@fungi.computer/oyster 0.0.1 → 0.2.0

package/dist/app-builds.js

@@ -5,43 +5,72 @@
  * A build runs the shared job lifecycle (`build/build-jobs.ts`) and the fixed
  * captured builder command on one Computer. The Computer holds no key: its
  * clone is admitted at egress for exactly the job's one repository (read
- * only), and its candidate upload for exactly the job. The candidate is
- * written to the Release bucket by the shared R2 writer, verified like any
- * installed Release, and recorded here; installing it is a separate owner act.
+ * only), and its candidate upload for exactly the job. A source is either a
+ * repository in an installation's Git (a fork, through the Git door) or the
+ * App's own published template, built only at a recorded seed revision of
+ * its pinned recipe (no installed App is needed). The build streams each
+ * built object into the host's artifact store itself, through the egress, and
+ * then submits a small manifest naming them. This owner only records facts:
+ * it checks each named object's stored size and digest, writes the asset
+ * manifest and App root in Oyster's one immutable artifact representation
+ * (the same objects a packed upload writes), verifies the Release like any
+ * installed one, and records it; installing it is a separate owner act.
  */
-import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
 import { parseArtifactRef, parseReleaseId, } from "@fungi.computer/puffball";
 import { appIdSchema, releaseSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
-import { capturedPinnedRecipeSchema, commitPreparedCandidate, digestPinnedRecipe, } from "./build/effect.js";
-import { encodeTeamAppCandidateSubmission, } from "./build/submission-contract.js";
+import { capturedPinnedRecipeSchema, digestPinnedRecipe, fitsPinnedRecipe, pinnedRecipeObjectBound, } from "./build/effect.js";
+import { candidateManifestObjects, decodeCandidateBackend, digestTeamAppCandidateManifest, } from "./build/submission-contract.js";
+import { contentObjectRef } from "./build/content-objects.js";
 import { createTeamBuildPublisher, teamAppBuildCommand, } from "./build/build-jobs.js";
-import { createR2ArtifactWriter, } from "./build/r2-artifact-writer.js";
+import { writeArtifactRoot, } from "./build/artifact-writer.js";
 import { buildGitPassPrefix } from "./git-auth.js";
-import { verifyRelease } from "./release.js";
-/** A Computer's whole-build budget: a cold standard-2 build measured 185-270 s. */
+import { defaultAssetPolicy, readVerified, verifyRelease, } from "./release.js";
+import { appForTemplateRepository, templateRepositoryForApp, } from "./source/template-repository.js";
+/** A Computer's whole-build budget: a cold build on a 6 GiB Computer measured 185-270 s. */
 export const oysterAppBuildTimeoutMs = 900_000;
 /** The job, its clone admission and its upload grant end together. */
 const jobTtlMs = oysterAppBuildTimeoutMs + 5 * 60_000;
 /** Host names the Computer's egress serves for a build; never public hosts. */
 export const oysterBuildGitHost = "git.team.internal";
 export const oysterBuildReportHost = "build.team.internal";
-/** An App's registered build source: one repository and its pinned recipe. */
+/** Where an App's source is cloned from. */
+export const oysterBuildLocationSchema = Schema.Union([
+    Schema.Struct({
+        kind: Schema.Literal("installation"),
+        /** The installation whose Git holds the repository (Bonsai for a fork). */
+        installationId: Schema.String.check(Schema.isPattern(/^[a-zA-Z0-9_-]{1,256}$/u)),
+        repository: Schema.String.check(Schema.isPattern(/^[a-zA-Z0-9._-]{1,128}$/u)),
+    }),
+    /** The App's own published template (`templateRepositoryForApp`). */
+    Schema.Struct({ kind: Schema.Literal("template") }),
+]);
+/** An App's registered build source: where it is cloned and its pinned recipe. */
 export const oysterBuildSourceSchema = Schema.Struct({
     appId: appIdSchema,
-    /** The installation whose Git holds the repository (Bonsai for a fork). */
-    installationId: Schema.String.check(Schema.isPattern(/^[a-zA-Z0-9_-]{1,256}$/u)),
-    repository: Schema.String.check(Schema.isPattern(/^[a-zA-Z0-9._-]{1,128}$/u)),
+    location: oysterBuildLocationSchema,
     recipe: capturedPinnedRecipeSchema,
     buildRecipeDigest: sha256DigestSchema,
 });
+/** One Computer as the build owner reaches it. */
+/** The Computer established no terminal result for a build command, for
+ * example because its connection to the container dropped mid-command. */
+class BuildOutcomeUnknown extends Error {
+    constructor() {
+        super("Build outcome unknown");
+    }
+}
+/** The repository a job clones: its installation repository, or its App's template. */
+const cloneRepository = (job) => job.location.kind === "installation"
+    ? job.location.repository
+    : templateRepositoryForApp(job.app_id);
 const jobRow = Schema.Struct({
     job_id: Schema.String,
     app_id: Schema.String,
     release_id: Schema.String,
     source_revision: Schema.String,
-    installation_id: Schema.String,
-    repository: Schema.String,
+    /** The job's clone location, as its source named it when the job started. */
+    location: Schema.fromJsonString(oysterBuildLocationSchema),
     recipe: Schema.String,
     recipe_digest: Schema.String,
     requested_by: Schema.String,
@@ -61,6 +90,7 @@ const releaseRow = Schema.Struct({ release: Schema.String });
 const sourceCodec = Schema.fromJsonString(oysterBuildSourceSchema);
 const releaseCodec = Schema.fromJsonString(releaseSchema);
 const recipeCodec = Schema.fromJsonString(capturedPinnedRecipeSchema);
+const locationCodec = Schema.fromJsonString(oysterBuildLocationSchema);
 /** Unguessable hex identity from the platform CSPRNG. */
 function randomHex(bytes) {
     return Array.from(crypto.getRandomValues(new Uint8Array(bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
@@ -77,24 +107,75 @@ function sameDigest(left, right) {
         difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
     return difference === 0;
 }
-/** The SQLite tables one Oyster build owner keeps. */
+/**
+ * The SQLite tables one Oyster build owner keeps. Creation and any carrying
+ * forward of retained facts run as one transaction of the owner's storage, so
+ * an interrupted conversion leaves the facts as they were for a retry.
+ */
 export function migrateOysterAppBuilds(owner) {
-    owner.exec("CREATE TABLE IF NOT EXISTS oyster_build_sources (app_id TEXT PRIMARY KEY, source TEXT NOT NULL) STRICT");
-    owner.exec(`CREATE TABLE IF NOT EXISTS oyster_build_jobs (
+    const { sql } = owner;
+    owner.transactionSync(() => {
+        sql.exec("CREATE TABLE IF NOT EXISTS oyster_build_sources (app_id TEXT PRIMARY KEY, source TEXT NOT NULL) STRICT");
+        // Sources recorded before the location union named only an installation
+        // repository; carry each forward once, in place.
+        sql.exec(`UPDATE oyster_build_sources SET source = json_set(
+       json_remove(source, '$.installationId', '$.repository'), '$.location',
+       json_object('kind', 'installation',
+         'installationId', json_extract(source, '$.installationId'),
+         'repository', json_extract(source, '$.repository')))
+     WHERE json_type(source, '$.location') IS NULL`);
+        const jobColumns = `
       job_id TEXT PRIMARY KEY, app_id TEXT NOT NULL, release_id TEXT NOT NULL UNIQUE,
-      source_revision TEXT NOT NULL, installation_id TEXT NOT NULL, repository TEXT NOT NULL,
+      source_revision TEXT NOT NULL, location TEXT NOT NULL,
       recipe TEXT NOT NULL, recipe_digest TEXT NOT NULL, requested_by TEXT NOT NULL,
       credential_id TEXT NOT NULL, upload_grant_digest TEXT NOT NULL,
       status TEXT NOT NULL, artifact_digest TEXT, artifact_bytes INTEGER, detail TEXT,
-      issued_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, executable_until INTEGER NOT NULL
-    ) STRICT`);
-    owner.exec("CREATE TABLE IF NOT EXISTS oyster_build_releases (release_id TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE, release TEXT NOT NULL) STRICT");
+      issued_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, executable_until INTEGER NOT NULL`;
+        sql.exec(`CREATE TABLE IF NOT EXISTS oyster_build_jobs (${jobColumns}) STRICT`);
+        // Jobs recorded before the location union named an installation repository
+        // in two columns; carry each into the one location column, once.
+        if (sql
+            .exec("SELECT name FROM pragma_table_info('oyster_build_jobs') WHERE name='installation_id'")
+            .toArray().length > 0) {
+            sql.exec(`CREATE TABLE oyster_build_jobs_current (${jobColumns}) STRICT`);
+            sql.exec(`INSERT INTO oyster_build_jobs_current SELECT job_id, app_id, release_id,
+         source_revision,
+         json_object('kind', 'installation', 'installationId', installation_id,
+           'repository', repository),
+         recipe, recipe_digest, requested_by, credential_id, upload_grant_digest,
+         status, artifact_digest, artifact_bytes, detail, issued_at, expires_at,
+         executable_until
+       FROM oyster_build_jobs`);
+            sql.exec("DROP TABLE oyster_build_jobs");
+            sql.exec("ALTER TABLE oyster_build_jobs_current RENAME TO oyster_build_jobs");
+        }
+        sql.exec("CREATE TABLE IF NOT EXISTS oyster_build_releases (release_id TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE, release TEXT NOT NULL) STRICT");
+    });
 }
-/** The build owner over one tenant's SQLite, Computer and Release bucket. */
+/** The build owner over one tenant's SQLite, Computer and artifact store. */
 export function createOysterAppBuilds(options) {
     const { owner } = options;
     const now = options.now ?? Date.now;
-    migrateOysterAppBuilds(owner.sql);
+    // The host store overwrites on put, so write-once is checked here first.
+    const storeObjects = {
+        async create(artifactRef, bytes) {
+            if ((await options.artifacts.get(artifactRef)) !== null)
+                return "exists";
+            await options.artifacts.put(artifactRef, bytes);
+            return "created";
+        },
+        read: (artifactRef) => options.artifacts.get(artifactRef),
+    };
+    migrateOysterAppBuilds(owner);
+    // A job outlives the owner instance that started it: the Computer keeps
+    // building and its own reports (objects, candidate, status) settle the
+    // job, so an owner restart must not fail it. A job that reaches its expiry
+    // without a result can never settle, so it fails then instead of reading
+    // as running for as long as anyone asks.
+    const expire = () => owner.sql.exec("UPDATE oyster_build_jobs SET status='failed', detail=? WHERE status='running' AND expires_at<=?", "Build expired without a result", now());
+    expire();
+    const decodeRecipe = (recipe) => Schema.decodeUnknownSync(recipeCodec)(recipe);
+    const grantAdmits = async (job, grant) => sameDigest(job.upload_grant_digest, await sha256Hex(new TextEncoder().encode(grant)));
     const readJob = (jobId) => {
         const [row] = owner.sql
             .exec("SELECT * FROM oyster_build_jobs WHERE job_id=?", jobId)
@@ -115,9 +196,11 @@ export function createOysterAppBuilds(options) {
         computerId: options.computer.name,
         credentialId: job.credential_id,
         issuedAt: job.issued_at,
-        repository: job.repository,
+        repository: cloneRepository(job),
         expiresAt: job.expires_at,
-        remote: `https://${oysterBuildGitHost}/git/${job.installation_id}/${job.repository}.git`,
+        remote: job.location.kind === "installation"
+            ? `https://${oysterBuildGitHost}/git/${job.location.installationId}/${job.location.repository}.git`
+            : `https://${oysterBuildGitHost}/${cloneRepository(job)}.git`,
         reportUrl: `https://${oysterBuildReportHost}/jobs/${job.job_id}`,
         status: job.status,
         artifact: job.artifact_digest === null || job.artifact_bytes === null
@@ -165,11 +248,16 @@ export function createOysterAppBuilds(options) {
                 owner.sql.exec("UPDATE oyster_build_jobs SET executable_until=? WHERE job_id=?", decision.status === "allowed" ? decision.expiresAt : 0, decision.jobId);
                 return Promise.resolve();
             },
-            execute: (input) => options.computer.port.runBuild({
-                jobId: input.jobId,
-                command: input.command,
-                timeoutMs: input.timeoutMs,
-            }),
+            execute: async (input) => {
+                const result = await options.computer.port.runBuild({
+                    jobId: input.jobId,
+                    command: input.command,
+                    timeoutMs: input.timeoutMs,
+                });
+                if (result.output === undefined || result.output === null)
+                    throw new BuildOutcomeUnknown();
+                return result;
+            },
             deliverTeamGitEvents: () => Promise.resolve(0),
         }),
     });
@@ -190,7 +278,10 @@ export function createOysterAppBuilds(options) {
             });
         }
         catch (cause) {
-            settle(jobId, "failed", cause instanceof Error ? cause.message : "Build failed");
+            // Without a terminal result the build may still be running on the
+            // Computer; its own reports settle the job, or its expiry fails it.
+            if (!(cause instanceof BuildOutcomeUnknown))
+                settle(jobId, "failed", cause instanceof Error ? cause.message : "Build failed");
         }
         return view(required(jobId));
     };
@@ -214,6 +305,8 @@ export function createOysterAppBuilds(options) {
         readSource,
         /**
          * Mint one build job for an App's registered source at one exact commit.
+         * A template source builds only a seed revision recorded for its pinned
+         * recipe.
          * Answers the job and its one run, which the caller keeps alive (the
          * upload grant exists only inside that run's fixed command).
          */
@@ -222,19 +315,25 @@ export function createOysterAppBuilds(options) {
             const source = readSource(input.appId);
             if (source === null)
                 throw new Error("App has no build source");
+            if (source.location.kind === "template") {
+                const receipt = await options.templates.read(source.appId, sourceRevision);
+                if (receipt?.buildRecipeDigest !== source.buildRecipeDigest)
+                    throw new Error("Revision is not a seed of this App's template");
+            }
             const jobId = `build_${randomHex(16)}`;
             const releaseId = parseReleaseId(`rel_${sourceRevision.slice("git:".length, "git:".length + 12)}${randomHex(4)}`);
             const uploadGrant = randomHex(32);
             const issuedAt = now();
-            owner.sql.exec(`INSERT INTO oyster_build_jobs(job_id, app_id, release_id, source_revision, installation_id,
-          repository, recipe, recipe_digest, requested_by, credential_id, upload_grant_digest,
+            owner.sql.exec(`INSERT INTO oyster_build_jobs(job_id, app_id, release_id, source_revision, location,
+          recipe, recipe_digest, requested_by, credential_id, upload_grant_digest,
           status, artifact_digest, artifact_bytes, detail, issued_at, expires_at, executable_until)
-        VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', NULL, NULL, NULL, ?, ?, 0)`, jobId, source.appId, releaseId, sourceRevision, source.installationId, source.repository, Schema.encodeUnknownSync(recipeCodec)(source.recipe), source.buildRecipeDigest, input.requestedBy, randomHex(32), await sha256Hex(new TextEncoder().encode(uploadGrant)), issuedAt, issuedAt + jobTtlMs);
+        VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', NULL, NULL, NULL, ?, ?, 0)`, jobId, source.appId, releaseId, sourceRevision, Schema.encodeUnknownSync(locationCodec)(source.location), Schema.encodeUnknownSync(recipeCodec)(source.recipe), source.buildRecipeDigest, input.requestedBy, randomHex(32), await sha256Hex(new TextEncoder().encode(uploadGrant)), issuedAt, issuedAt + jobTtlMs);
             // The grant leaves this owner only inside the fixed command.
             const command = teamAppBuildCommand({ appId: source.appId, sourceRevision, source }, uploadGrant);
             return { build: view(required(jobId)), run: () => run(jobId, command) };
         },
         read(jobId) {
+            expire();
             const job = readJob(jobId);
             return job === null ? null : view(job);
         },
@@ -270,7 +369,9 @@ export function createOysterAppBuilds(options) {
                 target.scope !== "read")
                 return null;
             const job = owner.sql
-                .exec("SELECT * FROM oyster_build_jobs WHERE installation_id=? AND repository=? AND status='running' AND expires_at>? ORDER BY issued_at DESC LIMIT 1", target.installationId, target.repository, now())
+                .exec(`SELECT * FROM oyster_build_jobs WHERE json_extract(location, '$.kind')='installation'
+            AND json_extract(location, '$.installationId')=? AND json_extract(location, '$.repository')=?
+            AND status='running' AND expires_at>? ORDER BY issued_at DESC LIMIT 1`, target.installationId, target.repository, now())
                 .toArray()
                 .map((row) => decodeJob(row))[0];
             return job === undefined
@@ -284,12 +385,29 @@ export function createOysterAppBuilds(options) {
                 return null;
             const job = readJob(match[1] ?? "");
             return live(job) &&
+                job.location.kind === "installation" &&
                 sameDigest(job.credential_id, match[2] ?? "") &&
-                job.installation_id === target.installationId &&
-                job.repository === target.repository
+                job.location.installationId === target.installationId &&
+                job.location.repository === target.repository
                 ? { requestedBy: job.requested_by }
                 : null;
         },
+        /**
+         * May this Computer's clone read this template repository now? Only while
+         * a live template job on this Computer names it.
+         */
+        admitTemplateClone(computerObjectId, repository) {
+            if (computerObjectId !== options.computer.objectId)
+                return false;
+            // The template repository names exactly one App (templateRepositoryForApp).
+            const appId = appForTemplateRepository(repository);
+            if (appId === null)
+                return false;
+            return (owner.sql
+                .exec(`SELECT 1 FROM oyster_build_jobs WHERE app_id=? AND json_extract(location, '$.kind')='template'
+              AND status='running' AND expires_at>? LIMIT 1`, appId, now())
+                .toArray().length > 0);
+        },
         /** A reported artifact or status for a live job. */
         record(event) {
             const job = readJob(event.jobId);
@@ -302,42 +420,68 @@ export function createOysterAppBuilds(options) {
                 settle(event.jobId, event.status, event.detail);
         },
         /**
-         * The Computer's candidate for a live job: checked against the job, written
-         * by the shared R2 writer, verified as an installable Release and recorded.
+         * May this live job's build upload one object now, and how large? The
+         * grant is the one inside the job's fixed command; the bound is its
+         * recipe's (`pinnedRecipeObjectBound`).
          */
-        async submitCandidate(jobId, candidate, grant, credentialId) {
+        async admitObjectUpload(jobId, computerObjectId, grant) {
+            const job = readJob(jobId);
+            if (computerObjectId !== options.computer.objectId ||
+                !live(job) ||
+                !(await grantAdmits(job, grant)))
+                return null;
+            return {
+                maxObjectBytes: pinnedRecipeObjectBound(decodeRecipe(job.recipe)),
+            };
+        },
+        /**
+         * The Computer's candidate manifest for a live job: checked against the
+         * job and its pinned recipe, each named object found stored with its
+         * size and verified digest (one at a time; only the backend descriptor
+         * is read), its asset manifest and App root written, verified as an
+         * installable Release and recorded. An over-policy candidate stores
+         * nothing.
+         */
+        async submitCandidate(jobId, manifest, grant, credentialId) {
             const job = readJob(jobId);
             if (!live(job) ||
                 job.credential_id !== credentialId ||
-                !sameDigest(job.upload_grant_digest, await sha256Hex(new TextEncoder().encode(grant))))
+                !(await grantAdmits(job, grant)))
                 return new Response(null, { status: 403 });
-            if (candidate.appId !== job.app_id ||
-                candidate.provenance.sourceRevision !== job.source_revision ||
-                candidate.provenance.buildRecipeDigest !== job.recipe_digest)
+            if (manifest.appId !== job.app_id ||
+                manifest.provenance.sourceRevision !== job.source_revision ||
+                manifest.provenance.buildRecipeDigest !== job.recipe_digest)
                 return new Response(null, { status: 409 });
             if (readRelease(jobId) !== null)
                 return new Response(null, { status: 409 });
-            const recipe = Schema.decodeUnknownSync(recipeCodec)(job.recipe);
-            const digest = await sha256Hex(new TextEncoder().encode(encodeTeamAppCandidateSubmission(candidate)));
-            const writerOptions = {
-                bucket: options.bucket,
-                artifactRef: parseArtifactRef(`artifact:sha256-${digest}`),
-                policy: {
-                    maxBytes: recipe.maxOutputBytes,
-                    maxManifestBytes: recipe.assets?.maxManifestBytes ?? 1024 * 1024,
-                },
-            };
-            if (recipe.assets !== undefined)
-                writerOptions.assets = recipe.assets;
+            const recipe = decodeRecipe(job.recipe);
             let release;
             try {
-                release = await Effect.runPromise(commitPreparedCandidate({ ...candidate, releaseId: parseReleaseId(job.release_id) }, {
-                    artifactWriter: createR2ArtifactWriter(writerOptions),
-                    releaseCatalog: {
-                        createRelease: (value) => Promise.resolve(value),
+                if (!fitsPinnedRecipe(manifest.output, recipe))
+                    throw new Error("Candidate exceeds its pinned recipe");
+                for (const object of candidateManifestObjects(manifest.output)) {
+                    const head = await options.artifacts.head(contentObjectRef(object.digest));
+                    if (head?.byteLength !== object.byteLength ||
+                        head.digest !== object.digest)
+                        throw new Error("Candidate object is not stored as named");
+                }
+                if (manifest.output.kind !== "ui")
+                    decodeCandidateBackend(await readVerified(options.artifacts, contentObjectRef(manifest.output.backend.digest), manifest.output.backend.digest));
+                const root = await writeArtifactRoot(manifest.output, storeObjects, {
+                    rootArtifactRef: parseArtifactRef(`artifact:sha256-${await digestTeamAppCandidateManifest(manifest)}`),
+                    assetPolicy: recipe.assets,
+                });
+                release = Schema.decodeUnknownSync(releaseSchema)({
+                    releaseId: job.release_id,
+                    appId: manifest.appId,
+                    artifact: {
+                        artifactRef: root.artifactRef,
+                        artifactDigest: root.artifactDigest,
+                        provenance: manifest.provenance,
                     },
-                }));
-                await verifyRelease(options.artifacts, release);
+                });
+                // Each object was checked by its stored digest above.
+                await verifyRelease(options.artifacts, release, defaultAssetPolicy, false);
             }
             catch {
                 settle(jobId, "failed", "Candidate could not be stored as a Release");

package/dist/app-sources.d.ts

@@ -22,25 +22,10 @@ export declare function createOysterArtifactsRepositoryMetadataStore(sql: Watchd
  * writes (`services/app-publisher/src/source-git.ts`), scoped to Oyster's own
  * Artifacts composition since a package cannot depend on that service. */
 export declare function exchangeOysterTemplateGit(artifacts: Pick<Artifacts, "exchangeGit">, remote: string, repository: string, request: Request, permission?: "read" | "write"): Promise<Response>;
-/** Seed Oyster's own template source from the operator owner route, over the
- * durable receipts and the Artifacts composition for this Oyster. */
-export declare function publishOysterAppSource(receipts: PublisherTemplateSeedReceipts, artifacts: Pick<Artifacts, "ensureRepository" | "exchangeGit">, rawAppId: string, request: Request): Promise<{
-    readonly kind: "invalid" | "too-large";
-    readonly receipt?: undefined;
-} | {
-    readonly kind: "conflict";
-    readonly receipt?: undefined;
-} | {
-    readonly kind: "recorded" | "existing";
-    readonly receipt: {
-        readonly appId: import("@fungi.computer/puffball").AppId;
-        readonly repository: string;
-        readonly sourceRevision: import("@fungi.computer/puffball").SourceRevision;
-        readonly sourceTreeDigest: import("@fungi.computer/puffball").Sha256Digest;
-        readonly seedRevision: import("@fungi.computer/puffball").SourceRevision;
-        readonly buildRecipeDigest: import("@fungi.computer/puffball").Sha256Digest;
-    };
-} | {
-    readonly kind: "unavailable";
-    readonly receipt?: undefined;
-}>;
+/** The operator's smart-HTTP door to one App's template repository: an
+ * ordinary `git push` (or the fetch before it) to
+ * `<base>/<suffix>` reaches `template-<app>` through the same admitted
+ * Artifacts exchange, which streams both bodies and holds every provider
+ * credential. An advertisement first opens the repository, so a fresh Oyster's
+ * first seed creates it. Admission (the owner) is the caller's. */
+export declare function exchangeOysterTemplateSource(artifacts: Pick<Artifacts, "ensureRepository" | "exchangeGit">, rawAppId: string, suffix: string, request: Request): Promise<Response>;

package/dist/app-sources.js

@@ -4,7 +4,8 @@ import { appIdSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.c
 import { teamAppPublisherRegistrationSchema, } from "@fungi.computer/puffball/publisher";
 import { capturedPinnedRecipeSchema, digestPinnedRecipe, } from "./build-contract.js";
 import { sameReceipt, seedReceiptInputSchema, templateRepositoryForApp, } from "./source/index.js";
-import { seedPublisherTemplate, } from "./source/template-write.js";
+import { smartHttpExchange } from "./git-door.js";
+import { parseAppId } from "@fungi.computer/puffball";
 /**
  * Oyster's own storage for App source templates, Team-owned fork
  * registrations and the recorded Artifacts repository metadata their fork
@@ -207,20 +208,21 @@ export function createOysterArtifactsRepositoryMetadataStore(sql) {
             initialToken: decoded.initial_token,
         }));
     };
-    const read = async (name) => {
-        if ((await readPending(name)) !== null)
-            return null;
+    /** The active row alone; activation checks its own promotion with this. */
+    const readActive = (name) => {
         const row = sql
             .exec(`SELECT repository_name, provider_id, default_branch, remote,
                 parent_repository
          FROM oyster_artifacts_repositories WHERE repository_name = ?`, name)
             .toArray()[0];
-        return row === undefined
+        return Promise.resolve(row === undefined
             ? null
             : metadataFromRow(Schema.decodeUnknownSync(repositoryRowSchema, {
                 onExcessProperty: "error",
-            })(row));
+            })(row)));
     };
+    /** Public reads hide a repository while its initial token is pending. */
+    const read = async (name) => (await readPending(name)) === null ? readActive(name) : null;
     return Object.freeze({
         read,
         readPending,
@@ -253,7 +255,7 @@ export function createOysterArtifactsRepositoryMetadataStore(sql) {
           FROM oyster_artifacts_repositories_pending
           WHERE repository_name = ? AND provider_id = ? AND default_branch = ?
             AND remote = ? AND parent_repository IS ? AND initial_token = ?`, metadata.name, metadata.id, metadata.defaultBranch, metadata.remote, metadata.parentRepository, initialToken);
-            const active = await read(metadata.name);
+            const active = await readActive(metadata.name);
             if (active === null || !sameMetadata(active, metadata))
                 throw new Error("Oyster Artifacts metadata conflicts");
             sql.exec(`DELETE FROM oyster_artifacts_repositories_pending
@@ -324,12 +326,45 @@ export async function exchangeOysterTemplateGit(artifacts, remote, repository, r
         headers: { "Content-Type": type, "Cache-Control": "no-store" },
     });
 }
-/** Seed Oyster's own template source from the operator owner route, over the
- * durable receipts and the Artifacts composition for this Oyster. */
-export function publishOysterAppSource(receipts, artifacts, rawAppId, request) {
-    const transport = {
-        ensureRepository: (name) => artifacts.ensureRepository(name),
-        exchangeTemplateGit: (repository, templateRequest) => exchangeOysterTemplateGit(artifacts, `https://git.team.internal/${repository}.git`, repository, templateRequest, "write"),
+/** The operator's smart-HTTP door to one App's template repository: an
+ * ordinary `git push` (or the fetch before it) to
+ * `<base>/<suffix>` reaches `template-<app>` through the same admitted
+ * Artifacts exchange, which streams both bodies and holds every provider
+ * credential. An advertisement first opens the repository, so a fresh Oyster's
+ * first seed creates it. Admission (the owner) is the caller's. */
+export async function exchangeOysterTemplateSource(artifacts, rawAppId, suffix, request) {
+    let appId;
+    try {
+        appId = parseAppId(rawAppId);
+    }
+    catch {
+        return new Response("Not an App", { status: 404 });
+    }
+    const url = new URL(request.url);
+    const exchange = smartHttpExchange(request.method, url, suffix);
+    if (exchange === null)
+        return new Response("Not a git route", { status: 404 });
+    // The provider exchange carries no content coding; refuse rather than corrupt.
+    if (request.headers.has("content-encoding"))
+        return new Response("Compressed Git requests are not supported", {
+            status: 400,
+        });
+    const repository = templateRepositoryForApp(appId);
+    if (exchange.advertise)
+        await artifacts.ensureRepository(repository);
+    const headers = new Headers();
+    for (const name of ["content-type", "accept", "git-protocol"]) {
+        const value = request.headers.get(name);
+        if (value !== null)
+            headers.set(name, value);
+    }
+    const init = {
+        method: request.method,
+        headers,
+        body: exchange.advertise ? null : request.body,
+        signal: request.signal,
     };
-    return seedPublisherTemplate(receipts, transport, rawAppId, request);
+    if (init.body !== null)
+        Object.assign(init, { duplex: "half" });
+    return exchangeOysterTemplateGit(artifacts, `https://git.team.internal/${repository}.git`, repository, new Request(`https://git.team.internal/${repository}.git/${suffix}${url.search}`, init), "write");
 }

package/dist/apps/gate.d.ts

@@ -10,7 +10,7 @@ export type HostPrincipal = Readonly<{
     role: "owner" | "member" | null;
 }>;
 /** Requests select existing SDK methods, opaque backend calls and derived operation identities. */
-export declare const gateRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+export declare const gateRequestSchema: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"method">;
     name: z.ZodString;
     input: z.ZodUnknown;
@@ -22,7 +22,7 @@ export declare const gateRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"capability-route">;
-    capability: z.ZodPipe<z.ZodUnknown, z.ZodTransform<"agent.list" | "agent.manage" | "agent.rename" | "agent.toolPolicy" | "agent.read" | "agent.send" | "computer.list" | "computer.readFile" | "computer.writeFile" | "computer.execute" | "llm.generation" | "media.generation" | "games:servers" | "git.repository" | "apps.open" | "apps.call" | "app.storage" | "app.events.emit" | "team.workbenchHost" | "marketplace.browse" | "marketplace.purchase" | "workflow.run" | "workflow.publish" | "workflow.arm" | "world" | "channels.read" | "channels.personal.manage", unknown>>;
+    capability: z.ZodPipe<z.ZodUnknown, z.ZodTransform<"agent.list" | "agent.manage" | "agent.rename" | "agent.avatar" | "agent.toolPolicy" | "agent.read" | "agent.send" | "computer.list" | "computer.readFile" | "computer.writeFile" | "computer.execute" | "llm.generation" | "media.generation" | "games:servers" | "git.repository" | "apps.open" | "apps.call" | "app.storage" | "app.events.emit" | "team.workbenchHost" | "marketplace.browse" | "marketplace.purchase" | "workflow.run" | "workflow.publish" | "workflow.arm" | "world" | "channels.read" | "channels.personal.manage", unknown>>;
     operation: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"binding">;
@@ -32,7 +32,7 @@ export declare const gateRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"list-tools">;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"backend">;
-}, z.core.$strict>], "kind">;
+}, z.core.$strict>], "kind">>;
 /** One decoded method, route, binding or catalog admission request. */
 export type GateRequest = z.output<typeof gateRequestSchema>;
 /** Immutable values the host already read; resource/grantor freshness remains host-owned. */
@@ -49,16 +49,16 @@ export type GateFacts = Readonly<{
     }>;
 }>;
 /** Binding grants have the exact S2 InvocationFacts shape and its maintained registry grammar. */
-export declare const invocationGrantsSchema: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+export declare const invocationGrantsSchema: z.ZodLazy<z.ZodReadonly<z.ZodArray<z.ZodObject<{
     binding: z.ZodPipe<z.ZodUnknown, z.ZodTransform<"BACKGROUND" | "GIT" | "EVENTS" | "APPS" | "WORKFLOWS" | "APP_STORAGE" | "MEDIA" | "COMPUTER" | "INBOX" | "AGENTS", unknown>>;
     operations: z.ZodReadonly<z.ZodArray<z.ZodString>>;
-}, z.core.$strict>>>;
+}, z.core.$strict>>>>;
 /** The explicit binding ceiling passed to an invocation frame. */
 export type InvocationGrants = z.output<typeof invocationGrantsSchema>;
 /** A declared method from the canonical Puffball API grammar. */
 export type AppMethodDeclaration = AppApi["methods"][string];
 /** Ordered, closed refusal vocabulary; external methods always require approval. */
-export declare const gateRefusalSchema: z.ZodObject<{
+export declare const gateRefusalSchema: z.ZodLazy<z.ZodObject<{
     kind: z.ZodLiteral<"refused">;
     code: z.ZodEnum<{
         unavailable: "unavailable";
@@ -71,7 +71,7 @@ export declare const gateRefusalSchema: z.ZodObject<{
         invalid_input: "invalid_input";
         visitor_read_only: "visitor_read_only";
     }>;
-}, z.core.$strict>;
+}, z.core.$strict>>;
 /** Either an admitted scoped ceiling or one closed refusal code. */
 export type GateDecision = Readonly<{
     kind: "admitted";

package/dist/apps/gate.js

@@ -8,7 +8,7 @@ import { appToolAccessSchema } from "./tools.js";
 import { ownerCodec, } from "./installation.js";
 const bindingNameSchema = ownerCodec(Schema.Literals(Object.values(appBackendBindingKinds).map((kind) => kind.name)));
 /** Requests select existing SDK methods, opaque backend calls and derived operation identities. */
-export const gateRequestSchema = z.discriminatedUnion("kind", [
+export const gateRequestSchema = z.lazy(() => z.discriminatedUnion("kind", [
     z.strictObject({
         kind: z.literal("method"),
         name: z.string(),
@@ -27,9 +27,9 @@ export const gateRequestSchema = z.discriminatedUnion("kind", [
     }),
     z.strictObject({ kind: z.literal("list-tools") }),
     z.strictObject({ kind: z.literal("backend") }),
-]);
+]));
 /** Binding grants have the exact S2 InvocationFacts shape and its maintained registry grammar. */
-export const invocationGrantsSchema = z
+export const invocationGrantsSchema = z.lazy(() => z
     .array(z.strictObject({
     binding: bindingNameSchema,
     operations: z.array(z.string().min(1)).readonly(),
@@ -38,9 +38,9 @@ export const invocationGrantsSchema = z
     name: grant.binding,
     operations: grant.operations,
 }))), "Invalid declared binding operations")
-    .readonly();
+    .readonly());
 /** Ordered, closed refusal vocabulary; external methods always require approval. */
-export const gateRefusalSchema = z.strictObject({
+export const gateRefusalSchema = z.lazy(() => z.strictObject({
     kind: z.literal("refused"),
     code: z.enum([
         "unavailable",
@@ -53,7 +53,7 @@ export const gateRefusalSchema = z.strictObject({
         "invalid_input",
         "visitor_read_only",
     ]),
-});
+}));
 /** Intersect stored approvals with the current verified Release without widening resource selectors. */
 export function grantsFor(installation, declaration, snapshot, capability) {
     if (installation.status !== "enabled" ||