@fungi.computer/oyster 0.0.1 → 0.2.0

package/dist/tenancy/registry.js

@@ -0,0 +1,138 @@
+import { checkedOrigin, immutable, createMemberId, membershipVersionSchema, } from "./registry-record.js";
+import * as Schema from "effect/Schema";
+import { tenantIdSchema } from "../tenant.js";
+/** In-memory tenant and member owner; create updates both atomically. */
+export function memoryRegistry(options = {}) {
+    const tenants = new Map();
+    const handles = new Map();
+    const domains = new Map();
+    const identities = new Map();
+    const memberships = new Map();
+    let revision = 0;
+    const nextRevision = () => {
+        revision = Schema.decodeUnknownSync(membershipVersionSchema)(revision + 1);
+        return revision;
+    };
+    const canonicalMember = (identity) => identities.get(identity.provider)?.get(identity.subject);
+    const retainMember = (identity, memberId) => {
+        let subjects = identities.get(identity.provider);
+        if (subjects === undefined) {
+            subjects = new Map();
+            identities.set(identity.provider, subjects);
+        }
+        const previous = subjects.get(identity.subject);
+        if (previous !== undefined && previous !== memberId)
+            throw new Error("Identity already has a canonical member mapping");
+        subjects.set(identity.subject, memberId);
+    };
+    const insert = (tenant) => {
+        if (tenants.has(tenant.id) ||
+            handles.has(tenant.handle) ||
+            tenant.domains.some((domain) => domains.has(domain)))
+            throw new Error("Tenant identity, handle or domain already exists");
+        const stored = immutable(tenant);
+        tenants.set(tenant.id, stored);
+        handles.set(tenant.handle, tenant.id);
+        for (const domain of tenant.domains)
+            domains.set(domain, tenant.id);
+        return stored;
+    };
+    for (const tenant of options.tenants ?? []) {
+        Schema.decodeUnknownSync(tenantIdSchema)(tenant.id);
+        Schema.decodeUnknownSync(tenantIdSchema)(tenant.handle);
+        insert({ ...tenant, origin: checkedOrigin(tenant.origin, tenant.domains) });
+    }
+    for (const membership of options.memberships ?? []) {
+        if (!tenants.has(membership.tenantId))
+            throw new Error("Membership tenant does not exist");
+        retainMember(membership.identity, membership.memberId);
+        let entries = memberships.get(membership.tenantId);
+        if (entries === undefined) {
+            entries = new Map();
+            memberships.set(membership.tenantId, entries);
+        }
+        entries.set(membership.memberId, {
+            memberId: membership.memberId,
+            role: membership.role,
+            membershipVersion: nextRevision(),
+        });
+    }
+    const get = (id) => tenants.get(id) ?? null;
+    return {
+        get: (id) => Promise.resolve(get(id)),
+        byHandle(handle) {
+            const id = handles.get(handle);
+            return Promise.resolve(id === undefined ? null : get(id));
+        },
+        byDomain(host) {
+            const id = domains.get(host);
+            return Promise.resolve(id === undefined ? null : get(id));
+        },
+        status: (id) => Promise.resolve(get(id)?.status ?? null),
+        memberById(id, memberId) {
+            const member = memberships.get(id)?.get(memberId);
+            return Promise.resolve(member === undefined ? null : { ...member });
+        },
+        membershipOf(id, identity) {
+            const memberId = canonicalMember(identity);
+            return Promise.resolve(memberId === undefined
+                ? null
+                : (memberships.get(id)?.get(memberId) ?? null));
+        },
+        create(input) {
+            return Promise.resolve().then(() => {
+                const handle = Schema.decodeUnknownSync(tenantIdSchema)(input.handle);
+                const origin = checkedOrigin(input.origin, input.domains);
+                const id = handle;
+                const memberId = canonicalMember(input.owner) ?? createMemberId();
+                const tenant = {
+                    id,
+                    handle,
+                    origin,
+                    domains: [...input.domains],
+                    owners: [memberId],
+                    status: "active",
+                };
+                const stored = insert(tenant);
+                retainMember(input.owner, memberId);
+                memberships.set(id, new Map([
+                    [
+                        memberId,
+                        {
+                            memberId,
+                            role: "owner",
+                            membershipVersion: nextRevision(),
+                        },
+                    ],
+                ]));
+                return stored;
+            });
+        },
+        setStatus(id, status) {
+            const tenant = get(id);
+            if (tenant === null)
+                return Promise.reject(new Error("Tenant does not exist"));
+            if (tenant.status !== status) {
+                const membershipVersion = nextRevision();
+                for (const [memberId, membership] of memberships.get(id) ?? [])
+                    memberships
+                        .get(id)
+                        ?.set(memberId, { ...membership, membershipVersion });
+            }
+            tenants.set(id, immutable({ ...tenant, status }));
+            return Promise.resolve();
+        },
+        delete(id) {
+            const tenant = get(id);
+            if (tenant === null)
+                return Promise.resolve();
+            nextRevision();
+            tenants.delete(id);
+            handles.delete(tenant.handle);
+            memberships.delete(id);
+            for (const domain of tenant.domains)
+                domains.delete(domain);
+            return Promise.resolve();
+        },
+    };
+}

package/dist/tenancy/resolve.d.ts

@@ -0,0 +1,7 @@
+import type { ReadonlyTenantRegistry, TenantResolverAdapter } from "./contracts.js";
+/** Resolve a provisioned label immediately below a configured base hostname. */
+export declare function subdomain(baseDomain: string): TenantResolverAdapter<"origin">;
+/** Resolve a provisioned custom domain through the registry's domain index. */
+export declare function hosts(registry: ReadonlyTenantRegistry): TenantResolverAdapter<"origin">;
+/** Resolve provisioned path tenants for APIs; this resolver cannot host Oyster. */
+export declare function path(pattern: string): TenantResolverAdapter<"path">;

package/dist/tenancy/resolve.js

@@ -0,0 +1,64 @@
+import { match, parse } from "path-to-regexp";
+import * as Schema from "effect/Schema";
+import { tenantIdSchema } from "../tenant.js";
+/** Resolve a provisioned label immediately below a configured base hostname. */
+export function subdomain(baseDomain) {
+    const base = new URL(`https://${baseDomain}`);
+    if (base.host !== baseDomain.toLowerCase() ||
+        base.port !== "" ||
+        base.pathname !== "/" ||
+        base.search ||
+        base.hash ||
+        base.username ||
+        base.password ||
+        base.hostname.endsWith("."))
+        throw new TypeError("Configure a base hostname without credentials, path, port or trailing dot");
+    const suffix = `.${base.hostname}`;
+    return {
+        kind: "origin",
+        async resolve(url, registry) {
+            if (!url.hostname.endsWith(suffix))
+                return null;
+            const handle = url.hostname.slice(0, -suffix.length);
+            const parsed = Schema.decodeUnknownOption(tenantIdSchema)(handle);
+            if (parsed._tag === "None")
+                return null;
+            return (await registry.byHandle(handle))?.id ?? null;
+        },
+    };
+}
+/** Resolve a provisioned custom domain through the registry's domain index. */
+export function hosts(registry) {
+    return {
+        kind: "origin",
+        resolve: async (url) => (await registry.byDomain?.(url.host))?.id ?? null,
+    };
+}
+/** Resolve provisioned path tenants for APIs; this resolver cannot host Oyster. */
+export function path(pattern) {
+    const tokens = parse(pattern).tokens;
+    if (!tokens.some((token) => token.type === "param" && token.name === "tenant"))
+        throw new TypeError("A tenant path must contain the :tenant parameter");
+    const route = match(pattern, { end: false });
+    return {
+        kind: "path",
+        async resolve(url, registry) {
+            let result;
+            try {
+                result = route(url.pathname);
+            }
+            catch (cause) {
+                if (cause instanceof URIError)
+                    return null;
+                throw cause;
+            }
+            if (result === false)
+                return null;
+            const handle = result.params.tenant;
+            const parsed = Schema.decodeUnknownOption(tenantIdSchema)(handle);
+            if (parsed._tag === "None")
+                return null;
+            return (await registry.byHandle(parsed.value))?.id ?? null;
+        },
+    };
+}

package/dist/workers-git.js

@@ -773,10 +773,7 @@ const revokeKeySchema = Schema.Struct({
     keyId: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256)),
     requestId: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_.:-]{1,112}$/u)),
 });
-const oysterGrantsArraySchema = z
-    .array(oysterKeyVocabulary.grantSchema)
-    .min(1)
-    .max(64);
+const oysterGrantsArraySchema = z.lazy(() => z.array(oysterKeyVocabulary.grantSchema).min(1).max(64));
 function keySummary(record) {
     return {
         keyId: record.keyId,

package/dist/workers.d.ts

@@ -18,7 +18,7 @@ import { type BackgroundFrameState, type InvocationFacts, type InvocationFrame }
 import { type InstallationCommit, type InstanceResult, type OysterAuth, type OysterHost, type OysterJson } from "./host.js";
 import { type AppStorageResult, type AppStorageWrite, type AppStorageReset, type ResolvedAppStorage } from "@fungi.computer/agar/storage";
 import { type OysterRootDirectory } from "./root-data.js";
-import { type ArtifactStore } from "./release.js";
+import { type ArtifactHeads, type ArtifactStore } from "./release.js";
 import type { AppApi } from "@fungi.computer/puffball";
 import type { AppDeclaration } from "@fungi.computer/puffball/app";
 import { createOysterAppSourceReceipts, createOysterAppRegistrations, createOysterArtifactsRepositoryMetadataStore } from "./app-sources.js";
@@ -64,7 +64,7 @@ export type OysterWorkerEnv = Readonly<{
     LOADER: WorkerLoader;
 }>;
 /** Store Release artifacts in an R2 bucket. */
-export declare function r2ArtifactStore(bucket: R2Bucket): ArtifactStore;
+export declare function r2ArtifactStore(bucket: R2Bucket): ArtifactStore & ArtifactHeads;
 /** The installation registry: one SQLite-backed Durable Object per Oyster. */
 export declare class OysterRegistry extends DurableObject<OysterWorkerEnv> {
     #private;

package/dist/workers.js

@@ -30,12 +30,14 @@ import { storageFrameMethods } from "./storage-frame.js";
 import { catalogFrameMethods, oysterAppCatalog } from "./catalog-frame.js";
 import { appStorageKeyNameSchema, appStorageWriteSchema, appStorageResetSchema, } from "@fungi.computer/agar/storage";
 import { createOysterRootData } from "./root-data.js";
-import { backendCache, resolveBackend } from "./release.js";
+import { backendCache, resolveBackend, } from "./release.js";
+import { headContentObject } from "./build/content-objects.js";
 import { ensureAppSourceTables, createOysterAppSourceReceipts, createOysterAppRegistrations, createOysterArtifactsRepositoryMetadataStore, } from "./app-sources.js";
 export { r2FileSource, ownerKeyAuth };
 /** Store Release artifacts in an R2 bucket. */
 export function r2ArtifactStore(bucket) {
     return {
+        head: (artifactRef) => headContentObject(bucket, artifactRef),
         async get(artifactRef) {
             const object = await bucket.get(artifactRef);
             return object === null