@fungi.computer/oyster 0.0.1 → 0.2.0

package/package.json

@@ -1,17 +1,18 @@
 {
   "name": "@fungi.computer/oyster",
-  "version": "0.0.1",
+  "version": "0.2.0",
   "author": "Levi <levi@technomancy.dev>",
   "description": "Run your own Apps on Cloudflare Workers or celld: installable App Releases, each with its own Durable Object, SQLite database and declared bindings",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "oyster": "./dist/standalone/install-apps-cli.js"
+  },
   "files": [
     "dist",
     "docs/api",
-    "docs/media",
     "examples/standalone",
-    "examples/git",
     "docs/site/agent-quickstart.mdx",
     "README.md",
     "LICENSE"
@@ -63,6 +64,18 @@
       "types": "./dist/workers-git.d.ts",
       "import": "./dist/workers-git.js"
     },
+    "./standalone": {
+      "types": "./dist/standalone/worker.d.ts",
+      "import": "./dist/standalone/worker.js"
+    },
+    "./standalone/app-set": {
+      "types": "./dist/standalone/app-set.d.ts",
+      "import": "./dist/standalone/app-set.js"
+    },
+    "./standalone/media": {
+      "types": "./dist/standalone/media.d.ts",
+      "import": "./dist/standalone/media.js"
+    },
     "./event-recipients": {
       "types": "./dist/event-recipients.d.ts",
       "import": "./dist/event-recipients.js"
@@ -99,6 +112,10 @@
       "types": "./dist/shell/app-directory.d.ts",
       "import": "./dist/shell/app-directory.js"
     },
+    "./shell/workbench-directory": {
+      "types": "./dist/shell/workbench-directory.d.ts",
+      "import": "./dist/shell/workbench-directory.js"
+    },
     "./app-storage": {
       "types": "./dist/app-storage.d.ts",
       "import": "./dist/app-storage.js"
@@ -127,14 +144,14 @@
       "types": "./dist/app-builds.d.ts",
       "import": "./dist/app-builds.js"
     },
-    "./r2-artifact-writer": {
-      "types": "./dist/build/r2-artifact-writer.d.ts",
-      "import": "./dist/build/r2-artifact-writer.js"
-    },
     "./build-contract": {
       "types": "./dist/build-contract.d.ts",
       "import": "./dist/build-contract.js"
     },
+    "./build-egress": {
+      "types": "./dist/build-egress.d.ts",
+      "import": "./dist/build-egress.js"
+    },
     "./build-jobs": {
       "types": "./dist/build-jobs.d.ts",
       "import": "./dist/build-jobs.js"
@@ -143,9 +160,9 @@
       "types": "./dist/source/index.d.ts",
       "import": "./dist/source/index.js"
     },
-    "./source/template-write": {
-      "types": "./dist/source/template-write.d.ts",
-      "import": "./dist/source/template-write.js"
+    "./source/template-push": {
+      "types": "./dist/source/template-push.d.ts",
+      "import": "./dist/source/template-push.js"
     },
     "./app-sources": {
       "types": "./dist/app-sources.d.ts",
@@ -171,6 +188,34 @@
       "types": "./dist/tenant.d.ts",
       "import": "./dist/tenant.js"
     },
+    "./tenancy": {
+      "types": "./dist/tenancy/index.d.ts",
+      "import": "./dist/tenancy/index.js"
+    },
+    "./tenancy/resolve": {
+      "types": "./dist/tenancy/resolve.d.ts",
+      "import": "./dist/tenancy/resolve.js"
+    },
+    "./tenancy/cold-directory": {
+      "types": "./dist/tenancy/cold-directory.d.ts",
+      "import": "./dist/tenancy/cold-directory.js"
+    },
+    "./tenancy/registry": {
+      "types": "./dist/tenancy/registry.d.ts",
+      "import": "./dist/tenancy/registry.js"
+    },
+    "./tenancy/owner-key": {
+      "types": "./dist/tenancy/owner-key.d.ts",
+      "import": "./dist/tenancy/owner-key.js"
+    },
+    "./tenancy/auth0": {
+      "types": "./dist/tenancy/auth0.d.ts",
+      "import": "./dist/tenancy/auth0.js"
+    },
+    "./tenancy/cloudflare": {
+      "types": "./dist/tenancy/cloudflare.d.ts",
+      "import": "./dist/tenancy/cloudflare.js"
+    },
     "./auth": {
       "types": "./dist/auth.d.ts",
       "import": "./dist/auth.js"
@@ -197,21 +242,22 @@
     }
   },
   "dependencies": {
-    "@fungi.computer/cloudflare-worker-bundler": "0.2.3-fungi.0",
-    "@fungi.computer/agar": "0.0.1",
-    "@fungi.computer/burrow": "0.0.1",
+    "@fungi.computer/agar": "0.2.0",
+    "@fungi.computer/burrow": "0.0.2",
     "@fungi.computer/cairn": "0.0.1",
-    "@fungi.computer/ear-tag": "0.0.1",
-    "@fungi.computer/caps": "0.0.1",
+    "@fungi.computer/ear-tag": "0.0.2",
+    "@fungi.computer/caps": "0.1.0",
     "@fungi.computer/carrier": "0.0.1",
-    "@fungi.computer/forage": "0.0.1",
-    "@fungi.computer/gills": "0.0.1",
-    "@fungi.computer/knapsack": "0.0.1",
-    "@fungi.computer/mycelium": "0.0.1",
-    "@fungi.computer/puffball": "0.0.1",
-    "@fungi.computer/sigils": "0.0.1",
+    "@fungi.computer/forage": "0.1.0",
+    "@fungi.computer/gills": "0.1.0",
+    "@fungi.computer/knapsack": "0.1.0",
+    "@fungi.computer/mycelium": "0.1.0",
+    "@fungi.computer/puffball": "0.1.0",
+    "@fungi.computer/sigils": "0.1.0",
+    "@fungi.computer/sprite": "0.1.0",
+    "@fungi.computer/sprite-zdog": "0.1.0",
     "@fungi.computer/watchdog": "0.0.1",
-    "@fungi.computer/whistle": "0.0.1",
+    "@fungi.computer/whistle": "0.0.2",
     "@modelcontextprotocol/server": "2.0.0",
     "@pnpm/lockfile.fs": "1100.2.13",
     "@pnpm/lockfile.pruner": "1100.0.27",
@@ -220,12 +266,19 @@
     "esbuild": "0.28.2",
     "fast-json-stable-stringify": "2.1.0",
     "hono": "4.13.5",
-    "isomorphic-git": "1.42.2",
     "jose": "6.2.11",
-    "memfs": "4.80.0",
     "mime": "4.1.0",
     "path-to-regexp": "8.4.2",
-    "zod": "4.4.3"
+    "zod": "4.4.3",
+    "oauth4webapi": "3.8.8",
+    "@cfworker/json-schema": "4.1.1",
+    "@earendil-works/pi-ai": "0.99.2",
+    "@fungi.computer/braid": "0.1.0",
+    "@fungi.computer/computer": "0.1.0",
+    "@fungi.computer/darkroom": "0.1.0",
+    "@fungi.computer/shiitake": "0.2.0",
+    "@fungi.computer/veil": "0.1.0",
+    "@fungi.computer/workflows-wire": "0.1.0"
   },
   "license": "MIT",
   "peerDependencies": {

package/dist/build/r2-artifact-writer.d.ts

@@ -1,31 +0,0 @@
-import { type AssetBuildPolicy } from "@fungi.computer/puffball/assets";
-import { type AssetR2Object, type AssetR2Bucket } from "@fungi.computer/puffball/cloudflare-assets";
-import { type ArtifactRef, type AppReleaseCatalogOptions } from "@fungi.computer/puffball";
-import { type AppReleaseR2Bucket } from "@fungi.computer/puffball/cloudflare";
-import type { ArtifactWriter } from "./effect.js";
-/**
- * The native R2 writer for a built App: immutable, digest-addressed objects
- * keyed by artifact reference, read back and verified before the root is
- * returned. Hub's Publisher and Oyster's Computer builds both write Releases
- * through it.
- */
-export type ArtifactPolicy = NonNullable<AppReleaseCatalogOptions["artifactPolicy"]>;
-/** Native binding subset; conditional put never replaces a retained artifact. */
-export type PublisherR2Bucket = AppReleaseR2Bucket & AssetR2Bucket & {
-    put(key: string, value: Uint8Array, options: {
-        onlyIf: {
-            etagDoesNotMatch: string;
-        };
-        sha256: string;
-        httpMetadata: {
-            contentType: string;
-        };
-    }): Promise<AssetR2Object | null>;
-};
-/** Private host pins a retry-stable reference; the actual build supplies its digest. */
-export declare function createR2ArtifactWriter(options: {
-    bucket: PublisherR2Bucket;
-    artifactRef: ArtifactRef;
-    policy: ArtifactPolicy;
-    assets?: AssetBuildPolicy;
-}): ArtifactWriter;

package/dist/build/r2-artifact-writer.js

@@ -1,179 +0,0 @@
-import { buildAssetManifest } from "@fungi.computer/cloudflare-worker-bundler/assets";
-import { createHash } from "node:crypto";
-import * as Effect from "effect/Effect";
-import * as Schema from "effect/Schema";
-import { assetBuildMediaType, assetBuildJsonSchema, assetBuildPolicySchema, assetBaseSchema, decodeAssetBuild, assetPathSchema, } from "@fungi.computer/puffball/assets";
-import { appBuildJsonSchema, appMediaType, createAppBuild, } from "@fungi.computer/puffball/app";
-import { matchesAssetObject, } from "@fungi.computer/puffball/cloudflare-assets";
-import { parseSha256Digest, parseArtifactRef, } from "@fungi.computer/puffball";
-import { createR2ArtifactReader, } from "@fungi.computer/puffball/cloudflare";
-/** Private host pins a retry-stable reference; the actual build supplies its digest. */
-export function createR2ArtifactWriter(options) {
-    const artifactRef = options.artifactRef;
-    const assets = options.assets
-        ? {
-            bucket: options.bucket,
-            policy: Object.freeze(Schema.decodeUnknownSync(assetBuildPolicySchema)({
-                ...options.assets,
-            })),
-        }
-        : undefined;
-    const policy = { ...options.policy };
-    const reader = createR2ArtifactReader(options.bucket, policy, assets);
-    const writeImmutable = async (input) => {
-        if (input.limit === undefined || input.bytes.byteLength > input.limit)
-            throw new Error("Publisher artifact exceeds configured policy");
-        const digest = createHash("sha256").update(input.bytes).digest("hex");
-        const artifactDigest = parseSha256Digest(`sha256:${digest}`);
-        const readStored = () => reader.read({
-            artifactRef: input.artifactRef,
-            expectedDigest: artifactDigest,
-            verification: "publication",
-        });
-        let stored = await readStored();
-        if (stored.kind === "missing") {
-            await options.bucket.put(input.artifactRef, input.bytes, {
-                onlyIf: { etagDoesNotMatch: "*" },
-                sha256: digest,
-                httpMetadata: { contentType: input.mediaType },
-            });
-            stored = await readStored();
-        }
-        const object = await options.bucket.head(input.artifactRef);
-        if (stored.kind !== "verified" ||
-            stored.mediaType !== input.mediaType ||
-            object?.size !== input.bytes.byteLength)
-            throw new Error("Publisher artifact readback failed");
-        return {
-            artifactRef: input.artifactRef,
-            artifactDigest,
-            version: object.version,
-            byteLength: input.bytes.byteLength,
-            mediaType: input.mediaType,
-        };
-    };
-    const childArtifactRef = (digest) => parseArtifactRef(`artifact:sha256-${digest.slice("sha256:".length)}`);
-    return {
-        write: (output) => Effect.tryPromise(async () => {
-            const uiOutput = output.kind === "backend" ? null : output.ui;
-            const backendBytes = output.kind === "ui" ? null : output.backend;
-            const uiBytes = uiOutput === null
-                ? null
-                : uiOutput.content.kind === "html"
-                    ? uiOutput.content.bytes.slice()
-                    : await storeAssetObjects(uiOutput.content.assets, uiOutput.content.base, options.bucket, assets?.policy);
-            const uiMediaType = uiOutput?.mediaType ?? null;
-            const ui = uiBytes === null || uiMediaType === null
-                ? null
-                : await writeImmutable({
-                    artifactRef: childArtifactRef(`sha256:${createHash("sha256")
-                        .update(uiBytes)
-                        .digest("hex")}`),
-                    bytes: uiBytes,
-                    mediaType: uiMediaType,
-                    limit: uiMediaType === assetBuildMediaType
-                        ? policy.maxManifestBytes
-                        : policy.maxBytes,
-                });
-            const backend = backendBytes === null
-                ? null
-                : await writeImmutable({
-                    artifactRef: childArtifactRef(`sha256:${createHash("sha256")
-                        .update(backendBytes)
-                        .digest("hex")}`),
-                    bytes: backendBytes,
-                    mediaType: "application/vnd.fungi.app-backend+json",
-                    limit: policy.maxBytes,
-                });
-            const rootInput = createAppBuild(ui === null || uiMediaType === null
-                ? null
-                : {
-                    artifactRef: ui.artifactRef,
-                    digest: ui.artifactDigest,
-                    version: ui.version,
-                    byteLength: ui.byteLength,
-                    mediaType: uiMediaType,
-                }, backend === null
-                ? null
-                : {
-                    artifactRef: backend.artifactRef,
-                    digest: backend.artifactDigest,
-                    version: backend.version,
-                    byteLength: backend.byteLength,
-                    mediaType: "application/vnd.fungi.app-backend+json",
-                }, output.declaration);
-            const root = Schema.encodeUnknownSync(appBuildJsonSchema)(rootInput);
-            const rootBytes = new TextEncoder().encode(root);
-            const stored = await writeImmutable({
-                artifactRef,
-                bytes: rootBytes,
-                mediaType: appMediaType,
-                limit: policy.maxManifestBytes,
-            });
-            return {
-                artifactRef: stored.artifactRef,
-                artifactDigest: stored.artifactDigest,
-            };
-        }),
-    };
-}
-async function storeAssetObjects(outputs, suppliedBase, bucket, policy) {
-    const base = Schema.decodeUnknownSync(assetBaseSchema)(suppliedBase);
-    if (!policy)
-        throw new Error("Asset writer requires explicit policy and native metadata binding");
-    if (outputs.length === 0 || outputs.length > policy.maxObjects)
-        throw new Error("Asset count exceeds policy");
-    const content = {};
-    let total = 0;
-    for (const output of outputs) {
-        const path = Schema.decodeUnknownSync(assetPathSchema)(output.path);
-        if (Object.hasOwn(content, path))
-            throw new Error("Duplicate build path");
-        total += output.bytes.byteLength;
-        if (output.bytes.byteLength > policy.maxObjectBytes ||
-            !Number.isSafeInteger(total) ||
-            total > policy.maxTotalBytes)
-            throw new Error("Asset bytes exceed policy");
-        content[path] = new Uint8Array(output.bytes).buffer;
-    }
-    const metadata = await buildAssetManifest(content);
-    const assets = await Effect.runPromise(Effect.forEach(Object.keys(content).sort(), (path) => Effect.tryPromise(async () => {
-        const bytes = content[path];
-        const type = metadata.get(path)?.contentType;
-        if (!bytes || !type)
-            throw new Error("Build asset has no maintained content type");
-        const hash = createHash("sha256")
-            .update(new Uint8Array(bytes))
-            .digest("hex");
-        const artifactRef = parseArtifactRef(`artifact:sha256-${hash}`);
-        let object = await bucket.head(artifactRef);
-        if (object === null) {
-            object = await bucket.put(artifactRef, new Uint8Array(bytes), {
-                onlyIf: { etagDoesNotMatch: "*" },
-                sha256: hash,
-                httpMetadata: { contentType: type },
-            });
-            object ??= await bucket.head(artifactRef);
-        }
-        if (!object)
-            throw new Error("Asset readback missing");
-        const asset = {
-            path,
-            artifactRef,
-            digest: parseSha256Digest(`sha256:${hash}`),
-            version: object.version,
-            byteLength: bytes.byteLength,
-            contentType: type,
-        };
-        if (!matchesAssetObject(asset, object))
-            throw new Error("Immutable asset collision");
-        return asset;
-    }), { concurrency: 4 }));
-    const root = new TextEncoder().encode(Schema.encodeUnknownSync(assetBuildJsonSchema)({
-        format: "fungi-assets-v1",
-        base,
-        assets,
-    }));
-    decodeAssetBuild(root, policy);
-    return root;
-}