@fungi.computer/oyster 0.0.1 → 0.2.0

package/dist/source/template-write.js

@@ -1,344 +0,0 @@
-var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
-    if (value !== null && value !== void 0) {
-        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
-        var dispose, inner;
-        if (async) {
-            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
-            dispose = value[Symbol.asyncDispose];
-        }
-        if (dispose === void 0) {
-            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
-            dispose = value[Symbol.dispose];
-            if (async) inner = dispose;
-        }
-        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
-        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
-        env.stack.push({ value: value, dispose: dispose, async: async });
-    }
-    else if (async) {
-        env.stack.push({ async: true });
-    }
-    return value;
-};
-var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
-    return function (env) {
-        function fail(e) {
-            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
-            env.hasError = true;
-        }
-        var r, s = 0;
-        function next() {
-            while (r = env.stack.pop()) {
-                try {
-                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
-                    if (r.dispose) {
-                        var result = r.dispose.call(r.value);
-                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
-                    }
-                    else s |= 1;
-                }
-                catch (e) {
-                    fail(e);
-                }
-            }
-            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
-            if (env.hasError) throw env.error;
-        }
-        return next();
-    };
-})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
-    var e = new Error(message);
-    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
-});
-import { memfs } from "memfs";
-import { dirname, join } from "node:path";
-import * as git from "isomorphic-git";
-import * as Schema from "effect/Schema";
-import { parseAppId, parseSourceRevision } from "@fungi.computer/puffball";
-import { appIdSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
-import { capturedPinnedRecipeSchema, digestPinnedRecipe, } from "../build-contract.js";
-import { templateRepositoryForApp } from "./template-repository.js";
-function logEvent(operation, cause) {
-    console.error(JSON.stringify({
-        source: "app-publisher",
-        operation,
-        failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
-    }));
-}
-class TemplateRequestTooLarge extends Error {
-}
-/** A bounded operator source upload; decoding happens only at the Publisher boundary. */
-export const TEMPLATE_WRITE_MAX_REQUEST_BYTES = 24 * 1024 * 1024;
-const templatePathSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((path) => path.length > 0 &&
-    path.length <= 4096 &&
-    !path.includes("\\") &&
-    !path.includes("\0") &&
-    path
-        .split("/")
-        .every((part) => part !== "" &&
-        part !== "." &&
-        part !== ".." &&
-        part.toLowerCase() !== ".git"))));
-export const templateWriteInputSchema = Schema.Struct({
-    appId: appIdSchema,
-    sourceRevision: sourceRevisionSchema,
-    sourceTreeDigest: sha256DigestSchema,
-    recipe: capturedPinnedRecipeSchema,
-    files: Schema.Array(Schema.Struct({
-        path: templatePathSchema,
-        contents: Schema.Uint8ArrayFromBase64,
-    })).pipe(Schema.check(Schema.makeFilter((files) => files.length > 0 && files.length <= 10_000))),
-});
-/** Isomorphic Git owns the protocol; the existing Artifacts owner owns every
- * credential and revokes it when the response stream closes. */
-function templateHttp(transport, repository, signal) {
-    const readers = new Set();
-    const close = async (reader) => {
-        if (!readers.delete(reader))
-            return;
-        try {
-            await reader.cancel();
-        }
-        finally {
-            reader.releaseLock();
-        }
-    };
-    return {
-        async [Symbol.asyncDispose]() {
-            const results = await Promise.allSettled([...readers].map(close));
-            if (results.some((result) => result.status === "rejected"))
-                throw new Error("Template Git response cleanup failed");
-        },
-        async request(input) {
-            signal.throwIfAborted();
-            const chunks = input.body;
-            const iterator = chunks === undefined
-                ? undefined
-                : (async function* () {
-                    yield* chunks;
-                })();
-            const body = iterator === undefined
-                ? null
-                : new ReadableStream({
-                    async pull(controller) {
-                        const item = await iterator.next();
-                        if (item.done)
-                            controller.close();
-                        else
-                            controller.enqueue(item.value);
-                    },
-                    async cancel() {
-                        await iterator.return(undefined);
-                    },
-                });
-            const init = {
-                method: input.method ?? "GET",
-                headers: new Headers(input.headers),
-                body,
-                signal,
-            };
-            if (body !== null)
-                Object.assign(init, { duplex: "half" });
-            const response = await transport.exchangeTemplateGit(repository, new Request(input.url, init));
-            // Own the reader before handing the iterable to Git, including when the
-            // client never starts iteration or abandons it without calling return().
-            const reader = response.body?.getReader();
-            if (reader !== undefined)
-                readers.add(reader);
-            async function* responseChunks() {
-                if (reader === undefined)
-                    return;
-                try {
-                    for (;;) {
-                        signal.throwIfAborted();
-                        const item = await reader.read();
-                        if (item.done)
-                            return;
-                        yield item.value;
-                    }
-                }
-                finally {
-                    await close(reader);
-                }
-            }
-            return {
-                url: input.url,
-                method: input.method,
-                statusCode: response.status,
-                statusMessage: response.statusText,
-                headers: Object.fromEntries(response.headers),
-                body: responseChunks(),
-            };
-        },
-    };
-}
-/** Each request owns an in-memory Git working tree. Uploaded source never
- * executes here and callers supply no provider token; the maintained Git client
- * writes and compares trees. */
-async function writeTemplate(transport, input, repository, signal) {
-    const env_1 = { stack: [], error: void 0, hasError: false };
-    try {
-        const { fs } = memfs();
-        const dir = "/template";
-        await git.init({ fs, dir, defaultBranch: "main" });
-        const paths = new Set();
-        for (const file of input.files) {
-            signal.throwIfAborted();
-            if (paths.has(file.path))
-                throw new Error("Duplicate template source path");
-            paths.add(file.path);
-            const target = join(dir, file.path);
-            await fs.promises.mkdir(dirname(target), { recursive: true });
-            await fs.promises.writeFile(target, file.contents);
-        }
-        await git.add({ fs, dir, filepath: [...paths], force: true });
-        const oid = await git.commit({
-            fs,
-            dir,
-            author: {
-                name: "Botanical App Source",
-                email: "app-source@botanical.invalid",
-                timestamp: 0,
-                timezoneOffset: 0,
-            },
-            message: `Seed ${input.appId} from ${input.sourceRevision}`,
-        });
-        const http = __addDisposableResource(env_1, templateHttp(transport, repository, signal), true);
-        const url = `https://git.team.internal/${repository}.git`;
-        await git.addRemote({ fs, dir, remote: "origin", url });
-        const refs = await git.listServerRefs({
-            http,
-            url,
-            prefix: "refs/heads/main",
-        });
-        const main = refs.find((ref) => ref.ref === "refs/heads/main");
-        if (main !== undefined) {
-            await git.fetch({
-                fs,
-                http,
-                dir,
-                url,
-                ref: "main",
-                singleBranch: true,
-                depth: 1,
-                tags: false,
-            });
-            const expected = await git.readCommit({ fs, dir, oid });
-            const actual = await git.readCommit({ fs, dir, oid: main.oid });
-            if (expected.commit.tree !== actual.commit.tree)
-                return null;
-        }
-        if (main === undefined) {
-            // isomorphic-git's pack writer sends whole objects, preserving Artifacts
-            // native forks' requirement that seed packs contain no delta objects.
-            const pushed = await git.push({
-                fs,
-                http,
-                dir,
-                url,
-                ref: "main",
-                remoteRef: "main",
-                signal,
-            });
-            if (!pushed.ok)
-                throw new Error("Template Git push refused");
-        }
-        // A successful push or matching fetched tree is not sufficient: retain the
-        // former Publisher receipt check that main still names this exact commit.
-        const expectedHead = main?.oid ?? oid;
-        const confirmed = await git.listServerRefs({
-            http,
-            url,
-            prefix: "refs/heads/main",
-        });
-        return confirmed.find((ref) => ref.ref === "refs/heads/main")?.oid ===
-            expectedHead
-            ? expectedHead
-            : null;
-    }
-    catch (e_1) {
-        env_1.error = e_1;
-        env_1.hasError = true;
-    }
-    finally {
-        const result_1 = __disposeResources(env_1);
-        if (result_1)
-            await result_1;
-    }
-}
-/** The only operator template-write result contains provenance, never custody. */
-export async function seedPublisherTemplate(receipts, transport, rawAppId, request) {
-    try {
-        const appId = parseAppId(rawAppId);
-        const length = Number(request.headers.get("content-length") ?? "0");
-        if (!Number.isSafeInteger(length) ||
-            length < 0 ||
-            length > TEMPLATE_WRITE_MAX_REQUEST_BYTES)
-            return { kind: "too-large" };
-        const signal = AbortSignal.any([
-            request.signal,
-            AbortSignal.timeout(240_000),
-        ]);
-        let bytes = 0;
-        const bounded = request.body?.pipeThrough(new TransformStream({
-            transform(chunk, controller) {
-                bytes += chunk.byteLength;
-                if (bytes > TEMPLATE_WRITE_MAX_REQUEST_BYTES)
-                    throw new TemplateRequestTooLarge();
-                controller.enqueue(chunk);
-            },
-        }), { signal });
-        let input;
-        try {
-            const body = await new Response(bounded).json();
-            input = Schema.decodeUnknownSync(templateWriteInputSchema, {
-                onExcessProperty: "error",
-            })(body);
-        }
-        catch (cause) {
-            logEvent("operator.template.decode", cause);
-            return {
-                kind: cause instanceof TemplateRequestTooLarge ? "too-large" : "invalid",
-            };
-        }
-        if (input.appId !== appId)
-            return { kind: "conflict" };
-        const repository = templateRepositoryForApp(appId);
-        await transport.ensureRepository(repository);
-        const oid = await writeTemplate(transport, input, repository, signal);
-        if (oid === null)
-            return { kind: "conflict" };
-        const seedRevision = parseSourceRevision(`git:${oid}`);
-        const receipt = {
-            appId,
-            sourceRevision: input.sourceRevision,
-            sourceTreeDigest: input.sourceTreeDigest,
-            seedRevision,
-            recipe: input.recipe,
-            buildRecipeDigest: digestPinnedRecipe(input.recipe),
-        };
-        const existing = await receipts.read(appId, seedRevision);
-        if (existing !== null &&
-            (existing.sourceRevision !== receipt.sourceRevision ||
-                existing.sourceTreeDigest !== receipt.sourceTreeDigest ||
-                existing.buildRecipeDigest !== receipt.buildRecipeDigest))
-            return { kind: "conflict" };
-        // Recording still uses the write-once, digest-checked Publisher receipt owner.
-        await receipts.record(receipt);
-        return {
-            kind: existing === null ? "recorded" : "existing",
-            receipt: {
-                appId,
-                repository,
-                sourceRevision: receipt.sourceRevision,
-                sourceTreeDigest: receipt.sourceTreeDigest,
-                seedRevision,
-                buildRecipeDigest: receipt.buildRecipeDigest,
-            },
-        };
-    }
-    catch (cause) {
-        logEvent("operator.template.write", cause);
-        return { kind: "unavailable" };
-    }
-}

package/docs/media/architecture.mmd

@@ -1,32 +0,0 @@
-flowchart LR
-  people["Browsers<br/>git clients<br/>MCP agents"]
-
-  subgraph oyster["Oyster Worker · Cloudflare Workers or celld"]
-    direction TB
-    router["Router<br/>/apps · /api · /git · /mcp"]
-    home["Tourtois home<br/>launcher · windows · settings"]
-    registry[("OysterRegistry DO<br/>installations")]
-    instance["App Instance DO<br/>one per installation"]
-    facet["App backend<br/>Worker Loader facet<br/>with its own SQLite"]
-    door["git door<br/>per-agent keys"]
-    router --> home
-    router --> registry
-    router --> instance --> facet
-    router --> door
-  end
-
-  apps["Apps as immutable Releases<br/>Bonsai · Workflows · Shed<br/>Inkcap · Grove · Prints"]
-
-  subgraph services["Bindings the host provides"]
-    direction TB
-    r2[("R2<br/>Release artifacts")]
-    artifacts[("Artifacts<br/>git repositories")]
-    platform["Braid Workflows · Computers<br/>Agents · Workers AI"]
-  end
-
-  people --> router
-  home -. "UI in sandboxed frames" .-> apps
-  registry -- "Release refs" --> r2
-  door --> artifacts
-  facet -- "declared only" --> platform
-  facet -- "GIT binding" --> artifacts

package/examples/git/worker.ts

@@ -1,39 +0,0 @@
-// Add Git to an Oyster Worker. `host.git` is the whole seam: `createOyster`
-// mounts the git door at `/git/<installation>/<repo>.git`, and every clone,
-// fetch and push passes host authentication, live installation admission and
-// the App's own push policy before Artifacts sees a byte.
-//
-// One root composes every tenant host. HTTP, MCP and background wakes all reach
-// it through `root.hostFor`, so they share one auth, one workspace and one
-// capability set.
-import type { TenantScope } from "@fungi.computer/oyster/tenant";
-import {
-  createOysterGitMcpOwner,
-  createOysterGitWorker,
-  OysterGitInstance,
-  oysterGitRoot,
-  ownerOrKeyTenancy,
-  type OysterGitWorkerEnv,
-} from "@fungi.computer/oyster/workers-git";
-
-export { OysterRegistry } from "@fungi.computer/oyster/workers";
-// The one binding entrypoint, whose table also hands Apps `env.GIT` and `env.EVENTS`.
-export {
-  OysterBinding,
-  OysterKeys,
-  OysterWebhooks,
-} from "@fungi.computer/oyster/workers-git";
-
-// The owner key, or a named key minted at POST /api/keys, signs `git` in.
-const root = oysterGitRoot<OysterGitWorkerEnv>({ tenancy: ownerOrKeyTenancy });
-
-export class OysterMcp extends createOysterGitMcpOwner(root) {}
-
-/** Instances that hand Apps `env.GIT` and `env.EVENTS`; wakes use the root's host. */
-export class OysterInstance extends OysterGitInstance {
-  protected hostFor(scope: TenantScope) {
-    return root.hostFor(this.env, scope);
-  }
-}
-
-export default createOysterGitWorker(root);

package/examples/git/wrangler.jsonc

@@ -1,32 +0,0 @@
-{
-  "$schema": "../../../../node_modules/wrangler/config-schema.json",
-  "name": "oyster-git",
-  "main": "worker.ts",
-  "compatibility_date": "2026-09-04",
-  "compatibility_flags": ["nodejs_compat"],
-  "vars": { "OYSTER_ORIGIN": "https://oyster.example" },
-  "worker_loaders": [{ "binding": "LOADER" }],
-  "r2_buckets": [{ "binding": "RELEASES", "bucket_name": "oyster-releases" }],
-  "artifacts": [{ "binding": "ARTIFACTS", "namespace": "oyster" }],
-  "durable_objects": {
-    "bindings": [
-      { "name": "MCP", "class_name": "OysterMcp" },
-      { "name": "REGISTRY", "class_name": "OysterRegistry" },
-      { "name": "INSTANCES", "class_name": "OysterInstance" },
-      { "name": "KEYS", "class_name": "OysterKeys" },
-      { "name": "WEBHOOKS", "class_name": "OysterWebhooks" },
-    ],
-  },
-  "migrations": [
-    {
-      "tag": "v1",
-      "new_sqlite_classes": [
-        "OysterMcp",
-        "OysterRegistry",
-        "OysterInstance",
-        "OysterKeys",
-        "OysterWebhooks",
-      ],
-    },
-  ],
-}