@fungi.computer/oyster 0.1.0 → 0.3.0

package/dist/host.js

@@ -1,13 +1,13 @@
 import { hostGateFacts, releaseCache } from "./internal/host-gate.js";
+import { InstallationOperationError, installationCommandIds, installationRequestIdSchema, } from "./installation-operations.js";
+import { completedInstallationResponse, observeInstallation, InstallationObservationError, } from "./installation-client.js";
+import { instanceRefusalBody, instanceRefusalStatus, } from "./instance-refusal.js";
 import { appSandbox } from "./app-sandbox.js";
-import { sha256DigestSchema } from "@fungi.computer/puffball/effect";
 import { shellModuleAsset, shellModuleAssetPath, } from "@fungi.computer/puffball/assets";
-import { installationConsentSchema, capabilityDescriptions, } from "./installation-consent.js";
 import { gitRepositoryNameSchema } from "@fungi.computer/puffball/git-representation";
 import { gillRequestSchema, decodeGillReply, decodeDeclaredGillResponse, } from "@fungi.computer/gills";
 import { causeClass } from "./cause-class.js";
 import { appStorageKeyNameSchema, appStorageWriteSchema, appStorageResetSchema, } from "@fungi.computer/agar/storage";
-import {} from "@fungi.computer/agar/git";
 import { guestLimits } from "./guest-policy.js";
 import { APP_INVOCATION_CEILING_MS, admittedCallerFacts, admittedMethodCallerFacts, invocationAuthorityOf, invocationCallerContext, invocationFacts, } from "./invocation.js";
 import { appFacetResponse } from "./backend-request.js";
@@ -16,19 +16,21 @@ import { bodyLimit } from "hono/body-limit";
 import { match } from "path-to-regexp";
 import * as Schema from "effect/Schema";
 import * as Result from "effect/Result";
-import {} from "@fungi.computer/puffball/background-replay";
 import { emptyAppDeclaration } from "@fungi.computer/puffball/app";
-import { applyInstallationCommand, installationIdSchema, installationCommandSchema, } from "./apps/installation.js";
+import { applyInstallationCommand, installationIdSchema, } from "./apps/installation.js";
 import { admits, scopedBindings, grantsFor } from "./apps/gate.js";
+import { appPermissionPageSchema, permissionSaveSchema, } from "./apps/permissions.js";
 import { deriveDeclaredOperations, appCallOperation, } from "./apps/operations.js";
 import { appBackendActorHeader, appBackendComputerHeader, appMethodRefusalStatus, } from "@fungi.computer/agar/backend";
 import { appCallsDescriptor, } from "./capability-descriptor.js";
 export { capabilityDescriptorSchema, capabilityMethodKindSchema, capabilityMethodSchema, } from "./capability-descriptor.js";
-import { instanceIds, selectionOf, } from "./index.js";
-import { parseRelease, readVerified, ReleaseError, sha256, verifyRelease, } from "./release.js";
+import { selectionOf, } from "./index.js";
+import { parseRelease, readVerified, sha256, } from "./release.js";
 import { createGitDoor } from "./git.js";
-import { buildGitPassPrefix, presentedGitKey, workflowGitPassPrefix, } from "./git-auth.js";
-import { pageScript, publicHomeScript, grantConsentScript, fontStyles, shellStyles, } from "#page-script";
+import { buildGitPassPrefix, presentedGitKey } from "./git-auth.js";
+import { workflowGitPassPrefix } from "@fungi.computer/braid/runtime";
+import { loadPageAssets, PageAssetsLoadError, } from "./page-assets.js";
+import { fungiFaviconHref } from "@fungi.computer/sigils/favicon";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { CenteredCard, CardHeader, CardTitle, CardContent, } from "@fungi.computer/caps/components/card";
@@ -92,14 +94,16 @@ function refusal(status, error, retryAfter) {
         init.headers = { "Retry-After": String(retryAfter) };
     return Response.json({ error }, init);
 }
+function installationOperationRefusal(cause) {
+    return cause.code === "stored_operation_invalid"
+        ? Response.json({ error: cause.code, message: cause.message }, { status: 409 })
+        : refusal(cause.code === "unavailable" ? 503 : 409, cause.code);
+}
+/** A refusal no cache may keep: its answer depends on current authority. */
+function noStoreRefusal(status, error) {
+    return Response.json({ error }, { status, headers: { "Cache-Control": "no-store" } });
+}
 function instanceRefusal(code, causeClass) {
-    const conflict = [
-        "conflicting_owner_state",
-        "stale_authority",
-        "instance_release_mismatch",
-        "release_no_longer_matches_instance",
-        "state_schema_migration_unsupported",
-    ];
     if (code === "failed") {
         if (causeClass === undefined)
             console.error("AppInstance failure", {
@@ -114,7 +118,9 @@ function instanceRefusal(code, causeClass) {
             });
         return refusal(502, "App execution failed");
     }
-    return refusal(conflict.includes(code) ? 409 : 403, code);
+    return Response.json(instanceRefusalBody(code), {
+        status: instanceRefusalStatus(code),
+    });
 }
 /** An App's typed refusal keeps its code and caller-facing message. */
 function methodResponse(reply) {
@@ -123,69 +129,69 @@ function methodResponse(reply) {
         : Response.json({ error: reply.code, message: reply.message }, { status: appMethodRefusalStatus[reply.code] });
 }
 /**
- * Install a Release at `installationId`, or switch an already-live one onto
- * it: the one path the POST install and PUT release-select routes share,
- * and that a build owner's own install call reaches too. Nothing there (or
- * only a deleted installation) is a fresh install; a live installation is
- * switched in place, refusing a change of the installation's App identity.
+ * Admit the retained command shared by POST and PUT selection. Only POST's
+ * explicit install-or-remint intent
+ * may choose a fresh id for a tombstone; ordinary selection keeps the retired
+ * id unavailable. App-mediated build selection stays refused until it has
+ * designated install authority.
  */
-export async function installOrSelect(host, installationId, release, principal) {
-    let verifiedRelease;
+async function admitInstallation(host, installationId, release, principal, intent, origin, requestId = installationCommandIds.request.generate()) {
+    // App-mediated installation needs installFree/designated-marketplace
+    // authority. A member's owner role is not that delegated App authority.
+    if (origin !== "owner-direct" && origin !== "workflow")
+        return refusal(403, "install_authority_unavailable");
+    if (!oysterPrincipalIsOwner(principal))
+        return refusal(403, "Owner only");
+    if (!installationIdSchema.safeParse(installationId).success)
+        return refusal(400, "Invalid installation id");
+    if (!installationRequestIdSchema.safeParse(requestId).success)
+        return refusal(400, "Invalid installation request identity");
+    const operations = host.installations.operations;
+    if (operations === undefined)
+        return refusal(503, "Installation commands unavailable");
     try {
-        verifiedRelease = await verifyRelease(host.artifacts, release);
+        return await operations.admit({
+            requestId,
+            installationId,
+            release,
+            actor: principal.actor,
+            intent,
+            origin,
+        });
     }
     catch (cause) {
-        return cause instanceof ReleaseError
-            ? refusal(422, cause.code)
-            : refusal(502, "Release could not be read");
+        if (cause instanceof InstallationOperationError)
+            return installationOperationRefusal(cause);
+        throw cause;
     }
-    const operationDescriptors = host.capabilities ?? [];
-    const reduce = async (current, command, identity) => {
-        const context = invocationCallerContext(principal, host.computerId ?? null);
-        const declaration = verifiedRelease.declaration ?? emptyAppDeclaration;
-        return applyInstallationCommand(current, command, {
-            by: context.actor,
-            role: context.role ?? null,
-            expectedVersion: current?.authorityVersion ?? null,
-            declaration,
-            declaredOperations: await deriveDeclaredOperations(verifiedRelease.release, declaration, operationDescriptors),
-            now: Date.now(),
-            identity,
-        });
-    };
-    const apply = async (installation) => {
-        if (verifiedRelease.backend === null)
-            return null;
-        const limits = guestLimits(host.guestLimits);
-        const result = await host.instances
-            .get(selectionOf(installation).instanceId, limits)
-            .apply({ ...selectionOf(installation), status: installation.status }, installation.release);
-        return result.ok ? null : instanceRefusal(result.code, result.causeClass);
-    };
-    const current = await host.installations.get(installationId);
-    if (current !== null && current.status !== "deleted") {
-        const update = await reduce(current, { kind: "select-release", release, releasePin: "pinned" }, current);
-        if (Result.isFailure(update))
-            return refusal(409, update.failure.code);
-        const next = update.success.next;
-        const refused = await apply(next);
-        if (refused !== null)
-            return refused;
-        await host.installations.put(next);
-        return Response.json(next);
+}
+/** Completed selection, without re-deriving or executing outside Watchdog. */
+export async function installOrSelect(host, installationId, release, principal, intent, origin, requestId = installationCommandIds.request.generate(), signal = new AbortController().signal) {
+    const admitted = await admitInstallation(host, installationId, release, principal, intent, origin, requestId);
+    if (admitted instanceof Response)
+        return admitted;
+    const operations = host.installations.operations;
+    if (operations === undefined)
+        return refusal(503, "Installation commands unavailable");
+    try {
+        return completedInstallationResponse(await observeInstallation({
+            requestId,
+            initial: admitted,
+            read: () => operations.read(requestId, installationId),
+            signal,
+        }));
+    }
+    catch (cause) {
+        if (cause instanceof InstallationObservationError &&
+            cause.cause instanceof InstallationOperationError)
+            return installationOperationRefusal(cause.cause);
+        if (cause instanceof InstallationObservationError)
+            return Response.json({ error: "Installation outcome unconfirmed", requestId }, { status: 503 });
+        throw cause;
     }
-    if (!installationIdSchema.safeParse(installationId).success)
-        return refusal(400, "Invalid installation id");
-    const update = await reduce(null, { kind: "install", release, releasePin: "pinned", grants: "declared" }, { installationId, instanceId: instanceIds.instance.generate() });
-    if (Result.isFailure(update))
-        return refusal(409, update.failure.code);
-    const installation = update.success.next;
-    const refused = await apply(installation);
-    if (refused !== null)
-        return refused;
-    await host.installations.put(installation);
-    return Response.json(installation, { status: 201 });
 }
+/** The tab icon of every Oyster page a person opens at the top level. */
+const tabIcon = `<link rel="icon" type="image/svg+xml" href="${fungiFaviconHref}">`;
 /**
  * Create the Oyster App server: a Hono app that installs App Releases, serves
  * their UI, forwards their backend requests and methods to their Instances,
@@ -198,13 +204,22 @@ export function createOyster(host) {
     const releaseOf = releaseCache(host.artifacts);
     const operationDescriptors = host.capabilities ?? [];
     const gateFacts = (installation, release, principal) => hostGateFacts(host, installation, release, principal);
+    // Current approval for the home shell's code, read on every entry request.
+    const shellApproved = async (installation, release) => {
+        const declaration = release.declaration ?? emptyAppDeclaration;
+        return (grantsFor({
+            status: installation.status,
+            authority: installation.authority,
+            artifactDigest: installation.release.artifact.artifactDigest,
+        }, declaration, await deriveDeclaredOperations(installation.release, declaration, operationDescriptors), "team.workbenchHost") !== null);
+    };
     const reduceInstallation = async (current, command, release, principal, identity) => {
         const context = invocationCallerContext(principal, host.computerId ?? null);
         const declaration = release.declaration ?? emptyAppDeclaration;
         return applyInstallationCommand(current, command, {
             by: context.actor,
             role: context.role ?? null,
-            expectedVersion: current?.authorityVersion ?? null,
+            expectedVersion: current?.authority.authorityVersion ?? null,
             declaration,
             declaredOperations: await deriveDeclaredOperations(release.release, declaration, operationDescriptors),
             now: Date.now(),
@@ -217,19 +232,55 @@ export function createOyster(host) {
         contentType,
         source,
     });
-    const assets = Promise.all([
-        asset("page.js", "text/javascript; charset=utf-8", host.pageScript ?? pageScript),
-        asset("public-home.js", "text/javascript; charset=utf-8", publicHomeScript),
-        asset("grant-consent.js", "text/javascript; charset=utf-8", grantConsentScript),
-        asset("fonts.css", "text/css; charset=utf-8", fontStyles),
-        asset("styles.css", "text/css; charset=utf-8", shellStyles),
-    ]).then(([page, publicHome, grantConsent, fonts, styles]) => ({
-        page,
-        publicHome,
-        grantConsent,
-        fonts,
-        styles,
+    const prepareAssets = async () => {
+        const { pageScript, publicHomeScript, grantConsentScript, fontStyles, loginFontStyles, shellStyles, } = await (host.pageAssets ?? loadPageAssets)();
+        return Promise.all([
+            asset("page.js", "text/javascript; charset=utf-8", host.pageScript ?? pageScript),
+            asset("public-home.js", "text/javascript; charset=utf-8", publicHomeScript),
+            asset("grant-consent.js", "text/javascript; charset=utf-8", grantConsentScript),
+            asset("fonts.css", "text/css; charset=utf-8", fontStyles),
+            asset("login-fonts.css", "text/css; charset=utf-8", loginFontStyles),
+            asset("styles.css", "text/css; charset=utf-8", shellStyles),
+        ]).then(([page, publicHome, grantConsent, fonts, loginFonts, styles]) => ({
+            page,
+            publicHome,
+            grantConsent,
+            fonts,
+            loginFonts,
+            styles,
+        }));
+    };
+    let preparedAssets;
+    const assets = () => (preparedAssets ??= prepareAssets().catch((cause) => {
+        preparedAssets = undefined;
+        throw cause instanceof PageAssetsLoadError
+            ? cause
+            : new PageAssetsLoadError(cause);
     }));
+    // The home page imports this host-owned entry, never the Release module's
+    // own URL: released Oyster 0.2.0 served that URL immutable, so a browser may
+    // hold a copy it would import without a request. The entry is never cached
+    // and rechecks current approval before it names the module.
+    app.get(`/ui-entry/:installationId/:releaseId${shellModuleAssetPath}`, async (context) => {
+        const installation = await host.installations.get(context.req.param("installationId"));
+        if (installation?.status !== "enabled" ||
+            installation.release.releaseId !== context.req.param("releaseId"))
+            return noStoreRefusal(404, "Not found");
+        const release = await releaseOf(installation.release);
+        if (release.ui?.kind !== "assets" ||
+            shellModuleAsset(release.ui.build) === undefined)
+            return noStoreRefusal(404, "Not found");
+        if (!(await shellApproved(installation, release)))
+            return noStoreRefusal(403, "not_approved");
+        const module = `/ui/${installation.installationId}/${installation.release.releaseId}${shellModuleAssetPath}`;
+        return new Response(`export * from ${JSON.stringify(module)};\n`, {
+            headers: {
+                "Content-Type": "text/javascript; charset=utf-8",
+                "X-Content-Type-Options": "nosniff",
+                "Cache-Control": "no-store",
+            },
+        });
+    });
     // App UI: digest-pinned, sandboxed, and readable without a session because
     // the opaque-origin frame cannot carry one.
     app.get("/ui/:installationId/:releaseId/*", async (context) => {
@@ -260,6 +311,11 @@ export function createOyster(host) {
         const asset = release.ui.build.assets.find((item) => item.path === wanted);
         if (asset === undefined)
             return refusal(404, "Not found");
+        // The Release's shell module is read only through the host's entry, but
+        // keeps the same per-request check; other UI assets stay digest-cacheable.
+        const shellEntry = wanted === shellModuleAssetPath;
+        if (shellEntry && !(await shellApproved(installation, release)))
+            return noStoreRefusal(403, "not_approved");
         const bytes = await readVerified(host.artifacts, asset.artifactRef, asset.digest);
         const scope = `${origin}${prefix}/`;
         return new Response(new Uint8Array(bytes), {
@@ -268,13 +324,15 @@ export function createOyster(host) {
                 "Content-Security-Policy": `default-src 'none'; script-src ${scope} 'wasm-unsafe-eval'; style-src ${scope} 'unsafe-inline'; img-src ${scope} blob: data:; media-src blob:; font-src ${scope} data:; connect-src data: ${scope}; worker-src blob:; frame-src 'none'; frame-ancestors ${origin}; base-uri 'none'; form-action 'none'; sandbox ${appSandbox}`,
                 "Access-Control-Allow-Origin": "*",
                 "X-Content-Type-Options": "nosniff",
-                "Cache-Control": "public, max-age=31536000, immutable",
+                "Cache-Control": shellEntry
+                    ? "no-store"
+                    : "public, max-age=31536000, immutable",
             },
         });
     });
     app.get("/_oyster/assets/*", async (context) => {
         const wanted = new URL(context.req.url).pathname;
-        const found = Object.values(await assets).find(({ path }) => path === wanted);
+        const found = Object.values(await assets()).find(({ path }) => path === wanted);
         if (found === undefined)
             return refusal(404, "Not found");
         return new Response(found.source, {
@@ -286,7 +344,7 @@ export function createOyster(host) {
         });
     });
     app.get("/login", async () => {
-        const { fonts, styles } = await assets;
+        const { loginFonts, styles } = await assets();
         const form = renderToStaticMarkup(createElement(CenteredCard, null, createElement(CardHeader, null, createElement(CardTitle, { level: 2 }, "Sign in")), createElement(CardContent, null, createElement(Form, { method: "post", action: "/login" }, createElement(Field, {
             label: "Owner key",
             required: true,
@@ -297,7 +355,7 @@ export function createOyster(host) {
                 required: true,
             }),
         }), createElement(FormFooter, { layout: "stretch", divider: false }, createElement(Button, { type: "submit" }, "Sign in"))))));
-        return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Sign in · ${escapeHtml(title)}</title><link rel="stylesheet" href="${styles.path}"><link rel="stylesheet" href="${fonts.path}"></head><body class="px-lg">${form}</body></html>`, {
+        return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Sign in · ${escapeHtml(title)}</title>${tabIcon}<link rel="stylesheet" href="${styles.path}"><link rel="stylesheet" href="${loginFonts.path}"></head><body class="px-lg">${form}</body></html>`, {
             headers: {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store",
@@ -461,7 +519,7 @@ export function createOyster(host) {
                 });
             }
             const config = JSON.stringify({ title, apps }).replaceAll("<", "\\u003c");
-            return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(title)}</title><link rel="stylesheet" href="${(await assets).fonts.path}"><style>html,body{margin:0;min-height:100%;font-family:var(--font-sans);background:var(--color-base-100);color:var(--color-base-content)}#oyster-public-home{min-height:100vh;display:flex;flex-direction:column}</style><div id="oyster-public-home"></div><script type="application/json" id="oyster-public-config">${config}</script><script type="module" src="${(await assets).publicHome.path}"></script>`, {
+            return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(title)}</title>${tabIcon}<link rel="stylesheet" href="${(await assets()).fonts.path}"><style>html,body{margin:0;min-height:100%;font-family:var(--font-sans);background:var(--color-base-100);color:var(--color-base-content)}#oyster-public-home{min-height:100vh;display:flex;flex-direction:column}</style><div id="oyster-public-home"></div><script type="application/json" id="oyster-public-config">${config}</script><script type="module" src="${(await assets()).publicHome.path}"></script>`, {
                 headers: {
                     "Content-Type": "text/html; charset=utf-8",
                     "Cache-Control": "no-store",
@@ -473,7 +531,7 @@ export function createOyster(host) {
         const items = installations
             .map((installation) => `<li><a href="/apps/${escapeHtml(installation.installationId)}/">${escapeHtml(installation.installationId)}</a> <small>${escapeHtml(installation.release.releaseId)}</small>${oysterPrincipalIsOwner(context.get("principal")) ? ` <a href="/api/installations/${encodeURIComponent(installation.installationId)}/grants">App access</a>` : ""}</li>`)
             .join("");
-        return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(title)}</title><h1>${escapeHtml(title)}</h1><ul>${items || "<li>No Apps installed yet.</li>"}</ul>`, {
+        return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(title)}</title>${tabIcon}<h1>${escapeHtml(title)}</h1><ul>${items || "<li>No Apps installed yet.</li><li>Install Apps with <code>npx oyster install-apps</code></li>"}</ul>`, {
             headers: {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store",
@@ -488,6 +546,7 @@ export function createOyster(host) {
         return undefined;
     });
     app.put("/api/installations/:installationId/visibility", async (context) => {
+        const generation = await host.installations.generation();
         const current = await host.installations.get(context.req.param("installationId"));
         if (current === null || current.status === "deleted")
             return refusal(404, "Not found");
@@ -498,10 +557,16 @@ export function createOyster(host) {
         if (Result.isFailure(update))
             return refusal(409, update.failure.code);
         const next = update.success.next;
-        const refused = await apply(next, await releaseOf(current.release));
+        const release = await releaseOf(current.release);
+        const refused = await prepare(next, release);
         if (refused !== null)
             return refused;
-        await host.installations.put(next);
+        const commit = await host.installations.compareAndPut(next, current.authority.authorityVersion, generation);
+        if (!commit.ok)
+            return refusal(409, commit.code);
+        const activationRefusal = await apply(next, release);
+        if (activationRefusal !== null)
+            return activationRefusal;
         return Response.json(next);
     });
     if (host.ownerRoutes !== undefined) {
@@ -584,6 +649,14 @@ export function createOyster(host) {
         await host.artifacts.put(artifactRef, bytes);
         return new Response(null, { status: 204 });
     });
+    const prepare = async (installation, verifiedRelease) => {
+        if (verifiedRelease.backend === null)
+            return null;
+        const result = await host.instances
+            .get(selectionOf(installation).instanceId, limits)
+            .prepare({ ...selectionOf(installation), status: installation.status }, installation.release);
+        return result.ok ? null : instanceRefusal(result.code, result.causeClass);
+    };
     const apply = async (installation, verifiedRelease) => {
         if (verifiedRelease.backend === null)
             return null;
@@ -603,44 +676,67 @@ export function createOyster(host) {
             return refusal(400, "Invalid install request");
         }
         const installationId = request.installationId ?? release.appId.replaceAll("_", "-");
-        return installOrSelect(host, installationId, release, context.get("principal"));
+        if (!installationIdSchema.safeParse(installationId).success)
+            return refusal(400, "Invalid installation id");
+        const key = installationRequestIdSchema.safeParse(context.req.header("Idempotency-Key"));
+        if (!key.success)
+            return refusal(400, "Invalid installation request identity");
+        const admitted = await admitInstallation(host, installationId, release, context.get("principal"), "install-or-remint", context.req.raw.headers.has("X-Oyster-Installation")
+            ? "app"
+            : "owner-direct", key.data);
+        return admitted instanceof Response
+            ? admitted
+            : Response.json(admitted, { status: 202 });
+    });
+    app.get("/api/installations/:installationId/status", async (context) => {
+        if (!oysterPrincipalIsOwner(context.get("principal")) ||
+            context.req.raw.headers.has("X-Oyster-Installation"))
+            return refusal(403, "Owner only");
+        const key = installationRequestIdSchema.safeParse(context.req.query("requestId"));
+        if (!key.success)
+            return refusal(400, "Invalid installation request identity");
+        const operations = host.installations.operations;
+        if (operations === undefined)
+            return refusal(503, "Installation commands unavailable");
+        try {
+            const operation = await operations.read(key.data, context.req.param("installationId"));
+            return operation === null
+                ? refusal(404, "Installation request not found")
+                : Response.json(operation);
+        }
+        catch (cause) {
+            if (cause instanceof InstallationOperationError)
+                return installationOperationRefusal(cause);
+            throw cause;
+        }
     });
     app.get("/api/installations/:installationId/grants", async (context) => {
         if (context.req.raw.headers.has("X-Oyster-Installation"))
             return refusal(403, "Owner direct only");
+        const generation = await host.installations.generation();
         const current = await host.installations.get(context.req.param("installationId"));
         if (current === null || current.status === "deleted")
             return refusal(404, "Not found");
         const verified = await releaseOf(current.release);
         const declaration = verified.declaration ?? emptyAppDeclaration;
         const declared = await deriveDeclaredOperations(current.release, declaration, operationDescriptors);
-        const config = Schema.decodeUnknownSync(installationConsentSchema)({
+        const config = appPermissionPageSchema.parse({
+            storeGeneration: generation,
             installationId: current.installationId,
             appId: current.appId,
             appName: declaration.displayName ?? current.installationId,
-            authorityVersion: current.authorityVersion,
             artifactDigest: current.release.artifact.artifactDigest,
-            capabilities: declaration.capabilities.map((capability) => {
-                const existing = current.approvedGrants.find((grant) => grant.capability === capability);
-                return {
-                    approved: existing !== undefined,
-                    description: `Lets this App ${capabilityDescriptions[capability]}`,
-                    scope: (existing?.resources ?? "tenant-scope") === "tenant-scope"
-                        ? "All of this Oyster"
-                        : "Only the resources you already approved",
-                    request: {
-                        capability,
-                        operations: existing?.operations ??
-                            declared.capabilities.find((row) => row.capability === capability)
-                                ?.operations ??
-                            [],
-                        resources: existing?.resources ?? "tenant-scope",
-                    },
-                };
-            }),
+            permissions: {
+                authority: current.authority,
+                declaredOperations: declared,
+            },
         });
+        if (context.req.header("Accept")?.includes("application/json"))
+            return Response.json(config, {
+                headers: { "Cache-Control": "no-store" },
+            });
         const encoded = JSON.stringify(config).replaceAll("<", "\\u003c");
-        return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(config.appName)} permissions</title><link rel="stylesheet" href="${(await assets).fonts.path}"><style>html,body{margin:0;min-height:100%;font-family:var(--font-sans);background:var(--color-base-100);color:var(--color-base-content)}</style><div id="oyster-consent"></div><script type="application/json" id="oyster-consent-config">${encoded}</script><script type="module" src="${(await assets).grantConsent.path}"></script>`, {
+        return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(config.appName)} permissions</title><link rel="stylesheet" href="${(await assets()).fonts.path}"><style>html,body{margin:0;min-height:100%;font-family:var(--font-sans);background:var(--color-base-100);color:var(--color-base-content)}</style><div id="oyster-consent"></div><script type="application/json" id="oyster-consent-config">${encoded}</script><script type="module" src="${(await assets()).grantConsent.path}"></script>`, {
             headers: {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store",
@@ -659,27 +755,33 @@ export function createOyster(host) {
         const principal = context.get("principal");
         if (!oysterPrincipalIsOwner(principal))
             return refusal(403, "Owner only");
-        const parsed = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Struct({
-            authorityVersion: Schema.Int.check(Schema.isGreaterThan(0)),
-            artifactDigest: sha256DigestSchema,
-            command: Schema.Unknown,
-        })), { onExcessProperty: "error" })(await context.req.text());
-        if (parsed._tag === "None")
+        const body = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown))(await context.req.text());
+        if (body._tag === "None")
             return refusal(400, "Invalid approval");
-        const command = installationCommandSchema.safeParse(parsed.value.command);
-        if (!command.success || command.data.kind !== "set-grants")
+        const parsed = permissionSaveSchema.safeParse(body.value);
+        if (!parsed.success || parsed.data.command.kind !== "change-grants")
             return refusal(400, "Invalid approval");
+        const generation = await host.installations.generation();
+        if (generation !== parsed.data.storeGeneration)
+            return refusal(409, "stale_authority");
         const current = await host.installations.get(context.req.param("installationId"));
-        if (current === null || current.status === "deleted")
+        if (current === null)
             return refusal(404, "Not found");
-        if (current.authorityVersion !== parsed.value.authorityVersion ||
-            current.release.artifact.artifactDigest !== parsed.value.artifactDigest)
+        // A retired installation's pins can never match a live record: the
+        // page already offers a reload, which then finds the App gone.
+        if (current.status === "deleted")
+            return refusal(409, "stale_authority");
+        if (current.authority.authorityVersion !== parsed.data.authorityVersion ||
+            current.release.artifact.artifactDigest !== parsed.data.artifactDigest)
             return refusal(409, "stale_authority");
         const release = await releaseOf(current.release);
-        const update = await reduceInstallation(current, command.data, release, principal, current);
+        const update = await reduceInstallation(current, parsed.data.command, release, principal, current);
         if (Result.isFailure(update))
             return refusal(409, update.failure.code);
-        const commit = await host.installations.compareAndPut(update.success.next, parsed.value.authorityVersion);
+        const preflightRefusal = await prepare(update.success.next, release);
+        if (preflightRefusal !== null)
+            return preflightRefusal;
+        const commit = await host.installations.compareAndPut(update.success.next, parsed.data.authorityVersion, parsed.data.storeGeneration);
         if (!commit.ok)
             return refusal(409, commit.code);
         const refused = await apply(update.success.next, release);
@@ -695,9 +797,18 @@ export function createOyster(host) {
         catch {
             return refusal(400, "Invalid Release");
         }
-        return installOrSelect(host, context.req.param("installationId"), release, context.get("principal"));
+        const key = installationRequestIdSchema.safeParse(context.req.header("Idempotency-Key") ??
+            installationCommandIds.request.generate());
+        if (!key.success)
+            return refusal(400, "Invalid installation request identity");
+        // PUT retains its completed-response meaning. Cancellation only stops this
+        // observer; Watchdog's retained command continues independently.
+        return installOrSelect(host, context.req.param("installationId"), release, context.get("principal"), "install-or-select", context.req.raw.headers.has("X-Oyster-Installation")
+            ? "app"
+            : "owner-direct", key.data, context.req.raw.signal);
     });
     app.delete("/api/installations/:installationId", async (context) => {
+        const generation = await host.installations.generation();
         const current = await host.installations.get(context.req.param("installationId"));
         if (current === null || current.status === "deleted")
             return refusal(404, "Not found");
@@ -705,10 +816,16 @@ export function createOyster(host) {
         if (Result.isFailure(update))
             return refusal(409, update.failure.code);
         const next = update.success.next;
-        const refused = await apply(next, await releaseOf(current.release));
+        const release = await releaseOf(current.release);
+        const refused = await prepare(next, release);
         if (refused !== null)
             return refused;
-        await host.installations.put(next);
+        const commit = await host.installations.compareAndPut(next, current.authority.authorityVersion, generation);
+        if (!commit.ok)
+            return refusal(409, commit.code);
+        const activationRefusal = await apply(next, release);
+        if (activationRefusal !== null)
+            return activationRefusal;
         return new Response(null, { status: 204 });
     });
     const enabled = async (context) => {
@@ -754,7 +871,8 @@ export function createOyster(host) {
         const workbench = oysterPrincipalIsOwner(principal) &&
             host.workbench !== undefined &&
             installation.installationId === host.homeInstallationId &&
-            declaration?.capabilities.includes("team.workbenchHost") === true;
+            declaration?.capabilities.includes("team.workbenchHost") === true &&
+            grantsFor(facts.installation, facts.declaration, facts.declaredOperations, "team.workbenchHost") !== null;
         const uiUrl = `/ui/${installation.installationId}/${installation.release.releaseId}/`;
         const config = {
             workbench,
@@ -763,7 +881,7 @@ export function createOyster(host) {
             shellModuleUrl: workbench &&
                 release.ui?.kind === "assets" &&
                 shellModuleAsset(release.ui.build) !== undefined
-                ? `${uiUrl}${shellModuleAssetPath.slice(1)}`
+                ? `/ui-entry/${installation.installationId}/${installation.release.releaseId}${shellModuleAssetPath}`
                 : null,
             storage: oysterPrincipalIsOwner(principal) &&
                 host.workbench !== undefined &&
@@ -771,7 +889,7 @@ export function createOyster(host) {
             appsOpen: declaration?.capabilities.includes("apps.open") === true,
             computerId: invocationCallerContext(principal, host.computerId ?? null)
                 .computerId,
-            authorityVersion: installation.authorityVersion,
+            authorityVersion: installation.authority.authorityVersion,
             capabilities,
             commands: declaration?.commands ?? [],
             icon: declaration?.icon ?? null,
@@ -787,8 +905,8 @@ export function createOyster(host) {
             return Response.json(config, {
                 headers: { "Cache-Control": "no-store", Vary: "Accept" },
             });
-        const head = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(installation.installationId)} · ${escapeHtml(title)}</title><link rel="stylesheet" href="${(await assets).fonts.path}">`;
-        const tail = `<script type="application/json" id="oyster-config">${JSON.stringify(config).replaceAll("<", "\\u003c")}</script><script type="module" src="${(await assets).page.path}"></script>`;
+        const head = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(installation.installationId)} · ${escapeHtml(title)}</title>${tabIcon}<link rel="stylesheet" href="${(await assets()).fonts.path}">`;
+        const tail = `<script type="application/json" id="oyster-config">${JSON.stringify(config).replaceAll("<", "\\u003c")}</script><script type="module" src="${(await assets()).page.path}"></script>`;
         // The home shell is trusted: the host's page script renders it in this
         // top-level document, and it mounts each App's sandboxed frame inside
         // that App's window. Every other App page is only its one framed App;
@@ -799,7 +917,9 @@ export function createOyster(host) {
             headers: {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store",
-                "Content-Security-Policy": `default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src data:; frame-src 'self'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+                // worker-src would otherwise fall back to script-src 'self': trusted
+                // shell code must not outlive revocation in a Worker or Service Worker.
+                "Content-Security-Policy": `default-src 'none'; script-src 'self'; worker-src 'none'; style-src 'self' 'unsafe-inline'; font-src data:; frame-src 'self'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
             },
         });
     });
@@ -886,11 +1006,15 @@ export function createOyster(host) {
             return refusal(403, "Gill source is not admitted");
         const current = await gateFacts(installation, release, context.get("principal"));
         if (current.declaredOperations.digest !==
-            installation.declaredOperationsDigest ||
+            installation.authority.declaredOperationsDigest ||
             current.declaredOperations.artifactDigest !==
                 installation.release.artifact.artifactDigest)
             return refusal(403, "stale_authority");
-        if (method.requires.some((capability) => grantsFor(installation, current.declaration, current.declaredOperations, capability) === null))
+        if (method.requires.some((capability) => grantsFor({
+            status: installation.status,
+            authority: installation.authority,
+            artifactDigest: installation.release.artifact.artifactDigest,
+        }, current.declaration, current.declaredOperations, capability) === null))
             return refusal(403, "requires_not_granted");
         if (selected?.kind === "computer")
             return Response.json({
@@ -1024,13 +1148,15 @@ export function createOyster(host) {
                 host.installations.get(target.installationId),
             ]);
             if (currentCaller?.status !== "enabled" ||
-                currentCaller.authorityVersion !== caller.authorityVersion ||
+                currentCaller.authority.authorityVersion !==
+                    caller.authority.authorityVersion ||
                 currentCaller.release.artifact.artifactDigest !==
                     caller.release.artifact.artifactDigest ||
                 !(await allows(currentCaller, fresh)))
                 return refusal(403, "app_call_not_allowed");
             if (currentTarget?.status !== "enabled" ||
-                currentTarget.authorityVersion !== target.authorityVersion ||
+                currentTarget.authority.authorityVersion !==
+                    target.authority.authorityVersion ||
                 currentTarget.release.releaseId !== target.release.releaseId ||
                 currentTarget.release.artifact.artifactDigest !==
                     target.release.artifact.artifactDigest)