@fungi.computer/oyster 0.1.0 → 0.3.0

package/dist/machine-link/enrollment.js

@@ -0,0 +1,286 @@
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import { importSeamVerifiers } from "@fungi.computer/seam";
+import { z } from "zod";
+const identity = z.string().min(1).max(256);
+const selectedAgent = z.strictObject({
+    name: z.string().trim().min(1).max(256),
+});
+/** Public keys and selected identities only; a local store path never crosses. */
+export const machineEnrollmentSchema = z.strictObject({
+    requestId: identity,
+    publicKey: z.base64().length(44),
+    machineLabel: z.string().trim().min(1).max(256),
+    agents: z.array(selectedAgent).max(256),
+});
+/** Trusted Local OAuth facts, never supplied in the public enrollment body. */
+export const machineMemberSchema = z.strictObject({
+    memberId: identity,
+    clientId: identity,
+    loginId: identity,
+});
+/** Server-selected issuer facts; omitted fields match all of this member's devices. */
+export const machineLoginSelectionSchema = z.strictObject({
+    clientId: identity.optional(),
+    loginId: identity.optional(),
+});
+const ids = defineIdFamily({
+    family: "machine-enrollment",
+    version: 1,
+    kinds: { device: { prefix: "machine" } },
+});
+const rowSchema = z.strictObject({
+    device_id: identity,
+    member_id: identity,
+    client_id: identity,
+    login_id: identity,
+    input: z.string(),
+});
+const mappingSchema = z.strictObject({
+    selection: z.number().int().min(0).max(255),
+    agent_id: identity,
+});
+const limitsSchema = z.strictObject({
+    machines: z.number().int().positive(),
+    agentsPerMachine: z.number().int().positive().max(256),
+});
+/** Honest enrollment refusals; none denotes command acceptance. */
+export class MachineEnrollmentRefused extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+        this.name = "MachineEnrollmentRefused";
+    }
+}
+/**
+ * Team-owned enrollment state over the ordinary Agent directory, not a second
+ * hosted runtime. Its caller must supply the live, member-authorized identity.
+ * Limits are captured host policy; this module does not invent a Team quota.
+ */
+export function createMachineEnrollment(options) {
+    const { owner } = options;
+    const limits = limitsSchema.parse(options.limits);
+    const reserveAgent = options.agents(owner.sql);
+    owner.sql.exec(`CREATE TABLE IF NOT EXISTS hub_machine_devices (
+    device_id TEXT PRIMARY KEY,
+    member_id TEXT NOT NULL,
+    client_id TEXT NOT NULL,
+    login_id TEXT NOT NULL,
+    request_id TEXT NOT NULL UNIQUE,
+    input TEXT NOT NULL,
+    public_key TEXT NOT NULL UNIQUE,
+    machine_label TEXT NOT NULL,
+    revoked INTEGER NOT NULL DEFAULT 0 CHECK(revoked IN (0,1)),
+    fence_epoch INTEGER NOT NULL DEFAULT 0
+      CHECK(fence_epoch BETWEEN 0 AND 9007199254740991)
+  ) STRICT`);
+    owner.sql.exec(`CREATE TABLE IF NOT EXISTS hub_machine_agents (
+    device_id TEXT NOT NULL REFERENCES hub_machine_devices(device_id),
+    selection INTEGER NOT NULL,
+    agent_id TEXT NOT NULL UNIQUE,
+    PRIMARY KEY(device_id, selection)
+  ) STRICT`);
+    const mappings = (deviceId) => owner.sql
+        .exec("SELECT selection, agent_id FROM hub_machine_agents WHERE device_id = ? ORDER BY selection", deviceId)
+        .toArray()
+        .map((row) => {
+        const parsed = mappingSchema.parse(row);
+        return { selection: parsed.selection, agentId: parsed.agent_id };
+    });
+    const enroll = async (rawMember, raw) => {
+        const member = machineMemberSchema.parse(rawMember);
+        const { memberId } = member;
+        const input = machineEnrollmentSchema.parse(raw);
+        // Use the maintained Ed25519 decoder before storing an unusable pin.
+        await importSeamVerifiers({ device: input.publicKey });
+        await options.authorizeMember(memberId);
+        const canonical = JSON.stringify(input);
+        return owner.transactionSync(() => {
+            const prior = owner.sql
+                .exec("SELECT device_id, member_id, client_id, login_id, input FROM hub_machine_devices WHERE request_id = ?", input.requestId)
+                .toArray()[0];
+            if (prior !== undefined) {
+                const row = rowSchema.parse(prior);
+                if (row.member_id !== memberId ||
+                    row.client_id !== member.clientId ||
+                    row.login_id !== member.loginId ||
+                    row.input !== canonical)
+                    throw new MachineEnrollmentRefused("request_conflict");
+                const revoked = z
+                    .object({ revoked: z.number() })
+                    .parse(owner.sql
+                    .exec("SELECT revoked FROM hub_machine_devices WHERE device_id = ?", row.device_id)
+                    .toArray()[0]).revoked;
+                if (revoked !== 0)
+                    throw new MachineEnrollmentRefused("device_revoked");
+                return { deviceId: row.device_id, agents: mappings(row.device_id) };
+            }
+            // Bound retained identity/replay history, including revoked devices;
+            // counting only active devices would leave that history unbounded.
+            const count = z
+                .object({ count: z.number().int().nonnegative() })
+                .parse(owner.sql
+                .exec("SELECT COUNT(*) AS count FROM hub_machine_devices")
+                .toArray()[0]).count;
+            if (count >= limits.machines ||
+                input.agents.length > limits.agentsPerMachine)
+                throw new MachineEnrollmentRefused("capacity");
+            if (owner.sql
+                .exec("SELECT 1 FROM hub_machine_devices WHERE public_key = ?", input.publicKey)
+                .toArray().length > 0)
+                throw new MachineEnrollmentRefused("request_conflict");
+            const deviceId = ids.device.generate();
+            owner.sql.exec("INSERT INTO hub_machine_devices(device_id, member_id, client_id, login_id, request_id, input, public_key, machine_label) VALUES(?,?,?,?,?,?,?,?)", deviceId, memberId, member.clientId, member.loginId, input.requestId, canonical, input.publicKey, input.machineLabel);
+            for (const [index, selected] of input.agents.entries()) {
+                // A bounded server-owned receipt, stable across retries.
+                const agent = reserveAgent({
+                    memberId,
+                    requestId: `${deviceId}:${String(index)}`,
+                    name: selected.name,
+                });
+                owner.sql.exec("INSERT INTO hub_machine_agents(device_id, selection, agent_id) VALUES(?,?,?)", deviceId, index, agent.agentId);
+                options.onAgentCreated(agent.agentId);
+            }
+            return { deviceId, agents: mappings(deviceId) };
+        });
+    };
+    const device = (deviceId) => {
+        const row = owner.sql
+            .exec("SELECT device_id, member_id, client_id, login_id, public_key, machine_label, fence_epoch FROM hub_machine_devices WHERE device_id = ? AND revoked = 0", deviceId)
+            .toArray()[0];
+        if (row === undefined)
+            return null;
+        const value = z
+            .strictObject({
+            device_id: identity,
+            member_id: identity,
+            client_id: identity,
+            login_id: identity,
+            public_key: z.string(),
+            machine_label: z.string(),
+            fence_epoch: z.int().nonnegative(),
+        })
+            .parse(row);
+        return {
+            deviceId: value.device_id,
+            memberId: value.member_id,
+            clientId: value.client_id,
+            loginId: value.login_id,
+            publicKey: value.public_key,
+            machineLabel: value.machine_label,
+            fenceEpoch: value.fence_epoch,
+        };
+    };
+    const home = (agentId) => {
+        const row = owner.sql
+            .exec(`SELECT d.device_id FROM hub_machine_agents a
+       JOIN hub_machine_devices d ON d.device_id = a.device_id WHERE a.agent_id = ?`, agentId)
+            .toArray()[0];
+        if (row === undefined)
+            return null;
+        const value = z.strictObject({ device_id: identity }).parse(row);
+        return { kind: "machine", deviceId: value.device_id };
+    };
+    const revoke = (memberId, deviceId) => owner.transactionSync(() => {
+        const current = device(deviceId);
+        if (current?.memberId !== memberId)
+            return false;
+        owner.sql.exec("UPDATE hub_machine_devices SET revoked = 1, fence_epoch = fence_epoch + 1 WHERE device_id = ?", deviceId);
+        return true;
+    });
+    const authorizeDevice = async (deviceId) => {
+        const current = device(deviceId);
+        if (current === null)
+            throw new MachineEnrollmentRefused("device_revoked");
+        await options.authorizeMember(current.memberId);
+        if (!(await options.authorizeLogin({
+            memberId: current.memberId,
+            clientId: current.clientId,
+            loginId: current.loginId,
+        })))
+            throw new MachineEnrollmentRefused("login_not_current");
+        // The primary login read yields to other RPCs. A concurrent per-device
+        // revoke must win before this call lends the device to transport again.
+        const authorized = device(deviceId);
+        if (authorized === null)
+            throw new MachineEnrollmentRefused("device_revoked");
+        return authorized;
+    };
+    /** Retained rows include revoked devices: their replay owner still exists. */
+    const retainedDevices = () => owner.sql
+        .exec("SELECT device_id, member_id, client_id, login_id, revoked, fence_epoch FROM hub_machine_devices ORDER BY device_id")
+        .toArray()
+        .map((raw) => {
+        const row = z
+            .strictObject({
+            device_id: identity,
+            member_id: identity,
+            client_id: identity,
+            login_id: identity,
+            revoked: z.union([z.literal(0), z.literal(1)]),
+            fence_epoch: z.int().nonnegative(),
+        })
+            .parse(raw);
+        return {
+            deviceId: row.device_id,
+            memberId: row.member_id,
+            clientId: row.client_id,
+            loginId: row.login_id,
+            revoked: row.revoked === 1,
+            fenceEpoch: row.fence_epoch,
+        };
+    });
+    /** Commit the authority fence before attempting any remote socket close. */
+    const fenceDevice = (deviceId) => owner.transactionSync(() => {
+        const row = owner.sql
+            .exec("UPDATE hub_machine_devices SET fence_epoch = fence_epoch + 1 WHERE device_id = ? RETURNING fence_epoch", deviceId)
+            .toArray()[0];
+        return row === undefined
+            ? null
+            : z.strictObject({ fence_epoch: z.int().nonnegative() }).parse(row)
+                .fence_epoch;
+    });
+    const fenceSelected = (devices) => devices.map(({ deviceId }) => {
+        const fenceEpoch = fenceDevice(deviceId);
+        if (fenceEpoch === null)
+            throw new Error("Retained device disappeared");
+        return { deviceId, fenceEpoch };
+    });
+    /** Logout/removal closes old sockets, but does not retire keys or replay. */
+    const fenceLogins = (memberId, selection) => owner.transactionSync(() => fenceSelected(retainedDevices().filter((device) => device.memberId === memberId &&
+        (selection.clientId === undefined ||
+            device.clientId === selection.clientId) &&
+        (selection.loginId === undefined ||
+            device.loginId === selection.loginId))));
+    const fenceMember = (memberId) => fenceLogins(memberId, {});
+    /** Irreversible erasure acceptance, not suspension. Keep every roster row
+     * until its link's replay and storage have been erased and read back.
+     */
+    const retireAllForErasure = () => owner.transactionSync(() => {
+        for (const device of retainedDevices()) {
+            if (!device.revoked && !revoke(device.memberId, device.deviceId))
+                throw new Error("Device retirement did not commit");
+        }
+        return retainedDevices().map(({ deviceId, fenceEpoch }) => ({
+            deviceId,
+            fenceEpoch,
+        }));
+    });
+    /** Revocation is irreversible. Keep its UNIQUE public-key row, even after
+     * the device's link replay is erased; a resumable fence is not retirement.
+     */
+    const keyRetired = (deviceId) => retainedDevices().some((device) => device.deviceId === deviceId && device.revoked);
+    return {
+        enroll,
+        device,
+        home,
+        revoke,
+        authorizeDevice,
+        retainedDevices,
+        fenceDevice,
+        fenceMember,
+        fenceLogins,
+        retireAllForErasure,
+        keyRetired,
+    };
+}

package/dist/machine-link/fences.d.ts

@@ -0,0 +1,37 @@
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import type { createMachineEnrollment, MachineLoginSelection } from "./enrollment.js";
+import { type MachineLinkFenceResult, type MachineLinkFenceFact } from "./authority.js";
+/** One host outbox family: the host's drain asks when it is due and runs it. */
+export type MachineLinkFenceFamily = Readonly<{
+    family: string;
+    nextDue(): number | null;
+    deliver(): Promise<void>;
+}>;
+/** Team-local durable push custody; device rows remain the authority. */
+export declare function createMachineLinkFences(options: {
+    owner: WatchdogSqliteOwner;
+    enrollment: ReturnType<typeof createMachineEnrollment>;
+    readFact: (deviceId: string) => Promise<MachineLinkFenceFact | null>;
+    push: (fact: MachineLinkFenceFact) => Promise<MachineLinkFenceResult>;
+    /** Own an immediate post-commit push/alarm. When staging inside an outer
+     * transaction, the host must defer I/O until that transaction has committed.
+     */
+    wakeNow: () => void;
+    retryDelayMs: (failures: number) => number;
+    /** The host's failure log; a failed push still stays UNCONFIRMED and retries. */
+    report: (operation: string, cause: unknown) => void;
+}): {
+    fenceAll: () => void;
+    fenceMember: (memberId: string, membershipVersion: number) => void;
+    fenceLogins: (memberId: string, selection: MachineLoginSelection) => Promise<{
+        kind: "unconfirmed" | "confirmed";
+        fenceEpoch: number;
+    }[]>;
+    retireAllForErasure: () => void;
+    revoke: (memberId: string, deviceId: string) => Promise<MachineLinkFenceResult | null>;
+    family: Readonly<{
+        family: string;
+        nextDue(): number | null;
+        deliver(): Promise<void>;
+    }>;
+};

package/dist/machine-link/fences.js

@@ -0,0 +1,166 @@
+import { z } from "zod";
+import { machineLinkFenceResultSchema, } from "./authority.js";
+const intentSchema = z.strictObject({
+    device_id: z.string().min(1).max(256),
+    fence_epoch: z.int().nonnegative(),
+    failures: z.int().nonnegative(),
+});
+/** Team-local durable push custody; device rows remain the authority. */
+export function createMachineLinkFences(options) {
+    const { owner, enrollment } = options;
+    owner.sql.exec(`CREATE TABLE IF NOT EXISTS hub_machine_link_fences (
+    device_id TEXT PRIMARY KEY,
+    fence_epoch INTEGER NOT NULL CHECK(fence_epoch >= 0),
+    failures INTEGER NOT NULL DEFAULT 0 CHECK(failures >= 0),
+    next_attempt_at INTEGER NOT NULL
+  ) STRICT`);
+    // Only members with retained devices get a receipt: bounded by enrollment.
+    // This records delivery versions, never admission or role authority.
+    owner.sql.exec(`CREATE TABLE IF NOT EXISTS hub_machine_link_member_fences (
+    member_id TEXT PRIMARY KEY,
+    membership_version INTEGER NOT NULL CHECK(membership_version > 0)
+  ) STRICT`);
+    const stage = (deviceId, fenceEpoch) => {
+        owner.sql.exec(`INSERT INTO hub_machine_link_fences
+       (device_id,fence_epoch,failures,next_attempt_at) VALUES (?,?,0,?)
+       ON CONFLICT(device_id) DO UPDATE SET fence_epoch=excluded.fence_epoch,
+       failures=0,next_attempt_at=excluded.next_attempt_at`, deviceId, fenceEpoch, Date.now());
+    };
+    const attempt = async (intent) => {
+        try {
+            const fact = await options.readFact(intent.device_id);
+            if (fact?.deviceId !== intent.device_id ||
+                fact.fenceEpoch < intent.fence_epoch)
+                throw new Error("Machine link fence fact is not current");
+            const result = machineLinkFenceResultSchema.parse(await options.push(fact));
+            if (result.kind !== "confirmed" || result.fenceEpoch < intent.fence_epoch)
+                throw new Error("Machine link did not confirm the committed fence");
+            // An older in-flight ACK cannot clear a newer persisted intent.
+            owner.sql.exec("DELETE FROM hub_machine_link_fences WHERE device_id=? AND fence_epoch=?", intent.device_id, intent.fence_epoch);
+            return result;
+        }
+        catch (cause) {
+            const failures = intent.failures + 1;
+            owner.sql.exec(`UPDATE hub_machine_link_fences SET failures=?,next_attempt_at=?
+         WHERE device_id=? AND fence_epoch=?`, failures, Date.now() + options.retryDelayMs(failures), intent.device_id, intent.fence_epoch);
+            options.report("machine-link.fence-push", cause);
+            return { kind: "unconfirmed", fenceEpoch: intent.fence_epoch };
+        }
+    };
+    const pending = (deviceId) => {
+        const row = owner.sql
+            .exec("SELECT device_id,fence_epoch,failures FROM hub_machine_link_fences WHERE device_id=?", deviceId)
+            .toArray()[0];
+        return row === undefined ? null : intentSchema.parse(row);
+    };
+    /** Called in the lifecycle transaction. Resume must not cancel these pushes:
+     * an old socket still needs closing even after admission becomes live again.
+     */
+    const fenceAll = () => {
+        owner.transactionSync(() => {
+            for (const { deviceId } of enrollment.retainedDevices()) {
+                const epoch = enrollment.fenceDevice(deviceId);
+                if (epoch === null)
+                    throw new Error("Retained device disappeared");
+                stage(deviceId, epoch);
+            }
+        });
+        if (enrollment.retainedDevices().length > 0)
+            options.wakeNow();
+    };
+    /** Called inside the member-removal transaction; old deliveries cannot fence
+     * a member again after rejoin. The host owns the post-commit wake.
+     */
+    const fenceMember = (memberId, membershipVersion) => {
+        const staged = owner.transactionSync(() => {
+            const previous = owner.sql
+                .exec("SELECT membership_version FROM hub_machine_link_member_fences WHERE member_id=?", memberId)
+                .toArray()[0];
+            if (previous !== undefined &&
+                z
+                    .strictObject({ membership_version: z.int().positive() })
+                    .parse(previous).membership_version >= membershipVersion)
+                return false;
+            const devices = enrollment.fenceMember(memberId);
+            if (devices.length === 0)
+                return false;
+            for (const { deviceId, fenceEpoch } of devices)
+                stage(deviceId, fenceEpoch);
+            owner.sql.exec(`INSERT INTO hub_machine_link_member_fences(member_id,membership_version) VALUES (?,?)
+         ON CONFLICT(member_id) DO UPDATE SET membership_version=excluded.membership_version`, memberId, membershipVersion);
+            return true;
+        });
+        if (staged)
+            options.wakeNow();
+    };
+    const fenceLogins = async (memberId, selection) => {
+        const intents = owner.transactionSync(() => enrollment
+            .fenceLogins(memberId, selection)
+            .map(({ deviceId, fenceEpoch }) => {
+            stage(deviceId, fenceEpoch);
+            const intent = pending(deviceId);
+            if (intent === null)
+                throw new Error("Login fence was not staged");
+            return intent;
+        }));
+        // The first attempts start inline after commit, not at the retry deadline.
+        if (intents.length > 0)
+            options.wakeNow();
+        const receipts = [];
+        for (let offset = 0; offset < intents.length; offset += 16)
+            receipts.push(...(await Promise.all(intents.slice(offset, offset + 16).map(attempt))));
+        return receipts;
+    };
+    const retireAllForErasure = () => {
+        const devices = owner.transactionSync(() => {
+            const retired = enrollment.retireAllForErasure();
+            for (const { deviceId, fenceEpoch } of retired)
+                stage(deviceId, fenceEpoch);
+            return retired;
+        });
+        if (devices.length > 0)
+            options.wakeNow();
+    };
+    const revoke = async (memberId, deviceId) => {
+        const intent = owner.transactionSync(() => {
+            const device = enrollment
+                .retainedDevices()
+                .find((row) => row.deviceId === deviceId && row.memberId === memberId);
+            if (device === undefined)
+                return null;
+            if (!device.revoked && !enrollment.revoke(memberId, deviceId))
+                throw new Error("Device retirement did not commit");
+            const retired = enrollment
+                .retainedDevices()
+                .find((row) => row.deviceId === deviceId);
+            if (retired === undefined)
+                throw new Error("Retired device disappeared");
+            stage(deviceId, retired.fenceEpoch);
+            return pending(deviceId);
+        });
+        return intent === null ? null : await attempt(intent);
+    };
+    const family = {
+        family: "machine-link-fences",
+        nextDue: () => z
+            .strictObject({ due: z.number().nullable() })
+            .parse(owner.sql
+            .exec("SELECT MIN(next_attempt_at) AS due FROM hub_machine_link_fences")
+            .toArray()[0]).due,
+        deliver: async () => {
+            const due = z.array(intentSchema).parse(owner.sql
+                .exec(`SELECT device_id,fence_epoch,failures FROM hub_machine_link_fences
+             WHERE next_attempt_at<=? ORDER BY next_attempt_at,device_id LIMIT 16`, Date.now())
+                .toArray());
+            await Promise.all(due.map(attempt));
+        },
+    };
+    return {
+        fenceAll,
+        fenceMember,
+        fenceLogins,
+        retireAllForErasure,
+        revoke,
+        family,
+    };
+}

package/dist/machine-link/home.d.ts

@@ -0,0 +1,20 @@
+import * as Schema from "effect/Schema";
+/**
+ * A Team Agent's delivery home, not a second Agent or relationship identity.
+ * Routing needs only the device; the attaching member stays with the
+ * enrollment owner, which reauthorizes it for every act.
+ */
+declare const machineAgentHomeSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"hosted">;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"machine">;
+    readonly deviceId: Schema.String;
+}>]>;
+/** The home published by a trusted Team directory projection. */
+export type MachineAgentHome = typeof machineAgentHomeSchema.Type;
+/**
+ * Decode one home without silently accepting another routing representation.
+ * This validates shape only; the host must attest the device.
+ */
+export declare function decodeMachineAgentHome(input: unknown): MachineAgentHome;
+export {};

package/dist/machine-link/home.js

@@ -0,0 +1,24 @@
+import * as Schema from "effect/Schema";
+// The directory's opaque identities use the same bound as Agent mail addresses.
+const identifier = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256));
+/**
+ * A Team Agent's delivery home, not a second Agent or relationship identity.
+ * Routing needs only the device; the attaching member stays with the
+ * enrollment owner, which reauthorizes it for every act.
+ */
+const machineAgentHomeSchema = Schema.Union([
+    Schema.Struct({ kind: Schema.Literal("hosted") }),
+    Schema.Struct({
+        kind: Schema.Literal("machine"),
+        deviceId: identifier,
+    }),
+]);
+/**
+ * Decode one home without silently accepting another routing representation.
+ * This validates shape only; the host must attest the device.
+ */
+export function decodeMachineAgentHome(input) {
+    return Schema.decodeUnknownSync(machineAgentHomeSchema, {
+        onExcessProperty: "error",
+    })(input);
+}

package/dist/machine-link/host.d.ts

@@ -0,0 +1,43 @@
+import type { PostEnvelope, PostDeliveryResult } from "@fungi.computer/carrier/post";
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+export type MachineLinkDevice = Readonly<{
+    deviceId: string;
+    memberId: string;
+    publicKey: string;
+    fenceEpoch: number;
+}>;
+/**
+ * Native device socket I/O. Pins/member authority and mail admission are supplied
+ * by their existing owners. Native attachments survive hibernation; pending
+ * Post I/O does not claim durable custody and is retried by Carrier.
+ */
+export declare class MachineLinkHost {
+    #private;
+    private readonly context;
+    private readonly options;
+    private readonly channels;
+    private readonly replay;
+    private readonly routes;
+    constructor(context: Pick<DurableObjectState, "getWebSockets" | "acceptWebSocket" | "setWebSocketAutoResponse" | "waitUntil">, owner: WatchdogSqliteOwner, options: Readonly<{
+        teamId: string;
+        directory: () => Promise<readonly {
+            agentId: string;
+            name: string;
+        }[]>;
+        authorize: (deviceId: string) => Promise<MachineLinkDevice>;
+        receive: (device: MachineLinkDevice, envelope: PostEnvelope) => Promise<PostDeliveryResult>;
+        /** The host's failure log for refused dials and closed links. */
+        report: (operation: string, cause: unknown) => void;
+    }>);
+    fetch(request: Request): Promise<Response>;
+    private publishDirectory;
+    private channel;
+    deliver(deviceId: string, envelope: PostEnvelope): Promise<PostDeliveryResult>;
+    message(socket: WebSocket, message: string | ArrayBuffer): Promise<void>;
+    close(socket: WebSocket): void;
+    private authorizeSocket;
+    /** A delayed old fence cannot retire a fresh connection at the current epoch. */
+    fence(fenceEpoch: number, live: boolean): void;
+    /** Authorized physical erasure retires even hibernated sockets, at any epoch. */
+    retireForErasure(): void;
+}