@fungi.computer/oyster 0.1.0 → 0.3.0

package/dist/boot-capability-route.js

@@ -0,0 +1,196 @@
+import { createHash } from "node:crypto";
+import { parseReleaseId } from "@fungi.computer/puffball";
+import { z } from "zod";
+import { BOOT_CAPABILITY_HEADER, } from "./boot-capability.js";
+import {} from "./boot-gate.js";
+import { defaultAssetPolicy } from "./release.js";
+import { bootAssetUrl, bootHostScript, bootParentDocument, candidateAssetUrls, candidateSecurityHeaders, parentSecurityHeaders, } from "./boot-mount.js";
+const tokenSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/);
+const candidatePreflightPathSchema = z
+    .tuple([
+    z.literal("_boot"),
+    z.string(),
+    z.literal("candidate"),
+    z.string().min(1),
+])
+    .rest(z.string().min(1));
+const capabilityPreflightSchema = z.object({
+    method: z.literal("OPTIONS"),
+    search: z.literal(""),
+    origin: z.literal("null"),
+    requestedMethod: z.literal("GET"),
+    requestedHeaders: z
+        .string()
+        .trim()
+        .toLowerCase()
+        .pipe(z.literal(BOOT_CAPABILITY_HEADER)),
+    path: candidatePreflightPathSchema,
+});
+/** Worker-only HTTPS endpoint for a single digest-authorized boot lease. */
+export async function serveBootCapability(request, options) {
+    const url = new URL(request.url);
+    if (!url.pathname.startsWith("/_boot/"))
+        return null;
+    const configured = new URL(options.configuredOrigin);
+    // The same origins checkBootPage opens: https, or http on loopback only.
+    const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(configured.hostname);
+    if ((configured.protocol !== "https:" &&
+        !(configured.protocol === "http:" && loopback)) ||
+        configured.pathname !== "/" ||
+        configured.search !== "" ||
+        configured.hash !== "" ||
+        configured.username !== "" ||
+        configured.password !== "" ||
+        url.origin !== configured.origin)
+        return refusal(404);
+    const segments = url.pathname.split("/");
+    if (isCapabilityPreflight(request, url, segments))
+        return capabilityPreflight();
+    const token = tokenSchema.safeParse(request.headers.get(BOOT_CAPABILITY_HEADER));
+    if (request.method !== "GET" ||
+        url.search !== "" ||
+        segments[2] === "" ||
+        !token.success ||
+        segments.length < 4 ||
+        segments[0] !== "" ||
+        segments[1] !== "_boot")
+        return refusal(404);
+    const tokenDigest = createHash("sha256")
+        .update(token.data, "utf8")
+        .digest("hex");
+    const lease = await options.capabilities.resolve(tokenDigest, Date.now());
+    if (lease === null)
+        return refusal(404);
+    // The capability store returns a lease already decoded at its persistence boundary.
+    const checkedLease = lease;
+    if (checkedLease.identity.releaseId !== segments[2])
+        return refusal(404);
+    const assets = checkedLease.assets.map(bootUiAsset);
+    const ui = {
+        identity: checkedLease.identity,
+        base: checkedLease.base,
+        assets,
+    };
+    const root = new URL(`/_boot/${checkedLease.identity.releaseId}/`, configured.origin);
+    const candidateBase = new URL("candidate/", root);
+    const urls = candidateAssetUrls(ui, candidateBase.href);
+    const entry = bootAssetUrl(candidateBase.href, checkedLease.base, "/index.html");
+    if (Date.now() >= checkedLease.expiresAt)
+        return refusal(404);
+    const parentPath = `${root.pathname}index.html`;
+    const bridgePath = `${root.pathname}bridge.js`;
+    if (url.pathname === parentPath) {
+        return new Response(bootParentDocument(checkedLease.identity, entry), {
+            status: 200,
+            headers: {
+                ...parentSecurityHeaders(candidateBase.href),
+                "content-type": "text/html; charset=utf-8",
+            },
+        });
+    }
+    if (url.pathname === bridgePath) {
+        return new Response(bootHostScript, {
+            status: 200,
+            headers: {
+                ...parentSecurityHeaders(candidateBase.href),
+                "content-type": "text/javascript; charset=utf-8",
+            },
+        });
+    }
+    const assetIndex = urls.findIndex((assetUrl) => {
+        const asset = new URL(assetUrl);
+        return asset.origin === url.origin && asset.pathname === url.pathname;
+    });
+    const asset = checkedLease.assets[assetIndex];
+    if (asset === undefined)
+        return refusal(404);
+    if (Date.now() >= checkedLease.expiresAt)
+        return refusal(404);
+    const object = await options.bucket.get(asset.artifactRef);
+    if (object?.size !== asset.byteLength)
+        return refusal(404);
+    const headers = new Headers({
+        ...candidateSecurityHeaders(candidateBase.href),
+        "content-type": asset.contentType,
+        "x-content-type-options": "nosniff",
+    });
+    if (request.headers.get("origin") === "null") {
+        headers.set("access-control-allow-origin", "null");
+        headers.set("vary", "Origin");
+    }
+    const hash = createHash("sha256");
+    let byteLength = 0;
+    const verified = object.body.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            if (Date.now() >= checkedLease.expiresAt) {
+                controller.error(new Error("Boot asset lease expired"));
+                return;
+            }
+            byteLength += chunk.byteLength;
+            if (byteLength > defaultAssetPolicy.maxObjectBytes) {
+                controller.error(new Error("Boot asset exceeds its size limit"));
+                return;
+            }
+            hash.update(chunk);
+            controller.enqueue(chunk);
+        },
+        flush(controller) {
+            if (byteLength !== asset.byteLength ||
+                `sha256:${hash.digest("hex")}` !== asset.digest)
+                controller.error(new Error("Boot asset verification failed"));
+        },
+    }));
+    return new Response(verified, { status: 200, headers });
+}
+function isCapabilityPreflight(request, url, segments) {
+    const preflight = capabilityPreflightSchema.safeParse({
+        method: request.method,
+        search: url.search,
+        origin: request.headers.get("origin"),
+        requestedMethod: request.headers.get("access-control-request-method"),
+        requestedHeaders: request.headers.get("access-control-request-headers"),
+        path: segments.slice(1),
+    });
+    if (!preflight.success)
+        return false;
+    try {
+        parseReleaseId(preflight.data.path[1]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function capabilityPreflight() {
+    return new Response(null, {
+        status: 204,
+        headers: {
+            "access-control-allow-origin": "null",
+            "access-control-allow-methods": "GET",
+            "access-control-allow-headers": BOOT_CAPABILITY_HEADER,
+            "cache-control": "no-store",
+            "referrer-policy": "no-referrer",
+            vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
+            "x-content-type-options": "nosniff",
+        },
+    });
+}
+function bootUiAsset(asset) {
+    return {
+        path: asset.path,
+        contentType: asset.contentType,
+        artifactRef: asset.artifactRef,
+        digest: asset.digest,
+    };
+}
+function refusal(status) {
+    return new Response("Boot resource unavailable", {
+        status,
+        headers: {
+            "cache-control": "no-store",
+            "content-type": "text/plain; charset=utf-8",
+            "referrer-policy": "no-referrer",
+            "x-content-type-options": "nosniff",
+        },
+    });
+}

package/dist/boot-capability.d.ts

@@ -0,0 +1,103 @@
+import { z } from "zod";
+import { type BootUi, type UiBootCheckOutcome } from "./boot-gate.js";
+import type { BootPageResult, BootPageTarget } from "./browser/boot.js";
+export declare const BOOT_CAPABILITY_HEADER = "x-oyster-boot-capability";
+declare const bootCapabilityAssetSchema: z.ZodObject<{
+    path: z.ZodString;
+    contentType: z.ZodString;
+    artifactRef: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").ArtifactRef, string>>;
+    digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").Sha256Digest, string>>;
+    byteLength: z.ZodNumber;
+}, z.core.$strict>;
+export declare const bootCapabilityLeaseSchema: z.ZodObject<{
+    id: z.ZodString;
+    identity: z.ZodObject<{
+        appId: z.ZodString;
+        releaseId: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").ReleaseId, string>>;
+        surfaceId: z.ZodLiteral<"host-boot">;
+    }, z.core.$strict>;
+    base: z.ZodString;
+    expiresAt: z.ZodNumber;
+    assets: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        contentType: z.ZodString;
+        artifactRef: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").ArtifactRef, string>>;
+        digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").Sha256Digest, string>>;
+        byteLength: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const bootCapabilityGrantSchema: z.ZodObject<{
+    lease: z.ZodObject<{
+        id: z.ZodString;
+        identity: z.ZodObject<{
+            appId: z.ZodString;
+            releaseId: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").ReleaseId, string>>;
+            surfaceId: z.ZodLiteral<"host-boot">;
+        }, z.core.$strict>;
+        base: z.ZodString;
+        expiresAt: z.ZodNumber;
+        assets: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            contentType: z.ZodString;
+            artifactRef: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").ArtifactRef, string>>;
+            digest: z.ZodPipe<z.ZodString, z.ZodTransform<import("@fungi.computer/puffball").Sha256Digest, string>>;
+            byteLength: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    tokenDigest: z.ZodString;
+}, z.core.$strict>;
+export type BootCapabilityAsset = z.output<typeof bootCapabilityAssetSchema>;
+export type BootCapabilityLease = z.output<typeof bootCapabilityLeaseSchema>;
+export type BootCapabilityGrant = z.output<typeof bootCapabilityGrantSchema>;
+/** Host-owned bounded Durable Object port. No raw token crosses this seam. */
+export type BootCapabilityStore = Readonly<{
+    issue(grant: BootCapabilityGrant): Promise<void>;
+    resolve(tokenDigest: string, now: number): Promise<BootCapabilityLease | null>;
+    revoke(id: string): Promise<void>;
+}>;
+/** Build metadata retained by the lease must exactly match the verified boot UI. */
+export declare function capabilityAssets(assets: BootUi["assets"], byteLengths: readonly number[]): BootCapabilityAsset[];
+export declare function validateCapabilityAssetSet(lease: BootCapabilityLease): void;
+/** The artifact bucket's metadata read; asset bytes are never read here. */
+export type BootCapabilityBucket = Readonly<{
+    head(key: string): Promise<Readonly<{
+        size: number;
+    }> | null>;
+}>;
+/**
+ * Mint one boot capability for every host: a fresh 256-bit token for the
+ * caller's request header, only its SHA-256 digest in the store, and a lease
+ * whose asset sizes come from the bucket's own metadata. An asset the bucket
+ * does not hold, or one beyond the asset policy, refuses before anything is
+ * stored.
+ */
+export declare function issueBootCapability(input: Readonly<{
+    ui: BootUi;
+    bucket: BootCapabilityBucket;
+    capabilities: BootCapabilityStore;
+    expiresAt: number;
+}>): Promise<Readonly<{
+    token: string;
+    leaseId: string;
+}>>;
+/** What one boot page report needs from its host. */
+export type BootPageReportInput = Readonly<{
+    /** The host's configured origin for its `/_boot/` route, or null when unset. */
+    origin: string | null;
+    /** `checkBootPage` over the host's browser, or null without one. */
+    check: ((target: BootPageTarget) => Promise<BootPageResult>) | null;
+    /** The Release's UI as artifact references, or null when it has no UI. */
+    readUi: () => Promise<BootUi | null>;
+    bucket: BootCapabilityBucket;
+    capabilities: BootCapabilityStore;
+    now: () => number;
+}>;
+/**
+ * One UI page check for a Release, for every host, reading no UI bytes:
+ * issue a capability, open the pinned boot page, revoke the capability, and
+ * report in the boot gate's vocabulary. A page that did not mount fails,
+ * with diagnostics sanitized by the gate's schema; a timeout, unconfirmed
+ * cleanup, an unavailable runner, or no browser or origin is not checked.
+ */
+export declare function reportBootPage(input: BootPageReportInput): Promise<UiBootCheckOutcome>;
+export {};

package/dist/boot-capability.js

@@ -0,0 +1,141 @@
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { parseArtifactRef, parseReleaseId, parseSha256Digest, } from "@fungi.computer/puffball";
+import { BOOT_DEADLINE_MS, BOOT_TRANSPORT_GRACE_MS, BootGateError, bootMountDiagnosticsSchema, } from "./boot-gate.js";
+import { defaultAssetPolicy } from "./release.js";
+export const BOOT_CAPABILITY_HEADER = "x-oyster-boot-capability";
+const bootCapabilityAssetSchema = z.strictObject({
+    path: z.string().min(1).max(4096),
+    contentType: z.string().min(1).max(256),
+    artifactRef: z.string().min(1).max(512).transform(parseArtifactRef),
+    digest: z.string().min(1).max(80).transform(parseSha256Digest),
+    byteLength: z
+        .number()
+        .int()
+        .nonnegative()
+        .max(defaultAssetPolicy.maxObjectBytes),
+});
+export const bootCapabilityLeaseSchema = z.strictObject({
+    id: z.string().min(1).max(128),
+    identity: z.strictObject({
+        appId: z.string().min(1).max(256),
+        releaseId: z.string().transform(parseReleaseId),
+        surfaceId: z.literal("host-boot"),
+    }),
+    base: z.string().min(1).max(2048),
+    expiresAt: z.number().int().positive(),
+    assets: z.array(bootCapabilityAssetSchema).max(defaultAssetPolicy.maxObjects),
+});
+export const bootCapabilityGrantSchema = z.strictObject({
+    lease: bootCapabilityLeaseSchema,
+    tokenDigest: z.string().regex(/^[0-9a-f]{64}$/),
+});
+/** Build metadata retained by the lease must exactly match the verified boot UI. */
+export function capabilityAssets(assets, byteLengths) {
+    if (assets.length !== byteLengths.length)
+        throw new Error("Boot capability asset metadata is incomplete");
+    return assets.map((asset, index) => {
+        const byteLength = byteLengths[index];
+        if (byteLength === undefined)
+            throw new Error("Boot capability asset metadata is incomplete");
+        return { ...asset, byteLength };
+    });
+}
+export function validateCapabilityAssetSet(lease) {
+    const total = lease.assets.reduce((sum, asset) => sum + asset.byteLength, 0);
+    if (total > defaultAssetPolicy.maxTotalBytes ||
+        new Set(lease.assets.map((asset) => asset.path)).size !==
+            lease.assets.length)
+        throw new Error("Boot capability asset set is invalid");
+}
+const bootCapabilityIds = defineIdFamily({
+    family: "oyster-boot-capability",
+    version: 1,
+    kinds: { lease: { prefix: "bcap" } },
+});
+/**
+ * Mint one boot capability for every host: a fresh 256-bit token for the
+ * caller's request header, only its SHA-256 digest in the store, and a lease
+ * whose asset sizes come from the bucket's own metadata. An asset the bucket
+ * does not hold, or one beyond the asset policy, refuses before anything is
+ * stored.
+ */
+export async function issueBootCapability(input) {
+    const byteLengths = [];
+    let totalBytes = 0;
+    for (const asset of input.ui.assets) {
+        const head = await input.bucket.head(asset.artifactRef);
+        if (head === null || head.size > defaultAssetPolicy.maxObjectBytes)
+            throw new BootGateError("ui_mount_failed");
+        totalBytes += head.size;
+        if (totalBytes > defaultAssetPolicy.maxTotalBytes)
+            throw new BootGateError("ui_mount_failed");
+        byteLengths.push(head.size);
+    }
+    const lease = {
+        id: bootCapabilityIds.lease.generate(),
+        identity: input.ui.identity,
+        base: input.ui.base,
+        expiresAt: input.expiresAt,
+        assets: capabilityAssets(input.ui.assets, byteLengths),
+    };
+    validateCapabilityAssetSet(lease);
+    const token = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(32))))
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replace(/=+$/u, "");
+    const tokenDigest = createHash("sha256").update(token, "utf8").digest("hex");
+    await input.capabilities.issue({ lease, tokenDigest });
+    return { token, leaseId: lease.id };
+}
+/**
+ * One UI page check for a Release, for every host, reading no UI bytes:
+ * issue a capability, open the pinned boot page, revoke the capability, and
+ * report in the boot gate's vocabulary. A page that did not mount fails,
+ * with diagnostics sanitized by the gate's schema; a timeout, unconfirmed
+ * cleanup, an unavailable runner, or no browser or origin is not checked.
+ */
+export async function reportBootPage(input) {
+    const ui = await input.readUi();
+    if (ui === null)
+        return { kind: "passed" };
+    if (input.check === null || input.origin === null)
+        return { kind: "not_checked", code: "boot_browser_binding_missing" };
+    const deadlineAt = input.now() + BOOT_DEADLINE_MS;
+    let issued;
+    try {
+        issued = await issueBootCapability({
+            ui,
+            bucket: input.bucket,
+            capabilities: input.capabilities,
+            expiresAt: deadlineAt + BOOT_TRANSPORT_GRACE_MS,
+        });
+    }
+    catch (cause) {
+        if (cause instanceof BootGateError && cause.code === "ui_mount_failed")
+            return { kind: "failed", code: "ui_mount_failed" };
+        throw cause;
+    }
+    let result;
+    try {
+        result = await input.check({
+            origin: input.origin,
+            releaseId: ui.identity.releaseId,
+            capability: { header: BOOT_CAPABILITY_HEADER, token: issued.token },
+            deadlineAt,
+        });
+    }
+    finally {
+        await input.capabilities.revoke(issued.leaseId);
+    }
+    if (result.kind === "mounted")
+        return { kind: "passed" };
+    if (result.code === "ui_mount_failed")
+        return {
+            kind: "failed",
+            code: "ui_mount_failed",
+            diagnostics: bootMountDiagnosticsSchema.parse(result.diagnostics),
+        };
+    return { kind: "not_checked", code: result.code };
+}

package/dist/boot-construction.d.ts

@@ -0,0 +1,12 @@
+import type { Backend, Instance } from "./index.js";
+import type { AppInstanceContext, AppInstanceLoader } from "./cloudflare.js";
+import type { GuestLimits } from "./guest-policy.js";
+/** One bounded disposable sibling; it can never become the live App facet. */
+export declare const BACKEND_CONSTRUCTION_FACET = "candidate";
+/**
+ * The Instance owns the disposable facet and supplies its already-read prior
+ * state schema. Only initialized App storage is copied; supervisor state and
+ * authority are never copied. A unique Loader ID isolates candidate globals.
+ * No invocation frame or guestEnv factory is accepted.
+ */
+export declare function checkBackendConstruction<FacetClass>(ctx: Pick<AppInstanceContext<FacetClass>, "facets">, loader: AppInstanceLoader<FacetClass> | undefined, artifact: Backend, limits: GuestLimits, priorStateSchema: Instance["stateSchema"]): Promise<void>;

package/dist/boot-construction.js

@@ -0,0 +1,175 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import { rpcHandleSchema, rpcMethod } from "@fungi.computer/agar/rpc";
+import { z } from "zod";
+import * as Result from "effect/Result";
+import { correlationKey } from "@fungi.computer/cairn";
+import { BOOT_DEADLINE_MS, BootGateError } from "./boot-gate.js";
+const probeSchema = rpcHandleSchema({
+    construct: rpcMethod(z.undefined()).input(z.tuple([])),
+});
+/** One bounded disposable sibling; it can never become the live App facet. */
+export const BACKEND_CONSTRUCTION_FACET = "candidate";
+/**
+ * The Instance owns the disposable facet and supplies its already-read prior
+ * state schema. Only initialized App storage is copied; supervisor state and
+ * authority are never copied. A unique Loader ID isolates candidate globals.
+ * No invocation frame or guestEnv factory is accepted.
+ */
+export async function checkBackendConstruction(ctx, loader, artifact, limits, priorStateSchema) {
+    if (loader === undefined)
+        throw new BootGateError("boot_runner_unavailable");
+    const name = BACKEND_CONSTRUCTION_FACET;
+    const loaderId = `boot:${correlationKey()}`;
+    let stage = "backend_load_failed";
+    let timeout;
+    const result = await (async () => {
+        try {
+            const env_1 = { stack: [], error: void 0, hasError: false };
+            try {
+                const deadline = new Promise((_, reject) => {
+                    timeout = setTimeout(() => {
+                        reject(new BootGateError("boot_timeout"));
+                    }, BOOT_DEADLINE_MS);
+                });
+                if (priorStateSchema !== null) {
+                    if (ctx.facets.clone === undefined)
+                        throw new BootGateError("boot_clone_unavailable");
+                    ctx.facets.clone("app", name);
+                }
+                else {
+                    // A crash may have left the bounded sibling behind. Fresh means empty,
+                    // not a retry against storage written by an earlier constructor.
+                    ctx.facets.delete(name);
+                }
+                const stub = __addDisposableResource(env_1, probeSchema.parse(ctx.facets.get(name, () => ({
+                    class: loader
+                        .get(loaderId, () => ({
+                        compatibilityDate: artifact.backend.compatibilityDate,
+                        mainModule: "boot.js",
+                        modules: {
+                            "backend.js": artifact.backend.code,
+                            "boot.js": constructionModule(artifact.backend.exportName),
+                        },
+                        env: {},
+                        globalOutbound: null,
+                        limits,
+                    }))
+                        .getDurableObjectClass("BootConstruction"),
+                }))), false);
+                stage = "backend_construction_failed";
+                await Promise.race([stub.construct(), deadline]);
+                return Result.succeed(undefined);
+            }
+            catch (e_1) {
+                env_1.error = e_1;
+                env_1.hasError = true;
+            }
+            finally {
+                __disposeResources(env_1);
+            }
+        }
+        catch (cause) {
+            return Result.fail(cause instanceof BootGateError
+                ? cause
+                : new BootGateError(stage, { cause }));
+        }
+        finally {
+            if (timeout !== undefined)
+                clearTimeout(timeout);
+        }
+    })();
+    // Cleanup uncertainty takes precedence over the captured probe result.
+    try {
+        try {
+            ctx.facets.abort(name, new Error("Candidate boot ended"));
+        }
+        finally {
+            ctx.facets.delete(name);
+        }
+    }
+    catch (cause) {
+        throw new BootGateError("boot_cleanup_failed", { cause });
+    }
+    if (Result.isFailure(result))
+        throw result.failure;
+}
+function constructionModule(exportName) {
+    return `import { DurableObject } from "cloudflare:workers";
+// Capture trusted operations BEFORE evaluating any candidate module.
+const construct = Reflect.construct;
+const freeze = Object.freeze;
+// These are host test bindings, not invocation loopbacks. They deny all
+// external operations. SQLite is the disposable facet's fresh or copied storage.
+const unavailable = () => { throw new Error("Host test binding unavailable"); };
+const env = freeze({
+  APP_STORAGE: freeze({
+    read: unavailable, write: unavailable, reset: unavailable
+  })
+});
+export class BootConstruction extends DurableObject {
+  constructor(ctx, bindings) {
+    super(ctx, bindings);
+    ctx.blockConcurrencyWhile(async () => {
+      const backend = await import("./backend.js");
+      construct(backend[${JSON.stringify(exportName)}], [ctx, env]);
+    });
+  }
+  // Native constructor blocking must finish before RPC dispatch. No App-mutated
+  // Promise methods or candidate-supplied completion value decide readiness.
+  construct() {}
+}
+// A candidate can import this module, but cannot patch the host check.
+freeze(BootConstruction.prototype);
+freeze(BootConstruction);`;
+}