@fungi.computer/oyster 0.2.0 → 0.3.0

package/dist/standalone/machine-link.d.ts

@@ -0,0 +1,354 @@
+import { createMachineEnrollment, type MachineEnrollment, type MachineLinkDeviceFacts, type MachineLinkIdentity, type MachineLinkFenceFact, type MachineLinkCaller, type MachineLinkTargetFacts, type MachineAgentHome } from "../machine-link/index.js";
+import { type LiveOysterKey, type OysterKeyStore } from "../keys.js";
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import { DurableObject } from "cloudflare:workers";
+import { type MachineLinkAuthority, type MachineLinkFenceResult } from "../machine-link/index.js";
+import type { PostEnvelope, PostDeliveryResult } from "@fungi.computer/carrier/post";
+import type { MachineAgentOperation } from "@fungi.computer/seam/machine-link-protocol";
+import { type TenantScope } from "../tenant.js";
+import { type StandaloneTenancyEnv } from "./tenancy.js";
+import type { StandaloneAgentsEnv, AgentDirectory } from "./agents.js";
+/** Standalone's fresh directory projection for the shared hosted client. */
+export declare function standaloneMachineAgentHome(options: {
+    identity(): Readonly<{
+        teamId: string;
+        agentId: string;
+    }> | null;
+    directory: {
+        getByName(name: string): Pick<AgentDirectory, "agentHome" | "machineTarget">;
+    };
+}): (agentId: string) => Promise<MachineAgentHome>;
+export type StandaloneMachineLinkBindings = Readonly<{
+    MACHINE_LINK: DurableObjectNamespace<MachineLinkDO>;
+}>;
+/** Everything the standalone machine link reads from its Worker. */
+export type StandaloneMachineLinkEnv = StandaloneTenancyEnv & Pick<StandaloneAgentsEnv, "AGENTS" | "AGENT_DIRECTORY"> & StandaloneMachineLinkBindings;
+export type StandaloneMachineJoinResult = Readonly<{
+    kind: "refused";
+    error: "not_allowed" | "request_conflict" | "capacity" | "invalid_enrollment";
+}> | Readonly<{
+    kind: "enrolled";
+    value: Awaited<ReturnType<ReturnType<typeof createMachineEnrollment>["enroll"]>>;
+}>;
+/** Fresh host authority; no answer is retained by the adapter or the link. */
+export declare function standaloneMachineLinkAuthority(env: StandaloneMachineLinkEnv): MachineLinkAuthority;
+/** HTTP enrollment over the existing live KEYS and directory owners. */
+export declare function standaloneMachineJoinRoutes(options: {
+    scope: TenantScope;
+    ownerId: () => Promise<string | null>;
+    keys: () => Pick<OysterKeyStore, "verify"> & {
+        live(keyId: string): Promise<LiveOysterKey | null>;
+    };
+    enroll(keyId: string, input: MachineEnrollment): Promise<StandaloneMachineJoinResult>;
+}): import("hono/hono-base").HonoBase<import("hono/types").BlankEnv, {
+    "/local/mesh/join": {
+        $post: {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: null;
+            outputFormat: "body";
+            status: 403;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: null;
+            outputFormat: "body";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: {
+                error: "request_conflict" | "capacity";
+            };
+            outputFormat: "json";
+            status: 409;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: {
+                deviceId: string;
+                agents: {
+                    selection: number;
+                    agentId: string;
+                }[];
+                kind: string;
+                scopeId: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+}, "/", "/local/mesh/join">;
+/** Only join accepts an oyk credential; every subsequent dial uses Seam. */
+export declare function standaloneMachineLinkRoutes(env: StandaloneMachineLinkEnv): import("hono/hono-base").HonoBase<import("hono/types").BlankEnv, {
+    "/local/mesh/join": {
+        $post: {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: null;
+            outputFormat: "body";
+            status: 403;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: null;
+            outputFormat: "body";
+            status: 401;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: {
+                error: "request_conflict" | "capacity";
+            };
+            outputFormat: "json";
+            status: 409;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: {
+                error: string;
+            };
+            outputFormat: "json";
+            status: 400;
+        } | {
+            input: {
+                json: {
+                    requestId: string;
+                    publicKey: string;
+                    machineLabel: string;
+                    agents: {
+                        name: string;
+                    }[];
+                };
+            };
+            output: {
+                deviceId: string;
+                agents: {
+                    selection: number;
+                    agentId: string;
+                }[];
+                kind: string;
+                scopeId: string;
+            };
+            outputFormat: "json";
+            status: 200;
+        };
+    };
+} & {
+    "/api/teams/:teamId/local/mesh/:deviceId/connect": {
+        $get: {
+            input: {
+                param: {
+                    teamId: string;
+                } & {
+                    deviceId: string;
+                };
+            };
+            output: {};
+            outputFormat: string;
+            status: import("hono/utils/http-status").StatusCode;
+        };
+    };
+}, "/", "/api/teams/:teamId/local/mesh/:deviceId/connect">;
+/** One device's link; directory, credentials and owner state remain elsewhere. */
+export declare class MachineLinkDO extends DurableObject<StandaloneMachineLinkEnv> {
+    private readonly link;
+    fetch(request: Request): Promise<Response>;
+    deliver(id: MachineLinkIdentity, caller: MachineLinkCaller, agentId: string, envelope: PostEnvelope): Promise<PostDeliveryResult>;
+    operation(id: MachineLinkIdentity, caller: MachineLinkCaller, agentId: string, operation: MachineAgentOperation): Promise<import("effect/Schema").Json>;
+    applyFence(fact: MachineLinkFenceFact): Promise<MachineLinkFenceResult>;
+    preflightErasure(teamId: string, deviceId: string): Promise<void>;
+    eraseForTeam(teamId: string, deviceId: string): Promise<{
+        erased: boolean;
+    }>;
+    readErasure(): Promise<{
+        erased: boolean;
+    }>;
+    webSocketMessage(socket: WebSocket, message: string | ArrayBuffer): Promise<void>;
+    webSocketClose(socket: WebSocket, code: number, reason: string): void;
+    webSocketError(socket: WebSocket): void;
+}
+/** Enrollment and the ordinary directory share this one SQLite owner. */
+export declare function createStandaloneMachineEnrollment(options: {
+    owner: WatchdogSqliteOwner;
+    scopeId: string;
+    ownerId: () => Promise<string | null>;
+    liveKey: (keyId: string) => Promise<LiveOysterKey | null>;
+    onAgentCreated: (agentId: string) => void;
+}): {
+    admitDevice: (id: MachineLinkIdentity) => Promise<MachineLinkDeviceFacts>;
+    currentFence: (id: MachineLinkIdentity) => Promise<MachineLinkFenceFact | null>;
+    target: (caller: MachineLinkCaller, agentId: string, requester: string | null) => Promise<MachineLinkTargetFacts>;
+    publicDirectory(id: MachineLinkIdentity): Promise<{
+        agentId: import("@fungi.computer/shiitake/fleet").AgentId;
+        name: string;
+    }[]>;
+    enrollWithKey(keyId: string, input: MachineEnrollment): Promise<{
+        deviceId: string;
+        agents: {
+            selection: number;
+            agentId: string;
+        }[];
+    }>;
+    enroll: (rawMember: import("../machine-link/enrollment.js").MachineMember, raw: MachineEnrollment) => Promise<{
+        deviceId: string;
+        agents: {
+            selection: number;
+            agentId: string;
+        }[];
+    }>;
+    device: (deviceId: string) => {
+        deviceId: string;
+        memberId: string;
+        clientId: string;
+        loginId: string;
+        publicKey: string;
+        machineLabel: string;
+        fenceEpoch: number;
+    } | null;
+    home: (agentId: string) => MachineAgentHome | null;
+    revoke: (memberId: string, deviceId: string) => boolean;
+    authorizeDevice: (deviceId: string) => Promise<{
+        deviceId: string;
+        memberId: string;
+        clientId: string;
+        loginId: string;
+        publicKey: string;
+        machineLabel: string;
+        fenceEpoch: number;
+    }>;
+    retainedDevices: () => {
+        deviceId: string;
+        memberId: string;
+        clientId: string;
+        loginId: string;
+        revoked: boolean;
+        fenceEpoch: number;
+    }[];
+    fenceDevice: (deviceId: string) => number | null;
+    fenceMember: (memberId: string) => {
+        deviceId: string;
+        fenceEpoch: number;
+    }[];
+    fenceLogins: (memberId: string, selection: import("../machine-link/enrollment.js").MachineLoginSelection) => {
+        deviceId: string;
+        fenceEpoch: number;
+    }[];
+    retireAllForErasure: () => {
+        deviceId: string;
+        fenceEpoch: number;
+    }[];
+    keyRetired: (deviceId: string) => boolean;
+};