@fungi.computer/oyster 0.2.0 → 0.3.1

package/dist/standalone/app-builds-binding.js

@@ -1,38 +1,63 @@
 /**
- * The APPS guest binding on the standalone Bonsai root: start a build job on
+ * The APPS guest binding on the standalone Bonsai root: register an App from
+ * its repository's committed root manifest, start a build job on
  * this Oyster's one Computer, read a job's status, and install (or switch) a
  * Release at an installation id. Every operation re-checks the caller is the
  * tenant owner; the binding carries no key and no owner secret.
  */
 import { z } from "zod";
+import { buildStartFailureReply } from "./builds.js";
 import * as Schema from "effect/Schema";
 import { AppInstanceError } from "../index.js";
-import { installOrSelect } from "../host.js";
+import { installOrSelect, verifyRelease, } from "../host.js";
+import { repositoryWorkflowSourceSchema } from "@fungi.computer/workflows-wire";
 import { installationIdSchema } from "../apps/index.js";
 import { appIdSchema, releaseSchema } from "@fungi.computer/puffball/effect";
+import { gitRepositoryNameSchema } from "@fungi.computer/puffball/git-representation";
 /** The calling tenant's registry owns its App builds. */
 const buildRegistry = (env, scope) => env.REGISTRY.getByName(scope.durableName("registry"));
+const repositoryName = Schema.String.check(Schema.makeFilter((name) => gitRepositoryNameSchema.safeParse(name).success));
+const registrationArgs = Schema.decodeUnknownSync(Schema.Tuple([Schema.Struct({ repo: repositoryName })]), { onExcessProperty: "error" });
 const buildInput = z.lazy(() => z.strictObject({
     appId: z.string().min(1).max(256),
     sourceRevision: z.string().min(1).max(256),
+    installationId: z.string().min(1).max(256).optional(),
 }));
-const buildStatusInput = z.lazy(() => z.strictObject({
-    jobId: z.string().min(1).max(256),
-}));
+// Workflows wait for their particular job; Settings discovers the latest
+// job for its captured installation's repository after reload.
+const buildStatusArgs = Schema.decodeUnknownSync(Schema.Tuple([
+    Schema.Union([
+        Schema.Struct({
+            jobId: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(256)),
+        }),
+        Schema.Struct({ repo: repositoryName }),
+    ]),
+]), { onExcessProperty: "error" });
 const selectInput = z.lazy(() => z.strictObject({
     installationId: z.string().min(1).max(256),
+    jobId: z.string().min(1).max(256),
     release: z.unknown(),
 }));
 /** The Instance gate and native guest entrypoint share these argument codecs. */
 export const appsFrameMethods = {
     APPS: {
+        repository: {
+            decodeArgs: registrationArgs,
+            decodeResult: Schema.decodeUnknownSync(Schema.Json),
+            requiredOperations: () => ["repository"],
+        },
+        register: {
+            decodeArgs: registrationArgs,
+            decodeResult: Schema.decodeUnknownSync(Schema.Json),
+            requiredOperations: () => ["register"],
+        },
         build: {
             decodeArgs: (raw) => z.tuple([buildInput]).parse(raw),
             decodeResult: Schema.decodeUnknownSync(Schema.Json),
             requiredOperations: () => ["build"],
         },
         buildStatus: {
-            decodeArgs: (raw) => z.tuple([buildStatusInput]).parse(raw),
+            decodeArgs: buildStatusArgs,
             decodeResult: Schema.decodeUnknownSync(Schema.Json),
             requiredOperations: () => ["buildStatus"],
         },
@@ -43,7 +68,7 @@ export const appsFrameMethods = {
         },
     },
 };
-/** Only a live owner call reaches build, status or select; a key or a
+/** Only a live owner call reaches registration, build, status or select; a key or a
  * member without the owner role is refused before any registry or host read. */
 function callerOwner(frame) {
     const subject = frame.facts.subject;
@@ -61,36 +86,129 @@ export async function dispatchAppsBuildsBinding(env, scope, frame, props, method
     frame.signal.throwIfAborted();
     if (props.binding !== "APPS")
         throw new AppInstanceError("revoked");
+    if (method === "repository") {
+        const subject = frame.facts.subject;
+        if (frame.facts.selection.owner.kind !== "installation")
+            throw new AppInstanceError("revoked");
+        if (subject.kind === "call")
+            callerOwner(frame);
+        else if (subject.name !== "onGitPush")
+            throw new AppInstanceError("revoked");
+        const [input] = registrationArgs(args);
+        const installationId = frame.facts.selection.owner.id;
+        const source = await buildRegistry(env, scope).repositoryBuildSource(installationId, input.repo);
+        if (source === null)
+            return null;
+        const host = await backgroundHost();
+        if (host === null)
+            throw new AppInstanceError("revoked");
+        const installation = await host.installations.get(installationId);
+        if (installation?.status !== "enabled" ||
+            installation.instanceId !== frame.facts.instanceId ||
+            installation.authority.authorityVersion !==
+                frame.facts.selection.authorityVersion ||
+            installation.release.appId !== frame.facts.selection.appId ||
+            installation.release.releaseId !== frame.facts.selection.releaseId)
+            throw new AppInstanceError("revoked");
+        const verified = await verifyRelease(host.artifacts, installation.release, undefined, false);
+        frame.signal.throwIfAborted();
+        // invocationAuthorityOf pins executable backend bytes, not the App descriptor.
+        if (verified.backend?.digest !== frame.facts.artifactDigest)
+            throw new AppInstanceError("revoked");
+        return Schema.decodeUnknownSync(Schema.Json)(Schema.decodeUnknownSync(repositoryWorkflowSourceSchema)({
+            appId: source.appId,
+            installationId,
+            callerAppId: verified.release.appId,
+            callerSourceRevision: verified.release.artifact.provenance.sourceRevision,
+        }));
+    }
     const principal = callerOwner(frame);
     const requestedBy = principal.actor.kind === "member" ? principal.actor.memberId : "owner";
+    if (method === "register") {
+        const [input] = registrationArgs(args);
+        let result;
+        try {
+            result = await buildRegistry(env, scope).registerRepositoryApp({
+                memberId: requestedBy,
+                installationId: frame.facts.selection.owner.id,
+                repository: input.repo,
+            });
+        }
+        catch {
+            frame.signal.throwIfAborted();
+            return { status: 503, body: { error: "App registration unavailable" } };
+        }
+        frame.signal.throwIfAborted();
+        if (result.kind === "registered")
+            return {
+                status: 200,
+                body: { appId: result.appId, sourceRevision: result.sourceRevision },
+            };
+        switch (result.kind) {
+            case "unauthorized":
+                return { status: 403, body: { error: "Owner only" } };
+            case "invalid_app":
+                return {
+                    status: 400,
+                    body: { error: "Repository has no valid root App manifest" },
+                };
+            case "conflict":
+                return {
+                    status: 409,
+                    body: {
+                        error: "App identity is already registered to another source",
+                    },
+                };
+        }
+    }
     if (method === "build") {
         const [input] = z.tuple([buildInput]).parse(args);
         const appId = Schema.decodeUnknownSync(appIdSchema)(input.appId);
         const registry = buildRegistry(env, scope);
-        let build;
+        const context = frame.facts.subject.kind === "call"
+            ? frame.facts.subject.context
+            : undefined;
+        const workflowRequestId = context?.workflow === undefined ? undefined : context.idempotencyKey;
+        if (context?.workflow !== undefined && workflowRequestId === undefined)
+            throw new AppInstanceError("revoked");
+        const request = {
+            appId,
+            sourceRevision: input.sourceRevision,
+            requestedBy,
+        };
+        if (input.installationId !== undefined && workflowRequestId === undefined)
+            throw new AppInstanceError("revoked");
+        if (workflowRequestId !== undefined) {
+            request.workflow = {
+                requestId: workflowRequestId,
+                callerInstallationId: frame.facts.selection.owner.id,
+            };
+            if (input.installationId !== undefined)
+                request.workflow.installationId = input.installationId;
+        }
+        let result;
         try {
-            build = await registry.startBuild({
-                appId,
-                sourceRevision: input.sourceRevision,
-                requestedBy,
-            });
+            result = await registry.startBuild(request);
         }
         catch {
-            return Schema.decodeUnknownSync(Schema.Json)({
-                status: 409,
-                body: { error: "App has no build source" },
-            });
+            return Schema.decodeUnknownSync(Schema.Json)(buildStartFailureReply("unavailable"));
         }
         frame.signal.throwIfAborted();
-        return Schema.decodeUnknownSync(Schema.Json)({ status: 202, body: build });
+        return Schema.decodeUnknownSync(Schema.Json)(result.kind === "started"
+            ? { status: 202, body: result.build }
+            : buildStartFailureReply(result.reason));
     }
     if (method === "buildStatus") {
-        const [input] = z.tuple([buildStatusInput]).parse(args);
-        const build = await buildRegistry(env, scope).readBuild(input.jobId);
+        const [input] = buildStatusArgs(args);
+        const registry = buildRegistry(env, scope);
+        const build = "repo" in input
+            ? await registry.readRepositoryBuild(frame.facts.selection.owner.id, input.repo)
+            : await registry.readBuild(input.jobId);
         frame.signal.throwIfAborted();
+        const missingJob = build === null && "jobId" in input;
         return Schema.decodeUnknownSync(Schema.Json)({
-            status: build === null ? 404 : 200,
-            body: build ?? { error: "Not found" },
+            status: missingJob ? 404 : 200,
+            body: missingJob ? { error: "Not found" } : build,
         });
     }
     if (method === "select") {
@@ -108,10 +226,16 @@ export async function dispatchAppsBuildsBinding(env, scope, frame, props, method
                 body: { error: "Invalid Release" },
             });
         }
+        if (frame.facts.subject.kind === "call" &&
+            frame.facts.subject.context.workflow !== undefined) {
+            const result = await buildRegistry(env, scope).installWorkflowBuild(input.jobId, installationId, release, requestedBy, frame.facts.selection.owner.id);
+            frame.signal.throwIfAborted();
+            return Schema.decodeUnknownSync(Schema.Json)(result);
+        }
         const host = await backgroundHost();
         if (host === null)
             throw new AppInstanceError("revoked");
-        const response = await installOrSelect(host, installationId, release, principal);
+        const response = await installOrSelect(host, installationId, release, principal, "install-or-select", "app");
         frame.signal.throwIfAborted();
         return Schema.decodeUnknownSync(Schema.Json)(await responseResult(response));
     }

package/dist/standalone/app-set.d.ts

@@ -1,14 +1,15 @@
 import * as Schema from "effect/Schema";
 import { type PackOptions } from "../pack.js";
-/** One starter App: where its source lives and how the Computer builds it. */
+/** One starter App's identity and source; its manifest owns the build recipe. */
 export type StarterApp = Readonly<{
+    /** Selecting this configured dashboard approves its declared shell authority only. */
+    dashboard?: true;
     installationId: string;
     appId: string;
     /** The App's directory in a Botanical checkout; its recipe is rooted there. */
     directory: string;
     /** Its own public source repository's name, the App at that repository's root. */
     repository: string;
-    recipe: PackOptions["recipe"];
 }>;
 export declare const standaloneAppSet: readonly StarterApp[];
 /** Where the starter Apps' sources come from. */
@@ -87,5 +88,7 @@ export declare function installStandaloneAppSet(options: Readonly<{
         recipe: PackOptions["recipe"];
     }>) => Promise<Response>;
     pollMs?: number;
+    /** The idle wait between build status reads; the real timer by default. */
+    idle?: (ms: number, signal: AbortSignal) => Promise<void>;
     waitMs?: number;
 }>): Promise<readonly InstalledStarterApp[]>;