@fungi.computer/oyster 0.2.0 → 0.3.1

package/dist/standalone/app-set.js

@@ -2,150 +2,66 @@ import { execFile } from "node:child_process";
 import { mkdtemp, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
+import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
+import { olderOysterStoreCode } from "../older-oyster-store.js";
 import { publishSource } from "../pack.js";
+import { appBuildRecipe, readBuildManifest } from "../build/workspace-build.js";
 import { parseSourceRevision } from "@fungi.computer/puffball";
-// Existing closed source recipes, shared by the standalone install command and
-// its real-root proof. The canonical Oyster builder owns every compilation, on
-// the Oyster's own Computer.
-const assets = {
-    maxManifestBytes: 1_048_576,
-    maxObjects: 1024,
-    maxObjectBytes: 16_777_216,
-    maxTotalBytes: 67_108_864,
-};
-const facet = { kind: "durable-facet", stateSchema: 1 };
+import { releaseSchema } from "@fungi.computer/puffball/effect";
+import { grantCommandSchema, installationSchema, } from "../apps/installation.js";
+import { appPermissionPageSchema } from "../apps/permissions.js";
+import { installOnOyster, InstallationObservationError, } from "../installation-client.js";
 export const standaloneAppSet = [
     {
         installationId: "tourtois",
+        dashboard: true,
         directory: "apps/tourtois",
         repository: "tourtois",
         appId: "app_tourtois",
-        recipe: {
-            entry: "apps/tourtois/index.html",
-            assets,
-            assetBase: "./",
-            backend: {
-                entry: "apps/tourtois/backend/index.ts",
-                exportName: "Tourtois",
-                compatibilityDate: "2026-09-04",
-                runtime: facet,
-            },
-            maxOutputBytes: 67_108_864,
-        },
     },
     {
         installationId: "bonsai",
         directory: "apps/bonsai",
         repository: "bonsai",
         appId: "app_bonsai",
-        recipe: {
-            entry: "apps/bonsai/web/index.html",
-            assets,
-            assetBase: "./",
-            maxOutputBytes: 67_108_864,
-            backend: {
-                entry: "apps/bonsai/backend/index.ts",
-                exportName: "BonsaiApp",
-                compatibilityDate: "2026-09-04",
-                runtime: facet,
-            },
-        },
     },
     {
         installationId: "shed",
         directory: "apps/shed",
         repository: "shed",
         appId: "app_shed",
-        recipe: {
-            entry: "apps/shed/index.html",
-            assets: {
-                maxManifestBytes: 1_048_576,
-                maxObjects: 512,
-                maxObjectBytes: 4_194_304,
-                maxTotalBytes: 16_777_216,
-            },
-            assetBase: "./",
-            maxOutputBytes: 16_777_216,
-            backend: {
-                entry: "apps/shed/backend/index.ts",
-                exportName: "Shed",
-                compatibilityDate: "2026-09-25",
-                runtime: facet,
-            },
-        },
     },
     {
         installationId: "inkcap",
         directory: "apps/inkcap",
         repository: "inkcap",
         appId: "app_inkcap",
-        recipe: {
-            entry: "apps/inkcap/index.html",
-            assets,
-            assetBase: "./",
-            maxOutputBytes: 16_777_216,
-            backend: {
-                entry: "apps/inkcap/backend/index.ts",
-                exportName: "Inkcap",
-                compatibilityDate: "2026-09-25",
-                runtime: facet,
-            },
-        },
     },
     {
         installationId: "trellis",
         directory: "apps/trellis",
         repository: "trellis",
         appId: "app_trellis",
-        recipe: {
-            entry: "apps/trellis/index.html",
-            maxOutputBytes: 16_777_216,
-            backend: {
-                entry: "apps/trellis/backend/index.ts",
-                exportName: "Trellis",
-                compatibilityDate: "2026-09-04",
-                runtime: facet,
-            },
-        },
     },
     {
         installationId: "prints",
         directory: "apps/prints",
         repository: "prints",
         appId: "app_prints",
-        recipe: {
-            entry: "apps/prints/index.html",
-            assets,
-            assetBase: "./",
-            maxOutputBytes: 16_777_216,
-            backend: {
-                entry: "apps/prints/backend/index.ts",
-                exportName: "Prints",
-                compatibilityDate: "2026-09-04",
-                runtime: facet,
-            },
-        },
     },
     {
         installationId: "grove",
         directory: "apps/grove",
         repository: "grove",
         appId: "app_grove",
-        recipe: {
-            entry: "apps/grove/index.html",
-            assets,
-            assetBase: "./",
-            maxOutputBytes: 67_108_864,
-            backend: {
-                entry: "apps/grove/backend/index.ts",
-                exportName: "Grove",
-                compatibilityDate: "2026-09-04",
-                runtime: facet,
-            },
-        },
     },
 ];
+/** The host's refusal of a store written by Oyster 0.2 or earlier. */
+const olderOysterStoreRefusal = Schema.Struct({
+    error: Schema.Literal(olderOysterStoreCode),
+    message: Schema.String,
+});
 const publishedSchema = Schema.Struct({
     kind: Schema.Literals(["recorded", "existing"]),
     receipt: Schema.Struct({
@@ -181,23 +97,6 @@ const appBuildWaitMs = 20 * 60_000;
 export const defaultStarterBuildConcurrency = 2;
 /** The most builds at once on the 12 GiB Computer. */
 const maxStarterBuildConcurrency = 3;
-/** A recipe rooted at `from` (a checkout directory), rooted at `to` instead. */
-function relocateRecipe(recipe, from, to) {
-    const move = (path) => {
-        if (!path.startsWith(`${from}/`))
-            throw new Error(`${path} is outside its App directory ${from}`);
-        const rest = path.slice(from.length + 1);
-        return to === "" ? rest : `${to}/${rest}`;
-    };
-    const backend = recipe.backend;
-    if (backend?.entry === undefined)
-        return { ...recipe, entry: move(recipe.entry) };
-    return {
-        ...recipe,
-        entry: move(recipe.entry),
-        backend: { ...backend, entry: move(backend.entry) },
-    };
-}
 const run = (command, args, cwd) => new Promise((resolveRun, reject) => {
     execFile(command, args, { cwd, encoding: "utf8", maxBuffer: 1_048_576 }, (error, stdout) => {
         if (error)
@@ -220,7 +119,10 @@ export async function installStandaloneAppSet(options) {
         concurrency < 1 ||
         concurrency > maxStarterBuildConcurrency)
         throw new Error(`Starter builds run 1 to ${String(maxStarterBuildConcurrency)} at a time`);
-    const authorization = { Authorization: `Bearer ${options.key}` };
+    const authorization = {
+        Authorization: `Bearer ${options.key}`,
+        Accept: "application/json",
+    };
     const owner = async (method, path, body, signal) => {
         const init = body === undefined
             ? { method, headers: authorization }
@@ -233,6 +135,59 @@ export async function installStandaloneAppSet(options) {
             init.signal = signal;
         return fetch(new URL(path, options.url), init);
     };
+    const approveChosenDashboard = async (installed, generation) => {
+        const name = installed.installationId;
+        const path = `/api/installations/${encodeURIComponent(name)}/grants`;
+        const projectionResponse = await owner("GET", path);
+        if (!projectionResponse.ok)
+            throw new Error(`${name} approval read failed (${String(projectionResponse.status)})`);
+        const projection = appPermissionPageSchema.parse(await projectionResponse.json());
+        const { permissions } = projection;
+        const digest = installed.release.artifact.artifactDigest;
+        if (projection.storeGeneration !== generation ||
+            projection.installationId !== name ||
+            projection.artifactDigest !== digest ||
+            permissions.declaredOperations.artifactDigest !== digest ||
+            permissions.authority.authorityVersion !==
+                installed.authority.authorityVersion ||
+            permissions.authority.declaredOperationsDigest !==
+                installed.authority.declaredOperationsDigest ||
+            permissions.declaredOperations.digest !==
+                installed.authority.declaredOperationsDigest)
+            throw new Error(`${name} approval snapshot changed`);
+        const shell = permissions.declaredOperations.capabilities.find((row) => row.capability === "team.workbenchHost");
+        if (shell === undefined)
+            return;
+        const command = grantCommandSchema.parse({
+            kind: "change-grants",
+            changes: [
+                {
+                    capability: shell.capability,
+                    grant: { operations: shell.operations, resources: "tenant-scope" },
+                },
+            ],
+        });
+        const saved = await owner("PUT", path, Schema.decodeUnknownSync(Schema.Json)({
+            storeGeneration: projection.storeGeneration,
+            authorityVersion: installed.authority.authorityVersion,
+            artifactDigest: digest,
+            command,
+        }));
+        if (!saved.ok)
+            throw new Error(`${name} approval failed (${String(saved.status)})`);
+        const receipt = installationSchema.parse(await saved.json());
+        if (receipt.installationId !== name ||
+            receipt.instanceId !== installed.instanceId ||
+            receipt.release.artifact.artifactDigest !== digest ||
+            receipt.authority.authorityVersion !==
+                installed.authority.authorityVersion + 1 ||
+            !receipt.authority.approvedGrants.some((grant) => grant.capability === "team.workbenchHost" &&
+                grant.resources === "tenant-scope" &&
+                shell.operations.every((operation) => grant.operations.includes(operation))))
+            throw new Error(`${name} approval incomplete`);
+    };
+    const idle = options.idle ??
+        ((ms, signal) => sleep(ms, undefined, { signal }));
     /** Start one build and wait for its terminal outcome within the build
      * budget; the budget cancels every request and body read it covers. */
     const buildOnComputer = async (name, appId, seedRevision) => {
@@ -246,11 +201,13 @@ export async function installStandaloneAppSet(options) {
             jobId = build.jobId;
             options.report(`Building ${name} on the Computer (${build.jobId})`);
             while (build.status === "running") {
-                await sleep(options.pollMs ?? 5_000, undefined, { signal: budget });
                 const read = await owner("GET", `/api/builds/${encodeURIComponent(build.jobId)}`, undefined, budget);
                 if (!read.ok)
                     throw new Error(`${name} build is missing (${String(read.status)})`);
                 build = Schema.decodeUnknownSync(buildSchema)(await read.json());
+                // Read first: a build already finished costs no idle wait.
+                if (build.status === "running")
+                    await idle(options.pollMs ?? 5_000, budget);
             }
             return build;
         }
@@ -276,13 +233,19 @@ export async function installStandaloneAppSet(options) {
      * own repository; `release` removes a clone once its template is seeded. */
     const locate = async (app) => {
         const source = options.source;
-        if (source.kind === "checkout")
+        if (source.kind === "checkout") {
+            const sourceRevision = parseSourceRevision(source.revision);
+            const metadata = await run("git", [
+                "show",
+                sourceRevision.slice(4) + ":" + app.directory + "/package.json",
+            ], source.directory);
             return {
                 repositoryPath: source.directory,
-                sourceRevision: parseSourceRevision(source.revision),
-                recipe: app.recipe,
+                sourceRevision,
+                recipe: appBuildRecipe(readBuildManifest(metadata), app.directory),
                 release: () => Promise.resolve(),
             };
+        }
         const clone = await mkdtemp(join(source.scratch, `${app.repository}-`));
         try {
             await run("git", [
@@ -298,7 +261,7 @@ export async function installStandaloneAppSet(options) {
             return {
                 repositoryPath: clone,
                 sourceRevision: parseSourceRevision(`git:${head}`),
-                recipe: relocateRecipe(app.recipe, app.directory, ""),
+                recipe: appBuildRecipe(readBuildManifest(await run("git", ["show", head + ":package.json"], clone)), ""),
                 release: () => rm(clone, { recursive: true, force: true }),
             };
         }
@@ -307,21 +270,38 @@ export async function installStandaloneAppSet(options) {
             throw cause;
         }
     };
-    // Seed every template first: a git push each, quick beside a build.
-    const seeded = [];
-    for (const app of standaloneAppSet) {
+    const installed = new Map();
+    /** Set by the first failure, so no further seed or build starts. */
+    const stop = { requested: false };
+    /** Every failure, in the order it happened; the first is the one thrown. */
+    const failures = [];
+    const seededQueue = [];
+    const waiting = [];
+    const seeding = { finished: false };
+    const takeSeeded = () => new Promise((resolveTake) => {
+        const next = seededQueue.shift();
+        if (next !== undefined || seeding.finished)
+            resolveTake(next);
+        else
+            waiting.push(resolveTake);
+    });
+    const seedApp = async (app) => {
         const name = app.installationId;
         const fetchStarted = performance.now();
         const located = await locate(app);
         const publishStarted = performance.now();
         try {
             const published = await publish(app, located);
-            if (!published.ok)
+            if (!published.ok) {
+                const refusal = Schema.decodeUnknownOption(Schema.fromJsonString(olderOysterStoreRefusal))(await published.text());
+                if (Option.isSome(refusal))
+                    throw new Error(refusal.value.message);
                 throw new Error(`${name} source publish failed (${String(published.status)})`);
+            }
             const { kind, receipt } = Schema.decodeUnknownSync(publishedSchema)(await published.json());
             options.report(`${name} source ${kind} at ${receipt.seedRevision}`);
             const ready = performance.now();
-            seeded.push({
+            return {
                 app,
                 kind,
                 seedRevision: receipt.seedRevision,
@@ -329,45 +309,99 @@ export async function installStandaloneAppSet(options) {
                 fetch: publishStarted - fetchStarted,
                 publish: ready - publishStarted,
                 ready,
-            });
+            };
         }
         finally {
             await located.release();
         }
-    }
-    // Then build `concurrency` at a time, in set order, installing each as its
-    // build succeeds. The first failure rejects the install and starts no
-    // further build; builds already running finish and install.
-    const installed = new Map();
-    const pending = [...seeded];
-    /** Set by the first failure, so no further build starts. */
-    const stop = { requested: false };
+    };
+    const seedAll = async () => {
+        try {
+            for (const app of standaloneAppSet) {
+                if (stop.requested)
+                    break;
+                const seeded = await seedApp(app);
+                const waiter = waiting.shift();
+                if (waiter === undefined)
+                    seededQueue.push(seeded);
+                else
+                    waiter(seeded);
+            }
+        }
+        catch (cause) {
+            stop.requested = true;
+            failures.push(cause);
+            throw cause;
+        }
+        finally {
+            seeding.finished = true;
+            for (const waiter of waiting.splice(0))
+                waiter(undefined);
+        }
+    };
+    // `concurrency` builds at once, each installing as its build succeeds.
     const slot = async () => {
-        for (let next = stop.requested ? undefined : pending.shift(); next !== undefined; next = stop.requested ? undefined : pending.shift()) {
+        for (let next = await takeSeeded(); next !== undefined && !stop.requested; next = await takeSeeded()) {
             const name = next.app.installationId;
             try {
                 const buildStarted = performance.now();
                 const build = await buildOnComputer(name, next.app.appId, next.seedRevision);
                 if (build.status !== "succeeded" || build.release === null)
                     throw new Error(`${name} build ${build.status}: ${build.detail ?? "no Release"}`);
+                const release = Schema.decodeUnknownSync(releaseSchema)(build.release, {
+                    onExcessProperty: "error",
+                });
+                if (release.appId !== next.app.appId)
+                    throw new Error(`${name} build belongs to another App`);
                 const installStarted = performance.now();
-                const installation = await owner("POST", "/api/installations", {
-                    release: build.release,
+                let installation = {
+                    url: options.url,
+                    key: options.key,
+                    release,
                     installationId: name,
-                });
-                if (!installation.ok)
-                    throw new Error(`${name} installation failed (${String(installation.status)})`);
-                options.report(`${installation.status === 201 ? "Installed" : "Replaced"} ${name} from its build ${build.jobId}`);
+                    signal: AbortSignal.timeout(options.waitMs ?? appBuildWaitMs),
+                    idle,
+                };
+                if (options.pollMs !== undefined)
+                    installation = { ...installation, pollMs: options.pollMs };
+                const operation = await installOnOyster(installation);
+                if (operation.state === "unconfirmed")
+                    throw new InstallationObservationError(operation.requestId);
+                if (operation.state === "refused")
+                    throw new Error(`${name} installation refused (${operation.code})`);
+                const record = operation.installation;
+                if (record === null)
+                    throw new Error(`${name} completed installation version is unavailable`);
+                if (record.appId !== release.appId ||
+                    record.release.releaseId !== release.releaseId ||
+                    record.release.artifact.artifactDigest !==
+                        release.artifact.artifactDigest)
+                    throw new Error(`${name} installation does not match its build`);
+                // Only the owner can attest exclusive fresh creation. A replacement or
+                // tombstone remint never replays a default grant.
+                if (operation.creation === "fresh") {
+                    if (record.status !== "enabled")
+                        throw new Error(`${name} fresh installation is not enabled`);
+                    if (next.app.dashboard === true)
+                        await approveChosenDashboard(record, operation.reference.generation);
+                }
+                options.report(`${operation.creation === "replacement" ? "Replaced" : "Installed"} ${name} from its build ${build.jobId}`);
+                // Report-only UI check: never blocks, but the owner sees it here.
+                const uiCheck = operation.uiCheck;
+                if (uiCheck?.kind === "failed")
+                    options.report(`Warning: ${name} is installed, but its UI check failed (${uiCheck.code}${uiCheck.diagnostics === undefined ? "" : `: ${uiCheck.diagnostics.failedPredicate}`}).`);
+                else if (uiCheck?.kind === "not_checked")
+                    options.report(`Warning: ${name} is installed, but its UI was not checked (${uiCheck.code}).`);
                 const phases = build.detail === null
                     ? undefined
                     : Schema.decodeUnknownOption(computerPhasesSchema)(build.detail);
                 installed.set(name, {
-                    installationId: name,
+                    installationId: record.installationId,
                     published: next.kind,
                     seedRevision: next.seedRevision,
                     sourceRevision: next.sourceRevision,
                     jobId: build.jobId,
-                    installed: installation.status === 201 ? "installed" : "replaced",
+                    installed: operation.creation === "replacement" ? "replaced" : "installed",
                     release: build.release,
                     timings: {
                         fetch: next.fetch,
@@ -383,11 +417,19 @@ export async function installStandaloneAppSet(options) {
             }
             catch (cause) {
                 stop.requested = true;
+                failures.push(cause);
                 throw cause;
             }
         }
     };
-    await Promise.all(Array.from({ length: concurrency }, slot));
+    // Wait for every seed and build to settle before reporting: nothing of this
+    // call may still run, or install, after it rejects.
+    await Promise.allSettled([
+        seedAll(),
+        ...Array.from({ length: concurrency }, slot),
+    ]);
+    if (failures.length > 0)
+        throw failures[0];
     return standaloneAppSet.flatMap((app) => {
         const result = installed.get(app.installationId);
         return result === undefined ? [] : [result];

package/dist/standalone/browser.d.ts

@@ -0,0 +1,11 @@
+import type { CapabilitySource } from "@fungi.computer/mycelium";
+import { type BrowserBinding } from "../browser/index.js";
+/**
+ * The agent's `cloudBrowser` tool on a standalone Oyster, or an empty source
+ * when the deployment declares no BROWSER binding. Driven sessions only: no
+ * Quick Reads, no Computer save, no member handoff on this host.
+ */
+export declare function standaloneBrowserSource(binding: BrowserBinding | undefined, identity: () => Readonly<{
+    teamId: string;
+    agentId: string;
+}>): CapabilitySource;

package/dist/standalone/browser.js

@@ -0,0 +1,72 @@
+import { bindingSessions, browserCapabilitySource, createBrowser, } from "../browser/index.js";
+import { causeClass } from "../cause-class.js";
+/**
+ * A standalone Oyster's `BrowserHost`: its own Workers BROWSER binding, no
+ * Quick Reads (the binding has none), and the owner-funded meter below.
+ */
+/**
+ * A standalone Oyster has no credit ledger: its owner's Cloudflare account
+ * pays Browser Rendering directly. This is that host's explicit metering
+ * decision, not a missing meter; the Hub supplies its Billing owner instead.
+ */
+const ownerFundedMeter = {
+    hold: () => Promise.resolve(),
+    start: () => Promise.resolve(),
+    settle: () => Promise.resolve(),
+    release: () => Promise.resolve(),
+};
+/** One Browser per binding per isolate, so a lease survives between calls. */
+const browsers = new WeakMap();
+function standaloneBrowser(binding) {
+    let browser = browsers.get(binding);
+    if (browser === undefined) {
+        browser = createBrowser({
+            sessions: bindingSessions(binding),
+            quickReads: null,
+            meter: () => ownerFundedMeter,
+            report: (event) => {
+                // Code-only: never a URL, page text or provider body.
+                console.warn("Oyster browser", {
+                    kind: event.kind,
+                    executionId: event.executionId,
+                    cause: causeClass(event.cause),
+                });
+            },
+        }, {
+            maxConcurrentPerTeam: 2,
+            maxLifetimeMs: 30 * 60_000,
+            idleTimeoutMs: 5 * 60_000,
+        });
+        browsers.set(binding, browser);
+    }
+    return browser;
+}
+/**
+ * The agent's `cloudBrowser` tool on a standalone Oyster, or an empty source
+ * when the deployment declares no BROWSER binding. Driven sessions only: no
+ * Quick Reads, no Computer save, no member handoff on this host.
+ */
+export function standaloneBrowserSource(binding, identity) {
+    if (binding === undefined)
+        return {
+            id: "cloud-browser",
+            acquire: () => Promise.resolve({
+                snapshot: { version: "0", modules: [] },
+                release: () => Promise.resolve(),
+            }),
+        };
+    const browser = standaloneBrowser(binding);
+    return browserCapabilitySource({
+        identity,
+        browser: {
+            call: (owner, op, signal) => browser.call(owner, op, signal),
+            handoff: (owner, leaseId) => {
+                browser.handoff(owner, leaseId);
+                return Promise.resolve();
+            },
+        },
+        quickReads: false,
+        saveFile: null,
+        requestHandoff: null,
+    });
+}

package/dist/standalone/builds.d.ts

@@ -2,17 +2,26 @@
  * Owner routes for App builds on the standalone's Computer. They run after
  * the host's owner guard; the build owner is the registry.
  *
- * - `PUT /api/apps/:appId/build-source` records an installation repository
- *   and recipe an App builds from (the recipe is normalized and pinned here).
- *   Publishing an App's source (`PUT /api/apps/:appId/source`) instead makes
- *   its template the build source, buildable at the returned seed revision.
+ * Repository Apps register through APPS.register from their committed root
+ * metadata. Publishing an App's source (PUT /api/apps/:appId/source) instead
+ * makes its template the build source at the returned seed revision.
+ *
  * - `POST /api/builds` starts a build of that source at one exact commit.
  * - `GET /api/builds/:jobId` reads it; a finished build carries its Release,
  *   which the owner installs or selects through the installation routes.
  */
 import { Hono } from "hono";
+import { type OysterBuildStartReason } from "../app-builds.js";
 import { type OysterEnv } from "../host.js";
 import type { StandaloneRegistry } from "./registry.js";
+/** Both HTTP and APPS expose the same closed preflight reason. */
+export declare function buildStartFailureReply(reason: OysterBuildStartReason | "unavailable"): {
+    status: number;
+    body: {
+        code: "unavailable" | "invalid_revision" | "no_source" | "not_template_seed" | "no_backend";
+        error: string;
+    };
+};
 /** The build routes over the tenant registry that owns builds, resolved per
  * request so mounting the routes reaches no registry. */
 export declare function standaloneBuildRoutes(registryFor: () => DurableObjectStub<StandaloneRegistry>): Hono<OysterEnv>;