@fungi.computer/oyster 0.2.0 → 0.3.1

package/dist/workers.js

@@ -1,5 +1,20 @@
-import { installationSchema } from "./apps/installation.js";
+import { approvalCapability } from "./approval-capability.js";
+import { createInstallationStoreGeneration } from "./installation-store-generation.js";
+import { OysterApprovalHome, } from "./approval-home.js";
+import { timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { bootCapabilityGrantSchema, bootCapabilityLeaseSchema, reportBootPage, validateCapabilityAssetSet, } from "./boot-capability.js";
+import { serveBootCapability } from "./boot-capability-route.js";
+import { installationSchema, isCommittedInstallation, } from "./apps/installation.js";
+import { BOOT_DEADLINE_MS, BOOT_TRANSPORT_GRACE_MS, readBootUi, } from "./boot-gate.js";
+import { checkBootPage } from "./browser/boot.js";
+import { bindingSessions } from "./browser/sessions.js";
 import { registryInstallations } from "./internal/registry-installations.js";
+import { installationsFromOlderOyster } from "./older-oyster-store.js";
+import { refuseOlderOysterStore } from "./older-oyster-store-refusal.js";
+import { createInstallationOperations, } from "./installation-operations.js";
+import { installationWorkerEntrypoint } from "./installation-execution.js";
+export { installationWorkerEntrypoint };
 import { approvedBindingGrants, scopedBindings } from "./apps/gate.js";
 import { appMethodReplySchema } from "@fungi.computer/agar/backend";
 import { nativeGitFrameMethods, nativeGitMethodNameSchema, } from "@fungi.computer/agar/git-rpc";
@@ -20,7 +35,7 @@ import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 import { releaseSchema } from "@fungi.computer/puffball/effect";
 import { AppInstanceError, } from "./index.js";
-import { createCloudflareAppInstance, createCloudflareInvocationGate, decodeFrameBindingProps, captureFrameBindingReply, frameBindingEntrypoint, backgroundFrameMethods, } from "./cloudflare.js";
+import { createCloudflareAppInstance, r2ArtifactStore, createCloudflareInvocationGate, decodeFrameBindingProps, captureFrameBindingReply, frameBindingEntrypoint, backgroundFrameMethods, } from "./cloudflare.js";
 import { invocationFactsSchema, assertBackgroundBinding, admitBackgroundFrame, } from "./invocation.js";
 import { deliverBackground, deliverGitPush } from "./internal/delivery.js";
 import { createOyster, verifyRelease, defaultAssetPolicy, } from "./host.js";
@@ -30,31 +45,106 @@ import { storageFrameMethods } from "./storage-frame.js";
 import { catalogFrameMethods, oysterAppCatalog } from "./catalog-frame.js";
 import { appStorageKeyNameSchema, appStorageWriteSchema, appStorageResetSchema, } from "@fungi.computer/agar/storage";
 import { createOysterRootData } from "./root-data.js";
-import { backendCache, resolveBackend, } from "./release.js";
-import { headContentObject } from "./build/content-objects.js";
+import { backendCache, resolveBackend } from "./release.js";
 import { ensureAppSourceTables, createOysterAppSourceReceipts, createOysterAppRegistrations, createOysterArtifactsRepositoryMetadataStore, } from "./app-sources.js";
-export { r2FileSource, ownerKeyAuth };
-/** Store Release artifacts in an R2 bucket. */
-export function r2ArtifactStore(bucket) {
-    return {
-        head: (artifactRef) => headContentObject(bucket, artifactRef),
-        async get(artifactRef) {
-            const object = await bucket.get(artifactRef);
-            return object === null
-                ? null
-                : new Uint8Array(await object.arrayBuffer());
-        },
-        async put(artifactRef, bytes) {
-            await bucket.put(artifactRef, bytes);
-        },
-    };
-}
+export { r2ArtifactStore, r2FileSource, ownerKeyAuth };
 const recordRow = Schema.Struct({
     installation_id: Schema.String,
     record: Schema.String,
 });
+const bootCapabilityRows = z.array(z.strictObject({
+    token_digest: z.string().regex(/^[0-9a-f]{64}$/),
+    expires_at: z.number().int(),
+    record: z.string().max(2_000_000),
+}));
+const approvalHomePinRow = Schema.Struct({
+    tenant_id: tenantIdSchema,
+    origin: Schema.String,
+});
 /** The installation registry: one SQLite-backed Durable Object per Oyster. */
 export class OysterRegistry extends DurableObject {
+    #generation;
+    /** Decided once, before this version writes anything, and never revised. */
+    #installationsFromOlderOyster;
+    #approval;
+    #installationOperations;
+    /** The plain root has the same single owner-key host as OysterInstance. */
+    hostFor(scope) {
+        return Promise.resolve(ownerKeyRootHost(this.env, { scope }));
+    }
+    /** Trusted host RPC; an operation input cannot select actor, namespace or tenant. */
+    approvalSubmit(pin, call) {
+        return this.approvalHome(pin).submit(call);
+    }
+    approvalHome(pin) {
+        const scope = tenantScope(Schema.decodeUnknownSync(tenantIdSchema)(pin.tenantId), pin.origin);
+        if (this.ctx.id.name !== scope.durableName("registry"))
+            throw new Error("Approval home namespace does not match tenant");
+        this.ctx.storage.transactionSync(() => {
+            const raw = this.ctx.storage.sql
+                .exec("SELECT tenant_id, origin FROM oyster_approval_home WHERE id = 1")
+                .toArray()[0];
+            if (raw === undefined) {
+                this.ctx.storage.sql.exec("INSERT INTO oyster_approval_home (id, tenant_id, origin) VALUES (1, ?, ?)", scope.tenantId, scope.origin);
+                return;
+            }
+            const retained = Schema.decodeUnknownSync(approvalHomePinRow)(raw);
+            if (retained.tenant_id !== scope.tenantId ||
+                retained.origin !== scope.origin)
+                throw new Error("Approval home cannot change tenant or origin");
+        });
+        this.#approval ??= new OysterApprovalHome({
+            owner: {
+                sql: this.ctx.storage.sql,
+                transactionSync: (body) => this.ctx.storage.transactionSync(body),
+            },
+            scope,
+            current: () => this.hostFor(scope),
+            commit: (write, nextWakeAt) => this.ctx.storage.transaction(async (transaction) => {
+                const result = await write();
+                const at = nextWakeAt();
+                const current = await transaction.getAlarm();
+                if (at !== null && (current === null || current > at))
+                    await transaction.setAlarm(at);
+                return result;
+            }),
+        });
+        return this.#approval;
+    }
+    /** Recover approved work from the durable home, not a last-request memory pin. */
+    async approvalAlarm() {
+        const raw = this.ctx.storage.sql
+            .exec("SELECT tenant_id, origin FROM oyster_approval_home WHERE id = 1")
+            .toArray()[0];
+        if (raw === undefined)
+            return;
+        const pin = Schema.decodeUnknownSync(approvalHomePinRow)(raw);
+        const at = await this.approvalHome({
+            tenantId: pin.tenant_id,
+            origin: pin.origin,
+        }).reconcile();
+        if (at !== null) {
+            const current = await this.ctx.storage.getAlarm();
+            if (current === null || current > at)
+                await this.ctx.storage.setAlarm(at);
+        }
+    }
+    /** Read a bounded page for the current member of the pinned native home. */
+    approvalList(pin, actor, input) {
+        return this.approvalHome(pin).capability(actor).list(input);
+    }
+    /** Read one member-scoped view; the native home resolves membership again. */
+    approvalGet(pin, actor, input) {
+        return this.approvalHome(pin).capability(actor).get(input);
+    }
+    /** Persist an eligible answer and attempt its native decision work once. */
+    approvalAnswer(pin, actor, input) {
+        return this.approvalHome(pin).capability(actor).answer(input);
+    }
+    /** Policy never grants operation authority; only the live Oyster owner may change it. */
+    approvalSetAutoApprove(pin, actor, input) {
+        return this.approvalHome(pin).capability(actor).setAutoApprove(input);
+    }
     #rootData;
     /** Append-only App source seed receipts; a Git-capable subclass forks over these. */
     appSourceReceipts;
@@ -64,8 +154,32 @@ export class OysterRegistry extends DurableObject {
     artifactsRepositories;
     constructor(ctx, env) {
         super(ctx, env);
+        this.#installationsFromOlderOyster = installationsFromOlderOyster(ctx.storage.sql);
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS oyster_approval_home (id INTEGER PRIMARY KEY CHECK (id = 1), tenant_id TEXT NOT NULL, origin TEXT NOT NULL) STRICT");
         ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS installations (installation_id TEXT PRIMARY KEY, record TEXT NOT NULL) STRICT");
+        this.#generation = createInstallationStoreGeneration(ctx.storage.sql);
+        ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS boot_capabilities (id TEXT PRIMARY KEY, token_digest TEXT NOT NULL, expires_at INTEGER NOT NULL, record TEXT NOT NULL) STRICT");
         ensureAppSourceTables(ctx.storage.sql);
+        this.#installationOperations = createInstallationOperations({
+            owner: ctx.storage,
+            registryName: ctx.id.name ?? "",
+            generation: () => this.generation(),
+            get: (installationId) => this.get(installationId),
+            compareAndPut: (installation, version, generation, scope) => this.compareAndPut(installation, version, generation, scope.tenantId),
+            execute: (command) => ctx.exports
+                .OysterInstallationExecutor({
+                props: {
+                    requestId: command.admission.requestId,
+                    scope: command.scope,
+                },
+            })
+                .run(),
+            scheduleWake: (at) => ctx.storage.transaction(async (transaction) => {
+                const current = await transaction.getAlarm();
+                if (current === null || at < current)
+                    await transaction.setAlarm(at);
+            }),
+        });
         this.appSourceReceipts = createOysterAppSourceReceipts(ctx.storage.sql);
         this.appRegistrations = createOysterAppRegistrations(ctx.storage.sql);
         this.artifactsRepositories = createOysterArtifactsRepositoryMetadataStore(ctx.storage.sql);
@@ -83,6 +197,24 @@ export class OysterRegistry extends DurableObject {
             resolveRelease: (release) => verifyRelease(r2ArtifactStore(env.RELEASES), release, defaultAssetPolicy, false),
         });
     }
+    /** The installation owner's RPC: admit, read, load, plan or commit one
+     * retained command for the caller's tenant scope. */
+    async installationOperation(input) {
+        return (await this.#installationOperations).dispatch(input);
+    }
+    /**
+     * One Registry wake serves both owners: installation work, then the native
+     * approval home. Each re-arms only an earlier wake, so neither postpones the
+     * other, and one owner's failure never skips the other's quantum.
+     */
+    async alarm() {
+        try {
+            await (await this.#installationOperations).tick();
+        }
+        finally {
+            await this.approvalAlarm();
+        }
+    }
     /** Current desktop metadata; roles are the ADR's derived default, never Hub's stored choice. */
     directory() {
         return this.#rootData.directory();
@@ -179,7 +311,7 @@ export class OysterRegistry extends DurableObject {
                     (expected !== undefined &&
                         (expected.selection.owner.kind !== "installation" ||
                             installation.instanceId !== expected.instanceId ||
-                            installation.authorityVersion !==
+                            installation.authority.authorityVersion !==
                                 expected.selection.authorityVersion ||
                             installation.release.releaseId !==
                                 expected.selection.releaseId ||
@@ -197,7 +329,8 @@ export class OysterRegistry extends DurableObject {
                         throw new AppStorageError("unavailable");
                     const current = this.get(installationId);
                     if (current?.status !== "enabled" ||
-                        current.authorityVersion !== installation.authorityVersion ||
+                        current.authority.authorityVersion !==
+                            installation.authority.authorityVersion ||
                         current.release.releaseId !== installation.release.releaseId ||
                         current.release.artifact.artifactDigest !==
                             installation.release.artifact.artifactDigest)
@@ -219,6 +352,10 @@ export class OysterRegistry extends DurableObject {
                 : new AppStorageError("unavailable", { cause }),
         }));
     }
+    /** Whether this registry's data was written by Oyster 0.2 or earlier; hosts refuse it. */
+    storeFromOlderOyster() {
+        return this.#installationsFromOlderOyster;
+    }
     /** Every installation record. */
     list() {
         return this.ctx.storage.sql
@@ -233,14 +370,14 @@ export class OysterRegistry extends DurableObject {
             .toArray()[0];
         return row === undefined ? null : this.decode(row);
     }
-    /** Create or replace one installation record. */
-    async put(installation, tenantId = defaultTenant) {
-        await this.writeInstallation(installation, tenantId);
+    /** Durable store identity, regenerated only when the store itself is replaced. */
+    generation() {
+        return this.#generation();
     }
     /** Native RPC returns a closed result; callers never classify a transported Error. */
-    async compareAndPut(installation, expectedAuthorityVersion, tenantId = defaultTenant) {
+    async compareAndPut(installation, expectedAuthorityVersion, expectedGeneration, tenantId = defaultTenant) {
         try {
-            await this.writeInstallation(installation, tenantId, expectedAuthorityVersion);
+            await this.writeInstallation(installation, tenantId, expectedAuthorityVersion, expectedGeneration);
             return { ok: true };
         }
         catch (cause) {
@@ -249,10 +386,12 @@ export class OysterRegistry extends DurableObject {
             throw cause;
         }
     }
-    async writeInstallation(installation, tenantId, expectedAuthorityVersion) {
+    async writeInstallation(installation, tenantId, expectedAuthorityVersion, expectedGeneration) {
+        // Version 0 names an absent record.
+        const versionOf = (record) => record?.authority.authorityVersion ?? 0;
         const previous = this.get(installation.installationId);
-        if (expectedAuthorityVersion !== undefined &&
-            previous?.authorityVersion !== expectedAuthorityVersion)
+        if (this.generation() !== expectedGeneration ||
+            versionOf(previous) !== expectedAuthorityVersion)
             throw new AppInstanceError("stale_authority");
         const encode = (value) => JSON.stringify(installationSchema.parse(value));
         const record = encode(installation);
@@ -260,21 +399,22 @@ export class OysterRegistry extends DurableObject {
         if (previous !== null &&
             previous.instanceId !== null &&
             (previous.instanceId !== installation.instanceId ||
-                previous.authorityVersion !== installation.authorityVersion ||
+                previous.authority.authorityVersion !==
+                    installation.authority.authorityVersion ||
                 previous.status !== installation.status ||
                 previous.release.artifact.artifactDigest !==
                     installation.release.artifact.artifactDigest))
             if ((await resolveBackend(r2ArtifactStore(this.env.RELEASES), previous.release)) !== null) {
-                if (expectedAuthorityVersion !== undefined &&
-                    this.get(installation.installationId)?.authorityVersion !==
+                if (this.generation() !== expectedGeneration ||
+                    versionOf(this.get(installation.installationId)) !==
                         expectedAuthorityVersion)
                     throw new AppInstanceError("stale_authority");
                 await this.env.INSTANCES.getByName(previous.instanceId).revoke(previous.installationId, undefined, tenantId);
             }
         this.ctx.storage.transactionSync(() => {
             const current = this.get(installation.installationId);
-            if (expectedAuthorityVersion !== undefined &&
-                current?.authorityVersion !== expectedAuthorityVersion)
+            if (this.generation() !== expectedGeneration ||
+                versionOf(current) !== expectedAuthorityVersion)
                 throw new AppInstanceError("stale_authority");
             if ((current === null ? null : encode(current)) !== previousRecord)
                 throw new AppInstanceError("stale_authority");
@@ -287,6 +427,49 @@ export class OysterRegistry extends DurableObject {
         const { record } = Schema.decodeUnknownSync(recordRow)(row);
         return installationSchema.parse(JSON.parse(record));
     }
+    /** Issue, resolve, or revoke one bounded capability without storing its token. */
+    bootCapability(input) {
+        if (input.kind === "issue") {
+            const { lease, tokenDigest } = bootCapabilityGrantSchema.parse(input.grant);
+            validateCapabilityAssetSet(lease);
+            const now = Date.now();
+            if (lease.expiresAt <= now ||
+                lease.expiresAt > now + BOOT_DEADLINE_MS + BOOT_TRANSPORT_GRACE_MS)
+                throw new Error("Boot capability lease is outside its deadline");
+            this.ctx.storage.sql.exec("DELETE FROM boot_capabilities WHERE expires_at <= ?", now);
+            const count = this.ctx.storage.sql
+                .exec("SELECT id FROM boot_capabilities LIMIT 8")
+                .toArray().length;
+            if (count >= 8)
+                throw new Error("Boot capability lease capacity reached");
+            this.ctx.storage.sql.exec("INSERT INTO boot_capabilities (id, token_digest, expires_at, record) VALUES(?,?,?,?)", lease.id, tokenDigest, lease.expiresAt, JSON.stringify(lease));
+            return undefined;
+        }
+        if (input.kind === "revoke") {
+            const id = z.string().min(1).max(128).parse(input.id);
+            this.ctx.storage.sql.exec("DELETE FROM boot_capabilities WHERE id = ?", id);
+            return undefined;
+        }
+        const tokenDigest = z
+            .string()
+            .regex(/^[0-9a-f]{64}$/)
+            .parse(input.tokenDigest);
+        const now = z.number().int().parse(input.now);
+        const rows = bootCapabilityRows.parse(this.ctx.storage.sql
+            .exec("SELECT token_digest, expires_at, record FROM boot_capabilities LIMIT 8")
+            .toArray());
+        const encoder = new TextEncoder();
+        const candidate = encoder.encode(tokenDigest);
+        let matched = null;
+        for (const row of rows) {
+            const digest = encoder.encode(row.token_digest);
+            const equal = digest.byteLength === candidate.byteLength &&
+                timingSafeEqual(candidate, digest);
+            if (equal && row.expires_at > now)
+                matched = bootCapabilityLeaseSchema.parse(JSON.parse(row.record));
+        }
+        return matched;
+    }
 }
 const releaseRow = Schema.Struct({ release: Schema.String });
 /**
@@ -368,6 +551,7 @@ export class OysterBinding extends oysterBindingEntrypoint(oysterBindings) {
 function instanceHandle(target, scope, budget) {
     const { tenantId, origin } = scope;
     return {
+        prepare: (state, release) => target.prepare(state, release, budget, { tenantId, origin }),
         apply: (state, release) => target.apply(state, release, budget, { tenantId, origin }),
         fetch: (facts, request) => target.backend(facts, request, budget, tenantId),
         call: async (facts, api, name, input) => {
@@ -456,7 +640,7 @@ export class OysterInstance extends DurableObject {
     }
     /** The deployable root's host for one pinned tenant; this plain root is the single owner key. */
     hostFor(scope) {
-        return ownerKeyRootHost(this.env, { scope });
+        return Promise.resolve(ownerKeyRootHost(this.env, { scope }));
     }
     /** Reconstruct current host admission for each wake; non-default tenants get no wakes. */
     backgroundHost() {
@@ -495,19 +679,21 @@ export class OysterInstance extends DurableObject {
             },
         });
     }
-    createRuntime(limits) {
+    createRuntime(limits, candidate, bootScope) {
         return createCloudflareAppInstance(this.ctx, this.env.LOADER, (releaseId, scope) => Effect.tryPromise({
             try: async () => {
                 if (scope.kind === "invocation")
                     return scope.frame.host.artifact;
-                const release = this.release(releaseId);
+                const release = candidate ?? this.release(releaseId);
+                if (release.releaseId !== releaseId)
+                    throw new AppInstanceError("instance_release_mismatch");
                 const resolved = await this.backends(release);
                 if (resolved === null)
                     throw new Error("Release has no backend");
                 return { release, ...resolved };
             },
             catch: (cause) => cause instanceof Error ? cause : new Error("Release unavailable"),
-        }), (frame) => this.guestEnv(frame), limits);
+        }), (frame) => this.guestEnv(frame), (release) => oysterBootUi(this.env, bootScope ?? this.scope())(release), limits);
     }
     runtimeFor(input) {
         const limits = guestLimits(input);
@@ -618,6 +804,14 @@ export class OysterInstance extends DurableObject {
     }
     /** Installation changes end guest work; a Workflow cancel targets only its run. */
     async revoke(installationId, runId, tenantId = defaultTenant) {
+        // CAS can complete without the first apply ever arriving. An unclaimed
+        // Instance cannot admit work: withFrame requires both ownership pins.
+        // There is nothing to revoke, and this must not invent a tenant/receipt.
+        if (this.installationId() === null &&
+            this.ctx.storage.sql
+                .exec("SELECT id FROM oyster_tenant WHERE id = 1")
+                .toArray().length === 0)
+            return;
         this.requireTenant(tenantId);
         if (installationId !== this.installationId())
             throw new AppInstanceError("instance_owner_mismatch");
@@ -633,7 +827,7 @@ export class OysterInstance extends DurableObject {
             "kind" in current ||
             current.status !== "enabled" ||
             current.instanceId !== selected.instanceId ||
-            current.authorityVersion !== selected.authorityVersion ||
+            current.authority.authorityVersion !== selected.authorityVersion ||
             current.release.releaseId !== selected.releaseId ||
             current.release.artifact.artifactDigest !==
                 frame.host.artifact.release.artifact.artifactDigest)
@@ -710,7 +904,33 @@ export class OysterInstance extends DurableObject {
             throw new Error("Release unknown to this Instance");
         return Schema.decodeUnknownSync(Schema.fromJsonString(releaseSchema))(Schema.decodeUnknownSync(releaseRow)(row).release);
     }
-    /** Remember `release`, then apply the owner state under the host's tenant pin. */
+    rememberRelease(release) {
+        this.ctx.storage.sql.exec("INSERT INTO oyster_releases(release_id, release) VALUES(?,?) ON CONFLICT(release_id) DO NOTHING", release.releaseId, Schema.encodeUnknownSync(Schema.fromJsonString(releaseSchema))(release));
+    }
+    /** Reuse lifecycle preflight without changing the active runtime or its budgets. */
+    async prepare(state, release, limits, tenant) {
+        let bootScope;
+        if (tenant !== undefined) {
+            bootScope = tenantScope(Schema.decodeUnknownSync(tenantIdSchema)(tenant.tenantId), tenant.origin);
+            const stored = this.ctx.storage.sql
+                .exec("SELECT tenant_id, origin FROM oyster_tenant WHERE id = 1")
+                .toArray()[0];
+            if (stored !== undefined) {
+                const pin = this.scope();
+                if (pin.tenantId !== bootScope.tenantId ||
+                    pin.origin !== bootScope.origin)
+                    throw new AppInstanceError("installation_tenant_mismatch");
+                const owner = this.installationId();
+                if (owner !== null && owner !== state.owner.id)
+                    throw new AppInstanceError("instance_owner_mismatch");
+            }
+            else if (this.installationId() !== null) {
+                throw new AppInstanceError("installation_tenant_mismatch");
+            }
+        }
+        return result(this.createRuntime(guestLimits(limits), release, bootScope).prepare(state));
+    }
+    /** Activate the exact committed selection under the host's tenant pin. */
     async apply(state, release, limits, tenant) {
         const selected = tenantScope(Schema.decodeUnknownSync(tenantIdSchema)(tenant.tenantId), tenant.origin);
         const checkTenant = () => {
@@ -725,17 +945,30 @@ export class OysterInstance extends DurableObject {
             const pin = this.scope();
             if (pin.tenantId !== selected.tenantId || pin.origin !== selected.origin)
                 throw new AppInstanceError("installation_tenant_mismatch");
+            const owner = this.installationId();
+            if (owner !== null && owner !== state.owner.id)
+                throw new AppInstanceError("instance_owner_mismatch");
         };
+        const committed = async () => isCommittedInstallation(await this.env.REGISTRY.getByName(selected.durableName("registry")).get(state.owner.id), state, release);
         checkTenant();
+        if (!(await committed()))
+            return { ok: false, code: "stale_authority" };
         await this.frames.revoke();
         return this.frames.exclusive(async () => {
             checkTenant();
-            this.ctx.storage.sql.exec("INSERT INTO oyster_releases(release_id, release) VALUES(?,?) ON CONFLICT(release_id) DO NOTHING", release.releaseId, Schema.encodeUnknownSync(Schema.fromJsonString(releaseSchema))(release));
-            const applied = await result(this.runtimeFor(limits).apply(state));
-            if (applied.ok) {
+            if (!(await committed()))
+                return { ok: false, code: "stale_authority" };
+            // These pins attest the committed owner, not successful activation.
+            // Persist before boot so a failed first activation can be retried or
+            // revoked/deleted without ever claiming an active lifecycle receipt.
+            this.ctx.storage.transactionSync(() => {
                 this.ctx.storage.sql.exec("INSERT INTO oyster_tenant (id, tenant_id, origin) VALUES (1, ?, ?) ON CONFLICT(id) DO NOTHING", selected.tenantId, selected.origin);
-                this.ctx.storage.sql.exec("INSERT INTO oyster_owner (id, installation_id) VALUES (1, ?) ON CONFLICT(id) DO UPDATE SET installation_id = excluded.installation_id", state.owner.id);
-            }
+                this.ctx.storage.sql.exec("INSERT INTO oyster_owner (id, installation_id) VALUES (1, ?) ON CONFLICT(id) DO NOTHING", state.owner.id);
+            });
+            this.rememberRelease(release);
+            const applied = await result(this.runtimeFor(limits).apply(state));
+            if (!(await committed()))
+                return { ok: false, code: "stale_authority" };
             return applied;
         });
     }
@@ -791,12 +1024,74 @@ export class OysterInstance extends DurableObject {
     }
 }
 /** Host adapters for a standalone Oyster Worker over its own bindings. */
+function registryBootCapabilities(env, scope) {
+    const registry = () => env.REGISTRY.getByName(scope.durableName("registry"));
+    return {
+        issue: async (grant) => {
+            await registry().bootCapability({ kind: "issue", grant });
+        },
+        resolve: async (tokenDigest, now) => {
+            const result = await registry().bootCapability({
+                kind: "resolve",
+                tokenDigest,
+                now,
+            });
+            if (result === undefined)
+                throw new Error("Boot capability lookup returned no result");
+            return result === null ? null : bootCapabilityLeaseSchema.parse(result);
+        },
+        revoke: async (id) => {
+            await registry().bootCapability({ kind: "revoke", id });
+        },
+    };
+}
+/** Resolve a scoped boot URL through the registry-backed HTTPS asset route. */
+export function serveOysterBootCapability(request, env, scope) {
+    return serveBootCapability(request, {
+        configuredOrigin: scope.origin,
+        bucket: env.RELEASES,
+        capabilities: registryBootCapabilities(env, scope),
+    });
+}
+/**
+ * The standalone UI boot check: the Worker's own BROWSER binding opens the
+ * pinned `/_boot/` page on the host-selected origin, with a capability in
+ * that tenant's registry. Without a BROWSER binding the UI is not checked.
+ */
+function oysterBootUi(env, scope) {
+    const artifacts = r2ArtifactStore(env.RELEASES);
+    const capabilities = registryBootCapabilities(env, scope);
+    const sessions = env.BROWSER === undefined ? null : bindingSessions(env.BROWSER);
+    return (release) => reportBootPage({
+        origin: scope.origin,
+        check: sessions === null ? null : (target) => checkBootPage(sessions, target),
+        readUi: () => readBootUi(artifacts, release),
+        bucket: env.RELEASES,
+        capabilities,
+        now: Date.now,
+    });
+}
+/**
+ * Create an Oyster host backed by this Worker environment's registry,
+ * artifacts, Instances, and boot-check service.
+ */
 export function oysterWorkerHost(env, auth, options = {}) {
     const scope = options.scope ?? tenantScope(defaultTenant, env.OYSTER_ORIGIN);
     const registry = () => env.REGISTRY.getByName(scope.durableName("registry"));
     const installations = registryInstallations(env, scope);
+    const artifacts = r2ArtifactStore(env.RELEASES);
     const originSecret = Schema.decodeUnknownOption(Schema.NonEmptyString)(env.OYSTER_OWNER_KEY);
+    const pin = { tenantId: scope.tenantId, origin: scope.origin };
+    const approvalControl = (actor) => ({
+        list: (input) => registry().approvalList(pin, actor, input),
+        get: (input) => registry().approvalGet(pin, actor, input),
+        answer: (input) => registry().approvalAnswer(pin, actor, input),
+        setAutoApprove: (input) => registry().approvalSetAutoApprove(pin, actor, input),
+    });
     let host = {
+        approvals: {
+            submit: (call) => registry().approvalSubmit({ tenantId: scope.tenantId, origin: scope.origin }, call),
+        },
         auth,
         workbench: {
             directory: async () => {
@@ -811,10 +1106,14 @@ export function oysterWorkerHost(env, auth, options = {}) {
             }),
         },
         guestLimits: guestLimits(options.guestLimits),
-        artifacts: r2ArtifactStore(env.RELEASES),
+        artifacts,
+        bootUi: oysterBootUi(env, scope),
         // File-only hosts may keep workspace files beside their Release artifacts.
-        capabilities: fileCapabilities(options.workspace?.files ??
-            r2FileSource(env.RELEASES, scope.workspacePrefix)),
+        capabilities: [
+            ...fileCapabilities(options.workspace?.files ??
+                r2FileSource(env.RELEASES, scope.workspacePrefix)),
+            approvalCapability(approvalControl),
+        ],
         installations,
         instances: {
             get: (instanceId, limits) => instanceHandle(env.INSTANCES.getByName(instanceId), scope, guestLimits(limits)),
@@ -848,6 +1147,9 @@ function ownerKeyRootHost(env, options) {
 /** The non-git standalone root's MCP owner. */
 export class OysterMcp extends createOysterMcpOwner((env, scope) => ownerKeyRootHost(env, { scope })) {
 }
+/** Ordinary Worker execution; REGISTRY receives references and receipts only. */
+export class OysterInstallationExecutor extends installationWorkerEntrypoint((env, scope) => ownerKeyRootHost(env, { scope })) {
+}
 /**
  * The standalone Worker's `fetch` handler; frontend hosts are cached per env.
  * MCP transports belong to the tenant Durable Object, independent of that cache.
@@ -856,10 +1158,20 @@ export function createOysterWorker(options = {}) {
     const limits = guestLimits(options.guestLimits);
     const apps = new WeakMap();
     return {
-        fetch(request, env) {
+        async fetch(request, env) {
+            const scope = tenantScope(defaultTenant, env.OYSTER_ORIGIN);
+            const refused = await refuseOlderOysterStore(request, env, scope);
+            if (refused !== null)
+                return refused;
+            const boot = await serveOysterBootCapability(request, env, scope);
+            if (boot !== null)
+                return boot;
             let app = apps.get(env);
             if (app === undefined) {
-                app = createOyster(ownerKeyRootHost(env, { guestLimits: limits }));
+                app = createOyster(ownerKeyRootHost(env, {
+                    guestLimits: limits,
+                    scope,
+                }));
                 apps.set(env, app);
             }
             return app.fetch(request);

package/dist/workflow-agent-authority.d.ts

@@ -0,0 +1,8 @@
+import type { WorkflowArmer, WorkflowTriggerPrincipal } from "@fungi.computer/braid/runtime";
+import type { AppToolPolicy } from "./apps/index.js";
+import type { InvocationFacts } from "./invocation.js";
+/** Use the actual host-captured policy, never an Agent-supplied grantor or revision. */
+export declare function workflowAgentAuthority(facts: InvocationFacts, operation: string, readPolicy: (agentId: string) => Promise<AppToolPolicy | null>): Promise<{
+    armer: WorkflowArmer;
+    principal: WorkflowTriggerPrincipal;
+} | null>;

package/dist/workflow-agent-authority.js

@@ -0,0 +1,42 @@
+import { AppInstanceError } from "./index.js";
+import { agentWorkflowOperationSchema } from "./workflows.js";
+/** Use the actual host-captured policy, never an Agent-supplied grantor or revision. */
+export async function workflowAgentAuthority(facts, operation, readPolicy) {
+    if (facts.subject.kind !== "call")
+        throw new AppInstanceError("revoked");
+    const actor = facts.subject.context.actor;
+    if (actor.kind === "member")
+        return {
+            armer: { armedBy: actor.memberId, armedVia: null },
+            principal: { kind: "member", memberId: actor.memberId },
+        };
+    if (actor.kind !== "agent" ||
+        !agentWorkflowOperationSchema.safeParse(operation).success)
+        return null;
+    const captured = facts.subject.agentPolicy;
+    const policy = await readPolicy(actor.agentId);
+    const write = operation !== "catalog" &&
+        operation !== "schedules" &&
+        operation !== "eventTriggers";
+    if (policy === null ||
+        captured?.policyRevision !== policy.revision ||
+        captured.grantorMemberId !== policy.grantedBy ||
+        (write && policy.level !== "write"))
+        throw new AppInstanceError("revoked");
+    return {
+        armer: {
+            armedBy: policy.grantedBy,
+            armedVia: {
+                kind: "policy",
+                agentId: actor.agentId,
+                policyRevision: policy.revision,
+                grantorMemberId: policy.grantedBy,
+            },
+        },
+        principal: {
+            kind: "agent",
+            agentId: actor.agentId,
+            grantorMemberId: policy.grantedBy,
+        },
+    };
+}