@fungi.computer/oyster 0.3.0 → 0.3.1

package/README.md

@@ -172,6 +172,26 @@ repositories and namespace. Use the configured resource names and confirm each
 is gone through Cloudflare's dashboard or API. Capture teardown errors and the
 Wrangler version rather than silently adding unrelated token permissions.
 
+### Upgrading from Oyster 0.2 or earlier
+
+Oyster 0.3 does not read data created by Oyster 0.1 or 0.2, and it does not
+convert it. An Oyster deployed on 0.2 and redeployed on 0.3 answers every
+request with `409` and `{"error": "store_from_older_oyster", ...}` (a short
+explanation page in a browser), and `oyster install-apps` prints the same
+message. Old data is left untouched, so redeploying 0.2.x brings the Oyster back
+exactly as it was.
+
+To move to 0.3, start from a fresh store. The smallest way is to deploy under
+new names, leaving the old Oyster in place until you no longer need it. In
+`wrangler.jsonc`, rename `name`, both `bucket_name` values,
+`artifacts.namespace` and every `workflows[].name`; create the new release
+bucket; then run the quick start again. To reuse the names instead, tear the old
+Oyster down as in the teardown steps above (delete the Worker, which deletes its
+Durable Object data; empty and delete the release bucket; delete the Computer's
+container application, the Workflow, and the Artifacts repositories and
+namespace), then deploy 0.3 and reinstall the Apps. Data in the old Oyster, such
+as Apps' stored data, is not carried over.
+
 ### Set the Oyster owner key
 
 Choose an owner key (separate from the Cloudflare API token) and store it as a

package/dist/app-builds.d.ts

@@ -166,7 +166,7 @@ export type OysterAppBuildOptions = Readonly<{
     templates: Pick<PublisherTemplateSeedReceipts, "read">;
     now?: () => number;
 }>;
-/** Create the current build tables and index atomically; never convert old stores. */
+/** Create the current build tables and index atomically; an older store is refused, never converted. */
 export declare function migrateOysterAppBuilds(owner: WatchdogSqliteOwner): void;
 /** The build owner over one tenant's SQLite, Computer and artifact store. */
 export declare function createOysterAppBuilds(options: OysterAppBuildOptions): Readonly<{

package/dist/app-builds.js

@@ -29,6 +29,7 @@ import { writeArtifactRoot, } from "./build/artifact-writer.js";
 import { buildGitPassPrefix } from "./git-auth.js";
 import { defaultAssetPolicy, readVerified, verifyRelease, } from "./release.js";
 import { appForTemplateRepository, templateRepositoryForApp, } from "./source/template-repository.js";
+import { buildJobsFromOlderOyster, OlderOysterStoreError, } from "./older-oyster-store.js";
 /** A Computer's whole-build budget: a cold build on a 6 GiB Computer measured 185-270 s. */
 export const oysterAppBuildTimeoutMs = 900_000;
 /** The job, its clone admission and its upload grant end together. */
@@ -147,9 +148,11 @@ function sameDigest(left, right) {
         difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
     return difference === 0;
 }
-/** Create the current build tables and index atomically; never convert old stores. */
+/** Create the current build tables and index atomically; an older store is refused, never converted. */
 export function migrateOysterAppBuilds(owner) {
     const { sql } = owner;
+    if (buildJobsFromOlderOyster(sql))
+        throw new OlderOysterStoreError();
     owner.transactionSync(() => {
         sql.exec("CREATE TABLE IF NOT EXISTS oyster_build_sources (app_id TEXT PRIMARY KEY, source TEXT NOT NULL) STRICT");
         const jobColumns = `

package/dist/older-oyster-store-refusal.d.ts

@@ -0,0 +1,4 @@
+import type { TenantScope } from "./tenant.js";
+import type { OysterWorkerEnv } from "./workers.js";
+/** Answer with the refusal when the request's registry holds an older store. */
+export declare function refuseOlderOysterStore(request: Request, env: Pick<OysterWorkerEnv, "REGISTRY">, scope: TenantScope): Promise<Response | null>;

package/dist/older-oyster-store-refusal.js

@@ -0,0 +1,18 @@
+import { olderOysterStoreResponse } from "./older-oyster-store.js";
+/** Scopes whose registry answered "not older" in this isolate; a refusal is never cached. */
+const cleanScopes = new WeakMap();
+/** Answer with the refusal when the request's registry holds an older store. */
+export async function refuseOlderOysterStore(request, env, scope) {
+    const name = scope.durableName("registry");
+    let clean = cleanScopes.get(env);
+    if (clean === undefined) {
+        clean = new Set();
+        cleanScopes.set(env, clean);
+    }
+    if (clean.has(name))
+        return null;
+    if (await env.REGISTRY.getByName(name).storeFromOlderOyster())
+        return olderOysterStoreResponse(request);
+    clean.add(name);
+    return null;
+}

package/dist/older-oyster-store.d.ts

@@ -0,0 +1,21 @@
+import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+/** The closed error code a refused request carries. */
+export declare const olderOysterStoreCode = "store_from_older_oyster";
+/** The one message every refusal shows. */
+export declare const olderOysterStoreMessage = "This Oyster's data was created by Oyster 0.2 or earlier, which this version cannot read. Reset it (https://github.com/fungi-computer/oyster#upgrading-from-oyster-02-or-earlier) or redeploy 0.2.x. Old data is left untouched.";
+/** Raised by a store owner that finds data written by Oyster 0.2 or earlier. */
+export declare class OlderOysterStoreError extends Error {
+    constructor();
+}
+/**
+ * Whether the registry holds an installation row written before 0.3, which
+ * kept its authority fields at the top level. Reads only.
+ */
+export declare function installationsFromOlderOyster(sql: WatchdogSqliteOwner["sql"]): boolean;
+/**
+ * Whether `oyster_build_jobs` was created before 0.3 added `request_id`. Reads
+ * the table's own definition, never a schema probe.
+ */
+export declare function buildJobsFromOlderOyster(sql: WatchdogSqliteOwner["sql"]): boolean;
+/** The refusal as the browser or API caller asked to see it. */
+export declare function olderOysterStoreResponse(request: Request): Response;

package/dist/older-oyster-store.js

@@ -0,0 +1,43 @@
+/** The closed error code a refused request carries. */
+export const olderOysterStoreCode = "store_from_older_oyster";
+/** Where the reset steps live. */
+const olderOysterStoreGuide = "https://github.com/fungi-computer/oyster#upgrading-from-oyster-02-or-earlier";
+/** The one message every refusal shows. */
+export const olderOysterStoreMessage = `This Oyster's data was created by Oyster 0.2 or earlier, which this version cannot read. Reset it (${olderOysterStoreGuide}) or redeploy 0.2.x. Old data is left untouched.`;
+/** Raised by a store owner that finds data written by Oyster 0.2 or earlier. */
+export class OlderOysterStoreError extends Error {
+    constructor() {
+        super(olderOysterStoreMessage);
+        this.name = "OlderOysterStoreError";
+    }
+}
+/**
+ * Whether the registry holds an installation row written before 0.3, which
+ * kept its authority fields at the top level. Reads only.
+ */
+export function installationsFromOlderOyster(sql) {
+    const table = sql
+        .exec("SELECT 1 AS found FROM sqlite_master WHERE name='installations'")
+        .toArray();
+    if (table.length === 0)
+        return false;
+    return (sql
+        .exec("SELECT 1 AS found FROM installations WHERE json_valid(record) AND json_type(record, '$.authority') IS NULL LIMIT 1")
+        .toArray().length > 0);
+}
+/**
+ * Whether `oyster_build_jobs` was created before 0.3 added `request_id`. Reads
+ * the table's own definition, never a schema probe.
+ */
+export function buildJobsFromOlderOyster(sql) {
+    return (sql
+        .exec("SELECT 1 AS found FROM sqlite_master WHERE type='table' AND name='oyster_build_jobs' AND sql NOT LIKE '%request_id%'")
+        .toArray().length > 0);
+}
+/** The refusal as the browser or API caller asked to see it. */
+export function olderOysterStoreResponse(request) {
+    const status = 409;
+    if (request.headers.get("accept")?.includes("text/html") === true)
+        return new Response(`<!doctype html><meta charset="utf-8"><title>Oyster data needs a reset</title><body style="font:16px/1.5 system-ui;max-width:40rem;margin:4rem auto;padding:0 1rem"><h1>Oyster data needs a reset</h1><p>This Oyster's data was created by Oyster 0.2 or earlier, which this version cannot read. Old data is left untouched.</p><p><a href="${olderOysterStoreGuide}">Reset it</a> or redeploy 0.2.x.</p></body>`, { status, headers: { "content-type": "text/html; charset=utf-8" } });
+    return Response.json({ error: olderOysterStoreCode, message: olderOysterStoreMessage }, { status });
+}

package/dist/standalone/app-set.js

@@ -2,7 +2,9 @@ import { execFile } from "node:child_process";
 import { mkdtemp, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
+import * as Option from "effect/Option";
 import * as Schema from "effect/Schema";
+import { olderOysterStoreCode } from "../older-oyster-store.js";
 import { publishSource } from "../pack.js";
 import { appBuildRecipe, readBuildManifest } from "../build/workspace-build.js";
 import { parseSourceRevision } from "@fungi.computer/puffball";
@@ -55,6 +57,11 @@ export const standaloneAppSet = [
         appId: "app_grove",
     },
 ];
+/** The host's refusal of a store written by Oyster 0.2 or earlier. */
+const olderOysterStoreRefusal = Schema.Struct({
+    error: Schema.Literal(olderOysterStoreCode),
+    message: Schema.String,
+});
 const publishedSchema = Schema.Struct({
     kind: Schema.Literals(["recorded", "existing"]),
     receipt: Schema.Struct({
@@ -285,8 +292,12 @@ export async function installStandaloneAppSet(options) {
         const publishStarted = performance.now();
         try {
             const published = await publish(app, located);
-            if (!published.ok)
+            if (!published.ok) {
+                const refusal = Schema.decodeUnknownOption(Schema.fromJsonString(olderOysterStoreRefusal))(await published.text());
+                if (Option.isSome(refusal))
+                    throw new Error(refusal.value.message);
                 throw new Error(`${name} source publish failed (${String(published.status)})`);
+            }
             const { kind, receipt } = Schema.decodeUnknownSync(publishedSchema)(await published.json());
             options.report(`${name} source ${kind} at ${receipt.seedRevision}`);
             const ready = performance.now();

package/dist/standalone/registry.d.ts

@@ -43,6 +43,8 @@ export declare abstract class StandaloneRegistry extends OysterRegistry implemen
     #private;
     protected abstract hostFor(scope: TenantScope): Promise<OysterHost>;
     constructor(state: DurableObjectState, env: StandaloneRegistryEnv, git?: StandaloneRegistryGit);
+    /** Whether installations or build jobs were written by Oyster 0.2 or earlier. */
+    storeFromOlderOyster(): boolean;
     /** Re-admit the live owner before inventory access or a hosted start. */
     computerFleet(memberId: string, request: StandaloneFleetRequest): Promise<Readonly<{
         computerId: string;

package/dist/standalone/registry.js

@@ -12,6 +12,7 @@ import * as Schema from "effect/Schema";
 import { parseAppId } from "@fungi.computer/puffball";
 import { appIdSchema } from "@fungi.computer/puffball/effect";
 import { createOysterAppBuilds, OysterBuildStartError, } from "../app-builds.js";
+import { buildJobsFromOlderOyster } from "../older-oyster-store.js";
 import { readBuildManifest, appBuildRecipe } from "../build/workspace-build.js";
 import { standaloneTenancy } from "./tenancy.js";
 import { createFleetComputers, ComputerInventoryError, } from "@fungi.computer/computer/fleet";
@@ -44,6 +45,11 @@ export class StandaloneRegistry extends OysterRegistry {
         });
         this.#computers.ensure();
     }
+    /** Whether installations or build jobs were written by Oyster 0.2 or earlier. */
+    storeFromOlderOyster() {
+        return (super.storeFromOlderOyster() ||
+            buildJobsFromOlderOyster(this.ctx.storage.sql));
+    }
     /** Re-admit the live owner before inventory access or a hosted start. */
     async computerFleet(memberId, request) {
         const shared = await standaloneTenancy(this.#env);

package/dist/workers-git.js

@@ -29,6 +29,7 @@ import { createRecipientDeliveries, } from "./event-recipients.js";
 import { createOyster, oysterPrincipalIsOwner, } from "./host.js";
 import { OysterInstance, oysterBindingEntrypoint, oysterBindings, oysterWorkerHost, r2FileSource, r2ArtifactStore, serveOysterBootCapability, } from "./workers.js";
 import { registryInstallations } from "./internal/registry-installations.js";
+import { refuseOlderOysterStore } from "./older-oyster-store-refusal.js";
 const infoSchema = Schema.Struct({
     name: Schema.String,
     defaultBranch: Schema.String,
@@ -892,6 +893,9 @@ export function createOysterGitWorker(root) {
             if (resolved === null)
                 return new Response("Not found", { status: 404 });
             const { scope } = resolved;
+            const refused = await refuseOlderOysterStore(request, env, scope);
+            if (refused !== null)
+                return refused;
             const boot = await serveOysterBootCapability(request, env, scope);
             if (boot !== null)
                 return boot;

package/dist/workers.d.ts

@@ -211,6 +211,8 @@ export declare class OysterRegistry<Env extends OysterWorkerEnv = OysterWorkerEn
      */
     protected currentOwner(memberId: string, tenantId: TenantId): Promise<string | null>;
     private storageView;
+    /** Whether this registry's data was written by Oyster 0.2 or earlier; hosts refuse it. */
+    storeFromOlderOyster(): boolean;
     /** Every installation record. */
     list(): Installation[];
     /** One installation record, or `null`. */

package/dist/workers.js

@@ -10,6 +10,8 @@ import { BOOT_DEADLINE_MS, BOOT_TRANSPORT_GRACE_MS, readBootUi, } from "./boot-g
 import { checkBootPage } from "./browser/boot.js";
 import { bindingSessions } from "./browser/sessions.js";
 import { registryInstallations } from "./internal/registry-installations.js";
+import { installationsFromOlderOyster } from "./older-oyster-store.js";
+import { refuseOlderOysterStore } from "./older-oyster-store-refusal.js";
 import { createInstallationOperations, } from "./installation-operations.js";
 import { installationWorkerEntrypoint } from "./installation-execution.js";
 export { installationWorkerEntrypoint };
@@ -62,6 +64,8 @@ const approvalHomePinRow = Schema.Struct({
 /** The installation registry: one SQLite-backed Durable Object per Oyster. */
 export class OysterRegistry extends DurableObject {
     #generation;
+    /** Decided once, before this version writes anything, and never revised. */
+    #installationsFromOlderOyster;
     #approval;
     #installationOperations;
     /** The plain root has the same single owner-key host as OysterInstance. */
@@ -150,6 +154,7 @@ export class OysterRegistry extends DurableObject {
     artifactsRepositories;
     constructor(ctx, env) {
         super(ctx, env);
+        this.#installationsFromOlderOyster = installationsFromOlderOyster(ctx.storage.sql);
         ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS oyster_approval_home (id INTEGER PRIMARY KEY CHECK (id = 1), tenant_id TEXT NOT NULL, origin TEXT NOT NULL) STRICT");
         ctx.storage.sql.exec("CREATE TABLE IF NOT EXISTS installations (installation_id TEXT PRIMARY KEY, record TEXT NOT NULL) STRICT");
         this.#generation = createInstallationStoreGeneration(ctx.storage.sql);
@@ -347,6 +352,10 @@ export class OysterRegistry extends DurableObject {
                 : new AppStorageError("unavailable", { cause }),
         }));
     }
+    /** Whether this registry's data was written by Oyster 0.2 or earlier; hosts refuse it. */
+    storeFromOlderOyster() {
+        return this.#installationsFromOlderOyster;
+    }
     /** Every installation record. */
     list() {
         return this.ctx.storage.sql
@@ -1151,6 +1160,9 @@ export function createOysterWorker(options = {}) {
     return {
         async fetch(request, env) {
             const scope = tenantScope(defaultTenant, env.OYSTER_ORIGIN);
+            const refused = await refuseOlderOysterStore(request, env, scope);
+            if (refused !== null)
+                return refused;
             const boot = await serveOysterBootCapability(request, env, scope);
             if (boot !== null)
                 return boot;

package/docs/api/workers.md

@@ -1188,6 +1188,19 @@ Open the existing App-storage invalidation stream under fresh owner admission.
 
 `Promise`\<`Response`\>
 
+##### storeFromOlderOyster()
+
+```ts
+storeFromOlderOyster(): boolean;
+```
+
+Whether this registry's data was written by Oyster 0.2 or earlier; hosts refuse
+it.
+
+###### Returns
+
+`boolean`
+
 ##### list()
 
 ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/oyster",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "author": "Levi <levi@technomancy.dev>",
   "description": "Run your own Apps on Cloudflare Workers or celld: installable App Releases, each with its own Durable Object, SQLite database and declared bindings",
   "type": "module",
@@ -252,7 +252,7 @@
     "@fungi.computer/capnweb": "0.12.0",
     "@fungi.computer/caps": "0.2.0",
     "@fungi.computer/carrier": "0.1.0",
-    "@fungi.computer/computer": "0.2.0",
+    "@fungi.computer/computer": "0.2.1",
     "@fungi.computer/computer-contract": "0.0.1",
     "@fungi.computer/darkroom": "0.2.0",
     "@fungi.computer/ear-tag": "0.1.0",