@fungi.computer/oyster 0.3.2 → 0.4.1

package/dist/build/candidate-cli.mjs

@@ -14544,6 +14544,21 @@ function makeIsGreaterThanOrEqualTo(options) {
     });
   };
 }
+function makeIsLessThanOrEqualTo(options) {
+  const lte = isLessThanOrEqualTo(options.order);
+  const formatter = options.formatter ?? format;
+  return (maximum, annotations) => {
+    return makeFilter2((input) => lte(input, maximum), {
+      expected: `a value less than or equal to ${formatter(maximum)}`,
+      arbitraryConstraint: {
+        order: options.order,
+        maximum
+      },
+      ...options.annotate?.(maximum),
+      ...annotations
+    });
+  };
+}
 function makeIsBetween(deriveOptions) {
   const greaterThanOrEqualTo = isGreaterThanOrEqualTo(deriveOptions.order);
   const greaterThan = isGreaterThan(deriveOptions.order);
@@ -14611,6 +14626,23 @@ var isGreaterThanOrEqualTo2 = /* @__PURE__ */ makeIsGreaterThanOrEqualTo({
     })
   })
 });
+var isLessThanOrEqualTo2 = /* @__PURE__ */ makeIsLessThanOrEqualTo({
+  order: Number2,
+  annotate: (maximum) => ({
+    representation: {
+      id: "effect/schema/isLessThanOrEqualTo",
+      payload: {
+        maximum: encodeNumberPayload(maximum)
+      }
+    },
+    toJsonSchema: () => ({
+      maximum
+    }),
+    toCode: () => ({
+      runtime: `Schema.isLessThanOrEqualTo(${format(maximum)})`
+    })
+  })
+});
 var isBetween = /* @__PURE__ */ makeIsBetween({
   order: Number2,
   annotate: (options) => {
@@ -16806,14 +16838,14 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       return `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
     };
     doc.write(`const input = payload.value;`);
-    const ids = /* @__PURE__ */ Object.create(null);
+    const ids2 = /* @__PURE__ */ Object.create(null);
     let counter = 0;
     for (const key of normalized.keys) {
-      ids[key] = `key_${counter++}`;
+      ids2[key] = `key_${counter++}`;
     }
     doc.write(`const newResult = {};`);
     for (const key of normalized.keys) {
-      const id = ids[key];
+      const id = ids2[key];
       const k = esc(key);
       const schema2 = shape[key];
       const isOptionalIn = schema2?._zod?.optin === "optional";
@@ -21625,6 +21657,189 @@ var publicRouteConfigurationSchema = Struct({
 // src/build/candidate-cli.ts
 import { readFile as readFile6 } from "node:fs/promises";
 
+// ../carrier/dist/internal/post-contract.js
+var CursorResultSchema = Struct({
+  status: Literals(["accepted", "duplicate"]),
+  cursor: Int.check(isGreaterThanOrEqualTo2(0))
+});
+var PostDeliveryResultSchema = Union2([
+  Literals(["accepted", "duplicate", "refused"]),
+  CursorResultSchema,
+  Struct({
+    status: Literals(["accepted", "duplicate", "refused"]),
+    receipt: Json2
+  })
+]);
+var PostError = class extends TaggedError2("PostError") {
+  constructor(message, reason) {
+    super(reason === void 0 ? { message } : { message, reason });
+  }
+};
+
+// ../carrier/dist/post.js
+var Key = String4.check(isMinLength(1), isMaxLength(256));
+var JobPayload = Struct({ postKey: Key });
+var PageLimit = Int.check(isGreaterThanOrEqualTo2(1), isLessThanOrEqualTo2(64));
+var maxRouteDeadlineMs = 7 * 24 * 60 * 60 * 1e3;
+var ids = defineIdFamily({
+  family: "post",
+  version: 1,
+  kinds: { work: { prefix: "post_work" } }
+});
+var PostEnvelopeSchema = Struct({
+  key: Key,
+  kind: Key,
+  address: Unknown2,
+  event: Unknown2
+});
+var PostRowSchema = fromJsonString2(Union2([
+  Struct({
+    state: Literal2("pending"),
+    envelope: PostEnvelopeSchema,
+    attempts: Int.check(isGreaterThanOrEqualTo2(0)),
+    nextAttemptAt: Number5.check(isGreaterThanOrEqualTo2(0)),
+    deadlineAt: optional2(Number5.check(isGreaterThanOrEqualTo2(0))),
+    jobId: optional2(Key),
+    delivery: optional2(PostEnvelopeSchema),
+    nextKey: optional2(Key)
+  }),
+  Struct({
+    state: Literal2("delivered"),
+    receipt: optional2(Json2),
+    nextKey: optional2(Key)
+  }),
+  Struct({
+    state: Literal2("dead"),
+    envelope: PostEnvelopeSchema,
+    attempts: Int.check(isGreaterThanOrEqualTo2(0)),
+    reason: Literals(["refused", "exhausted", "expired"]),
+    deadlineAt: optional2(Number5.check(isGreaterThanOrEqualTo2(0))),
+    receipt: optional2(Json2),
+    delivery: optional2(PostEnvelopeSchema),
+    nextKey: optional2(Key)
+  })
+]));
+var StoredRow = Struct({ key: String4, value: String4 });
+var DueRow = Struct({
+  due: NullOr(Number5.check(isGreaterThanOrEqualTo2(0)))
+});
+
+// ../bird-dog/dist/effect.js
+var Identifier = String4.check(isMinLength(1), isMaxLength(256));
+var BIRD_DOG_MAIL_CONTENT_MAX_BYTES = 256 * 1024;
+var MailContent = String4.check(makeFilter2((content) => new TextEncoder().encode(content).byteLength <= BIRD_DOG_MAIL_CONTENT_MAX_BYTES, {
+  message: `Mail content must be at most ${String(BIRD_DOG_MAIL_CONTENT_MAX_BYTES)} UTF-8 bytes`
+}));
+var BirdDogAgentReferenceSchema = Struct({
+  kind: Literal2("agent"),
+  agentId: Identifier,
+  sessionId: Identifier
+});
+var BirdDogAgentRecipientReferenceSchema = Struct({
+  kind: Literal2("agent"),
+  agentId: Identifier,
+  sessionId: optionalKey2(Identifier)
+});
+var BIRD_DOG_DIAGNOSTIC_MAX_LENGTH = 200;
+var SettledBirdDogReplySchema = Struct({
+  commandId: Identifier,
+  outcome: Literals([
+    "completed",
+    "failed",
+    "interrupted",
+    "cancelled",
+    "outcome_unknown"
+  ]),
+  diagnostic: optionalKey2(String4.check(isMinLength(1), isMaxLength(BIRD_DOG_DIAGNOSTIC_MAX_LENGTH)))
+});
+var BirdDogUndeliverableReasonSchema = Literals([
+  "recipient_offline",
+  "recipient_left"
+]);
+var UndeliverableBirdDogReplySchema = Struct({
+  outcome: Literal2("undeliverable"),
+  reason: BirdDogUndeliverableReasonSchema
+});
+var AcceptedBirdDogReplySchema = Struct({
+  outcome: Literal2("accepted"),
+  commandId: Identifier
+});
+var BirdDogReplySchema = Union2([
+  SettledBirdDogReplySchema,
+  UndeliverableBirdDogReplySchema,
+  AcceptedBirdDogReplySchema
+]);
+var REDACTED = "[redacted]";
+var schemeCredential = /\b(bearer|basic)\s+[^\s"',;]+/giu;
+var namedCredential = /\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|secret|password|authorization)["']?\s*[:=]\s*["']?)(?!(?:bearer|basic)\s)[^\s"',;&]+/giu;
+var opaqueToken = /[A-Za-z0-9][\w-]{23,}/gu;
+function redactCredentials(text) {
+  return text.replace(schemeCredential, `$1 ${REDACTED}`).replace(namedCredential, `$1${REDACTED}`).replace(opaqueToken, (token) => /\d/u.test(token) && /[A-Za-z]/u.test(token) ? REDACTED : token);
+}
+function boundedDiagnostic(text) {
+  const line = redactCredentials(text.replace(/[\p{Cc}\p{Zl}\p{Zp}\s]+/gu, " ").trim()).slice(0, BIRD_DOG_DIAGNOSTIC_MAX_LENGTH).trimEnd();
+  return line.length === 0 ? void 0 : line;
+}
+var BirdDogMailFields = {
+  key: Identifier,
+  to: BirdDogAgentRecipientReferenceSchema,
+  replyTo: ArraySchema(BirdDogAgentReferenceSchema),
+  content: MailContent,
+  createdAt: Number5.check(isGreaterThanOrEqualTo2(0)),
+  /** The sender's opaque host metadata; BirdDog never reads it. */
+  meta: optionalKey2(Json2)
+};
+var BirdDogMailSchema = Union2([
+  Struct({
+    ...BirdDogMailFields,
+    from: BirdDogAgentReferenceSchema,
+    /** Settlement or acceptance facts, present only on a reply. */
+    reply: optionalKey2(BirdDogReplySchema)
+  }),
+  Struct({
+    ...BirdDogMailFields,
+    from: BirdDogAgentRecipientReferenceSchema,
+    /** An unstarted recipient can only author an undeliverable reply. */
+    reply: UndeliverableBirdDogReplySchema
+  })
+]);
+var BirdDogAgentWorkSchema = Struct({
+  jobId: Identifier,
+  sessionId: Identifier,
+  commandFactId: Identifier,
+  recovery: optional2(Struct({
+    maxRecoveries: Int.check(isGreaterThanOrEqualTo2(0))
+  }))
+});
+var BirdDogAgentJobPayloadSchema = Struct({
+  work: Struct({
+    sessionId: Identifier,
+    commandFactId: Identifier
+  }),
+  mail: optional2(BirdDogMailSchema)
+});
+var BirdDogAgentJobInputSchema = Struct({
+  work: BirdDogAgentWorkSchema,
+  mail: optional2(BirdDogMailSchema)
+});
+
+// src/build/candidate-diagnostic.ts
+function candidateFailureDiagnostic(cause) {
+  const messages = [];
+  let current = cause;
+  for (let depth = 0; depth < 3; depth += 1) {
+    if (!(current instanceof Error)) {
+      if (depth === 0) messages.push("Non-error thrown");
+      break;
+    }
+    messages.push(
+      `${depth === 0 ? "" : "Caused by: "}${current.message || current.name}`
+    );
+    current = current.cause;
+  }
+  return boundedDiagnostic(messages.join("; ")) ?? "Build failed";
+}
+
 // ../puffball/dist/assets.js
 var positiveInteger = Number5.pipe(check(isInt()), check(isGreaterThan2(0)), check(makeFilter2(Number.isSafeInteger)));
 var assetBuildPolicySchema = Struct({
@@ -36087,10 +36302,14 @@ async function buildTeamCandidate(input) {
 var uploadConcurrency = 4;
 var uploadAttempts = 3;
 function reportFailure2(cause) {
+  const diagnostic = candidateFailureDiagnostic(cause);
+  process.stderr.write(`Team App source/build failed: ${diagnostic}
+`);
   process.stderr.write(
     `${JSON.stringify({
       source: "oyster-candidate-builder",
-      failureKind: cause instanceof Error ? "Error" : "NonErrorThrown"
+      failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+      diagnostic
     })}
 `
   );
@@ -36199,7 +36418,6 @@ try {
   );
 } catch (cause) {
   reportFailure2(cause);
-  process.stderr.write("Team App source/build failed\n");
   process.exitCode = 1;
 }
 /*! Bundled license information:

package/dist/build/candidate-diagnostic.d.ts

@@ -0,0 +1,2 @@
+/** The builder's error and at most two causes, safe for a build record. */
+export declare function candidateFailureDiagnostic(cause: unknown): string;

package/dist/build/candidate-diagnostic.js

@@ -0,0 +1,16 @@
+import { boundedDiagnostic } from "@fungi.computer/bird-dog/effect";
+/** The builder's error and at most two causes, safe for a build record. */
+export function candidateFailureDiagnostic(cause) {
+    const messages = [];
+    let current = cause;
+    for (let depth = 0; depth < 3; depth += 1) {
+        if (!(current instanceof Error)) {
+            if (depth === 0)
+                messages.push("Non-error thrown");
+            break;
+        }
+        messages.push(`${depth === 0 ? "" : "Caused by: "}${current.message || current.name}`);
+        current = current.cause;
+    }
+    return boundedDiagnostic(messages.join("; ")) ?? "Build failed";
+}

package/dist/computer-control-port.d.ts

@@ -0,0 +1,26 @@
+import type { z } from "zod";
+import type { computerCreateRequestSchema, computerPageSchema } from "@fungi.computer/computer/fleet/inventory-wire";
+import type { computerStateSchema } from "@fungi.computer/computer/fleet/wire";
+import type { teamComputerDirectorySchema } from "@fungi.computer/nacre/workbench";
+import type { InvocationContext } from "@fungi.computer/mycelium";
+/** Host policy stays outside this family: Hub admits funded slots, standalone
+ * admits its current owner. Both call their durable fleet through this port.
+ * Keep the host contract independent of the Worker-only fleet lifecycle. */
+export type ComputerControlPort = Readonly<{
+    /** List a bounded page from the host-admitted inventory. */
+    list(page: z.output<typeof computerPageSchema>, context: InvocationContext): Promise<z.output<typeof teamComputerDirectorySchema>>;
+    /** Read liveness without waking the Computer. */
+    state(computerId: string, context: InvocationContext): Promise<z.output<typeof computerStateSchema>>;
+    /** Start one inventoried hosted Computer through the host's admission. */
+    start(computerId: string, context: InvocationContext): Promise<z.output<typeof computerStateSchema>>;
+    /** Create or replay a durable receipt tied to this request identity. */
+    create(input: z.output<typeof computerCreateRequestSchema>, context: InvocationContext): Promise<{
+        kind: "created";
+        computer: {
+            computerId: string;
+            name: string;
+        };
+    } | {
+        kind: "uncertain" | "denied" | "conflict" | "invalid";
+    }>;
+}>;

package/dist/computer-control-port.js

@@ -0,0 +1 @@
+export {};

package/dist/host.d.ts

@@ -1,6 +1,7 @@
 import type { OysterApprovalCall } from "./approval-home.js";
 import type { PendingApproval, ApprovalApplyResult } from "@fungi.computer/approvals";
 import type { WorkflowControl } from "./workflows.js";
+import type { ComputerControlPort } from "./computer-control-port.js";
 import { type InstallationOperations } from "./installation-operations.js";
 export type { InstallationOperations };
 import type { KnapsackComputer } from "@fungi.computer/knapsack";
@@ -192,6 +193,8 @@ export type OysterHost = Readonly<{
      * @inlineType WorkflowControl
      */
     workflows?: (principal: OysterPrincipal) => Promise<WorkflowControl | null>;
+    /** Owner-admitted durable Computer inventory, absent on hosts without a fleet. */
+    computerControl?: (principal: OysterPrincipal) => ComputerControlPort | null;
     auth: OysterAuth;
     /** Host-held sealing key for member writes; never exposed to the guest.
      * Absence refuses eligible named member writes, even when the App has no sync continuation.

package/dist/machine-link/delivery.d.ts

@@ -13,6 +13,6 @@ export declare function createHomeAwareAgentMailNamespace(options: {
     home: (agentId: string) => Promise<MachineAgentHome | null>;
     hosted: PostRoute<never, never>["namespace"];
     machine: (deviceId: string, envelope: PostEnvelope) => Promise<PostDeliveryResult>;
-    /** Host's Agent grammar: throws unless the receipt is a well-formed Accepted. */
+    /** Host's Agent grammar: validates Accepted or Held without conflating them. */
     accepted: (receipt: Schema.Json) => void;
 }): PostRoute<never, never>["namespace"];

package/dist/machine-link/delivery.js

@@ -28,8 +28,7 @@ export function createHomeAwareAgentMailNamespace(options) {
                     address.scopeId !== options.sender.teamId ||
                     address.agentId !== agentId ||
                     mail.to.agentId !== agentId ||
-                    mail.from.agentId !== options.sender.agentId ||
-                    new TextEncoder().encode(JSON.stringify(mail)).byteLength > 256 * 1024)
+                    mail.from.agentId !== options.sender.agentId)
                     return "refused";
                 const projected = await options.home(agentId);
                 if (projected === null)
@@ -45,7 +44,7 @@ export function createHomeAwareAgentMailNamespace(options) {
                 if (result === "accepted" ||
                     result === "duplicate" ||
                     !("receipt" in result))
-                    throw new Error("Agent mail acknowledgment lacks an Accepted receipt");
+                    throw new Error("Agent mail acknowledgment lacks a valid acceptance or Held receipt");
                 if (result.status !== "refused")
                     options.accepted(result.receipt);
                 return result;

package/dist/machine-link/host.d.ts

@@ -1,5 +1,6 @@
-import type { PostEnvelope, PostDeliveryResult } from "@fungi.computer/carrier/post";
-import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
+import { type SeamReplayStore } from "@fungi.computer/seam";
+import { type PostEnvelope, type PostDeliveryResult } from "@fungi.computer/carrier/post";
+import { type WatchdogSqliteOwner } from "@fungi.computer/watchdog";
 export type MachineLinkDevice = Readonly<{
     deviceId: string;
     memberId: string;
@@ -8,16 +9,21 @@ export type MachineLinkDevice = Readonly<{
 }>;
 /**
  * Native device socket I/O. Pins/member authority and mail admission are supplied
- * by their existing owners. Native attachments survive hibernation; pending
- * Post I/O does not claim durable custody and is retried by Carrier.
+ * by their existing owners. Native attachments survive hibernation; Carrier
+ * owns durable custody and per-Agent ordering across socket lifetimes.
  */
 export declare class MachineLinkHost {
     #private;
     private readonly context;
+    private readonly owner;
     private readonly options;
     private readonly channels;
-    private readonly replay;
-    private readonly routes;
+    private replayRuntime;
+    private readonly router;
+    private readonly custodyRoutes;
+    private deviceId;
+    private custodyRuntime;
+    private readonly receipts;
     constructor(context: Pick<DurableObjectState, "getWebSockets" | "acceptWebSocket" | "setWebSocketAutoResponse" | "waitUntil">, owner: WatchdogSqliteOwner, options: Readonly<{
         teamId: string;
         directory: () => Promise<readonly {
@@ -25,14 +31,39 @@ export declare class MachineLinkHost {
             name: string;
         }[]>;
         authorize: (deviceId: string) => Promise<MachineLinkDevice>;
+        replay: () => Promise<SeamReplayStore>;
         receive: (device: MachineLinkDevice, envelope: PostEnvelope) => Promise<PostDeliveryResult>;
+        /** Arm the Durable Object alarm for Carrier/Watchdog progress. */
+        scheduleWake: (at: number) => Promise<void>;
         /** The host's failure log for refused dials and closed links. */
         report: (operation: string, cause: unknown) => void;
     }>);
     fetch(request: Request): Promise<Response>;
+    private replayStore;
+    /** Start the fresh socket and then hand durable rows to its live channel. */
+    connected(socket: WebSocket, deviceId: string): Promise<void>;
     private publishDirectory;
     private channel;
     deliver(deviceId: string, envelope: PostEnvelope): Promise<PostDeliveryResult>;
+    private deliverLiveOperation;
+    private deliverCustodyMail;
+    /** Run due Carrier work; expired rows remain visible as Carrier dead letters. */
+    alarm(): Promise<void>;
+    /** Expose terminal custody rows so S9 can stage its own disposition reply. */
+    deadLetters(afterKey?: string): Promise<Readonly<{
+        letters: readonly Readonly<{
+            key: string;
+            reason: "refused" | "exhausted" | "expired";
+            envelope: PostEnvelope;
+            attempts: number;
+        }>[];
+        nextCursor: string | undefined;
+    }>>;
+    private deliverToSocket;
+    private custody;
+    private createCustody;
+    private releaseCustody;
+    private drainCustody;
     message(socket: WebSocket, message: string | ArrayBuffer): Promise<void>;
     close(socket: WebSocket): void;
     private authorizeSocket;