@fungi.computer/oyster 0.4.0 → 0.4.1

package/dist/app-builds.d.ts

@@ -97,7 +97,7 @@ export type OysterBuildView = Readonly<{
     appId: string;
     releaseId: string;
     sourceRevision: string;
-    status: "running" | "succeeded" | "failed" | "revoked";
+    status: "running" | "succeeded" | "failed" | "interrupted" | "revoked";
     detail: string | null;
     release: Release | null;
     installation: OysterBuildInstallation | null;

package/dist/app-builds.js

@@ -19,6 +19,7 @@
 import * as Schema from "effect/Schema";
 import * as Data from "effect/Data";
 import * as Option from "effect/Option";
+import { candidateFailureDiagnostic } from "./build/candidate-diagnostic.js";
 import { parseArtifactRef, parseReleaseId, } from "@fungi.computer/puffball";
 import { appIdSchema, releaseSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
 import { capturedPinnedRecipeSchema, normalizeAppPublisherRecipe, digestPinnedRecipe, fitsPinnedRecipe, pinnedRecipeObjectBound, } from "./build/effect.js";
@@ -116,7 +117,13 @@ const jobRow = Schema.Struct({
     credential_id: Schema.String,
     upload_grant_digest: Schema.String,
     request_id: Schema.NullOr(Schema.String),
-    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    status: Schema.Literals([
+        "running",
+        "succeeded",
+        "failed",
+        "interrupted",
+        "revoked",
+    ]),
     artifact_digest: Schema.NullOr(Schema.String),
     artifact_bytes: Schema.NullOr(Schema.Number),
     detail: Schema.NullOr(Schema.String),
@@ -186,12 +193,12 @@ export function createOysterAppBuilds(options) {
     // A job outlives the owner instance that started it: the Computer keeps
     // building and its own reports (objects, candidate, status) settle the
     // job, so an owner restart must not fail it. A job that reaches its expiry
-    // without a result can never settle, so it fails then instead of reading
+    // without a result can never settle, so it is interrupted instead of reading
     // as running for as long as anyone asks.
     const failedInstallation = `CASE WHEN installation IS NULL THEN NULL ELSE
     json_object('kind', 'failed', 'installationId', json_extract(installation, '$.installationId'),
       'detail', COALESCE(?, 'Build did not succeed')) END`;
-    const expire = () => owner.sql.exec(`UPDATE oyster_build_jobs SET installation=${failedInstallation}, status='failed', detail=? WHERE status='running' AND expires_at<=?`, "Build expired without a result", "Build expired without a result", now());
+    const expire = () => owner.sql.exec(`UPDATE oyster_build_jobs SET installation=${failedInstallation}, status='interrupted', detail=? WHERE status='running' AND expires_at<=?`, "Build expired without a result", "Build expired without a result", now());
     expire();
     const decodeRecipe = (recipe) => Schema.decodeUnknownSync(recipeCodec)(recipe);
     const grantAdmits = async (job, grant) => sameDigest(job.upload_grant_digest, await sha256Hex(new TextEncoder().encode(grant)));
@@ -269,6 +276,9 @@ export function createOysterAppBuilds(options) {
                 return Promise.resolve();
             },
             execute: async (input) => {
+                // The Computer's connection may close without a terminal execution
+                // reply. A missing output is not an exit; a rejected RPC carrying an
+                // Error (including an admission refusal) remains a definite failure.
                 const result = await options.computer.port.runBuild({
                     jobId: input.jobId,
                     command: input.command,
@@ -298,10 +308,10 @@ export function createOysterAppBuilds(options) {
             });
         }
         catch (cause) {
-            // Without a terminal result the build may still be running on the
-            // Computer; its own reports settle the job, or its expiry fails it.
+            // An unknown output can belong to a live builder. Its reports can
+            // still succeed; the existing build expiry interrupts it if abandoned.
             if (!(cause instanceof BuildOutcomeUnknown))
-                settle(jobId, "failed", cause instanceof Error ? cause.message : "Build failed");
+                settle(jobId, "failed", candidateFailureDiagnostic(cause));
         }
         return view(required(jobId));
     };

package/dist/boot-capability.d.ts

@@ -75,10 +75,11 @@ export declare function issueBootCapability(input: Readonly<{
     ui: BootUi;
     bucket: BootCapabilityBucket;
     capabilities: BootCapabilityStore;
-    expiresAt: number;
+    now: () => number;
 }>): Promise<Readonly<{
     token: string;
     leaseId: string;
+    deadlineAt: number;
 }>>;
 /** What one boot page report needs from its host. */
 export type BootPageReportInput = Readonly<{

package/dist/boot-capability.js

@@ -73,11 +73,14 @@ export async function issueBootCapability(input) {
             throw new BootGateError("ui_mount_failed");
         byteLengths.push(head.size);
     }
+    // Metadata may take longer than the page budget; start the lease only once
+    // every asset has been verified, immediately before issuing it.
+    const deadlineAt = input.now() + BOOT_DEADLINE_MS;
     const lease = {
         id: bootCapabilityIds.lease.generate(),
         identity: input.ui.identity,
         base: input.ui.base,
-        expiresAt: input.expiresAt,
+        expiresAt: deadlineAt + BOOT_TRANSPORT_GRACE_MS,
         assets: capabilityAssets(input.ui.assets, byteLengths),
     };
     validateCapabilityAssetSet(lease);
@@ -87,7 +90,7 @@ export async function issueBootCapability(input) {
         .replace(/=+$/u, "");
     const tokenDigest = createHash("sha256").update(token, "utf8").digest("hex");
     await input.capabilities.issue({ lease, tokenDigest });
-    return { token, leaseId: lease.id };
+    return { token, leaseId: lease.id, deadlineAt };
 }
 /**
  * One UI page check for a Release, for every host, reading no UI bytes:
@@ -102,14 +105,13 @@ export async function reportBootPage(input) {
         return { kind: "passed" };
     if (input.check === null || input.origin === null)
         return { kind: "not_checked", code: "boot_browser_binding_missing" };
-    const deadlineAt = input.now() + BOOT_DEADLINE_MS;
     let issued;
     try {
         issued = await issueBootCapability({
             ui,
             bucket: input.bucket,
             capabilities: input.capabilities,
-            expiresAt: deadlineAt + BOOT_TRANSPORT_GRACE_MS,
+            now: input.now,
         });
     }
     catch (cause) {
@@ -123,7 +125,7 @@ export async function reportBootPage(input) {
             origin: input.origin,
             releaseId: ui.identity.releaseId,
             capability: { header: BOOT_CAPABILITY_HEADER, token: issued.token },
-            deadlineAt,
+            deadlineAt: issued.deadlineAt,
         });
     }
     finally {

package/dist/build/build-jobs.d.ts

@@ -11,7 +11,7 @@ declare const jobSchema: Schema.Struct<{
     readonly expiresAt: Schema.Number;
     readonly remote: Schema.NonEmptyString;
     readonly reportUrl: Schema.NonEmptyString;
-    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "revoked"]>;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "interrupted", "revoked"]>;
     readonly artifact: Schema.NullOr<Schema.Struct<{
         readonly digest: Schema.NonEmptyString;
         readonly bytes: Schema.Number;
@@ -87,7 +87,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded";
+        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;
@@ -103,7 +103,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded";
+        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;

package/dist/build/build-jobs.js

@@ -53,6 +53,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
 import * as Schema from "effect/Schema";
 import { base64url } from "jose";
 import { workspaceBuildPolicy } from "./build-policy.js";
+import { boundedDiagnostic } from "@fungi.computer/bird-dog/effect";
 /** The secret-free Team job; no provider token enters publication. */
 const jobSchema = Schema.Struct({
     jobId: Schema.NonEmptyString,
@@ -63,7 +64,13 @@ const jobSchema = Schema.Struct({
     expiresAt: Schema.Number,
     remote: Schema.NonEmptyString,
     reportUrl: Schema.NonEmptyString,
-    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    status: Schema.Literals([
+        "running",
+        "succeeded",
+        "failed",
+        "interrupted",
+        "revoked",
+    ]),
     artifact: Schema.NullOr(Schema.Struct({ digest: Schema.NonEmptyString, bytes: Schema.Number })),
     detail: Schema.NullOr(Schema.String),
 });
@@ -148,10 +155,8 @@ export function createTeamBuildPublisher(options) {
                         ? "succeeded"
                         : "failed", exitCode === 0
                         ? "Build exited without reporting status"
-                        : "Build exited with " +
-                            String(exitCode) +
-                            ": " +
-                            (result.output?.stderr ?? "").slice(-1_000)));
+                        : (boundedDiagnostic(result.output?.stderr ?? "") ??
+                            `Build exited with ${String(exitCode)}`)));
                     await build.deliverProjection();
                     return completed;
                 }

package/dist/build/candidate-cli.js

@@ -1,17 +1,21 @@
 import * as Schema from "effect/Schema";
 import { releaseSchema } from "@fungi.computer/puffball/effect";
 import { readFile } from "node:fs/promises";
+import { candidateFailureDiagnostic } from "./candidate-diagnostic.js";
 import { candidateManifestObjects, teamAppCandidateManifestSchema, } from "../build-contract.js";
 import { buildTeamCandidate, teamCandidateConfigurationSchema, teamCandidateLayout, TeamCandidateBuildError, } from "./candidate-builder.js";
 /** Objects in flight at once; each is read from disk only while it uploads. */
 const uploadConcurrency = 4;
 /** Attempts per object when its connection drops before a response. */
 const uploadAttempts = 3;
-/** Report a failed build to the host's build output: its kind, never its text. */
+/** Report bounded diagnostics to the host's build output. */
 function reportFailure(cause) {
+    const diagnostic = candidateFailureDiagnostic(cause);
+    process.stderr.write(`Team App source/build failed: ${diagnostic}\n`);
     process.stderr.write(`${JSON.stringify({
         source: "oyster-candidate-builder",
         failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+        diagnostic,
     })}\n`);
 }
 const [configuration, repositoryPath, outputPath] = process.argv.slice(2);
@@ -113,7 +117,5 @@ try {
 }
 catch (cause) {
     reportFailure(cause);
-    // Customer source and provider messages can contain secrets; only expose the stage.
-    process.stderr.write("Team App source/build failed\n");
     process.exitCode = 1;
 }

package/dist/build/candidate-cli.mjs

@@ -14544,6 +14544,21 @@ function makeIsGreaterThanOrEqualTo(options) {
     });
   };
 }
+function makeIsLessThanOrEqualTo(options) {
+  const lte = isLessThanOrEqualTo(options.order);
+  const formatter = options.formatter ?? format;
+  return (maximum, annotations) => {
+    return makeFilter2((input) => lte(input, maximum), {
+      expected: `a value less than or equal to ${formatter(maximum)}`,
+      arbitraryConstraint: {
+        order: options.order,
+        maximum
+      },
+      ...options.annotate?.(maximum),
+      ...annotations
+    });
+  };
+}
 function makeIsBetween(deriveOptions) {
   const greaterThanOrEqualTo = isGreaterThanOrEqualTo(deriveOptions.order);
   const greaterThan = isGreaterThan(deriveOptions.order);
@@ -14611,6 +14626,23 @@ var isGreaterThanOrEqualTo2 = /* @__PURE__ */ makeIsGreaterThanOrEqualTo({
     })
   })
 });
+var isLessThanOrEqualTo2 = /* @__PURE__ */ makeIsLessThanOrEqualTo({
+  order: Number2,
+  annotate: (maximum) => ({
+    representation: {
+      id: "effect/schema/isLessThanOrEqualTo",
+      payload: {
+        maximum: encodeNumberPayload(maximum)
+      }
+    },
+    toJsonSchema: () => ({
+      maximum
+    }),
+    toCode: () => ({
+      runtime: `Schema.isLessThanOrEqualTo(${format(maximum)})`
+    })
+  })
+});
 var isBetween = /* @__PURE__ */ makeIsBetween({
   order: Number2,
   annotate: (options) => {
@@ -16806,14 +16838,14 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       return `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
     };
     doc.write(`const input = payload.value;`);
-    const ids = /* @__PURE__ */ Object.create(null);
+    const ids2 = /* @__PURE__ */ Object.create(null);
     let counter = 0;
     for (const key of normalized.keys) {
-      ids[key] = `key_${counter++}`;
+      ids2[key] = `key_${counter++}`;
     }
     doc.write(`const newResult = {};`);
     for (const key of normalized.keys) {
-      const id = ids[key];
+      const id = ids2[key];
       const k = esc(key);
       const schema2 = shape[key];
       const isOptionalIn = schema2?._zod?.optin === "optional";
@@ -21625,6 +21657,189 @@ var publicRouteConfigurationSchema = Struct({
 // src/build/candidate-cli.ts
 import { readFile as readFile6 } from "node:fs/promises";
 
+// ../carrier/dist/internal/post-contract.js
+var CursorResultSchema = Struct({
+  status: Literals(["accepted", "duplicate"]),
+  cursor: Int.check(isGreaterThanOrEqualTo2(0))
+});
+var PostDeliveryResultSchema = Union2([
+  Literals(["accepted", "duplicate", "refused"]),
+  CursorResultSchema,
+  Struct({
+    status: Literals(["accepted", "duplicate", "refused"]),
+    receipt: Json2
+  })
+]);
+var PostError = class extends TaggedError2("PostError") {
+  constructor(message, reason) {
+    super(reason === void 0 ? { message } : { message, reason });
+  }
+};
+
+// ../carrier/dist/post.js
+var Key = String4.check(isMinLength(1), isMaxLength(256));
+var JobPayload = Struct({ postKey: Key });
+var PageLimit = Int.check(isGreaterThanOrEqualTo2(1), isLessThanOrEqualTo2(64));
+var maxRouteDeadlineMs = 7 * 24 * 60 * 60 * 1e3;
+var ids = defineIdFamily({
+  family: "post",
+  version: 1,
+  kinds: { work: { prefix: "post_work" } }
+});
+var PostEnvelopeSchema = Struct({
+  key: Key,
+  kind: Key,
+  address: Unknown2,
+  event: Unknown2
+});
+var PostRowSchema = fromJsonString2(Union2([
+  Struct({
+    state: Literal2("pending"),
+    envelope: PostEnvelopeSchema,
+    attempts: Int.check(isGreaterThanOrEqualTo2(0)),
+    nextAttemptAt: Number5.check(isGreaterThanOrEqualTo2(0)),
+    deadlineAt: optional2(Number5.check(isGreaterThanOrEqualTo2(0))),
+    jobId: optional2(Key),
+    delivery: optional2(PostEnvelopeSchema),
+    nextKey: optional2(Key)
+  }),
+  Struct({
+    state: Literal2("delivered"),
+    receipt: optional2(Json2),
+    nextKey: optional2(Key)
+  }),
+  Struct({
+    state: Literal2("dead"),
+    envelope: PostEnvelopeSchema,
+    attempts: Int.check(isGreaterThanOrEqualTo2(0)),
+    reason: Literals(["refused", "exhausted", "expired"]),
+    deadlineAt: optional2(Number5.check(isGreaterThanOrEqualTo2(0))),
+    receipt: optional2(Json2),
+    delivery: optional2(PostEnvelopeSchema),
+    nextKey: optional2(Key)
+  })
+]));
+var StoredRow = Struct({ key: String4, value: String4 });
+var DueRow = Struct({
+  due: NullOr(Number5.check(isGreaterThanOrEqualTo2(0)))
+});
+
+// ../bird-dog/dist/effect.js
+var Identifier = String4.check(isMinLength(1), isMaxLength(256));
+var BIRD_DOG_MAIL_CONTENT_MAX_BYTES = 256 * 1024;
+var MailContent = String4.check(makeFilter2((content) => new TextEncoder().encode(content).byteLength <= BIRD_DOG_MAIL_CONTENT_MAX_BYTES, {
+  message: `Mail content must be at most ${String(BIRD_DOG_MAIL_CONTENT_MAX_BYTES)} UTF-8 bytes`
+}));
+var BirdDogAgentReferenceSchema = Struct({
+  kind: Literal2("agent"),
+  agentId: Identifier,
+  sessionId: Identifier
+});
+var BirdDogAgentRecipientReferenceSchema = Struct({
+  kind: Literal2("agent"),
+  agentId: Identifier,
+  sessionId: optionalKey2(Identifier)
+});
+var BIRD_DOG_DIAGNOSTIC_MAX_LENGTH = 200;
+var SettledBirdDogReplySchema = Struct({
+  commandId: Identifier,
+  outcome: Literals([
+    "completed",
+    "failed",
+    "interrupted",
+    "cancelled",
+    "outcome_unknown"
+  ]),
+  diagnostic: optionalKey2(String4.check(isMinLength(1), isMaxLength(BIRD_DOG_DIAGNOSTIC_MAX_LENGTH)))
+});
+var BirdDogUndeliverableReasonSchema = Literals([
+  "recipient_offline",
+  "recipient_left"
+]);
+var UndeliverableBirdDogReplySchema = Struct({
+  outcome: Literal2("undeliverable"),
+  reason: BirdDogUndeliverableReasonSchema
+});
+var AcceptedBirdDogReplySchema = Struct({
+  outcome: Literal2("accepted"),
+  commandId: Identifier
+});
+var BirdDogReplySchema = Union2([
+  SettledBirdDogReplySchema,
+  UndeliverableBirdDogReplySchema,
+  AcceptedBirdDogReplySchema
+]);
+var REDACTED = "[redacted]";
+var schemeCredential = /\b(bearer|basic)\s+[^\s"',;]+/giu;
+var namedCredential = /\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|secret|password|authorization)["']?\s*[:=]\s*["']?)(?!(?:bearer|basic)\s)[^\s"',;&]+/giu;
+var opaqueToken = /[A-Za-z0-9][\w-]{23,}/gu;
+function redactCredentials(text) {
+  return text.replace(schemeCredential, `$1 ${REDACTED}`).replace(namedCredential, `$1${REDACTED}`).replace(opaqueToken, (token) => /\d/u.test(token) && /[A-Za-z]/u.test(token) ? REDACTED : token);
+}
+function boundedDiagnostic(text) {
+  const line = redactCredentials(text.replace(/[\p{Cc}\p{Zl}\p{Zp}\s]+/gu, " ").trim()).slice(0, BIRD_DOG_DIAGNOSTIC_MAX_LENGTH).trimEnd();
+  return line.length === 0 ? void 0 : line;
+}
+var BirdDogMailFields = {
+  key: Identifier,
+  to: BirdDogAgentRecipientReferenceSchema,
+  replyTo: ArraySchema(BirdDogAgentReferenceSchema),
+  content: MailContent,
+  createdAt: Number5.check(isGreaterThanOrEqualTo2(0)),
+  /** The sender's opaque host metadata; BirdDog never reads it. */
+  meta: optionalKey2(Json2)
+};
+var BirdDogMailSchema = Union2([
+  Struct({
+    ...BirdDogMailFields,
+    from: BirdDogAgentReferenceSchema,
+    /** Settlement or acceptance facts, present only on a reply. */
+    reply: optionalKey2(BirdDogReplySchema)
+  }),
+  Struct({
+    ...BirdDogMailFields,
+    from: BirdDogAgentRecipientReferenceSchema,
+    /** An unstarted recipient can only author an undeliverable reply. */
+    reply: UndeliverableBirdDogReplySchema
+  })
+]);
+var BirdDogAgentWorkSchema = Struct({
+  jobId: Identifier,
+  sessionId: Identifier,
+  commandFactId: Identifier,
+  recovery: optional2(Struct({
+    maxRecoveries: Int.check(isGreaterThanOrEqualTo2(0))
+  }))
+});
+var BirdDogAgentJobPayloadSchema = Struct({
+  work: Struct({
+    sessionId: Identifier,
+    commandFactId: Identifier
+  }),
+  mail: optional2(BirdDogMailSchema)
+});
+var BirdDogAgentJobInputSchema = Struct({
+  work: BirdDogAgentWorkSchema,
+  mail: optional2(BirdDogMailSchema)
+});
+
+// src/build/candidate-diagnostic.ts
+function candidateFailureDiagnostic(cause) {
+  const messages = [];
+  let current = cause;
+  for (let depth = 0; depth < 3; depth += 1) {
+    if (!(current instanceof Error)) {
+      if (depth === 0) messages.push("Non-error thrown");
+      break;
+    }
+    messages.push(
+      `${depth === 0 ? "" : "Caused by: "}${current.message || current.name}`
+    );
+    current = current.cause;
+  }
+  return boundedDiagnostic(messages.join("; ")) ?? "Build failed";
+}
+
 // ../puffball/dist/assets.js
 var positiveInteger = Number5.pipe(check(isInt()), check(isGreaterThan2(0)), check(makeFilter2(Number.isSafeInteger)));
 var assetBuildPolicySchema = Struct({
@@ -36087,10 +36302,14 @@ async function buildTeamCandidate(input) {
 var uploadConcurrency = 4;
 var uploadAttempts = 3;
 function reportFailure2(cause) {
+  const diagnostic = candidateFailureDiagnostic(cause);
+  process.stderr.write(`Team App source/build failed: ${diagnostic}
+`);
   process.stderr.write(
     `${JSON.stringify({
       source: "oyster-candidate-builder",
-      failureKind: cause instanceof Error ? "Error" : "NonErrorThrown"
+      failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+      diagnostic
     })}
 `
   );
@@ -36199,7 +36418,6 @@ try {
   );
 } catch (cause) {
   reportFailure2(cause);
-  process.stderr.write("Team App source/build failed\n");
   process.exitCode = 1;
 }
 /*! Bundled license information:

package/dist/build/candidate-diagnostic.d.ts

@@ -0,0 +1,2 @@
+/** The builder's error and at most two causes, safe for a build record. */
+export declare function candidateFailureDiagnostic(cause: unknown): string;

package/dist/build/candidate-diagnostic.js

@@ -0,0 +1,16 @@
+import { boundedDiagnostic } from "@fungi.computer/bird-dog/effect";
+/** The builder's error and at most two causes, safe for a build record. */
+export function candidateFailureDiagnostic(cause) {
+    const messages = [];
+    let current = cause;
+    for (let depth = 0; depth < 3; depth += 1) {
+        if (!(current instanceof Error)) {
+            if (depth === 0)
+                messages.push("Non-error thrown");
+            break;
+        }
+        messages.push(`${depth === 0 ? "" : "Caused by: "}${current.message || current.name}`);
+        current = current.cause;
+    }
+    return boundedDiagnostic(messages.join("; ")) ?? "Build failed";
+}

package/dist/standalone/agent-model-choice.d.ts

@@ -20,7 +20,10 @@ export declare class AgentModelRefused extends Error {
 /** Read the maintained Pi catalog; never accept a model from a different egress. */
 export declare function selectAgentModel(choice: AgentModelChoice): Promise<Model<Api>>;
 /** The Agent DO is the only durable owner. Absence is a new-format default, not an old-env reader. */
-export declare function agentModelChoice(storage: Pick<DurableObjectStorage, "get" | "put">, admit: (choice: AgentModelChoice) => void): {
+export declare function agentModelChoice(storage: Readonly<{
+    get<T = unknown>(key: string): Promise<T | undefined>;
+    put(key: string, value: AgentModelChoice): Promise<void>;
+}>, admit: (choice: AgentModelChoice) => void): {
     read(): Promise<AgentModelChoice>;
     set(input: AgentModelChoice): Promise<AgentModelChoice>;
 };

package/dist/standalone/app-set.d.ts

@@ -60,6 +60,13 @@ export type InstalledStarterApp = Readonly<{
     release: Schema.Json;
     timings: StarterAppTimings;
 }>;
+export type StarterAppSetResult = Readonly<{
+    installed: readonly InstalledStarterApp[];
+    failed: readonly Readonly<{
+        installationId: string;
+        reason: string;
+    }>[];
+}>;
 /**
  * Builds the installer runs at once by default. A build's compiler may take a
  * 4 GB heap, so two fit the platform's 12 GiB Computer (standard-4) with room
@@ -91,4 +98,4 @@ export declare function installStandaloneAppSet(options: Readonly<{
     /** The idle wait between build status reads; the real timer by default. */
     idle?: (ms: number, signal: AbortSignal) => Promise<void>;
     waitMs?: number;
-}>): Promise<readonly InstalledStarterApp[]>;
+}>): Promise<StarterAppSetResult>;

package/dist/standalone/app-set.js

@@ -72,7 +72,13 @@ const publishedSchema = Schema.Struct({
 });
 const buildSchema = Schema.Struct({
     jobId: Schema.String,
-    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    status: Schema.Literals([
+        "running",
+        "succeeded",
+        "failed",
+        "interrupted",
+        "revoked",
+    ]),
     detail: Schema.NullOr(Schema.String),
     /** Installed exactly as the host encoded it. */
     release: Schema.NullOr(Schema.Json),
@@ -271,10 +277,15 @@ export async function installStandaloneAppSet(options) {
         }
     };
     const installed = new Map();
-    /** Set by the first failure, so no further seed or build starts. */
-    const stop = { requested: false };
-    /** Every failure, in the order it happened; the first is the one thrown. */
-    const failures = [];
+    const failures = new Map();
+    const fail = (app, cause) => {
+        const reason = cause instanceof Error ? cause.message : String(cause);
+        failures.set(app.installationId, reason);
+        options.report(`Failed ${app.installationId}: ${reason}`);
+    };
+    const reportFailure = ({ app, cause, }) => {
+        fail(app, cause);
+    };
     const seededQueue = [];
     const waiting = [];
     const seeding = { finished: false };
@@ -318,21 +329,19 @@ export async function installStandaloneAppSet(options) {
     const seedAll = async () => {
         try {
             for (const app of standaloneAppSet) {
-                if (stop.requested)
-                    break;
-                const seeded = await seedApp(app);
-                const waiter = waiting.shift();
-                if (waiter === undefined)
-                    seededQueue.push(seeded);
-                else
-                    waiter(seeded);
+                try {
+                    const seeded = await seedApp(app);
+                    const waiter = waiting.shift();
+                    if (waiter === undefined)
+                        seededQueue.push(seeded);
+                    else
+                        waiter(seeded);
+                }
+                catch (cause) {
+                    reportFailure({ app, cause });
+                }
             }
         }
-        catch (cause) {
-            stop.requested = true;
-            failures.push(cause);
-            throw cause;
-        }
         finally {
             seeding.finished = true;
             for (const waiter of waiting.splice(0))
@@ -341,7 +350,7 @@ export async function installStandaloneAppSet(options) {
     };
     // `concurrency` builds at once, each installing as its build succeeds.
     const slot = async () => {
-        for (let next = await takeSeeded(); next !== undefined && !stop.requested; next = await takeSeeded()) {
+        for (let next = await takeSeeded(); next !== undefined; next = await takeSeeded()) {
             const name = next.app.installationId;
             try {
                 const buildStarted = performance.now();
@@ -416,22 +425,28 @@ export async function installStandaloneAppSet(options) {
                 });
             }
             catch (cause) {
-                stop.requested = true;
-                failures.push(cause);
-                throw cause;
+                reportFailure({ app: next.app, cause });
             }
         }
     };
-    // Wait for every seed and build to settle before reporting: nothing of this
-    // call may still run, or install, after it rejects.
-    await Promise.allSettled([
+    // Wait for every seed and build to settle before returning the full outcome.
+    const settled = await Promise.allSettled([
         seedAll(),
         ...Array.from({ length: concurrency }, slot),
     ]);
-    if (failures.length > 0)
-        throw failures[0];
-    return standaloneAppSet.flatMap((app) => {
-        const result = installed.get(app.installationId);
-        return result === undefined ? [] : [result];
-    });
+    for (const outcome of settled)
+        if (outcome.status === "rejected")
+            throw outcome.reason;
+    return {
+        installed: standaloneAppSet.flatMap((app) => {
+            const result = installed.get(app.installationId);
+            return result === undefined ? [] : [result];
+        }),
+        failed: standaloneAppSet.flatMap((app) => {
+            const reason = failures.get(app.installationId);
+            return reason === undefined
+                ? []
+                : [{ installationId: app.installationId, reason }];
+        }),
+    };
 }

package/dist/standalone/install-apps-bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/standalone/install-apps-bin.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { runInstallAppsCli } from "./install-apps-cli.js";
+await runInstallAppsCli();

package/dist/standalone/install-apps-cli.d.ts

@@ -1,2 +1,4 @@
 #!/usr/bin/env node
-export {};
+import { installStandaloneAppSet } from "./app-set.js";
+export declare function installApps(args: readonly string[], install?: typeof installStandaloneAppSet): Promise<void>;
+export declare function runInstallAppsCli(args?: readonly string[]): Promise<void>;

package/dist/standalone/install-apps-cli.js

@@ -76,7 +76,7 @@ function timingTable(results) {
     ];
     return [header, ...rows].map((row) => row.join("\t")).join("\n");
 }
-async function installApps(args) {
+export async function installApps(args, install = installStandaloneAppSet) {
     const { values } = parseArgs({
         args: [...args],
         options: {
@@ -121,7 +121,7 @@ async function installApps(args) {
             source = { kind: "checkout", directory, revision: `git:${revision}` };
         }
         const started = performance.now();
-        const results = await installStandaloneAppSet({
+        const { installed, failed } = await install({
             source,
             url,
             key,
@@ -131,33 +131,43 @@ async function installApps(args) {
             },
         });
         const elapsed = performance.now() - started;
-        process.stdout.write(`\n${timingTable(results)}\n`);
-        process.stdout.write(`\nInstalled ${String(results.length)} Apps in ${seconds(elapsed)}. Open ${url}/ to use Tourtois and the installed Apps.\n`);
+        process.stdout.write(`\n${timingTable(installed)}\n`);
+        process.stdout.write("\nApp\tResult\n");
+        for (const app of installed)
+            process.stdout.write(`${app.installationId}\tinstalled\n`);
+        for (const app of failed)
+            process.stdout.write(`${app.installationId}\tfailed: ${app.reason}\n`);
+        process.stdout.write(`\nInstalled ${String(installed.length)} Apps; failed ${String(failed.length)} in ${seconds(elapsed)}.${installed.length > 0 ? ` Open ${url}/ to use the installed Apps.` : ""}\n`);
         if (values.timings !== undefined)
             await writeFile(values.timings, JSON.stringify({
                 concurrency,
                 elapsedMs: elapsed,
-                apps: results.map(({ installationId, jobId, timings }) => ({
+                apps: installed.map(({ installationId, jobId, timings }) => ({
                     installationId,
                     jobId,
                     timings,
                 })),
+                failed,
             }, null, 2) + "\n");
+        if (failed.length > 0)
+            process.exitCode = 1;
     }
     finally {
         await rm(scratch, { recursive: true, force: true });
     }
 }
-const [command, ...rest] = process.argv.slice(2);
-if (command === "--help" || command === "-h") {
-    process.stdout.write(usage + "\n" + installReleaseUsage + "\n");
-}
-else if (command !== "install-apps" && command !== "install") {
-    process.stderr.write(`${usage}\n`);
-    process.exitCode = 2;
+export async function runInstallAppsCli(args = process.argv.slice(2)) {
+    const [command, ...rest] = args;
+    if (command === "--help" || command === "-h") {
+        process.stdout.write(usage + "\n" + installReleaseUsage + "\n");
+    }
+    else if (command !== "install-apps" && command !== "install") {
+        process.stderr.write(`${usage}\n`);
+        process.exitCode = 2;
+    }
+    else
+        await (command === "install" ? installReleaseCommand(rest) : installApps(rest)).catch((cause) => {
+            process.stderr.write(`${cause instanceof Error ? cause.message : String(cause)}\n`);
+            process.exitCode = 1;
+        });
 }
-else
-    await (command === "install" ? installReleaseCommand(rest) : installApps(rest)).catch((cause) => {
-        process.stderr.write(`${cause instanceof Error ? cause.message : String(cause)}\n`);
-        process.exitCode = 1;
-    });

package/dist/standalone/registry.d.ts

@@ -187,7 +187,7 @@ export declare abstract class StandaloneRegistry extends OysterRegistry implemen
         appId: string;
         releaseId: string;
         sourceRevision: string;
-        status: "running" | "succeeded" | "failed" | "revoked";
+        status: "running" | "succeeded" | "failed" | "interrupted" | "revoked";
         detail: string | null;
         release: Release | null;
         installation: import("../app-builds.js").OysterBuildInstallation | null;

package/dist/workers.js

@@ -48,6 +48,8 @@ import { createOysterRootData } from "./root-data.js";
 import { backendCache, resolveBackend } from "./release.js";
 import { ensureAppSourceTables, createOysterAppSourceReceipts, createOysterAppRegistrations, createOysterArtifactsRepositoryMetadataStore, } from "./app-sources.js";
 export { r2ArtifactStore, r2FileSource, ownerKeyAuth };
+/** Issuer-ahead clock allowance at issue only; resolution never adds skew. */
+const BOOT_ISSUER_SKEW_MS = 2_000;
 const recordRow = Schema.Struct({
     installation_id: Schema.String,
     record: Schema.String,
@@ -433,8 +435,14 @@ export class OysterRegistry extends DurableObject {
             const { lease, tokenDigest } = bootCapabilityGrantSchema.parse(input.grant);
             validateCapabilityAssetSet(lease);
             const now = Date.now();
+            // The issuer can be at most 2 s ahead of this registry. Apply that
+            // allowance only on issue: resolution still uses the stored absolute
+            // expiry, and revocation still removes the token after the page check.
+            // A lease can therefore live at most 14 s on this clock, not be renewed
+            // or replayed once expired.
             if (lease.expiresAt <= now ||
-                lease.expiresAt > now + BOOT_DEADLINE_MS + BOOT_TRANSPORT_GRACE_MS)
+                lease.expiresAt >
+                    now + BOOT_DEADLINE_MS + BOOT_TRANSPORT_GRACE_MS + BOOT_ISSUER_SKEW_MS)
                 throw new Error("Boot capability lease is outside its deadline");
             this.ctx.storage.sql.exec("DELETE FROM boot_capabilities WHERE expires_at <= ?", now);
             const count = this.ctx.storage.sql

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@fungi.computer/oyster",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "author": "Levi <levi@technomancy.dev>",
   "description": "Run your own Apps on Cloudflare Workers or celld: installable App Releases, each with its own Durable Object, SQLite database and declared bindings",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "oyster": "./dist/standalone/install-apps-cli.js"
+    "oyster": "./dist/standalone/install-apps-bin.js"
   },
   "files": [
     "dist",