@fungi.computer/oyster 0.4.0 → 0.5.0

package/dist/build/build-jobs.d.ts

@@ -11,7 +11,7 @@ declare const jobSchema: Schema.Struct<{
     readonly expiresAt: Schema.Number;
     readonly remote: Schema.NonEmptyString;
     readonly reportUrl: Schema.NonEmptyString;
-    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "revoked"]>;
+    readonly status: Schema.Literals<readonly ["running", "succeeded", "failed", "interrupted", "revoked"]>;
     readonly artifact: Schema.NullOr<Schema.Struct<{
         readonly digest: Schema.NonEmptyString;
         readonly bytes: Schema.Number;
@@ -87,7 +87,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded";
+        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;
@@ -103,7 +103,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded";
+        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;

package/dist/build/build-jobs.js

@@ -53,6 +53,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
 import * as Schema from "effect/Schema";
 import { base64url } from "jose";
 import { workspaceBuildPolicy } from "./build-policy.js";
+import { boundedDiagnostic } from "@fungi.computer/bird-dog/effect";
 /** The secret-free Team job; no provider token enters publication. */
 const jobSchema = Schema.Struct({
     jobId: Schema.NonEmptyString,
@@ -63,7 +64,13 @@ const jobSchema = Schema.Struct({
     expiresAt: Schema.Number,
     remote: Schema.NonEmptyString,
     reportUrl: Schema.NonEmptyString,
-    status: Schema.Literals(["running", "succeeded", "failed", "revoked"]),
+    status: Schema.Literals([
+        "running",
+        "succeeded",
+        "failed",
+        "interrupted",
+        "revoked",
+    ]),
     artifact: Schema.NullOr(Schema.Struct({ digest: Schema.NonEmptyString, bytes: Schema.Number })),
     detail: Schema.NullOr(Schema.String),
 });
@@ -148,10 +155,8 @@ export function createTeamBuildPublisher(options) {
                         ? "succeeded"
                         : "failed", exitCode === 0
                         ? "Build exited without reporting status"
-                        : "Build exited with " +
-                            String(exitCode) +
-                            ": " +
-                            (result.output?.stderr ?? "").slice(-1_000)));
+                        : (boundedDiagnostic(result.output?.stderr ?? "") ??
+                            `Build exited with ${String(exitCode)}`)));
                     await build.deliverProjection();
                     return completed;
                 }

package/dist/build/candidate-cli.js

@@ -1,17 +1,21 @@
 import * as Schema from "effect/Schema";
 import { releaseSchema } from "@fungi.computer/puffball/effect";
 import { readFile } from "node:fs/promises";
+import { candidateFailureDiagnostic } from "./candidate-diagnostic.js";
 import { candidateManifestObjects, teamAppCandidateManifestSchema, } from "../build-contract.js";
 import { buildTeamCandidate, teamCandidateConfigurationSchema, teamCandidateLayout, TeamCandidateBuildError, } from "./candidate-builder.js";
 /** Objects in flight at once; each is read from disk only while it uploads. */
 const uploadConcurrency = 4;
 /** Attempts per object when its connection drops before a response. */
 const uploadAttempts = 3;
-/** Report a failed build to the host's build output: its kind, never its text. */
+/** Report bounded diagnostics to the host's build output. */
 function reportFailure(cause) {
+    const diagnostic = candidateFailureDiagnostic(cause);
+    process.stderr.write(`Team App source/build failed: ${diagnostic}\n`);
     process.stderr.write(`${JSON.stringify({
         source: "oyster-candidate-builder",
         failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+        diagnostic,
     })}\n`);
 }
 const [configuration, repositoryPath, outputPath] = process.argv.slice(2);
@@ -113,7 +117,5 @@ try {
 }
 catch (cause) {
     reportFailure(cause);
-    // Customer source and provider messages can contain secrets; only expose the stage.
-    process.stderr.write("Team App source/build failed\n");
     process.exitCode = 1;
 }

package/dist/build/candidate-cli.mjs

@@ -14544,6 +14544,21 @@ function makeIsGreaterThanOrEqualTo(options) {
     });
   };
 }
+function makeIsLessThanOrEqualTo(options) {
+  const lte = isLessThanOrEqualTo(options.order);
+  const formatter = options.formatter ?? format;
+  return (maximum, annotations) => {
+    return makeFilter2((input) => lte(input, maximum), {
+      expected: `a value less than or equal to ${formatter(maximum)}`,
+      arbitraryConstraint: {
+        order: options.order,
+        maximum
+      },
+      ...options.annotate?.(maximum),
+      ...annotations
+    });
+  };
+}
 function makeIsBetween(deriveOptions) {
   const greaterThanOrEqualTo = isGreaterThanOrEqualTo(deriveOptions.order);
   const greaterThan = isGreaterThan(deriveOptions.order);
@@ -14611,6 +14626,23 @@ var isGreaterThanOrEqualTo2 = /* @__PURE__ */ makeIsGreaterThanOrEqualTo({
     })
   })
 });
+var isLessThanOrEqualTo2 = /* @__PURE__ */ makeIsLessThanOrEqualTo({
+  order: Number2,
+  annotate: (maximum) => ({
+    representation: {
+      id: "effect/schema/isLessThanOrEqualTo",
+      payload: {
+        maximum: encodeNumberPayload(maximum)
+      }
+    },
+    toJsonSchema: () => ({
+      maximum
+    }),
+    toCode: () => ({
+      runtime: `Schema.isLessThanOrEqualTo(${format(maximum)})`
+    })
+  })
+});
 var isBetween = /* @__PURE__ */ makeIsBetween({
   order: Number2,
   annotate: (options) => {
@@ -16806,14 +16838,14 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
       return `shape[${k}]._zod.run({ value: input[${k}], issues: [] }, ctx)`;
     };
     doc.write(`const input = payload.value;`);
-    const ids = /* @__PURE__ */ Object.create(null);
+    const ids2 = /* @__PURE__ */ Object.create(null);
     let counter = 0;
     for (const key of normalized.keys) {
-      ids[key] = `key_${counter++}`;
+      ids2[key] = `key_${counter++}`;
     }
     doc.write(`const newResult = {};`);
     for (const key of normalized.keys) {
-      const id = ids[key];
+      const id = ids2[key];
       const k = esc(key);
       const schema2 = shape[key];
       const isOptionalIn = schema2?._zod?.optin === "optional";
@@ -21625,6 +21657,204 @@ var publicRouteConfigurationSchema = Struct({
 // src/build/candidate-cli.ts
 import { readFile as readFile6 } from "node:fs/promises";
 
+// ../carrier/dist/internal/post-contract.js
+var CursorResultSchema = Struct({
+  status: Literals(["accepted", "duplicate"]),
+  cursor: Int.check(isGreaterThanOrEqualTo2(0))
+});
+var PostDeliveryResultSchema = Union2([
+  Literals(["accepted", "duplicate", "refused"]),
+  CursorResultSchema,
+  Struct({
+    status: Literals(["accepted", "duplicate", "refused"]),
+    receipt: Json2
+  })
+]);
+var PostError = class extends TaggedError2("PostError") {
+  constructor(message, reason) {
+    super(reason === void 0 ? { message } : { message, reason });
+  }
+};
+
+// ../carrier/dist/post.js
+var Key = String4.check(isMinLength(1), isMaxLength(256));
+var JobPayload = Struct({ postKey: Key });
+var PageLimit = Int.check(isGreaterThanOrEqualTo2(1), isLessThanOrEqualTo2(64));
+var maxRouteDeadlineMs = 7 * 24 * 60 * 60 * 1e3;
+var ids = defineIdFamily({
+  family: "post",
+  version: 1,
+  kinds: { work: { prefix: "post_work" } }
+});
+var PostEnvelopeSchema = Struct({
+  key: Key,
+  kind: Key,
+  address: Unknown2,
+  event: Unknown2
+});
+var PostRowSchema = fromJsonString2(Union2([
+  Struct({
+    state: Literal2("pending"),
+    envelope: PostEnvelopeSchema,
+    attempts: Int.check(isGreaterThanOrEqualTo2(0)),
+    nextAttemptAt: Number5.check(isGreaterThanOrEqualTo2(0)),
+    deadlineAt: optional2(Number5.check(isGreaterThanOrEqualTo2(0))),
+    jobId: optional2(Key),
+    delivery: optional2(PostEnvelopeSchema),
+    nextKey: optional2(Key)
+  }),
+  Struct({
+    state: Literal2("delivered"),
+    receipt: optional2(Json2),
+    nextKey: optional2(Key)
+  }),
+  Struct({
+    state: Literal2("dead"),
+    envelope: PostEnvelopeSchema,
+    attempts: Int.check(isGreaterThanOrEqualTo2(0)),
+    reason: Literals(["refused", "exhausted", "expired"]),
+    deadlineAt: optional2(Number5.check(isGreaterThanOrEqualTo2(0))),
+    receipt: optional2(Json2),
+    delivery: optional2(PostEnvelopeSchema),
+    nextKey: optional2(Key)
+  })
+]));
+var StoredRow = Struct({ key: String4, value: String4 });
+var DueRow = Struct({
+  due: NullOr(Number5.check(isGreaterThanOrEqualTo2(0)))
+});
+
+// ../bird-dog/dist/effect.js
+var Identifier = String4.check(isMinLength(1), isMaxLength(256));
+var BIRD_DOG_MAIL_CONTENT_MAX_BYTES = 256 * 1024;
+var MailContent = String4.check(makeFilter2((content) => new TextEncoder().encode(content).byteLength <= BIRD_DOG_MAIL_CONTENT_MAX_BYTES, {
+  message: `Mail content must be at most ${String(BIRD_DOG_MAIL_CONTENT_MAX_BYTES)} UTF-8 bytes`
+}));
+var BirdDogAgentReferenceSchema = Struct({
+  kind: Literal2("agent"),
+  agentId: Identifier,
+  sessionId: Identifier
+});
+var BirdDogAgentRecipientReferenceSchema = Struct({
+  kind: Literal2("agent"),
+  agentId: Identifier,
+  sessionId: optionalKey2(Identifier)
+});
+var BirdDogSystemIdentitySchema = Struct({
+  kind: Literal2("system"),
+  systemId: Literal2("hub")
+});
+var BIRD_DOG_DIAGNOSTIC_MAX_LENGTH = 200;
+var SettledBirdDogReplySchema = Struct({
+  commandId: Identifier,
+  outcome: Literals([
+    "completed",
+    "failed",
+    "interrupted",
+    "cancelled",
+    "outcome_unknown"
+  ]),
+  diagnostic: optionalKey2(String4.check(isMinLength(1), isMaxLength(BIRD_DOG_DIAGNOSTIC_MAX_LENGTH)))
+});
+var BirdDogUndeliverableReasonSchema = Literals([
+  "recipient_offline",
+  "recipient_left"
+]);
+var UndeliverableBirdDogReplySchema = Struct({
+  outcome: Literal2("undeliverable"),
+  reason: BirdDogUndeliverableReasonSchema
+});
+var AcceptedBirdDogReplySchema = Struct({
+  outcome: Literal2("accepted"),
+  commandId: Identifier
+});
+var BirdDogReplySchema = Union2([
+  SettledBirdDogReplySchema,
+  UndeliverableBirdDogReplySchema,
+  AcceptedBirdDogReplySchema
+]);
+var BirdDogAgentReplySchema = Union2([
+  SettledBirdDogReplySchema,
+  AcceptedBirdDogReplySchema,
+  Struct({
+    outcome: Literal2("undeliverable"),
+    reason: Literal2("recipient_left")
+  })
+]);
+var REDACTED = "[redacted]";
+var schemeCredential = /\b(bearer|basic)\s+[^\s"',;]+/giu;
+var namedCredential = /\b((?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|secret|password|authorization)["']?\s*[:=]\s*["']?)(?!(?:bearer|basic)\s)[^\s"',;&]+/giu;
+var opaqueToken = /[A-Za-z0-9][\w-]{23,}/gu;
+function redactCredentials(text) {
+  return text.replace(schemeCredential, `$1 ${REDACTED}`).replace(namedCredential, `$1${REDACTED}`).replace(opaqueToken, (token) => /\d/u.test(token) && /[A-Za-z]/u.test(token) ? REDACTED : token);
+}
+function boundedDiagnostic(text) {
+  const line = redactCredentials(text.replace(/[\p{Cc}\p{Zl}\p{Zp}\s]+/gu, " ").trim()).slice(0, BIRD_DOG_DIAGNOSTIC_MAX_LENGTH).trimEnd();
+  return line.length === 0 ? void 0 : line;
+}
+var BirdDogMailFields = {
+  key: Identifier,
+  to: BirdDogAgentRecipientReferenceSchema,
+  replyTo: ArraySchema(BirdDogAgentReferenceSchema),
+  content: MailContent,
+  createdAt: Number5.check(isGreaterThanOrEqualTo2(0)),
+  /** The sender's opaque host metadata; BirdDog never reads it. */
+  meta: optionalKey2(Json2)
+};
+var BirdDogMailSchema = Union2([
+  Struct({
+    ...BirdDogMailFields,
+    from: BirdDogAgentReferenceSchema,
+    /** Settlement or acceptance facts, present only on a reply. */
+    reply: optionalKey2(BirdDogAgentReplySchema)
+  }),
+  Struct({
+    ...BirdDogMailFields,
+    from: BirdDogSystemIdentitySchema,
+    /** Only the Hub may author this offline disposition. */
+    reply: Struct({
+      outcome: Literal2("undeliverable"),
+      reason: Literal2("recipient_offline")
+    })
+  })
+]);
+var BirdDogAgentWorkSchema = Struct({
+  jobId: Identifier,
+  sessionId: Identifier,
+  commandFactId: Identifier,
+  recovery: optional2(Struct({
+    maxRecoveries: Int.check(isGreaterThanOrEqualTo2(0))
+  }))
+});
+var BirdDogAgentJobPayloadSchema = Struct({
+  work: Struct({
+    sessionId: Identifier,
+    commandFactId: Identifier
+  }),
+  mail: optional2(BirdDogMailSchema)
+});
+var BirdDogAgentJobInputSchema = Struct({
+  work: BirdDogAgentWorkSchema,
+  mail: optional2(BirdDogMailSchema)
+});
+
+// src/build/candidate-diagnostic.ts
+function candidateFailureDiagnostic(cause) {
+  const messages = [];
+  let current = cause;
+  for (let depth = 0; depth < 3; depth += 1) {
+    if (!(current instanceof Error)) {
+      if (depth === 0) messages.push("Non-error thrown");
+      break;
+    }
+    messages.push(
+      `${depth === 0 ? "" : "Caused by: "}${current.message || current.name}`
+    );
+    current = current.cause;
+  }
+  return boundedDiagnostic(messages.join("; ")) ?? "Build failed";
+}
+
 // ../puffball/dist/assets.js
 var positiveInteger = Number5.pipe(check(isInt()), check(isGreaterThan2(0)), check(makeFilter2(Number.isSafeInteger)));
 var assetBuildPolicySchema = Struct({
@@ -36087,10 +36317,14 @@ async function buildTeamCandidate(input) {
 var uploadConcurrency = 4;
 var uploadAttempts = 3;
 function reportFailure2(cause) {
+  const diagnostic = candidateFailureDiagnostic(cause);
+  process.stderr.write(`Team App source/build failed: ${diagnostic}
+`);
   process.stderr.write(
     `${JSON.stringify({
       source: "oyster-candidate-builder",
-      failureKind: cause instanceof Error ? "Error" : "NonErrorThrown"
+      failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+      diagnostic
     })}
 `
   );
@@ -36199,7 +36433,6 @@ try {
   );
 } catch (cause) {
   reportFailure2(cause);
-  process.stderr.write("Team App source/build failed\n");
   process.exitCode = 1;
 }
 /*! Bundled license information:

package/dist/build/candidate-diagnostic.d.ts

@@ -0,0 +1,2 @@
+/** The builder's error and at most two causes, safe for a build record. */
+export declare function candidateFailureDiagnostic(cause: unknown): string;

package/dist/build/candidate-diagnostic.js

@@ -0,0 +1,16 @@
+import { boundedDiagnostic } from "@fungi.computer/bird-dog/effect";
+/** The builder's error and at most two causes, safe for a build record. */
+export function candidateFailureDiagnostic(cause) {
+    const messages = [];
+    let current = cause;
+    for (let depth = 0; depth < 3; depth += 1) {
+        if (!(current instanceof Error)) {
+            if (depth === 0)
+                messages.push("Non-error thrown");
+            break;
+        }
+        messages.push(`${depth === 0 ? "" : "Caused by: "}${current.message || current.name}`);
+        current = current.cause;
+    }
+    return boundedDiagnostic(messages.join("; ")) ?? "Build failed";
+}

package/dist/channels/binding.d.ts

@@ -0,0 +1,63 @@
+import { z } from "zod";
+/** The runtime needs a binding, not a Team or an authority projection. */
+export type ConversationBinding = Readonly<{
+    bindingId: string;
+    lifecycle: "active" | "suspended";
+    selector: Readonly<{
+        provider: "event";
+        target: "new" | "named";
+        verifier: "fungi-v1" | "github" | "secret-url";
+        eventsPerMinute: number;
+    }> | Readonly<{
+        provider: "web" | "discord" | "email" | "game";
+    }>;
+    /** Zod's optional binding projection may carry an explicit undefined. */
+    limits?: BindingLimits | undefined;
+}>;
+/** Per-party edge limits applied before any work is accepted. */
+export declare const bindingLimitsSchema: z.ZodObject<{
+    messagesPerPartyPerDay: z.ZodNumber;
+    charsPerMessage: z.ZodNumber;
+    newPartiesPerHour: z.ZodNumber;
+}, z.core.$strict>;
+/** Per-binding edge limits. */
+export type BindingLimits = z.infer<typeof bindingLimitsSchema>;
+/** Edge limits of a binding whose owner set none. */
+export declare const DEFAULT_BINDING_LIMITS: BindingLimits;
+/**
+ * How long a GitHub body digest keeps a changed-id replay out: the verifiers'
+ * signed-timestamp skew (Veil's `WEBHOOK_SIGNATURE_MAX_SKEW_SECONDS`; a test
+ * pins them equal). GitHub signs no timestamp, so this window is the bound.
+ */
+export declare const EVENT_REPLAY_WINDOW_SECONDS = 300;
+/** The edge limits one binding runs under: its owner's, else its kind's default. */
+export declare function limitsOf(binding: ConversationBinding): BindingLimits;
+export declare const discordSnowflakeSchema: z.ZodString;
+/** The party on the other side of a channel conversation; never a member. */
+export declare const channelPartySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"visitor">;
+    visitorId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"discord-user">;
+    guildId: z.ZodString;
+    userId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"email-sender">;
+    address: z.ZodEmail;
+    dmarc: z.ZodEnum<{
+        none: "none";
+        pass: "pass";
+        fail: "fail";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"player">;
+    worldId: z.ZodString;
+    playerId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"source">;
+    source: z.ZodString;
+}, z.core.$strict>], "kind">;
+/** One channel party. */
+export type ChannelParty = z.infer<typeof channelPartySchema>;
+/** Short human label for a party, used in author metadata and owner rows. */
+export declare function partyLabel(party: ChannelParty): string;

package/dist/channels/binding.js

@@ -0,0 +1,85 @@
+import { z } from "zod";
+import { channelIds } from "./ids.js";
+/** Per-party edge limits applied before any work is accepted. */
+export const bindingLimitsSchema = z.strictObject({
+    messagesPerPartyPerDay: z.number().int().min(1).max(10_000),
+    charsPerMessage: z.number().int().min(1).max(16_000),
+    newPartiesPerHour: z.number().int().min(1).max(100_000),
+});
+/** Edge limits of a binding whose owner set none. */
+export const DEFAULT_BINDING_LIMITS = Object.freeze({
+    messagesPerPartyPerDay: 30,
+    charsPerMessage: 4_000,
+    newPartiesPerHour: 200,
+});
+/**
+ * Edge limits of an incoming-events binding whose owner set none. Events are
+ * not people: `eventsPerMinute` bounds intake, so the
+ * per-party and new-party limits sit at their ceilings, and one event may
+ * carry the longest message intake accepts.
+ */
+const DEFAULT_EVENT_LIMITS = Object.freeze({
+    messagesPerPartyPerDay: 10_000,
+    charsPerMessage: 16_000,
+    newPartiesPerHour: 100_000,
+});
+/**
+ * How long a GitHub body digest keeps a changed-id replay out: the verifiers'
+ * signed-timestamp skew (Veil's `WEBHOOK_SIGNATURE_MAX_SKEW_SECONDS`; a test
+ * pins them equal). GitHub signs no timestamp, so this window is the bound.
+ */
+export const EVENT_REPLAY_WINDOW_SECONDS = 300;
+/** The edge limits one binding runs under: its owner's, else its kind's default. */
+export function limitsOf(binding) {
+    return (binding.limits ??
+        (binding.selector.provider === "event"
+            ? DEFAULT_EVENT_LIMITS
+            : DEFAULT_BINDING_LIMITS));
+}
+export const discordSnowflakeSchema = z.string().regex(/^\d{17,20}$/u);
+/** The party on the other side of a channel conversation; never a member. */
+export const channelPartySchema = z.discriminatedUnion("kind", [
+    z.strictObject({
+        kind: z.literal("visitor"),
+        visitorId: z
+            .string()
+            .refine((value) => channelIds.visitor.is(value), "Invalid visitor"),
+    }),
+    z.strictObject({
+        kind: z.literal("discord-user"),
+        guildId: discordSnowflakeSchema,
+        userId: discordSnowflakeSchema,
+    }),
+    z.strictObject({
+        kind: z.literal("email-sender"),
+        address: z.email(),
+        dmarc: z.enum(["pass", "fail", "none"]),
+    }),
+    z.strictObject({
+        kind: z.literal("player"),
+        worldId: z.string().min(1).max(160),
+        playerId: z.string().min(1).max(160),
+    }),
+    z.strictObject({
+        kind: z.literal("source"),
+        /** The sender's declared source identity, such as `github`. */
+        source: z.string().regex(/^[a-z0-9][a-z0-9._-]{0,63}$/u),
+    }),
+]);
+/** Short human label for a party, used in author metadata and owner rows. */
+export function partyLabel(party) {
+    switch (party.kind) {
+        case "visitor":
+            return `Visitor ${party.visitorId.slice(-4)}`;
+        case "discord-user":
+            return `Discord user ${party.userId}`;
+        case "email-sender":
+            return party.dmarc === "pass"
+                ? party.address
+                : `${party.address} (unverified)`;
+        case "player":
+            return `Player ${party.playerId}`;
+        case "source":
+            return party.source;
+    }
+}