@fungi.computer/oyster 0.5.0 → 0.6.0

package/dist/channels/visitors.d.ts

@@ -0,0 +1,47 @@
+import { z } from "zod";
+import { type ConversationBinding } from "./binding.js";
+export type VisitorSql = Readonly<{
+    exec: (statement: string, ...bindings: (ArrayBuffer | string | number | null)[]) => Readonly<{
+        toArray: () => readonly unknown[];
+    }>;
+}>;
+/** Credentials handed to one anonymous visitor's iframe. */
+export type VisitorCredentials = Readonly<{
+    visitorId: string;
+    accessToken: string;
+    accessExpiresAt: number;
+    refreshSecret: string;
+}>;
+/** Closed mint/refresh result. */
+export type VisitorGrant = Readonly<{
+    kind: "granted";
+    credentials: VisitorCredentials;
+}> | Readonly<{
+    kind: "denied";
+    reason: "unmapped" | "suspended" | "new_party_limit" | "address_limit" | "refresh_invalid" | "refresh_reused";
+}>;
+/** Bearer grammar: `vt_` or `vr_` plus 43 base64url characters. */
+export declare const visitorBearerSchema: z.ZodString;
+/**
+ * Anonymous visitor identity for web bindings. A visitor principal
+ * names exactly one binding and one visitor, so it can reach exactly that
+ * visitor's one conversation Session and nothing else. Only token hashes are
+ * stored. Reusing a spent refresh secret revokes the whole family.
+ */
+export declare function createChannelVisitors(options: Readonly<{
+    sql: VisitorSql;
+    transactionSync: <T>(body: () => T) => T;
+    now: () => number;
+}>): {
+    ensure: () => void;
+    mint: (binding: ConversationBinding | null, siteKey: string, addressHash: string) => Promise<VisitorGrant>;
+    refresh: (binding: ConversationBinding | null, refreshSecret: string) => Promise<VisitorGrant>;
+    authenticate: (bindingId: string, accessToken: string) => Promise<Readonly<{
+        visitorId: string;
+        expiresAt: number;
+        addressHash: string;
+    }> | null>;
+    forget: (visitorId: string) => void;
+};
+/** Anonymous visitor identity owner. */
+export type ChannelVisitors = ReturnType<typeof createChannelVisitors>;

package/dist/channels/visitors.js

@@ -0,0 +1,181 @@
+import { z } from "zod";
+import { DEFAULT_BINDING_LIMITS } from "./binding.js";
+import { channelIds } from "./ids.js";
+/** Access tokens live one hour; refresh secrets seven days, rotated on use. */
+const VISITOR_ACCESS_MS = 3_600_000;
+const VISITOR_REFRESH_MS = 7 * 86_400_000;
+/**
+ * A visitor identity (one conversation) ends thirty days after it was
+ * minted however often it refreshes: no token outlives it.
+ */
+const VISITOR_LIFETIME_MS = 30 * 86_400_000;
+/** New visitors one network address may mint per hour on one binding. */
+const VISITORS_PER_ADDRESS_PER_HOUR = 10;
+const HOUR_MS = 3_600_000;
+/** Bearer grammar: `vt_` or `vr_` plus 43 base64url characters. */
+export const visitorBearerSchema = z
+    .string()
+    .regex(/^v[tr]_[A-Za-z0-9_-]{43}$/u);
+const tokenRow = z.strictObject({
+    visitor_id: z.string(),
+    family: z.string(),
+    kind: z.enum(["access", "refresh"]),
+    expires_at: z.number().int(),
+    used: z.number().int(),
+});
+const countRow = z.strictObject({ count: z.number().int() });
+function randomBearer(prefix) {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return (prefix +
+        btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, ""));
+}
+async function digest(value) {
+    const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return [...new Uint8Array(hash)]
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+/**
+ * Anonymous visitor identity for web bindings. A visitor principal
+ * names exactly one binding and one visitor, so it can reach exactly that
+ * visitor's one conversation Session and nothing else. Only token hashes are
+ * stored. Reusing a spent refresh secret revokes the whole family.
+ */
+export function createChannelVisitors(options) {
+    const { sql } = options;
+    const ensure = () => {
+        sql.exec(`CREATE TABLE IF NOT EXISTS hub_channel_visitors (
+      visitor_id TEXT PRIMARY KEY,
+      binding_id TEXT NOT NULL,
+      address_hash TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      revoked INTEGER NOT NULL DEFAULT 0
+    ) STRICT`);
+        sql.exec("CREATE INDEX IF NOT EXISTS hub_channel_visitors_binding ON hub_channel_visitors(binding_id, created_at)");
+        sql.exec(`CREATE TABLE IF NOT EXISTS hub_channel_visitor_tokens (
+      token_hash TEXT PRIMARY KEY,
+      visitor_id TEXT NOT NULL,
+      binding_id TEXT NOT NULL,
+      family TEXT NOT NULL,
+      kind TEXT NOT NULL CHECK (kind IN ('access','refresh')),
+      expires_at INTEGER NOT NULL,
+      used INTEGER NOT NULL DEFAULT 0
+    ) STRICT`);
+    };
+    const count = (statement, ...bindings) => countRow.parse(sql.exec(statement, ...bindings).toArray()[0]).count;
+    const issue = async (bindingId, visitorId, family, endsAt) => {
+        const accessToken = randomBearer("vt_");
+        const refreshSecret = randomBearer("vr_");
+        const now = options.now();
+        const accessExpiresAt = Math.min(now + VISITOR_ACCESS_MS, endsAt);
+        const [accessHash, refreshHash] = await Promise.all([
+            digest(accessToken),
+            digest(refreshSecret),
+        ]);
+        options.transactionSync(() => {
+            sql.exec("INSERT INTO hub_channel_visitor_tokens VALUES (?,?,?,?,'access',?,0)", accessHash, visitorId, bindingId, family, accessExpiresAt);
+            sql.exec("INSERT INTO hub_channel_visitor_tokens VALUES (?,?,?,?,'refresh',?,0)", refreshHash, visitorId, bindingId, family, Math.min(now + VISITOR_REFRESH_MS, endsAt));
+        });
+        return { visitorId, accessToken, accessExpiresAt, refreshSecret };
+    };
+    /** Mint a new anonymous visitor on one active web binding. */
+    const mint = async (binding, siteKey, addressHash) => {
+        ensure();
+        if (binding?.selector.provider !== "web" ||
+            binding.selector.siteKey !== siteKey)
+            return { kind: "denied", reason: "unmapped" };
+        if (binding.lifecycle !== "active")
+            return { kind: "denied", reason: "suspended" };
+        const limits = binding.limits ?? DEFAULT_BINDING_LIMITS;
+        const now = options.now();
+        const visitorId = channelIds.visitor.generate();
+        const admitted = options.transactionSync(() => {
+            if (count("SELECT COUNT(*) AS count FROM hub_channel_visitors WHERE binding_id=? AND created_at>?", binding.bindingId, now - HOUR_MS) >= limits.newPartiesPerHour)
+                return "new_party_limit";
+            if (count("SELECT COUNT(*) AS count FROM hub_channel_visitors WHERE binding_id=? AND address_hash=? AND created_at>?", binding.bindingId, addressHash, now - HOUR_MS) >= VISITORS_PER_ADDRESS_PER_HOUR)
+                return "address_limit";
+            sql.exec("INSERT INTO hub_channel_visitors (visitor_id,binding_id,address_hash,created_at) VALUES (?,?,?,?)", visitorId, binding.bindingId, addressHash, now);
+            return null;
+        });
+        if (admitted !== null)
+            return { kind: "denied", reason: admitted };
+        return {
+            kind: "granted",
+            credentials: await issue(binding.bindingId, visitorId, visitorId, now + VISITOR_LIFETIME_MS),
+        };
+    };
+    const lookup = async (bearer) => {
+        ensure();
+        const raw = sql
+            .exec("SELECT t.visitor_id,t.family,t.kind,t.expires_at,t.used FROM hub_channel_visitor_tokens t JOIN hub_channel_visitors v ON v.visitor_id=t.visitor_id WHERE t.token_hash=? AND v.revoked=0", await digest(bearer))
+            .toArray()[0];
+        return raw === undefined ? null : tokenRow.parse(raw);
+    };
+    /** Rotate a refresh secret; a reused one revokes the visitor's family. */
+    const refresh = async (binding, refreshSecret) => {
+        if (binding?.selector.provider !== "web")
+            return { kind: "denied", reason: "unmapped" };
+        if (binding.lifecycle !== "active")
+            return { kind: "denied", reason: "suspended" };
+        const hash = await digest(refreshSecret);
+        const row = await lookup(refreshSecret);
+        if (row?.kind !== "refresh" ||
+            row.expires_at <= options.now() ||
+            !sql
+                .exec("SELECT 1 FROM hub_channel_visitor_tokens WHERE token_hash=? AND binding_id=?", hash, binding.bindingId)
+                .toArray().length)
+            return { kind: "denied", reason: "refresh_invalid" };
+        const claimed = options.transactionSync(() => {
+            if (row.used !== 0) {
+                sql.exec("UPDATE hub_channel_visitors SET revoked=1 WHERE visitor_id=?", row.visitor_id);
+                return false;
+            }
+            sql.exec("UPDATE hub_channel_visitor_tokens SET used=1 WHERE token_hash=?", hash);
+            return true;
+        });
+        if (!claimed)
+            return { kind: "denied", reason: "refresh_reused" };
+        const created = z
+            .strictObject({ created_at: z.number().int() })
+            .parse(sql
+            .exec("SELECT created_at FROM hub_channel_visitors WHERE visitor_id=?", row.visitor_id)
+            .toArray()[0]).created_at;
+        const endsAt = created + VISITOR_LIFETIME_MS;
+        if (endsAt <= options.now())
+            return { kind: "denied", reason: "refresh_invalid" };
+        return {
+            kind: "granted",
+            credentials: await issue(binding.bindingId, row.visitor_id, row.family, endsAt),
+        };
+    };
+    /** The one visitor an access token names on this binding, or null. */
+    const authenticate = async (bindingId, accessToken) => {
+        const hash = await digest(accessToken);
+        const row = await lookup(accessToken);
+        if (row?.kind !== "access" || row.expires_at <= options.now())
+            return null;
+        const scoped = sql
+            .exec("SELECT v.address_hash FROM hub_channel_visitor_tokens t JOIN hub_channel_visitors v ON v.visitor_id=t.visitor_id WHERE t.token_hash=? AND t.binding_id=? AND v.revoked=0", hash, bindingId)
+            .toArray()[0];
+        if (scoped === undefined)
+            return null;
+        const address = z.strictObject({ address_hash: z.string() }).parse(scoped);
+        return {
+            visitorId: row.visitor_id,
+            expiresAt: row.expires_at,
+            addressHash: address.address_hash,
+        };
+    };
+    /** Revoke a swept visitor and drop its token hashes. */
+    const forget = (visitorId) => {
+        ensure();
+        options.transactionSync(() => {
+            sql.exec("UPDATE hub_channel_visitors SET revoked=1 WHERE visitor_id=?", visitorId);
+            sql.exec("DELETE FROM hub_channel_visitor_tokens WHERE visitor_id=?", visitorId);
+        });
+    };
+    return { ensure, mint, refresh, authenticate, forget };
+}

package/dist/cloudflare.d.ts

@@ -4,7 +4,7 @@ export type { BackgroundFrameState } from "./invocation.js";
 import { WorkerEntrypoint } from "cloudflare:workers";
 import { type GuestLimits } from "./guest-policy.js";
 export type { GuestLimits } from "./guest-policy.js";
-import type { ArtifactHeads, ArtifactStore, ArtifactStreams } from "./release.js";
+import type { ArtifactHeads, ArtifactStore, ArtifactStreams, VerifiedObjectCache } from "./release.js";
 import { type AppBackendBindingName } from "@fungi.computer/puffball/app";
 import { type InvocationFrame, type InvocationGate } from "./invocation.js";
 import * as Schema from "effect/Schema";
@@ -14,6 +14,12 @@ import { type UiBootCheckOutcome } from "./boot-gate.js";
 export { checkBackendConstruction } from "./boot-construction.js";
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
 import { AppInstanceError, type AppInstance, type InstancePorts } from "./index.js";
+/**
+ * The zone's edge cache as a {@link VerifiedObjectCache}: each verified object
+ * under a digest-named key on `origin` that no route serves. A failed write is
+ * logged and answers `unstored`; the next reader verifies from the store again.
+ */
+export declare function edgeVerifiedObjectCache(cache: Pick<Cache, "match" | "put">, origin: string): VerifiedObjectCache;
 /** Store Release artifacts without loading the Worker ownership barrel. */
 export declare function r2ArtifactStore(bucket: R2Bucket): ArtifactStore & ArtifactHeads & ArtifactStreams;
 /** Encode supervisor refusals before native RPC can discard Error properties. */
@@ -113,7 +119,7 @@ export type AppInstanceLoader<FacetClass> = Readonly<{
         getDurableObjectClass: (exportName: string) => FacetClass;
     }>;
 }>;
-/** End the native App facet before shared frame admission releases its permit. */
+/** End the native App facet when live authority closes early, before the gate admits again. */
 export declare function createCloudflareInvocationGate<Host, FacetClass>(ctx: Pick<AppInstanceContext<FacetClass>, "facets">, close: (frame: InvocationFrame<Host>) => Promise<void>): InvocationGate<Host>;
 /**
  * Run an App Instance inside a SQLite-backed Durable Object on workerd, celld

package/dist/cloudflare.js

@@ -20,6 +20,32 @@ import { BootGateError } from "./boot-gate.js";
 export { checkBackendConstruction } from "./boot-construction.js";
 import { createAppInstance, AppInstanceError, instanceIdSchema, instanceSchema, appInstanceErrorCodeSchema, } from "./index.js";
 const bindingWire = createFrameBindingWire(appInstanceErrorCodeSchema.literals);
+/**
+ * The zone's edge cache as a {@link VerifiedObjectCache}: each verified object
+ * under a digest-named key on `origin` that no route serves. A failed write is
+ * logged and answers `unstored`; the next reader verifies from the store again.
+ */
+export function edgeVerifiedObjectCache(cache, origin) {
+    const key = (digest) => new Request(new URL(`/_oyster/verified/${digest}`, origin));
+    return {
+        match: async (digest) => (await cache.match(key(digest)))?.body ?? null,
+        put: async (digest, bytes) => {
+            try {
+                await cache.put(key(digest), new Response(new Uint8Array(bytes), {
+                    headers: { "Cache-Control": "public, max-age=31536000, immutable" },
+                }));
+                return "stored";
+            }
+            catch (cause) {
+                console.error("Verified object cache write failed", {
+                    digest,
+                    failure: cause instanceof Error ? cause.name : "non-error rejection",
+                });
+                return "unstored";
+            }
+        },
+    };
+}
 /** Store Release artifacts without loading the Worker ownership barrel. */
 export function r2ArtifactStore(bucket) {
     const abortError = (signal) => {
@@ -241,7 +267,7 @@ const facetInvocationSchema = rpcHandleSchema({
     invoke: rpcMethod(z.union([z.json(), z.undefined()])).input(z.tuple([z.string(), z.array(z.unknown()), z.unknown()])),
     http: rpcMethod(facetHttpReplySchema).input(z.tuple([facetHttpInputSchema, z.unknown()])),
 });
-/** End the native App facet before shared frame admission releases its permit. */
+/** End the native App facet when live authority closes early, before the gate admits again. */
 export function createCloudflareInvocationGate(ctx, close) {
     return createInvocationGate({
         abortGuest: () => {

package/dist/computer-target.d.ts

@@ -0,0 +1,5 @@
+/** The query parameter that carries a window's Computer routing hint. */
+export declare const computerTargetParam = "computerId";
+/** Serialize a window's routing hint. The server must admit it through the live
+ * owner and fleet before constructing that request's workspace. */
+export declare function computerTargetUrl(path: string, computerId?: string): string;

package/dist/computer-target.js

@@ -0,0 +1,11 @@
+/** The query parameter that carries a window's Computer routing hint. */
+export const computerTargetParam = "computerId";
+/** Serialize a window's routing hint. The server must admit it through the live
+ * owner and fleet before constructing that request's workspace. */
+export function computerTargetUrl(path, computerId) {
+    if (computerId === undefined)
+        return path;
+    const url = new URL(path, "https://oyster.invalid");
+    url.searchParams.set(computerTargetParam, computerId);
+    return url.pathname + url.search;
+}

package/dist/host.d.ts

@@ -14,6 +14,7 @@ import { type GuestLimits } from "./guest-policy.js";
 import { type InvocationFacts } from "./invocation.js";
 export type { GuestLimits } from "./guest-policy.js";
 import { Hono } from "hono";
+import { type TimingVariables } from "hono/timing";
 import * as Schema from "effect/Schema";
 import { type BackgroundSyncRefusal } from "@fungi.computer/puffball/background-replay";
 import { type Installation, type InstallationReader } from "./apps/installation.js";
@@ -26,12 +27,12 @@ export { capabilityDescriptorSchema, capabilityMethodKindSchema, capabilityMetho
 import type { Release } from "@fungi.computer/puffball";
 import type { UiBootCheckOutcome } from "./boot-gate.js";
 import { type Instance, type InstanceId, type OwnerState, type AppInstanceErrorCode } from "./index.js";
-import { type ArtifactStore } from "./release.js";
+import { type ArtifactStore, type VerifiedObjectCache } from "./release.js";
 import { type GitDoorTarget } from "./git.js";
 import type { AdmittedGit } from "./git-admission.js";
 import { type PageAssetLoader } from "./page-assets.js";
 import { type AppApi } from "@fungi.computer/puffball";
-export { ReleaseError, defaultAssetPolicy, parseRelease, resolveBackend, sha256, verifyRelease, type ArtifactStore, type VerifiedRelease, } from "./release.js";
+export { ReleaseError, defaultAssetPolicy, parseRelease, resolveBackend, sha256, verifyRelease, type ArtifactStore, type VerifiedObjectCache, type VerifiedRelease, } from "./release.js";
 /**
  * The anonymous reader of a public installation. The host admits it only when
  * authentication refuses; it reaches that App's page and its `read` methods.
@@ -173,7 +174,7 @@ export type OysterCapability = Readonly<CapabilityDescriptor & {
     routes: Hono<CapabilityEnv>;
 }>;
 /** What the host stamps once per request; inner routes read it with `c.get`. */
-export type OysterVariables = {
+export type OysterVariables = TimingVariables & {
     principal: OysterPrincipal;
     installation?: Installation;
 };
@@ -201,6 +202,8 @@ export type OysterHost = Readonly<{
      */
     backgroundOriginKey?: () => Promise<CryptoKey>;
     artifacts: ArtifactStore;
+    /** Digest-keyed copies of verified UI objects; absent, every read is verified from `artifacts`. */
+    uiCache?: VerifiedObjectCache;
     installations: InstallationStore;
     instances: InstanceDirectory;
     /** Report-only host UI check; backend construction remains Instance-owned and blocking. */

package/dist/host.js

@@ -12,6 +12,7 @@ import { guestLimits } from "./guest-policy.js";
 import { APP_INVOCATION_CEILING_MS, admittedCallerFacts, admittedMethodCallerFacts, invocationAuthorityOf, invocationCallerContext, invocationFacts, } from "./invocation.js";
 import { appFacetResponse } from "./backend-request.js";
 import { Hono } from "hono";
+import { endTime, startTime, timing } from "hono/timing";
 import { bodyLimit } from "hono/body-limit";
 import { match } from "path-to-regexp";
 import * as Schema from "effect/Schema";
@@ -26,7 +27,7 @@ import { appBackendActorHeader, appBackendComputerHeader, appMethodRefusalStatus
 import { appCallsDescriptor, } from "./capability-descriptor.js";
 export { capabilityDescriptorSchema, capabilityMethodKindSchema, capabilityMethodSchema, } from "./capability-descriptor.js";
 import { selectionOf, } from "./index.js";
-import { parseRelease, readVerified, sha256, } from "./release.js";
+import { parseRelease, readCachedVerified, sha256, } from "./release.js";
 import { createGitDoor } from "./git.js";
 import { buildGitPassPrefix, presentedGitKey } from "./git-auth.js";
 import { workflowGitPassPrefix } from "@fungi.computer/braid/runtime";
@@ -202,6 +203,19 @@ const tabIcon = `<link rel="icon" type="image/svg+xml" href="${fungiFaviconHref}
 export function createOyster(host) {
     const limits = guestLimits(host.guestLimits);
     const app = new Hono();
+    // Server-Timing names the Durable Object hops a request waited on.
+    // An upgraded socket keeps its response untouched.
+    app.use(timing({
+        totalDescription: "Oyster",
+        enabled: (context) => context.res.status !== 101,
+    }));
+    // A forwarded Durable Object or fetch response has immutable headers;
+    // give the timing middleware a copy it can append Server-Timing to.
+    app.use(async (context, next) => {
+        await next();
+        if (context.res.status !== 101)
+            context.res = new Response(context.res.body, context.res);
+    });
     const releaseOf = releaseCache(host.artifacts);
     const operationDescriptors = host.capabilities ?? [];
     const gateFacts = (installation, release, principal) => hostGateFacts(host, installation, release, principal);
@@ -258,6 +272,30 @@ export function createOyster(host) {
             ? cause
             : new PageAssetsLoadError(cause);
     }));
+    // An Oyster is a private instance, never a search result: every response
+    // says so, and robots.txt is public so crawlers read the rule rather than a
+    // 401 (which Google treats as "crawl everything").
+    app.use("*", async (context, next) => {
+        await next();
+        try {
+            context.res.headers.set("X-Robots-Tag", "noindex, nofollow");
+        }
+        catch (cause) {
+            // Fetched responses (proxied Apps, the git door) have immutable headers.
+            if (!(cause instanceof TypeError))
+                throw cause;
+            const { body, status, statusText, headers } = context.res;
+            const marked = new Headers(headers);
+            marked.set("X-Robots-Tag", "noindex, nofollow");
+            context.res = new Response(body, { status, statusText, headers: marked });
+        }
+    });
+    app.get("/robots.txt", () => new Response("User-agent: *\nDisallow: /\n", {
+        headers: {
+            "Content-Type": "text/plain; charset=utf-8",
+            "Cache-Control": "public, max-age=3600",
+        },
+    }));
     // The home page imports this host-owned entry, never the Release module's
     // own URL: released Oyster 0.2.0 served that URL immutable, so a browser may
     // hold a copy it would import without a request. The entry is never cached
@@ -285,7 +323,9 @@ export function createOyster(host) {
     // App UI: digest-pinned, sandboxed, and readable without a session because
     // the opaque-origin frame cannot carry one.
     app.get("/ui/:installationId/:releaseId/*", async (context) => {
+        startTime(context, "registry");
         const installation = await host.installations.get(context.req.param("installationId"));
+        endTime(context, "registry");
         if (installation?.status !== "enabled" ||
             installation.release.releaseId !== context.req.param("releaseId"))
             return refusal(404, "Not found");
@@ -298,13 +338,15 @@ export function createOyster(host) {
         if (release.ui.kind === "html") {
             if (path !== "/")
                 return refusal(404, "Not found");
-            const bytes = await readVerified(host.artifacts, release.ui.artifactRef, release.ui.digest);
-            return new Response(new Uint8Array(bytes), {
+            const body = await readCachedVerified(host.artifacts, host.uiCache, release.ui.artifactRef, release.ui.digest);
+            return new Response(body, {
                 headers: {
                     "Content-Type": "text/html; charset=utf-8",
                     "Content-Security-Policy": `default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src blob: data:; media-src blob:; font-src data:; connect-src 'none'; frame-src 'none'; frame-ancestors ${origin}; base-uri 'none'; form-action 'none'; sandbox ${appSandbox}`,
                     "X-Content-Type-Options": "nosniff",
-                    "Cache-Control": "no-store",
+                    // Digest-pinned like an assets UI's index.html: the frame's
+                    // authority is its host connection, never these bytes.
+                    "Cache-Control": "public, max-age=31536000, immutable",
                 },
             });
         }
@@ -317,9 +359,9 @@ export function createOyster(host) {
         const shellEntry = wanted === shellModuleAssetPath;
         if (shellEntry && !(await shellApproved(installation, release)))
             return noStoreRefusal(403, "not_approved");
-        const bytes = await readVerified(host.artifacts, asset.artifactRef, asset.digest);
+        const body = await readCachedVerified(host.artifacts, host.uiCache, asset.artifactRef, asset.digest);
         const scope = `${origin}${prefix}/`;
-        return new Response(new Uint8Array(bytes), {
+        return new Response(body, {
             headers: {
                 "Content-Type": asset.contentType,
                 "Content-Security-Policy": `default-src 'none'; script-src ${scope} 'wasm-unsafe-eval'; style-src ${scope} 'unsafe-inline'; img-src ${scope} blob: data:; media-src blob:; font-src ${scope} data:; connect-src data: ${scope}; worker-src blob:; frame-src 'none'; frame-ancestors ${origin}; base-uri 'none'; form-action 'none'; sandbox ${appSandbox}`,
@@ -389,9 +431,20 @@ export function createOyster(host) {
                         ? null
                         : git.buildPass(presented.value, target);
                 const result = await host.auth.authenticate(request);
-                return result.kind === "admitted"
-                    ? git.writerOf(result.principal)
-                    : null;
+                if (result.kind !== "admitted")
+                    return null;
+                // A named key signs Git in only where its own grants reach that
+                // App: a clone needs App read, a push App use. Otherwise it is
+                // anonymous, which reaches only a public repository's reads.
+                const { actor } = result.principal;
+                if (actor.kind === "team-key") {
+                    const key = (await host.keys?.live(actor.keyId)) ?? null;
+                    const access = key === null ? null : keyAppAccess(key, target.installationId);
+                    if (access === null ||
+                        (target.scope === "write" && access.level !== "write"))
+                        return null;
+                }
+                return git.writerOf(result.principal);
             },
             isPublic: async (installationId) => (await host.installations.get(installationId))?.visibility ===
                 "public",
@@ -600,7 +653,9 @@ export function createOyster(host) {
             return refusal(403, "Owner only");
         if (host.workbench === undefined)
             return refusal(404, "Not found");
+        startTime(context, "registry");
         let directory = await host.workbench.directory();
+        endTime(context, "registry");
         if (host.computerId !== undefined)
             directory = {
                 ...directory,
@@ -845,9 +900,11 @@ export function createOyster(host) {
     const enabled = async (context) => {
         const installationId = context.req.param("installationId") ?? "";
         const resolved = context.get("installation");
-        const installation = resolved?.installationId === installationId
-            ? resolved
-            : await host.installations.get(installationId);
+        if (resolved?.installationId === installationId)
+            return resolved.status === "enabled" ? resolved : null;
+        startTime(context, "registry");
+        const installation = await host.installations.get(installationId);
+        endTime(context, "registry");
         return installation?.status === "enabled" ? installation : null;
     };
     app.get("/apps/:installationId/", async (context) => {
@@ -858,6 +915,8 @@ export function createOyster(host) {
         const declaration = release.declaration;
         const principal = context.get("principal");
         const facts = await gateFacts(installation, release, principal);
+        if (principal.actor.kind === "team-key" && facts.access === null)
+            return refusal(403, "App access denied");
         const capabilities = [];
         for (const capability of host.capabilities ?? []) {
             const methods = Object.fromEntries(Object.entries(capability.methods).filter(([name, method]) => admits(facts, {
@@ -1115,7 +1174,10 @@ export function createOyster(host) {
         const installation = await enabled(context);
         if (installation === null)
             return refusal(404, "Not found");
-        return executeMethod(installation, await releaseOf(installation.release), context.get("principal"), context.req.param("name"), context.req.raw);
+        startTime(context, "method", "admission and Instance call");
+        const response = await executeMethod(installation, await releaseOf(installation.release), context.get("principal"), context.req.param("name"), context.req.raw);
+        endTime(context, "method");
+        return response;
     });
     app.post("/apps/:caller/calls/:appId/:method", async (context) => {
         const principal = context.get("principal");

package/dist/internal/host-gate.d.ts

@@ -5,10 +5,12 @@ import type { Installation } from "../apps/installation.js";
 import type { OysterHost, OysterPrincipal } from "../host.js";
 import { type ArtifactStore, type VerifiedRelease } from "../release.js";
 /**
- * Verify each Release once per process: a failed read is not cached, so the
- * next request reads it again. Installation verified every asset; serving
- * verifies each on read.
+ * Verify each Release once per owner (an isolate's HTTP host, or the
+ * Registry): a failed read is not cached, so the next request reads it again.
+ * Installation verified every asset; serving verifies each on read. A Release
+ * is content-addressed and immutable, so the key is its ID and root digest and
+ * a hit never goes stale; the bound only forgets the oldest-verified Releases.
  */
-export declare function releaseCache(artifacts: ArtifactStore): (release: Release) => Promise<VerifiedRelease>;
+export declare function releaseCache(artifacts: ArtifactStore, limit?: number): (release: Release) => Promise<VerifiedRelease>;
 /** The gate facts one principal presents to one installation. */
 export declare function hostGateFacts(host: OysterHost, installation: Installation, release: VerifiedRelease, principal: OysterPrincipal): Promise<GateFacts>;

package/dist/internal/host-gate.js

@@ -2,24 +2,31 @@ import { emptyAppDeclaration } from "@fungi.computer/puffball/app";
 import { deriveDeclaredOperations } from "../apps/operations.js";
 import { keyAppAccess } from "../keys.js";
 import { defaultAssetPolicy, verifyRelease, } from "../release.js";
+/** Verified Releases one cache keeps; the least recently added leaves first. */
+const releaseCacheLimit = 256;
 /**
- * Verify each Release once per process: a failed read is not cached, so the
- * next request reads it again. Installation verified every asset; serving
- * verifies each on read.
+ * Verify each Release once per owner (an isolate's HTTP host, or the
+ * Registry): a failed read is not cached, so the next request reads it again.
+ * Installation verified every asset; serving verifies each on read. A Release
+ * is content-addressed and immutable, so the key is its ID and root digest and
+ * a hit never goes stale; the bound only forgets the oldest-verified Releases.
  */
-export function releaseCache(artifacts) {
+export function releaseCache(artifacts, limit = releaseCacheLimit) {
     const verified = new Map();
     return (release) => {
         const key = `${release.releaseId}:${release.artifact.artifactDigest}`;
         let entry = verified.get(key);
         if (entry === undefined) {
-            // A failed read is not cached: the next request reads the Release again.
-            // Installation verified every asset; serving verifies each on read.
-            entry = verifyRelease(artifacts, release, defaultAssetPolicy, false).then((value) => value, (cause) => {
+            entry = verifyRelease(artifacts, release, defaultAssetPolicy, false).catch((cause) => {
                 verified.delete(key);
                 throw cause;
             });
             verified.set(key, entry);
+            for (const oldest of verified.keys()) {
+                if (verified.size <= limit)
+                    break;
+                verified.delete(oldest);
+            }
         }
         return entry;
     };

package/dist/invocation.d.ts

@@ -193,7 +193,7 @@ export declare function assertBackgroundBinding(frame: InvocationFrame<Backgroun
 export declare function admitBackgroundFrame(key: CryptoKey, frame: InvocationFrame<BackgroundFrameState>, raw: unknown): Promise<ClaimedJobAdmission>;
 /** The host's native guest-abort and authority-close hooks. */
 export type InvocationGatePorts<Host> = Readonly<{
-    /** Stop the guest when the captured invocation's authority closes. */
+    /** Stop the guest when live authority closes early (revocation, expiry). */
     abortGuest: () => Promise<void>;
     /** Release the host resources belonging to this completed or revoked frame. */
     close: (frame: InvocationFrame<Host>) => Promise<void>;
@@ -204,8 +204,8 @@ export type InvocationGatePorts<Host> = Readonly<{
 export type InvocationGate<Host> = Readonly<{
     /** Run work within one immutable frame and close its authority afterward. */
     run: <A>(facts: InvocationFacts, host: Host, work: (frame: InvocationFrame<Host>) => Promise<A>) => Promise<A>;
-    /** Resolve the sole admitted frame, refusing outside an active invocation. */
-    active: () => InvocationFrame<Host>;
+    /** Resolve one live frame by its id, refusing a closed or unknown frame. */
+    active: (frameId: string) => InvocationFrame<Host>;
     /** Close live authority, optionally restricted to frames of a selected run. */
     revoke: (reason?: Error, target?: Readonly<{
         runId: string;
@@ -215,7 +215,14 @@ export type InvocationGate<Host> = Readonly<{
 }>;
 /** Decode only identities minted from the invocation-frame ID family. */
 export declare const invocationFrameIdSchema: Schema.String;
-/** Serialize authority, preempt replay only for verified writes, and close each guest before admission. */
+/**
+ * Admit frames against one guest. Verified foreground reads share it, up to
+ * eight at once; writes, raw backend requests, Gills and replay run alone. Every guest binding packet names its frame, so a finished
+ * frame's leftover timers cannot borrow a later frame's authority and a
+ * normal finish keeps the guest warm. Closing authority early (revocation,
+ * expiry, a write preempting replay) aborts the guest and so every frame
+ * sharing it; replay only yields to a verified write.
+ */
 export declare function createInvocationGate<Host>(ports: InvocationGatePorts<Host>): InvocationGate<Host>;
 /** Verified selection, artifact and binding grants before caller attribution. */
 export type InvocationAuthority = Omit<InvocationFacts, "subject" | "deadlineAt">;