@fungi.computer/oyster 0.5.0 → 0.6.0

package/dist/invocation.js

@@ -1,8 +1,6 @@
 import { approvedBindingGrants } from "./apps/gate.js";
 import { appToolPolicySchema } from "./apps/tools.js";
-import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
-import * as Semaphore from "effect/Semaphore";
 import { defineIdFamily } from "@fungi.computer/cairn/id";
 import { sha256DigestSchema } from "@fungi.computer/puffball/effect";
 import { appBackendBindingKinds, appBackendBindingsSchema, appMethodCallContextSchema, } from "@fungi.computer/puffball/app";
@@ -116,6 +114,8 @@ export async function admitBackgroundFrame(key, frame, raw) {
     frame.host.origin = decision.kind;
     return decision;
 }
+/** Foreground reads one Instance runs at once; every other frame runs alone. */
+const concurrentReadFrames = 8;
 const frameIds = defineIdFamily({
     family: "app-invocation-frame",
     version: 1,
@@ -152,28 +152,79 @@ function immutableFacts(facts) {
     Object.freeze(facts.ancestry);
     return Object.freeze(facts);
 }
-/** Serialize authority, preempt replay only for verified writes, and close each guest before admission. */
+/**
+ * First-come permits over one guest: a waiting exclusive frame holds back
+ * every frame queued after it, so a stream of reads never starves a write.
+ */
+function orderedPermits(total) {
+    let available = total;
+    const waiting = [];
+    const admit = () => {
+        for (let next = waiting[0]; next !== undefined && next.permits <= available; next = waiting[0]) {
+            waiting.shift();
+            available -= next.permits;
+            next.enter();
+        }
+    };
+    return async (permits, work) => {
+        await new Promise((enter) => {
+            waiting.push({ permits, enter });
+            admit();
+        });
+        try {
+            return await work();
+        }
+        catch (cause) {
+            throw cause instanceof Error
+                ? cause
+                : new Error("App invocation failed", { cause });
+        }
+        finally {
+            available += permits;
+            admit();
+        }
+    };
+}
+/** A foreground call to a verified read method; only these share the guest. */
+function concurrentRead(facts) {
+    return (facts.subject.kind === "call" &&
+        facts.subject.replay === undefined &&
+        facts.subject.method?.effect === "read");
+}
+/**
+ * Admit frames against one guest. Verified foreground reads share it, up to
+ * eight at once; writes, raw backend requests, Gills and replay run alone. Every guest binding packet names its frame, so a finished
+ * frame's leftover timers cannot borrow a later frame's authority and a
+ * normal finish keeps the guest warm. Closing authority early (revocation,
+ * expiry, a write preempting replay) aborts the guest and so every frame
+ * sharing it; replay only yields to a verified write.
+ */
 export function createInvocationGate(ports) {
-    const permit = Semaphore.makeUnsafe(1);
+    const withPermits = orderedPermits(concurrentReadFrames);
     const now = ports.now ?? Date.now;
     let foregroundWaiting = 0;
-    let active;
-    const close = (state, reason) => {
+    const live = new Map();
+    const finish = (state, reason) => {
         if (state.closing)
             return state.closing;
-        if (active === state)
-            active = undefined;
+        live.delete(state.frame.frameId);
         state.controller.abort(reason);
-        state.closing = (async () => {
-            try {
-                await ports.abortGuest();
-            }
-            finally {
-                await ports.close(state.frame);
-            }
-        })();
+        state.closing = ports.close(state.frame);
         return state.closing;
     };
+    // The guest is shared: aborting it ends every live frame's guest work, and
+    // each of those frames closes only after the guest abort has completed.
+    const abortAll = (reason) => {
+        const states = [...live.values()];
+        for (const state of states) {
+            live.delete(state.frame.frameId);
+            state.controller.abort(reason);
+        }
+        const guest = ports.abortGuest();
+        for (const state of states)
+            state.closing ??= guest.finally(() => ports.close(state.frame));
+        return Promise.all([guest, ...states.map((state) => state.closing)]).then(() => undefined);
+    };
     const run = async (input, host, work) => {
         let facts;
         try {
@@ -196,64 +247,63 @@ export function createInvocationGate(ports) {
             if (queuedForeground &&
                 facts.subject.kind === "call" &&
                 facts.subject.method?.effect === "write" &&
-                active?.frame.facts.subject.kind === "call" &&
-                active.frame.facts.subject.replay !== undefined)
-                await close(active, new AppInstanceError("revoked"));
-            return await Effect.runPromise(permit.withPermits(1)(Effect.tryPromise({
-                try: async () => {
-                    if (facts.subject.kind === "call" &&
-                        facts.subject.replay !== undefined &&
-                        foregroundWaiting > 0)
-                        throw new AppInstanceError("revoked");
-                    if (queuedForeground) {
-                        foregroundWaiting -= 1;
-                        queuedForeground = false;
-                    }
-                    const { deadlineAt } = facts;
-                    if (deadlineAt <= now())
-                        throw new AppInstanceError("expired");
-                    const frameId = frameIds.frame.generate();
-                    const controller = new AbortController();
-                    const frame = Object.freeze({
-                        frameId,
-                        facts,
-                        host,
-                        signal: controller.signal,
+                [...live.values()].some(({ frame }) => frame.facts.subject.kind === "call" &&
+                    frame.facts.subject.replay !== undefined))
+                await abortAll(new AppInstanceError("revoked"));
+            return await withPermits(concurrentRead(facts) ? 1 : concurrentReadFrames, async () => {
+                if (facts.subject.kind === "call" &&
+                    facts.subject.replay !== undefined &&
+                    foregroundWaiting > 0)
+                    throw new AppInstanceError("revoked");
+                if (queuedForeground) {
+                    foregroundWaiting -= 1;
+                    queuedForeground = false;
+                }
+                const { deadlineAt } = facts;
+                if (deadlineAt <= now())
+                    throw new AppInstanceError("expired");
+                const frameId = frameIds.frame.generate();
+                const controller = new AbortController();
+                const frame = Object.freeze({
+                    frameId,
+                    facts,
+                    host,
+                    signal: controller.signal,
+                });
+                const state = { frame, controller };
+                live.set(frameId, state);
+                let timer;
+                let stop = () => undefined;
+                const revoked = new Promise((_resolve, reject) => {
+                    const onAbort = () => {
+                        const reason = controller.signal.reason;
+                        reject(reason instanceof Error
+                            ? reason
+                            : new AppInstanceError("revoked"));
+                    };
+                    controller.signal.addEventListener("abort", onAbort, {
+                        once: true,
                     });
-                    const state = { frame, controller };
-                    active = state;
-                    let timer;
-                    let stop = () => undefined;
-                    const revoked = new Promise((_resolve, reject) => {
-                        const onAbort = () => {
-                            const reason = controller.signal.reason;
-                            reject(reason instanceof Error
-                                ? reason
-                                : new AppInstanceError("revoked"));
-                        };
-                        controller.signal.addEventListener("abort", onAbort, {
-                            once: true,
-                        });
-                        stop = () => {
-                            controller.signal.removeEventListener("abort", onAbort);
-                        };
-                        timer = setTimeout(() => {
-                            controller.abort(new AppInstanceError("expired"));
-                        }, Math.max(0, deadlineAt - now()));
-                    });
-                    try {
-                        return await Promise.race([work(frame), revoked]);
-                    }
-                    finally {
-                        clearTimeout(timer);
-                        stop();
-                        await close(state, new AppInstanceError("revoked"));
-                    }
-                },
-                catch: (cause) => cause instanceof Error
-                    ? cause
-                    : new Error("App invocation failed", { cause }),
-            })));
+                    stop = () => {
+                        controller.signal.removeEventListener("abort", onAbort);
+                    };
+                    timer = setTimeout(() => {
+                        // An expired frame's guest may still be running. Each frame's own
+                        // run awaits its close, so a failure reaches that caller.
+                        void Promise.allSettled([
+                            abortAll(new AppInstanceError("expired")),
+                        ]);
+                    }, Math.max(0, deadlineAt - now()));
+                });
+                try {
+                    return await Promise.race([work(frame), revoked]);
+                }
+                finally {
+                    clearTimeout(timer);
+                    stop();
+                    await finish(state, new AppInstanceError("revoked"));
+                }
+            });
         }
         finally {
             if (queuedForeground)
@@ -262,27 +312,20 @@ export function createInvocationGate(ports) {
     };
     return {
         run,
-        exclusive: (work) => Effect.runPromise(permit.withPermits(1)(Effect.tryPromise({
-            try: work,
-            catch: (cause) => cause instanceof Error
-                ? cause
-                : new Error("Instance supervisor operation failed", { cause }),
-        }))),
-        active: () => {
-            if (active === undefined ||
-                active.controller.signal.aborted ||
-                active.frame.facts.deadlineAt <= now())
+        exclusive: (work) => withPermits(concurrentReadFrames, work),
+        active: (frameId) => {
+            const state = live.get(frameId);
+            if (state === undefined ||
+                state.controller.signal.aborted ||
+                state.frame.facts.deadlineAt <= now())
                 throw new AppInstanceError("revoked");
-            return active.frame;
+            return state.frame;
         },
         revoke: (reason = new AppInstanceError("revoked"), target) => {
-            if (active === undefined)
-                return Promise.resolve();
-            if (target !== undefined &&
-                (active.frame.facts.subject.kind !== "call" ||
-                    active.frame.facts.subject.context.workflow?.runId !== target.runId))
-                return Promise.resolve();
-            return close(active, reason);
+            const matched = [...live.values()].some(({ frame }) => target === undefined ||
+                (frame.facts.subject.kind === "call" &&
+                    frame.facts.subject.context.workflow?.runId === target.runId));
+            return matched ? abortAll(reason) : Promise.resolve();
         },
     };
 }

package/dist/page/capabilities.js

@@ -3,7 +3,7 @@ import { compile, parse, pathToRegexp } from "path-to-regexp";
 import * as Schema from "effect/Schema";
 import { AppError } from "@fungi.computer/agar";
 import { parseJsonValue } from "@fungi.computer/whistle/wire";
-import { computerTargetUrl } from "./computer-target.js";
+import { computerTargetUrl } from "../computer-target.js";
 const queryInput = Schema.Record(Schema.String, Schema.Union([Schema.String, Schema.Number, Schema.Boolean]));
 const capabilityInputSchema = Schema.Union([Schema.Json, Schema.Undefined]);
 function resolveRoute(path, input) {

package/dist/page/child-selection.d.ts

@@ -0,0 +1,27 @@
+/** The launch fields a window names; none of them is authority. */
+export type ChildLaunch = Readonly<{
+    appId: string;
+    releaseId: string;
+    surfaceId: string;
+    href: string;
+}>;
+/** The identity the App's own configuration route answers with. */
+export type ChildIdentity = Readonly<{
+    installationId: string;
+    appId: string;
+    releaseId: string;
+    computerId: string | null;
+}>;
+/**
+ * The installation page a launch names, or null when the address is not one.
+ * Only an `/apps/<installationId>/` page is ever asked for its configuration.
+ */
+export declare function childInstallationAddress(href: string, origin: string): URL | null;
+/**
+ * The launch still names what the host serves at its address: the same
+ * installation, App and Release, under the admitted Computer. The host's
+ * configuration read is the one fresh answer; no directory read precedes it.
+ */
+export declare function childMatchesLaunch(launch: ChildLaunch, pathname: string, config: ChildIdentity, computerTarget: string | undefined): boolean;
+/** Concurrent callers share the one read in flight; a settled read is never reused. */
+export declare function sharedRead<A>(read: () => Promise<A>): () => Promise<A>;

package/dist/page/child-selection.js

@@ -0,0 +1,38 @@
+import { addressKey } from "@fungi.computer/nacre/app-directory";
+const installationPath = /^\/apps\/[^/]+\/$/u;
+/**
+ * The installation page a launch names, or null when the address is not one.
+ * Only an `/apps/<installationId>/` page is ever asked for its configuration.
+ */
+export function childInstallationAddress(href, origin) {
+    const address = new URL(href, origin);
+    return address.origin === origin && installationPath.test(address.pathname)
+        ? address
+        : null;
+}
+/**
+ * The launch still names what the host serves at its address: the same
+ * installation, App and Release, under the admitted Computer. The host's
+ * configuration read is the one fresh answer; no directory read precedes it.
+ */
+export function childMatchesLaunch(launch, pathname, config, computerTarget) {
+    return (pathname === `/apps/${encodeURIComponent(config.installationId)}/` &&
+        launch.surfaceId ===
+            addressKey({
+                kind: "installation",
+                installationId: config.installationId,
+            }) &&
+        config.appId === launch.appId &&
+        config.releaseId === launch.releaseId &&
+        (computerTarget === undefined || config.computerId === computerTarget));
+}
+/** Concurrent callers share the one read in flight; a settled read is never reused. */
+export function sharedRead(read) {
+    let inFlight;
+    return () => {
+        inFlight ??= read().finally(() => {
+            inFlight = undefined;
+        });
+        return inFlight;
+    };
+}

package/dist/page/mount.js

@@ -9,7 +9,7 @@ import { RpcTarget, RpcStub } from "@fungi.computer/capnweb";
 import { EventSource } from "eventsource";
 import { connectBrowser, UiBrowserError, } from "@fungi.computer/knapsack/ui/browser";
 import { createPageLifetime } from "./lifetime.js";
-import { computerTargetUrl } from "./computer-target.js";
+import { computerTargetUrl } from "../computer-target.js";
 import * as Schema from "effect/Schema";
 import { AppError, createCapabilityRegistry, } from "@fungi.computer/agar";
 import { appStorage } from "@fungi.computer/agar/storage";