@fungi.computer/oyster 0.5.0 → 0.7.0

package/dist/channels/visitors.d.ts

@@ -0,0 +1,47 @@
+import { z } from "zod";
+import { type ConversationBinding } from "./binding.js";
+export type VisitorSql = Readonly<{
+    exec: (statement: string, ...bindings: (ArrayBuffer | string | number | null)[]) => Readonly<{
+        toArray: () => readonly unknown[];
+    }>;
+}>;
+/** Credentials handed to one anonymous visitor's iframe. */
+export type VisitorCredentials = Readonly<{
+    visitorId: string;
+    accessToken: string;
+    accessExpiresAt: number;
+    refreshSecret: string;
+}>;
+/** Closed mint/refresh result. */
+export type VisitorGrant = Readonly<{
+    kind: "granted";
+    credentials: VisitorCredentials;
+}> | Readonly<{
+    kind: "denied";
+    reason: "unmapped" | "suspended" | "new_party_limit" | "address_limit" | "refresh_invalid" | "refresh_reused";
+}>;
+/** Bearer grammar: `vt_` or `vr_` plus 43 base64url characters. */
+export declare const visitorBearerSchema: z.ZodString;
+/**
+ * Anonymous visitor identity for web bindings. A visitor principal
+ * names exactly one binding and one visitor, so it can reach exactly that
+ * visitor's one conversation Session and nothing else. Only token hashes are
+ * stored. Reusing a spent refresh secret revokes the whole family.
+ */
+export declare function createChannelVisitors(options: Readonly<{
+    sql: VisitorSql;
+    transactionSync: <T>(body: () => T) => T;
+    now: () => number;
+}>): {
+    ensure: () => void;
+    mint: (binding: ConversationBinding | null, siteKey: string, addressHash: string) => Promise<VisitorGrant>;
+    refresh: (binding: ConversationBinding | null, refreshSecret: string) => Promise<VisitorGrant>;
+    authenticate: (bindingId: string, accessToken: string) => Promise<Readonly<{
+        visitorId: string;
+        expiresAt: number;
+        addressHash: string;
+    }> | null>;
+    forget: (visitorId: string) => void;
+};
+/** Anonymous visitor identity owner. */
+export type ChannelVisitors = ReturnType<typeof createChannelVisitors>;

package/dist/channels/visitors.js

@@ -0,0 +1,181 @@
+import { z } from "zod";
+import { DEFAULT_BINDING_LIMITS } from "./binding.js";
+import { channelIds } from "./ids.js";
+/** Access tokens live one hour; refresh secrets seven days, rotated on use. */
+const VISITOR_ACCESS_MS = 3_600_000;
+const VISITOR_REFRESH_MS = 7 * 86_400_000;
+/**
+ * A visitor identity (one conversation) ends thirty days after it was
+ * minted however often it refreshes: no token outlives it.
+ */
+const VISITOR_LIFETIME_MS = 30 * 86_400_000;
+/** New visitors one network address may mint per hour on one binding. */
+const VISITORS_PER_ADDRESS_PER_HOUR = 10;
+const HOUR_MS = 3_600_000;
+/** Bearer grammar: `vt_` or `vr_` plus 43 base64url characters. */
+export const visitorBearerSchema = z
+    .string()
+    .regex(/^v[tr]_[A-Za-z0-9_-]{43}$/u);
+const tokenRow = z.strictObject({
+    visitor_id: z.string(),
+    family: z.string(),
+    kind: z.enum(["access", "refresh"]),
+    expires_at: z.number().int(),
+    used: z.number().int(),
+});
+const countRow = z.strictObject({ count: z.number().int() });
+function randomBearer(prefix) {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return (prefix +
+        btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, ""));
+}
+async function digest(value) {
+    const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return [...new Uint8Array(hash)]
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+/**
+ * Anonymous visitor identity for web bindings. A visitor principal
+ * names exactly one binding and one visitor, so it can reach exactly that
+ * visitor's one conversation Session and nothing else. Only token hashes are
+ * stored. Reusing a spent refresh secret revokes the whole family.
+ */
+export function createChannelVisitors(options) {
+    const { sql } = options;
+    const ensure = () => {
+        sql.exec(`CREATE TABLE IF NOT EXISTS hub_channel_visitors (
+      visitor_id TEXT PRIMARY KEY,
+      binding_id TEXT NOT NULL,
+      address_hash TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      revoked INTEGER NOT NULL DEFAULT 0
+    ) STRICT`);
+        sql.exec("CREATE INDEX IF NOT EXISTS hub_channel_visitors_binding ON hub_channel_visitors(binding_id, created_at)");
+        sql.exec(`CREATE TABLE IF NOT EXISTS hub_channel_visitor_tokens (
+      token_hash TEXT PRIMARY KEY,
+      visitor_id TEXT NOT NULL,
+      binding_id TEXT NOT NULL,
+      family TEXT NOT NULL,
+      kind TEXT NOT NULL CHECK (kind IN ('access','refresh')),
+      expires_at INTEGER NOT NULL,
+      used INTEGER NOT NULL DEFAULT 0
+    ) STRICT`);
+    };
+    const count = (statement, ...bindings) => countRow.parse(sql.exec(statement, ...bindings).toArray()[0]).count;
+    const issue = async (bindingId, visitorId, family, endsAt) => {
+        const accessToken = randomBearer("vt_");
+        const refreshSecret = randomBearer("vr_");
+        const now = options.now();
+        const accessExpiresAt = Math.min(now + VISITOR_ACCESS_MS, endsAt);
+        const [accessHash, refreshHash] = await Promise.all([
+            digest(accessToken),
+            digest(refreshSecret),
+        ]);
+        options.transactionSync(() => {
+            sql.exec("INSERT INTO hub_channel_visitor_tokens VALUES (?,?,?,?,'access',?,0)", accessHash, visitorId, bindingId, family, accessExpiresAt);
+            sql.exec("INSERT INTO hub_channel_visitor_tokens VALUES (?,?,?,?,'refresh',?,0)", refreshHash, visitorId, bindingId, family, Math.min(now + VISITOR_REFRESH_MS, endsAt));
+        });
+        return { visitorId, accessToken, accessExpiresAt, refreshSecret };
+    };
+    /** Mint a new anonymous visitor on one active web binding. */
+    const mint = async (binding, siteKey, addressHash) => {
+        ensure();
+        if (binding?.selector.provider !== "web" ||
+            binding.selector.siteKey !== siteKey)
+            return { kind: "denied", reason: "unmapped" };
+        if (binding.lifecycle !== "active")
+            return { kind: "denied", reason: "suspended" };
+        const limits = binding.limits ?? DEFAULT_BINDING_LIMITS;
+        const now = options.now();
+        const visitorId = channelIds.visitor.generate();
+        const admitted = options.transactionSync(() => {
+            if (count("SELECT COUNT(*) AS count FROM hub_channel_visitors WHERE binding_id=? AND created_at>?", binding.bindingId, now - HOUR_MS) >= limits.newPartiesPerHour)
+                return "new_party_limit";
+            if (count("SELECT COUNT(*) AS count FROM hub_channel_visitors WHERE binding_id=? AND address_hash=? AND created_at>?", binding.bindingId, addressHash, now - HOUR_MS) >= VISITORS_PER_ADDRESS_PER_HOUR)
+                return "address_limit";
+            sql.exec("INSERT INTO hub_channel_visitors (visitor_id,binding_id,address_hash,created_at) VALUES (?,?,?,?)", visitorId, binding.bindingId, addressHash, now);
+            return null;
+        });
+        if (admitted !== null)
+            return { kind: "denied", reason: admitted };
+        return {
+            kind: "granted",
+            credentials: await issue(binding.bindingId, visitorId, visitorId, now + VISITOR_LIFETIME_MS),
+        };
+    };
+    const lookup = async (bearer) => {
+        ensure();
+        const raw = sql
+            .exec("SELECT t.visitor_id,t.family,t.kind,t.expires_at,t.used FROM hub_channel_visitor_tokens t JOIN hub_channel_visitors v ON v.visitor_id=t.visitor_id WHERE t.token_hash=? AND v.revoked=0", await digest(bearer))
+            .toArray()[0];
+        return raw === undefined ? null : tokenRow.parse(raw);
+    };
+    /** Rotate a refresh secret; a reused one revokes the visitor's family. */
+    const refresh = async (binding, refreshSecret) => {
+        if (binding?.selector.provider !== "web")
+            return { kind: "denied", reason: "unmapped" };
+        if (binding.lifecycle !== "active")
+            return { kind: "denied", reason: "suspended" };
+        const hash = await digest(refreshSecret);
+        const row = await lookup(refreshSecret);
+        if (row?.kind !== "refresh" ||
+            row.expires_at <= options.now() ||
+            !sql
+                .exec("SELECT 1 FROM hub_channel_visitor_tokens WHERE token_hash=? AND binding_id=?", hash, binding.bindingId)
+                .toArray().length)
+            return { kind: "denied", reason: "refresh_invalid" };
+        const claimed = options.transactionSync(() => {
+            if (row.used !== 0) {
+                sql.exec("UPDATE hub_channel_visitors SET revoked=1 WHERE visitor_id=?", row.visitor_id);
+                return false;
+            }
+            sql.exec("UPDATE hub_channel_visitor_tokens SET used=1 WHERE token_hash=?", hash);
+            return true;
+        });
+        if (!claimed)
+            return { kind: "denied", reason: "refresh_reused" };
+        const created = z
+            .strictObject({ created_at: z.number().int() })
+            .parse(sql
+            .exec("SELECT created_at FROM hub_channel_visitors WHERE visitor_id=?", row.visitor_id)
+            .toArray()[0]).created_at;
+        const endsAt = created + VISITOR_LIFETIME_MS;
+        if (endsAt <= options.now())
+            return { kind: "denied", reason: "refresh_invalid" };
+        return {
+            kind: "granted",
+            credentials: await issue(binding.bindingId, row.visitor_id, row.family, endsAt),
+        };
+    };
+    /** The one visitor an access token names on this binding, or null. */
+    const authenticate = async (bindingId, accessToken) => {
+        const hash = await digest(accessToken);
+        const row = await lookup(accessToken);
+        if (row?.kind !== "access" || row.expires_at <= options.now())
+            return null;
+        const scoped = sql
+            .exec("SELECT v.address_hash FROM hub_channel_visitor_tokens t JOIN hub_channel_visitors v ON v.visitor_id=t.visitor_id WHERE t.token_hash=? AND t.binding_id=? AND v.revoked=0", hash, bindingId)
+            .toArray()[0];
+        if (scoped === undefined)
+            return null;
+        const address = z.strictObject({ address_hash: z.string() }).parse(scoped);
+        return {
+            visitorId: row.visitor_id,
+            expiresAt: row.expires_at,
+            addressHash: address.address_hash,
+        };
+    };
+    /** Revoke a swept visitor and drop its token hashes. */
+    const forget = (visitorId) => {
+        ensure();
+        options.transactionSync(() => {
+            sql.exec("UPDATE hub_channel_visitors SET revoked=1 WHERE visitor_id=?", visitorId);
+            sql.exec("DELETE FROM hub_channel_visitor_tokens WHERE visitor_id=?", visitorId);
+        });
+    };
+    return { ensure, mint, refresh, authenticate, forget };
+}

package/dist/cloudflare.d.ts

@@ -4,16 +4,23 @@ export type { BackgroundFrameState } from "./invocation.js";
 import { WorkerEntrypoint } from "cloudflare:workers";
 import { type GuestLimits } from "./guest-policy.js";
 export type { GuestLimits } from "./guest-policy.js";
-import type { ArtifactHeads, ArtifactStore, ArtifactStreams } from "./release.js";
+import type { ArtifactHeads, ArtifactStore, ArtifactStreams, VerifiedObjectCache } from "./release.js";
 import { type AppBackendBindingName } from "@fungi.computer/puffball/app";
 import { type InvocationFrame, type InvocationGate } from "./invocation.js";
 import * as Schema from "effect/Schema";
 import { z } from "zod";
+import type { ResourceRef } from "./apps/installation.js";
 import type { Release } from "@fungi.computer/puffball";
 import { type UiBootCheckOutcome } from "./boot-gate.js";
 export { checkBackendConstruction } from "./boot-construction.js";
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
 import { AppInstanceError, type AppInstance, type InstancePorts } from "./index.js";
+/**
+ * The zone's edge cache as a {@link VerifiedObjectCache}: each verified object
+ * under a digest-named key on `origin` that no route serves. A failed write is
+ * logged and answers `unstored`; the next reader verifies from the store again.
+ */
+export declare function edgeVerifiedObjectCache(cache: Pick<Cache, "match" | "put">, origin: string): VerifiedObjectCache;
 /** Store Release artifacts without loading the Worker ownership barrel. */
 export declare function r2ArtifactStore(bucket: R2Bucket): ArtifactStore & ArtifactHeads & ArtifactStreams;
 /** Encode supervisor refusals before native RPC can discard Error properties. */
@@ -33,6 +40,8 @@ export type FrameBindingMethod<Result> = Readonly<{
     decodeResult: z.ZodType<Result>["parse"];
     /** Determine the declared operations needed for these decoded arguments. */
     requiredOperations: (args: readonly unknown[]) => readonly string[];
+    /** Select a concrete host resource after decoding, before provider dispatch. */
+    requestedResource?: (args: readonly unknown[]) => ResourceRef;
 }>;
 /** Method descriptors for the closed App binding vocabulary. */
 export type FrameBindingMethods<Result> = Readonly<Partial<Record<AppBackendBindingName, Readonly<Record<string, FrameBindingMethod<Result>>>>>>;
@@ -113,7 +122,7 @@ export type AppInstanceLoader<FacetClass> = Readonly<{
         getDurableObjectClass: (exportName: string) => FacetClass;
     }>;
 }>;
-/** End the native App facet before shared frame admission releases its permit. */
+/** Stop the shared native App facet at cohort drain or revocation. */
 export declare function createCloudflareInvocationGate<Host, FacetClass>(ctx: Pick<AppInstanceContext<FacetClass>, "facets">, close: (frame: InvocationFrame<Host>) => Promise<void>): InvocationGate<Host>;
 /**
  * Run an App Instance inside a SQLite-backed Durable Object on workerd, celld

package/dist/cloudflare.js

@@ -20,6 +20,32 @@ import { BootGateError } from "./boot-gate.js";
 export { checkBackendConstruction } from "./boot-construction.js";
 import { createAppInstance, AppInstanceError, instanceIdSchema, instanceSchema, appInstanceErrorCodeSchema, } from "./index.js";
 const bindingWire = createFrameBindingWire(appInstanceErrorCodeSchema.literals);
+/**
+ * The zone's edge cache as a {@link VerifiedObjectCache}: each verified object
+ * under a digest-named key on `origin` that no route serves. A failed write is
+ * logged and answers `unstored`; the next reader verifies from the store again.
+ */
+export function edgeVerifiedObjectCache(cache, origin) {
+    const key = (digest) => new Request(new URL(`/_oyster/verified/${digest}`, origin));
+    return {
+        match: async (digest) => (await cache.match(key(digest)))?.body ?? null,
+        put: async (digest, bytes) => {
+            try {
+                await cache.put(key(digest), new Response(new Uint8Array(bytes), {
+                    headers: { "Cache-Control": "public, max-age=31536000, immutable" },
+                }));
+                return "stored";
+            }
+            catch (cause) {
+                console.error("Verified object cache write failed", {
+                    digest,
+                    failure: cause instanceof Error ? cause.name : "non-error rejection",
+                });
+                return "unstored";
+            }
+        },
+    };
+}
 /** Store Release artifacts without loading the Worker ownership barrel. */
 export function r2ArtifactStore(bucket) {
     const abortError = (signal) => {
@@ -241,7 +267,7 @@ const facetInvocationSchema = rpcHandleSchema({
     invoke: rpcMethod(z.union([z.json(), z.undefined()])).input(z.tuple([z.string(), z.array(z.unknown()), z.unknown()])),
     http: rpcMethod(facetHttpReplySchema).input(z.tuple([facetHttpInputSchema, z.unknown()])),
 });
-/** End the native App facet before shared frame admission releases its permit. */
+/** Stop the shared native App facet at cohort drain or revocation. */
 export function createCloudflareInvocationGate(ctx, close) {
     return createInvocationGate({
         abortGuest: () => {

package/dist/{page/computer-target.d.ts → computer-target.d.ts}

@@ -1,3 +1,5 @@
+/** The query parameter that carries a window's Computer routing hint. */
+export declare const computerTargetParam = "computerId";
 /** Serialize a window's routing hint. The server must admit it through the live
  * owner and fleet before constructing that request's workspace. */
 export declare function computerTargetUrl(path: string, computerId?: string): string;

package/dist/{page/computer-target.js → computer-target.js}

@@ -1,9 +1,11 @@
+/** The query parameter that carries a window's Computer routing hint. */
+export const computerTargetParam = "computerId";
 /** Serialize a window's routing hint. The server must admit it through the live
  * owner and fleet before constructing that request's workspace. */
 export function computerTargetUrl(path, computerId) {
     if (computerId === undefined)
         return path;
     const url = new URL(path, "https://oyster.invalid");
-    url.searchParams.set("computerId", computerId);
+    url.searchParams.set(computerTargetParam, computerId);
     return url.pathname + url.search;
 }

package/dist/files.js

@@ -6,7 +6,7 @@
  * the Oyster's workspace unchanged. Other sources (a git repository) implement
  * the same `FileSource`.
  */
-import { Hono } from "hono";
+import { computer, routes } from "./authorization.js";
 import * as Schema from "effect/Schema";
 import { computerList, computerReadFile, computerWriteFile, } from "@fungi.computer/agar/computer";
 const MAX_FILE_BYTES = 25 * 1024 * 1024;
@@ -66,10 +66,11 @@ export function fileCapabilities(source) {
         },
     ];
 }
+/** The workspace is the Computer's: a key needs `computer.use` (see `authorization.ts`). */
 function createFileRoutes(source) {
-    const routes = new Hono();
+    const table = routes();
     const pathOf = (raw) => normalizeFilePath(raw ?? "");
-    routes.get("/list", async (context) => {
+    table.get("/list", computer(), async (context) => {
         const path = pathOf(context.req.query("path"));
         if (path === null)
             return refusal(400, "Invalid path");
@@ -80,7 +81,7 @@ function createFileRoutes(source) {
             ? refusal(404, "No such directory")
             : Response.json(listing);
     });
-    routes.get("/content", async (context) => {
+    table.get("/content", computer(), async (context) => {
         const path = pathOf(context.req.query("path"));
         if (path === null)
             return refusal(400, "Invalid path");
@@ -91,7 +92,7 @@ function createFileRoutes(source) {
                 headers: { "Content-Type": "application/octet-stream" },
             });
     });
-    routes.put("/content", async (context) => {
+    table.put("/content", computer(), async (context) => {
         const path = pathOf(context.req.query("path"));
         if (path === null || path === "/")
             return refusal(400, "Invalid path");
@@ -104,7 +105,7 @@ function createFileRoutes(source) {
         await source.write(path, bytes);
         return new Response(null, { status: 204 });
     });
-    routes.post("/mkdir", async (context) => {
+    table.post("/mkdir", computer(), async (context) => {
         const body = Schema.decodeUnknownOption(mkdirSchema)(await context.req.json());
         const path = body._tag === "Some" ? normalizeFilePath(body.value.path) : null;
         if (path === null || path === "/")
@@ -112,12 +113,12 @@ function createFileRoutes(source) {
         await source.mkdir(path);
         return new Response(null, { status: 204 });
     });
-    routes.post("/replace", async (context) => {
+    table.post("/replace", computer(), async (context) => {
         const body = Schema.decodeUnknownOption(replaceSchema)(await context.req.json());
         const path = body._tag === "Some" ? normalizeFilePath(body.value.path) : null;
         if (body._tag === "None" || path === null)
             return refusal(400, "Invalid request");
         return Response.json(await source.replace(path, body.value.expectedContent, body.value.content));
     });
-    return routes;
+    return table;
 }

package/dist/git-admission.d.ts

@@ -5,10 +5,10 @@ import type { AppDeclaration } from "@fungi.computer/puffball/app";
 import type { Installation } from "./apps/installation.js";
 /** Installation-scoped storage; transport and credentials stay with its provider adapter. */
 export type GitStore = GitBinding;
-/** Live host authority, reopened before every provider call. Null is an anonymous reader. */
+/** Live host authority, reopened before every provider call. */
 export type GitGrants = Readonly<{
     /** Reopen the host authority for this repository and requested scope. */
-    admits(writer: GitWriter | null, repository: string, scope: "read" | "write"): Promise<boolean>;
+    admits(writer: GitWriter, repository: string, scope: "read" | "write"): Promise<boolean>;
 }>;
 /** Reuse the live installation/verified Release rule without opening provider storage. */
 export declare function createInstallationGitAdmission(ports: Readonly<{
@@ -36,7 +36,7 @@ export type AdmittedGit = Readonly<{
     /** Recheck host read authority before exchanging provider bytes. */
     read(writer: Extract<GitWriter, {
         kind: "actor";
-    }> | null, repository: string, request: GitExchangeRequest): Promise<GitExchangeResponse>;
+    }>, repository: string, request: GitExchangeRequest): Promise<GitExchangeResponse>;
     /** Bind installation-authored operations; null attribution is lifecycle-only. */
     binding(onBehalfOf: HostActor | null): GitBinding;
 }>;

package/dist/git-admission.js

@@ -5,13 +5,12 @@ import { acceptedRefs, parseReceivePack, refusalReport, } from "@fungi.computer/
 import { defineIdFamily } from "@fungi.computer/cairn/id";
 /** Reuse the live installation/verified Release rule without opening provider storage. */
 export function createInstallationGitAdmission(ports) {
-    return async (writer) => {
+    return async () => {
         const current = await ports.currentInstallation();
         if (current === null)
             return false;
         const declaration = await ports.declaration(current);
-        return (declaration?.capabilities.includes("git.repository") === true &&
-            (writer !== null || current.visibility === "public"));
+        return declaration?.capabilities.includes("git.repository") === true;
     };
 }
 const ids = defineIdFamily({
@@ -26,9 +25,8 @@ export function createAdmittedGit(ports) {
     const { store, grants, policy, journal } = ports;
     async function admit(writer, repository, scope) {
         gitRepositoryNameSchema.parse(repository);
-        if (writer !== null)
-            gitWriterSchema.parse(writer);
-        if (writer?.kind === "installation" &&
+        gitWriterSchema.parse(writer);
+        if (writer.kind === "installation" &&
             writer.installationId !== ports.installationId)
             throw new Error("Git installation authority mismatch");
         if (!(await grants.admits(writer, repository, scope)))

package/dist/git-door.d.ts

@@ -1,5 +1,3 @@
-/** Smart-HTTP routing; all writes enter the same admitted Git path. */
-import { Hono } from "hono";
 import type { GitWriter } from "@fungi.computer/agar/git";
 import type { AdmittedGit } from "./git-admission.js";
 /** The repository and access one smart-HTTP request names. */
@@ -11,12 +9,10 @@ export type GitDoorTarget = Readonly<{
 /** Identity and selected installation come only from host-held ports. */
 export type GitDoorHost = Readonly<{
     /** Resolve a host-authenticated actor for this exact repository and scope;
-     * null means an anonymous request. */
+     * null refuses the request. */
     authenticate(request: Request, target: GitDoorTarget): Promise<Extract<GitWriter, {
         kind: "actor";
     }> | null>;
-    /** Decide whether anonymous reads may reach the selected installation. */
-    isPublic(installationId: string): Promise<boolean>;
     /** Resolve the installation's admitted path without exposing provider credentials. */
     git(installationId: string): Promise<AdmittedGit | null>;
 }>;
@@ -31,5 +27,10 @@ export declare function smartHttpExchange(method: string, url: URL, suffix: stri
 export declare function gitDoorRoute(method: string, url: URL): (GitDoorTarget & Readonly<{
     advertise: boolean;
 }>) | null;
-/** Mount one smart-HTTP door with no provider credentials or alternate write branch. */
-export declare function createGitDoor(host: GitDoorHost): Hono;
+/** One smart-HTTP exchange's answer; the host declares the route it serves at. */
+export type GitDoor = Readonly<{
+    /** Answer one smart-HTTP request at `/git/...`; anything else is 404. */
+    fetch: (request: Request) => Promise<Response>;
+}>;
+/** One smart-HTTP door with no provider credentials or alternate write branch. */
+export declare function createGitDoor(host: GitDoorHost): GitDoor;

package/dist/git-door.js

@@ -1,5 +1,4 @@
 /** Smart-HTTP routing; all writes enter the same admitted Git path. */
-import { Hono } from "hono";
 import { z } from "zod";
 const route = /^\/git\/([a-zA-Z0-9_-]{1,256})\/([a-zA-Z0-9._-]{1,128}?)(?:\.git)?\/(info\/refs|git-upload-pack|git-receive-pack)$/u;
 /** One smart-HTTP exchange: the method, `service` query and path suffix a
@@ -59,34 +58,37 @@ async function bodyOf(request) {
     }
     return body;
 }
-/** Mount one smart-HTTP door with no provider credentials or alternate write branch. */
+const text = (body, status) => new Response(body, {
+    status,
+    headers: { "Content-Type": "text/plain; charset=UTF-8" },
+});
+/** One smart-HTTP door with no provider credentials or alternate write branch. */
 export function createGitDoor(host) {
-    const door = new Hono();
-    const smartHttp = async (context) => {
-        const routed = gitDoorRoute(context.req.method, new URL(context.req.url));
+    const smartHttp = async (incoming) => {
+        const routed = gitDoorRoute(incoming.method, new URL(incoming.url));
         if (routed === null)
-            return context.text("Not a git route", 404);
+            return text("Not a git route", 404);
         const { advertise, ...target } = routed;
         const { installationId, repository } = target;
         const writing = target.scope === "write";
-        const writer = await host.authenticate(context.req.raw, target);
-        if (writer === null && (writing || !(await host.isPublic(installationId))))
+        const writer = await host.authenticate(incoming, target);
+        if (writer === null)
             return new Response("A key is required", {
                 status: 401,
                 headers: { "WWW-Authenticate": 'Basic realm="Oyster git"' },
             });
         const git = await host.git(installationId);
         if (git === null)
-            return context.text("Installation Git unavailable", 403);
-        if (context.req.header("content-encoding") !== undefined)
-            return context.text("Compressed Git requests are not supported", 400);
-        const body = advertise ? null : await bodyOf(context.req.raw);
+            return text("Installation Git unavailable", 403);
+        if (incoming.headers.get("content-encoding") !== null)
+            return text("Compressed Git requests are not supported", 400);
+        const body = advertise ? null : await bodyOf(incoming);
         if (body instanceof Response)
             return body;
         const headers = {};
         for (const name of ["content-type", "accept", "git-protocol"]) {
-            const value = context.req.header(name);
-            if (value !== undefined)
+            const value = incoming.headers.get(name);
+            if (value !== null)
                 headers[name] = value;
         }
         const request = {
@@ -95,7 +97,7 @@ export function createGitDoor(host) {
             headers,
             body,
         };
-        const response = writing && writer !== null
+        const response = writing
             ? await git.push(writer, repository, request)
             : await git.read(writer, repository, request);
         return new Response(new Uint8Array(response.body), {
@@ -103,6 +105,5 @@ export function createGitDoor(host) {
             headers: response.headers,
         });
     };
-    door.all("/git/*", smartHttp);
-    return door;
+    return { fetch: smartHttp };
 }

package/dist/git.d.ts

@@ -23,7 +23,7 @@ export declare function signStandardWebhook(secret: string, id: string, timestam
 /** Headers for one signed delivery: Standard Webhooks plus `X-Hub-Signature-256`. */
 export declare function webhookHeaders(secret: string, id: string, type: string, timestamp: number, body: string): Promise<Record<string, string>>;
 export { createGitDoor, gitDoorRoute, smartHttpExchange } from "./git-door.js";
-export type { GitDoorHost, GitDoorTarget } from "./git-door.js";
+export type { GitDoor, GitDoorHost, GitDoorTarget } from "./git-door.js";
 export { createAdmittedGit, createInstallationGitAdmission, } from "./git-admission.js";
 export type { AdmittedGit, GitStore, GitGrants, GitPolicy, GitJournal, } from "./git-admission.js";
 export { createGitPushJournal } from "./git-journal.js";