@fungi.computer/oyster 0.5.0 → 0.7.0

package/docs/api/cloudflare.md

@@ -31,6 +31,7 @@ type FrameBindingMethod<Result> = Readonly<{
   decodeArgs: (raw) => readonly unknown[];
   decodeResult: z.ZodType<Result>["parse"];
   requiredOperations: (args) => readonly string[];
+  requestedResource?: (args) => ResourceRef;
 }>;
 ```
 
@@ -305,6 +306,30 @@ frame or guestEnv factory is accepted.
 
 ---
 
+### edgeVerifiedObjectCache()
+
+```ts
+function edgeVerifiedObjectCache(cache, origin): VerifiedObjectCache;
+```
+
+The zone's edge cache as a [VerifiedObjectCache](host.md#verifiedobjectcache):
+each verified object under a digest-named key on `origin` that no route serves.
+A failed write is logged and answers `unstored`; the next reader verifies from
+the store again.
+
+#### Parameters
+
+| Parameter | Type                                    |
+| --------- | --------------------------------------- |
+| `cache`   | `Pick`\<`Cache`, `"match"` \| `"put"`\> |
+| `origin`  | `string`                                |
+
+#### Returns
+
+[`VerifiedObjectCache`](host.md#verifiedobjectcache)
+
+---
+
 ### r2ArtifactStore()
 
 ```ts
@@ -435,7 +460,7 @@ function createCloudflareInvocationGate<Host, FacetClass>(
 ): InvocationGate<Host>;
 ```
 
-End the native App facet before shared frame admission releases its permit.
+Stop the shared native App facet at cohort drain or revocation.
 
 #### Type Parameters
 
@@ -492,7 +517,7 @@ Guest code gets only host gatekeeper bindings and no ambient outbound access.
 | `loader`   | \| `Readonly`\<\{ `get`: (`id`, `configure`) => `Readonly`\<\{ `getDurableObjectClass`: (`exportName`) => `FacetClass`; \}\>; \}\> \| `undefined`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | The Worker Loader binding; without it backend execution is unavailable.                                                       |
 | `resolve`  | (`release`, `scope`) => `Effect`\<`Readonly`\<\{ `release`: `Release`; `digest`: `Sha256Digest`; `backend`: `DurableBackend`; \}\>, `Error`\>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | Resolves a Release ID to its verified durable backend.                                                                        |
 | `guestEnv` | (`frame`) => `object`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | Mints loopbacks bound to the captured invocation frame.                                                                       |
-| `bootUi`   | (`release`) => `Promise`\< \| \{ `kind`: `"passed"`; \} \| \{ `kind`: `"failed"`; `code`: `"ui_mount_failed"`; `diagnostics?`: \{ `failedPredicate`: \| `"unexpected_candidate_request"` \| `"response_status"` \| `"request_failed"` \| `"page_error"` \| `"candidate_not_mounted"`; `errorName?`: \| `"TypeError"` \| `"RangeError"` \| `"SyntaxError"` \| `"AbortError"` \| `"TimeoutError"` \| `"Other"` \| `"Error"`; `finalUrlPath`: `string`; `consoleErrors`: `string`[]; `pageErrors`: `string`[]; `failedRequests`: `object`[]; `droppedCount`: `number`; \}; \} \| \{ `kind`: `"not_checked"`; `code`: \| `"boot_runner_unavailable"` \| `"boot_browser_binding_missing"` \| `"boot_clone_unavailable"` \| `"boot_timeout"` \| `"boot_cleanup_failed"` \| `"ui_check_not_run_on_host"`; \} \| `null`\> | Host-owned UI check, or `null` when this executor deliberately skips it (for example, after the signed host already checked). |
+| `bootUi`   | (`release`) => `Promise`\< \| \{ `kind`: `"passed"`; \} \| \{ `kind`: `"failed"`; `code`: `"ui_mount_failed"`; `diagnostics?`: \{ `failedPredicate`: \| `"unexpected_candidate_request"` \| `"response_status"` \| `"request_failed"` \| `"page_error"` \| `"candidate_not_mounted"`; `errorName?`: \| `"Error"` \| `"TypeError"` \| `"RangeError"` \| `"SyntaxError"` \| `"AbortError"` \| `"TimeoutError"` \| `"Other"`; `finalUrlPath`: `string`; `consoleErrors`: `string`[]; `pageErrors`: `string`[]; `failedRequests`: `object`[]; `droppedCount`: `number`; \}; \} \| \{ `kind`: `"not_checked"`; `code`: \| `"boot_runner_unavailable"` \| `"boot_browser_binding_missing"` \| `"boot_clone_unavailable"` \| `"boot_timeout"` \| `"boot_cleanup_failed"` \| `"ui_check_not_run_on_host"`; \} \| `null`\> | Host-owned UI check, or `null` when this executor deliberately skips it (for example, after the signed host already checked). |
 | `limits?`  | `Partial`\<`Readonly`\<\{ `cpuMs`: `number`; `subRequests`: `number`; \}\>\>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Guest CPU and subrequest budgets; omitted fields use safe defaults.                                                           |
 | `onAbort?` | (`reason`) => `Promise`\<`void`\>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Close the host's existing invocation frame after its state is fenced.                                                         |
 

package/docs/api/git.md

@@ -29,8 +29,7 @@ type GitGrants = Readonly<{
 }>;
 ```
 
-Live host authority, reopened before every provider call. Null is an anonymous
-reader.
+Live host authority, reopened before every provider call.
 
 ---
 
@@ -129,7 +128,6 @@ type GitDoorHost = Readonly<{
      workflow?: WorkflowAttestation & object;
    }>
     | null>;
-  isPublic: Promise<boolean>;
   git: Promise<
      | Readonly<{
      push: Promise<Readonly<{
@@ -152,6 +150,18 @@ Identity and selected installation come only from host-held ports.
 
 ---
 
+### GitDoor
+
+```ts
+type GitDoor = Readonly<{
+  fetch: (request) => Promise<Response>;
+}>;
+```
+
+One smart-HTTP exchange's answer; the host declares the route it serves at.
+
+---
+
 ### GitPushJournalPorts
 
 ```ts
@@ -207,9 +217,9 @@ storage.
 
 #### Parameters
 
-| Parameter | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `ports`   | `Readonly`\<\{ `currentInstallation`: `Promise`\< \| `Readonly`\<\{ `installationId`: `string`; `instanceId`: [`InstanceId`](index.md#instanceid) \| `null`; `appId`: `AppId`; `release`: \{ `releaseId`: `Schema.refine`\<`ReleaseId`, `Schema.String`\>; `appId`: `Schema.refine`\<`AppId`, `Schema.String`\>; `artifact`: `Schema.Struct`\<\{ `artifactRef`: `Schema.refine`\<`ArtifactRef`, `Schema.String`\>; `artifactDigest`: `Schema.refine`\<`Sha256Digest`, `Schema.String`\>; `provenance`: `Schema.Struct`\<\{ `sourceRevision`: ...; `sourceTreeDigest`: ...; `buildRecipeDigest`: ...; \}\>; \}\>; \}; `releasePin`: `"pinned"` \| `"floating"`; `authority`: \{ `authorityVersion`: `number`; `declaredOperationsDigest`: `Sha256Digest`; `approvedGrants`: readonly `Readonly`\<\{ `capability`: \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ...; `capabilityApproved`: `true`; `operations`: readonly ...[]; `resources`: ... \| ...; \}\>[]; `approval`: \| `Readonly`\<\{ `by`: ... \| ... \| ...; `at`: `number`; `authorityVersion`: `number`; \}\> \| `null`; \}; `status`: `"enabled"` \| `"disabled"` \| `"deleted"`; `visibility`: `"private"` \| `"public"`; `approvedAnonymousMethods`: readonly `Readonly`\<\{ `name`: `string`; `digest`: `Sha256Digest`; \}\>[]; `anonymousApproval`: \| `Readonly`\<\{ `by`: \| \{ `kind`: ...; `memberId`: ...; \} \| \{ `kind`: ...; `agentId`: ...; \} \| \{ `kind`: ...; `keyId`: ...; \}; `at`: `number`; `authorityVersion`: `number`; \}\> \| `null`; \}\> \| `null`\>; `declaration`: `Promise`\< \| `Readonly`\<\{ `api?`: `AppApi`; `displayName?`: `string`; `capabilities`: readonly `AppCapabilityId`[]; `calls?`: readonly `Readonly`\<\{ `appId`: ...; `methods`: ...; \}\>[]; `guidance?`: `string`; `handlers`: readonly `AppHandler`[]; `receives?`: readonly `"git.push"`[]; `icon?`: `string`; `roles`: readonly `AppRole`[]; `storage?`: readonly `AppStorageKey`[]; `commands?`: readonly `AppDeclaredCommand`[]; `gills?`: readonly `AppDeclaredGill`[]; `backend?`: `Readonly`\<\{ `bindings`: readonly ...[]; `sync?`: `Readonly`\<\{ `method`: ...; \}\>; \}\>; \}\> \| `null`\>; \}\> |
+| Parameter | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `ports`   | `Readonly`\<\{ `currentInstallation`: `Promise`\< \| `Readonly`\<\{ `installationId`: `string`; `instanceId`: [`InstanceId`](index.md#instanceid) \| `null`; `appId`: `AppId`; `release`: \{ `releaseId`: `Schema.refine`\<`ReleaseId`, `Schema.String`\>; `appId`: `Schema.refine`\<`AppId`, `Schema.String`\>; `artifact`: `Schema.Struct`\<\{ `artifactRef`: `Schema.refine`\<`ArtifactRef`, `Schema.String`\>; `artifactDigest`: `Schema.refine`\<`Sha256Digest`, `Schema.String`\>; `provenance`: `Schema.Struct`\<\{ `sourceRevision`: ...; `sourceTreeDigest`: ...; `buildRecipeDigest`: ...; \}\>; \}\>; \}; `releasePin`: `"pinned"` \| `"floating"`; `authority`: \{ `authorityVersion`: `number`; `declaredOperationsDigest`: `Sha256Digest`; `approvedGrants`: readonly `Readonly`\<\{ `capability`: \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ... \| ...; `capabilityApproved`: `true`; `operations`: readonly ...[]; `resources`: ... \| ...; \}\>[]; `approval`: \| `Readonly`\<\{ `by`: ... \| ... \| ...; `at`: `number`; `authorityVersion`: `number`; \}\> \| `null`; \}; `status`: `"enabled"` \| `"disabled"` \| `"deleted"`; \}\> \| `null`\>; `declaration`: `Promise`\< \| `Readonly`\<\{ `api?`: `AppApi`; `displayName?`: `string`; `capabilities`: readonly `AppCapabilityId`[]; `calls?`: readonly `Readonly`\<\{ `appId`: ...; `methods`: ...; \}\>[]; `guidance?`: `string`; `handlers`: readonly `AppHandler`[]; `receives?`: readonly `"git.push"`[]; `icon?`: `string`; `roles`: readonly `AppRole`[]; `storage?`: readonly `AppStorageKey`[]; `commands?`: readonly `AppDeclaredCommand`[]; `gills?`: readonly `AppDeclaredGill`[]; `backend?`: `Readonly`\<\{ `bindings`: readonly ...[]; `sync?`: `Readonly`\<\{ `method`: ...; \}\>; \}\>; \}\> \| `null`\>; \}\> |
 
 #### Returns
 
@@ -227,7 +237,7 @@ Reopen the host authority for this repository and requested scope.
 
 | Parameter    | Type                  |
 | ------------ | --------------------- |
-| `writer`     | `GitWriter` \| `null` |
+| `writer`     | `GitWriter`           |
 | `repository` | `string`              |
 | `scope`      | `"read"` \| `"write"` |
 
@@ -328,11 +338,10 @@ null when it is not an exact Oyster Git exchange.
 ### createGitDoor()
 
 ```ts
-function createGitDoor(host): Hono;
+function createGitDoor(host): GitDoor;
 ```
 
-Mount one smart-HTTP door with no provider credentials or alternate write
-branch.
+One smart-HTTP door with no provider credentials or alternate write branch.
 
 #### Parameters
 
@@ -342,7 +351,7 @@ branch.
 
 #### Returns
 
-`Hono`
+[`GitDoor`](#gitdoor)
 
 ---
 

package/docs/api/host.md

@@ -98,32 +98,6 @@ A page descriptor carries routing, never the authority to use a capability.
 
 ---
 
-### OysterVisitor
-
-```ts
-type OysterVisitor = Readonly<{
-  actor: Readonly<{
-    kind: "visitor";
-  }>;
-}>;
-```
-
-The anonymous reader of a public installation. The host admits it only when
-authentication refuses; it reaches that App's page and its `read` methods.
-
----
-
-### OysterPrincipal
-
-```ts
-type OysterPrincipal = TenantPrincipal | OysterVisitor;
-```
-
-Who an admitted request acts for: an authenticated tenant principal or the
-visitor.
-
----
-
 ### OysterAuthResult
 
 ```ts
@@ -181,6 +155,7 @@ type InstallationStore = InstallationReader &
   Readonly<{
     operations?: InstallationOperations;
     generation: () => Promise<string>;
+    resetAt?: () => Promise<number | null>;
     compareAndPut: (
       installation,
       expectedAuthorityVersion,
@@ -372,44 +347,21 @@ A capability adapter whose routes require live installation admission.
 
 ---
 
-### OysterVariables
-
-```ts
-type OysterVariables = object;
-```
-
-What the host stamps once per request; inner routes read it with `c.get`.
-
-#### Properties
-
-##### principal
-
-```ts
-principal: OysterPrincipal;
-```
-
-##### installation?
-
-```ts
-optional installation?: Installation;
-```
-
----
-
 ### OysterEnv
 
 ```ts
 type OysterEnv = object;
 ```
 
-Owner routes run after the host's owner guard and read `c.get("principal")`.
+The host table's Hono env; every route receives its principal from its declared
+requirement.
 
 #### Properties
 
 ##### Variables
 
 ```ts
-Variables: OysterVariables;
+Variables: TimingVariables;
 ```
 
 ---
@@ -470,9 +422,11 @@ type OysterHost = Readonly<{
    }
     | null>;
   computerControl?: (principal) => ComputerControlPort | null;
+  permissionResources?: (principal) => Promise<readonly ResourceOption[]>;
   auth: OysterAuth;
   backgroundOriginKey?: () => Promise<CryptoKey>;
   artifacts: ArtifactStore;
+  uiCache?: VerifiedObjectCache;
   installations: InstallationStore;
   instances: InstanceDirectory;
   bootUi: (release) => Promise<UiBootCheckOutcome>;
@@ -495,7 +449,7 @@ type OysterHost = Readonly<{
   guestLimits?: Partial<GuestLimits>;
   mcp?: OysterMcp;
   git?: OysterGitHost;
-  ownerRoutes?: Hono<OysterEnv>;
+  ownerRoutes?: Routes<OysterEnv>;
   capabilities?: readonly OysterCapability[];
   workbench?: Readonly<{
      directory: Promise<Readonly<{
@@ -514,7 +468,6 @@ type OysterHost = Readonly<{
   pageScript?: string;
   pageAssets?: () => Promise<{
      pageScript: string;
-     publicHomeScript: string;
      fontStyles: string;
      loginFontStyles: string;
      shellStyles: string;
@@ -528,6 +481,19 @@ Everything a host supplies to run Oyster.
 
 ---
 
+### OysterRouteTable
+
+```ts
+type OysterRouteTable = Readonly<{
+  declarations: () => readonly RouteDeclaration[];
+  serve: () => ServedTable<OysterEnv>;
+}>;
+```
+
+One host's declared routes and the one way to serve them.
+
+---
+
 ### InstallationOperations
 
 ```ts
@@ -611,13 +577,13 @@ type InstallationOperations = Readonly<{
               | "request_failed"
               | "page_error"
               | "candidate_not_mounted";
-           errorName?:   | "TypeError"
+           errorName?:   | "Error"
+              | "TypeError"
               | "RangeError"
               | "SyntaxError"
               | "AbortError"
               | "TimeoutError"
-              | "Other"
-              | "Error";
+              | "Other";
            finalUrlPath: string;
            consoleErrors: string[];
            pageErrors: string[];
@@ -666,17 +632,6 @@ type InstallationOperations = Readonly<{
               | null;
         };
         status: "enabled" | "disabled" | "deleted";
-        visibility: "private" | "public";
-        approvedAnonymousMethods: readonly Readonly<{
-           name: string;
-           digest: Sha256Digest;
-        }>[];
-        anonymousApproval:   | Readonly<{
-           by: ... | ... | ...;
-           at: number;
-           authorityVersion: number;
-         }>
-           | null;
       }
         | null;
    }
@@ -778,13 +733,13 @@ type InstallationOperations = Readonly<{
               | "request_failed"
               | "page_error"
               | "candidate_not_mounted";
-           errorName?:   | "TypeError"
+           errorName?:   | "Error"
+              | "TypeError"
               | "RangeError"
               | "SyntaxError"
               | "AbortError"
               | "TimeoutError"
-              | "Other"
-              | "Error";
+              | "Other";
            finalUrlPath: string;
            consoleErrors: string[];
            pageErrors: string[];
@@ -833,17 +788,6 @@ type InstallationOperations = Readonly<{
               | null;
         };
         status: "enabled" | "disabled" | "deleted";
-        visibility: "private" | "public";
-        approvedAnonymousMethods: readonly Readonly<{
-           name: string;
-           digest: Sha256Digest;
-        }>[];
-        anonymousApproval:   | Readonly<{
-           by: ... | ... | ...;
-           at: number;
-           authorityVersion: number;
-         }>
-           | null;
       }
         | null;
    }
@@ -938,17 +882,6 @@ type InstallationOperations = Readonly<{
               | null;
         };
         status: "enabled" | "disabled" | "deleted";
-        visibility: "private" | "public";
-        approvedAnonymousMethods: readonly Readonly<{
-           name: string;
-           digest: Sha256Digest;
-        }>[];
-        anonymousApproval:   | Readonly<{
-           by: ... | ... | ...;
-           at: number;
-           authorityVersion: number;
-         }>
-           | null;
       }
         | null;
      acceptedAt: number;
@@ -975,17 +908,6 @@ type InstallationOperations = Readonly<{
               approval: Readonly<...> | null;
            };
            status: "enabled" | "disabled" | "deleted";
-           visibility: "private" | "public";
-           approvedAnonymousMethods: readonly Readonly<{
-              name: ...;
-              digest: ...;
-           }>[];
-           anonymousApproval:   | Readonly<{
-              by: ...;
-              at: ...;
-              authorityVersion: ...;
-            }>
-              | null;
         };
         hasBackend: boolean;
         prepared: boolean;
@@ -1140,28 +1062,6 @@ type InstallationOperations = Readonly<{
               | null;
         };
         status: "enabled" | "disabled" | "deleted";
-        visibility: "private" | "public";
-        approvedAnonymousMethods: readonly Readonly<{
-           name: string;
-           digest: Sha256Digest;
-        }>[];
-        anonymousApproval:   | Readonly<{
-           by:   | {
-              kind: ...;
-              memberId: ...;
-            }
-              | {
-              kind: ...;
-              agentId: ...;
-            }
-              | {
-              kind: ...;
-              keyId: ...;
-            };
-           at: number;
-           authorityVersion: number;
-         }>
-           | null;
       }
         | null;
      acceptedAt: number;
@@ -1198,17 +1098,6 @@ type InstallationOperations = Readonly<{
                  | null;
            };
            status: "enabled" | "disabled" | "deleted";
-           visibility: "private" | "public";
-           approvedAnonymousMethods: readonly Readonly<{
-              name: string;
-              digest: Sha256Digest;
-           }>[];
-           anonymousApproval:   | Readonly<{
-              by: ... | ... | ...;
-              at: number;
-              authorityVersion: number;
-            }>
-              | null;
         };
         hasBackend: boolean;
         prepared: boolean;
@@ -1309,6 +1198,21 @@ type VerifiedRelease = Readonly<{
 
 A Release whose root, UI and backend artifacts were read and verified.
 
+---
+
+### VerifiedObjectCache
+
+```ts
+type VerifiedObjectCache = Readonly<{
+  match: (digest) => Promise<ReadableStream<Uint8Array> | null>;
+  put: (digest, bytes) => Promise<"stored" | "unstored">;
+}>;
+```
+
+Copies of verified artifacts near the reader, keyed by content digest. An entry
+holds only bytes that already matched its digest, so a hit is served without
+another store read or hash.
+
 ## Variables
 
 ### capabilityMethodKindSchema
@@ -1421,53 +1325,6 @@ Default bounds for an App's UI asset build.
 
 ## Functions
 
-### oysterPrincipalIsVisitor()
-
-```ts
-function oysterPrincipalIsVisitor(
-  principal,
-): principal is Readonly<{ actor: Readonly<{ kind: "visitor" }> }>;
-```
-
-Narrow an admitted principal to the anonymous public reader.
-
-#### Parameters
-
-| Parameter   | Type                                  |
-| ----------- | ------------------------------------- |
-| `principal` | [`OysterPrincipal`](#oysterprincipal) |
-
-#### Returns
-
-`principal is Readonly<{ actor: Readonly<{ kind: "visitor" }> }>`
-
----
-
-### oysterPrincipalIsOwner()
-
-```ts
-function oysterPrincipalIsOwner(
-  principal,
-): principal is Readonly<{
-  actor: { kind: "member"; memberId: string };
-  role: "owner";
-}>;
-```
-
-True only for a member admitted with the owner role.
-
-#### Parameters
-
-| Parameter   | Type                                  |
-| ----------- | ------------------------------------- |
-| `principal` | [`OysterPrincipal`](#oysterprincipal) |
-
-#### Returns
-
-`principal is Readonly<{ actor: { kind: "member"; memberId: string }; role: "owner" }>`
-
----
-
 ### oysterPrincipalId()
 
 ```ts
@@ -1512,9 +1369,9 @@ Completed selection, without re-deriving or executing outside Watchdog.
 | `host`           | [`OysterHost`](#oysterhost)                                       |
 | `installationId` | `string`                                                          |
 | `release`        | `Release`                                                         |
-| `principal`      | [`OysterPrincipal`](#oysterprincipal)                             |
+| `principal`      | [`TenantPrincipal`](tenant.md#tenantprincipal)                    |
 | `intent`         | `"install-or-select"` \| `"install-or-remint"` \| `"create-only"` |
-| `origin`         | `"workflow"` \| `"owner-direct"` \| `"app"`                       |
+| `origin`         | `"workflow"` \| `"app"` \| `"owner-direct"`                       |
 | `requestId`      | `string`                                                          |
 | `signal`         | `AbortSignal`                                                     |
 
@@ -1527,13 +1384,34 @@ Completed selection, without re-deriving or executing outside Watchdog.
 ### createOyster()
 
 ```ts
-function createOyster(host): Hono<OysterEnv>;
+function createOyster(host): ServedTable<OysterEnv>;
+```
+
+Create the Oyster App server: a served route table that installs App Releases,
+serves their UI, forwards their backend requests and methods to their Instances,
+and mounts the host's MCP endpoint. The host's adapters decide where state lives
+and who may sign in.
+
+#### Parameters
+
+| Parameter | Type                        |
+| --------- | --------------------------- |
+| `host`    | [`OysterHost`](#oysterhost) |
+
+#### Returns
+
+[`ServedTable`](authorization.md#servedtable)\<[`OysterEnv`](#oysterenv)\>
+
+---
+
+### oysterRouteTable()
+
+```ts
+function oysterRouteTable(host): OysterRouteTable;
 ```
 
-Create the Oyster App server: a Hono app that installs App Releases, serves
-their UI, forwards their backend requests and methods to their Instances, and
-mounts the host's MCP endpoint. The host's adapters decide where state lives and
-who may sign in.
+The Oyster host's declared route table: every route names its requirement
+(`authorization.ts`), so an undeclared route is never served.
 
 #### Parameters
 
@@ -1543,7 +1421,7 @@ who may sign in.
 
 #### Returns
 
-`Hono`\<[`OysterEnv`](#oysterenv)\>
+[`OysterRouteTable`](#oysterroutetable)
 
 ---
 
@@ -1790,13 +1668,16 @@ function verifyRelease(
   api:   | Readonly<{
      methods: Readonly<Record<string, Readonly<{
         description: string;
-        input: object;
-        output: object;
+        input: {
+         [key: ...]: ...;
+        };
+        output: {
+         [key: ...]: ...;
+        };
         effect: ... | ... | ...;
         requires: readonly ...;
         pending?: ... | ...;
         hidden?: ... | ...;
-        anonymous?: ... | ...;
         present?: ... | ...;
      }>>>;
      toolFamily?: Readonly<{
@@ -1990,10 +1871,10 @@ readonly `"git.push"`[]; `icon?`: `string`; `roles`: readonly (`"files"` \|
 `"application/vnd.fungi.app-backend+json"`; `artifactRef`: `ArtifactRef`;
 `digest`: `Sha256Digest`; `version`: `string`; `byteLength`: `number`; \}; \};
 `api`: \| `Readonly`\<\{ `methods`: `Readonly`\<`Record`\<`string`,
-`Readonly`\<\{ `description`: `string`; `input`: `object`; `output`: `object`;
-`effect`: ... \| ... \| ...; `requires`: readonly ...; `pending?`: ... \| ...;
-`hidden?`: ... \| ...; `anonymous?`: ... \| ...; `present?`: ... \| ...;
-\}\>\>\>; `toolFamily?`: `Readonly`\<\{ `name`: `string`; `list`: `string`;
+`Readonly`\<\{ `description`: `string`; `input`: \{ \[`key`: ...\]: ...; \};
+`output`: \{ \[`key`: ...\]: ...; \}; `effect`: ... \| ... \| ...; `requires`:
+readonly ...; `pending?`: ... \| ...; `hidden?`: ... \| ...; `present?`: ... \|
+...; \}\>\>\>; `toolFamily?`: `Readonly`\<\{ `name`: `string`; `list`: `string`;
 `call`: `string`; \}\>; `events?`: `Readonly`\<`Record`\<`string`,
 `Readonly`\<\{ `description`: ...; `payload`: ...; \}\>\>\>; \}\> \| `null`;
 `declaration`: \| `Readonly`\<\{ `api?`: `Readonly`\<\{ `methods`:

package/docs/api/index.md

@@ -448,13 +448,13 @@ const uiBootCheckOutcomeSchema: ZodDiscriminatedUnion<[ZodObject<{
         candidate_not_mounted: "candidate_not_mounted";
      }>;
      errorName: ZodOptional<ZodEnum<{
+        Error: "Error";
         TypeError: "TypeError";
         RangeError: "RangeError";
         SyntaxError: "SyntaxError";
         AbortError: "AbortError";
         TimeoutError: "TimeoutError";
         Other: "Other";
-        Error: "Error";
      }>>;
      finalUrlPath: ZodString;
      consoleErrors: ZodArray<ZodPipe<ZodPipe<ZodString, ZodTransform<..., ...>>, ZodString>>;