@fungi.computer/oyster 0.6.0 → 0.7.0

package/dist/build/build-jobs.d.ts

@@ -87,7 +87,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
+        readonly status: "revoked" | "failed" | "running" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;
@@ -103,7 +103,7 @@ export declare function createTeamBuildPublisher(options: Readonly<{
         readonly expiresAt: number;
         readonly remote: string;
         readonly reportUrl: string;
-        readonly status: "revoked" | "running" | "failed" | "succeeded" | "interrupted";
+        readonly status: "revoked" | "failed" | "running" | "succeeded" | "interrupted";
         readonly artifact: {
             readonly digest: string;
             readonly bytes: number;

package/dist/build/candidate-builder.d.ts

@@ -56,6 +56,8 @@ export declare function buildTeamCandidate(input: {
     outputPath: string;
     /** Trusted Computer-local cache; never part of customer configuration. */
     packageStoreDirectory?: string;
+    /** Host-owned observation of raw subprocess output; never source configuration. */
+    onOutput?: (stream: "stdout" | "stderr", bytes: Uint8Array) => void;
 }): Promise<Readonly<{
     digest: string;
     bytes: number;

package/dist/build/candidate-builder.js

@@ -48,15 +48,19 @@ export async function buildTeamCandidate(input) {
     const onPhase = (phase, milliseconds) => {
         phases[phase] += milliseconds;
     };
+    const onOutput = (stream, bytes) => {
+        input.onOutput?.(stream, bytes);
+    };
     const prepareStarted = performance.now();
     const candidate = await Effect.runPromise(createCapturedCandidatePreparer(config, {
         sourceCapture: createLocalCommitSourceCapture(input.repositoryPath, config.sourceRevision),
         buildExecutor: createLocalBuildExecutor(input.packageStoreDirectory === undefined
-            ? { packageScripts: "run", onPhase }
+            ? { packageScripts: "run", onPhase, onOutput }
             : {
                 packageScripts: "run",
                 packageStoreDirectory: input.packageStoreDirectory,
                 onPhase,
+                onOutput,
             }),
     }).prepareCandidate(parseReleaseId("rel_build")));
     const prepared = performance.now() - prepareStarted;

package/dist/build/candidate-cli.js

@@ -32,6 +32,9 @@ try {
         outputPath,
         // Computer scratch survives captured snapshot cleanup, without a global or durable Workspace store.
         packageStoreDirectory: "/var/tmp/fungi-app-package-store",
+        onOutput: (stream, bytes) => {
+            process[stream].write(bytes);
+        },
     });
     const reportUrl = process.env.TEAM_BUILD_REPORT;
     if (!reportUrl)

package/dist/build/candidate-cli.mjs

@@ -19518,6 +19518,11 @@ var appBackendBindingKinds = {
         requires: ["workflow.run", "workflow.arm"],
         effect: "write"
       },
+      pauseSchedule: {
+        cap: "app.workflow.run",
+        requires: ["workflow.run", "workflow.arm"],
+        effect: "write"
+      },
       schedules: {
         cap: "app.workflow.read",
         requires: ["workflow.run"],
@@ -19659,7 +19664,22 @@ var appBackendBindingKinds = {
     name: "AGENTS",
     operations: {
       list: { cap: "agent.list", requires: ["agent.list"], effect: "read" },
-      send: { cap: "agent.send", requires: ["agent.send"], effect: "write" }
+      send: { cap: "agent.send", requires: ["agent.send"], effect: "write" },
+      schedules: {
+        cap: "agent.read",
+        requires: ["agent.read"],
+        effect: "read"
+      },
+      pauseSchedule: {
+        cap: "agent.manage",
+        requires: ["agent.manage"],
+        effect: "write"
+      },
+      deleteSchedule: {
+        cap: "agent.manage",
+        requires: ["agent.manage"],
+        effect: "write"
+      }
     }
   }
 };
@@ -19714,13 +19734,17 @@ var emptyAppDeclaration = Object.freeze({
 
 // ../puffball/dist/app-api.js
 var appApiMethodNameSchema = String4.check(makeFilter2(isAppApiMethodName));
+function isJsonContainer(value) {
+  return value !== null && typeof value === "object";
+}
 function withinDepth(value, depth = 0) {
   if (depth > 16)
     return false;
-  if (is2(ArraySchema(Json2))(value))
-    return value.every((child) => withinDepth(child, depth + 1));
-  if (is2(JsonObject)(value))
-    return Object.values(value).every((child) => withinDepth(child, depth + 1));
+  if (isJsonContainer(value)) {
+    for (const child of Object.values(value))
+      if (!withinDepth(child, depth + 1))
+        return false;
+  }
   return true;
 }
 var projection = JsonObject.pipe(check(makeFilter2((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 2e4 && withinDepth(value), { message: "App API schema exceeds its byte or depth bound" })));
@@ -19731,15 +19755,12 @@ var method = Struct({
   output: projection,
   pending: optional2(Literal2(true)),
   hidden: optional2(Literal2(true)),
-  anonymous: optional2(Literal2(true)),
   present: optional2(Struct({
     verb: String4.check(isMinLength(1), isMaxLength(32))
   })),
   effect: Literals(["read", "write", "external"]),
   requires: ArraySchema(Literals(appCapabilityIds)).pipe(check(makeFilter2((values) => new Set(values).size === values.length)))
-}).check(makeFilter2((value) => value.anonymous !== true || value.effect === "read" && value.requires.length === 0, {
-  message: "Anonymous methods must be reads with no required capabilities"
-}));
+});
 var appApiSchema = Struct({
   methods: Record(String4, method).pipe(check(makeFilter2((methods) => Object.keys(methods).every(is2(appApiMethodNameSchema)), { message: "Invalid App API method name" })), check(makeFilter2((methods) => Object.keys(methods).length <= 64)), check(makeFilter2((methods) => {
     const names = Object.keys(methods);
@@ -21842,6 +21863,7 @@ var BirdDogAgentJobPayloadSchema = Struct({
 });
 var BirdDogAgentJobInputSchema = Struct({
   work: BirdDogAgentWorkSchema,
+  delivery: Literals(["steer", "followUp"]),
   mail: optional2(BirdDogMailSchema)
 });
 
@@ -35641,7 +35663,7 @@ async function stopHtmlGroup(child) {
   }
   throw new Error("HTML process group survived its five-second cleanup bound");
 }
-function runHtmlCommand(args2, cwd, env, command = "pnpm") {
+function runHtmlCommand(args2, cwd, env, command = "pnpm", onOutput) {
   return acquireUseRelease2(
     sync2(() => {
       if (process.platform === "win32")
@@ -35656,11 +35678,13 @@ function runHtmlCommand(args2, cwd, env, command = "pnpm") {
         let stdout = "";
         let stderr = "";
         child.stdout.on("data", (chunk) => {
+          onOutput?.("stdout", chunk);
           stdout += chunk.toString();
           if (Buffer2.byteLength(stdout) > 1024 * 1024)
             reject(new Error("HTML command output exceeded its bound"));
         });
         child.stderr.on("data", (chunk) => {
+          onOutput?.("stderr", chunk);
           stderr += chunk.toString();
           if (Buffer2.byteLength(stderr) > 1024 * 1024)
             reject(new Error("HTML command diagnostics exceeded their bound"));
@@ -35701,10 +35725,10 @@ function snapshotBuildEnvironment(sourceSnapshotPath) {
 }
 function rebuildViteSnapshot(sourceSnapshotPath, recipe, options) {
   if (recipe.kind === "source-html")
-    return rebuildNpmSnapshot(sourceSnapshotPath, recipe);
+    return rebuildNpmSnapshot(sourceSnapshotPath, recipe, options);
   return gen2(function* () {
     const env = snapshotBuildEnvironment(sourceSnapshotPath);
-    const run2 = (args2, cwd = sourceSnapshotPath) => runHtmlCommand(args2, cwd, env);
+    const run2 = (args2, cwd = sourceSnapshotPath) => runHtmlCommand(args2, cwd, env, "pnpm", options.onOutput);
     if ((yield* run2(["--version"])).trim() !== "11.24.0") {
       return yield* fail5(new Error("Publisher requires pnpm 11.24.0"));
     }
@@ -35922,7 +35946,7 @@ function readHtmlBuildOutput(sourceSnapshotPath, recipe) {
     return Object.freeze({ kind: "bytes", bytes });
   });
 }
-function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
+function rebuildNpmSnapshot(sourceSnapshotPath, recipe, options) {
   return gen2(function* () {
     const env = snapshotBuildEnvironment(sourceSnapshotPath);
     const home = join5(sourceSnapshotPath, ".publisher-home");
@@ -35939,7 +35963,8 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
       ["--version"],
       sourceSnapshotPath,
       env,
-      "npm"
+      "npm",
+      options.onOutput
     )).trim() !== recipe.toolchain.npm)
       return yield* fail5(
         new Error("Captured npm version differs from the recipe")
@@ -35948,7 +35973,8 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
       ["ci", "--include=dev", "--ignore-scripts", "--no-audit", "--no-fund"],
       sourceSnapshotPath,
       env,
-      "npm"
+      "npm",
+      options.onOutput
     );
     const program = join5(sourceSnapshotPath, ".publisher-build.mjs");
     yield* tryPromise2(async () => {
@@ -35969,7 +35995,8 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
       ],
       sourceSnapshotPath,
       env,
-      "node"
+      "node",
+      options.onOutput
     );
     return yield* readHtmlBuildOutput(sourceSnapshotPath, recipe);
   });
@@ -36110,7 +36137,9 @@ function createLocalBuildExecutor(options = {}) {
               if ((yield* runHtmlCommand(
                 ["--version"],
                 source.snapshotPath,
-                environment
+                environment,
+                "pnpm",
+                options.onOutput
               )).trim() !== "11.24.0")
                 return yield* fail5(
                   new Error("Publisher requires pnpm 11.24.0")
@@ -36121,7 +36150,9 @@ function createLocalBuildExecutor(options = {}) {
                   options.packageCacheDirectory
                 ),
                 source.snapshotPath,
-                environment
+                environment,
+                "pnpm",
+                options.onOutput
               );
             }
           }
@@ -36272,6 +36303,9 @@ async function buildTeamCandidate(input) {
   const onPhase = (phase, milliseconds) => {
     phases[phase] += milliseconds;
   };
+  const onOutput = (stream, bytes2) => {
+    input.onOutput?.(stream, bytes2);
+  };
   const prepareStarted = performance.now();
   const candidate = await runPromise2(
     createCapturedCandidatePreparer(config2, {
@@ -36280,10 +36314,11 @@ async function buildTeamCandidate(input) {
         config2.sourceRevision
       ),
       buildExecutor: createLocalBuildExecutor(
-        input.packageStoreDirectory === void 0 ? { packageScripts: "run", onPhase } : {
+        input.packageStoreDirectory === void 0 ? { packageScripts: "run", onPhase, onOutput } : {
           packageScripts: "run",
           packageStoreDirectory: input.packageStoreDirectory,
-          onPhase
+          onPhase,
+          onOutput
         }
       )
     }).prepareCandidate(parseReleaseId("rel_build"))
@@ -36354,7 +36389,10 @@ try {
     repositoryPath,
     outputPath,
     // Computer scratch survives captured snapshot cleanup, without a global or durable Workspace store.
-    packageStoreDirectory: "/var/tmp/fungi-app-package-store"
+    packageStoreDirectory: "/var/tmp/fungi-app-package-store",
+    onOutput: (stream, bytes) => {
+      process[stream].write(bytes);
+    }
   });
   const reportUrl = process.env.TEAM_BUILD_REPORT;
   if (!reportUrl) throw new TeamCandidateBuildError("report_failed");

package/dist/build/job-log.d.ts

@@ -0,0 +1,23 @@
+import * as Schema from "effect/Schema";
+/** Maximum retained combined stdout/stderr bytes, split equally into head and tail. */
+export declare const buildJobLogMaxBytes: number;
+/** Base64url preserves raw command bytes, including split UTF-8 and terminal control bytes. */
+export declare const buildJobLogSchema: Schema.Struct<{
+    readonly encoding: Schema.Literal<"base64url">;
+    readonly output: Schema.String;
+    readonly truncated: Schema.NullOr<Schema.Struct<{
+        readonly droppedBytes: Schema.Number;
+    }>>;
+}>;
+export type BuildJobLog = Schema.Schema.Type<typeof buildJobLogSchema>;
+/** The artifact-upload door cannot write this host-owned job-log namespace. */
+export declare const isBuildJobLogRef: (ref: string) => boolean;
+/** One bounded raw-event sink; event arrival order is the combined output order. */
+export declare function createBuildJobLog(): {
+    /** Retained buffer capacity, distinct from the transient encoded result. */
+    readonly allocatedBytes: number;
+    append(bytes: Uint8Array): void;
+    finish(): BuildJobLog;
+};
+/** Preserve BirdDog's redacted 200-character status/mail budget and name the full log. */
+export declare function buildJobDiagnostic(jobId: string, detail: string): string;

package/dist/build/job-log.js

@@ -0,0 +1,88 @@
+import * as Schema from "effect/Schema";
+import { base64url } from "jose";
+import { boundedDiagnostic } from "@fungi.computer/bird-dog/effect";
+/** Maximum retained combined stdout/stderr bytes, split equally into head and tail. */
+export const buildJobLogMaxBytes = 2 * 1024 * 1024;
+/** Base64url preserves raw command bytes, including split UTF-8 and terminal control bytes. */
+export const buildJobLogSchema = Schema.Struct({
+    encoding: Schema.Literal("base64url"),
+    output: Schema.String.check(Schema.isMaxLength(Math.ceil(buildJobLogMaxBytes / 3) * 4)),
+    truncated: Schema.NullOr(Schema.Struct({
+        droppedBytes: Schema.Number.check(Schema.isInt(), Schema.isGreaterThan(0)),
+    })),
+});
+/** The artifact-upload door cannot write this host-owned job-log namespace. */
+export const isBuildJobLogRef = (ref) => ref.startsWith("artifact:build-log-");
+/** One bounded raw-event sink; event arrival order is the combined output order. */
+export function createBuildJobLog() {
+    const half = buildJobLogMaxBytes / 2;
+    let head = new Uint8Array(0);
+    let tail = new Uint8Array(0);
+    let headBytes = 0;
+    let tailBytes = 0;
+    let tailPosition = 0;
+    let total = 0;
+    const capacityFor = (current, needed) => Math.min(half, Math.max(needed, current === 0 ? 4096 : current * 2));
+    return {
+        /** Retained buffer capacity, distinct from the transient encoded result. */
+        get allocatedBytes() {
+            return head.byteLength + tail.byteLength;
+        },
+        append(bytes) {
+            total += bytes.byteLength;
+            const prefix = Math.min(half - headBytes, bytes.byteLength);
+            if (headBytes + prefix > head.byteLength) {
+                const next = new Uint8Array(capacityFor(head.byteLength, headBytes + prefix));
+                next.set(head.subarray(0, headBytes));
+                head = next;
+            }
+            head.set(bytes.subarray(0, prefix), headBytes);
+            headBytes += prefix;
+            const remaining = bytes.subarray(prefix);
+            if (remaining.byteLength === 0)
+                return;
+            const needed = Math.min(half, tailBytes + remaining.byteLength);
+            if (needed > tail.byteLength) {
+                const next = new Uint8Array(capacityFor(tail.byteLength, needed));
+                const start = tailBytes === tail.byteLength ? tailPosition : 0;
+                const first = Math.min(tailBytes, tail.byteLength - start);
+                next.set(tail.subarray(start, start + first));
+                next.set(tail.subarray(0, tailBytes - first), first);
+                tail = next;
+                tailPosition = tailBytes;
+            }
+            const suffix = remaining.subarray(Math.max(0, remaining.byteLength - half));
+            if (remaining.byteLength >= half) {
+                tailBytes = 0;
+                tailPosition = 0;
+            }
+            const first = Math.min(suffix.byteLength, tail.byteLength - tailPosition);
+            tail.set(suffix.subarray(0, first), tailPosition);
+            tail.set(suffix.subarray(first), 0);
+            tailPosition = (tailPosition + suffix.byteLength) % tail.byteLength;
+            tailBytes = Math.min(half, tailBytes + remaining.byteLength);
+        },
+        finish() {
+            const bytes = new Uint8Array(headBytes + tailBytes);
+            bytes.set(head.subarray(0, headBytes));
+            const start = tailBytes === tail.byteLength ? tailPosition : 0;
+            const first = Math.min(tailBytes, tail.byteLength - start);
+            bytes.set(tail.subarray(start, start + first), headBytes);
+            bytes.set(tail.subarray(0, tailBytes - first), headBytes + first);
+            const droppedBytes = total - bytes.byteLength;
+            return {
+                encoding: "base64url",
+                output: base64url.encode(bytes),
+                truncated: droppedBytes === 0 ? null : { droppedBytes },
+            };
+        },
+    };
+}
+/** The job read door, not an artifact-serving URL. */
+const buildJobLogReference = (jobId) => `/api/builds/${encodeURIComponent(jobId)}?log`;
+/** Preserve BirdDog's redacted 200-character status/mail budget and name the full log. */
+export function buildJobDiagnostic(jobId, detail) {
+    const reference = `Log: ${buildJobLogReference(jobId)}`;
+    const diagnostic = boundedDiagnostic(detail) ?? "Build finished";
+    return `${reference}\n${diagnostic.slice(0, 200 - reference.length - 1)}`;
+}

package/dist/build/local-build.d.ts

@@ -53,6 +53,8 @@ export type LocalBuildExecutorOptions = Readonly<{
     packageScripts?: "run";
     /** Hears how long the dependency install and the compile each took. */
     onPhase?: (phase: "install" | "build", milliseconds: number) => void;
+    /** Forward raw install/build output to the admitted Computer's job log. */
+    onOutput?: (stream: "stdout" | "stderr", bytes: Uint8Array) => void;
 }>;
 /** Exact pinned esbuild options shared by local builds and artifact-budget proofs. */
 export declare function localSnapshotBuildOptions(source: CapturedSource, recipe: PinnedRecipe, emission: DefinitionEmission): esbuild.BuildOptions;

package/dist/build/local-build.js

@@ -571,7 +571,7 @@ async function stopHtmlGroup(child) {
     }
     throw new Error("HTML process group survived its five-second cleanup bound");
 }
-function runHtmlCommand(args, cwd, env, command = "pnpm") {
+function runHtmlCommand(args, cwd, env, command = "pnpm", onOutput) {
     return Effect.acquireUseRelease(Effect.sync(() => {
         if (process.platform === "win32")
             throw new Error("HTML builds require POSIX process groups");
@@ -585,11 +585,13 @@ function runHtmlCommand(args, cwd, env, command = "pnpm") {
             let stdout = "";
             let stderr = "";
             child.stdout.on("data", (chunk) => {
+                onOutput?.("stdout", chunk);
                 stdout += chunk.toString();
                 if (Buffer.byteLength(stdout) > 1024 * 1024)
                     reject(new Error("HTML command output exceeded its bound"));
             });
             child.stderr.on("data", (chunk) => {
+                onOutput?.("stderr", chunk);
                 stderr += chunk.toString();
                 if (Buffer.byteLength(stderr) > 1024 * 1024)
                     reject(new Error("HTML command diagnostics exceeded their bound"));
@@ -632,10 +634,10 @@ function snapshotBuildEnvironment(sourceSnapshotPath) {
 }
 function rebuildViteSnapshot(sourceSnapshotPath, recipe, options) {
     if (recipe.kind === "source-html")
-        return rebuildNpmSnapshot(sourceSnapshotPath, recipe);
+        return rebuildNpmSnapshot(sourceSnapshotPath, recipe, options);
     return Effect.gen(function* () {
         const env = snapshotBuildEnvironment(sourceSnapshotPath);
-        const run = (args, cwd = sourceSnapshotPath) => runHtmlCommand(args, cwd, env);
+        const run = (args, cwd = sourceSnapshotPath) => runHtmlCommand(args, cwd, env, "pnpm", options.onOutput);
         if ((yield* run(["--version"])).trim() !== "11.24.0") {
             return yield* Effect.fail(new Error("Publisher requires pnpm 11.24.0"));
         }
@@ -827,7 +829,7 @@ function readHtmlBuildOutput(sourceSnapshotPath, recipe) {
         return Object.freeze({ kind: "bytes", bytes });
     });
 }
-function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
+function rebuildNpmSnapshot(sourceSnapshotPath, recipe, options) {
     return Effect.gen(function* () {
         const env = snapshotBuildEnvironment(sourceSnapshotPath);
         const home = join(sourceSnapshotPath, ".publisher-home");
@@ -840,9 +842,9 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
             await writeFile(userConfig, "", { flag: "wx" });
             await writeFile(globalConfig, "", { flag: "wx" });
         });
-        if ((yield* runHtmlCommand(["--version"], sourceSnapshotPath, env, "npm")).trim() !== recipe.toolchain.npm)
+        if ((yield* runHtmlCommand(["--version"], sourceSnapshotPath, env, "npm", options.onOutput)).trim() !== recipe.toolchain.npm)
             return yield* Effect.fail(new Error("Captured npm version differs from the recipe"));
-        yield* runHtmlCommand(["ci", "--include=dev", "--ignore-scripts", "--no-audit", "--no-fund"], sourceSnapshotPath, env, "npm");
+        yield* runHtmlCommand(["ci", "--include=dev", "--ignore-scripts", "--no-audit", "--no-fund"], sourceSnapshotPath, env, "npm", options.onOutput);
         const program = join(sourceSnapshotPath, ".publisher-build.mjs");
         yield* Effect.tryPromise(async () => {
             const { htmlBuildProgram } = await snapshotPrograms();
@@ -858,7 +860,7 @@ function rebuildNpmSnapshot(sourceSnapshotPath, recipe) {
             dirname(recipe.entry),
             "true",
             "",
-        ], sourceSnapshotPath, env, "node");
+        ], sourceSnapshotPath, env, "node", options.onOutput);
         return yield* readHtmlBuildOutput(sourceSnapshotPath, recipe);
     });
 }
@@ -982,9 +984,9 @@ export function createLocalBuildExecutor(options = {}) {
                                 })))(await readFile(join(source.snapshotPath, "package.json"), "utf8"));
                             });
                             const environment = snapshotBuildEnvironment(source.snapshotPath);
-                            if ((yield* runHtmlCommand(["--version"], source.snapshotPath, environment)).trim() !== "11.24.0")
+                            if ((yield* runHtmlCommand(["--version"], source.snapshotPath, environment, "pnpm", options.onOutput)).trim() !== "11.24.0")
                                 return yield* Effect.fail(new Error("Publisher requires pnpm 11.24.0"));
-                            yield* runHtmlCommand(frozenSnapshotInstallArguments(options.packageStoreDirectory, options.packageCacheDirectory), source.snapshotPath, environment);
+                            yield* runHtmlCommand(frozenSnapshotInstallArguments(options.packageStoreDirectory, options.packageCacheDirectory), source.snapshotPath, environment, "pnpm", options.onOutput);
                         }
                     }
                     const ui = yield* recipe.kind === "bundled-html"

package/dist/cloudflare.d.ts

@@ -9,6 +9,7 @@ import { type AppBackendBindingName } from "@fungi.computer/puffball/app";
 import { type InvocationFrame, type InvocationGate } from "./invocation.js";
 import * as Schema from "effect/Schema";
 import { z } from "zod";
+import type { ResourceRef } from "./apps/installation.js";
 import type { Release } from "@fungi.computer/puffball";
 import { type UiBootCheckOutcome } from "./boot-gate.js";
 export { checkBackendConstruction } from "./boot-construction.js";
@@ -39,6 +40,8 @@ export type FrameBindingMethod<Result> = Readonly<{
     decodeResult: z.ZodType<Result>["parse"];
     /** Determine the declared operations needed for these decoded arguments. */
     requiredOperations: (args: readonly unknown[]) => readonly string[];
+    /** Select a concrete host resource after decoding, before provider dispatch. */
+    requestedResource?: (args: readonly unknown[]) => ResourceRef;
 }>;
 /** Method descriptors for the closed App binding vocabulary. */
 export type FrameBindingMethods<Result> = Readonly<Partial<Record<AppBackendBindingName, Readonly<Record<string, FrameBindingMethod<Result>>>>>>;
@@ -119,7 +122,7 @@ export type AppInstanceLoader<FacetClass> = Readonly<{
         getDurableObjectClass: (exportName: string) => FacetClass;
     }>;
 }>;
-/** End the native App facet when live authority closes early, before the gate admits again. */
+/** Stop the shared native App facet at cohort drain or revocation. */
 export declare function createCloudflareInvocationGate<Host, FacetClass>(ctx: Pick<AppInstanceContext<FacetClass>, "facets">, close: (frame: InvocationFrame<Host>) => Promise<void>): InvocationGate<Host>;
 /**
  * Run an App Instance inside a SQLite-backed Durable Object on workerd, celld

package/dist/cloudflare.js

@@ -267,7 +267,7 @@ const facetInvocationSchema = rpcHandleSchema({
     invoke: rpcMethod(z.union([z.json(), z.undefined()])).input(z.tuple([z.string(), z.array(z.unknown()), z.unknown()])),
     http: rpcMethod(facetHttpReplySchema).input(z.tuple([facetHttpInputSchema, z.unknown()])),
 });
-/** End the native App facet when live authority closes early, before the gate admits again. */
+/** Stop the shared native App facet at cohort drain or revocation. */
 export function createCloudflareInvocationGate(ctx, close) {
     return createInvocationGate({
         abortGuest: () => {

package/dist/files.js

@@ -6,7 +6,7 @@
  * the Oyster's workspace unchanged. Other sources (a git repository) implement
  * the same `FileSource`.
  */
-import { Hono } from "hono";
+import { computer, routes } from "./authorization.js";
 import * as Schema from "effect/Schema";
 import { computerList, computerReadFile, computerWriteFile, } from "@fungi.computer/agar/computer";
 const MAX_FILE_BYTES = 25 * 1024 * 1024;
@@ -66,10 +66,11 @@ export function fileCapabilities(source) {
         },
     ];
 }
+/** The workspace is the Computer's: a key needs `computer.use` (see `authorization.ts`). */
 function createFileRoutes(source) {
-    const routes = new Hono();
+    const table = routes();
     const pathOf = (raw) => normalizeFilePath(raw ?? "");
-    routes.get("/list", async (context) => {
+    table.get("/list", computer(), async (context) => {
         const path = pathOf(context.req.query("path"));
         if (path === null)
             return refusal(400, "Invalid path");
@@ -80,7 +81,7 @@ function createFileRoutes(source) {
             ? refusal(404, "No such directory")
             : Response.json(listing);
     });
-    routes.get("/content", async (context) => {
+    table.get("/content", computer(), async (context) => {
         const path = pathOf(context.req.query("path"));
         if (path === null)
             return refusal(400, "Invalid path");
@@ -91,7 +92,7 @@ function createFileRoutes(source) {
                 headers: { "Content-Type": "application/octet-stream" },
             });
     });
-    routes.put("/content", async (context) => {
+    table.put("/content", computer(), async (context) => {
         const path = pathOf(context.req.query("path"));
         if (path === null || path === "/")
             return refusal(400, "Invalid path");
@@ -104,7 +105,7 @@ function createFileRoutes(source) {
         await source.write(path, bytes);
         return new Response(null, { status: 204 });
     });
-    routes.post("/mkdir", async (context) => {
+    table.post("/mkdir", computer(), async (context) => {
         const body = Schema.decodeUnknownOption(mkdirSchema)(await context.req.json());
         const path = body._tag === "Some" ? normalizeFilePath(body.value.path) : null;
         if (path === null || path === "/")
@@ -112,12 +113,12 @@ function createFileRoutes(source) {
         await source.mkdir(path);
         return new Response(null, { status: 204 });
     });
-    routes.post("/replace", async (context) => {
+    table.post("/replace", computer(), async (context) => {
         const body = Schema.decodeUnknownOption(replaceSchema)(await context.req.json());
         const path = body._tag === "Some" ? normalizeFilePath(body.value.path) : null;
         if (body._tag === "None" || path === null)
             return refusal(400, "Invalid request");
         return Response.json(await source.replace(path, body.value.expectedContent, body.value.content));
     });
-    return routes;
+    return table;
 }

package/dist/git-admission.d.ts

@@ -5,10 +5,10 @@ import type { AppDeclaration } from "@fungi.computer/puffball/app";
 import type { Installation } from "./apps/installation.js";
 /** Installation-scoped storage; transport and credentials stay with its provider adapter. */
 export type GitStore = GitBinding;
-/** Live host authority, reopened before every provider call. Null is an anonymous reader. */
+/** Live host authority, reopened before every provider call. */
 export type GitGrants = Readonly<{
     /** Reopen the host authority for this repository and requested scope. */
-    admits(writer: GitWriter | null, repository: string, scope: "read" | "write"): Promise<boolean>;
+    admits(writer: GitWriter, repository: string, scope: "read" | "write"): Promise<boolean>;
 }>;
 /** Reuse the live installation/verified Release rule without opening provider storage. */
 export declare function createInstallationGitAdmission(ports: Readonly<{
@@ -36,7 +36,7 @@ export type AdmittedGit = Readonly<{
     /** Recheck host read authority before exchanging provider bytes. */
     read(writer: Extract<GitWriter, {
         kind: "actor";
-    }> | null, repository: string, request: GitExchangeRequest): Promise<GitExchangeResponse>;
+    }>, repository: string, request: GitExchangeRequest): Promise<GitExchangeResponse>;
     /** Bind installation-authored operations; null attribution is lifecycle-only. */
     binding(onBehalfOf: HostActor | null): GitBinding;
 }>;

package/dist/git-admission.js

@@ -5,13 +5,12 @@ import { acceptedRefs, parseReceivePack, refusalReport, } from "@fungi.computer/
 import { defineIdFamily } from "@fungi.computer/cairn/id";
 /** Reuse the live installation/verified Release rule without opening provider storage. */
 export function createInstallationGitAdmission(ports) {
-    return async (writer) => {
+    return async () => {
         const current = await ports.currentInstallation();
         if (current === null)
             return false;
         const declaration = await ports.declaration(current);
-        return (declaration?.capabilities.includes("git.repository") === true &&
-            (writer !== null || current.visibility === "public"));
+        return declaration?.capabilities.includes("git.repository") === true;
     };
 }
 const ids = defineIdFamily({
@@ -26,9 +25,8 @@ export function createAdmittedGit(ports) {
     const { store, grants, policy, journal } = ports;
     async function admit(writer, repository, scope) {
         gitRepositoryNameSchema.parse(repository);
-        if (writer !== null)
-            gitWriterSchema.parse(writer);
-        if (writer?.kind === "installation" &&
+        gitWriterSchema.parse(writer);
+        if (writer.kind === "installation" &&
             writer.installationId !== ports.installationId)
             throw new Error("Git installation authority mismatch");
         if (!(await grants.admits(writer, repository, scope)))