@fungi.computer/oyster 0.6.0 → 0.7.0

package/dist/git-door.d.ts

@@ -1,5 +1,3 @@
-/** Smart-HTTP routing; all writes enter the same admitted Git path. */
-import { Hono } from "hono";
 import type { GitWriter } from "@fungi.computer/agar/git";
 import type { AdmittedGit } from "./git-admission.js";
 /** The repository and access one smart-HTTP request names. */
@@ -11,12 +9,10 @@ export type GitDoorTarget = Readonly<{
 /** Identity and selected installation come only from host-held ports. */
 export type GitDoorHost = Readonly<{
     /** Resolve a host-authenticated actor for this exact repository and scope;
-     * null means an anonymous request. */
+     * null refuses the request. */
     authenticate(request: Request, target: GitDoorTarget): Promise<Extract<GitWriter, {
         kind: "actor";
     }> | null>;
-    /** Decide whether anonymous reads may reach the selected installation. */
-    isPublic(installationId: string): Promise<boolean>;
     /** Resolve the installation's admitted path without exposing provider credentials. */
     git(installationId: string): Promise<AdmittedGit | null>;
 }>;
@@ -31,5 +27,10 @@ export declare function smartHttpExchange(method: string, url: URL, suffix: stri
 export declare function gitDoorRoute(method: string, url: URL): (GitDoorTarget & Readonly<{
     advertise: boolean;
 }>) | null;
-/** Mount one smart-HTTP door with no provider credentials or alternate write branch. */
-export declare function createGitDoor(host: GitDoorHost): Hono;
+/** One smart-HTTP exchange's answer; the host declares the route it serves at. */
+export type GitDoor = Readonly<{
+    /** Answer one smart-HTTP request at `/git/...`; anything else is 404. */
+    fetch: (request: Request) => Promise<Response>;
+}>;
+/** One smart-HTTP door with no provider credentials or alternate write branch. */
+export declare function createGitDoor(host: GitDoorHost): GitDoor;

package/dist/git-door.js

@@ -1,5 +1,4 @@
 /** Smart-HTTP routing; all writes enter the same admitted Git path. */
-import { Hono } from "hono";
 import { z } from "zod";
 const route = /^\/git\/([a-zA-Z0-9_-]{1,256})\/([a-zA-Z0-9._-]{1,128}?)(?:\.git)?\/(info\/refs|git-upload-pack|git-receive-pack)$/u;
 /** One smart-HTTP exchange: the method, `service` query and path suffix a
@@ -59,34 +58,37 @@ async function bodyOf(request) {
     }
     return body;
 }
-/** Mount one smart-HTTP door with no provider credentials or alternate write branch. */
+const text = (body, status) => new Response(body, {
+    status,
+    headers: { "Content-Type": "text/plain; charset=UTF-8" },
+});
+/** One smart-HTTP door with no provider credentials or alternate write branch. */
 export function createGitDoor(host) {
-    const door = new Hono();
-    const smartHttp = async (context) => {
-        const routed = gitDoorRoute(context.req.method, new URL(context.req.url));
+    const smartHttp = async (incoming) => {
+        const routed = gitDoorRoute(incoming.method, new URL(incoming.url));
         if (routed === null)
-            return context.text("Not a git route", 404);
+            return text("Not a git route", 404);
         const { advertise, ...target } = routed;
         const { installationId, repository } = target;
         const writing = target.scope === "write";
-        const writer = await host.authenticate(context.req.raw, target);
-        if (writer === null && (writing || !(await host.isPublic(installationId))))
+        const writer = await host.authenticate(incoming, target);
+        if (writer === null)
             return new Response("A key is required", {
                 status: 401,
                 headers: { "WWW-Authenticate": 'Basic realm="Oyster git"' },
             });
         const git = await host.git(installationId);
         if (git === null)
-            return context.text("Installation Git unavailable", 403);
-        if (context.req.header("content-encoding") !== undefined)
-            return context.text("Compressed Git requests are not supported", 400);
-        const body = advertise ? null : await bodyOf(context.req.raw);
+            return text("Installation Git unavailable", 403);
+        if (incoming.headers.get("content-encoding") !== null)
+            return text("Compressed Git requests are not supported", 400);
+        const body = advertise ? null : await bodyOf(incoming);
         if (body instanceof Response)
             return body;
         const headers = {};
         for (const name of ["content-type", "accept", "git-protocol"]) {
-            const value = context.req.header(name);
-            if (value !== undefined)
+            const value = incoming.headers.get(name);
+            if (value !== null)
                 headers[name] = value;
         }
         const request = {
@@ -95,7 +97,7 @@ export function createGitDoor(host) {
             headers,
             body,
         };
-        const response = writing && writer !== null
+        const response = writing
             ? await git.push(writer, repository, request)
             : await git.read(writer, repository, request);
         return new Response(new Uint8Array(response.body), {
@@ -103,6 +105,5 @@ export function createGitDoor(host) {
             headers: response.headers,
         });
     };
-    door.all("/git/*", smartHttp);
-    return door;
+    return { fetch: smartHttp };
 }

package/dist/git.d.ts

@@ -23,7 +23,7 @@ export declare function signStandardWebhook(secret: string, id: string, timestam
 /** Headers for one signed delivery: Standard Webhooks plus `X-Hub-Signature-256`. */
 export declare function webhookHeaders(secret: string, id: string, type: string, timestamp: number, body: string): Promise<Record<string, string>>;
 export { createGitDoor, gitDoorRoute, smartHttpExchange } from "./git-door.js";
-export type { GitDoorHost, GitDoorTarget } from "./git-door.js";
+export type { GitDoor, GitDoorHost, GitDoorTarget } from "./git-door.js";
 export { createAdmittedGit, createInstallationGitAdmission, } from "./git-admission.js";
 export type { AdmittedGit, GitStore, GitGrants, GitPolicy, GitJournal, } from "./git-admission.js";
 export { createGitPushJournal } from "./git-journal.js";

package/dist/host.d.ts

@@ -13,13 +13,14 @@ import { type AppGitPushFact, type GitPushQuestion, type GitPushVerdict, type Gi
 import { type GuestLimits } from "./guest-policy.js";
 import { type InvocationFacts } from "./invocation.js";
 export type { GuestLimits } from "./guest-policy.js";
-import { Hono } from "hono";
 import { type TimingVariables } from "hono/timing";
 import * as Schema from "effect/Schema";
 import { type BackgroundSyncRefusal } from "@fungi.computer/puffball/background-replay";
 import { type Installation, type InstallationReader } from "./apps/installation.js";
+import { type ResourceOption } from "./apps/permissions.js";
 import type { AppToolPolicy } from "./apps/tools.js";
-import { type LiveOysterKey } from "./keys.js";
+import type { LiveOysterKey } from "./keys.js";
+import { type ServedTable, type RouteDeclaration, type Routes } from "./authorization.js";
 import { type AppMethodReply } from "@fungi.computer/agar/backend";
 import type { AppCapabilityId, HostActor } from "@fungi.computer/puffball/app";
 import { type CapabilityDescriptor } from "./capability-descriptor.js";
@@ -33,26 +34,6 @@ import type { AdmittedGit } from "./git-admission.js";
 import { type PageAssetLoader } from "./page-assets.js";
 import { type AppApi } from "@fungi.computer/puffball";
 export { ReleaseError, defaultAssetPolicy, parseRelease, resolveBackend, sha256, verifyRelease, type ArtifactStore, type VerifiedObjectCache, type VerifiedRelease, } from "./release.js";
-/**
- * The anonymous reader of a public installation. The host admits it only when
- * authentication refuses; it reaches that App's page and its `read` methods.
- */
-export type OysterVisitor = Readonly<{
-    actor: Readonly<{
-        kind: "visitor";
-    }>;
-}>;
-/** Who an admitted request acts for: an authenticated tenant principal or the visitor. */
-export type OysterPrincipal = TenantPrincipal | OysterVisitor;
-/** Narrow an admitted principal to the anonymous public reader. */
-export declare function oysterPrincipalIsVisitor(principal: OysterPrincipal): principal is OysterVisitor;
-/** True only for a member admitted with the owner role. */
-export declare function oysterPrincipalIsOwner(principal: OysterPrincipal): principal is Readonly<{
-    actor: Extract<HostActor, {
-        kind: "member";
-    }>;
-    role: "owner";
-}>;
 /** Stable actor identity for host storage and backend attribution. */
 export declare function oysterPrincipalId(principal: TenantPrincipal): string;
 /** The outcome of authenticating one request. */
@@ -86,6 +67,8 @@ export type InstallationStore = InstallationReader & Readonly<{
     operations?: InstallationOperations;
     /** Opaque identity of this store incarnation; replacing the store mints another. */
     generation: () => Promise<string>;
+    /** Registry-backed stores retain their reset audit; other hosts have none. */
+    resetAt?: () => Promise<number | null>;
     /**
      * Atomically commit one reducer-produced record only over the version it
      * was computed from (0: no record). Every writer reads, may await
@@ -170,17 +153,13 @@ export type CapabilityEnv = {
 export type OysterCapability = Readonly<CapabilityDescriptor & {
     /** The permission declared by an App Release to use this contract. */
     permission: AppCapabilityId;
-    /** Routes relative to the descriptor's base path. */
-    routes: Hono<CapabilityEnv>;
+    /** Declared routes relative to the descriptor's base path; each names
+     * its own requirement beyond the App holding this capability. */
+    routes: Routes<CapabilityEnv>;
 }>;
-/** What the host stamps once per request; inner routes read it with `c.get`. */
-export type OysterVariables = TimingVariables & {
-    principal: OysterPrincipal;
-    installation?: Installation;
-};
-/** Owner routes run after the host's owner guard and read `c.get("principal")`. */
+/** The host table's Hono env; every route receives its principal from its declared requirement. */
 export type OysterEnv = {
-    Variables: OysterVariables;
+    Variables: TimingVariables;
 };
 /** Everything a host supplies to run Oyster. */
 export type OysterHost = Readonly<{
@@ -193,9 +172,11 @@ export type OysterHost = Readonly<{
      * Host-bound Workflow control; absence exposes no Workflow authority.
      * @inlineType WorkflowControl
      */
-    workflows?: (principal: OysterPrincipal) => Promise<WorkflowControl | null>;
+    workflows?: (principal: TenantPrincipal) => Promise<WorkflowControl | null>;
     /** Owner-admitted durable Computer inventory, absent on hosts without a fleet. */
-    computerControl?: (principal: OysterPrincipal) => ComputerControlPort | null;
+    computerControl?: (principal: TenantPrincipal) => ComputerControlPort | null;
+    /** Owner-direct picker facts from the host's existing resource directories. */
+    permissionResources?: (principal: TenantPrincipal) => Promise<readonly ResourceOption[]>;
     auth: OysterAuth;
     /** Host-held sealing key for member writes; never exposed to the guest.
      * Absence refuses eligible named member writes, even when the App has no sync continuation.
@@ -215,7 +196,7 @@ export type OysterHost = Readonly<{
      * `computer.use` grant). The Computer owner accepts each call against the
      * authority the host issued.
      */
-    computer?: (principal: OysterPrincipal) => KnapsackComputer | null | Promise<KnapsackComputer | null>;
+    computer?: (principal: TenantPrincipal) => KnapsackComputer | null | Promise<KnapsackComputer | null>;
     /** Host-attested Agent tool policy; absence grants no App tool access. A
      * key's App access is its own grants (Ear Tag), read through `keys.live`
      * and `keyAppAccess`, never this port. */
@@ -233,9 +214,9 @@ export type OysterHost = Readonly<{
     mcp?: OysterMcp;
     /** The git door for Apps that use GIT; mounted at `/git/*`. */
     git?: OysterGitHost;
-    /** Owner-only `/api/*` routes the host adds (keys, webhooks); they read the
-     * admitted owner with `c.get("principal")` and never authenticate again. */
-    ownerRoutes?: Hono<OysterEnv>;
+    /** Further routes the host adds (keys, webhooks, builds); each declares
+     * its own requirement and receives the admitted principal from it. */
+    ownerRoutes?: Routes<OysterEnv>;
     /** Adapters granted only when the Release declares them and admission passes. */
     capabilities?: readonly OysterCapability[];
     /**
@@ -266,11 +247,23 @@ export type OysterHost = Readonly<{
     title?: string;
 }>;
 /** Completed selection, without re-deriving or executing outside Watchdog. */
-export declare function installOrSelect(host: OysterHost, installationId: string, release: Release, principal: OysterPrincipal, intent: "install-or-select" | "install-or-remint" | "create-only", origin: "owner-direct" | "workflow" | "app", requestId?: string, signal?: AbortSignal): Promise<Response>;
+export declare function installOrSelect(host: OysterHost, installationId: string, release: Release, principal: TenantPrincipal, intent: "install-or-select" | "install-or-remint" | "create-only", origin: "owner-direct" | "workflow" | "app", requestId?: string, signal?: AbortSignal): Promise<Response>;
+/** One host's declared routes and the one way to serve them. */
+export type OysterRouteTable = Readonly<{
+    /** Every route this host serves, each with its declared requirement. */
+    declarations: () => readonly RouteDeclaration[];
+    /** Serve the table; only declared routes answer. */
+    serve: () => ServedTable<OysterEnv>;
+}>;
 /**
- * Create the Oyster App server: a Hono app that installs App Releases, serves
+ * Create the Oyster App server: a served route table that installs App Releases, serves
  * their UI, forwards their backend requests and methods to their Instances,
  * and mounts the host's MCP endpoint. The host's adapters decide where state
  * lives and who may sign in.
  */
-export declare function createOyster(host: OysterHost): Hono<OysterEnv>;
+export declare function createOyster(host: OysterHost): ServedTable<OysterEnv>;
+/**
+ * The Oyster host's declared route table: every route names its requirement
+ * (`authorization.ts`), so an undeclared route is never served.
+ */
+export declare function oysterRouteTable(host: OysterHost): OysterRouteTable;