@fungi.computer/oyster 0.6.0 → 0.8.0

package/dist/standalone/machine-link.d.ts

@@ -2,6 +2,8 @@ import { createMachineEnrollment, type MachineEnrollment, type MachineLinkDevice
 import { type LiveOysterKey, type OysterKeyStore } from "../keys.js";
 import type { WatchdogSqliteOwner } from "@fungi.computer/watchdog";
 import { DurableObject } from "cloudflare:workers";
+import type { BlankEnv } from "hono/types";
+import { type Routes } from "../authorization.js";
 import { type MachineLinkAuthority, type MachineLinkFenceResult } from "../machine-link/index.js";
 import type { PostEnvelope, PostDeliveryResult } from "@fungi.computer/carrier/post";
 import type { MachineAgentOperation } from "@fungi.computer/seam/machine-link-protocol";
@@ -40,228 +42,9 @@ export declare function standaloneMachineJoinRoutes(options: {
         live(keyId: string): Promise<LiveOysterKey | null>;
     };
     enroll(keyId: string, input: MachineEnrollment): Promise<StandaloneMachineJoinResult>;
-}): import("hono/hono-base").HonoBase<import("hono/types").BlankEnv, {
-    "/local/mesh/join": {
-        $post: {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: null;
-            outputFormat: "body";
-            status: 403;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: {
-                error: string;
-            };
-            outputFormat: "json";
-            status: 400;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: null;
-            outputFormat: "body";
-            status: 401;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: {
-                error: "request_conflict" | "capacity";
-            };
-            outputFormat: "json";
-            status: 409;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: {
-                error: string;
-            };
-            outputFormat: "json";
-            status: 400;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: {
-                deviceId: string;
-                agents: {
-                    selection: number;
-                    agentId: string;
-                }[];
-                kind: string;
-                scopeId: string;
-            };
-            outputFormat: "json";
-            status: 200;
-        };
-    };
-}, "/", "/local/mesh/join">;
+}): Routes<BlankEnv>;
 /** Only join accepts an oyk credential; every subsequent dial uses Seam. */
-export declare function standaloneMachineLinkRoutes(env: StandaloneMachineLinkEnv): import("hono/hono-base").HonoBase<import("hono/types").BlankEnv, {
-    "/local/mesh/join": {
-        $post: {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: null;
-            outputFormat: "body";
-            status: 403;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: {
-                error: string;
-            };
-            outputFormat: "json";
-            status: 400;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: null;
-            outputFormat: "body";
-            status: 401;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: {
-                error: "request_conflict" | "capacity";
-            };
-            outputFormat: "json";
-            status: 409;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: {
-                error: string;
-            };
-            outputFormat: "json";
-            status: 400;
-        } | {
-            input: {
-                json: {
-                    requestId: string;
-                    publicKey: string;
-                    machineLabel: string;
-                    agents: {
-                        name: string;
-                    }[];
-                };
-            };
-            output: {
-                deviceId: string;
-                agents: {
-                    selection: number;
-                    agentId: string;
-                }[];
-                kind: string;
-                scopeId: string;
-            };
-            outputFormat: "json";
-            status: 200;
-        };
-    };
-} & {
-    "/api/teams/:teamId/local/mesh/:deviceId/connect": {
-        $get: {
-            input: {
-                param: {
-                    teamId: string;
-                } & {
-                    deviceId: string;
-                };
-            };
-            output: {};
-            outputFormat: string;
-            status: import("hono/utils/http-status").StatusCode;
-        };
-    };
-}, "/", "/api/teams/:teamId/local/mesh/:deviceId/connect">;
+export declare function standaloneMachineLinkRoutes(env: StandaloneMachineLinkEnv): Routes<BlankEnv>;
 /** One device's link; directory, credentials and owner state remain elsewhere. */
 export declare class MachineLinkDO extends DurableObject<StandaloneMachineLinkEnv> {
     private readonly link;

package/dist/standalone/machine-link.js

@@ -1,11 +1,10 @@
 import { machineAgentCodecs, machineAgentReservations, } from "@fungi.computer/shiitake/delegation";
 import { createMachineEnrollment, MachineEnrollmentRefused, MachineLinkRefused, } from "../machine-link/index.js";
-import { keyAllowsMachineEnroll, } from "../keys.js";
+import {} from "../keys.js";
 import { agentIds, createAgentDirectory, } from "@fungi.computer/shiitake/fleet";
 import { DurableObject } from "cloudflare:workers";
-import { Hono } from "hono";
+import { allowsMachineEnrollment, door, routes, } from "../authorization.js";
 import { bodyLimit } from "hono/body-limit";
-import { validator } from "hono/validator";
 import { machineEnrollmentSchema, machineLinkName, } from "../machine-link/index.js";
 import { createMachineLink } from "../machine-link/workers.js";
 import { deliverUndeliverableMail } from "../machine-link/delivery.js";
@@ -123,12 +122,19 @@ export function standaloneMachineLinkAuthority(env) {
 export function standaloneMachineJoinRoutes(options) {
     const { scope } = options;
     const teamId = scope.durableName("agents");
-    return new Hono().post("/local/mesh/join", bodyLimit({ maxSize: 512 * 1024 }), validator("json", (value, context) => {
-        const parsed = machineEnrollmentSchema.safeParse(value);
-        return parsed.success
-            ? parsed.data
-            : context.json({ error: "invalid_enrollment" }, 400);
-    }), async (context) => {
+    return routes().post("/local/mesh/join", door("an oyk key whose only grant is machine.enroll, verified here"), async (context) => {
+        let body;
+        try {
+            body = await context.req.json();
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError))
+                throw error;
+            return context.json({ error: "invalid_enrollment" }, 400);
+        }
+        const enrollment = machineEnrollmentSchema.safeParse(body);
+        if (!enrollment.success)
+            return context.json({ error: "invalid_enrollment" }, 400);
         if (new URL(context.req.url).origin !== scope.origin)
             return context.body(null, 403);
         const ownerId = await options.ownerId();
@@ -142,9 +148,9 @@ export function standaloneMachineJoinRoutes(options) {
         if (verified.kind !== "ok")
             return context.body(null, 401);
         const live = await keys.live(verified.value.keyId);
-        if (live?.owner !== ownerId || !keyAllowsMachineEnroll(live))
+        if (live?.owner !== ownerId || !allowsMachineEnrollment(live))
             return context.body(null, 403);
-        const joined = await options.enroll(live.keyId, context.req.valid("json"));
+        const joined = await options.enroll(live.keyId, enrollment.data);
         // Domain refusals cross RPC as data, not an instanceof claim about a
         // platform-reconstructed Error.
         if (joined.kind === "refused") {
@@ -155,7 +161,7 @@ export function standaloneMachineJoinRoutes(options) {
             return context.body(null, 403);
         }
         return context.json({ kind: "joined", scopeId: teamId, ...joined.value }, 200);
-    });
+    }, { middleware: [bodyLimit({ maxSize: 512 * 1024 })] });
 }
 /** Only join accepts an oyk credential; every subsequent dial uses Seam. */
 export function standaloneMachineLinkRoutes(env) {
@@ -166,7 +172,7 @@ export function standaloneMachineLinkRoutes(env) {
         ownerId: async () => (await liveOwner(env))?.actor.memberId ?? null,
         keys: () => env.KEYS.getByName(scope.durableName("keys")),
         enroll: (keyId, input) => env.AGENT_DIRECTORY.getByName(teamId).enrollMachine(keyId, input),
-    }).get("/api/teams/:teamId/local/mesh/:deviceId/connect", async (context) => {
+    }).get("/api/teams/:teamId/local/mesh/:deviceId/connect", door("a live enrolled device; its link verifies Seam on every dial"), async (context) => {
         const id = {
             teamId: context.req.param("teamId"),
             deviceId: context.req.param("deviceId"),
@@ -366,7 +372,7 @@ export function createStandaloneMachineEnrollment(options) {
             const key = await options.liveKey(keyId);
             if (memberId === null ||
                 key?.owner !== memberId ||
-                !keyAllowsMachineEnroll(key))
+                !allowsMachineEnrollment(key))
                 throw new MachineLinkRefused("actor_not_allowed");
             // This wrapper is per call: concurrent joins never share a mutable key
             // slot. createMachineEnrollment invokes it only around its synchronous
@@ -398,7 +404,7 @@ export function createStandaloneMachineEnrollment(options) {
                 authorizeMember: async (member) => {
                     await configured.authorizeMember(member);
                     const current = await options.liveKey(keyId);
-                    if (current?.owner !== member || !keyAllowsMachineEnroll(current))
+                    if (current?.owner !== member || !allowsMachineEnrollment(current))
                         throw new MachineLinkRefused("actor_not_allowed");
                 },
             }).enroll({ memberId, clientId: "oyster-key", loginId: key.keyId }, input);

package/dist/standalone/media.d.ts

@@ -41,6 +41,7 @@ export declare const mediaFrameMethods: {
                     aspectRatio?: "16:9" | "4:3" | "1:1" | "3:4" | "9:16" | "21:9" | "9:21" | undefined;
                     references?: {
                         path: string;
+                        computerId?: string | undefined;
                         role?: "reference" | "first-frame" | "last-frame" | undefined;
                     }[] | undefined;
                     generateAudio?: boolean | undefined;

package/dist/standalone/media.js

@@ -2,30 +2,31 @@ import { z } from "zod";
 import { MAX_REFERENCE_BYTES, MediaSettingsError, } from "@fungi.computer/darkroom";
 import { AppInstanceError } from "../index.js";
 import { readMediaFailure } from "@fungi.computer/darkroom/browser";
-import { appMediaGenerationResultSchema } from "@fungi.computer/darkroom/app-media-contracts";
+import { appMediaGenerationResultSchema, mediaModelsSchema, } from "@fungi.computer/darkroom/app-media-contracts";
 import { mediaSlot } from "../media.js";
-import { Hono } from "hono";
+import { computer, routes as routeTable } from "../authorization.js";
 import * as Schema from "effect/Schema";
 import { pendingSchema } from "@fungi.computer/agar/backend-definition";
 import { mediaGenerationDescriptionSchema, mediaGenerationJsonRequestSchema, mediaGenerationReferenceSchema, } from "@fungi.computer/agar/media-json";
-import { createMediaService, mediaPendingSchema, mediaResultSchema, mediaBindingCallSchema, mediaBindingRequest, parseMediaBindingCall, readMediaBindingReply, } from "@fungi.computer/darkroom/server";
+import { createMediaService, estimateMediaModel, mediaPendingSchema, mediaResultSchema, mediaBindingCallSchema, mediaBindingRequest, parseMediaBindingCall, readMediaBindingReply, } from "@fungi.computer/darkroom/server";
 import { createWorkersAiMediaProvider, createImagesReferenceFitter, } from "@fungi.computer/darkroom/cloudflare";
 import { oysterPrincipalId, } from "../host.js";
 import { normalizeFilePath } from "../files.js";
 /** Media capability using Darkroom execution and the existing workspace FileSource. */
 export function workersMedia(env, workspace) {
     const { computerId } = workspace;
-    const routes = new Hono();
+    // Media reads and writes the Computer's workspace: a key needs `computer.use`.
+    const routes = routeTable();
     const service = (principal) => standaloneMediaService(env, oysterPrincipalId(principal), workspace);
-    routes.get("/describe", async (context) => {
-        const response = await service(context.env.principal).request("http://media/models");
+    routes.get("/describe", computer(), async (context, { principal }) => {
+        const response = await service(principal).request("http://media/models");
         return context.json(Schema.decodeUnknownSync(mediaGenerationDescriptionSchema)({
             computerId,
             canGenerate: true,
             models: await response.json(),
         }));
     });
-    routes.post("/generate", async (context) => {
+    routes.post("/generate", computer(), async (context, { principal }) => {
         const input = Schema.decodeUnknownOption(Schema.fromJsonString(mediaGenerationJsonRequestSchema), { onExcessProperty: "error" })(await context.req.text());
         if (input._tag === "None")
             return context.json(invalidRequest());
@@ -33,13 +34,13 @@ export function workersMedia(env, workspace) {
         if (path === null || path === "/")
             return context.json(invalidRequest());
         const references = input.value.settings.references?.map((reference) => ({
-            ...reference,
             computerId,
+            ...reference,
             path: normalizeFilePath(reference.path),
         }));
         if (references?.some((reference) => reference.path === null || reference.path === "/"))
             return context.json(invalidRequest());
-        const response = await service(context.env.principal).request("http://media/generate", {
+        const response = await service(principal).request("http://media/generate", {
             method: "POST",
             signal: context.req.raw.signal,
             headers: {
@@ -88,7 +89,7 @@ export function workersMedia(env, workspace) {
             },
         });
     });
-    routes.post("/cancel-attempt", async (context) => {
+    routes.post("/cancel-attempt", computer(), async (context) => {
         const reference = Schema.decodeUnknownOption(Schema.fromJsonString(mediaGenerationReferenceSchema), { onExcessProperty: "error" })(await context.req.text());
         if (reference._tag === "None" || reference.value.computerId !== computerId)
             return context.json({ error: "Invalid workspace media reference" }, 400);
@@ -138,7 +139,7 @@ function standaloneMediaService(env, actorId, workspace, owner = "owner", librar
         ? destination
         : {
             ...destination,
-            readReference: async (reference) => {
+            readReference: async (reference, model) => {
                 if (reference.computerId !== computerId)
                     throw new MediaSettingsError("reference Computer is not selected");
                 const bytes = await files.read(workspacePath(reference.path));
@@ -147,7 +148,7 @@ function standaloneMediaService(env, actorId, workspace, owner = "owner", librar
                     bytes.byteLength > MAX_REFERENCE_BYTES)
                     throw new MediaSettingsError("reference image is unavailable or exceeds the byte limit");
                 return {
-                    ...(await fit(bytes)),
+                    ...(await fit(bytes, model)),
                     filename: reference.path.split("/").at(-1) ?? "reference",
                 };
             },
@@ -201,8 +202,13 @@ export async function dispatchMediaBinding(env, frame, props, method, args, work
     const input = parsed.call;
     const service = standaloneMediaService(env, actorId, workspace, frame.facts.selection.owner.id, input.operation === "generate" ? input.input.libraryPath : undefined);
     let response;
-    if (input.operation === "models")
-        response = await service.request("/models");
+    if (input.operation === "models") {
+        const catalog = await service.request("/models");
+        response = Response.json(mediaModelsSchema.parse(await catalog.json()).map((model) => ({
+            ...model,
+            priceEstimate: estimateMediaModel(model),
+        })));
+    }
     else {
         const body = mediaBindingRequest(input.input, workspace.computerId);
         const generated = await service.request("/generate", {

package/dist/standalone/owner-routes.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The standalone root's owner routes: App source seeding, builds, the Computer
+ * fleet, Agent Computer attachment and Workflow webhook controls. The Worker
+ * and the authorization law both compose them from this one function.
+ */
+import type { OysterEnv, OysterHost } from "../host.js";
+import type { Routes } from "../authorization.js";
+import type { TenantScope } from "../tenant.js";
+import type { StandaloneAgentsEnv } from "./agents.js";
+import { type AppSourceBindingEnv } from "./app-source.js";
+import type { StandaloneComputerEnv } from "./computer.js";
+import type { StandaloneWorkflowEnv } from "./workflows.js";
+/** The bindings the standalone owner routes reach, resolved per request. */
+export type StandaloneOwnerRoutesEnv = AppSourceBindingEnv & Pick<StandaloneComputerEnv, "REGISTRY"> & Pick<StandaloneAgentsEnv, "AGENT_DIRECTORY"> & Pick<StandaloneWorkflowEnv, "WORKFLOW_RUNS">;
+/** Every owner route the standalone root adds to its tenant host. */
+export declare function standaloneOwnerRoutes(env: StandaloneOwnerRoutesEnv, scope: TenantScope, hostFor: () => Promise<Pick<OysterHost, "installations">>): Routes<OysterEnv>;

package/dist/standalone/owner-routes.js

@@ -0,0 +1,21 @@
+import { agentDirectoryForScope } from "./agent-directory.js";
+import { standaloneAgentComputerRoutes } from "./agent-computers.js";
+import { appSourceOwnerRoutes, } from "./app-source.js";
+import { standaloneBuildRoutes } from "./builds.js";
+import { standaloneComputerFleetRoutes } from "./computer-fleet.js";
+import { standaloneWorkflowWebhookControls } from "./workflow-webhooks.js";
+/** Every owner route the standalone root adds to its tenant host. */
+export function standaloneOwnerRoutes(env, scope, hostFor) {
+    // A tenant's registry owns its installations, builds and Computer fleet.
+    const registry = () => env.REGISTRY.getByName(scope.durableName("registry"));
+    const directory = () => agentDirectoryForScope(env, scope);
+    return appSourceOwnerRoutes(env, scope)
+        .include(standaloneBuildRoutes(registry))
+        .include(standaloneComputerFleetRoutes(registry))
+        .include(standaloneAgentComputerRoutes({
+        attach: (principal, command) => directory().attachComputer(command, principal, scope.tenantId),
+        detach: (principal, command) => directory().detachComputer(command, principal, scope.tenantId),
+        read: (principal, agentId) => directory().readAgentComputers(agentId, principal, scope.tenantId),
+    }))
+        .include(standaloneWorkflowWebhookControls(env, hostFor));
+}

package/dist/standalone/permission-resources.d.ts

@@ -0,0 +1,5 @@
+import type { OysterHost } from "../host.js";
+import type { OysterAgents } from "../agents.js";
+import type { StandaloneRegistryRpc } from "./registry.js";
+/** The existing owner picker includes its configured Computer as well as the fleet. */
+export declare function standalonePermissionResources(registry: Pick<StandaloneRegistryRpc, "computerFleet">, agents: Pick<OysterAgents, "list">): NonNullable<OysterHost["permissionResources"]>;

package/dist/standalone/permission-resources.js

@@ -0,0 +1,31 @@
+import { HTTPException } from "hono/http-exception";
+import { workbenchComputerDirectorySchema } from "@fungi.computer/nacre/workbench-directory";
+import { oysterPrincipalIsOwner } from "../authorization.js";
+/** The existing owner picker includes its configured Computer as well as the fleet. */
+export function standalonePermissionResources(registry, agents) {
+    return async (principal) => {
+        if (!oysterPrincipalIsOwner(principal))
+            throw new HTTPException(403, { message: "Owner only" });
+        const resources = (await agents.list()).map((agent) => ({
+            kind: "agent",
+            id: agent.agentId,
+            label: agent.name,
+        }));
+        // Follow the native picker cursor, as inventory.ids() does for inventory.
+        // A transport failure refuses the read; it is never an empty directory.
+        let offset = 0;
+        while (offset !== null) {
+            const page = workbenchComputerDirectorySchema.parse(await registry.computerFleet(principal.actor.memberId, {
+                operation: "choices",
+                page: { offset, limit: 100 },
+            }));
+            resources.push(...page.computers.map((computer) => ({
+                kind: "computer",
+                id: computer.computerId,
+                label: computer.name,
+            })));
+            offset = page.nextOffset;
+        }
+        return resources;
+    };
+}

package/dist/standalone/registry.d.ts

@@ -179,6 +179,13 @@ export declare abstract class StandaloneRegistry extends OysterRegistry implemen
         appId: import("@fungi.computer/puffball").AppId;
     } | null>;
     readBuild(jobId: string): Promise<OysterBuildView | null>;
+    readBuildLog(jobId: string): Promise<{
+        readonly encoding: "base64url";
+        readonly output: string;
+        readonly truncated: {
+            readonly droppedBytes: number;
+        } | null;
+    } | null>;
     /** A job ID alone never grants another installation access to its status. */
     readInstallationBuild(installationId: string, jobId: string): Promise<OysterBuildView | null>;
     /** Repository status belongs to the same captured Git owner as registration. */

package/dist/standalone/registry.js

@@ -372,6 +372,9 @@ export class StandaloneRegistry extends OysterRegistry {
     async readBuild(jobId) {
         return (await this.#appBuilds()).read(jobId);
     }
+    async readBuildLog(jobId) {
+        return (await this.#appBuilds()).readLog(jobId);
+    }
     /** A job ID alone never grants another installation access to its status. */
     async readInstallationBuild(installationId, jobId) {
         const builds = await this.#appBuilds();

package/dist/standalone/tenancy.d.ts

@@ -1,6 +1,5 @@
 import { TenancyRegistryDO } from "../tenancy/cloudflare.js";
 import { type Identity, type Tenant, type ReadonlyTenancy } from "../tenancy/index.js";
-import { type OysterKeySessionResolver } from "../auth.js";
 import type { OysterGitWorkerEnv } from "../workers-git.js";
 import { type OysterTenancy, type TenantId } from "../tenant.js";
 /** Trusted standalone provisioning inputs; credentials never enter the seed. */
@@ -29,8 +28,6 @@ export declare class StandaloneTenants extends TenancyRegistryDO {
 /** The same trusted bindings are used by HTTP, MCP and cold root readers. */
 export type StandaloneTenancyEnv = Pick<OysterGitWorkerEnv, "OYSTER_ORIGIN" | "OYSTER_OWNER_NAME" | "OYSTER_OWNER_KEY" | "KEYS"> & Readonly<{
     TENANTS: DurableObjectNamespace<StandaloneTenants>;
-    /** Optional host-owned named-key browser sessions; Oyster mints none. */
-    OYSTER_KEY_SESSIONS?: OysterKeySessionResolver;
 }>;
 /** A live registry-owned owner; the configured label is never its member ID. */
 export type StandaloneOwner = Readonly<{

package/dist/standalone/tenancy.js

@@ -2,7 +2,7 @@ import { TenancyRegistryDO, admittedRegistry, durableObjectRegistry, } from "../
 import { createTenancy, } from "../tenancy/index.js";
 import { ownerKey } from "../tenancy/owner-key.js";
 import { hosts } from "../tenancy/resolve.js";
-import { keySessionAuth, ownerOrKeyAuth, } from "../auth.js";
+import { ownerOrKeyAuth } from "../auth.js";
 import { HTTPException } from "hono/http-exception";
 import { defaultTenant, tenantScope, } from "../tenant.js";
 import * as Schema from "effect/Schema";
@@ -174,10 +174,7 @@ async function composeTenancy(env) {
                         if (owner === null)
                             return { kind: "refused", status: 403 };
                         const keys = () => env.KEYS.getByName(scope.durableName("keys"));
-                        const namedKeyAuth = ownerOrKeyAuth(env.OYSTER_OWNER_KEY, owner.actor.memberId, keys);
-                        const auth = env.OYSTER_KEY_SESSIONS === undefined
-                            ? namedKeyAuth
-                            : keySessionAuth(namedKeyAuth, owner.actor.memberId, keys, env.OYSTER_KEY_SESSIONS);
+                        const auth = ownerOrKeyAuth(env.OYSTER_OWNER_KEY, owner.actor.memberId, keys);
                         const admission = await auth.authenticate(request);
                         // This entry admits only named keys; the owner key has its own entry.
                         return admission.kind === "admitted" &&

package/dist/standalone/worker-routes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The standalone Worker's top-level table, before any tenant is selected:
+ * device enrollment and links, signed Workflow webhook delivery, then the
+ * selected tenant's own declared host table for every other path. The Worker
+ * and the authorization law both compose it here.
+ */
+import type { BlankEnv } from "hono/types";
+import { type Routes } from "../authorization.js";
+/** What the Worker-top doors forward to. */
+export type StandaloneWorkerRoutePorts = Readonly<{
+    /** The machine-link doors' own table, served for this request. */
+    machineLink: (request: Request) => Promise<Response>;
+    /** Signed Workflow webhook delivery, verified by the library's run owner. */
+    workflowWebhooks: Routes<BlankEnv>;
+    /** The selected tenant's declared host table. */
+    tenant: (request: Request) => Promise<Response>;
+}>;
+/** The Worker-top table; `serveDoors` serves it, so no route admits a principal. */
+export declare function standaloneWorkerRoutes(ports: StandaloneWorkerRoutePorts): Routes<BlankEnv>;

package/dist/standalone/worker-routes.js

@@ -0,0 +1,9 @@
+import { door, routes } from "../authorization.js";
+/** The Worker-top table; `serveDoors` serves it, so no route admits a principal. */
+export function standaloneWorkerRoutes(ports) {
+    return routes()
+        .all("/local/mesh/join", door("machine enrollment; the join route verifies its key"), (context) => ports.machineLink(context.req.raw))
+        .all("/api/teams/:teamId/local/mesh/:deviceId/connect", door("a machine link; the device's link verifies Seam"), (context) => ports.machineLink(context.req.raw))
+        .include(ports.workflowWebhooks)
+        .all("*", door("the selected tenant's own declared host table"), (context) => ports.tenant(context.req.raw));
+}

package/dist/standalone/worker.d.ts

@@ -17,7 +17,7 @@ export { StandaloneTenants } from "./tenancy.js";
 import { type StandaloneMachineLinkBindings } from "./machine-link.js";
 export { MachineLinkDO } from "./machine-link.js";
 import { type OysterComputerEgressProps } from "./computer-egress.js";
-import { type AppSourceBindingEnv } from "./app-source.js";
+import type { AppSourceBindingEnv } from "./app-source.js";
 export { StandaloneGraphWorkflow } from "./workflows.js";
 export { MediaOperationDO } from "@fungi.computer/darkroom/cloudflare";
 /** Every binding the standalone Bonsai root receives. */