@fungi.computer/oyster 0.6.0 → 0.8.0

package/dist/host.js

@@ -11,8 +11,7 @@ import { appStorageKeyNameSchema, appStorageWriteSchema, appStorageResetSchema,
 import { guestLimits } from "./guest-policy.js";
 import { APP_INVOCATION_CEILING_MS, admittedCallerFacts, admittedMethodCallerFacts, invocationAuthorityOf, invocationCallerContext, invocationFacts, } from "./invocation.js";
 import { appFacetResponse } from "./backend-request.js";
-import { Hono } from "hono";
-import { endTime, startTime, timing } from "hono/timing";
+import { endTime, startTime } from "hono/timing";
 import { bodyLimit } from "hono/body-limit";
 import { match } from "path-to-regexp";
 import * as Schema from "effect/Schema";
@@ -21,7 +20,7 @@ import { emptyAppDeclaration } from "@fungi.computer/puffball/app";
 import { applyInstallationCommand, installationIdSchema, } from "./apps/installation.js";
 import { admits, scopedBindings, grantsFor } from "./apps/gate.js";
 import { appPermissionPageSchema, permissionSaveSchema, } from "./apps/permissions.js";
-import { keyAppAccess } from "./keys.js";
+import { app as appRoute, apps as appsRoute, door, member, oysterPrincipalIsOwner, owner, publicRoute, authorityOf, hostAuthorityPorts, reachesInstallation, routes, serveCapability, serveHost, } from "./authorization.js";
 import { deriveDeclaredOperations, appCallOperation, } from "./apps/operations.js";
 import { appBackendActorHeader, appBackendComputerHeader, appMethodRefusalStatus, } from "@fungi.computer/agar/backend";
 import { appCallsDescriptor, } from "./capability-descriptor.js";
@@ -40,15 +39,8 @@ import { Form, Field, FormFooter } from "@fungi.computer/caps/components/field";
 import { Input } from "@fungi.computer/caps/components/input";
 import { Button } from "@fungi.computer/caps/components/button";
 import { parseArtifactRef } from "@fungi.computer/puffball";
+import { isBuildJobLogRef } from "./build/job-log.js";
 export { ReleaseError, defaultAssetPolicy, parseRelease, resolveBackend, sha256, verifyRelease, } from "./release.js";
-/** Narrow an admitted principal to the anonymous public reader. */
-export function oysterPrincipalIsVisitor(principal) {
-    return principal.actor.kind === "visitor";
-}
-/** True only for a member admitted with the owner role. */
-export function oysterPrincipalIsOwner(principal) {
-    return "role" in principal && principal.role === "owner";
-}
 /** Stable actor identity for host storage and backend attribution. */
 export function oysterPrincipalId(principal) {
     switch (principal.actor.kind) {
@@ -87,9 +79,6 @@ function escapeHtml(value) {
         .replaceAll(">", ">")
         .replaceAll('"', """);
 }
-const visibilitySchema = Schema.Struct({
-    visibility: Schema.Literals(["private", "public"]),
-});
 function refusal(status, error, retryAfter) {
     const init = { status };
     if (retryAfter !== undefined)
@@ -138,8 +127,8 @@ function methodResponse(reply) {
  * designated install authority.
  */
 async function admitInstallation(host, installationId, release, principal, intent, origin, requestId = installationCommandIds.request.generate()) {
-    // App-mediated installation needs installFree/designated-marketplace
-    // authority. A member's owner role is not that delegated App authority.
+    // App-mediated installation has no owner-confirmation flow here, so refuse
+    // it. A member's owner role is not delegated App install authority.
     if (origin !== "owner-direct" && origin !== "workflow")
         return refusal(403, "install_authority_unavailable");
     if (!oysterPrincipalIsOwner(principal))
@@ -195,27 +184,32 @@ export async function installOrSelect(host, installationId, release, principal,
 /** The tab icon of every Oyster page a person opens at the top level. */
 const tabIcon = `<link rel="icon" type="image/svg+xml" href="${fungiFaviconHref}">`;
 /**
- * Create the Oyster App server: a Hono app that installs App Releases, serves
+ * Create the Oyster App server: a served route table that installs App Releases, serves
  * their UI, forwards their backend requests and methods to their Instances,
  * and mounts the host's MCP endpoint. The host's adapters decide where state
  * lives and who may sign in.
  */
 export function createOyster(host) {
+    return oysterRouteTable(host).serve();
+}
+/**
+ * The Oyster host's declared route table: every route names its requirement
+ * (`authorization.ts`), so an undeclared route is never served.
+ */
+export function oysterRouteTable(host) {
     const limits = guestLimits(host.guestLimits);
-    const app = new Hono();
-    // Server-Timing names the Durable Object hops a request waited on.
-    // An upgraded socket keeps its response untouched.
-    app.use(timing({
-        totalDescription: "Oyster",
-        enabled: (context) => context.res.status !== 101,
-    }));
-    // A forwarded Durable Object or fetch response has immutable headers;
-    // give the timing middleware a copy it can append Server-Timing to.
-    app.use(async (context, next) => {
-        await next();
-        if (context.res.status !== 101)
-            context.res = new Response(context.res.body, context.res);
-    });
+    const table = routes();
+    // One authentication per request, shared by its requirement and its door.
+    const authentications = new WeakMap();
+    const authenticate = (request) => {
+        let result = authentications.get(request);
+        if (result === undefined) {
+            result = host.auth.authenticate(request);
+            authentications.set(request, result);
+        }
+        return result;
+    };
+    const ports = hostAuthorityPorts(host);
     const releaseOf = releaseCache(host.artifacts);
     const operationDescriptors = host.capabilities ?? [];
     const gateFacts = (installation, release, principal) => hostGateFacts(host, installation, release, principal);
@@ -248,17 +242,15 @@ export function createOyster(host) {
         source,
     });
     const prepareAssets = async () => {
-        const { pageScript, publicHomeScript, grantConsentScript, fontStyles, loginFontStyles, shellStyles, } = await (host.pageAssets ?? loadPageAssets)();
+        const { pageScript, grantConsentScript, fontStyles, loginFontStyles, shellStyles, } = await (host.pageAssets ?? loadPageAssets)();
         return Promise.all([
             asset("page.js", "text/javascript; charset=utf-8", host.pageScript ?? pageScript),
-            asset("public-home.js", "text/javascript; charset=utf-8", publicHomeScript),
             asset("grant-consent.js", "text/javascript; charset=utf-8", grantConsentScript),
             asset("fonts.css", "text/css; charset=utf-8", fontStyles),
             asset("login-fonts.css", "text/css; charset=utf-8", loginFontStyles),
             asset("styles.css", "text/css; charset=utf-8", shellStyles),
-        ]).then(([page, publicHome, grantConsent, fonts, loginFonts, styles]) => ({
+        ]).then(([page, grantConsent, fonts, loginFonts, styles]) => ({
             page,
-            publicHome,
             grantConsent,
             fonts,
             loginFonts,
@@ -275,22 +267,10 @@ export function createOyster(host) {
     // An Oyster is a private instance, never a search result: every response
     // says so, and robots.txt is public so crawlers read the rule rather than a
     // 401 (which Google treats as "crawl everything").
-    app.use("*", async (context, next) => {
-        await next();
-        try {
-            context.res.headers.set("X-Robots-Tag", "noindex, nofollow");
-        }
-        catch (cause) {
-            // Fetched responses (proxied Apps, the git door) have immutable headers.
-            if (!(cause instanceof TypeError))
-                throw cause;
-            const { body, status, statusText, headers } = context.res;
-            const marked = new Headers(headers);
-            marked.set("X-Robots-Tag", "noindex, nofollow");
-            context.res = new Response(body, { status, statusText, headers: marked });
-        }
+    const noIndex = () => ({
+        "X-Robots-Tag": "noindex, nofollow",
     });
-    app.get("/robots.txt", () => new Response("User-agent: *\nDisallow: /\n", {
+    table.get("/robots.txt", publicRoute("the crawl rule for a private instance"), () => new Response("User-agent: *\nDisallow: /\n", {
         headers: {
             "Content-Type": "text/plain; charset=utf-8",
             "Cache-Control": "public, max-age=3600",
@@ -300,7 +280,7 @@ export function createOyster(host) {
     // own URL: released Oyster 0.2.0 served that URL immutable, so a browser may
     // hold a copy it would import without a request. The entry is never cached
     // and rechecks current approval before it names the module.
-    app.get(`/ui-entry/:installationId/:releaseId${shellModuleAssetPath}`, async (context) => {
+    table.get(`/ui-entry/:installationId/:releaseId${shellModuleAssetPath}`, publicRoute("never cached; rechecks the shell's approval before naming it"), async (context) => {
         const installation = await host.installations.get(context.req.param("installationId"));
         if (installation?.status !== "enabled" ||
             installation.release.releaseId !== context.req.param("releaseId"))
@@ -322,7 +302,7 @@ export function createOyster(host) {
     });
     // App UI: digest-pinned, sandboxed, and readable without a session because
     // the opaque-origin frame cannot carry one.
-    app.get("/ui/:installationId/:releaseId/*", async (context) => {
+    table.get("/ui/:installationId/:releaseId/*", publicRoute("digest-pinned App bytes for an opaque-origin frame"), async (context) => {
         startTime(context, "registry");
         const installation = await host.installations.get(context.req.param("installationId"));
         endTime(context, "registry");
@@ -373,7 +353,7 @@ export function createOyster(host) {
             },
         });
     });
-    app.get("/_oyster/assets/*", async (context) => {
+    table.get("/_oyster/assets/*", publicRoute("content-addressed host page assets"), async (context) => {
         const wanted = new URL(context.req.url).pathname;
         const found = Object.values(await assets()).find(({ path }) => path === wanted);
         if (found === undefined)
@@ -386,7 +366,7 @@ export function createOyster(host) {
             },
         });
     });
-    app.get("/login", async () => {
+    table.get("/login", publicRoute("the sign-in form"), async () => {
         const { loginFonts, styles } = await assets();
         const form = renderToStaticMarkup(createElement(CenteredCard, null, createElement(CardHeader, null, createElement(CardTitle, { level: 2 }, "Sign in")), createElement(CardContent, null, createElement(Form, { method: "post", action: "/login" }, createElement(Field, {
             label: "Owner key",
@@ -405,16 +385,16 @@ export function createOyster(host) {
             },
         });
     });
-    app.post("/login", (context) => host.auth.login === undefined
+    table.post("/login", door("the host's own sign-in checks the posted key"), (context) => host.auth.login === undefined
         ? refusal(404, "Sign-in is not available")
         : host.auth.login(context.req.raw));
     if (host.mcp !== undefined) {
         const mcp = host.mcp;
-        app.all("/mcp", (context) => mcp.handleRequest(context.req.raw));
+        table.all("/mcp", door("MCP authenticates every request; tools read this module's reach"), (context) => mcp.handleRequest(context.req.raw));
     }
     if (host.git !== undefined) {
         const git = host.git;
-        app.route("/", createGitDoor({
+        const gitDoor = createGitDoor({
             authenticate: async (request, target) => {
                 // A Workflow Git pass header is admitted only by the pass port,
                 // never as a session or key.
@@ -430,80 +410,27 @@ export function createOyster(host) {
                     return git.buildPass === undefined
                         ? null
                         : git.buildPass(presented.value, target);
-                const result = await host.auth.authenticate(request);
+                // A signed-in key reaches only the installations its grants
+                // name: clone needs App read, push App use. Otherwise the door
+                // refuses it.
+                const result = await authenticate(request);
                 if (result.kind !== "admitted")
                     return null;
-                // A named key signs Git in only where its own grants reach that
-                // App: a clone needs App read, a push App use. Otherwise it is
-                // anonymous, which reaches only a public repository's reads.
-                const { actor } = result.principal;
-                if (actor.kind === "team-key") {
-                    const key = (await host.keys?.live(actor.keyId)) ?? null;
-                    const access = key === null ? null : keyAppAccess(key, target.installationId);
-                    if (access === null ||
-                        (target.scope === "write" && access.level !== "write"))
-                        return null;
-                }
-                return git.writerOf(result.principal);
+                const installation = await host.installations.get(target.installationId);
+                return installation !== null &&
+                    (await reachesInstallation(await authorityOf(result.principal, ports), installation, target.scope === "write" ? "use" : "read", ports))
+                    ? git.writerOf(result.principal)
+                    : null;
             },
-            isPublic: async (installationId) => (await host.installations.get(installationId))?.visibility ===
-                "public",
             git: async (installationId) => {
                 const installation = await host.installations.get(installationId);
                 if (installation?.status !== "enabled")
                     return null;
                 return git.git(installation);
             },
-        }));
+        });
+        table.all("/git/*", door("Git passes and keys; a key's reach is checked per installation"), (context) => gitDoor.fetch(context.req.raw));
     }
-    // A public installation's page and read methods admit anonymous visitors.
-    const visitor = { actor: { kind: "visitor" } };
-    const visitorRoute = /^\/apps\/([^/]+)\/(?:|methods\/([A-Za-z0-9_.]+))$/u;
-    const visitorMayReach = async (request) => {
-        const match = visitorRoute.exec(new URL(request.url).pathname);
-        if (match === null)
-            return null;
-        const [, installationId = "", method] = match;
-        const page = method === undefined;
-        if (page ? request.method !== "GET" : request.method !== "POST")
-            return null;
-        const installation = await host.installations.get(installationId);
-        if (installation?.status !== "enabled" ||
-            installation.visibility !== "public")
-            return null;
-        if (page)
-            return installation;
-        const release = await releaseOf(installation.release);
-        return release.api?.methods[method]?.effect === "read"
-            ? installation
-            : null;
-    };
-    // The public home and public App reads admit visitors; other routes require authentication.
-    app.use("*", async (context, next) => {
-        const result = await host.auth.authenticate(context.req.raw);
-        const installation = result.kind === "refused" ? await visitorMayReach(context.req.raw) : null;
-        if (result.kind === "refused" &&
-            (result.status === 401 || result.status === 403) &&
-            ((context.req.method === "GET" && context.req.path === "/") ||
-                installation !== null)) {
-            if (installation !== null)
-                context.set("installation", installation);
-            context.set("principal", visitor);
-            await next();
-            return undefined;
-        }
-        if (result.kind === "refused") {
-            const accept = context.req.header("Accept") ?? "";
-            if ((result.status === 401 || result.status === 403) &&
-                context.req.method === "GET" &&
-                accept.includes("text/html"))
-                return context.redirect("/login");
-            return refusal(result.status, "Sign in to use this Oyster", result.retryAfter);
-        }
-        context.set("principal", result.principal);
-        await next();
-        return undefined;
-    });
     const capabilityRoutes = (host.capabilities ?? []).flatMap((capability) => Object.entries(capability.methods).map(([name, method]) => ({
         capability,
         operation: `route:${capability.id}:${name}`,
@@ -514,17 +441,26 @@ export function createOyster(host) {
             sensitive: true,
         }),
     })));
-    // Capability routes run under the principal stamped above; they receive the
-    // admission as their env and never authenticate again.
-    app.use("*", async (context, next) => {
+    // Each capability's own declared table, served once; it reads the
+    // dispatcher's admission from its env and never authenticates again.
+    const capabilityTables = new Map();
+    const capabilityTable = (capability) => {
+        let served = capabilityTables.get(capability.routes);
+        if (served === undefined) {
+            served = serveCapability(capability.routes, ports);
+            capabilityTables.set(capability.routes, served);
+        }
+        return served;
+    };
+    // Each declared capability path is a route: the App must hold that
+    // capability for the call, then the capability's own route decides the
+    // resource (an Agent, the Computer) under the same principal.
+    const dispatchCapability = async (context, principal) => {
         const url = new URL(context.req.url);
         const candidates = capabilityRoutes.filter((route) => (route.method === "ANY" || route.method === context.req.method) &&
             route.matches(url.pathname));
         if (candidates.length === 0)
-            return next();
-        const principal = context.get("principal");
-        if (oysterPrincipalIsVisitor(principal))
-            return refusal(401, "Sign in to use capabilities");
+            return refusal(404, "Not found");
         const browserTransport = context.req.header("Upgrade")?.toLowerCase() === "websocket" &&
             context.req.header("Origin") === url.origin &&
             candidates.some((route) => route.kind === "transport");
@@ -548,57 +484,45 @@ export function createOyster(host) {
             }).kind === "refused")
                 continue;
             url.pathname = `/${url.pathname.slice(capability.base.length)}`;
-            return capability.routes.fetch(new Request(url, context.req.raw), {
-                principal,
-                installation,
-            });
+            return capabilityTable(capability).fetch(new Request(url, context.req.raw), { principal, installation });
         }
         return refusal(403, "Capability permission denied");
-    });
-    app.get("/", async (context) => {
-        const actor = context.get("principal").actor;
-        const publicHome = actor.kind === "visitor";
-        const key = actor.kind === "team-key"
-            ? ((await host.keys?.live(actor.keyId)) ?? null)
-            : null;
-        if (!publicHome && host.homeInstallationId !== undefined) {
+    };
+    const capabilityPaths = new Set((host.capabilities ?? []).flatMap((capability) => Object.values(capability.methods).flatMap((method) => {
+        const path = `${capability.base}${method.path}`;
+        return method.kind === "transport" ? [path, `${path}/*`] : [path];
+    })));
+    for (const path of capabilityPaths)
+        table.all(path, appRoute(), (context, admitted) => dispatchCapability(context, admitted.principal));
+    table.get("/", appsRoute(), async (context, admitted) => {
+        if (host.homeInstallationId !== undefined) {
             const home = await host.installations.get(host.homeInstallationId);
-            if (home?.status === "enabled" &&
-                (actor.kind !== "team-key" ||
-                    (key !== null && keyAppAccess(key, home.installationId) !== null)))
-                return context.redirect(`/apps/${encodeURIComponent(home.installationId)}/`);
-        }
-        const installations = (await host.installations.list()).filter((installation) => installation.status === "enabled" &&
-            (!publicHome || installation.visibility === "public") &&
-            (actor.kind !== "team-key" ||
-                (key !== null &&
-                    keyAppAccess(key, installation.installationId) !== null)));
-        if (publicHome) {
-            const apps = [];
-            for (const installation of installations) {
-                const release = await releaseOf(installation.release);
-                if (release.ui === null)
-                    continue;
-                apps.push({
-                    href: `/apps/${encodeURIComponent(installation.installationId)}/`,
-                    displayName: release.declaration?.displayName ?? "App",
-                    icon: release.declaration?.icon ?? null,
-                });
+            if (home?.status === "enabled" && (await admitted.reaches(home))) {
+                const release = await releaseOf(home.release);
+                if (release.declaration?.capabilities.includes("team.workbenchHost") !==
+                    true ||
+                    (await shellApproved(home, release)))
+                    return context.redirect(`/apps/${encodeURIComponent(home.installationId)}/`);
+                // Revocation must leave an owner a way back to consent, rather than
+                // redirecting into a shell that can no longer offer Settings.
             }
-            const config = JSON.stringify({ title, apps }).replaceAll("<", "\\u003c");
-            return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(title)}</title>${tabIcon}<link rel="stylesheet" href="${(await assets()).fonts.path}"><style>html,body{margin:0;min-height:100%;font-family:var(--font-sans);background:var(--color-base-100);color:var(--color-base-content)}#oyster-public-home{min-height:100vh;display:flex;flex-direction:column}</style><div id="oyster-public-home"></div><script type="application/json" id="oyster-public-config">${config}</script><script type="module" src="${(await assets()).publicHome.path}"></script>`, {
-                headers: {
-                    "Content-Type": "text/html; charset=utf-8",
-                    "Cache-Control": "no-store",
-                    "X-Content-Type-Options": "nosniff",
-                    "Content-Security-Policy": "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src data:; img-src data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
-                },
-            });
         }
+        const installations = [];
+        const stored = await host.installations.list();
+        for (const installation of stored)
+            if (installation.status === "enabled" &&
+                (await admitted.reaches(installation)))
+                installations.push(installation);
         const items = installations
-            .map((installation) => `<li><a href="/apps/${escapeHtml(installation.installationId)}/">${escapeHtml(installation.installationId)}</a> <small>${escapeHtml(installation.release.releaseId)}</small>${oysterPrincipalIsOwner(context.get("principal")) ? ` <a href="/api/installations/${encodeURIComponent(installation.installationId)}/grants">App access</a>` : ""}</li>`)
+            .map((installation) => `<li><a href="/apps/${escapeHtml(installation.installationId)}/">${escapeHtml(installation.installationId)}</a> <small>${escapeHtml(installation.release.releaseId)}</small>${admitted.authority.kind === "owner" ? ` <a href="/api/installations/${encodeURIComponent(installation.installationId)}/grants">App access</a>` : ""}</li>`)
             .join("");
-        return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(title)}</title>${tabIcon}<h1>${escapeHtml(title)}</h1><ul>${items || "<li>No Apps installed yet.</li><li>Install Apps with <code>npx oyster install-apps</code></li>"}</ul>`, {
+        const resetAt = await host.installations.resetAt?.();
+        const resetNotice = resetAt !== undefined &&
+            resetAt !== null &&
+            !stored.some((installation) => installation.status === "enabled")
+            ? "<p>This update reset your installed Apps. Reinstall them with npx oyster install-apps.</p>"
+            : "";
+        return new Response(`<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escapeHtml(title)}</title>${tabIcon}<h1>${escapeHtml(title)}</h1>${resetNotice}<ul>${items || "<li>No Apps installed yet.</li><li>Install Apps with <code>npx oyster install-apps</code></li>"}</ul>`, {
             headers: {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store",
@@ -606,51 +530,9 @@ export function createOyster(host) {
             },
         });
     });
-    app.use("/api/*", async (context, next) => {
-        if (!oysterPrincipalIsOwner(context.get("principal")))
-            return refusal(403, "Only the owner manages this Oyster");
-        await next();
-        return undefined;
-    });
-    app.put("/api/installations/:installationId/visibility", async (context) => {
-        const generation = await host.installations.generation();
-        const current = await host.installations.get(context.req.param("installationId"));
-        if (current === null || current.status === "deleted")
-            return refusal(404, "Not found");
-        const body = Schema.decodeUnknownOption(visibilitySchema)(await context.req.json());
-        if (body._tag === "None")
-            return refusal(400, "Invalid visibility");
-        const update = await reduceInstallation(current, { kind: "set-visibility", visibility: body.value.visibility }, await releaseOf(current.release), context.get("principal"), current);
-        if (Result.isFailure(update))
-            return refusal(409, update.failure.code);
-        const next = update.success.next;
-        const release = await releaseOf(current.release);
-        const refused = await prepare(next, release);
-        if (refused !== null)
-            return refused;
-        const commit = await host.installations.compareAndPut(next, current.authority.authorityVersion, generation);
-        if (!commit.ok)
-            return refusal(409, commit.code);
-        const activationRefusal = await apply(next, release);
-        if (activationRefusal !== null)
-            return activationRefusal;
-        return Response.json(next);
-    });
-    if (host.ownerRoutes !== undefined) {
-        const ownerRoutes = host.ownerRoutes;
-        const owned = new Hono();
-        owned.use("/api/*", async (context, next) => {
-            if (!oysterPrincipalIsOwner(context.get("principal")))
-                return refusal(403, "Owner only");
-            await next();
-            return undefined;
-        });
-        owned.route("/", ownerRoutes);
-        app.route("/", owned);
-    }
-    app.get("/api/workbench/directory", async (context) => {
-        if (!oysterPrincipalIsOwner(context.get("principal")))
-            return refusal(403, "Owner only");
+    if (host.ownerRoutes !== undefined)
+        table.include(host.ownerRoutes);
+    table.get("/api/workbench/directory", owner("direct-or-app"), async (context) => {
         if (host.workbench === undefined)
             return refusal(404, "Not found");
         startTime(context, "registry");
@@ -665,10 +547,7 @@ export function createOyster(host) {
             headers: { "Cache-Control": "no-store" },
         });
     });
-    app.all("/api/workbench/storage/:installationId/:operation", async (context) => {
-        const principal = context.get("principal");
-        if (!oysterPrincipalIsOwner(principal))
-            return refusal(403, "Owner only");
+    table.all("/api/workbench/storage/:installationId/:operation", owner("direct-or-app"), async (context, { principal }) => {
         const workbench = host.workbench;
         if (workbench === undefined)
             return refusal(404, "Not found");
@@ -702,8 +581,8 @@ export function createOyster(host) {
         }
         return refusal(404, "Not found");
     });
-    app.get("/api/installations", async () => Response.json(await host.installations.list()));
-    app.put("/api/artifacts/:artifactRef", async (context) => {
+    table.get("/api/installations", owner("direct-or-app"), async () => Response.json(await host.installations.list()));
+    table.put("/api/artifacts/:artifactRef", owner("direct-or-app"), async (context) => {
         let artifactRef;
         try {
             artifactRef = parseArtifactRef(context.req.param("artifactRef"));
@@ -711,6 +590,8 @@ export function createOyster(host) {
         catch {
             return refusal(400, "Invalid artifact reference");
         }
+        if (isBuildJobLogRef(artifactRef))
+            return refusal(409, "build_job_log_ref_reserved");
         const expected = context.req.query("digest");
         const bytes = new Uint8Array(await context.req.arrayBuffer());
         if (expected === undefined || (await sha256(bytes)) !== expected)
@@ -734,7 +615,7 @@ export function createOyster(host) {
             .apply({ ...selectionOf(installation), status: installation.status }, installation.release);
         return result.ok ? null : instanceRefusal(result.code, result.causeClass);
     };
-    app.post("/api/installations", async (context) => {
+    table.post("/api/installations", owner("direct-or-app"), async (context, { origin, principal }) => {
         let request;
         let release;
         try {
@@ -750,17 +631,12 @@ export function createOyster(host) {
         const key = installationRequestIdSchema.safeParse(context.req.header("Idempotency-Key"));
         if (!key.success)
             return refusal(400, "Invalid installation request identity");
-        const admitted = await admitInstallation(host, installationId, release, context.get("principal"), "install-or-remint", context.req.raw.headers.has("X-Oyster-Installation")
-            ? "app"
-            : "owner-direct", key.data);
+        const admitted = await admitInstallation(host, installationId, release, principal, "install-or-remint", origin, key.data);
         return admitted instanceof Response
             ? admitted
             : Response.json(admitted, { status: 202 });
     });
-    app.get("/api/installations/:installationId/status", async (context) => {
-        if (!oysterPrincipalIsOwner(context.get("principal")) ||
-            context.req.raw.headers.has("X-Oyster-Installation"))
-            return refusal(403, "Owner only");
+    table.get("/api/installations/:installationId/status", owner("direct"), async (context) => {
         const key = installationRequestIdSchema.safeParse(context.req.query("requestId"));
         if (!key.success)
             return refusal(400, "Invalid installation request identity");
@@ -779,9 +655,7 @@ export function createOyster(host) {
             throw cause;
         }
     });
-    app.get("/api/installations/:installationId/grants", async (context) => {
-        if (context.req.raw.headers.has("X-Oyster-Installation"))
-            return refusal(403, "Owner direct only");
+    table.get("/api/installations/:installationId/grants", owner("direct"), async (context, { principal }) => {
         const generation = await host.installations.generation();
         const current = await host.installations.get(context.req.param("installationId"));
         if (current === null || current.status === "deleted")
@@ -795,6 +669,18 @@ export function createOyster(host) {
             appId: current.appId,
             appName: declaration.displayName ?? current.installationId,
             artifactDigest: current.release.artifact.artifactDigest,
+            canEdit: oysterPrincipalIsOwner(principal),
+            resources: host.permissionResources === undefined
+                ? host.computerId === undefined
+                    ? []
+                    : [
+                        {
+                            kind: "computer",
+                            id: host.computerId,
+                            label: host.computerId,
+                        },
+                    ]
+                : await host.permissionResources(principal),
             permissions: {
                 authority: current.authority,
                 declaredOperations: declared,
@@ -810,20 +696,13 @@ export function createOyster(host) {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store",
                 "X-Content-Type-Options": "nosniff",
-                "Content-Security-Policy": "default-src 'none'; script-src 'self'; connect-src 'self'; style-src 'self' 'unsafe-inline'; font-src data:; base-uri 'none'; form-action 'self'; frame-ancestors 'none'",
+                "Content-Security-Policy": "default-src 'none'; script-src 'self'; connect-src 'self'; style-src 'self' 'unsafe-inline'; font-src data:; base-uri 'none'; form-action 'self'; frame-ancestors 'self'",
             },
         });
     });
-    app.put("/api/installations/:installationId/grants", bodyLimit({
-        maxSize: 64 * 1024,
-        onError: () => refusal(413, "Approval request too large"),
-    }), async (context) => {
-        // Capability-origin requests cannot become direct owner consent.
-        if (context.req.raw.headers.has("X-Oyster-Installation"))
-            return refusal(403, "Owner direct only");
-        const principal = context.get("principal");
-        if (!oysterPrincipalIsOwner(principal))
-            return refusal(403, "Owner only");
+    table.put("/api/installations/:installationId/grants", 
+    // Capability-origin requests cannot become direct owner consent.
+    owner("direct"), async (context, { principal }) => {
         const body = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown))(await context.req.text());
         if (body._tag === "None")
             return refusal(400, "Invalid approval");
@@ -857,8 +736,15 @@ export function createOyster(host) {
         if (refused !== null)
             return refused;
         return Response.json(update.success.next);
+    }, {
+        middleware: [
+            bodyLimit({
+                maxSize: 64 * 1024,
+                onError: () => refusal(413, "Approval request too large"),
+            }),
+        ],
     });
-    app.put("/api/installations/:installationId/release", async (context) => {
+    table.put("/api/installations/:installationId/release", owner("direct-or-app"), async (context, admitted) => {
         let release;
         try {
             release = parseRelease(await context.req.json());
@@ -872,16 +758,14 @@ export function createOyster(host) {
             return refusal(400, "Invalid installation request identity");
         // PUT retains its completed-response meaning. Cancellation only stops this
         // observer; Watchdog's retained command continues independently.
-        return installOrSelect(host, context.req.param("installationId"), release, context.get("principal"), "install-or-select", context.req.raw.headers.has("X-Oyster-Installation")
-            ? "app"
-            : "owner-direct", key.data, context.req.raw.signal);
+        return installOrSelect(host, context.req.param("installationId"), release, admitted.principal, "install-or-select", admitted.origin, key.data, context.req.raw.signal);
     });
-    app.delete("/api/installations/:installationId", async (context) => {
+    table.delete("/api/installations/:installationId", owner("direct-or-app"), async (context, admitted) => {
         const generation = await host.installations.generation();
         const current = await host.installations.get(context.req.param("installationId"));
         if (current === null || current.status === "deleted")
             return refusal(404, "Not found");
-        const update = await reduceInstallation(current, { kind: "set-status", status: "deleted" }, await releaseOf(current.release), context.get("principal"), current);
+        const update = await reduceInstallation(current, { kind: "set-status", status: "deleted" }, await releaseOf(current.release), admitted.principal, current);
         if (Result.isFailure(update))
             return refusal(409, update.failure.code);
         const next = update.success.next;
@@ -899,21 +783,18 @@ export function createOyster(host) {
     });
     const enabled = async (context) => {
         const installationId = context.req.param("installationId") ?? "";
-        const resolved = context.get("installation");
-        if (resolved?.installationId === installationId)
-            return resolved.status === "enabled" ? resolved : null;
         startTime(context, "registry");
         const installation = await host.installations.get(installationId);
         endTime(context, "registry");
         return installation?.status === "enabled" ? installation : null;
     };
-    app.get("/apps/:installationId/", async (context) => {
+    table.get("/apps/:installationId/", appRoute(), async (context, admitted) => {
         const installation = await enabled(context);
         if (installation === null)
             return refusal(404, "Not found");
         const release = await releaseOf(installation.release);
         const declaration = release.declaration;
-        const principal = context.get("principal");
+        const principal = admitted.principal;
         const facts = await gateFacts(installation, release, principal);
         if (principal.actor.kind === "team-key" && facts.access === null)
             return refusal(403, "App access denied");
@@ -988,7 +869,7 @@ export function createOyster(host) {
         // desktop chrome belongs to the shell.
         return new Response(config.workbench
             ? `${head}<style>html,body,#oyster-shell{margin:0;height:100%}body{font-family:var(--font-sans)}</style><div id="oyster-shell"></div>${tail}`
-            : `${head}<style>html,body{margin:0;height:100%}iframe{border:0;width:100%;height:100%;display:block}</style><iframe id="oyster-app" sandbox="${appSandbox}" src="${escapeHtml(config.uiUrl)}" title="${escapeHtml(installation.installationId)}"></iframe>${tail}`, {
+            : `${head}<style>html,body{margin:0;height:100%}iframe{border:0;width:100%;height:100%;display:block}</style><iframe id="oyster-app" sandbox="${appSandbox}" allowfullscreen src="${escapeHtml(config.uiUrl)}" title="${escapeHtml(installation.installationId)}"></iframe>${tail}`, {
             headers: {
                 "Content-Type": "text/html; charset=utf-8",
                 "Cache-Control": "no-store",
@@ -998,10 +879,7 @@ export function createOyster(host) {
             },
         });
     });
-    app.put("/apps/:installationId/backend", async (context) => {
-        const principal = context.get("principal");
-        if (oysterPrincipalIsVisitor(principal))
-            return refusal(403, "Sign in to use this App");
+    table.put("/apps/:installationId/backend", appRoute(), async (context, { principal }) => {
         const installation = await enabled(context);
         if (installation === null)
             return refusal(404, "Not found");
@@ -1030,10 +908,8 @@ export function createOyster(host) {
             .fetch(admittedCallerFacts(installation, release, invocationCallerContext(principal, host.computerId ?? null), decision.grants), request);
         return appFacetResponse(response);
     });
-    app.put("/apps/:installationId/gills", async (context) => {
-        const caller = invocationCallerContext(context.get("principal"), host.computerId ?? null);
-        if (caller.actor.kind !== "member" || caller.role !== "owner")
-            return refusal(403, "Owner only");
+    table.put("/apps/:installationId/gills", owner("direct-or-app"), async (context, { principal }) => {
+        const caller = invocationCallerContext(principal, host.computerId ?? null);
         const installation = await enabled(context);
         if (installation === null)
             return refusal(404, "Not found");
@@ -1046,7 +922,9 @@ export function createOyster(host) {
         const request = decoded.value;
         const release = await releaseOf(installation.release);
         const gill = release.declaration?.gills?.find((item) => item.id === request.viewId);
-        if (gill === undefined || release.api === null || release.backend === null)
+        if (gill === undefined ||
+            release.api === null ||
+            release.backend === null)
             return refusal(404, "Gill is not declared");
         if (installation.instanceId === null)
             return instanceRefusal("invalid_invocation_facts");
@@ -1079,7 +957,7 @@ export function createOyster(host) {
             method?.effect !== "read" ||
             !method.requires.every((capability) => release.declaration?.capabilities.includes(capability)))
             return refusal(403, "Gill source is not admitted");
-        const current = await gateFacts(installation, release, context.get("principal"));
+        const current = await gateFacts(installation, release, principal);
         if (current.declaredOperations.digest !==
             installation.authority.declaredOperationsDigest ||
             current.declaredOperations.artifactDigest !==
@@ -1170,20 +1048,16 @@ export function createOyster(host) {
             return instanceRefusal(result.code, result.causeClass);
         return methodResponse(result.value);
     };
-    app.post("/apps/:installationId/methods/:name", async (context) => {
+    table.post("/apps/:installationId/methods/:name", appRoute(), async (context, { principal }) => {
         const installation = await enabled(context);
         if (installation === null)
             return refusal(404, "Not found");
         startTime(context, "method", "admission and Instance call");
-        const response = await executeMethod(installation, await releaseOf(installation.release), context.get("principal"), context.req.param("name"), context.req.raw);
+        const response = await executeMethod(installation, await releaseOf(installation.release), principal, context.req.param("name"), context.req.raw);
         endTime(context, "method");
         return response;
     });
-    app.post("/apps/:caller/calls/:appId/:method", async (context) => {
-        const principal = context.get("principal");
-        if (oysterPrincipalIsVisitor(principal) ||
-            principal.actor.kind !== "member")
-            return refusal(403, "app_call_member_only");
+    table.post("/apps/:caller/calls/:appId/:method", member(), async (context, { principal }) => {
         const caller = await host.installations.get(context.req.param("caller"));
         if (caller?.status !== "enabled")
             return refusal(404, "Not found");
@@ -1244,5 +1118,12 @@ export function createOyster(host) {
         };
         return executeMethod(target, release, principal, method, context.req.raw, recheck);
     });
-    return app;
+    return {
+        declarations: () => table.declarations(),
+        serve: () => serveHost(table, authenticate, ports, {
+            // Server-Timing names the Durable Object hops a request waited on.
+            serverTiming: { totalDescription: "Oyster" },
+            headers: [noIndex],
+        }),
+    };
 }