@fungi.computer/oyster 0.0.0-stage → 0.0.1

package/dist/shell/workbench-model.d.ts

@@ -0,0 +1,192 @@
+import * as z from "zod";
+import * as Schema from "effect/Schema";
+import type { AppCommand, AppOpenRequest, FileNavigationInput, AppNavigationState, AppStatusAction, AppStatusItem } from "@fungi.computer/agar";
+import type { AppOpenInput, AppRoleChoice } from "@fungi.computer/agar/apps";
+import type { WhistleExecutionOrigin, WhistleJsonValue } from "@fungi.computer/whistle";
+/** A request to resolve and mount one child App, by its own identity. */
+export type WorkbenchChildLaunch = Readonly<{
+    windowId: string;
+    appId: string;
+    releaseId: string;
+    surfaceId: string;
+    href: string;
+    title?: string;
+    openRequest: AppOpenRequest | null;
+}>;
+/** One invocation of a mounted child's own Release-declared command. */
+export type WorkbenchCommandInvocation = Readonly<{
+    arguments?: WhistleJsonValue;
+    origin: WhistleExecutionOrigin;
+}>;
+/**
+ * Events a mounted child raises toward its dashboard. A child's permission
+ * requests never reach the dashboard: the host asks the person itself. The
+ * host validates a
+ * child's commands against that child's own Release declaration before
+ * forwarding them, so the dashboard can present them but never widen them.
+ */
+export type WorkbenchChildEvents = Readonly<{
+    /** Ask this window's shell to open its existing Computer picker. */
+    onComputerChoice?: () => Promise<void>;
+    /** Ask the embedding host to follow a file navigation request. */
+    onNavigation?: (input: FileNavigationInput) => Promise<void>;
+    /** Ask the embedding host to open an App through its own admission policy. */
+    onAppOpen?: (input: AppOpenInput) => Promise<void>;
+    /** Ask the embedding host which App its role routing would open for a role. */
+    onAppRole?: (role: string) => Promise<AppRoleChoice>;
+    /** Report a changed child selection; the host returns whether it handled it. */
+    onSelectionChanged?: () => Promise<boolean>;
+    /**
+     * Replace the child's presented command set; an empty list clears it. Run
+     * one through the child's handle with `invokeCommand`.
+     */
+    onCommands?: (commands: readonly AppCommand[]) => Promise<void>;
+    /** A reserved shell chord (the command palette) pressed inside the child. */
+    onReservedChord?: (input: Readonly<{
+        id: string;
+        repeat: boolean;
+    }>) => Promise<void>;
+    /** The child gained (`true`) or lost (`false`) input focus. */
+    onFocus?: (focused: boolean) => Promise<void>;
+    /**
+     * The child's latest parsed navigation state; `null` once it disconnects.
+     * The dashboard shows a Back affordance from it.
+     */
+    onNavigationState?: (state: AppNavigationState | null) => Promise<void>;
+    /** The child's latest status readouts; an empty list once it disconnects. */
+    onStatusItems?: (items: readonly AppStatusItem[]) => Promise<void>;
+}>;
+/** One mounted child App; every method proxies to its real host-owned mount. */
+export type WorkbenchChildHandle = {
+    /** Show or hide the mounted child without changing its identity. */
+    setVisibility(visibility: "hidden" | "visible"): Promise<void>;
+    /** Update the launch descriptor of the existing mount. */
+    reconfigure(launch: WorkbenchChildLaunch): Promise<void>;
+    /** Ask whether the child permits a user-initiated close. */
+    requestClose(): Promise<boolean>;
+    /** Ask the child to go back one step in its own history; `true` when it did. */
+    requestBack(): Promise<boolean>;
+    /** Deliver the person's use of a child's status item; `true` when it acted. */
+    activateStatus(action: AppStatusAction): Promise<boolean>;
+    /** Run one of the child's currently presented commands. */
+    invokeCommand(commandId: string, input: WorkbenchCommandInvocation): Promise<WhistleJsonValue | undefined>;
+    /** Release the child mount and its resources. */
+    dispose(): Promise<void>;
+};
+/**
+ * A platform destination the host offers the dashboard, such as opening
+ * a host settings page. The host owns the labels and the navigation;
+ * the dashboard only presents them and asks the host to follow one.
+ */
+export type WorkbenchPlatformDestination = Readonly<{
+    id: string;
+    label: string;
+}>;
+/** A declared Gill request addressed to one host-selected App surface. */
+export declare const workbenchGillRequestSchema: Schema.Struct<{
+    readonly viewId: Schema.String;
+    readonly params: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly after: Schema.optional<Schema.String>;
+    readonly options: Schema.optional<Schema.String>;
+    readonly surfaceId: Schema.String;
+}>;
+/** Decoded Gill request for a surface in the host directory. */
+export type WorkbenchGillRequest = typeof workbenchGillRequestSchema.Type;
+/** The member chooses a declared Gill and size in host-rendered Settings. */
+export declare const desktopGillSelectionSchema: z.ZodObject<{
+    surfaceId: z.ZodString;
+    gillId: z.ZodString;
+}, z.core.$strict>;
+/** The identity of a Gill selected in a host-rendered settings view. */
+export type DesktopGillSelection = z.output<typeof desktopGillSelectionSchema>;
+/** The dashboard layout sizes currently assigned to one Gill. */
+export declare const desktopGillSizesSchema: z.ZodArray<z.ZodEnum<{
+    S: "S";
+    M: "M";
+    L: "L";
+}>>;
+/** A selected Gill and the layout size requested for a new placement. */
+export declare const desktopGillAdditionSchema: z.ZodObject<{
+    surfaceId: z.ZodString;
+    gillId: z.ZodString;
+    size: z.ZodEnum<{
+        S: "S";
+        M: "M";
+        L: "L";
+    }>;
+}, z.core.$strict>;
+/** A decoded request to add a Gill placement. */
+export type DesktopGillAddition = z.output<typeof desktopGillAdditionSchema>;
+/** A dashboard supplies its own arranger, not an endpoint for ordinary Apps. */
+export type WorkbenchDesktopSettings = {
+    /** Read the sizes currently assigned to this Gill in the dashboard layout. */
+    readGill: (input: DesktopGillSelection) => Promise<z.output<typeof desktopGillSizesSchema>>;
+    /** Add a Gill at the requested size to the dashboard layout. */
+    addGill: (input: DesktopGillAddition) => Promise<void>;
+    /** Remove this Gill from the dashboard layout. */
+    removeGill: (input: DesktopGillSelection) => Promise<void>;
+};
+/** Shape of the arranger callbacks the shell supplies to its host. */
+export declare const desktopSettingsHandlerSchema: z.ZodPipe<z.ZodUnknown, z.ZodTransform<{
+    readGill: z.core.$InferOuterFunctionType<z.core.$ZodTuple<readonly [z.ZodObject<{
+        surfaceId: z.ZodString;
+        gillId: z.ZodString;
+    }, z.core.$strict>], z.core.$ZodFunctionOut>, z.ZodPromise<z.ZodPipe<z.ZodUnknown, z.ZodTransform<("S" | "M" | "L")[], unknown>>>>;
+    addGill: z.core.$InferOuterFunctionType<z.core.$ZodTuple<readonly [z.ZodObject<{
+        surfaceId: z.ZodString;
+        gillId: z.ZodString;
+        size: z.ZodEnum<{
+            S: "S";
+            M: "M";
+            L: "L";
+        }>;
+    }, z.core.$strict>], z.core.$ZodFunctionOut>, z.ZodPromise<z.ZodPipe<z.ZodUnknown, z.ZodTransform<void, unknown>>>>;
+    removeGill: z.core.$InferOuterFunctionType<z.core.$ZodTuple<readonly [z.ZodObject<{
+        surfaceId: z.ZodString;
+        gillId: z.ZodString;
+    }, z.core.$strict>], z.core.$ZodFunctionOut>, z.ZodPromise<z.ZodPipe<z.ZodUnknown, z.ZodTransform<void, unknown>>>>;
+} & {
+    [Symbol.dispose](): void;
+}, unknown>>;
+/** A registration lease; close it when the dashboard unmounts. */
+export type WorkbenchDesktopRegistration = {
+    /** Release this host registration. */
+    close(): Promise<void>;
+};
+/** A host-owned change subscription; close it when no longer visible. */
+export type WorkbenchGillWatch = {
+    /** Release this host registration. */
+    close(): Promise<void>;
+};
+/** Runtime check for an App-open handoff arriving across an untrusted boundary. */
+export declare const appOpenRequestSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"compose">;
+    readonly requestId: Schema.String;
+    readonly text: Schema.String;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"navigate">;
+    readonly requestId: Schema.String;
+    readonly params: Schema.$Array<Schema.Struct<{
+        readonly key: Schema.String;
+        readonly value: Schema.String;
+    }>>;
+}>]>;
+/** One Team Computer in a host's inventory: the wire of `computers()`. */
+export declare const teamComputerSchema: z.ZodObject<{
+    computerId: z.ZodString;
+    name: z.ZodString;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}, z.core.$strict>;
+/** A decoded Team Computer inventory record. */
+export type TeamComputer = z.output<typeof teamComputerSchema>;
+/** One page of a host's Team Computer inventory. */
+export declare const teamComputerDirectorySchema: z.ZodObject<{
+    computers: z.ZodArray<z.ZodObject<{
+        computerId: z.ZodString;
+        name: z.ZodString;
+        createdAt: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+    }, z.core.$strict>>;
+    nextOffset: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strict>;

package/dist/shell/workbench-model.js

@@ -0,0 +1,53 @@
+import { rpcDataSchema, rpcHandleSchema, rpcMethod, rpcVoid, } from "@fungi.computer/agar/rpc";
+import * as z from "zod";
+import * as Schema from "effect/Schema";
+import { gillRequestSchema } from "@fungi.computer/gills";
+/** A declared Gill request addressed to one host-selected App surface. */
+export const workbenchGillRequestSchema = Schema.Struct({
+    surfaceId: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(513)),
+    ...gillRequestSchema.fields,
+});
+/** The member chooses a declared Gill and size in host-rendered Settings. */
+export const desktopGillSelectionSchema = z.strictObject({
+    surfaceId: z.string().min(1).max(256),
+    gillId: z.string().min(1).max(80),
+});
+/** The dashboard layout sizes currently assigned to one Gill. */
+export const desktopGillSizesSchema = z.array(z.enum(["S", "M", "L"])).max(24);
+/** A selected Gill and the layout size requested for a new placement. */
+export const desktopGillAdditionSchema = desktopGillSelectionSchema.extend({
+    size: z.enum(["S", "M", "L"]),
+});
+/** Shape of the arranger callbacks the shell supplies to its host. */
+export const desktopSettingsHandlerSchema = rpcHandleSchema({
+    readGill: rpcMethod(rpcDataSchema(desktopGillSizesSchema)).input([
+        desktopGillSelectionSchema,
+    ]),
+    addGill: rpcVoid.input([desktopGillAdditionSchema]),
+    removeGill: rpcVoid.input([desktopGillSelectionSchema]),
+});
+/** Runtime check for an App-open handoff arriving across an untrusted boundary. */
+export const appOpenRequestSchema = Schema.Union([
+    Schema.Struct({
+        kind: Schema.Literal("compose"),
+        requestId: Schema.String,
+        text: Schema.String,
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("navigate"),
+        requestId: Schema.String,
+        params: Schema.Array(Schema.Struct({ key: Schema.String, value: Schema.String })),
+    }),
+]);
+/** One Team Computer in a host's inventory: the wire of `computers()`. */
+export const teamComputerSchema = z.strictObject({
+    computerId: z.string().min(1),
+    name: z.string().min(1).max(256),
+    createdAt: z.number().int().nonnegative(),
+    updatedAt: z.number().int().nonnegative(),
+});
+/** One page of a host's Team Computer inventory. */
+export const teamComputerDirectorySchema = z.strictObject({
+    computers: z.array(teamComputerSchema),
+    nextOffset: z.number().int().nonnegative().nullable(),
+});

package/dist/shell/workbench.d.ts

@@ -0,0 +1,4 @@
+export * from "./workbench-model.js";
+export type { TeamWorkbenchHostHandle, TeamWorkbenchChildEvents, } from "./workbench-contract.js";
+export { WorkbenchHost } from "./workbench-host.js";
+export type * from "./workbench-host-types.js";

package/dist/shell/workbench.js

@@ -0,0 +1,2 @@
+export * from "./workbench-model.js";
+export { WorkbenchHost } from "./workbench-host.js";

package/dist/source/fork.d.ts

@@ -0,0 +1,27 @@
+import { type AppId } from "@fungi.computer/puffball";
+import type { TeamAppPublisherRegistry } from "@fungi.computer/puffball/publisher";
+import type { Artifacts } from "@fungi.computer/burrow";
+import type { PublisherTemplateSeedReceipts } from "./seed-receipt.js";
+export type AppSourceForkResult = Readonly<{
+    kind: "forked";
+    appId: string;
+    repository: string;
+}> | Readonly<{
+    kind: "unauthorized" | "conflict" | "provider_unavailable";
+}>;
+/** Fork a verified first-party template source into a Team-owned Artifacts
+ * repository (named by the host) and register it as its own App, recovering
+ * an existing fork idempotently. The
+ * native Artifacts fork is asynchronous; `artifacts.forkRepository` already
+ * owns waiting for it to become ready. */
+export declare function forkAppSource(input: Readonly<{
+    teamId: string;
+    platformAppId: AppId;
+    appId: AppId;
+    /** The destination Artifacts repository's full provider name. */
+    repository: string;
+}>, ports: Readonly<{
+    registry: Pick<TeamAppPublisherRegistry, "read" | "register">;
+    artifacts: Pick<Artifacts, "recoverForkRepository" | "readDefaultBranchHead" | "forkRepository">;
+    receipts: Pick<PublisherTemplateSeedReceipts, "read">;
+}>): Promise<AppSourceForkResult>;

package/dist/source/fork.js

@@ -0,0 +1,46 @@
+import { parseSourceRevision } from "@fungi.computer/puffball";
+import { templateRepositoryForApp } from "./template-repository.js";
+/** Fork a verified first-party template source into a Team-owned Artifacts
+ * repository (named by the host) and register it as its own App, recovering
+ * an existing fork idempotently. The
+ * native Artifacts fork is asynchronous; `artifacts.forkRepository` already
+ * owns waiting for it to become ready. */
+export async function forkAppSource(input, ports) {
+    const { teamId, platformAppId, appId, repository } = input;
+    const { registry, artifacts, receipts } = ports;
+    const platform = await registry.read(platformAppId);
+    if (platform.kind !== "found" ||
+        platform.registration.source.provider !== "artifacts" ||
+        platform.registration.source.repository !==
+            templateRepositoryForApp(platformAppId))
+        return { kind: "unauthorized" };
+    const template = platform.registration.source.repository;
+    let fork = await artifacts.recoverForkRepository({ template, repository });
+    if (fork === null) {
+        const head = await artifacts.readDefaultBranchHead(template);
+        if (head === null)
+            return { kind: "provider_unavailable" };
+        const seedReceipt = await receipts.read(platformAppId, parseSourceRevision(`git:${head}`));
+        if (seedReceipt === null)
+            return { kind: "conflict" };
+        fork = await artifacts.forkRepository({
+            template,
+            repository,
+            expectedMainHead: head,
+        });
+    }
+    if (fork.repository.name !== repository)
+        return { kind: "conflict" };
+    const forkRevision = parseSourceRevision(`git:${fork.mainHead}`);
+    if ((await receipts.read(platformAppId, forkRevision)) === null)
+        return { kind: "conflict" };
+    const registration = await registry.register({
+        appId,
+        teamId,
+        source: { provider: "artifacts", repository, branch: "main" },
+        templateSeed: { appId: platformAppId, revision: forkRevision },
+    });
+    if (registration.kind === "conflict")
+        return { kind: "conflict" };
+    return { kind: "forked", appId, repository };
+}

package/dist/source/index.d.ts

@@ -0,0 +1,11 @@
+/** App source seed receipts and the fork algorithm, owned generically here;
+ * the Publisher supplies D1 adapters and the retained Git admission
+ * transport. The Node-only template writer (`memfs` + `isomorphic-git`) is
+ * deliberately not re-exported here: it would drag that dependency into
+ * every Worker bundle that only needs the fork/provenance reads below (team
+ * rail's RPC surface has no use for it). Import it from
+ * `@fungi.computer/oyster/source/template-write` instead. */
+export { templateRepositoryForApp } from "./template-repository.js";
+export { seedReceiptInputSchema, sameReceipt, type PublisherTemplateSeedReceipt, type PublisherTemplateSeedReceipts, } from "./seed-receipt.js";
+export { readTeamAppSeedProvenance, privateTeamBuildSource, TeamAppSourceError, } from "./team-source.js";
+export { forkAppSource, type AppSourceForkResult } from "./fork.js";

package/dist/source/index.js

@@ -0,0 +1,11 @@
+/** App source seed receipts and the fork algorithm, owned generically here;
+ * the Publisher supplies D1 adapters and the retained Git admission
+ * transport. The Node-only template writer (`memfs` + `isomorphic-git`) is
+ * deliberately not re-exported here: it would drag that dependency into
+ * every Worker bundle that only needs the fork/provenance reads below (team
+ * rail's RPC surface has no use for it). Import it from
+ * `@fungi.computer/oyster/source/template-write` instead. */
+export { templateRepositoryForApp } from "./template-repository.js";
+export { seedReceiptInputSchema, sameReceipt, } from "./seed-receipt.js";
+export { readTeamAppSeedProvenance, privateTeamBuildSource, TeamAppSourceError, } from "./team-source.js";
+export { forkAppSource } from "./fork.js";

package/dist/source/seed-receipt.d.ts

@@ -0,0 +1,53 @@
+import { appIdSchema, sha256DigestSchema, sourceRevisionSchema } from "@fungi.computer/puffball/effect";
+import * as Schema from "effect/Schema";
+import { type PinnedRecipe } from "../build-contract.js";
+export declare const seedReceiptInputSchema: Schema.Struct<{
+    readonly appId: Schema.refine<import("@fungi.computer/puffball").AppId, Schema.String>;
+    readonly sourceRevision: Schema.refine<import("@fungi.computer/puffball").SourceRevision, Schema.String>;
+    readonly sourceTreeDigest: Schema.refine<import("@fungi.computer/puffball").Sha256Digest, Schema.String>;
+    readonly seedRevision: Schema.refine<import("@fungi.computer/puffball").SourceRevision, Schema.String>;
+    readonly recipe: Schema.Struct<{
+        readonly kind: Schema.optional<Schema.Literals<readonly ["bundled-html", "source-html"]>>;
+        readonly bundle: Schema.Literal<true>;
+        readonly entry: Schema.String;
+        readonly format: Schema.Literals<readonly ["html", "esm", "assets"]>;
+        readonly assets: Schema.optional<Schema.Struct<{
+            readonly maxManifestBytes: Schema.Number;
+            readonly maxObjects: Schema.Number;
+            readonly maxObjectBytes: Schema.Number;
+            readonly maxTotalBytes: Schema.Number;
+        }>>;
+        readonly assetBase: Schema.optionalKey<Schema.String>;
+        readonly toolchain: Schema.$Record<Schema.String, Schema.String>;
+        readonly maxOutputBytes: Schema.Number;
+        readonly platform: Schema.Literals<readonly ["browser", "neutral"]>;
+        readonly backend: Schema.Union<readonly [Schema.Null, Schema.Struct<{
+            readonly entry: Schema.optional<Schema.String>;
+            readonly runtime: Schema.Struct<{
+                readonly kind: Schema.Literal<"durable-facet">;
+                readonly stateSchema: Schema.Number;
+            }>;
+            readonly compatibilityDate: Schema.String;
+            readonly exportName: Schema.String;
+        }>]>;
+        readonly target: Schema.Tuple<readonly [Schema.Literal<"es2022">]>;
+    }>;
+    readonly buildRecipeDigest: Schema.refine<import("@fungi.computer/puffball").Sha256Digest, Schema.String>;
+}>;
+export type PublisherTemplateSeedReceipt = Readonly<{
+    appId: Schema.Schema.Type<typeof appIdSchema>;
+    repository: string;
+    sourceRevision: Schema.Schema.Type<typeof sourceRevisionSchema>;
+    sourceTreeDigest: Schema.Schema.Type<typeof sha256DigestSchema>;
+    seedRevision: Schema.Schema.Type<typeof sourceRevisionSchema>;
+    recipe: PinnedRecipe;
+    buildRecipeDigest: Schema.Schema.Type<typeof sha256DigestSchema>;
+}>;
+/** Append-only proof that an exact projected template was seeded, keyed by
+ * the template's repository and recorded seed revision. The Publisher's D1
+ * adapter is the only durable implementation; this is the port it fulfills. */
+export type PublisherTemplateSeedReceipts = Readonly<{
+    read(appId: PublisherTemplateSeedReceipt["appId"], seedRevision: PublisherTemplateSeedReceipt["seedRevision"]): Promise<PublisherTemplateSeedReceipt | null>;
+    record(input: Schema.Schema.Type<typeof seedReceiptInputSchema>): Promise<PublisherTemplateSeedReceipt>;
+}>;
+export declare const sameReceipt: (left: PublisherTemplateSeedReceipt, right: PublisherTemplateSeedReceipt) => boolean;

package/dist/source/seed-receipt.js

@@ -0,0 +1,18 @@
+import { appIdSchema, sha256DigestSchema, sourceRevisionSchema, } from "@fungi.computer/puffball/effect";
+import * as Schema from "effect/Schema";
+import { capturedPinnedRecipeSchema, } from "../build-contract.js";
+export const seedReceiptInputSchema = Schema.Struct({
+    appId: appIdSchema,
+    sourceRevision: sourceRevisionSchema,
+    sourceTreeDigest: sha256DigestSchema,
+    seedRevision: sourceRevisionSchema,
+    recipe: capturedPinnedRecipeSchema,
+    buildRecipeDigest: sha256DigestSchema,
+});
+export const sameReceipt = (left, right) => left.appId === right.appId &&
+    left.repository === right.repository &&
+    left.sourceRevision === right.sourceRevision &&
+    left.sourceTreeDigest === right.sourceTreeDigest &&
+    left.seedRevision === right.seedRevision &&
+    JSON.stringify(left.recipe) === JSON.stringify(right.recipe) &&
+    left.buildRecipeDigest === right.buildRecipeDigest;

package/dist/source/team-source.d.ts

@@ -0,0 +1,32 @@
+import type { TeamAppPublisherRegistry } from "@fungi.computer/puffball/publisher";
+import type { PublisherTemplateSeedReceipt } from "./seed-receipt.js";
+export declare class TeamAppSourceError extends Error {
+    readonly code: "denied" | "unavailable";
+    constructor(code: "denied" | "unavailable");
+}
+export declare function readTeamAppSeedProvenance(options: {
+    appId: string;
+    teamId: string;
+    registry: TeamAppPublisherRegistry;
+    readSeedReceipt(appId: PublisherTemplateSeedReceipt["appId"], seedRevision: PublisherTemplateSeedReceipt["seedRevision"]): Promise<PublisherTemplateSeedReceipt | null>;
+}): Promise<Readonly<{
+    appId: string;
+    repository: string;
+    templateSeed: Readonly<{
+        appId: string;
+        revision: string;
+    }>;
+    recipe: PublisherTemplateSeedReceipt["recipe"];
+    buildRecipeDigest: PublisherTemplateSeedReceipt["buildRecipeDigest"];
+}>>;
+/** A fork keeps the seed's exact builder; private UI assets use Vite's relative base. */
+export declare function privateTeamBuildSource(source: Awaited<ReturnType<typeof readTeamAppSeedProvenance>>): Readonly<{
+    appId: string;
+    repository: string;
+    templateSeed: Readonly<{
+        appId: string;
+        revision: string;
+    }>;
+    recipe: PublisherTemplateSeedReceipt["recipe"];
+    buildRecipeDigest: PublisherTemplateSeedReceipt["buildRecipeDigest"];
+}>;

package/dist/source/team-source.js

@@ -0,0 +1,42 @@
+import { parseAppId } from "@fungi.computer/puffball";
+import { digestPinnedRecipe } from "../build-contract.js";
+import { templateRepositoryForApp } from "./template-repository.js";
+export class TeamAppSourceError extends Error {
+    code;
+    constructor(code) {
+        super(`Team App source ${code}`);
+        this.code = code;
+        this.name = "TeamAppSourceError";
+    }
+}
+export async function readTeamAppSeedProvenance(options) {
+    const appId = parseAppId(options.appId);
+    const authorization = await options.registry.authorize(appId, options.teamId);
+    if (authorization.kind !== "authorized")
+        throw new TeamAppSourceError("denied");
+    const registration = authorization.registration;
+    const templateSeed = registration.templateSeed;
+    if (registration.source.provider !== "artifacts" ||
+        templateSeed === undefined)
+        throw new TeamAppSourceError("unavailable");
+    const receipt = await options.readSeedReceipt(parseAppId(templateSeed.appId), templateSeed.revision);
+    if (receipt?.appId !== templateSeed.appId ||
+        receipt.seedRevision !== templateSeed.revision ||
+        receipt.repository !== templateRepositoryForApp(templateSeed.appId) ||
+        digestPinnedRecipe(receipt.recipe) !== receipt.buildRecipeDigest)
+        throw new TeamAppSourceError("unavailable");
+    return Object.freeze({
+        appId,
+        repository: registration.source.repository,
+        templateSeed,
+        recipe: receipt.recipe,
+        buildRecipeDigest: receipt.buildRecipeDigest,
+    });
+}
+/** A fork keeps the seed's exact builder; private UI assets use Vite's relative base. */
+export function privateTeamBuildSource(source) {
+    if (source.recipe.format !== "assets")
+        return source;
+    const recipe = { ...source.recipe, assetBase: "./" };
+    return { ...source, recipe, buildRecipeDigest: digestPinnedRecipe(recipe) };
+}

package/dist/source/template-repository.d.ts

@@ -0,0 +1,2 @@
+/** Derive the private editable source repository from its validated App identity. */
+export declare function templateRepositoryForApp(appId: string): string;

package/dist/source/template-repository.js

@@ -0,0 +1,8 @@
+import { parseAppId } from "@fungi.computer/puffball";
+const TEMPLATE_REPOSITORY_PREFIX = "template-";
+/** Derive the private editable source repository from its validated App identity. */
+export function templateRepositoryForApp(appId) {
+    const parsed = parseAppId(appId);
+    // AppId's maximum 63-character suffix makes this repository at most 72 chars.
+    return `${TEMPLATE_REPOSITORY_PREFIX}${parsed.slice("app_".length)}`;
+}

package/dist/source/template-write.d.ts

@@ -0,0 +1,69 @@
+import * as Schema from "effect/Schema";
+import type { Artifacts } from "@fungi.computer/burrow";
+import type { PublisherTemplateSeedReceipts } from "./seed-receipt.js";
+/** A bounded operator source upload; decoding happens only at the Publisher boundary. */
+export declare const TEMPLATE_WRITE_MAX_REQUEST_BYTES: number;
+export declare const templateWriteInputSchema: Schema.Struct<{
+    readonly appId: Schema.refine<import("@fungi.computer/puffball").AppId, Schema.String>;
+    readonly sourceRevision: Schema.refine<import("@fungi.computer/puffball").SourceRevision, Schema.String>;
+    readonly sourceTreeDigest: Schema.refine<import("@fungi.computer/puffball").Sha256Digest, Schema.String>;
+    readonly recipe: Schema.Struct<{
+        readonly kind: Schema.optional<Schema.Literals<readonly ["bundled-html", "source-html"]>>;
+        readonly bundle: Schema.Literal<true>;
+        readonly entry: Schema.String;
+        readonly format: Schema.Literals<readonly ["html", "esm", "assets"]>;
+        readonly assets: Schema.optional<Schema.Struct<{
+            readonly maxManifestBytes: Schema.Number;
+            readonly maxObjects: Schema.Number;
+            readonly maxObjectBytes: Schema.Number;
+            readonly maxTotalBytes: Schema.Number;
+        }>>;
+        readonly assetBase: Schema.optionalKey<Schema.String>;
+        readonly toolchain: Schema.$Record<Schema.String, Schema.String>;
+        readonly maxOutputBytes: Schema.Number;
+        readonly platform: Schema.Literals<readonly ["browser", "neutral"]>;
+        readonly backend: Schema.Union<readonly [Schema.Null, Schema.Struct<{
+            readonly entry: Schema.optional<Schema.String>;
+            readonly runtime: Schema.Struct<{
+                readonly kind: Schema.Literal<"durable-facet">;
+                readonly stateSchema: Schema.Number;
+            }>;
+            readonly compatibilityDate: Schema.String;
+            readonly exportName: Schema.String;
+        }>]>;
+        readonly target: Schema.Tuple<readonly [Schema.Literal<"es2022">]>;
+    }>;
+    readonly files: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.String;
+        readonly contents: Schema.Uint8ArrayFromBase64;
+    }>>;
+}>;
+export type TemplateWriteInput = Schema.Schema.Type<typeof templateWriteInputSchema>;
+/** The Publisher's own `exchangeGit` admission root (`source-git.ts`) stays the
+ * sole caller of that physical transport; this port only ever sees a Request
+ * in, a Response out, already bound to the one template repository. */
+export type TemplateSourceTransport = Readonly<{
+    ensureRepository: Artifacts["ensureRepository"];
+    exchangeTemplateGit(repository: string, request: Request): Promise<Response>;
+}>;
+/** The only operator template-write result contains provenance, never custody. */
+export declare function seedPublisherTemplate(receipts: PublisherTemplateSeedReceipts, transport: TemplateSourceTransport, rawAppId: string, request: Request): Promise<{
+    readonly kind: "invalid" | "too-large";
+    readonly receipt?: undefined;
+} | {
+    readonly kind: "conflict";
+    readonly receipt?: undefined;
+} | {
+    readonly kind: "recorded" | "existing";
+    readonly receipt: {
+        readonly appId: import("@fungi.computer/puffball").AppId;
+        readonly repository: string;
+        readonly sourceRevision: import("@fungi.computer/puffball").SourceRevision;
+        readonly sourceTreeDigest: import("@fungi.computer/puffball").Sha256Digest;
+        readonly seedRevision: import("@fungi.computer/puffball").SourceRevision;
+        readonly buildRecipeDigest: import("@fungi.computer/puffball").Sha256Digest;
+    };
+} | {
+    readonly kind: "unavailable";
+    readonly receipt?: undefined;
+}>;