@fungi.computer/puffball 0.0.0-stage → 0.0.1

package/dist/internal/public-website-delivery.d.ts

@@ -0,0 +1,59 @@
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import type { PublicSurface, PublicSurfaceAuthority, PublicWebsiteRepresentation, Release, Sha256Digest, StableRoute } from "./app-release-contract.js";
+import { AppReleasePublicWebsiteNotFoundError, AppReleasePublicWebsiteUnavailableError } from "./app-release-contract.js";
+import type { AppReleaseArtifactReader } from "./app-release-artifact-reader.js";
+import type { AppReleaseStore } from "./app-release-store.js";
+import { type ArtifactSnapshotPolicy } from "./verified-artifact-snapshot.js";
+export type PublicWebsiteFailure = AppReleasePublicWebsiteNotFoundError | AppReleasePublicWebsiteUnavailableError;
+export type EligibleSurfaceRelease = Readonly<{
+    appId: Release["appId"];
+    releaseId: Release["releaseId"];
+    stableRoute: StableRoute;
+    artifactDigest: Sha256Digest;
+    mediaType: "application/vnd.fungi.app+json";
+}>;
+/** Resolve the selected Surface's persisted metadata without loading bytes. */
+export declare function createPublicSurfaceAuthorityResolver(options: {
+    readonly store: AppReleaseStore;
+}): (stableRoute: StableRoute) => Effect.Effect<PublicSurfaceAuthority, PublicWebsiteFailure>;
+/** Resolve one previously selected Release's current metadata authority. */
+export declare function createPublicSurfaceAuthorityVersionResolver(options: {
+    readonly store: AppReleaseStore;
+}): (stableRoute: StableRoute, releaseId: Release["releaseId"]) => Effect.Effect<PublicSurfaceAuthority, PublicWebsiteFailure>;
+/** Resolve the immutable owner of one stable route without selecting a Release. */
+export declare function createPublicSurfaceResolver(options: {
+    readonly store: AppReleaseStore;
+}): (stableRoute: StableRoute) => Effect.Effect<PublicSurface, PublicWebsiteFailure>;
+/** Read current eligible Surface authority without loading executable bytes. */
+export declare function createEligibleSurfaceReleaseResolver(options: {
+    readonly store: AppReleaseStore;
+}): (stableRoute: StableRoute) => Effect.Effect<EligibleSurfaceRelease, PublicWebsiteFailure>;
+/** Read one atomic directory; eligibility failures belong to individual entries. */
+export declare function createEligibleSurfaceReleasesResolver(options: {
+    readonly store: AppReleaseStore;
+}): (routes: readonly StableRoute[]) => Effect.Effect<readonly Result.Result<EligibleSurfaceRelease, PublicWebsiteFailure>[], PublicWebsiteFailure>;
+/** Resolve one eligible Release that has previously been selected on this Surface. */
+export declare function createEligibleSurfaceVersionResolver(options: {
+    readonly store: AppReleaseStore;
+}): (stableRoute: StableRoute, releaseId: Release["releaseId"]) => Effect.Effect<EligibleSurfaceRelease, PublicWebsiteFailure>;
+/** Media types accepted by the public website representation resolvers. */
+export type PublicWebsiteMediaType = "text/html; charset=utf-8" | "application/vnd.fungi.app-assets+json";
+/** Compose the one deep public delivery operation and its private cache. */
+export declare function createPublicWebsiteResolver<MediaType extends PublicWebsiteMediaType>(options: {
+    readonly mediaType: MediaType;
+    readonly store: AppReleaseStore;
+    readonly artifactReader: AppReleaseArtifactReader;
+    readonly artifactPolicy?: ArtifactSnapshotPolicy;
+}): (stableRoute: StableRoute) => Effect.Effect<Omit<PublicWebsiteRepresentation, "mediaType"> & {
+    readonly mediaType: MediaType;
+}, PublicWebsiteFailure>;
+/** Compose pinned public delivery for a Release previously selected by a Surface. */
+export declare function createPublicWebsiteVersionResolver<MediaType extends PublicWebsiteMediaType>(options: {
+    readonly mediaType: MediaType;
+    readonly store: AppReleaseStore;
+    readonly artifactReader: AppReleaseArtifactReader;
+    readonly artifactPolicy?: ArtifactSnapshotPolicy;
+}): (stableRoute: StableRoute, releaseId: Release["releaseId"]) => Effect.Effect<Omit<PublicWebsiteRepresentation, "mediaType"> & {
+    readonly mediaType: MediaType;
+}, PublicWebsiteFailure>;

package/dist/internal/public-website-delivery.js

@@ -0,0 +1,232 @@
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import { AppReleasePublicWebsiteNotFoundError, AppReleasePublicWebsiteUnavailableError, } from "./app-release-contract.js";
+import { decodeStableRoute } from "./app-release-schema.js";
+import { getEffectPublicWebsiteAuthorityReader, } from "./public-website-authority.js";
+import { sameImmutableReleaseMaterial } from "./immutable-release-material.js";
+import { readVerifiedArtifactSnapshot, DEFAULT_ARTIFACT_SNAPSHOT_POLICY, } from "./verified-artifact-snapshot.js";
+/** Resolve the selected Surface's persisted metadata without loading bytes. */
+export function createPublicSurfaceAuthorityResolver(options) {
+    return (stableRoute) => decodeRoute(stableRoute).pipe(Effect.flatMap((route) => readAuthority(options.store, route).pipe(Effect.flatMap((authority) => resolveSurfaceAuthority(authority, route)))));
+}
+/** Resolve one previously selected Release's current metadata authority. */
+export function createPublicSurfaceAuthorityVersionResolver(options) {
+    return (stableRoute, releaseId) => decodeRoute(stableRoute).pipe(Effect.flatMap((route) => readAuthority(options.store, route, releaseId).pipe(Effect.flatMap((authority) => resolveSurfaceAuthority(authority, route)))));
+}
+/** Resolve the immutable owner of one stable route without selecting a Release. */
+export function createPublicSurfaceResolver(options) {
+    return (stableRoute) => decodeRoute(stableRoute).pipe(Effect.flatMap((route) => readAuthority(options.store, route).pipe(Effect.flatMap((authority) => {
+        if (authority.kind === "absent")
+            return Effect.fail(notFound());
+        if (authority.kind === "ambiguous" ||
+            authority.surface.stableRoute !== route)
+            return Effect.fail(unavailable());
+        return Effect.succeed(authority.surface);
+    }))));
+}
+/** Read current eligible Surface authority without loading executable bytes. */
+export function createEligibleSurfaceReleaseResolver(options) {
+    const resolve = createEligibleSurfaceReleasesResolver(options);
+    return (route) => resolve([route]).pipe(Effect.flatMap((selections) => {
+        const selection = selections[0];
+        return selection === undefined
+            ? Effect.fail(unavailable())
+            : Effect.fromResult(selection);
+    }));
+}
+/** Read one atomic directory; eligibility failures belong to individual entries. */
+export function createEligibleSurfaceReleasesResolver(options) {
+    return (routes) => Effect.gen(function* () {
+        if (routes.length > 100)
+            return yield* Effect.fail(unavailable());
+        const parsed = yield* Effect.forEach(routes, decodeRoute);
+        if (parsed.length === 0)
+            return [];
+        const read = getEffectPublicWebsiteAuthorityReader(options.store);
+        if (read === undefined)
+            return yield* Effect.fail(unavailable());
+        const authorities = yield* read(parsed.map((stableRoute) => ({ stableRoute }))).pipe(Effect.mapError(unavailable));
+        if (authorities.length !== parsed.length)
+            return yield* Effect.fail(unavailable());
+        return yield* Effect.forEach(parsed, (route, index) => {
+            const authority = authorities[index];
+            if (authority === undefined)
+                return Effect.fail(unavailable());
+            return resolveEligibleAuthority(authority, route).pipe(Effect.map(({ release }) => ({
+                appId: release.appId,
+                releaseId: release.releaseId,
+                stableRoute: route,
+                artifactDigest: release.artifact.artifactDigest,
+                mediaType: "application/vnd.fungi.app+json",
+            })), Effect.result);
+        });
+    });
+}
+/** Resolve one eligible Release that has previously been selected on this Surface. */
+export function createEligibleSurfaceVersionResolver(options) {
+    return (stableRoute, releaseId) => createPublicSurfaceAuthorityVersionResolver(options)(stableRoute, releaseId).pipe(Effect.flatMap((authority) => authority.revocation.kind === "active"
+        ? Effect.succeed({
+            appId: authority.release.appId,
+            releaseId: authority.release.releaseId,
+            stableRoute: authority.surface.stableRoute,
+            artifactDigest: authority.digest,
+            mediaType: "application/vnd.fungi.app+json",
+        })
+        : Effect.fail(unavailable())));
+}
+/** Compose the one deep public delivery operation and its private cache. */
+export function createPublicWebsiteResolver(options) {
+    let cache;
+    const artifactPolicy = options.artifactPolicy ?? DEFAULT_ARTIFACT_SNAPSHOT_POLICY;
+    return (stableRoute) => decodeRoute(stableRoute).pipe(Effect.flatMap((route) => readAuthority(options.store, route).pipe(Effect.map((authority) => ({ authority, route })))), Effect.flatMap(({ authority, route }) => resolveEligibleAuthority(authority, route).pipe(Effect.flatMap((eligible) => readVerifiedArtifact(options.artifactReader, eligible.ui, artifactPolicy, options.mediaType).pipe(Effect.flatMap((artifact) => readAuthority(options.store, route).pipe(Effect.flatMap((second) => sameAuthority(authority, second)
+        ? Effect.succeed(representation(eligible.release.releaseId, selectCache(cache, eligible.ui.digest, artifact))).pipe(Effect.tap((result) => {
+            cache = {
+                digest: result.digest,
+                artifact: {
+                    digest: result.digest,
+                    mediaType: result.mediaType,
+                    byteLength: result.byteLength,
+                    bytes: result.bytes,
+                },
+            };
+            return Effect.void;
+        }))
+        : Effect.fail(unavailable())))))))));
+}
+/** Compose pinned public delivery for a Release previously selected by a Surface. */
+export function createPublicWebsiteVersionResolver(options) {
+    let cache;
+    const artifactPolicy = options.artifactPolicy ?? DEFAULT_ARTIFACT_SNAPSHOT_POLICY;
+    return (stableRoute, releaseId) => decodeRoute(stableRoute).pipe(Effect.flatMap((route) => readAuthority(options.store, route, releaseId).pipe(Effect.map((authority) => ({ authority, route })))), Effect.flatMap(({ authority, route }) => resolveEligibleAuthority(authority, route).pipe(Effect.flatMap((eligible) => readVerifiedArtifact(options.artifactReader, eligible.ui, artifactPolicy, options.mediaType).pipe(Effect.flatMap((artifact) => readAuthority(options.store, route, releaseId).pipe(Effect.flatMap((second) => {
+        if (!sameAuthority(authority, second))
+            return Effect.fail(unavailable());
+        const selected = selectCache(cache, eligible.ui.digest, artifact);
+        cache = { digest: selected.digest, artifact: selected };
+        return Effect.succeed(representation(eligible.release.releaseId, selected));
+    }))))))));
+}
+function decodeRoute(input) {
+    return Result.match(decodeStableRoute(input), {
+        onFailure: () => Effect.fail(notFound()),
+        onSuccess: Effect.succeed,
+    });
+}
+function readAuthority(store, stableRoute, expectedReleaseId) {
+    const read = getEffectPublicWebsiteAuthorityReader(store);
+    const request = expectedReleaseId === undefined
+        ? { stableRoute }
+        : { stableRoute, expectedReleaseId };
+    return read === undefined
+        ? Effect.fail(unavailable())
+        : read([request]).pipe(Effect.mapError(unavailable), Effect.flatMap((values) => values[0] === undefined
+            ? Effect.fail(unavailable())
+            : Effect.succeed(values[0])));
+}
+function resolveEligibleAuthority(authority, requestedRoute) {
+    return resolveSurfaceAuthority(authority, requestedRoute).pipe(Effect.flatMap((resolved) => resolved.revocation.kind === "active"
+        ? resolvePublishedUi(resolved)
+        : Effect.fail(unavailable())));
+}
+function resolveSurfaceAuthority(authority, requestedRoute) {
+    if (authority.kind === "absent")
+        return Effect.fail(notFound());
+    if (authority.kind === "ambiguous")
+        return Effect.fail(unavailable());
+    if (authority.kind === "unselected")
+        return Effect.fail(notFound());
+    if (authority.surface.stableRoute !== requestedRoute)
+        return Effect.fail(unavailable());
+    if (authority.release.kind !== "found")
+        return Effect.fail(unavailable());
+    const release = authority.release.release;
+    const verification = authority.release.verification;
+    if (verification.kind !== "verified")
+        return Effect.fail(unavailable());
+    const coherent = [
+        authority.releaseId === release.releaseId,
+        authority.app.appId === authority.surface.appId,
+        release.appId === authority.surface.appId,
+        verification.digest === release.artifact.artifactDigest,
+    ].every(Boolean);
+    if (!coherent)
+        return Effect.fail(unavailable());
+    return Effect.succeed({
+        app: authority.app,
+        sequence: authority.sequence,
+        currentReleaseId: authority.currentReleaseId,
+        release,
+        surface: authority.surface,
+        digest: verification.digest,
+        revocation: authority.release.revocation,
+        description: verification.description,
+    });
+}
+function resolvePublishedUi(authority) {
+    if (authority.description.ui === null)
+        return Effect.fail(unavailable());
+    return Effect.succeed({
+        release: authority.release,
+        ui: authority.description.ui,
+    });
+}
+function readVerifiedArtifact(artifactReader, artifactReference, artifactPolicy, mediaType) {
+    return readVerifiedArtifactSnapshot(artifactReader, {
+        artifactRef: artifactReference.artifactRef,
+        expectedDigest: artifactReference.digest,
+        expectedObject: {
+            version: artifactReference.version,
+            byteLength: artifactReference.byteLength,
+        },
+    }, artifactPolicy).pipe(Effect.mapError(unavailable), Effect.flatMap((artifact) => artifact.mediaType === mediaType
+        ? Effect.succeed({
+            ...artifact,
+            mediaType,
+        })
+        : Effect.fail(unavailable())));
+}
+function selectCache(cache, expectedDigest, artifact) {
+    return cache?.digest === expectedDigest && artifact.digest === expectedDigest
+        ? cache.artifact
+        : artifact;
+}
+function representation(releaseId, artifact) {
+    return {
+        releaseId,
+        digest: artifact.digest,
+        mediaType: artifact.mediaType,
+        byteLength: artifact.byteLength,
+        bytes: {
+            byteLength: artifact.byteLength,
+            copy: () => artifact.bytes.copy(),
+        },
+    };
+}
+function sameAuthority(left, right) {
+    if (left.kind !== "selected" || right.kind !== "selected")
+        return false;
+    if (left.surface.publicSurfaceId !== right.surface.publicSurfaceId ||
+        left.surface.appId !== right.surface.appId ||
+        left.surface.stableRoute !== right.surface.stableRoute) {
+        return false;
+    }
+    return (left.releaseId === right.releaseId &&
+        sameLifecycle(left.release, right.release));
+}
+function sameLifecycle(left, right) {
+    if (left.kind !== "found" || right.kind !== "found")
+        return left.kind === right.kind;
+    const leftRelease = left.release;
+    const rightRelease = right.release;
+    return (sameImmutableReleaseMaterial(leftRelease, rightRelease) &&
+        left.verification.kind === right.verification.kind &&
+        (left.verification.kind !== "verified" ||
+            right.verification.kind !== "verified" ||
+            left.verification.digest === right.verification.digest) &&
+        left.revocation.kind === right.revocation.kind);
+}
+function notFound() {
+    return new AppReleasePublicWebsiteNotFoundError();
+}
+function unavailable() {
+    return new AppReleasePublicWebsiteUnavailableError();
+}

package/dist/internal/public-website-fetch.d.ts

@@ -0,0 +1,8 @@
+import type { AppReleaseCatalog } from "./app-release-contract.js";
+export type AppReleasePublicWebsiteFetchHandler = Readonly<{
+    fetch(request: Request): Promise<Response>;
+}>;
+/** Private Fetch projection for the anonymous public-website tracer. */
+export declare function createPublicWebsiteFetchHandler(options: {
+    readonly resolvePublicWebsite: AppReleaseCatalog["resolvePublicWebsite"];
+}): AppReleasePublicWebsiteFetchHandler;

package/dist/internal/public-website-fetch.js

@@ -0,0 +1,54 @@
+import { AppReleasePublicWebsiteNotFoundError } from "./app-release-contract.js";
+import { decodeStableRoute } from "./app-release-schema.js";
+const htmlContentType = "text/html; charset=utf-8";
+const notFoundHtml = "<!doctype html><title>Not found</title>";
+const unavailableHtml = "<!doctype html><title>Unavailable</title>";
+const methodNotAllowedHtml = "<!doctype html><title>Method not allowed</title>";
+/** Private Fetch projection for the anonymous public-website tracer. */
+export function createPublicWebsiteFetchHandler(options) {
+    return {
+        async fetch(request) {
+            if (request.method !== "GET")
+                return methodNotAllowed();
+            const stableRoute = parsePathname(request.url);
+            if (stableRoute === undefined)
+                return notFound();
+            try {
+                const representation = await options.resolvePublicWebsite(stableRoute);
+                return delivered(representation);
+            }
+            catch (error) {
+                return error instanceof AppReleasePublicWebsiteNotFoundError
+                    ? notFound()
+                    : unavailable();
+            }
+        },
+    };
+}
+function parsePathname(requestUrl) {
+    if (!URL.canParse(requestUrl))
+        return undefined;
+    const decoded = decodeStableRoute(new URL(requestUrl).pathname);
+    return decoded._tag === "Success" ? decoded.success : undefined;
+}
+function delivered(representation) {
+    return new Response(new Uint8Array(representation.bytes.copy()), {
+        status: 200,
+        headers: { "content-type": htmlContentType },
+    });
+}
+function notFound() {
+    return fixedResponse(notFoundHtml, 404);
+}
+function unavailable() {
+    return fixedResponse(unavailableHtml, 503);
+}
+function methodNotAllowed() {
+    return fixedResponse(methodNotAllowedHtml, 405);
+}
+function fixedResponse(body, status) {
+    return new Response(body, {
+        status,
+        headers: { "content-type": htmlContentType },
+    });
+}

package/dist/internal/release-transition-material.d.ts

@@ -0,0 +1,3 @@
+import type { ReleaseTransition } from "./app-release-contract.js";
+/** Compare the durable material owned by one operation-scoped transition key. */
+export declare function sameReleaseTransitionMaterial(left: ReleaseTransition, right: ReleaseTransition): boolean;

package/dist/internal/release-transition-material.js

@@ -0,0 +1,11 @@
+/** Compare the durable material owned by one operation-scoped transition key. */
+export function sameReleaseTransitionMaterial(left, right) {
+    if (left.kind !== right.kind ||
+        left.idempotencyKey !== right.idempotencyKey ||
+        left.releaseId !== right.releaseId) {
+        return false;
+    }
+    return (left.kind === "revocation" ||
+        (right.kind !== "revocation" &&
+            left.publicSurfaceId === right.publicSurfaceId));
+}

package/dist/internal/verified-artifact-snapshot.d.ts

@@ -0,0 +1,41 @@
+import * as Effect from "effect/Effect";
+import type { ArtifactRef, ArtifactVerificationIntent, Sha256Digest, VerifiedArtifactRead } from "./app-release-contract.js";
+import type { AppReleaseArtifactReader } from "./app-release-artifact-reader.js";
+/** Private, package-owned immutable artifact snapshot shape. */
+export type VerifiedArtifactSnapshot = Omit<VerifiedArtifactRead, "kind">;
+/** Trusted composition limit for reading one immutable artifact. */
+export type ArtifactSnapshotPolicy = Readonly<{
+    /** Maximum verified artifact size in bytes. */
+    readonly maxBytes: number;
+    readonly maxManifestBytes?: number;
+}>;
+export declare const DEFAULT_ARTIFACT_SNAPSHOT_POLICY: ArtifactSnapshotPolicy;
+export declare function createArtifactSnapshotPolicy(maxBytes: number, maxManifestBytes?: number): ArtifactSnapshotPolicy;
+/** Closed reasons that an immutable artifact snapshot cannot be established. */
+export type VerifiedArtifactSnapshotFailure = {
+    readonly kind: "unavailable";
+} | {
+    readonly kind: "missing";
+} | {
+    readonly kind: "digest-mismatch";
+} | {
+    readonly kind: "invalid-snapshot";
+    readonly cause?: unknown;
+};
+/**
+ * Read, decode, classify, and own one hostile artifact-reader result.
+ *
+ * Callers receive only a bounded immutable snapshot or this closed internal
+ * failure vocabulary. Publication may request complete asset verification;
+ * ordinary delivery leaves that work to the requested-object handler. Reader
+ * and schema details do not escape this module.
+ */
+export declare function readVerifiedArtifactSnapshot(artifactReader: AppReleaseArtifactReader, input: {
+    readonly artifactRef: ArtifactRef;
+    readonly expectedDigest: Sha256Digest;
+    readonly expectedObject?: {
+        readonly version: string;
+        readonly byteLength: number;
+    };
+    readonly verification?: ArtifactVerificationIntent;
+}, policy?: ArtifactSnapshotPolicy): Effect.Effect<VerifiedArtifactSnapshot, VerifiedArtifactSnapshotFailure>;

package/dist/internal/verified-artifact-snapshot.js

@@ -0,0 +1,91 @@
+import * as Effect from "effect/Effect";
+import { decodeArtifactReadResult } from "./app-release-schema.js";
+import { reportFailure } from "./failure.js";
+export const DEFAULT_ARTIFACT_SNAPSHOT_POLICY = Object.freeze({ maxBytes: 65_536 });
+export function createArtifactSnapshotPolicy(maxBytes, maxManifestBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+        throw new Error("Invalid artifact snapshot policy");
+    if (maxManifestBytes !== undefined &&
+        (!Number.isSafeInteger(maxManifestBytes) || maxManifestBytes < 1))
+        throw new Error("Invalid asset manifest policy");
+    return Object.freeze(maxManifestBytes === undefined
+        ? { maxBytes }
+        : { maxBytes, maxManifestBytes });
+}
+/**
+ * Read, decode, classify, and own one hostile artifact-reader result.
+ *
+ * Callers receive only a bounded immutable snapshot or this closed internal
+ * failure vocabulary. Publication may request complete asset verification;
+ * ordinary delivery leaves that work to the requested-object handler. Reader
+ * and schema details do not escape this module.
+ */
+export function readVerifiedArtifactSnapshot(artifactReader, input, policy = DEFAULT_ARTIFACT_SNAPSHOT_POLICY) {
+    return artifactReader.read(input).pipe(Effect.mapError(() => artifactFailure("unavailable")), Effect.flatMap((raw) => decodeArtifactReadResult(raw).pipe(Effect.mapError(() => artifactFailure("invalid-snapshot")), Effect.flatMap((result) => {
+        switch (result.kind) {
+            case "unavailable":
+                return Effect.fail(artifactFailure("unavailable"));
+            case "missing":
+                return Effect.fail(artifactFailure("missing"));
+            case "digest-mismatch":
+                return Effect.fail(artifactFailure("digest-mismatch"));
+            case "verified": {
+                if (result.digest !== input.expectedDigest) {
+                    return Effect.fail(artifactFailure("digest-mismatch"));
+                }
+                let snapshot;
+                try {
+                    snapshot = createVerifiedArtifactSnapshot(result, policy);
+                }
+                catch (cause) {
+                    reportFailure("copy verified artifact snapshot", cause);
+                    return Effect.fail(artifactFailure("invalid-snapshot", cause));
+                }
+                return snapshot === undefined
+                    ? Effect.fail(artifactFailure("invalid-snapshot"))
+                    : Effect.succeed(snapshot);
+            }
+        }
+    }))));
+}
+/**
+ * Copy hostile verified bytes into the package-owned immutable snapshot.
+ *
+ * Undefined means that the foreign result could not satisfy the fixed A1
+ * snapshot bounds. The returned closure only retains the owned copy.
+ */
+function createVerifiedArtifactSnapshot(input, policy) {
+    const isManifest = input.mediaType === "application/vnd.fungi.app-assets+json" ||
+        input.mediaType === "application/vnd.fungi.app+json";
+    const maxBytes = isManifest
+        ? (policy.maxManifestBytes ?? policy.maxBytes)
+        : policy.maxBytes;
+    if (!Number.isInteger(input.byteLength) ||
+        input.byteLength < 1 ||
+        input.byteLength > maxBytes) {
+        return undefined;
+    }
+    const bytes = input.bytes;
+    if (bytes.byteLength !== input.byteLength) {
+        return undefined;
+    }
+    const foreignCopy = bytes.copy();
+    if (!(foreignCopy instanceof Uint8Array) ||
+        foreignCopy.byteLength !== input.byteLength) {
+        return undefined;
+    }
+    const ownedBytes = new Uint8Array(input.byteLength);
+    ownedBytes.set(foreignCopy);
+    return {
+        digest: input.digest,
+        mediaType: input.mediaType,
+        byteLength: ownedBytes.byteLength,
+        bytes: {
+            byteLength: ownedBytes.byteLength,
+            copy: () => ownedBytes.slice(),
+        },
+    };
+}
+function artifactFailure(kind, cause) {
+    return cause === undefined ? { kind } : { kind, cause };
+}

package/dist/public-route-moderation.d.ts

@@ -0,0 +1,83 @@
+import * as Schema from "effect/Schema";
+import type { AppReleaseD1Database } from "./cloudflare.js";
+declare const commandSchema: Schema.Struct<{
+    readonly operationId: Schema.String;
+    readonly operatorId: Schema.String;
+    readonly reason: Schema.String;
+    readonly target: Schema.Struct<{
+        readonly publicSurfaceId: Schema.refine<import("./index.js").PublicSurfaceId, Schema.String>;
+        readonly appId: Schema.refine<import("./index.js").AppId, Schema.String>;
+        readonly teamId: Schema.String;
+        readonly stableRoute: Schema.refine<import("./index.js").StableRoute, Schema.String>;
+    }>;
+}>;
+export type PublicRouteRemoval = Schema.Schema.Type<typeof commandSchema>;
+declare const operationSchema: Schema.Struct<{
+    readonly operation_id: Schema.String;
+    readonly kind: Schema.Literals<readonly ["unlist-and-release", "re-allow"]>;
+    readonly public_surface_id: Schema.refine<import("./index.js").PublicSurfaceId, Schema.String>;
+    readonly app_id: Schema.refine<import("./index.js").AppId, Schema.String>;
+    readonly team_id: Schema.String;
+    readonly stable_route: Schema.refine<import("./index.js").StableRoute, Schema.String>;
+    readonly route_key: Schema.String;
+    readonly reason: Schema.String;
+    readonly initiated_by: Schema.String;
+    readonly created_at: Schema.Number;
+    readonly removal_operation_id: Schema.NullOr<Schema.String>;
+    readonly state: Schema.Literals<readonly ["pending", "complete", "superseded-by-erasure"]>;
+    readonly completed_at: Schema.NullOr<Schema.Number>;
+}>;
+export type PublicRouteOperation = Schema.Schema.Type<typeof operationSchema>;
+export type PublicRouteModerationResult = {
+    readonly kind: "recorded";
+    readonly operation: PublicRouteOperation;
+} | {
+    readonly kind: "conflict" | "unavailable";
+};
+/** Publisher phases only. Its Operator composes the Marketplace phase between prepare and complete. */
+export declare function createD1PublicRouteModeration(database: AppReleaseD1Database, now?: () => number): {
+    prepareRemoval: (input: PublicRouteRemoval) => Promise<PublicRouteModerationResult>;
+    prepareReallow: (input: PublicRouteRemoval, removalId: string) => Promise<PublicRouteModerationResult>;
+    complete: (operationId: string, operatorId: string) => Promise<PublicRouteModerationResult>;
+    pending: (after?: string) => Promise<{
+        readonly operation_id: string;
+        readonly kind: "unlist-and-release" | "re-allow";
+        readonly public_surface_id: import("./index.js").PublicSurfaceId;
+        readonly app_id: import("./index.js").AppId;
+        readonly team_id: string;
+        readonly stable_route: import("./index.js").StableRoute;
+        readonly route_key: string;
+        readonly reason: string;
+        readonly initiated_by: string;
+        readonly created_at: number;
+        readonly removal_operation_id: string | null;
+        readonly state: "complete" | "pending" | "superseded-by-erasure";
+        readonly completed_at: number | null;
+    }[]>;
+    read: (operationId: string) => Promise<{
+        readonly operation_id: string;
+        readonly kind: "unlist-and-release" | "re-allow";
+        readonly public_surface_id: import("./index.js").PublicSurfaceId;
+        readonly app_id: import("./index.js").AppId;
+        readonly team_id: string;
+        readonly stable_route: import("./index.js").StableRoute;
+        readonly route_key: string;
+        readonly reason: string;
+        readonly initiated_by: string;
+        readonly created_at: number;
+        readonly removal_operation_id: string | null;
+        readonly state: "complete" | "pending" | "superseded-by-erasure";
+        readonly completed_at: number | null;
+    } | null>;
+};
+declare const platformReplaySchema: Schema.Struct<{
+    readonly publicSurfaceId: Schema.refine<import("./index.js").PublicSurfaceId, Schema.String>;
+    readonly appId: Schema.refine<import("./index.js").AppId, Schema.String>;
+    readonly stableRoute: Schema.refine<import("./index.js").StableRoute, Schema.String>;
+    readonly teamId: Schema.String;
+    readonly operatorId: Schema.String;
+}>;
+export type PlatformOwnerReplay = Schema.Schema.Type<typeof platformReplaySchema>;
+/** Private Operator door only: Hub supplies the resolved System Team and admitted actor. */
+export declare function recordD1PlatformOwnerReplay(database: AppReleaseD1Database, raw: PlatformOwnerReplay): Promise<boolean>;
+export {};