@fungi.computer/puffball 0.0.0-stage → 0.0.1

package/dist/public-route-moderation.js

@@ -0,0 +1,236 @@
+import * as Schema from "effect/Schema";
+import { appIdSchema, publicSurfaceIdSchema, stableRouteSchema, } from "./internal/app-release-schema.js";
+import { publicRouteKey, publicRoutePolicy } from "./public-route-policy.js";
+import { reportFailure } from "./internal/failure.js";
+const identity = Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(256)));
+const commandSchema = Schema.Struct({
+    operationId: identity,
+    operatorId: identity,
+    reason: Schema.String.pipe(Schema.check(Schema.isPattern(/\S/u)), Schema.check(Schema.isMaxLength(1000))),
+    target: Schema.Struct({
+        publicSurfaceId: publicSurfaceIdSchema,
+        appId: appIdSchema,
+        teamId: identity,
+        stableRoute: stableRouteSchema,
+    }),
+});
+const operationSchema = Schema.Struct({
+    operation_id: identity,
+    kind: Schema.Literals(["unlist-and-release", "re-allow"]),
+    public_surface_id: publicSurfaceIdSchema,
+    app_id: appIdSchema,
+    team_id: identity,
+    stable_route: stableRouteSchema,
+    route_key: Schema.String,
+    reason: Schema.String,
+    initiated_by: identity,
+    created_at: Schema.Number,
+    removal_operation_id: Schema.NullOr(identity),
+    state: Schema.Literals(["pending", "complete", "superseded-by-erasure"]),
+    completed_at: Schema.NullOr(Schema.Number),
+});
+/** Publisher phases only. Its Operator composes the Marketplace phase between prepare and complete. */
+export function createD1PublicRouteModeration(database, now = Date.now) {
+    const read = async (operationId) => {
+        const row = await database
+            .prepare("SELECT * FROM app_release_route_operations WHERE operation_id=?")
+            .bind(operationId)
+            .first();
+        return row === null ? null : Schema.decodeUnknownSync(operationSchema)(row);
+    };
+    const protect = async (action) => {
+        try {
+            return await action();
+        }
+        catch (cause) {
+            reportFailure("public route moderation", cause);
+            return { kind: "unavailable" };
+        }
+    };
+    const matches = (operation, input, kind, removalId) => operation.kind === kind &&
+        operation.public_surface_id === input.target.publicSurfaceId &&
+        operation.app_id === input.target.appId &&
+        operation.team_id === input.target.teamId &&
+        operation.stable_route === input.target.stableRoute &&
+        operation.reason === input.reason &&
+        operation.removal_operation_id === removalId;
+    const prepare = (raw, removalId) => protect(async () => {
+        const input = Schema.decodeUnknownSync(commandSchema, {
+            onExcessProperty: "error",
+        })(raw);
+        const kind = removalId === null ? "unlist-and-release" : "re-allow";
+        const existing = await read(input.operationId);
+        if (existing)
+            return matches(existing, input, kind, removalId) &&
+                existing.state !== "superseded-by-erasure"
+                ? { kind: "recorded", operation: existing }
+                : { kind: "conflict" };
+        const at = Math.floor(now() / 1000);
+        const key = publicRouteKey(input.target.stableRoute);
+        const material = [
+            input.operationId,
+            kind,
+            input.target.publicSurfaceId,
+            input.target.appId,
+            input.target.teamId,
+            input.target.stableRoute,
+            key,
+            input.reason,
+            input.operatorId,
+            at,
+            removalId,
+        ];
+        const eligible = removalId === null
+            ? `EXISTS (SELECT 1 FROM app_release_route_claims c
+         JOIN app_release_public_surfaces s ON s.public_surface_id=c.public_surface_id
+         WHERE c.public_surface_id=? AND s.app_id=? AND c.team_id=? AND c.stable_route=? AND c.state='held')`
+            : `EXISTS (SELECT 1 FROM app_release_team_route_blocks b
+         JOIN app_release_route_operations removal ON removal.operation_id=b.removal_operation_id
+         WHERE removal.public_surface_id=? AND removal.app_id=? AND b.team_id=? AND removal.stable_route=?
+           AND b.removal_operation_id=? AND removal.state='complete')`;
+        const guardValues = [
+            input.target.publicSurfaceId,
+            input.target.appId,
+            input.target.teamId,
+            input.target.stableRoute,
+            ...(removalId === null ? [] : [removalId]),
+        ];
+        // Every mutation joins the full bound material, so a racing changed-ID replay cannot advance it.
+        const guard = `SELECT operation_id FROM app_release_route_operations
+      WHERE operation_id=? AND kind=? AND public_surface_id=? AND app_id=? AND team_id=?
+        AND stable_route=? AND route_key=? AND reason=? AND state='pending'
+        AND removal_operation_id IS ?`;
+        const guardBindings = [...material.slice(0, 8), removalId];
+        const statements = [
+            database
+                .prepare(`INSERT INTO app_release_route_operations
+      (operation_id,kind,public_surface_id,app_id,team_id,stable_route,route_key,reason,initiated_by,created_at,removal_operation_id,state)
+      SELECT ?,?,?,?,?,?,?,?,?,?,?,'pending' WHERE ${eligible} ON CONFLICT DO NOTHING`)
+                .bind(...material, ...guardValues),
+        ];
+        if (removalId === null)
+            statements.push(database
+                .prepare(`UPDATE app_release_route_claims SET state='removing',removal_operation_id=?
+        WHERE public_surface_id=? AND state='held' AND EXISTS (${guard})`)
+                .bind(input.operationId, input.target.publicSurfaceId, ...guardBindings), database
+                .prepare(`INSERT INTO app_release_surface_retirements(public_surface_id,operation_id)
+        SELECT public_surface_id,operation_id FROM app_release_route_operations WHERE operation_id IN (${guard})
+        ON CONFLICT DO NOTHING`)
+                .bind(...guardBindings), database
+                .prepare(`INSERT INTO app_release_team_route_blocks(team_id,route_key,stable_route,removal_operation_id)
+        SELECT team_id,route_key,stable_route,operation_id FROM app_release_route_operations WHERE operation_id IN (${guard})
+        ON CONFLICT(team_id,route_key) DO UPDATE SET removal_operation_id=excluded.removal_operation_id,stable_route=excluded.stable_route`)
+                .bind(...guardBindings));
+        statements.push(database
+            .prepare(`INSERT INTO app_release_route_operation_steps(operation_id,phase,operator_id,recorded_at)
+      SELECT operation_id,'prepared',?,? FROM app_release_route_operations WHERE operation_id IN (${guard}) ON CONFLICT DO NOTHING`)
+            .bind(input.operatorId, at, ...guardBindings));
+        const results = await database.batch(statements);
+        if (results.length !== statements.length ||
+            results.some((result) => !result.success))
+            throw new Error("Route moderation batch unavailable");
+        const operation = await read(input.operationId);
+        return operation && matches(operation, input, kind, removalId)
+            ? { kind: "recorded", operation }
+            : { kind: "conflict" };
+    });
+    /** Call only after the corresponding Marketplace owner returns its committed phase. */
+    const complete = (operationId, operatorId) => protect(async () => {
+        const id = Schema.decodeUnknownSync(identity)(operationId);
+        const actor = Schema.decodeUnknownSync(identity)(operatorId);
+        const operation = await read(id);
+        if (!operation || operation.state === "superseded-by-erasure")
+            return { kind: "conflict" };
+        if (operation.state === "complete")
+            return { kind: "recorded", operation };
+        const at = Math.floor(now() / 1000);
+        const statements = [];
+        if (operation.kind === "unlist-and-release") {
+            // The exact still-removing claim is the only source of a new hold. A stale replay cannot freeze a later claimant.
+            statements.push(database
+                .prepare(`INSERT INTO app_release_route_holds(route_key,stable_route,until_s,cause,operation_id)
+        SELECT c.route_key,c.stable_route,?,'operator-release',o.operation_id
+        FROM app_release_route_claims c JOIN app_release_route_operations o
+          ON o.operation_id=c.removal_operation_id AND o.public_surface_id=c.public_surface_id
+        WHERE o.operation_id=? AND o.state='pending' AND c.state='removing'
+        ON CONFLICT(route_key) DO UPDATE SET until_s=max(until_s,excluded.until_s),
+          cause=CASE WHEN cause='erasure' THEN cause ELSE excluded.cause END,
+          operation_id=CASE WHEN cause='erasure' THEN operation_id ELSE excluded.operation_id END`)
+                .bind(at + publicRoutePolicy.releaseCooldownSeconds, id));
+            statements.push(database
+                .prepare(`DELETE FROM app_release_route_claims
+        WHERE public_surface_id=? AND state='removing' AND removal_operation_id=?
+          AND EXISTS (SELECT 1 FROM app_release_route_holds h WHERE h.route_key=app_release_route_claims.route_key AND h.until_s>=?)`)
+                .bind(operation.public_surface_id, id, at + publicRoutePolicy.releaseCooldownSeconds));
+        }
+        else
+            statements.push(database
+                .prepare(`DELETE FROM app_release_team_route_blocks
+      WHERE team_id=? AND route_key=? AND removal_operation_id=?`)
+                .bind(operation.team_id, operation.route_key, operation.removal_operation_id));
+        const completed = operation.kind === "unlist-and-release"
+            ? `NOT EXISTS (SELECT 1 FROM app_release_route_claims c WHERE c.public_surface_id=app_release_route_operations.public_surface_id)
+         AND EXISTS (SELECT 1 FROM app_release_route_holds h WHERE h.route_key=app_release_route_operations.route_key AND h.operation_id=app_release_route_operations.operation_id)`
+            : `NOT EXISTS (SELECT 1 FROM app_release_team_route_blocks b WHERE b.team_id=app_release_route_operations.team_id AND b.route_key=app_release_route_operations.route_key)`;
+        statements.push(database
+            .prepare(`UPDATE app_release_route_operations SET state='complete',completed_at=?
+      WHERE operation_id=? AND state='pending' AND ${completed}`)
+            .bind(at, id));
+        statements.push(database
+            .prepare(`INSERT INTO app_release_route_operation_steps(operation_id,phase,operator_id,recorded_at)
+      SELECT operation_id,'completed',?,? FROM app_release_route_operations WHERE operation_id=? AND state='complete'
+      ON CONFLICT DO NOTHING`)
+            .bind(actor, at, id));
+        const results = await database.batch(statements);
+        if (results.length !== statements.length ||
+            results.some((result) => !result.success))
+            throw new Error("Route moderation batch unavailable");
+        const result = await read(id);
+        return result?.state === "complete"
+            ? { kind: "recorded", operation: result }
+            : { kind: "conflict" };
+    });
+    const pending = async (after = "") => {
+        const cursor = Schema.decodeUnknownSync(Schema.String.pipe(Schema.check(Schema.isMaxLength(256))))(after);
+        const result = await database
+            .prepare("SELECT * FROM app_release_route_operations WHERE state='pending' AND operation_id>? ORDER BY operation_id LIMIT 100")
+            .bind(cursor)
+            .all();
+        return result.results.map((row) => Schema.decodeUnknownSync(operationSchema)(row));
+    };
+    return {
+        prepareRemoval: (input) => prepare(input, null),
+        prepareReallow: (input, removalId) => prepare(input, Schema.decodeUnknownSync(identity)(removalId)),
+        complete,
+        pending,
+        read,
+    };
+}
+const platformReplaySchema = Schema.Struct({
+    publicSurfaceId: publicSurfaceIdSchema,
+    appId: appIdSchema,
+    stableRoute: stableRouteSchema,
+    teamId: identity,
+    operatorId: identity,
+});
+/** Private Operator door only: Hub supplies the resolved System Team and admitted actor. */
+export async function recordD1PlatformOwnerReplay(database, raw) {
+    const input = Schema.decodeUnknownSync(platformReplaySchema)(raw);
+    const row = await database
+        .prepare(`
+    INSERT INTO app_release_platform_owner_replays
+      (public_surface_id,app_id,stable_route,owner_team_id,publisher_user_id,operator_user_id,recorded_at)
+    SELECT s.public_surface_id,s.app_id,s.stable_route,s.publisher_team_id,s.publisher_user_id,?,unixepoch()
+    FROM app_release_public_surfaces s
+    JOIN app_release_route_claims c ON c.public_surface_id=s.public_surface_id AND c.route_key=s.route_key
+    JOIN app_release_platform_routes p ON p.app_id=s.app_id AND p.stable_route=s.stable_route AND p.route_key=s.route_key
+    WHERE s.public_surface_id=? AND s.app_id=? AND s.stable_route=?
+      AND s.publisher_team_id=? AND c.team_id=s.publisher_team_id
+      AND c.user_id=s.publisher_user_id AND c.state='held' AND s.authority_kind='platform'
+      AND s.publisher_user_id<>?
+      AND NOT EXISTS (SELECT 1 FROM app_release_surface_retirements x WHERE x.public_surface_id=s.public_surface_id)
+    RETURNING public_surface_id`)
+        .bind(input.operatorId, input.publicSurfaceId, input.appId, input.stableRoute, input.teamId, input.operatorId)
+        .first();
+    return row !== null;
+}

package/dist/public-route-policy.d.ts

@@ -0,0 +1,51 @@
+import * as Schema from "effect/Schema";
+/** CTO customer-publication policy. Deployment projects this one configuration. */
+export declare const publicRoutePolicy: {
+    readonly version: 1;
+    readonly maxPublicRoutesPerTeam: 20;
+    readonly maxUnusedSurfacesPerApp: 20;
+    readonly releaseCooldownSeconds: number;
+    readonly erasureTombstoneSeconds: number;
+    readonly reservedWords: readonly ["admin", "administrator", "api", "assets", "auth", "billing", "botanical", "docs", "fungi", "help", "login", "logout", "oauth", "operator", "security", "settings", "signin", "signup", "static", "status", "support", "www"];
+    readonly brandPrefixes: readonly ["fungi"];
+    readonly brandWordExceptions: readonly ["fungible", "fungicide"];
+};
+/** Comparison only: a key never repairs or replaces the canonical route URL. */
+export declare function publicRouteKey(value: string): string;
+/** Router prefixes and platform assignments are supplied by their owners. */
+export declare function isReservedPublicRoute(route: string, structuralRoutes: readonly string[]): boolean;
+/** Deployment supplies routes from the platform plan and App-origin router. */
+export declare const publicRouteConfigurationSchema: Schema.Struct<{
+    readonly platformRoutes: Schema.$Array<Schema.Struct<{
+        readonly appId: Schema.refine<import("./index.js").AppId, Schema.String>;
+        readonly stableRoute: Schema.refine<import("./index.js").StableRoute, Schema.String>;
+    }>>;
+    readonly structuralRoutes: Schema.$Array<Schema.refine<import("./index.js").StableRoute, Schema.String>>;
+}>;
+export type PublicRouteConfiguration = Schema.Schema.Type<typeof publicRouteConfigurationSchema>;
+/** The deployed checksum binds both maintained policy and environment assignments. */
+export declare function capturePublicRoutePolicy(input: unknown): Promise<{
+    configuration: {
+        platformRoutes: {
+            readonly appId: import("./index.js").AppId;
+            readonly stableRoute: import("./index.js").StableRoute;
+        }[];
+        structuralRoutes: import("./index.js").StableRoute[];
+    };
+    json: string;
+    digest: string;
+    version: 1;
+}>;
+/** Decode the deployment JSON at its owned representation boundary. */
+export declare function capturePublicRoutePolicyFromJson(input: string): Promise<{
+    configuration: {
+        platformRoutes: {
+            readonly appId: import("./index.js").AppId;
+            readonly stableRoute: import("./index.js").StableRoute;
+        }[];
+        structuralRoutes: import("./index.js").StableRoute[];
+    };
+    json: string;
+    digest: string;
+    version: 1;
+}>;

package/dist/public-route-policy.js

@@ -0,0 +1,88 @@
+import * as Schema from "effect/Schema";
+import { appIdSchema, stableRouteSchema, } from "./internal/app-release-schema.js";
+/** CTO customer-publication policy. Deployment projects this one configuration. */
+export const publicRoutePolicy = {
+    version: 1,
+    maxPublicRoutesPerTeam: 20,
+    maxUnusedSurfacesPerApp: 20,
+    releaseCooldownSeconds: 7 * 24 * 60 * 60,
+    erasureTombstoneSeconds: 90 * 24 * 60 * 60,
+    reservedWords: [
+        "admin",
+        "administrator",
+        "api",
+        "assets",
+        "auth",
+        "billing",
+        "botanical",
+        "docs",
+        "fungi",
+        "help",
+        "login",
+        "logout",
+        "oauth",
+        "operator",
+        "security",
+        "settings",
+        "signin",
+        "signup",
+        "static",
+        "status",
+        "support",
+        "www",
+    ],
+    brandPrefixes: ["fungi"],
+    brandWordExceptions: ["fungible", "fungicide"],
+};
+/** Comparison only: a key never repairs or replaces the canonical route URL. */
+export function publicRouteKey(value) {
+    return (value.startsWith("/") ? value.slice(1) : value)
+        .replaceAll("-", "")
+        .replaceAll("_", "")
+        .replaceAll("1", "i")
+        .replaceAll("l", "i")
+        .replaceAll("0", "o")
+        .replaceAll("5", "s")
+        .replaceAll("3", "e");
+}
+/** Router prefixes and platform assignments are supplied by their owners. */
+export function isReservedPublicRoute(route, structuralRoutes) {
+    const key = publicRouteKey(route);
+    if (structuralRoutes.some((value) => publicRouteKey(value) === key) ||
+        publicRoutePolicy.reservedWords.some((value) => publicRouteKey(value) === key))
+        return true;
+    return (publicRoutePolicy.brandPrefixes.some((value) => key.startsWith(publicRouteKey(value))) &&
+        !publicRoutePolicy.brandWordExceptions.some((value) => publicRouteKey(value) === key));
+}
+/** Deployment supplies routes from the platform plan and App-origin router. */
+export const publicRouteConfigurationSchema = Schema.Struct({
+    platformRoutes: Schema.Array(Schema.Struct({
+        appId: appIdSchema,
+        stableRoute: stableRouteSchema,
+    })),
+    structuralRoutes: Schema.Array(stableRouteSchema),
+}).pipe(Schema.check(Schema.makeFilter((configuration) => {
+    const keys = configuration.platformRoutes.map(({ stableRoute }) => publicRouteKey(stableRoute));
+    return new Set(keys).size === keys.length;
+}, { message: "Platform route assignments conflict" })), Schema.check(Schema.makeFilter((configuration) => {
+    const structuralKeys = new Set(configuration.structuralRoutes.map(publicRouteKey));
+    return !configuration.platformRoutes.some(({ stableRoute }) => structuralKeys.has(publicRouteKey(stableRoute)));
+}, { message: "Platform route assignments conflict with structural routes" })));
+/** The deployed checksum binds both maintained policy and environment assignments. */
+export async function capturePublicRoutePolicy(input) {
+    const decoded = Schema.decodeUnknownSync(publicRouteConfigurationSchema, {
+        onExcessProperty: "error",
+    })(input);
+    const configuration = {
+        platformRoutes: [...decoded.platformRoutes].sort((a, b) => a.stableRoute.localeCompare(b.stableRoute)),
+        structuralRoutes: [...decoded.structuralRoutes].sort(),
+    };
+    const json = JSON.stringify({ policy: publicRoutePolicy, configuration });
+    const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(json)));
+    const digest = Array.from(bytes, (value) => value.toString(16).padStart(2, "0")).join("");
+    return { configuration, json, digest, version: publicRoutePolicy.version };
+}
+/** Decode the deployment JSON at its owned representation boundary. */
+export async function capturePublicRoutePolicyFromJson(input) {
+    return capturePublicRoutePolicy(Schema.decodeUnknownSync(Schema.fromJsonString(publicRouteConfigurationSchema), { onExcessProperty: "error" })(input));
+}

package/dist/public-routes.d.ts

@@ -0,0 +1,34 @@
+import * as Schema from "effect/Schema";
+import type { AppReleaseD1Database } from "./cloudflare.js";
+import { capturePublicRoutePolicy } from "./public-route-policy.js";
+export type CapturedPublicRoutePolicy = Awaited<ReturnType<typeof capturePublicRoutePolicy>>;
+/** Fail closed until the operator has installed this exact deployment policy. */
+export declare function publicRoutePolicyReady(database: AppReleaseD1Database, policy: CapturedPublicRoutePolicy): Promise<boolean>;
+/** Operator composition only; values come from its captured deployment, not a request. */
+export declare function configureD1PublicRoutes(database: AppReleaseD1Database, policy: CapturedPublicRoutePolicy): Promise<void>;
+/** Live seller custody; a buyer entitlement or a historical Surface is never ownership. */
+export declare function ownsD1PublicRoute(database: AppReleaseD1Database, input: {
+    readonly teamId: string;
+    readonly appId: string;
+    readonly stableRoute: string;
+}): Promise<boolean>;
+declare const ownedPublicRouteSchema: Schema.Struct<{
+    readonly appId: Schema.refine<import("./index.js").AppId, Schema.String>;
+    readonly publicSurfaceId: Schema.refine<import("./index.js").PublicSurfaceId, Schema.String>;
+    readonly stableRoute: Schema.refine<import("./index.js").StableRoute, Schema.String>;
+    readonly releaseId: Schema.refine<import("./index.js").ReleaseId, Schema.String>;
+}>;
+export type OwnedPublicRoute = Schema.Schema.Type<typeof ownedPublicRouteSchema>;
+/** Published customer Surfaces still held by this Team, with their current promotion or rollback. */
+export declare function listD1OwnedPublicRoutes(database: AppReleaseD1Database, teamId: string): Promise<readonly OwnedPublicRoute[]>;
+/** Catalog-local irreversible closure; public admission never depends on Global availability. */
+export declare function closedD1PublicRoute(input: {
+    catalog: AppReleaseD1Database;
+    route: string;
+}): Promise<boolean>;
+/** A platform artifact keeps its public mount; a customer claim never qualifies. */
+export declare function platformD1PublicRoute(database: AppReleaseD1Database, input: {
+    appId: string;
+    stableRoute: string;
+}): Promise<boolean>;
+export {};

package/dist/public-routes.js

@@ -0,0 +1,136 @@
+import * as Schema from "effect/Schema";
+import { appIdSchema, publicSurfaceIdSchema, releaseIdSchema, stableRouteSchema, } from "./internal/app-release-schema.js";
+import { capturePublicRoutePolicy, publicRouteKey, publicRoutePolicy, } from "./public-route-policy.js";
+const policyRowSchema = Schema.Struct({
+    version: Schema.Number,
+    digest: Schema.String,
+});
+/** Fail closed until the operator has installed this exact deployment policy. */
+export async function publicRoutePolicyReady(database, policy) {
+    const row = await database
+        .prepare("SELECT version,digest FROM app_release_route_policy WHERE singleton=1")
+        .first();
+    if (row === null)
+        return false;
+    const found = Schema.decodeUnknownSync(policyRowSchema)(row);
+    return found.version === policy.version && found.digest === policy.digest;
+}
+/** Operator composition only; values come from its captured deployment, not a request. */
+export async function configureD1PublicRoutes(database, policy) {
+    if (await publicRoutePolicyReady(database, policy))
+        return;
+    const exact = new Map();
+    for (const word of [
+        ...publicRoutePolicy.reservedWords,
+        ...policy.configuration.structuralRoutes,
+    ])
+        exact.set(publicRouteKey(word), word);
+    const statements = [
+        database.prepare("DELETE FROM app_release_reserved_route_keys"),
+        database.prepare("DELETE FROM app_release_route_brand_exceptions"),
+        database.prepare("DELETE FROM app_release_platform_routes"),
+        ...[...exact].map(([key, word]) => database
+            .prepare("INSERT INTO app_release_reserved_route_keys(word,route_key,match_kind) VALUES (?,?,'exact')")
+            .bind(word, key)),
+        ...publicRoutePolicy.brandPrefixes.map((word) => database
+            .prepare("INSERT INTO app_release_reserved_route_keys(word,route_key,match_kind) VALUES (?,?,'prefix')")
+            .bind(word, publicRouteKey(word))),
+        ...publicRoutePolicy.brandWordExceptions.map((word) => database
+            .prepare("INSERT INTO app_release_route_brand_exceptions(word,route_key) VALUES (?,?)")
+            .bind(word, publicRouteKey(word))),
+        ...policy.configuration.platformRoutes.map(({ appId, stableRoute }) => database
+            .prepare("INSERT INTO app_release_platform_routes(stable_route,route_key,app_id) VALUES (?,?,?)")
+            .bind(stableRoute, publicRouteKey(stableRoute), appId)),
+        database
+            .prepare(`INSERT INTO app_release_route_policy
+      (singleton,version,digest,config_json,max_team_routes,max_unused_surfaces_per_app)
+      VALUES (1,?,?,?,?,?) ON CONFLICT(singleton) DO UPDATE SET
+      version=excluded.version,digest=excluded.digest,config_json=excluded.config_json,
+      max_team_routes=excluded.max_team_routes,max_unused_surfaces_per_app=excluded.max_unused_surfaces_per_app`)
+            .bind(policy.version, policy.digest, policy.json, publicRoutePolicy.maxPublicRoutesPerTeam, publicRoutePolicy.maxUnusedSurfacesPerApp),
+    ];
+    const result = await database.batch(statements);
+    if (result.length !== statements.length || result.some((row) => !row.success))
+        throw new Error("Public route policy projection unavailable");
+}
+const heldClaimSchema = Schema.Struct({
+    app_id: Schema.String,
+    public_surface_id: Schema.String,
+    team_id: Schema.String,
+    user_id: Schema.String,
+    stable_route: Schema.String,
+});
+const sellerRouteJoins = `FROM app_release_route_claims c
+    JOIN app_release_public_surfaces s ON s.public_surface_id=c.public_surface_id
+    JOIN app_release_team_publishers p ON p.app_id=s.app_id AND p.team_id=c.team_id`;
+const sellerRouteCustody = `c.state='held' AND s.authority_kind='customer'
+      AND p.source_provider='artifacts' AND p.source_repository=p.app_id
+      AND p.template_app_id IS NOT NULL AND p.template_app_id<>p.app_id
+      AND p.template_seed_revision IS NOT NULL
+      AND NOT EXISTS (SELECT 1 FROM app_release_surface_retirements r WHERE r.public_surface_id=c.public_surface_id)
+      AND NOT EXISTS (SELECT 1 FROM app_release_team_route_blocks b WHERE b.team_id=c.team_id AND b.route_key=c.route_key)`;
+/** Live seller custody; a buyer entitlement or a historical Surface is never ownership. */
+export async function ownsD1PublicRoute(database, input) {
+    const row = await database
+        .prepare(`SELECT s.app_id,c.public_surface_id,c.team_id,c.user_id,c.stable_route
+    ${sellerRouteJoins}
+    WHERE c.route_key=? AND c.stable_route=? AND c.team_id=? AND s.app_id=?
+      AND ${sellerRouteCustody}`)
+        .bind(publicRouteKey(input.stableRoute), input.stableRoute, input.teamId, input.appId)
+        .first();
+    if (row === null)
+        return false;
+    Schema.decodeUnknownSync(heldClaimSchema)(row);
+    return true;
+}
+const ownedPublicRouteSchema = Schema.Struct({
+    appId: appIdSchema,
+    publicSurfaceId: publicSurfaceIdSchema,
+    stableRoute: stableRouteSchema,
+    releaseId: releaseIdSchema,
+});
+/** Published customer Surfaces still held by this Team, with their current promotion or rollback. */
+export async function listD1OwnedPublicRoutes(database, teamId) {
+    const { results } = await database
+        .prepare(`SELECT s.app_id AS appId,c.public_surface_id AS publicSurfaceId,
+      c.stable_route AS stableRoute,t.release_id AS releaseId
+    ${sellerRouteJoins}
+    JOIN app_release_transitions t ON t.public_surface_id=c.public_surface_id
+    WHERE c.team_id=? AND ${sellerRouteCustody}
+      AND t.operation_kind IN ('promotion','rollback')
+      AND t.sequence=(SELECT MAX(latest.sequence) FROM app_release_transitions latest
+        WHERE latest.public_surface_id=c.public_surface_id AND latest.operation_kind IN ('promotion','rollback'))
+    ORDER BY s.app_id,c.public_surface_id`)
+        .bind(teamId)
+        .all();
+    return Schema.decodeUnknownSync(Schema.Array(ownedPublicRouteSchema))(results);
+}
+/** Catalog-local irreversible closure; public admission never depends on Global availability. */
+export async function closedD1PublicRoute(input) {
+    const row = await input.catalog
+        .prepare(`SELECT c.team_id FROM app_release_route_claims c
+    JOIN app_release_public_surfaces s ON s.public_surface_id=c.public_surface_id
+    JOIN app_release_closed_sellers closed ON closed.team_id=c.team_id
+    WHERE c.route_key=? AND c.stable_route=? AND c.state='held' AND s.authority_kind='customer'`)
+        .bind(publicRouteKey(input.route), input.route)
+        .first();
+    if (row === null)
+        return false;
+    Schema.decodeUnknownSync(Schema.Struct({ team_id: Schema.String }))(row);
+    return true;
+}
+/** A platform artifact keeps its public mount; a customer claim never qualifies. */
+export async function platformD1PublicRoute(database, input) {
+    const row = await database
+        .prepare(`SELECT s.app_id FROM app_release_public_surfaces s
+    JOIN app_release_platform_routes p ON p.app_id=s.app_id AND p.stable_route=s.stable_route
+    JOIN app_release_route_claims c ON c.public_surface_id=s.public_surface_id
+    WHERE s.app_id=? AND s.stable_route=? AND c.route_key=? AND c.stable_route=s.stable_route
+      AND c.state='held' AND s.authority_kind='platform'`)
+        .bind(input.appId, input.stableRoute, publicRouteKey(input.stableRoute))
+        .first();
+    if (row === null)
+        return false;
+    Schema.decodeUnknownSync(Schema.Struct({ app_id: Schema.String }))(row);
+    return true;
+}

package/dist/publisher.d.ts

@@ -0,0 +1,61 @@
+import * as Schema from "effect/Schema";
+import type { AppId, SourceRevision } from "./internal/app-release-contract.js";
+/** Canonical source repository resolved by the product publisher. */
+export declare const appSourceRepositorySchema: Schema.Struct<{
+    readonly provider: Schema.Literals<readonly ["artifacts", "github"]>;
+    readonly repository: Schema.String;
+    readonly branch: Schema.Literal<"main">;
+}>;
+/** Team-owned publication authority for one separately registered App. */
+export declare const teamAppPublisherRegistrationSchema: Schema.Struct<{
+    readonly appId: Schema.refine<AppId, Schema.String>;
+    readonly teamId: Schema.String;
+    readonly source: Schema.Struct<{
+        readonly provider: Schema.Literals<readonly ["artifacts", "github"]>;
+        readonly repository: Schema.String;
+        readonly branch: Schema.Literal<"main">;
+    }>;
+    readonly templateSeed: Schema.optionalKey<Schema.Struct<{
+        readonly appId: Schema.refine<AppId, Schema.String>;
+        readonly revision: Schema.refine<SourceRevision, Schema.String>;
+    }>>;
+}>;
+/** Exact first-party platform seed from which a Team-owned App was forked. */
+export type TeamAppTemplateSeed = Readonly<{
+    appId: AppId;
+    revision: SourceRevision;
+}>;
+/** Parsed immutable source location used to build one App. */
+export type AppSourceRepository = Schema.Schema.Type<typeof appSourceRepositorySchema>;
+/** Parsed Team ownership record for one App publisher. */
+export type TeamAppPublisherRegistration = Schema.Schema.Type<typeof teamAppPublisherRegistrationSchema>;
+/** Result of reading the durable publisher registered for an App. */
+export type TeamAppPublisherRegistrationRead = Readonly<{
+    kind: "found";
+    registration: TeamAppPublisherRegistration;
+}> | Readonly<{
+    kind: "absent";
+}>;
+/** Idempotent result of registering one App publisher. */
+export type TeamAppPublisherRegistrationCreate = Readonly<{
+    kind: "created" | "existing";
+    registration: TeamAppPublisherRegistration;
+}> | Readonly<{
+    kind: "conflict";
+}>;
+/** Team-scoped decision for publishing a registered App. */
+export type TeamAppPublicationAuthorization = Readonly<{
+    kind: "authorized";
+    registration: TeamAppPublisherRegistration;
+}> | Readonly<{
+    kind: "absent" | "denied";
+}>;
+/** Durable App publisher facts; Team membership remains owned by Hub. */
+export type TeamAppPublisherRegistry = Readonly<{
+    /** Read the publisher registration for an App. */
+    read(appId: AppId): Promise<TeamAppPublisherRegistrationRead>;
+    /** Atomically create or observe one immutable publisher registration. */
+    register(registration: TeamAppPublisherRegistration): Promise<TeamAppPublisherRegistrationCreate>;
+    /** Authorize a Team against the App's retained publisher registration. */
+    authorize(appId: AppId, teamId: string): Promise<TeamAppPublicationAuthorization>;
+}>;

package/dist/publisher.js

@@ -0,0 +1,16 @@
+import * as Schema from "effect/Schema";
+import { appIdSchema, sourceRevisionSchema, } from "./internal/app-release-schema.js";
+const boundedIdentity = Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(256)));
+/** Canonical source repository resolved by the product publisher. */
+export const appSourceRepositorySchema = Schema.Struct({
+    provider: Schema.Literals(["artifacts", "github"]),
+    repository: Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(1024))),
+    branch: Schema.Literal("main"),
+});
+/** Team-owned publication authority for one separately registered App. */
+export const teamAppPublisherRegistrationSchema = Schema.Struct({
+    appId: appIdSchema,
+    teamId: boundedIdentity,
+    source: appSourceRepositorySchema,
+    templateSeed: Schema.optionalKey(Schema.Struct({ appId: appIdSchema, revision: sourceRevisionSchema })),
+});