@fungi.computer/puffball 0.0.0-stage → 0.0.1

package/dist/safety-takedown.d.ts

@@ -0,0 +1,56 @@
+import * as Schema from "effect/Schema";
+import type { AppReleaseD1Database } from "./cloudflare.js";
+declare const safetyTakedownSchema: Schema.Struct<{
+    readonly operationId: Schema.String;
+    readonly operatorId: Schema.String;
+    readonly appId: Schema.refine<import("./index.js").AppId, Schema.String>;
+    readonly stableRoute: Schema.refine<import("./index.js").StableRoute, Schema.String>;
+    readonly reason: Schema.String;
+}>;
+export type SafetyTakedown = Schema.Schema.Type<typeof safetyTakedownSchema>;
+/** Audited intent precedes the maintained revocation path; a pending action is discoverable and retryable. */
+export declare function createD1SafetyTakedowns(database: AppReleaseD1Database, now?: () => number): {
+    prepare: (raw: SafetyTakedown) => Promise<{
+        kind: "conflict";
+        operation?: never;
+        releaseIds?: never;
+    } | {
+        kind: "recorded";
+        operation: {
+            readonly operation_id: string;
+            readonly app_id: import("./index.js").AppId;
+            readonly stable_route: import("./index.js").StableRoute;
+            readonly reason: string;
+            readonly operator_id: string;
+            readonly recorded_at: number;
+            readonly state: "complete" | "pending";
+            readonly completed_at: number | null;
+        };
+        releaseIds: import("./index.js").ReleaseId[];
+    } | {
+        kind: "unavailable";
+        operation?: never;
+        releaseIds?: never;
+    }>;
+    complete: (operationId: string, operatorId: string) => Promise<{
+        kind: "conflict";
+    } | {
+        kind: "recorded";
+    }>;
+    pending: () => Promise<{
+        readonly operation_id: string;
+        readonly app_id: import("./index.js").AppId;
+        readonly stable_route: import("./index.js").StableRoute;
+        readonly reason: string;
+        readonly operator_id: string;
+        readonly recorded_at: number;
+        readonly state: "complete" | "pending";
+        readonly completed_at: number | null;
+    }[]>;
+    capturedReleasePage: (operationId: string, after?: string) => Promise<{
+        releaseIds: import("./index.js").ReleaseId[];
+        next: import("./index.js").ReleaseId | null;
+    }>;
+};
+export declare const safetyTakedownSchemaSql: string;
+export {};

package/dist/safety-takedown.js

@@ -0,0 +1,146 @@
+import * as Schema from "effect/Schema";
+import { appIdSchema, releaseIdSchema, stableRouteSchema, } from "./internal/app-release-schema.js";
+import { reportFailure } from "./internal/failure.js";
+const identity = Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(128)));
+const safetyTakedownSchema = Schema.Struct({
+    operationId: identity,
+    operatorId: identity,
+    appId: appIdSchema,
+    stableRoute: stableRouteSchema,
+    reason: Schema.String.pipe(Schema.check(Schema.isPattern(/\S/u)), Schema.check(Schema.isMaxLength(1000))),
+});
+const operationSchema = Schema.Struct({
+    operation_id: identity,
+    app_id: appIdSchema,
+    stable_route: stableRouteSchema,
+    reason: Schema.String,
+    operator_id: identity,
+    recorded_at: Schema.Number,
+    state: Schema.Literals(["pending", "complete"]),
+    completed_at: Schema.NullOr(Schema.Number),
+});
+/** Audited intent precedes the maintained revocation path; a pending action is discoverable and retryable. */
+export function createD1SafetyTakedowns(database, now = Date.now) {
+    const read = async (operationId) => {
+        const row = await database
+            .prepare("SELECT * FROM app_release_safety_takedowns WHERE operation_id=?")
+            .bind(operationId)
+            .first();
+        return row === null ? null : Schema.decodeUnknownSync(operationSchema)(row);
+    };
+    const releasePage = async (operationId) => {
+        const rows = await database
+            .prepare(`SELECT r.release_id FROM app_release_safety_takedown_releases r
+      WHERE r.operation_id=? AND NOT EXISTS (
+        SELECT 1 FROM app_release_transitions t JOIN app_release_transition_obligations o USING(sequence)
+        WHERE t.release_id=r.release_id AND t.operation_kind='revocation' AND o.state='acknowledged')
+      ORDER BY r.release_id LIMIT 1000`)
+            .bind(operationId)
+            .all();
+        return rows.results.map((row) => Schema.decodeUnknownSync(Schema.Struct({ release_id: releaseIdSchema }))(row).release_id);
+    };
+    const capturedReleasePage = async (operationId, after = "") => {
+        Schema.decodeUnknownSync(identity)(operationId);
+        Schema.decodeUnknownSync(Schema.Union([Schema.Literal(""), releaseIdSchema]))(after);
+        const rows = await database
+            .prepare(`SELECT release_id FROM app_release_safety_takedown_releases
+      WHERE operation_id=? AND release_id>? ORDER BY release_id LIMIT 1001`)
+            .bind(operationId, after)
+            .all();
+        const ids = rows.results.map((row) => Schema.decodeUnknownSync(Schema.Struct({ release_id: releaseIdSchema }))(row).release_id);
+        return {
+            releaseIds: ids.slice(0, 1000),
+            next: ids.length > 1000 ? (ids[999] ?? null) : null,
+        };
+    };
+    const prepare = async (raw) => {
+        try {
+            const input = Schema.decodeUnknownSync(safetyTakedownSchema, {
+                onExcessProperty: "error",
+            })(raw);
+            // Snapshot all Releases in child rows; bounded delivery pages no longer cap an App's history.
+            const recipients = `SELECT t.release_id FROM app_release_transitions t JOIN app_release_public_surfaces s USING(public_surface_id)
+        WHERE s.app_id=? AND s.stable_route=? AND t.operation_kind IN ('promotion','rollback')
+        UNION SELECT release_id FROM app_release_buyer_references WHERE app_id=? AND stable_route=?`;
+            const results = await database.batch([
+                database
+                    .prepare(`INSERT INTO app_release_safety_takedowns(operation_id,app_id,stable_route,reason,operator_id,recorded_at,state)
+          SELECT ?,?,?,?,?,?,'pending' WHERE EXISTS (${recipients}) ON CONFLICT DO NOTHING`)
+                    .bind(input.operationId, input.appId, input.stableRoute, input.reason, input.operatorId, now(), input.appId, input.stableRoute, input.appId, input.stableRoute),
+                database
+                    .prepare(`INSERT INTO app_release_safety_takedown_releases(operation_id,release_id)
+          SELECT ?,r.release_id FROM (${recipients}) r
+          WHERE EXISTS (SELECT 1 FROM app_release_safety_takedowns a WHERE a.operation_id=? AND a.app_id=? AND a.stable_route=? AND a.reason=?)
+          AND NOT EXISTS (SELECT 1 FROM app_release_safety_takedown_releases frozen WHERE frozen.operation_id=?)
+          ON CONFLICT DO NOTHING`)
+                    .bind(input.operationId, input.appId, input.stableRoute, input.appId, input.stableRoute, input.operationId, input.appId, input.stableRoute, input.reason, input.operationId),
+            ]);
+            if (results.some((result) => !result.success))
+                throw new Error("Safety snapshot unavailable");
+            const saved = await read(input.operationId);
+            if (saved?.app_id !== input.appId ||
+                saved.stable_route !== input.stableRoute ||
+                saved.reason !== input.reason)
+                return { kind: "conflict" };
+            await database
+                .prepare(`INSERT INTO app_release_safety_takedown_steps(operation_id,phase,operator_id,recorded_at)
+        VALUES(?,'prepared',?,?)`)
+                .bind(input.operationId, input.operatorId, now())
+                .run();
+            return {
+                kind: "recorded",
+                operation: saved,
+                releaseIds: await releasePage(input.operationId),
+            };
+        }
+        catch (cause) {
+            reportFailure("safety takedown preparation", cause);
+            return { kind: "unavailable" };
+        }
+    };
+    const complete = async (operationId, operatorId) => {
+        for (const value of [operationId, operatorId])
+            Schema.decodeUnknownSync(identity)(value);
+        const operation = await read(operationId);
+        if (operation === null)
+            return { kind: "conflict" };
+        const results = await database.batch([
+            database
+                .prepare(`INSERT INTO app_release_safety_takedown_steps(operation_id,phase,operator_id,recorded_at)
+        SELECT ?,'completed',?,? WHERE EXISTS (SELECT 1 FROM app_release_safety_takedowns a WHERE a.operation_id=? AND a.state IN ('pending','complete')
+          AND NOT EXISTS (SELECT 1 FROM app_release_safety_takedown_releases r WHERE r.operation_id=a.operation_id AND NOT EXISTS (
+            SELECT 1 FROM app_release_transitions t JOIN app_release_transition_obligations o ON o.sequence=t.sequence
+            WHERE t.release_id=r.release_id AND t.operation_kind='revocation' AND o.state='acknowledged')))
+        ON CONFLICT DO NOTHING`)
+                .bind(operationId, operatorId, now(), operationId),
+            database
+                .prepare(`UPDATE app_release_safety_takedowns SET state='complete',completed_at=? WHERE operation_id=? AND state='pending'
+        AND EXISTS (SELECT 1 FROM app_release_safety_takedown_steps WHERE operation_id=? AND phase='completed')`)
+                .bind(now(), operationId, operationId),
+        ]);
+        if (results.some((result) => !result.success))
+            throw new Error("Safety audit unavailable");
+        return (await read(operationId))?.state === "complete"
+            ? { kind: "recorded" }
+            : { kind: "conflict" };
+    };
+    const pending = async () => {
+        const result = await database
+            .prepare("SELECT * FROM app_release_safety_takedowns WHERE state='pending' ORDER BY operation_id LIMIT 100")
+            .all();
+        return result.results.map((row) => Schema.decodeUnknownSync(operationSchema)(row));
+    };
+    return { prepare, complete, pending, capturedReleasePage };
+}
+export const safetyTakedownSchemaSql = [
+    `CREATE TABLE app_release_safety_takedowns(operation_id TEXT PRIMARY KEY,app_id TEXT NOT NULL,stable_route TEXT NOT NULL,
+    reason TEXT NOT NULL CHECK(length(reason) BETWEEN 1 AND 1000),operator_id TEXT NOT NULL,recorded_at INTEGER NOT NULL,
+    state TEXT NOT NULL CHECK(state IN ('pending','complete')),completed_at INTEGER) STRICT;`,
+    `CREATE TABLE app_release_safety_takedown_releases(operation_id TEXT NOT NULL REFERENCES app_release_safety_takedowns(operation_id),release_id TEXT NOT NULL,PRIMARY KEY(operation_id,release_id)) STRICT;`,
+    `CREATE INDEX app_release_safety_takedowns_pending ON app_release_safety_takedowns(state,operation_id);`,
+    `CREATE TABLE app_release_safety_takedown_steps(step_id INTEGER PRIMARY KEY,operation_id TEXT NOT NULL REFERENCES app_release_safety_takedowns(operation_id),
+    phase TEXT NOT NULL CHECK(phase IN ('prepared','completed')),operator_id TEXT NOT NULL,recorded_at INTEGER NOT NULL) STRICT;`,
+    `CREATE INDEX app_release_safety_takedown_steps_by_action ON app_release_safety_takedown_steps(operation_id,phase);`,
+]
+    .map((statement) => statement.replaceAll("\n", " "))
+    .join("\n");

package/dist/seller-closure-notice.d.ts

@@ -0,0 +1,14 @@
+import * as Schema from "effect/Schema";
+/** A retained entitlement continues after its seller closes; this is not a revocation. */
+export declare const sellerClosureNoticeSchema: Schema.Struct<{
+    readonly kind: Schema.Literal<"seller-closed">;
+    readonly dispositionId: Schema.String;
+    readonly sellerAccountId: Schema.String;
+    readonly buyerAccountId: Schema.String;
+    readonly appId: Schema.String;
+    readonly releaseIds: Schema.Tuple<readonly [Schema.String]>;
+    readonly displayName: Schema.String;
+    readonly sellerName: Schema.String;
+    readonly requestId: Schema.String;
+}>;
+export type SellerClosureNotice = Schema.Schema.Type<typeof sellerClosureNoticeSchema>;

package/dist/seller-closure-notice.js

@@ -0,0 +1,14 @@
+import * as Schema from "effect/Schema";
+const identity = Schema.String.pipe(Schema.check(Schema.isMinLength(1), Schema.isMaxLength(256)));
+/** A retained entitlement continues after its seller closes; this is not a revocation. */
+export const sellerClosureNoticeSchema = Schema.Struct({
+    kind: Schema.Literal("seller-closed"),
+    dispositionId: Schema.String.pipe(Schema.check(Schema.isMinLength(1), Schema.isMaxLength(1024))),
+    sellerAccountId: identity,
+    buyerAccountId: identity,
+    appId: identity,
+    releaseIds: Schema.Tuple([identity]),
+    displayName: identity,
+    sellerName: identity,
+    requestId: identity,
+});

package/dist/seller-closure.d.ts

@@ -0,0 +1,15 @@
+import * as Schema from "effect/Schema";
+import type { AppReleaseD1Database } from "./cloudflare.js";
+declare const sellerClosureSchema: Schema.Struct<{
+    readonly teamId: Schema.String;
+    readonly requestId: Schema.String;
+    readonly closedAt: Schema.Number;
+}>;
+export type SellerClosure = Schema.Schema.Type<typeof sellerClosureSchema>;
+export declare class SellerClosureConflictError extends Error {
+    readonly code = "seller_closure_conflict";
+    constructor();
+}
+/** Trusted close-decision delivery only. Keep the original irreversible decision on retries. */
+export declare function recordD1SellerClosure(database: AppReleaseD1Database, raw: SellerClosure): Promise<void>;
+export {};

package/dist/seller-closure.js

@@ -0,0 +1,31 @@
+import * as Schema from "effect/Schema";
+const sellerClosureSchema = Schema.Struct({
+    teamId: Schema.String.pipe(Schema.check(Schema.isMinLength(1), Schema.isMaxLength(256))),
+    requestId: Schema.String.pipe(Schema.check(Schema.isMinLength(1), Schema.isMaxLength(256))),
+    closedAt: Schema.Number.pipe(Schema.check(Schema.isInt(), Schema.isBetween({ minimum: 0, maximum: Number.MAX_SAFE_INTEGER }))),
+});
+export class SellerClosureConflictError extends Error {
+    code = "seller_closure_conflict";
+    constructor() {
+        super("Seller closure marker conflicts with the original decision");
+    }
+}
+/** Trusted close-decision delivery only. Keep the original irreversible decision on retries. */
+export async function recordD1SellerClosure(database, raw) {
+    const input = Schema.decodeUnknownSync(sellerClosureSchema, {
+        onExcessProperty: "error",
+    })(raw);
+    const result = await database
+        .prepare("INSERT INTO app_release_closed_sellers(team_id,request_id,closed_at) VALUES (?,?,?) ON CONFLICT(team_id) DO NOTHING")
+        .bind(input.teamId, input.requestId, input.closedAt)
+        .run();
+    if (!result.success)
+        throw new Error("Seller closure marker unavailable");
+    const row = await database
+        .prepare("SELECT team_id AS teamId,request_id AS requestId,closed_at AS closedAt FROM app_release_closed_sellers WHERE team_id=?")
+        .bind(input.teamId)
+        .first();
+    const saved = Schema.decodeUnknownSync(sellerClosureSchema)(row);
+    if (saved.requestId !== input.requestId || saved.closedAt !== input.closedAt)
+        throw new SellerClosureConflictError();
+}

package/dist/testing.d.ts

@@ -0,0 +1,8 @@
+import type { DatabaseSync } from "node:sqlite";
+import type { AppReleaseD1Database } from "./cloudflare.js";
+/**
+ * Adapt caller-owned Node SQLite to the catalog's D1 transport for tests and
+ * quick starts. The caller applies schema and closes the database. This is not
+ * a Cloudflare emulator or an isolation boundary.
+ */
+export declare function sqliteD1(sqlite: DatabaseSync): AppReleaseD1Database;

package/dist/testing.js

@@ -0,0 +1,47 @@
+import * as Schema from "effect/Schema";
+import { watchdogSqliteValueSchema, } from "@fungi.computer/watchdog";
+import { fromNodeSqlite } from "@fungi.computer/watchdog/node-sqlite";
+const decodeBindings = Schema.decodeUnknownSync(Schema.Array(watchdogSqliteValueSchema));
+const decodeChanges = Schema.decodeUnknownSync(Schema.Struct({ changes: Schema.Number }));
+/**
+ * Adapt caller-owned Node SQLite to the catalog's D1 transport for tests and
+ * quick starts. The caller applies schema and closes the database. This is not
+ * a Cloudflare emulator or an isolation boundary.
+ */
+export function sqliteD1(sqlite) {
+    const owner = fromNodeSqlite(sqlite);
+    const executions = new WeakMap();
+    const prepare = (sql, values = []) => {
+        const execute = () => {
+            const before = decodeChanges(owner.sql.exec("SELECT total_changes() AS changes").one()).changes;
+            const results = owner.sql.exec(sql, ...values).toArray();
+            const after = decodeChanges(owner.sql.exec("SELECT total_changes() AS changes").one()).changes;
+            const { changes } = decodeChanges(owner.sql.exec("SELECT changes() AS changes").one());
+            return {
+                success: true,
+                results,
+                meta: { changes: after === before ? 0 : changes },
+            };
+        };
+        const statement = {
+            bind: (...next) => prepare(sql, decodeBindings(next)),
+            first: () => Promise.resolve().then(() => owner.sql.exec(sql, ...values).toArray()[0] ?? null),
+            all: () => Promise.resolve().then(() => ({
+                success: true,
+                results: owner.sql.exec(sql, ...values).toArray(),
+            })),
+            run: () => Promise.resolve().then(execute),
+        };
+        executions.set(statement, execute);
+        return statement;
+    };
+    return {
+        prepare,
+        batch: (statements) => Promise.resolve().then(() => owner.transactionSync(() => statements.map((statement) => {
+            const execute = executions.get(statement);
+            if (execute === undefined)
+                throw new Error("Statement belongs to a different database");
+            return execute();
+        }))),
+    };
+}

package/docs/api/README.md

@@ -0,0 +1,26 @@
+<!-- Generated by Botanical API docs (TypeDoc + typedoc-plugin-markdown). Do not edit. -->
+
+**@fungi.computer/puffball**
+
+---
+
+# @fungi.computer/puffball
+
+## Modules
+
+| Module                                                              | Description |
+| ------------------------------------------------------------------- | ----------- |
+| [app-backend-binding-vocabulary](app-backend-binding-vocabulary.md) | -           |
+| [app-backend-bindings](app-backend-bindings.md)                     | -           |
+| [app-event-facts](app-event-facts.md)                               | -           |
+| [app-method-context](app-method-context.md)                         | -           |
+| [app-method-runtime](app-method-runtime.md)                         | -           |
+| [backend](backend.md)                                               | -           |
+| [background-replay](background-replay.md)                           | -           |
+| [cloudflare](cloudflare.md)                                         | -           |
+| [effect](effect.md)                                                 | -           |
+| [git-representation](git-representation.md)                         | -           |
+| [inbox](inbox.md)                                                   | -           |
+| [index](index.md)                                                   | -           |
+| [publisher](publisher.md)                                           | -           |
+| [testing](testing.md)                                               | -           |