@fungi.computer/puffball 0.0.0-stage → 0.0.1

package/docs/api/index.md

@@ -0,0 +1,2868 @@
+<!-- Generated by Botanical API docs (TypeDoc + typedoc-plugin-markdown). Do not edit. -->
+
+[**@fungi.computer/puffball**](README.md)
+
+---
+
+[@fungi.computer/puffball](README.md) / index
+
+# index
+
+## Classes
+
+### AppReleaseInputError
+
+Fixed, non-leaking input failure for one public parser boundary.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseInputError(parserName): AppReleaseInputError;
+```
+
+###### Parameters
+
+| Parameter    | Type                                            |
+| ------------ | ----------------------------------------------- |
+| `parserName` | [`AppReleaseParserName`](#appreleaseparsername) |
+
+###### Returns
+
+[`AppReleaseInputError`](#appreleaseinputerror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+#### Properties
+
+##### parserName
+
+```ts
+readonly parserName: AppReleaseParserName;
+```
+
+---
+
+### AppReleaseCommandInputError
+
+Fixed non-leaking input failure for one public catalog command.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseCommandInputError(commandName): AppReleaseCommandInputError;
+```
+
+###### Parameters
+
+| Parameter     | Type                                              |
+| ------------- | ------------------------------------------------- |
+| `commandName` | [`AppReleaseCommandName`](#appreleasecommandname) |
+
+###### Returns
+
+[`AppReleaseCommandInputError`](#appreleasecommandinputerror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+#### Properties
+
+##### commandName
+
+```ts
+readonly commandName: AppReleaseCommandName;
+```
+
+---
+
+### AppReleaseInvalidStoreResultError
+
+Fixed non-leaking failure when a foreign Store success is structurally invalid.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseInvalidStoreResultError(): AppReleaseInvalidStoreResultError;
+```
+
+###### Returns
+
+[`AppReleaseInvalidStoreResultError`](#appreleaseinvalidstoreresulterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseImmutableConflictError
+
+Fixed conflict when one Release ID receives changed immutable input.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseImmutableConflictError(): AppReleaseImmutableConflictError;
+```
+
+###### Returns
+
+[`AppReleaseImmutableConflictError`](#appreleaseimmutableconflicterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseOwnerAppAbsentError
+
+Fixed failure when a new Release references an App that does not exist.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseOwnerAppAbsentError(appId): AppReleaseOwnerAppAbsentError;
+```
+
+###### Parameters
+
+| Parameter | Type              |
+| --------- | ----------------- |
+| `appId`   | [`AppId`](#appid) |
+
+###### Returns
+
+[`AppReleaseOwnerAppAbsentError`](#appreleaseownerappabsenterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+#### Properties
+
+##### appId
+
+```ts
+readonly appId: AppId;
+```
+
+---
+
+### AppReleaseSurfaceOwnerAppAbsentError
+
+Fixed failure when a new public Surface references an App that does not exist.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseSurfaceOwnerAppAbsentError(appId): AppReleaseSurfaceOwnerAppAbsentError;
+```
+
+###### Parameters
+
+| Parameter | Type              |
+| --------- | ----------------- |
+| `appId`   | [`AppId`](#appid) |
+
+###### Returns
+
+[`AppReleaseSurfaceOwnerAppAbsentError`](#appreleasesurfaceownerappabsenterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+#### Properties
+
+##### appId
+
+```ts
+readonly appId: AppId;
+```
+
+---
+
+### AppReleaseStoreUnavailableError
+
+Fixed non-leaking failure when the injected App Release store is unavailable.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseStoreUnavailableError(): AppReleaseStoreUnavailableError;
+```
+
+###### Returns
+
+[`AppReleaseStoreUnavailableError`](#appreleasestoreunavailableerror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseReleaseAbsentError
+
+Fixed failure when artifact verification names no stored Release.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseReleaseAbsentError(): AppReleaseReleaseAbsentError;
+```
+
+###### Returns
+
+[`AppReleaseReleaseAbsentError`](#appreleasereleaseabsenterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseArtifactUnavailableError
+
+Fixed non-leaking failure when the injected artifact reader is unavailable.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseArtifactUnavailableError(): AppReleaseArtifactUnavailableError;
+```
+
+###### Returns
+
+[`AppReleaseArtifactUnavailableError`](#appreleaseartifactunavailableerror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseArtifactMissingError
+
+Fixed failure when the requested artifact cannot be found.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseArtifactMissingError(): AppReleaseArtifactMissingError;
+```
+
+###### Returns
+
+[`AppReleaseArtifactMissingError`](#appreleaseartifactmissingerror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseArtifactDigestMismatchError
+
+Fixed failure when resolved artifact bytes do not match the expected digest.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseArtifactDigestMismatchError(): AppReleaseArtifactDigestMismatchError;
+```
+
+###### Returns
+
+[`AppReleaseArtifactDigestMismatchError`](#appreleaseartifactdigestmismatcherror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseArtifactInvalidSnapshotError
+
+Fixed failure when a hostile artifact read cannot form a valid snapshot.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseArtifactInvalidSnapshotError(): AppReleaseArtifactInvalidSnapshotError;
+```
+
+###### Returns
+
+[`AppReleaseArtifactInvalidSnapshotError`](#appreleaseartifactinvalidsnapshoterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseUnimplementedError
+
+Error thrown when a catalog operation is not implemented in this slice.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseUnimplementedError(): AppReleaseUnimplementedError;
+```
+
+###### Returns
+
+[`AppReleaseUnimplementedError`](#appreleaseunimplementederror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseTransitionReleaseAbsentError
+
+Fixed failure when a transition names no stored Release.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseTransitionReleaseAbsentError(): AppReleaseTransitionReleaseAbsentError;
+```
+
+###### Returns
+
+[`AppReleaseTransitionReleaseAbsentError`](#appreleasetransitionreleaseabsenterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseTransitionReleaseUnverifiedError
+
+Fixed failure when promotion or rollback names an unverified Release.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseTransitionReleaseUnverifiedError(): AppReleaseTransitionReleaseUnverifiedError;
+```
+
+###### Returns
+
+[`AppReleaseTransitionReleaseUnverifiedError`](#appreleasetransitionreleaseunverifiederror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseTransitionArtifactIncompatibleError
+
+Fixed failure when a website selection names a non-HTML artifact.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseTransitionArtifactIncompatibleError(): AppReleaseTransitionArtifactIncompatibleError;
+```
+
+###### Returns
+
+[`AppReleaseTransitionArtifactIncompatibleError`](#appreleasetransitionartifactincompatibleerror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseTransitionReleaseRevokedError
+
+Fixed failure when promotion or rollback names a revoked Release.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseTransitionReleaseRevokedError(): AppReleaseTransitionReleaseRevokedError;
+```
+
+###### Returns
+
+[`AppReleaseTransitionReleaseRevokedError`](#appreleasetransitionreleaserevokederror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseTransitionSurfaceAbsentError
+
+Fixed failure when a transition names no stored public Surface.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseTransitionSurfaceAbsentError(): AppReleaseTransitionSurfaceAbsentError;
+```
+
+###### Returns
+
+[`AppReleaseTransitionSurfaceAbsentError`](#appreleasetransitionsurfaceabsenterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseTransitionOwnershipConflictError
+
+Fixed failure when a Release is owned by another App than its Surface.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseTransitionOwnershipConflictError(): AppReleaseTransitionOwnershipConflictError;
+```
+
+###### Returns
+
+[`AppReleaseTransitionOwnershipConflictError`](#appreleasetransitionownershipconflicterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseTransitionIdempotencyConflictError
+
+Fixed failure when an idempotency key is reused for changed material input.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseTransitionIdempotencyConflictError(): AppReleaseTransitionIdempotencyConflictError;
+```
+
+###### Returns
+
+[`AppReleaseTransitionIdempotencyConflictError`](#appreleasetransitionidempotencyconflicterror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleaseTransitionIdUnavailableError
+
+Fixed, non-leaking failure when Cairn cannot issue a transition identity.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleaseTransitionIdUnavailableError(): AppReleaseTransitionIdUnavailableError;
+```
+
+###### Returns
+
+[`AppReleaseTransitionIdUnavailableError`](#appreleasetransitionidunavailableerror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleasePublicWebsiteNotFoundError
+
+Fixed non-leaking failure for malformed, absent, or unselected routes.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleasePublicWebsiteNotFoundError(): AppReleasePublicWebsiteNotFoundError;
+```
+
+###### Returns
+
+[`AppReleasePublicWebsiteNotFoundError`](#appreleasepublicwebsitenotfounderror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+---
+
+### AppReleasePublicWebsiteUnavailableError
+
+Fixed non-leaking failure when public delivery cannot be proven safe.
+
+#### Extends
+
+- `Error`
+
+#### Constructors
+
+##### Constructor
+
+```ts
+new AppReleasePublicWebsiteUnavailableError(): AppReleasePublicWebsiteUnavailableError;
+```
+
+###### Returns
+
+[`AppReleasePublicWebsiteUnavailableError`](#appreleasepublicwebsiteunavailableerror)
+
+###### Overrides
+
+```ts
+Error.constructor;
+```
+
+## Type Aliases
+
+### AppRole
+
+```ts
+type AppRole = (typeof appRoles)[number];
+```
+
+One assignable App role.
+
+---
+
+### AppCapabilityId
+
+```ts
+type AppCapabilityId = (typeof appCapabilityIds)[number];
+```
+
+One requestable host capability id.
+
+---
+
+### AppApi
+
+```ts
+type AppApi = Readonly<{
+  methods: Readonly<
+    Record<
+      string,
+      Readonly<{
+        description: string;
+        input: object;
+        output: object;
+        effect: "read" | "write" | "external";
+        requires: readonly AppCapabilityId[];
+        pending?: true;
+        hidden?: true;
+        anonymous?: true;
+      }>
+    >
+  >;
+  toolFamily?: Readonly<{
+    name: string;
+    list: string;
+    call: string;
+  }>;
+  events?: Readonly<
+    Record<
+      string,
+      Readonly<{
+        description: string;
+        payload: object;
+      }>
+    >
+  >;
+}>;
+```
+
+Build-generated method and event metadata. This data-only projection grants no
+authority.
+
+---
+
+### AppHandler
+
+```ts
+type AppHandler = (typeof appHandlers)[number];
+```
+
+One shell navigation request an App can handle.
+
+---
+
+### AppDeclaredCommand
+
+```ts
+type AppDeclaredCommand = Readonly<{
+  id: string;
+  title: string;
+  category: string;
+  description?: string;
+  sigil?: string;
+  projections?: Readonly<{
+     bindings?: Readonly<{
+        order?: ... | ...;
+      }> & Readonly<{
+        values: readonly ...;
+     }>;
+     agent?: Readonly<{
+        order?: ... | ...;
+      }> & Readonly<{
+        keybind?: ... | ...;
+     }>;
+     help?: Readonly<{
+        order?: number;
+     }>;
+     menu?: Readonly<{
+        order?: number;
+     }>;
+     palette?: Readonly<{
+        order?: number;
+     }>;
+     slash?: Readonly<{
+        order?: ... | ...;
+      }> & Readonly<{
+        aliases: readonly ...;
+     }>;
+  }>;
+}>;
+```
+
+One command an App declares so the backend can advertise it before the App is
+open: the identity, labels and projections of a Whistle definition.
+Availability, typed action schemas and slash argument grammars are runtime facts
+the mounted App registers, so they are not part of the declaration.
+
+---
+
+### AppStorageScope
+
+```ts
+type AppStorageScope = (typeof appStorageScopes)[number];
+```
+
+The shared Team default or the calling member's private override.
+
+---
+
+### AppStorageKey
+
+```ts
+type AppStorageKey = Readonly<{
+  key: string;
+  scopes: readonly AppStorageScope[];
+  maxBytes: number;
+}>;
+```
+
+One digest-covered key and the bounds its App agrees to use.
+
+---
+
+### AppDeclaration
+
+```ts
+type AppDeclaration = Readonly<{
+  api?: AppApi;
+  displayName?: string;
+  capabilities: readonly AppCapabilityId[];
+  calls?: readonly Readonly<{
+    appId: string;
+    methods: readonly string[];
+  }>[];
+  guidance?: string;
+  handlers: readonly AppHandler[];
+  receives?: readonly "git.push"[];
+  icon?: string;
+  roles: readonly AppRole[];
+  storage?: readonly AppStorageKey[];
+  commands?: readonly AppDeclaredCommand[];
+  gills?: readonly AppDeclaredGill[];
+  backend?: Readonly<{
+    bindings: readonly AppBackendBinding[];
+    sync?: Readonly<{
+      method: string;
+    }>;
+  }>;
+}>;
+```
+
+What an App asks of the host, covered by its Release digest. Every App,
+first-party or not, uses this same declaration; there is no other source.
+
+---
+
+### AppId
+
+```ts
+type AppId = string & object;
+```
+
+Opaque Global App identifier.
+
+#### Type Declaration
+
+| Name             | Type      |
+| ---------------- | --------- |
+| `appReleaseKind` | `"AppId"` |
+
+---
+
+### ReleaseId
+
+```ts
+type ReleaseId = string & object;
+```
+
+Opaque immutable Release identifier.
+
+#### Type Declaration
+
+| Name             | Type          |
+| ---------------- | ------------- |
+| `appReleaseKind` | `"ReleaseId"` |
+
+---
+
+### PublicSurfaceId
+
+```ts
+type PublicSurfaceId = string & object;
+```
+
+Opaque anonymous public-Surface identifier.
+
+#### Type Declaration
+
+| Name             | Type                |
+| ---------------- | ------------------- |
+| `appReleaseKind` | `"PublicSurfaceId"` |
+
+---
+
+### ArtifactRef
+
+```ts
+type ArtifactRef = string & object;
+```
+
+Opaque, bounded artifact locator for an injected reader.
+
+#### Type Declaration
+
+| Name             | Type            |
+| ---------------- | --------------- |
+| `appReleaseKind` | `"ArtifactRef"` |
+
+---
+
+### IdempotencyKey
+
+```ts
+type IdempotencyKey = string & object;
+```
+
+Caller-provided idempotency key for one control-plane operation.
+
+#### Type Declaration
+
+| Name             | Type               |
+| ---------------- | ------------------ |
+| `appReleaseKind` | `"IdempotencyKey"` |
+
+---
+
+### SourceRevision
+
+```ts
+type SourceRevision = string & object;
+```
+
+Pinned lowercase Git source revision.
+
+#### Type Declaration
+
+| Name             | Type               |
+| ---------------- | ------------------ |
+| `appReleaseKind` | `"SourceRevision"` |
+
+---
+
+### Sha256Digest
+
+```ts
+type Sha256Digest = string & object;
+```
+
+Lowercase SHA-256 digest with its `sha256:` prefix.
+
+#### Type Declaration
+
+| Name             | Type             |
+| ---------------- | ---------------- |
+| `appReleaseKind` | `"Sha256Digest"` |
+
+---
+
+### StableRoute
+
+```ts
+type StableRoute = string & object;
+```
+
+Canonical, local origin-relative stable route for a public Surface.
+
+#### Type Declaration
+
+| Name             | Type            |
+| ---------------- | --------------- |
+| `appReleaseKind` | `"StableRoute"` |
+
+---
+
+### AppTransitionId
+
+```ts
+type AppTransitionId = CairnId<"app-release", "transition">;
+```
+
+Cairn-issued opaque identity for one owner-issued App transition.
+
+---
+
+### ImmutableArtifactBytes
+
+```ts
+type ImmutableArtifactBytes = object;
+```
+
+Immutable artifact bytes exposed only through fresh copies.
+
+#### Properties
+
+##### byteLength
+
+```ts
+readonly byteLength: number;
+```
+
+The immutable snapshot's bounded byte length.
+
+#### Methods
+
+##### copy()
+
+```ts
+copy(): Uint8Array;
+```
+
+Return an independently mutable copy of the immutable snapshot.
+
+###### Returns
+
+`Uint8Array`
+
+---
+
+### ArtifactProvenance
+
+```ts
+type ArtifactProvenance = object;
+```
+
+Source and build facts permanently bound to a Release artifact.
+
+#### Properties
+
+##### sourceRevision
+
+```ts
+readonly sourceRevision: SourceRevision;
+```
+
+Pinned source revision from which the artifact was built.
+
+##### sourceTreeDigest
+
+```ts
+readonly sourceTreeDigest: Sha256Digest;
+```
+
+Digest of the source tree used for the build.
+
+##### buildRecipeDigest
+
+```ts
+readonly buildRecipeDigest: Sha256Digest;
+```
+
+Digest of the deterministic build recipe.
+
+---
+
+### ReleaseArtifact
+
+```ts
+type ReleaseArtifact = object;
+```
+
+Immutable artifact identity and provenance bound to a Release.
+
+#### Properties
+
+##### artifactRef
+
+```ts
+readonly artifactRef: ArtifactRef;
+```
+
+Opaque reference resolved only by the injected reader.
+
+##### artifactDigest
+
+```ts
+readonly artifactDigest: Sha256Digest;
+```
+
+Digest expected from the resolved artifact bytes.
+
+##### provenance
+
+```ts
+readonly provenance: ArtifactProvenance;
+```
+
+Write-once source and build provenance.
+
+---
+
+### App
+
+```ts
+type App = object;
+```
+
+Global App record owned by the catalog.
+
+#### Properties
+
+##### appId
+
+```ts
+readonly appId: AppId;
+```
+
+Opaque App identity.
+
+---
+
+### Release
+
+```ts
+type Release = object;
+```
+
+Immutable App Release record.
+
+#### Properties
+
+##### releaseId
+
+```ts
+readonly releaseId: ReleaseId;
+```
+
+Opaque immutable Release identity.
+
+##### appId
+
+```ts
+readonly appId: AppId;
+```
+
+App that owns this Release.
+
+##### artifact
+
+```ts
+readonly artifact: ReleaseArtifact;
+```
+
+Immutable artifact identity and provenance.
+
+---
+
+### PublicSurface
+
+```ts
+type PublicSurface = object;
+```
+
+Anonymous website Surface and its explicit App owner.
+
+#### Properties
+
+##### publicSurfaceId
+
+```ts
+readonly publicSurfaceId: PublicSurfaceId;
+```
+
+Opaque public-Surface identity.
+
+##### appId
+
+```ts
+readonly appId: AppId;
+```
+
+App that owns this Surface.
+
+##### stableRoute
+
+```ts
+readonly stableRoute: StableRoute;
+```
+
+Canonical local route locator for this Surface.
+
+---
+
+### PublicSurfacePublisher
+
+```ts
+type PublicSurfacePublisher = Readonly<{
+  kind: "customer" | "platform";
+  teamId: string;
+  userId: string;
+  requestKey: string;
+}>;
+```
+
+Admitted publisher identity retained separately from public Surface metadata.
+
+---
+
+### PublicSurfaceDefinition
+
+```ts
+type PublicSurfaceDefinition = PublicSurface &
+  Readonly<{
+    publisher: PublicSurfacePublisher;
+  }>;
+```
+
+Creation requires explicit publisher custody; an ID is never authority.
+
+---
+
+### ArtifactMediaType
+
+```ts
+type ArtifactMediaType =
+  | "text/html; charset=utf-8"
+  | "application/vnd.fungi.app-backend+json"
+  | "application/vnd.fungi.app-assets+json"
+  | "application/vnd.fungi.app+json";
+```
+
+Supported immutable artifact representation formats.
+
+---
+
+### VerifiedAppArtifactReference
+
+```ts
+type VerifiedAppArtifactReference = Readonly<{
+  artifactRef: ArtifactRef;
+  digest: Sha256Digest;
+  mediaType: Exclude<ArtifactMediaType, "application/vnd.fungi.app+json">;
+  version: string;
+  byteLength: number;
+}>;
+```
+
+One immutable child reference retained after App publication verification.
+
+---
+
+### DurableBackend
+
+```ts
+type DurableBackend = Readonly<{
+  runtime: Readonly<{
+    kind: "durable-facet";
+    stateSchema: number;
+  }>;
+  compatibilityDate: string;
+  exportName: string;
+  code: string;
+}>;
+```
+
+Executable descriptor decoded from one verified backend child artifact.
+
+---
+
+### VerifiedBackendProfile
+
+```ts
+type VerifiedBackendProfile = Omit<DurableBackend, "code">;
+```
+
+Backend facts needed for admission, with executable code deliberately absent.
+
+---
+
+### VerifiedAppDescription
+
+```ts
+type VerifiedAppDescription = Readonly<{
+  format: "fungi-app-v1";
+  ui: VerifiedAppArtifactReference | null;
+  backend: Readonly<{
+    artifact: VerifiedAppArtifactReference;
+    profile: VerifiedBackendProfile;
+  }> | null;
+  declaration: AppDeclaration;
+}>;
+```
+
+Normalized immutable App description persisted by the verification owner.
+
+---
+
+### ResolvedAppMetadata
+
+```ts
+type ResolvedAppMetadata = Readonly<{
+  release: Release;
+  digest: Sha256Digest;
+  description: VerifiedAppDescription;
+}>;
+```
+
+Verified metadata returned without reading any artifact body.
+
+---
+
+### PublicSurfaceAuthority
+
+```ts
+type PublicSurfaceAuthority = Readonly<{
+  currentReleaseId: ReleaseId;
+  sequence: number;
+  app: App;
+  release: Release;
+  surface: PublicSurface;
+  digest: Sha256Digest;
+  revocation: ReleaseRevocation;
+  description: VerifiedAppDescription;
+}>;
+```
+
+Current metadata-only authority for one selected public Surface.
+
+---
+
+### VerifiedArtifactRead
+
+```ts
+type VerifiedArtifactRead = object;
+```
+
+Successful, verified artifact read.
+
+#### Properties
+
+##### kind
+
+```ts
+readonly kind: "verified";
+```
+
+Discriminant for a verified immutable representation snapshot.
+
+##### digest
+
+```ts
+readonly digest: Sha256Digest;
+```
+
+Computed digest matching the requested digest.
+
+##### mediaType
+
+```ts
+readonly mediaType: ArtifactMediaType;
+```
+
+Explicit artifact formats; an asset root is never interpreted as HTML or backend
+code.
+
+##### bytes
+
+```ts
+readonly bytes: ImmutableArtifactBytes;
+```
+
+Immutable representation byte snapshot.
+
+##### byteLength
+
+```ts
+readonly byteLength: number;
+```
+
+Byte length matching the immutable snapshot.
+
+---
+
+### AppUi
+
+```ts
+type AppUi = Omit<VerifiedArtifactRead, "kind" | "mediaType"> & object;
+```
+
+Verified UI representation; selection authority remains with its host.
+
+#### Type Declaration
+
+| Name        | Type                                                                      |
+| ----------- | ------------------------------------------------------------------------- |
+| `mediaType` | `"text/html; charset=utf-8"` \| `"application/vnd.fungi.app-assets+json"` |
+
+---
+
+### AppDescription
+
+```ts
+type AppDescription = Readonly<{
+  ui: AppUi | null;
+  backend: Readonly<{
+    digest: Sha256Digest;
+    descriptor: DurableBackend;
+  }> | null;
+}>;
+```
+
+Normalized immutable code description shared by Surface and facet consumers.
+
+---
+
+### ResolvedApp
+
+```ts
+type ResolvedApp = AppDescription &
+  Readonly<{
+    release: Release;
+    digest: Sha256Digest;
+  }>;
+```
+
+One eligible Release with all declared executable parts resolved.
+
+---
+
+### ArtifactReadResult
+
+```ts
+type ArtifactReadResult =
+  | VerifiedArtifactRead
+  | {
+      kind: "unavailable";
+    }
+  | {
+      kind: "missing";
+    }
+  | {
+      kind: "digest-mismatch";
+      actualDigest: Sha256Digest;
+    };
+```
+
+Closed result union returned by an injected artifact reader.
+
+---
+
+### ArtifactVerificationIntent
+
+```ts
+type ArtifactVerificationIntent = "publication";
+```
+
+Names the owner-controlled verification work requested for one read.
+
+---
+
+### ArtifactReader
+
+```ts
+type ArtifactReader = object;
+```
+
+Storage-neutral port that resolves an opaque reference and verifies bytes.
+
+#### Methods
+
+##### read()
+
+```ts
+read(input): Promise<ArtifactReadResult>;
+```
+
+Resolve and verify exactly one expected immutable artifact.
+
+###### Parameters
+
+| Parameter                         | Type                                                                                                                                                                                                                                                        | Description                                                                                                                                                                      |
+| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `input`                           | \{ `artifactRef`: [`ArtifactRef`](#artifactref); `expectedDigest`: [`Sha256Digest`](#sha256digest); `expectedObject?`: \{ `version`: `string`; `byteLength`: `number`; \}; `verification?`: [`ArtifactVerificationIntent`](#artifactverificationintent); \} | -                                                                                                                                                                                |
+| `input.artifactRef`               | [`ArtifactRef`](#artifactref)                                                                                                                                                                                                                               | Opaque artifact reference; never a storage capability.                                                                                                                           |
+| `input.expectedDigest`            | [`Sha256Digest`](#sha256digest)                                                                                                                                                                                                                             | Digest that the resolved bytes must match.                                                                                                                                       |
+| `input.expectedObject?`           | \{ `version`: `string`; `byteLength`: `number`; \}                                                                                                                                                                                                          | Child reference pins the native object version as well as its content.                                                                                                           |
+| `input.expectedObject.version`    | `string`                                                                                                                                                                                                                                                    | -                                                                                                                                                                                |
+| `input.expectedObject.byteLength` | `number`                                                                                                                                                                                                                                                    | -                                                                                                                                                                                |
+| `input.verification?`             | [`ArtifactVerificationIntent`](#artifactverificationintent)                                                                                                                                                                                                 | Publication asks the reader to verify every object named by an asset manifest. Omitted for ordinary delivery, which verifies one requested object at the asset handler boundary. |
+
+###### Returns
+
+`Promise`\<[`ArtifactReadResult`](#artifactreadresult)\>
+
+---
+
+### AppReleaseStoreFailure
+
+```ts
+type AppReleaseStoreFailure = object;
+```
+
+Closed infrastructure failure projected by an App Release store.
+
+#### Properties
+
+##### kind
+
+```ts
+readonly kind: "unavailable";
+```
+
+---
+
+### AppReleaseStoreSuccess
+
+```ts
+type AppReleaseStoreSuccess<Value> = object;
+```
+
+Closed successful outcome for one App Release store operation.
+
+#### Type Parameters
+
+| Type Parameter |
+| -------------- |
+| `Value`        |
+
+#### Properties
+
+##### kind
+
+```ts
+readonly kind: "success";
+```
+
+##### value
+
+```ts
+readonly value: Value;
+```
+
+---
+
+### AppReleaseStoreOperationFailure
+
+```ts
+type AppReleaseStoreOperationFailure = object;
+```
+
+Closed failed outcome for one App Release store operation.
+
+#### Properties
+
+##### kind
+
+```ts
+readonly kind: "failure";
+```
+
+##### failure
+
+```ts
+readonly failure: AppReleaseStoreFailure;
+```
+
+---
+
+### AppReleaseStoreResult
+
+```ts
+type AppReleaseStoreResult<Value> =
+  AppReleaseStoreSuccess<Value> | AppReleaseStoreOperationFailure;
+```
+
+Closed envelope returned by every App Release store operation.
+
+#### Type Parameters
+
+| Type Parameter |
+| -------------- |
+| `Value`        |
+
+---
+
+### AppRead
+
+```ts
+type AppRead =
+  | {
+      kind: "found";
+      app: App;
+    }
+  | {
+      kind: "absent";
+    };
+```
+
+Explicit result of looking up one Global App.
+
+---
+
+### AppCreate
+
+```ts
+type AppCreate =
+  | {
+      kind: "created";
+      app: App;
+    }
+  | {
+      kind: "existing";
+      app: App;
+    };
+```
+
+Explicit result of atomically creating or observing one Global App.
+
+---
+
+### ReleaseRead
+
+```ts
+type ReleaseRead =
+  | {
+      kind: "found";
+      release: Release;
+    }
+  | {
+      kind: "absent";
+    };
+```
+
+Explicit result of looking up one immutable Release.
+
+---
+
+### ReleaseCreate
+
+```ts
+type ReleaseCreate =
+  | {
+      kind: "created";
+      release: Release;
+    }
+  | {
+      kind: "existing";
+      release: Release;
+    };
+```
+
+Explicit result of atomically creating or observing one immutable Release.
+
+---
+
+### PublicSurfaceRead
+
+```ts
+type PublicSurfaceRead =
+  | {
+      kind: "found";
+      surface: PublicSurface;
+    }
+  | {
+      kind: "absent";
+    };
+```
+
+Explicit result of looking up one App-owned anonymous public Surface.
+
+---
+
+### PublicSurfaceCreate
+
+```ts
+type PublicSurfaceCreate =
+  | {
+      kind: "created";
+      surface: PublicSurface;
+    }
+  | {
+      kind: "existing";
+      surface: PublicSurface;
+    }
+  | {
+      kind: "conflict";
+    };
+```
+
+Explicit result of atomically creating or observing one public Surface.
+
+---
+
+### ReleaseVerification
+
+```ts
+type ReleaseVerification =
+  | {
+      kind: "verified";
+      digest: Sha256Digest;
+      mediaType: "application/vnd.fungi.app+json";
+      description: VerifiedAppDescription;
+    }
+  | {
+      kind: "unverified";
+    };
+```
+
+Verification fact retained after a valid immutable artifact snapshot.
+
+---
+
+### ReleaseRevocation
+
+```ts
+type ReleaseRevocation =
+  | {
+      kind: "active";
+    }
+  | {
+      kind: "revoked";
+    };
+```
+
+Revocation fact retained independently from immutable Release bytes.
+
+---
+
+### ReleaseLifecycle
+
+```ts
+type ReleaseLifecycle =
+  | {
+      kind: "found";
+      release: Release;
+      verification: ReleaseVerification;
+      revocation: ReleaseRevocation;
+    }
+  | {
+      kind: "absent";
+    };
+```
+
+Durable Release facts observed by transition policy.
+
+---
+
+### PublicSurfaceLifecycle
+
+```ts
+type PublicSurfaceLifecycle =
+  | {
+      kind: "found";
+      surface: PublicSurface;
+      selection:
+        | {
+            kind: "none";
+          }
+        | {
+            kind: "selected";
+            releaseId: ReleaseId;
+          };
+    }
+  | {
+      kind: "absent";
+    };
+```
+
+Durable public-Surface selection fact observed by transition policy.
+
+---
+
+### PublicWebsiteRepresentation
+
+```ts
+type PublicWebsiteRepresentation = Readonly<{
+  releaseId: ReleaseId;
+  digest: Sha256Digest;
+  mediaType: "text/html; charset=utf-8";
+  byteLength: number;
+  bytes: ImmutableArtifactBytes;
+}>;
+```
+
+Safe immutable website bytes selected by the current Surface authority.
+
+---
+
+### PublicAssetBuildRepresentation
+
+```ts
+type PublicAssetBuildRepresentation = Omit<
+  PublicWebsiteRepresentation,
+  "mediaType"
+> &
+  object;
+```
+
+Verified root manifest selected by the existing public Surface owner.
+
+#### Type Declaration
+
+| Name        | Type                                      |
+| ----------- | ----------------------------------------- |
+| `mediaType` | `"application/vnd.fungi.app-assets+json"` |
+
+---
+
+### TransitionLookup
+
+```ts
+type TransitionLookup =
+  | {
+      kind: "absent";
+    }
+  | {
+      kind: "found";
+      receipt: TransitionReceipt;
+    }
+  | {
+      kind: "conflict";
+    };
+```
+
+Result of looking up an operation-scoped idempotency key.
+
+---
+
+### TransitionPersistence
+
+```ts
+type TransitionPersistence =
+  | {
+      kind: "created";
+      receipt: TransitionReceipt;
+    }
+  | {
+      kind: "existing";
+      receipt: TransitionReceipt;
+    }
+  | {
+      kind: "conflict";
+    }
+  | {
+      kind: "identity-collision";
+    }
+  | {
+      kind: "lifecycle-conflict";
+    };
+```
+
+Result of atomically recording one transition and its receipt.
+
+---
+
+### PromiseAppReleaseStore
+
+```ts
+type PromiseAppReleaseStore = object;
+```
+
+Effect-free projection of the App Release store boundary.
+
+#### Properties
+
+##### readReleaseLifecycle?
+
+```ts
+readonly optional readReleaseLifecycle?: (releaseId) => Promise<AppReleaseStoreResult<ReleaseLifecycle>>;
+```
+
+Read immutable Release facts needed by owner-issued transitions.
+
+###### Parameters
+
+| Parameter   | Type                      |
+| ----------- | ------------------------- |
+| `releaseId` | [`ReleaseId`](#releaseid) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`ReleaseLifecycle`](#releaselifecycle)\>\>
+
+##### recordReleaseVerification?
+
+```ts
+readonly optional recordReleaseVerification?: (input) => Promise<AppReleaseStoreResult<{
+  kind: "recorded";
+}>>;
+```
+
+Atomically retain that one Release artifact was successfully verified.
+
+###### Parameters
+
+| Parameter           | Type                                                                                                                                                                                                          |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `input`             | \{ `releaseId`: [`ReleaseId`](#releaseid); `digest`: [`Sha256Digest`](#sha256digest); `mediaType`: `"application/vnd.fungi.app+json"`; `description`: [`VerifiedAppDescription`](#verifiedappdescription); \} |
+| `input.releaseId`   | [`ReleaseId`](#releaseid)                                                                                                                                                                                     |
+| `input.digest`      | [`Sha256Digest`](#sha256digest)                                                                                                                                                                               |
+| `input.mediaType`   | `"application/vnd.fungi.app+json"`                                                                                                                                                                            |
+| `input.description` | [`VerifiedAppDescription`](#verifiedappdescription)                                                                                                                                                           |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<\{ `kind`:
+`"recorded"`; \}\>\>
+
+##### readTransition?
+
+```ts
+readonly optional readTransition?: (request) => Promise<AppReleaseStoreResult<TransitionLookup>>;
+```
+
+Read one operation-scoped transition receipt before policy checks.
+
+###### Parameters
+
+| Parameter | Type                                      |
+| --------- | ----------------------------------------- |
+| `request` | [`ReleaseTransition`](#releasetransition) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`TransitionLookup`](#transitionlookup)\>\>
+
+##### persistTransition?
+
+```ts
+readonly optional persistTransition?: (request, receipt) => Promise<AppReleaseStoreResult<TransitionPersistence>>;
+```
+
+Atomically persist a validated transition and its terminal receipt.
+
+###### Parameters
+
+| Parameter | Type                                      |
+| --------- | ----------------------------------------- |
+| `request` | [`ReleaseTransition`](#releasetransition) |
+| `receipt` | [`TransitionReceipt`](#transitionreceipt) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`TransitionPersistence`](#transitionpersistence)\>\>
+
+#### Methods
+
+##### readApp()
+
+```ts
+readApp(appId): Promise<AppReleaseStoreResult<AppRead>>;
+```
+
+Look up one App by its opaque identifier.
+
+###### Parameters
+
+| Parameter | Type              |
+| --------- | ----------------- |
+| `appId`   | [`AppId`](#appid) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`AppRead`](#appread)\>\>
+
+##### createAppIfAbsent()
+
+```ts
+createAppIfAbsent(app): Promise<AppReleaseStoreResult<AppCreate>>;
+```
+
+Create an App if absent, or return the immutable existing record.
+
+###### Parameters
+
+| Parameter | Type          |
+| --------- | ------------- |
+| `app`     | [`App`](#app) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`AppCreate`](#appcreate)\>\>
+
+##### readRelease()
+
+```ts
+readRelease(releaseId): Promise<AppReleaseStoreResult<ReleaseRead>>;
+```
+
+Look up one immutable Release by its opaque identifier.
+
+###### Parameters
+
+| Parameter   | Type                      |
+| ----------- | ------------------------- |
+| `releaseId` | [`ReleaseId`](#releaseid) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`ReleaseRead`](#releaseread)\>\>
+
+##### createReleaseIfAbsent()
+
+```ts
+createReleaseIfAbsent(release): Promise<AppReleaseStoreResult<ReleaseCreate>>;
+```
+
+Create a Release if absent, or return the immutable existing record.
+
+###### Parameters
+
+| Parameter | Type                  |
+| --------- | --------------------- |
+| `release` | [`Release`](#release) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`ReleaseCreate`](#releasecreate)\>\>
+
+##### readPublicSurface()
+
+```ts
+readPublicSurface(publicSurfaceId): Promise<AppReleaseStoreResult<PublicSurfaceRead>>;
+```
+
+Look up one public Surface by its opaque identifier.
+
+###### Parameters
+
+| Parameter         | Type                                  |
+| ----------------- | ------------------------------------- |
+| `publicSurfaceId` | [`PublicSurfaceId`](#publicsurfaceid) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`PublicSurfaceRead`](#publicsurfaceread)\>\>
+
+##### createPublicSurfaceIfAbsent()
+
+```ts
+createPublicSurfaceIfAbsent(surface): Promise<AppReleaseStoreResult<PublicSurfaceCreate>>;
+```
+
+Create a public Surface if absent, or return the immutable existing record.
+
+###### Parameters
+
+| Parameter | Type                                                  |
+| --------- | ----------------------------------------------------- |
+| `surface` | [`PublicSurfaceDefinition`](#publicsurfacedefinition) |
+
+###### Returns
+
+`Promise`\<[`AppReleaseStoreResult`](#appreleasestoreresult)\<[`PublicSurfaceCreate`](#publicsurfacecreate)\>\>
+
+---
+
+### ReleaseTransition
+
+```ts
+type ReleaseTransition =
+  | {
+      kind: "promotion";
+      publicSurfaceId: PublicSurfaceId;
+      releaseId: ReleaseId;
+      idempotencyKey: IdempotencyKey;
+    }
+  | {
+      kind: "rollback";
+      publicSurfaceId: PublicSurfaceId;
+      releaseId: ReleaseId;
+      idempotencyKey: IdempotencyKey;
+    }
+  | {
+      kind: "revocation";
+      releaseId: ReleaseId;
+      idempotencyKey: IdempotencyKey;
+    };
+```
+
+Owner-issued transition request.
+
+---
+
+### TransitionReceipt
+
+```ts
+type TransitionReceipt = object;
+```
+
+Terminal receipt for an owner-issued transition.
+
+#### Properties
+
+##### transition
+
+```ts
+readonly transition: ReleaseTransition;
+```
+
+##### transitionId
+
+```ts
+readonly transitionId: AppTransitionId;
+```
+
+---
+
+### AppReleaseCatalogOptions
+
+```ts
+type AppReleaseCatalogOptions = object;
+```
+
+Inputs for the catalog factory.
+
+#### Properties
+
+##### artifactReader
+
+```ts
+readonly artifactReader: ArtifactReader;
+```
+
+##### store
+
+```ts
+readonly store: PromiseAppReleaseStore;
+```
+
+##### artifactPolicy?
+
+```ts
+readonly optional artifactPolicy?: object;
+```
+
+###### maxBytes
+
+```ts
+readonly maxBytes: number;
+```
+
+###### maxManifestBytes?
+
+```ts
+readonly optional maxManifestBytes?: number;
+```
+
+---
+
+### AppReleaseCatalog
+
+```ts
+type AppReleaseCatalog = object;
+```
+
+Public App Release catalog and public-website resolution seam.
+
+#### Methods
+
+##### createApp()
+
+```ts
+createApp(app): Promise<App>;
+```
+
+Create an App once and return the canonical stored record.
+
+###### Parameters
+
+| Parameter | Type          |
+| --------- | ------------- |
+| `app`     | [`App`](#app) |
+
+###### Returns
+
+`Promise`\<[`App`](#app)\>
+
+##### createRelease()
+
+```ts
+createRelease(release): Promise<Release>;
+```
+
+Create a Release once and return the canonical stored record.
+
+###### Parameters
+
+| Parameter | Type                  |
+| --------- | --------------------- |
+| `release` | [`Release`](#release) |
+
+###### Returns
+
+`Promise`\<[`Release`](#release)\>
+
+##### verifyReleaseArtifact()
+
+```ts
+verifyReleaseArtifact(releaseId): Promise<VerifiedArtifactRead>;
+```
+
+Resolve and verify the immutable artifact bound to a Release.
+
+###### Parameters
+
+| Parameter   | Type                      |
+| ----------- | ------------------------- |
+| `releaseId` | [`ReleaseId`](#releaseid) |
+
+###### Returns
+
+`Promise`\<[`VerifiedArtifactRead`](#verifiedartifactread)\>
+
+##### resolveEligibleReleaseArtifact()
+
+```ts
+resolveEligibleReleaseArtifact(releaseId): Promise<VerifiedArtifactRead & object>;
+```
+
+Read one verified, active Release snapshot and recheck its lifecycle. The caller
+owns selection authorization and must resolve before each use.
+
+###### Parameters
+
+| Parameter   | Type                      |
+| ----------- | ------------------------- |
+| `releaseId` | [`ReleaseId`](#releaseid) |
+
+###### Returns
+
+`Promise`\<[`VerifiedArtifactRead`](#verifiedartifactread) & `object`\>
+
+##### resolveEligibleApp()
+
+```ts
+resolveEligibleApp(releaseId): Promise<ResolvedApp>;
+```
+
+Resolve the UI and backend bound by one eligible immutable Release.
+
+###### Parameters
+
+| Parameter   | Type                      |
+| ----------- | ------------------------- |
+| `releaseId` | [`ReleaseId`](#releaseid) |
+
+###### Returns
+
+`Promise`\<[`ResolvedApp`](#resolvedapp)\>
+
+##### resolveEligibleAppMetadata()
+
+```ts
+resolveEligibleAppMetadata(releaseId): Promise<Readonly<{
+  release: Release;
+  digest: Sha256Digest;
+  description: VerifiedAppDescription;
+}>>;
+```
+
+Resolve verified App metadata without reading any artifact body.
+
+###### Parameters
+
+| Parameter   | Type                      |
+| ----------- | ------------------------- |
+| `releaseId` | [`ReleaseId`](#releaseid) |
+
+###### Returns
+
+`Promise`\<`Readonly`\<\{ `release`: [`Release`](#release); `digest`:
+[`Sha256Digest`](#sha256digest); `description`:
+[`VerifiedAppDescription`](#verifiedappdescription); \}\>\>
+
+##### resolvePublicSurfaceAuthority()
+
+```ts
+resolvePublicSurfaceAuthority(stableRoute): Promise<Readonly<{
+  currentReleaseId: ReleaseId;
+  sequence: number;
+  app: App;
+  release: Release;
+  surface: PublicSurface;
+  digest: Sha256Digest;
+  revocation: ReleaseRevocation;
+  description: VerifiedAppDescription;
+}>>;
+```
+
+Resolve one selected Surface's current metadata authority without bodies.
+
+###### Parameters
+
+| Parameter     | Type                          |
+| ------------- | ----------------------------- |
+| `stableRoute` | [`StableRoute`](#stableroute) |
+
+###### Returns
+
+`Promise`\<`Readonly`\<\{ `currentReleaseId`: [`ReleaseId`](#releaseid);
+`sequence`: `number`; `app`: [`App`](#app); `release`: [`Release`](#release);
+`surface`: [`PublicSurface`](#publicsurface); `digest`:
+[`Sha256Digest`](#sha256digest); `revocation`:
+[`ReleaseRevocation`](#releaserevocation); `description`:
+[`VerifiedAppDescription`](#verifiedappdescription); \}\>\>
+
+##### resolvePublicSurfaceAuthorityVersion()
+
+```ts
+resolvePublicSurfaceAuthorityVersion(stableRoute, releaseId): Promise<Readonly<{
+  currentReleaseId: ReleaseId;
+  sequence: number;
+  app: App;
+  release: Release;
+  surface: PublicSurface;
+  digest: Sha256Digest;
+  revocation: ReleaseRevocation;
+  description: VerifiedAppDescription;
+}>>;
+```
+
+Resolve one previously selected Release's current metadata authority.
+
+###### Parameters
+
+| Parameter     | Type                          |
+| ------------- | ----------------------------- |
+| `stableRoute` | [`StableRoute`](#stableroute) |
+| `releaseId`   | [`ReleaseId`](#releaseid)     |
+
+###### Returns
+
+`Promise`\<`Readonly`\<\{ `currentReleaseId`: [`ReleaseId`](#releaseid);
+`sequence`: `number`; `app`: [`App`](#app); `release`: [`Release`](#release);
+`surface`: [`PublicSurface`](#publicsurface); `digest`:
+[`Sha256Digest`](#sha256digest); `revocation`:
+[`ReleaseRevocation`](#releaserevocation); `description`:
+[`VerifiedAppDescription`](#verifiedappdescription); \}\>\>
+
+##### createPublicSurface()
+
+```ts
+createPublicSurface(surface): Promise<PublicSurface>;
+```
+
+Create a public Surface once and return the canonical stored record.
+
+###### Parameters
+
+| Parameter | Type                                                  |
+| --------- | ----------------------------------------------------- |
+| `surface` | [`PublicSurfaceDefinition`](#publicsurfacedefinition) |
+
+###### Returns
+
+`Promise`\<[`PublicSurface`](#publicsurface)\>
+
+##### transition()
+
+```ts
+transition(request): Promise<TransitionReceipt>;
+```
+
+Apply one owner-issued promotion, rollback, or revocation request.
+
+###### Parameters
+
+| Parameter | Type                                      |
+| --------- | ----------------------------------------- |
+| `request` | [`ReleaseTransition`](#releasetransition) |
+
+###### Returns
+
+`Promise`\<[`TransitionReceipt`](#transitionreceipt)\>
+
+##### resolvePublicAssetBuild()
+
+```ts
+resolvePublicAssetBuild(stableRoute): Promise<PublicAssetBuildRepresentation>;
+```
+
+Resolve an asset-build root through the same current Surface authority.
+
+###### Parameters
+
+| Parameter     | Type                          |
+| ------------- | ----------------------------- |
+| `stableRoute` | [`StableRoute`](#stableroute) |
+
+###### Returns
+
+`Promise`\<[`PublicAssetBuildRepresentation`](#publicassetbuildrepresentation)\>
+
+##### resolvePublicAssetBuildVersion()
+
+```ts
+resolvePublicAssetBuildVersion(stableRoute, releaseId): Promise<PublicAssetBuildRepresentation>;
+```
+
+Resolve a pinned asset-build root through Surface authority.
+
+###### Parameters
+
+| Parameter     | Type                          |
+| ------------- | ----------------------------- |
+| `stableRoute` | [`StableRoute`](#stableroute) |
+| `releaseId`   | [`ReleaseId`](#releaseid)     |
+
+###### Returns
+
+`Promise`\<[`PublicAssetBuildRepresentation`](#publicassetbuildrepresentation)\>
+
+##### resolvePublicWebsite()
+
+```ts
+resolvePublicWebsite(stableRoute): Promise<Readonly<{
+  releaseId: ReleaseId;
+  digest: Sha256Digest;
+  mediaType: "text/html; charset=utf-8";
+  byteLength: number;
+  bytes: ImmutableArtifactBytes;
+}>>;
+```
+
+Resolve the current eligible immutable website representation.
+
+###### Parameters
+
+| Parameter     | Type                          |
+| ------------- | ----------------------------- |
+| `stableRoute` | [`StableRoute`](#stableroute) |
+
+###### Returns
+
+`Promise`\<`Readonly`\<\{ `releaseId`: [`ReleaseId`](#releaseid); `digest`:
+[`Sha256Digest`](#sha256digest); `mediaType`: `"text/html; charset=utf-8"`;
+`byteLength`: `number`; `bytes`:
+[`ImmutableArtifactBytes`](#immutableartifactbytes); \}\>\>
+
+##### resolvePublicWebsiteVersion()
+
+```ts
+resolvePublicWebsiteVersion(stableRoute, releaseId): Promise<Readonly<{
+  releaseId: ReleaseId;
+  digest: Sha256Digest;
+  mediaType: "text/html; charset=utf-8";
+  byteLength: number;
+  bytes: ImmutableArtifactBytes;
+}>>;
+```
+
+Resolve a pinned eligible immutable website representation.
+
+###### Parameters
+
+| Parameter     | Type                          |
+| ------------- | ----------------------------- |
+| `stableRoute` | [`StableRoute`](#stableroute) |
+| `releaseId`   | [`ReleaseId`](#releaseid)     |
+
+###### Returns
+
+`Promise`\<`Readonly`\<\{ `releaseId`: [`ReleaseId`](#releaseid); `digest`:
+[`Sha256Digest`](#sha256digest); `mediaType`: `"text/html; charset=utf-8"`;
+`byteLength`: `number`; `bytes`:
+[`ImmutableArtifactBytes`](#immutableartifactbytes); \}\>\>
+
+---
+
+### AppReleaseParserName
+
+```ts
+type AppReleaseParserName =
+  | "AppId"
+  | "ReleaseId"
+  | "PublicSurfaceId"
+  | "ArtifactRef"
+  | "IdempotencyKey"
+  | "SourceRevision"
+  | "Sha256Digest"
+  | "StableRoute"
+  | "AppTransitionId";
+```
+
+Names the parser boundary that rejected an untrusted value.
+
+---
+
+### AppReleaseCommandName
+
+```ts
+type AppReleaseCommandName =
+  | "createApp"
+  | "createRelease"
+  | "verifyReleaseArtifact"
+  | "resolveEligibleReleaseArtifact"
+  | "resolveEligibleAppMetadata"
+  | "resolvePublicSurfaceAuthority"
+  | "resolvePublicSurfaceAuthorityVersion"
+  | "createPublicSurface"
+  | "transition";
+```
+
+Names a public catalog command whose hostile input was rejected.
+
+## Variables
+
+### appRoles
+
+```ts
+const appRoles: readonly [
+  "dashboard",
+  "inbox",
+  "files",
+  "media",
+  "sessions",
+  "terminal",
+];
+```
+
+Roles a user may assign to an App: the shell routes "open my inbox", file
+navigation, media and Session conversations to the App the Team chose.
+`dashboard` marks an App that can open as a Team's dashboard; the Team's shell
+selection, not a role choice, picks among them. Extend this list here; the Hub
+role projection then requires the new role. A role's intent and payload wire
+format lives in `@fungi.computer/agar/roles`.
+
+---
+
+### appCapabilityIds
+
+```ts
+const appCapabilityIds: readonly [
+  "agent.list",
+  "agent.manage",
+  "agent.rename",
+  "agent.toolPolicy",
+  "agent.read",
+  "agent.send",
+  "computer.list",
+  "computer.readFile",
+  "computer.writeFile",
+  "computer.execute",
+  "llm.generation",
+  "media.generation",
+  "games:servers",
+  "git.repository",
+  "apps.open",
+  "apps.call",
+  "app.storage",
+  "app.events.emit",
+  "team.workbenchHost",
+  "marketplace.browse",
+  "marketplace.purchase",
+  "workflow.run",
+  "workflow.publish",
+  "workflow.arm",
+  "world",
+  "channels.read",
+  "channels.personal.manage",
+];
+```
+
+Host capabilities an App may request. A request is never authority; the Team's
+installation grants decide. Extend this list here.
+
+---
+
+### appHandlers
+
+```ts
+const appHandlers: readonly ["file.open"];
+```
+
+Navigation requests an App can handle for the shell.
+
+---
+
+### appStorageScopes
+
+```ts
+const appStorageScopes: readonly ["team", "member"];
+```
+
+A declared layer of the App's own JSON data; never a cross-Team scope.
+
+---
+
+### emptyAppDeclaration
+
+```ts
+const emptyAppDeclaration: AppDeclaration;
+```
+
+The declaration of an App that asks for nothing.
+
+---
+
+### parseAppId
+
+```ts
+const parseAppId: (input) => AppId;
+```
+
+Parse an opaque Global App identifier.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`AppId`](#appid)
+
+---
+
+### parseAppTransitionId
+
+```ts
+const parseAppTransitionId: (input) => AppTransitionId;
+```
+
+Parse a Cairn-issued App transition identity.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`AppTransitionId`](#apptransitionid)
+
+---
+
+### parseReleaseId
+
+```ts
+const parseReleaseId: (input) => ReleaseId;
+```
+
+Parse an opaque immutable Release identifier.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`ReleaseId`](#releaseid)
+
+---
+
+### parsePublicSurfaceId
+
+```ts
+const parsePublicSurfaceId: (input) => PublicSurfaceId;
+```
+
+Parse an opaque anonymous public-Surface identifier.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`PublicSurfaceId`](#publicsurfaceid)
+
+---
+
+### parseArtifactRef
+
+```ts
+const parseArtifactRef: (input) => ArtifactRef;
+```
+
+Parse an opaque bounded artifact reference.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`ArtifactRef`](#artifactref)
+
+---
+
+### parseIdempotencyKey
+
+```ts
+const parseIdempotencyKey: (input) => IdempotencyKey;
+```
+
+Parse a caller-provided idempotency key.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`IdempotencyKey`](#idempotencykey)
+
+---
+
+### parseSourceRevision
+
+```ts
+const parseSourceRevision: (input) => SourceRevision;
+```
+
+Parse a pinned lowercase Git source revision.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`SourceRevision`](#sourcerevision)
+
+---
+
+### parseSha256Digest
+
+```ts
+const parseSha256Digest: (input) => Sha256Digest;
+```
+
+Parse a lowercase SHA-256 digest.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`Sha256Digest`](#sha256digest)
+
+---
+
+### parseStableRoute
+
+```ts
+const parseStableRoute: (input) => StableRoute;
+```
+
+Parse a canonical local origin-relative stable route.
+
+#### Parameters
+
+| Parameter | Type      |
+| --------- | --------- |
+| `input`   | `unknown` |
+
+#### Returns
+
+[`StableRoute`](#stableroute)
+
+## Functions
+
+### isEmptyAppDeclaration()
+
+```ts
+function isEmptyAppDeclaration(declaration): boolean;
+```
+
+An empty declaration is omitted from the manifest to keep digests stable.
+
+#### Parameters
+
+| Parameter     | Type                                |
+| ------------- | ----------------------------------- |
+| `declaration` | [`AppDeclaration`](#appdeclaration) |
+
+#### Returns
+
+`boolean`
+
+---
+
+### issuePublicSurfaceId()
+
+```ts
+function issuePublicSurfaceId(): PublicSurfaceId;
+```
+
+Publisher issues customer Surface identities through Cairn, never from slugs.
+
+#### Returns
+
+[`PublicSurfaceId`](#publicsurfaceid)
+
+---
+
+### createAppReleaseCatalog()
+
+```ts
+function createAppReleaseCatalog(options): AppReleaseCatalog;
+```
+
+Create the App Release catalog.
+
+The default Promise facade adapts each foreign port once before calling the same
+Effect-native core.
+
+#### Parameters
+
+| Parameter | Type                                                    |
+| --------- | ------------------------------------------------------- |
+| `options` | [`AppReleaseCatalogOptions`](#appreleasecatalogoptions) |
+
+#### Returns
+
+[`AppReleaseCatalog`](#appreleasecatalog)
+
+## References
+
+### AppBackendBinding
+
+Re-exports
+[AppBackendBinding](app-backend-binding-vocabulary.md#appbackendbinding)