@fungi.computer/puffball 0.0.0-stage → 0.0.1

package/dist/app.js

@@ -0,0 +1,71 @@
+export { appMethodCallContextSchema, } from "./app-method-context.js";
+export { appBackendBindingKinds, appBackendBindingOperation, scopeOperationToMethod, appBackendBindingsSchema, appBackendShardBindingsSchema, } from "./app-backend-bindings.js";
+import * as Schema from "effect/Schema";
+export { appApiSchema, appApiReservedMethodNames, appApiMethodNameSchema, } from "./app-api.js";
+import { appDeclarationSchema } from "./app-declaration.js";
+import { isEmptyAppDeclaration, } from "./app-vocabulary.js";
+import { artifactRefSchema, sha256DigestSchema, } from "./internal/app-release-schema.js";
+/** One immutable Release root binds every surface published by the App. */
+export const appMediaType = "application/vnd.fungi.app+json";
+const objectReference = {
+    artifactRef: artifactRefSchema,
+    digest: sha256DigestSchema,
+    version: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+    byteLength: Schema.Number.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThan(0)), Schema.check(Schema.makeFilter(Number.isSafeInteger))),
+};
+const appUiBuildSchema = Schema.Struct({
+    ...objectReference,
+    mediaType: Schema.Literals([
+        "text/html; charset=utf-8",
+        "application/vnd.fungi.app-assets+json",
+    ]),
+});
+const appBackendBuildSchema = Schema.Struct({
+    ...objectReference,
+    mediaType: Schema.Literal("application/vnd.fungi.app-backend+json"),
+});
+/** Omitted when the App requests nothing, so older roots stay valid. */
+const declaration = {
+    declaration: Schema.optionalKey(appDeclarationSchema),
+};
+/**
+ * Closed child formats prevent recursive manifests and independent selection.
+ * An App may be visual, headless, or both, but never empty.
+ */
+export const appBuildSchema = Schema.Union([
+    Schema.Struct({
+        format: Schema.Literal("fungi-app-v1"),
+        ui: appUiBuildSchema,
+        backend: appBackendBuildSchema,
+        ...declaration,
+    }),
+    Schema.Struct({
+        format: Schema.Literal("fungi-app-v1"),
+        ui: appUiBuildSchema,
+        ...declaration,
+    }),
+    Schema.Struct({
+        format: Schema.Literal("fungi-app-v1"),
+        backend: appBackendBuildSchema,
+        ...declaration,
+    }),
+]).pipe(Schema.check(Schema.makeFilter((app) => app.declaration?.api === undefined || "backend" in app, { message: "An App API requires a backend" })));
+/** Maintained codec shared by artifact producers and consumers. */
+export const appBuildJsonSchema = Schema.fromJsonString(appBuildSchema);
+/** Construct one non-empty App root without leaking union mechanics to adapters. */
+export function createAppBuild(ui, backend, appDeclaration) {
+    const declared = appDeclaration === undefined || isEmptyAppDeclaration(appDeclaration)
+        ? {}
+        : { declaration: appDeclaration };
+    if (ui === null) {
+        if (backend === null)
+            throw new Error("App build has no UI or backend");
+        return { format: "fungi-app-v1", backend, ...declared };
+    }
+    return backend === null
+        ? { format: "fungi-app-v1", ui, ...declared }
+        : { format: "fungi-app-v1", ui, backend, ...declared };
+}
+export { appCapabilityIdSchema, appDeclarationSchema, appDeclaredCommandSchema, appHandlerSchema, appRoleSchema, appStorageKeySchema, appStorageKeyNameSchema, } from "./app-declaration.js";
+export { appCapabilityIds, appHandlers, appRoles, appStorageScopes, emptyAppDeclaration, isEmptyAppDeclaration, resolveAppRoles, } from "./app-vocabulary.js";
+export { appCallsSchema } from "./app-declaration.js";

package/dist/artifact-dispositions.d.ts

@@ -0,0 +1,115 @@
+import * as Schema from "effect/Schema";
+import type { AppReleaseD1Database } from "./cloudflare.js";
+declare const actionSchema: Schema.Struct<{
+    readonly dispositionId: Schema.String;
+    readonly requestId: Schema.String;
+    readonly operatorId: Schema.String;
+    readonly reason: Schema.String;
+    readonly action: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"retain-detached">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"revoke-with-notice">;
+    }>]>;
+}>;
+export type ArtifactDispositionAction = Schema.Schema.Type<typeof actionSchema>;
+/** The disposition owner supplies the target and reason; Hub adds no caller-asserted recipients. */
+export declare const artifactDispositionNoticeSchema: Schema.Struct<{
+    readonly dispositionId: Schema.String;
+    readonly appId: Schema.refine<import("./index.js").AppId, Schema.String>;
+    readonly displayName: Schema.String;
+    readonly releaseIds: Schema.$Array<Schema.refine<import("./index.js").ReleaseId, Schema.String>>;
+    readonly reason: Schema.String;
+}>;
+export type ArtifactDispositionNotice = Schema.Schema.Type<typeof artifactDispositionNoticeSchema>;
+export declare const artifactDispositionReadbackSchema: Schema.Struct<{
+    readonly releaseIds: Schema.$Array<Schema.refine<import("./index.js").ReleaseId, Schema.String>>;
+    readonly disposition_id: Schema.String;
+    readonly app_id: Schema.refine<import("./index.js").AppId, Schema.String>;
+    readonly release_ids_json: Schema.String;
+    readonly artifact_roots_json: Schema.String;
+    readonly created_at: Schema.Number;
+    readonly state: Schema.Literals<readonly ["pending", "retaining", "retained", "revoking", "revoked"]>;
+    readonly request_id: Schema.NullOr<Schema.String>;
+    readonly reason: Schema.NullOr<Schema.String>;
+    readonly completed_at: Schema.NullOr<Schema.Number>;
+}>;
+/** Buyer artifact custody is independent of erased seller identity. Operators bind disposition to one request; captured buyer Teams require durable inbox receipts. */
+export declare function createD1ArtifactDispositions(database: AppReleaseD1Database, now?: () => number): {
+    read: (dispositionId: string) => Promise<{
+        releaseIds: readonly import("./index.js").ReleaseId[];
+        disposition_id: string;
+        app_id: import("./index.js").AppId;
+        release_ids_json: string;
+        artifact_roots_json: string;
+        created_at: number;
+        state: "pending" | "revoked" | "retaining" | "retained" | "revoking";
+        request_id: string | null;
+        reason: string | null;
+        completed_at: number | null;
+    } | null>;
+    prepare: (raw: ArtifactDispositionAction) => Promise<{
+        kind: "conflict";
+        disposition?: never;
+    } | {
+        kind: "recorded";
+        disposition: {
+            releaseIds: readonly import("./index.js").ReleaseId[];
+            disposition_id: string;
+            app_id: import("./index.js").AppId;
+            release_ids_json: string;
+            artifact_roots_json: string;
+            created_at: number;
+            state: "pending" | "revoked" | "retaining" | "retained" | "revoking";
+            request_id: string | null;
+            reason: string | null;
+            completed_at: number | null;
+        };
+    } | {
+        kind: "unavailable";
+        disposition?: never;
+    }>;
+    complete: (dispositionId: string, operatorId: string) => Promise<{
+        kind: "recorded";
+        disposition: {
+            releaseIds: readonly import("./index.js").ReleaseId[];
+            disposition_id: string;
+            app_id: import("./index.js").AppId;
+            release_ids_json: string;
+            artifact_roots_json: string;
+            created_at: number;
+            state: "pending" | "revoked" | "retaining" | "retained" | "revoking";
+            request_id: string | null;
+            reason: string | null;
+            completed_at: number | null;
+        };
+    } | {
+        kind: "conflict";
+        disposition?: never;
+    }>;
+    pending: (after?: string) => Promise<({
+        releaseIds: readonly import("./index.js").ReleaseId[];
+        disposition_id: string;
+        app_id: import("./index.js").AppId;
+        release_ids_json: string;
+        artifact_roots_json: string;
+        created_at: number;
+        state: "pending" | "revoked" | "retaining" | "retained" | "revoking";
+        request_id: string | null;
+        reason: string | null;
+        completed_at: number | null;
+    } | null)[]>;
+    noticeRecipients: (dispositionId: string, after?: string) => Promise<{
+        readonly teamId: string | null;
+        readonly receipt: string | null;
+        readonly erasedBy: string | null;
+        readonly erasedAt: number | null;
+    }[]>;
+    recordNoticeReceipt: (dispositionId: string, teamId: string, receipt: string) => Promise<boolean>;
+    recordNoticeRecipientErased: (dispositionId: string, teamId: string, operatorId: string) => Promise<boolean>;
+    pendingWork: (dispositionId: string) => Promise<{
+        teamIds: string[];
+        releaseIds: import("./index.js").ReleaseId[];
+    }>;
+};
+export declare const artifactDispositionSchemaSql: string;
+export {};

package/dist/artifact-dispositions.js

@@ -0,0 +1,234 @@
+import * as Schema from "effect/Schema";
+import { appIdSchema, artifactRefSchema, releaseIdSchema, } from "./internal/app-release-schema.js";
+import { reportFailure } from "./internal/failure.js";
+const identity = Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(256)));
+const reason = Schema.String.pipe(Schema.check(Schema.isPattern(/\S/u)), Schema.check(Schema.isMaxLength(1000)));
+const actionSchema = Schema.Struct({
+    dispositionId: identity,
+    requestId: identity,
+    operatorId: identity,
+    reason,
+    action: Schema.Union([
+        Schema.Struct({ kind: Schema.Literal("retain-detached") }),
+        Schema.Struct({ kind: Schema.Literal("revoke-with-notice") }),
+    ]),
+});
+/** The disposition owner supplies the target and reason; Hub adds no caller-asserted recipients. */
+export const artifactDispositionNoticeSchema = Schema.Struct({
+    dispositionId: identity,
+    appId: appIdSchema,
+    displayName: Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(64))),
+    releaseIds: Schema.Array(releaseIdSchema).pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isMaxLength(10000))),
+    reason,
+});
+const rowSchema = Schema.Struct({
+    disposition_id: identity,
+    app_id: appIdSchema,
+    release_ids_json: Schema.String,
+    artifact_roots_json: Schema.String,
+    created_at: Schema.Number,
+    state: Schema.Literals([
+        "pending",
+        "retaining",
+        "retained",
+        "revoking",
+        "revoked",
+    ]),
+    request_id: Schema.NullOr(identity),
+    reason: Schema.NullOr(reason),
+    completed_at: Schema.NullOr(Schema.Number),
+});
+export const artifactDispositionReadbackSchema = Schema.Struct({
+    ...rowSchema.fields,
+    releaseIds: Schema.Array(releaseIdSchema).pipe(Schema.check(Schema.isMaxLength(10000))),
+});
+const releasesSchema = Schema.fromJsonString(Schema.Array(releaseIdSchema).pipe(Schema.check(Schema.isMaxLength(10000))));
+const artifactsSchema = Schema.fromJsonString(Schema.Array(artifactRefSchema).pipe(Schema.check(Schema.isMaxLength(10000))));
+/** Buyer artifact custody is independent of erased seller identity. Operators bind disposition to one request; captured buyer Teams require durable inbox receipts. */
+export function createD1ArtifactDispositions(database, now = Date.now) {
+    const read = async (dispositionId) => {
+        const row = await database
+            .prepare("SELECT * FROM app_release_artifact_dispositions WHERE disposition_id=?")
+            .bind(dispositionId)
+            .first();
+        if (row === null)
+            return null;
+        const decoded = Schema.decodeUnknownSync(rowSchema)(row);
+        Schema.decodeUnknownSync(artifactsSchema)(decoded.artifact_roots_json);
+        return {
+            ...decoded,
+            releaseIds: Schema.decodeUnknownSync(releasesSchema)(decoded.release_ids_json),
+        };
+    };
+    const prepare = async (raw) => {
+        try {
+            const input = Schema.decodeUnknownSync(actionSchema, {
+                onExcessProperty: "error",
+            })(raw);
+            const state = input.action.kind === "retain-detached" ? "retaining" : "revoking";
+            const results = await database.batch([
+                database
+                    .prepare(`UPDATE app_release_artifact_dispositions SET state=?,request_id=?,reason=?
+          WHERE disposition_id=? AND state='pending'`)
+                    .bind(state, input.requestId, input.reason, input.dispositionId),
+                database
+                    .prepare(`INSERT INTO app_release_artifact_disposition_steps(disposition_id,phase,operator_id,recorded_at)
+          SELECT ?,'prepared',?,? WHERE EXISTS (SELECT 1 FROM app_release_artifact_dispositions
+            WHERE disposition_id=? AND state IN (?,?) AND request_id=? AND reason=?)
+          ON CONFLICT DO NOTHING`)
+                    .bind(input.dispositionId, input.operatorId, now(), input.dispositionId, state, state === "retaining" ? "retained" : "revoked", input.requestId, input.reason),
+            ]);
+            if (results.some((result) => !result.success))
+                throw new Error("Artifact disposition unavailable");
+            const saved = await read(input.dispositionId);
+            if (saved?.request_id !== input.requestId ||
+                saved.reason !== input.reason ||
+                ![state, state === "retaining" ? "retained" : "revoked"].includes(saved.state))
+                return { kind: "conflict" };
+            return { kind: "recorded", disposition: saved };
+        }
+        catch (cause) {
+            reportFailure("artifact disposition preparation", cause);
+            return { kind: "unavailable" };
+        }
+    };
+    const complete = async (dispositionId, operatorId) => {
+        for (const value of [dispositionId, operatorId])
+            Schema.decodeUnknownSync(identity)(value);
+        const results = await database.batch([
+            database
+                .prepare(`INSERT INTO app_release_artifact_disposition_steps(disposition_id,phase,operator_id,recorded_at)
+        SELECT ?,'completed',?,? WHERE EXISTS (SELECT 1 FROM app_release_artifact_dispositions d WHERE d.disposition_id=? AND
+          (d.state IN ('retaining','retained','revoked') OR (d.state='revoking' AND NOT EXISTS (
+            SELECT 1 FROM app_release_artifact_notice_recipients n WHERE n.disposition_id=d.disposition_id AND n.receipt IS NULL AND n.erased_at IS NULL) AND NOT EXISTS (
+            SELECT 1 FROM json_each(d.release_ids_json) r WHERE NOT EXISTS (
+              SELECT 1 FROM app_release_transitions t JOIN app_release_transition_obligations o ON o.sequence=t.sequence
+              WHERE t.release_id=r.value AND t.operation_kind='revocation' AND o.state='acknowledged')))))
+        ON CONFLICT DO NOTHING`)
+                .bind(dispositionId, operatorId, now(), dispositionId),
+            database
+                .prepare(`UPDATE app_release_artifact_dispositions SET state=CASE state WHEN 'retaining' THEN 'retained' ELSE 'revoked' END,completed_at=?
+        WHERE disposition_id=? AND state IN ('retaining','revoking') AND EXISTS (
+          SELECT 1 FROM app_release_artifact_disposition_steps WHERE disposition_id=? AND phase='completed')`)
+                .bind(now(), dispositionId, dispositionId),
+        ]);
+        if (results.some((result) => !result.success))
+            throw new Error("Artifact disposition unavailable");
+        const saved = await read(dispositionId);
+        return saved !== null &&
+            (saved.state === "retained" || saved.state === "revoked")
+            ? { kind: "recorded", disposition: saved }
+            : { kind: "conflict" };
+    };
+    const pending = async (after = "") => {
+        const rows = await database
+            .prepare(`SELECT disposition_id FROM app_release_artifact_dispositions
+      WHERE state IN ('pending','retaining','revoking') AND disposition_id>? ORDER BY disposition_id LIMIT 100`)
+            .bind(after)
+            .all();
+        const ids = rows.results.map((row) => Schema.decodeUnknownSync(Schema.Struct({ disposition_id: identity }))(row).disposition_id);
+        return Promise.all(ids.map(read));
+    };
+    const noticeRow = Schema.Struct({
+        teamId: Schema.NullOr(identity),
+        receipt: Schema.NullOr(identity),
+        erasedBy: Schema.NullOr(identity),
+        erasedAt: Schema.NullOr(Schema.Number),
+    });
+    const noticeRecipients = async (dispositionId, after = "") => {
+        const rows = await database
+            .prepare(`SELECT buyer_team_id AS teamId,receipt,erased_by AS erasedBy,erased_at AS erasedAt FROM app_release_artifact_notice_recipients
+      WHERE disposition_id=? AND (buyer_team_id>? OR buyer_team_id IS NULL) ORDER BY buyer_team_id,recipient_id LIMIT 100`)
+            .bind(dispositionId, after)
+            .all();
+        return rows.results.map((row) => Schema.decodeUnknownSync(noticeRow)(row));
+    };
+    /** Only the trusted Hub delivery coordinator calls this after the Team inbox owner commits its receipt. */
+    const recordNoticeReceipt = async (dispositionId, teamId, receipt) => {
+        for (const value of [dispositionId, teamId, receipt])
+            Schema.decodeUnknownSync(identity)(value);
+        await database
+            .prepare(`UPDATE app_release_artifact_notice_recipients SET receipt=?
+      WHERE disposition_id=? AND buyer_team_id=? AND receipt IS NULL AND erased_at IS NULL AND EXISTS (
+        SELECT 1 FROM app_release_artifact_dispositions d WHERE d.disposition_id=? AND d.state='revoking')`)
+            .bind(receipt, dispositionId, teamId, dispositionId)
+            .run();
+        const row = await database
+            .prepare(`SELECT receipt FROM app_release_artifact_notice_recipients
+      WHERE disposition_id=? AND buyer_team_id=?`)
+            .bind(dispositionId, teamId)
+            .first();
+        return (row !== null &&
+            Schema.decodeUnknownSync(Schema.Struct({ receipt: Schema.NullOr(identity) }))(row).receipt === receipt);
+    };
+    /** Trusted Hub coordinator verifies the Team owner's erasure readback before calling this. Never a delivered receipt. */
+    const recordNoticeRecipientErased = async (dispositionId, teamId, operatorId) => {
+        for (const value of [dispositionId, teamId, operatorId])
+            Schema.decodeUnknownSync(identity)(value);
+        await database
+            .prepare(`UPDATE app_release_artifact_notice_recipients SET erased_by=?,erased_at=?
+      WHERE disposition_id=? AND buyer_team_id=? AND receipt IS NULL AND erased_at IS NULL AND EXISTS (
+        SELECT 1 FROM app_release_artifact_dispositions d WHERE d.disposition_id=? AND d.state='revoking')`)
+            .bind(operatorId, now(), dispositionId, teamId, dispositionId)
+            .run();
+        const row = await database
+            .prepare(`SELECT erased_at FROM app_release_artifact_notice_recipients
+      WHERE disposition_id=? AND buyer_team_id=?`)
+            .bind(dispositionId, teamId)
+            .first();
+        return (row !== null &&
+            Schema.decodeUnknownSync(Schema.Struct({ erased_at: Schema.NullOr(Schema.Number) }))(row).erased_at !== null);
+    };
+    const pendingWork = async (dispositionId) => {
+        const notices = await database
+            .prepare(`SELECT buyer_team_id AS teamId FROM app_release_artifact_notice_recipients
+      WHERE disposition_id=? AND receipt IS NULL AND erased_at IS NULL ORDER BY buyer_team_id LIMIT 100`)
+            .bind(dispositionId)
+            .all();
+        const releases = await database
+            .prepare(`SELECT r.value AS releaseId FROM app_release_artifact_dispositions d,json_each(d.release_ids_json) r
+      WHERE d.disposition_id=? AND d.state='revoking' AND NOT EXISTS (
+        SELECT 1 FROM app_release_transitions t JOIN app_release_transition_obligations o ON o.sequence=t.sequence
+        WHERE t.release_id=r.value AND t.operation_kind='revocation' AND o.state='acknowledged')
+      ORDER BY r.value LIMIT 100`)
+            .bind(dispositionId)
+            .all();
+        return {
+            teamIds: notices.results.map((row) => Schema.decodeUnknownSync(Schema.Struct({ teamId: identity }))(row)
+                .teamId),
+            releaseIds: releases.results.map((row) => Schema.decodeUnknownSync(Schema.Struct({ releaseId: releaseIdSchema }))(row).releaseId),
+        };
+    };
+    return {
+        read,
+        prepare,
+        complete,
+        pending,
+        noticeRecipients,
+        recordNoticeReceipt,
+        recordNoticeRecipientErased,
+        pendingWork,
+    };
+}
+export const artifactDispositionSchemaSql = [
+    `CREATE TABLE app_release_artifact_dispositions(disposition_id TEXT PRIMARY KEY, app_id TEXT NOT NULL UNIQUE REFERENCES app_release_apps(app_id),
+    release_ids_json TEXT NOT NULL CHECK(json_valid(release_ids_json)), artifact_roots_json TEXT NOT NULL CHECK(json_valid(artifact_roots_json)),
+    created_at INTEGER NOT NULL,state TEXT NOT NULL CHECK(state IN ('pending','retaining','retained','revoking','revoked')),
+    request_id TEXT,reason TEXT,completed_at INTEGER,
+    CHECK((state='pending' AND request_id IS NULL AND reason IS NULL) OR (state<>'pending' AND request_id IS NOT NULL AND length(request_id) BETWEEN 1 AND 256 AND reason IS NOT NULL AND length(trim(reason)) BETWEEN 1 AND 1000)),
+    CHECK((state IN ('retained','revoked'))=(completed_at IS NOT NULL))) STRICT;`,
+    `CREATE TABLE app_release_artifact_notice_recipients(recipient_id INTEGER PRIMARY KEY,disposition_id TEXT NOT NULL REFERENCES app_release_artifact_dispositions(disposition_id),
+    buyer_team_id TEXT CHECK(buyer_team_id IS NULL OR length(buyer_team_id) BETWEEN 1 AND 256),receipt TEXT CHECK(receipt IS NULL OR length(receipt) BETWEEN 1 AND 256),
+    erased_by TEXT,erased_at INTEGER,
+    CHECK((erased_by IS NULL)=(erased_at IS NULL)),
+    CHECK(erased_by IS NULL OR length(erased_by) BETWEEN 1 AND 256),
+    CHECK(receipt IS NULL OR erased_at IS NULL),
+    CHECK(buyer_team_id IS NOT NULL OR erased_at IS NOT NULL),
+    UNIQUE(disposition_id,buyer_team_id)) STRICT;`,
+    `CREATE INDEX app_release_artifact_dispositions_pending ON app_release_artifact_dispositions(state,disposition_id);`,
+    `CREATE TABLE app_release_artifact_disposition_steps(step_id INTEGER PRIMARY KEY,disposition_id TEXT NOT NULL REFERENCES app_release_artifact_dispositions(disposition_id),
+    phase TEXT NOT NULL CHECK(phase IN ('prepared','completed')),operator_id TEXT NOT NULL,recorded_at INTEGER NOT NULL) STRICT;`,
+    `CREATE INDEX app_release_artifact_disposition_steps_by_action ON app_release_artifact_disposition_steps(disposition_id,phase);`,
+]
+    .map((statement) => statement.replaceAll("\n", " "))
+    .join("\n");

package/dist/assets.d.ts

@@ -0,0 +1,54 @@
+import * as Schema from "effect/Schema";
+import type { ReleaseId, StableRoute } from "./internal/app-release-contract.js";
+/** Explicit root representation; existing HTML and backend artifacts remain distinct. */
+export declare const assetBuildMediaType: "application/vnd.fungi.app-assets+json";
+/** Trusted host policy, independently bounded from single-document HTML. */
+export declare const assetBuildPolicySchema: Schema.Struct<{
+    readonly maxManifestBytes: Schema.Number;
+    readonly maxObjects: Schema.Number;
+    readonly maxObjectBytes: Schema.Number;
+    readonly maxTotalBytes: Schema.Number;
+}>;
+export type AssetBuildPolicy = Schema.Schema.Type<typeof assetBuildPolicySchema>;
+/** Captured Vite base: a canonical pathname, or a relative private host mount. */
+export declare const assetBaseSchema: Schema.String;
+/** StableRoute already owns the canonical single-slug grammar. */
+export declare function publicAssetBase(stableRoute: StableRoute, releaseId: ReleaseId): string;
+/** Vite output names are relative POSIX paths, never request URLs or storage keys. */
+export declare const assetPathSchema: Schema.String;
+export declare const assetBuildSchema: Schema.Struct<{
+    readonly format: Schema.Literal<"fungi-assets-v1">;
+    readonly base: Schema.String;
+    readonly assets: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.String;
+        readonly artifactRef: Schema.refine<import("./internal/app-release-contract.js").ArtifactRef, Schema.String>;
+        readonly digest: Schema.refine<import("./internal/app-release-contract.js").Sha256Digest, Schema.String>;
+        readonly version: Schema.String;
+        readonly byteLength: Schema.Number;
+        readonly contentType: Schema.String;
+    }>>;
+}>;
+export declare const assetBuildJsonSchema: Schema.fromJsonString<Schema.Struct<{
+    readonly format: Schema.Literal<"fungi-assets-v1">;
+    readonly base: Schema.String;
+    readonly assets: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.String;
+        readonly artifactRef: Schema.refine<import("./internal/app-release-contract.js").ArtifactRef, Schema.String>;
+        readonly digest: Schema.refine<import("./internal/app-release-contract.js").Sha256Digest, Schema.String>;
+        readonly version: Schema.String;
+        readonly byteLength: Schema.Number;
+        readonly contentType: Schema.String;
+    }>>;
+}>>;
+export type AssetBuild = Schema.Schema.Type<typeof assetBuildSchema>;
+export type BuildAsset = AssetBuild["assets"][number];
+/**
+ * A shell App's module: an ES module exporting `mountShell`, shipped beside
+ * `index.html`. A host composes the shell its Team picked by importing it
+ * from the host's own origin into the top-level page.
+ */
+export declare const shellModuleAssetPath = "/shell.js";
+/** The shell module this asset build ships, if it ships one. */
+export declare function shellModuleAsset(build: AssetBuild): BuildAsset | undefined;
+/** Decode the digest-covered root and enforce bounds before touching its objects. */
+export declare function decodeAssetBuild(bytes: Uint8Array, policy: AssetBuildPolicy): AssetBuild;

package/dist/assets.js

@@ -0,0 +1,89 @@
+import { appOriginPaths } from "./app-origin-paths.js";
+import * as Schema from "effect/Schema";
+import { artifactRefSchema, sha256DigestSchema, } from "./internal/app-release-schema.js";
+/** Explicit root representation; existing HTML and backend artifacts remain distinct. */
+export const assetBuildMediaType = "application/vnd.fungi.app-assets+json";
+const positiveInteger = Schema.Number.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThan(0)), Schema.check(Schema.makeFilter(Number.isSafeInteger)));
+/** Trusted host policy, independently bounded from single-document HTML. */
+export const assetBuildPolicySchema = Schema.Struct({
+    maxManifestBytes: positiveInteger,
+    maxObjects: positiveInteger,
+    maxObjectBytes: positiveInteger,
+    maxTotalBytes: positiveInteger,
+});
+/** Captured Vite base: a canonical pathname, or a relative private host mount. */
+export const assetBaseSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => {
+    if (value == "./")
+        return true;
+    const origin = "https://assets.invalid";
+    if (!URL.canParse(value, origin))
+        return false;
+    const url = new URL(value, origin);
+    return (value.startsWith("/") &&
+        value.endsWith("/") &&
+        url.origin === origin &&
+        url.pathname === value &&
+        url.search === "" &&
+        url.hash === "");
+})));
+/** StableRoute already owns the canonical single-slug grammar. */
+export function publicAssetBase(stableRoute, releaseId) {
+    return `${appOriginPaths.surfaceAssets}/${stableRoute.slice(1)}/releases/${encodeURIComponent(releaseId)}/`;
+}
+/** Vite output names are relative POSIX paths, never request URLs or storage keys. */
+export const assetPathSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((path) => path.startsWith("/") &&
+    !path.includes("\\") &&
+    !/\p{Cc}/u.test(path) &&
+    path
+        .slice(1)
+        .split("/")
+        .every((part) => part !== "" && part !== "." && part !== ".."))));
+const assetSchema = Schema.Struct({
+    path: assetPathSchema,
+    artifactRef: artifactRefSchema,
+    digest: sha256DigestSchema,
+    version: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+    byteLength: Schema.Number.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0)), Schema.check(Schema.makeFilter(Number.isSafeInteger))),
+    contentType: Schema.String.pipe(Schema.check(Schema.isMinLength(1)), Schema.check(Schema.isPattern(/^[^\r\n]+$/u))),
+});
+export const assetBuildSchema = Schema.Struct({
+    format: Schema.Literal("fungi-assets-v1"),
+    base: assetBaseSchema,
+    assets: Schema.Array(assetSchema),
+});
+export const assetBuildJsonSchema = Schema.fromJsonString(assetBuildSchema);
+/**
+ * A shell App's module: an ES module exporting `mountShell`, shipped beside
+ * `index.html`. A host composes the shell its Team picked by importing it
+ * from the host's own origin into the top-level page.
+ */
+export const shellModuleAssetPath = "/shell.js";
+/** The shell module this asset build ships, if it ships one. */
+export function shellModuleAsset(build) {
+    return build.assets.find((asset) => asset.path === shellModuleAssetPath);
+}
+/** Decode the digest-covered root and enforce bounds before touching its objects. */
+export function decodeAssetBuild(bytes, policy) {
+    const limits = Schema.decodeUnknownSync(assetBuildPolicySchema)(policy);
+    if (bytes.byteLength > limits.maxManifestBytes)
+        throw new Error("Asset manifest exceeds policy");
+    const build = Schema.decodeUnknownSync(assetBuildJsonSchema)(new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(bytes), { onExcessProperty: "error" });
+    if (build.assets.length === 0 || build.assets.length > limits.maxObjects)
+        throw new Error("Asset count exceeds policy");
+    const paths = new Set();
+    let total = 0;
+    for (const asset of build.assets) {
+        if (paths.has(asset.path))
+            throw new Error("Duplicate asset path");
+        paths.add(asset.path);
+        total += asset.byteLength;
+        if (asset.byteLength > limits.maxObjectBytes ||
+            !Number.isSafeInteger(total) ||
+            total > limits.maxTotalBytes)
+            throw new Error("Asset bytes exceed policy");
+    }
+    const index = build.assets.find((asset) => asset.path === "/index.html");
+    if (!index?.contentType.startsWith("text/html"))
+        throw new Error("Asset build requires HTML index");
+    return build;
+}

package/dist/backend.d.ts

@@ -0,0 +1,41 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import type { AppReleaseCore } from "./effect.js";
+import type { ReleaseId } from "./index.js";
+/** This immutable descriptor is stored inside the verified Release artifact. */
+export declare const durableBackendSchema: Schema.Struct<{
+    readonly runtime: Schema.Struct<{
+        readonly kind: Schema.Literal<"durable-facet">;
+        readonly stateSchema: Schema.Number;
+    }>;
+    readonly compatibilityDate: Schema.String;
+    readonly exportName: Schema.String;
+    readonly code: Schema.String;
+}>;
+export type { DurableBackend } from "./internal/app-release-contract.js";
+/** Content type separating executable backend artifacts from website HTML. */
+export declare const backendMediaType: "application/vnd.fungi.app-backend+json";
+/** Maintained JSON codec for immutable backend bytes. */
+export declare const backendJsonSchema: Schema.fromJsonString<Schema.Struct<{
+    readonly runtime: Schema.Struct<{
+        readonly kind: Schema.Literal<"durable-facet">;
+        readonly stateSchema: Schema.Number;
+    }>;
+    readonly compatibilityDate: Schema.String;
+    readonly exportName: Schema.String;
+    readonly code: Schema.String;
+}>>;
+/** Resolve through catalog eligibility and digest verification before decoding code. */
+export declare function resolveDurableBackend(catalog: Pick<AppReleaseCore, "resolveEligibleApp">, releaseId: ReleaseId): Effect.Effect<{
+    release: import("./index.js").Release;
+    digest: import("./index.js").Sha256Digest;
+    backend: Readonly<{
+        readonly runtime: Readonly<{
+            readonly kind: "durable-facet";
+            readonly stateSchema: number;
+        }>;
+        readonly compatibilityDate: string;
+        readonly exportName: string;
+        readonly code: string;
+    }>;
+}, import("./effect.js").AppReleaseCoreFailure, never>;

package/dist/backend.js

@@ -0,0 +1,29 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+/** This immutable descriptor is stored inside the verified Release artifact. */
+export const durableBackendSchema = Schema.Struct({
+    runtime: Schema.Struct({
+        kind: Schema.Literal("durable-facet"),
+        stateSchema: Schema.Number.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThan(0))),
+    }),
+    compatibilityDate: Schema.String.pipe(Schema.check(Schema.isPattern(/^\d{4}-\d{2}-\d{2}$/))),
+    exportName: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+    code: Schema.String.pipe(Schema.check(Schema.isMinLength(1))),
+});
+/** Content type separating executable backend artifacts from website HTML. */
+export const backendMediaType = "application/vnd.fungi.app-backend+json";
+/** Maintained JSON codec for immutable backend bytes. */
+export const backendJsonSchema = Schema.fromJsonString(durableBackendSchema);
+/** Resolve through catalog eligibility and digest verification before decoding code. */
+export function resolveDurableBackend(catalog, releaseId) {
+    return Effect.gen(function* () {
+        const app = yield* catalog.resolveEligibleApp(releaseId);
+        if (app.backend === null)
+            return yield* Effect.fail(new Error("Release has no durable backend"));
+        return {
+            release: app.release,
+            digest: app.backend.digest,
+            backend: app.backend.descriptor,
+        };
+    });
+}