@fungi.computer/puffball 0.0.2 → 0.2.0

package/dist/app-api.js

@@ -24,6 +24,9 @@ const method = Schema.Struct({
     pending: Schema.optional(Schema.Literal(true)),
     hidden: Schema.optional(Schema.Literal(true)),
     anonymous: Schema.optional(Schema.Literal(true)),
+    present: Schema.optional(Schema.Struct({
+        verb: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(32)),
+    })),
     effect: Schema.Literals(["read", "write", "external"]),
     requires: Schema.Array(Schema.Literals(appCapabilityIds)).pipe(Schema.check(Schema.makeFilter((values) => new Set(values).size === values.length))),
 }).check(Schema.makeFilter((value) => value.anonymous !== true ||

package/dist/app-backend-binding-vocabulary.d.ts

@@ -60,6 +60,19 @@ export declare const appBackendBindingKinds: {
     readonly APPS: {
         readonly name: "APPS";
         readonly operations: {
+            /** Register the calling installation's repository as an App from its
+             * exact main manifest. No Computer execution or installation is implied. */
+            readonly register: {
+                readonly cap: "app.register";
+                readonly requires: readonly ["git.repository"];
+                readonly effect: "write";
+            };
+            /** Read the captured installation's registered repository identity. */
+            readonly repository: {
+                readonly cap: "app.catalog.read";
+                readonly requires: readonly ["git.repository"];
+                readonly effect: "read";
+            };
             readonly build: {
                 readonly cap: "app.build";
                 readonly requires: readonly ["git.repository", "computer.execute"];
@@ -228,11 +241,6 @@ export declare const appBackendBindingKinds: {
                 readonly requires: readonly ["computer.writeFile"];
                 readonly effect: "write";
             };
-            readonly workflowGitPass: {
-                readonly cap: "app.computer.exec";
-                readonly requires: readonly ["computer.execute"];
-                readonly effect: "write";
-            };
             readonly preview: {
                 readonly cap: "app.computer.exec";
                 readonly requires: readonly ["computer.execute"];

package/dist/app-backend-binding-vocabulary.js

@@ -49,6 +49,19 @@ export const appBackendBindingKinds = {
     APPS: {
         name: "APPS",
         operations: {
+            /** Register the calling installation's repository as an App from its
+             * exact main manifest. No Computer execution or installation is implied. */
+            register: {
+                cap: "app.register",
+                requires: ["git.repository"],
+                effect: "write",
+            },
+            /** Read the captured installation's registered repository identity. */
+            repository: {
+                cap: "app.catalog.read",
+                requires: ["git.repository"],
+                effect: "read",
+            },
             build: {
                 cap: "app.build",
                 requires: ["git.repository", "computer.execute"],
@@ -217,11 +230,6 @@ export const appBackendBindingKinds = {
                 requires: ["computer.writeFile"],
                 effect: "write",
             },
-            workflowGitPass: {
-                cap: "app.computer.exec",
-                requires: ["computer.execute"],
-                effect: "write",
-            },
             preview: {
                 cap: "app.computer.exec",
                 requires: ["computer.execute"],

package/dist/app-backend-bindings.d.ts

@@ -11,7 +11,7 @@ export declare const appBackendShardBindingsSchema: Schema.$Array<Schema.Union<S
     readonly name: Schema.Literal<"BACKGROUND" | "GIT" | "EVENTS" | "APPS" | "WORKFLOWS" | "APP_STORAGE" | "MEDIA" | "COMPUTER" | "INBOX" | "AGENTS">;
     readonly operations: Schema.$Array<Schema.Union<Schema.Struct<{
         readonly name: Schema.Literal<string>;
-        readonly cap: Schema.Literal<"agent.list" | "agent.send" | "app.events.emit" | "app.background.admit" | "app.git.create" | "app.git.fork" | "app.git.read" | "app.git.write" | "app.git.exchange" | "app.build" | "app.select" | "app.catalog.read" | "app.fork" | "app.workflow.read" | "app.workflow.run" | "app.storage.read" | "app.storage.write" | "app.media.read" | "app.media.generate" | "app.computer.read" | "app.computer.write" | "app.computer.exec" | "inbox.read" | "inbox.visit">;
+        readonly cap: Schema.Literal<"agent.list" | "agent.send" | "app.events.emit" | "app.background.admit" | "app.git.create" | "app.git.fork" | "app.git.read" | "app.git.write" | "app.git.exchange" | "app.register" | "app.catalog.read" | "app.build" | "app.select" | "app.fork" | "app.workflow.read" | "app.workflow.run" | "app.storage.read" | "app.storage.write" | "app.media.read" | "app.media.generate" | "app.computer.read" | "app.computer.write" | "app.computer.exec" | "inbox.read" | "inbox.visit">;
     }>[]>>;
 }>[]>>;
 /** Look up an operation within its declared kind; unknown names have no authority. */

package/dist/app-declaration.d.ts

@@ -1,7 +1,7 @@
 import * as Schema from "effect/Schema";
 import { type AppDeclaration, type AppDeclaredCommand } from "./app-vocabulary.js";
 export declare const appRoleSchema: Schema.Literals<readonly ["dashboard", "inbox", "files", "media", "sessions", "terminal"]>;
-export declare const appCapabilityIdSchema: Schema.Literals<readonly ["agent.list", "agent.manage", "agent.rename", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>;
+export declare const appCapabilityIdSchema: Schema.Literals<readonly ["approvals", "agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>;
 export declare const appHandlerSchema: Schema.Literals<readonly ["file.open"]>;
 /**
  * One declared command: a Whistle definition's identity and projections.

package/dist/app-event-facts.d.ts

@@ -26,7 +26,7 @@ export declare const appEventFactSchema: z.ZodObject<{
     appId: z.ZodString;
     releaseId: z.ZodString;
     gitSource: z.ZodOptional<z.ZodObject<{
-        eventId: z.ZodString;
+        eventId: z.ZodLazy<z.ZodString>;
         repository: z.ZodString;
         updates: z.ZodArray<z.ZodObject<{
             ref: z.ZodString;

package/dist/app-method-runtime.d.ts

@@ -52,10 +52,10 @@ export declare const appMethodCallerSchema: z.ZodMiniObject<{
         keyId: z.ZodMiniString<string>;
     }, z.core.$strip>], "kind">;
     backgroundLane: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    backgroundOrigin: z.ZodMiniOptional<z.ZodMiniObject<{
+    backgroundOrigin: z.ZodMiniOptional<z.ZodMiniLazy<z.ZodMiniObject<{
         method: z.ZodMiniString<string>;
         seal: z.ZodMiniString<string>;
-    }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     role: z.ZodMiniOptional<z.ZodMiniEnum<{
         member: "member";
         owner: "owner";

package/dist/app-method-runtime.js

@@ -56,10 +56,10 @@ export const workflowAttestationSchema = z.object({
 });
 // Keep the single origin grammar in the lightweight caller module. The host-side
 // background-replay entry exposes this same schema without a runtime import cycle.
-const backgroundOrigin = z.strictObject({
+const backgroundOrigin = z.lazy(() => z.strictObject({
     method: z.string().check(z.refine((name) => isAppApiMethodName(name))),
     seal: z.string().check(z.regex(/^[A-Za-z0-9_-]{43}$/u)),
-});
+}));
 /** Sole grammar for the host-minted Computer pin and actor attribution. */
 export const appMethodCallerSchema = z.object({
     computerId: z.nullable(identity),

package/dist/app-vocabulary.d.ts

@@ -58,7 +58,7 @@ export declare function resolveAppRoles(choices: ReadonlyMap<AppRole, string>, c
  * Host capabilities an App may request. A request is never authority; the
  * Team's installation grants decide. Extend this list here.
  */
-export declare const appCapabilityIds: readonly ["agent.list", "agent.manage", "agent.rename", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"];
+export declare const appCapabilityIds: readonly ["approvals", "agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"];
 /** One requestable host capability id. */
 export type AppCapabilityId = (typeof appCapabilityIds)[number];
 /** Backend requests are narrower than the App capabilities a Team approves. */
@@ -78,6 +78,10 @@ export type AppApi = Readonly<{
         hidden?: true | undefined;
         /** Request anonymous read admission; declaration alone grants no authority. */
         anonymous?: true | undefined;
+        /** Finished calls read as a person-facing row projected by the App's hidden `present` method. */
+        present?: Readonly<{
+            verb: string;
+        }> | undefined;
     }>>>;
     /** A signed dynamic tool namespace; its methods remain subject to ordinary admission. */
     toolFamily?: Readonly<{

package/dist/app-vocabulary.js

@@ -49,9 +49,11 @@ export function resolveAppRoles(choices, candidates) {
  * Team's installation grants decide. Extend this list here.
  */
 export const appCapabilityIds = [
+    "approvals",
     "agent.list",
     "agent.manage",
     "agent.rename",
+    "agent.avatar",
     "agent.toolPolicy",
     "agent.read",
     "agent.send",

package/dist/background-replay.d.ts

@@ -4,19 +4,19 @@ import { type HostActor, type AppMethodCallContext } from "./app-method-runtime.
 import type { AppApi } from "./app-vocabulary.js";
 export { backgroundSyncAllowed } from "./internal/background-sync.js";
 /** The caller's single lightweight grammar for a host-sealed enqueue origin. */
-export declare const backgroundOriginSchema: import("zod/mini").ZodMiniObject<{
+export declare const backgroundOriginSchema: import("zod/mini").ZodMiniLazy<import("zod/mini").ZodMiniObject<{
     method: import("zod/mini").ZodMiniString<string>;
     seal: import("zod/mini").ZodMiniString<string>;
-}, z.core.$strict>;
+}, z.core.$strict>>;
 /** Origin evidence, never a retained grant or credential. */
 export type BackgroundOrigin = z.output<typeof backgroundOriginSchema>;
 /** The closed result of checking a claimed job's origin in a fresh replay frame. */
-export declare const claimedJobAdmissionSchema: z.ZodUnion<readonly [z.ZodObject<{
+export declare const claimedJobAdmissionSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodObject<{
     kind: z.ZodLiteral<"admitted">;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"refused">;
     code: z.ZodLiteral<"access_changed">;
-}, z.core.$strict>]>;
+}, z.core.$strict>]>>;
 /** A claim either passes origin admission or refuses before binding effects. */
 export type ClaimedJobAdmission = z.output<typeof claimedJobAdmissionSchema>;
 /** Host-minted replay port; an App cannot declare this binding. */
@@ -50,7 +50,7 @@ export declare function backgroundContext(context: AppMethodCallContext, ancestr
 /** App-side eligibility reads only the host-attested context; it never invents ancestry. */
 export declare function mayEnqueueBackground(context: AppMethodCallContext): boolean;
 /** Identity and observed revisions only. Unknown fields, including bearer material, refuse. */
-export declare const backgroundWakeSchema: z.ZodObject<{
+export declare const backgroundWakeSchema: z.ZodLazy<z.ZodObject<{
     installationId: z.ZodString;
     actor: z.ZodObject<{
         kind: import("zod/mini").ZodMiniLiteral<"member">;
@@ -59,12 +59,12 @@ export declare const backgroundWakeSchema: z.ZodObject<{
     lane: z.ZodString;
     originMethod: z.ZodString;
     observed: z.ZodObject<{
-        authorityVersion: z.ZodNumber;
+        authorityVersion: z.ZodLazy<z.ZodNumber>;
         artifactDigest: z.ZodCustom<Sha256Digest, Sha256Digest>;
-        membershipVersion: z.ZodOptional<z.ZodNumber>;
+        membershipVersion: z.ZodOptional<z.ZodLazy<z.ZodNumber>>;
     }, z.core.$strict>;
-    epoch: z.ZodNumber;
-}, z.core.$strict>;
+    epoch: z.ZodLazy<z.ZodNumber>;
+}, z.core.$strict>>;
 /** A host wake cannot confer authority without fresh directory and method admission. */
 export type BackgroundWake = z.output<typeof backgroundWakeSchema>;
 /** A retained identity eligible for member-only replay. */

package/dist/background-replay.js

@@ -8,13 +8,13 @@ export { backgroundSyncAllowed } from "./internal/background-sync.js";
 /** The caller's single lightweight grammar for a host-sealed enqueue origin. */
 export const backgroundOriginSchema = appMethodCallerSchema.shape.backgroundOrigin.def.innerType;
 /** The closed result of checking a claimed job's origin in a fresh replay frame. */
-export const claimedJobAdmissionSchema = z.union([
+export const claimedJobAdmissionSchema = z.lazy(() => z.union([
     z.strictObject({ kind: z.literal("admitted") }),
     z.strictObject({
         kind: z.literal("refused"),
         code: z.literal("access_changed"),
     }),
-]);
+]));
 const originBytes = (claims) => new TextEncoder().encode(JSON.stringify([
     "fungi.background-origin/1",
     claims.instanceId,
@@ -110,9 +110,9 @@ export function mayEnqueueBackground(context) {
         Schema.is(WatchdogQueuedJobSchema.fields.lane)(context.backgroundLane));
 }
 const member = z.strictObject(hostActorSchema.def.options[0].shape);
-const revision = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const revision = z.lazy(() => z.number().int().positive().max(Number.MAX_SAFE_INTEGER));
 /** Identity and observed revisions only. Unknown fields, including bearer material, refuse. */
-export const backgroundWakeSchema = z
+export const backgroundWakeSchema = z.lazy(() => z
     .strictObject({
     installationId: z.string().min(1).max(256),
     actor: member,
@@ -130,7 +130,7 @@ export const backgroundWakeSchema = z
 })
     .refine((wake) => wake.lane === actorLane(wake.actor), {
     message: "Wake lane must name its member",
-});
+}));
 /** The App can settle a refused lane without receiving any binding authority. */
 export const backgroundRefusalCodeSchema = z.enum([
     "access_changed",

package/dist/cloudflare.d.ts

@@ -217,6 +217,67 @@ export declare const appArtifactErasureReadbackSchema: Schema.Struct<{
 export declare const APP_RELEASE_D1_FRESH_SCHEMA: string;
 /** Create the native registry that joins a Team publisher to one App/source. */
 export declare function createD1TeamAppPublisherRegistry(database: AppReleaseD1Database): TeamAppPublisherRegistry;
+/** One boot result's identity: the Release and the version of the check that judged it. */
+export type ReleaseBootResultKey = Readonly<{
+    releaseId: string;
+    checkVersion: string;
+}>;
+/** A recorded boot result, opaque JSON owned by the boot gate that wrote it. */
+export type ReleaseBootResultRecord = Readonly<{
+    kind: "recorded";
+    result: Schema.Json;
+    checkedAt: number;
+}>;
+/**
+ * One boot result per Release and check version, beside the Release in the
+ * global catalog. Whoever checks first (the publisher at submission or a
+ * Team's first install) records it; everyone reads it; nobody rechecks.
+ * The catalog owns identity and write-once storage; the boot gate owns the
+ * result's meaning and parses it on read.
+ *
+ * Writers are host-run checkers only, recording only definitive outcomes
+ * (never an inconclusive or "not checked" run) with sanitized diagnostics;
+ * the result covers the UI page check alone, not backend construction.
+ */
+export type ReleaseBootResults = Readonly<{
+    /** The recorded result for this Release and check version, if any. */
+    read: (key: ReleaseBootResultKey) => Promise<Readonly<{
+        kind: "absent";
+    }> | ReleaseBootResultRecord>;
+    /** Record a result unless one exists; always answers with the stored one. */
+    recordIfAbsent: (input: ReleaseBootResultKey & Readonly<{
+        result: Schema.Json;
+        checkedAt: number;
+    }>) => Promise<ReleaseBootResultRecord>;
+}>;
+/** The catalog's write-once boot results, over the same App Release D1. */
+export declare function createD1ReleaseBootResults(database: AppReleaseD1Database): ReleaseBootResults;
+/** The longest a boot capability lease may live: one boot check plus cleanup. */
+export declare const BOOT_CAPABILITY_MAX_LIFETIME_MS = 60000;
+/**
+ * The catalog storage behind a host's boot `BootCapabilityStore`: one
+ * short-lived row per issued lease, keyed by the token's digest (never the
+ * token). The lease itself is opaque JSON owned by the boot capability
+ * contract, which parses it on resolve. Expired rows are deleted on resolve
+ * and purged on every issue; revoke deletes.
+ */
+export type BootCapabilityRows = Readonly<{
+    /** Store one lease; refuses a raw token or a lifetime beyond the maximum. */
+    issue: (input: Readonly<{
+        tokenDigest: string;
+        leaseId: string;
+        releaseId: string;
+        leaseJson: string;
+        expiresAt: number;
+        now: number;
+    }>) => Promise<void>;
+    /** The live lease's JSON for this digest, or `null` when absent or expired. */
+    resolve: (tokenDigest: string, now: number) => Promise<string | null>;
+    /** Delete one lease once its check is done. */
+    revoke: (leaseId: string) => Promise<void>;
+}>;
+/** The catalog's short-lived boot capability rows, over the same App Release D1. */
+export declare function createD1BootCapabilityRows(database: AppReleaseD1Database): BootCapabilityRows;
 /** Create the D1-backed App Release store with private public-website authority. */
 export declare function createD1AppReleaseStore(database: AppReleaseD1Database): PromiseAppReleaseStore & {
     readonly transitionObligations: AppReleaseTransitionObligationStore;

package/dist/cloudflare.js

@@ -512,6 +512,11 @@ CREATE INDEX app_release_team_publishers_team_idx ON app_release_team_publishers
 CREATE TABLE app_release_release_verification_metadata (release_id TEXT PRIMARY KEY REFERENCES app_release_release_verifications(release_id), artifact_digest TEXT NOT NULL, description_json TEXT NOT NULL CHECK(json_valid(description_json))) STRICT;
 CREATE TABLE publisher_template_seed_receipts (template_repository TEXT NOT NULL, seed_revision TEXT NOT NULL, platform_app_id TEXT NOT NULL, source_revision TEXT NOT NULL, source_tree_digest TEXT NOT NULL, recipe_json TEXT CHECK(recipe_json IS NULL OR json_valid(recipe_json)), build_recipe_digest TEXT CHECK(build_recipe_digest IS NULL OR (length(build_recipe_digest) = 71 AND substr(build_recipe_digest, 1, 7) = 'sha256:' AND substr(build_recipe_digest, 8) NOT GLOB '*[^0-9a-f]*')), CHECK((recipe_json IS NULL) = (build_recipe_digest IS NULL)), PRIMARY KEY (template_repository, seed_revision)) STRICT;
 CREATE TABLE publisher_artifacts_repositories (repository_name TEXT PRIMARY KEY CHECK(length(repository_name) BETWEEN 1 AND 128), provider_id TEXT NOT NULL CHECK(length(provider_id) > 0), default_branch TEXT NOT NULL CHECK(default_branch = 'main'), remote TEXT NOT NULL CHECK(length(remote) > 0), parent_repository TEXT REFERENCES publisher_artifacts_repositories(repository_name), CHECK(parent_repository IS NULL OR parent_repository <> repository_name)) STRICT;
+CREATE TABLE app_release_boot_results (release_id TEXT NOT NULL REFERENCES app_release_releases(release_id), check_version TEXT NOT NULL CHECK(length(check_version) BETWEEN 1 AND 64), outcome_json TEXT NOT NULL CHECK(json_valid(outcome_json) AND length(outcome_json) <= 65536), checked_at INTEGER NOT NULL, PRIMARY KEY (release_id, check_version)) STRICT;
+CREATE TRIGGER app_release_boot_results_write_once BEFORE UPDATE ON app_release_boot_results BEGIN SELECT RAISE(ABORT, 'App Release boot results are write-once'); END;
+CREATE TABLE app_release_boot_capabilities (token_digest TEXT PRIMARY KEY CHECK(length(token_digest) = 64 AND token_digest NOT GLOB '*[^0-9a-f]*'), lease_id TEXT NOT NULL UNIQUE CHECK(length(lease_id) BETWEEN 1 AND 128), release_id TEXT NOT NULL REFERENCES app_release_releases(release_id), lease_json TEXT NOT NULL CHECK(json_valid(lease_json) AND length(lease_json) <= 262144), expires_at INTEGER NOT NULL) STRICT;
+CREATE INDEX app_release_boot_capabilities_expiry_idx ON app_release_boot_capabilities(expires_at);
+CREATE TRIGGER app_release_boot_capabilities_write_once BEFORE UPDATE ON app_release_boot_capabilities BEGIN SELECT RAISE(ABORT, 'Boot capability leases are write-once'); END;
 ${publicRouteSchemaSql}
 ${platformOwnerReplaySchemaSql}
 ${buyerReferenceSchemaSql}
@@ -647,6 +652,89 @@ export function createD1TeamAppPublisherRegistry(database) {
         },
     };
 }
+const bootResultRowSchema = Schema.Struct({
+    outcome_json: Schema.fromJsonString(Schema.Json),
+    checked_at: Schema.Number,
+});
+/** The catalog's write-once boot results, over the same App Release D1. */
+export function createD1ReleaseBootResults(database) {
+    const read = async (key) => {
+        const row = await database
+            .prepare(`SELECT outcome_json, checked_at FROM app_release_boot_results
+         WHERE release_id = ? AND check_version = ?`)
+            .bind(parseReleaseId(key.releaseId), key.checkVersion)
+            .first();
+        if (row === null)
+            return { kind: "absent" };
+        const decoded = Schema.decodeUnknownSync(bootResultRowSchema)(row);
+        return {
+            kind: "recorded",
+            result: decoded.outcome_json,
+            checkedAt: decoded.checked_at,
+        };
+    };
+    return {
+        read,
+        recordIfAbsent: async (input) => {
+            await database
+                .prepare(`INSERT INTO app_release_boot_results
+             (release_id, check_version, outcome_json, checked_at)
+           VALUES (?, ?, ?, ?)
+           ON CONFLICT (release_id, check_version) DO NOTHING`)
+                .bind(parseReleaseId(input.releaseId), input.checkVersion, JSON.stringify(input.result), input.checkedAt)
+                .run();
+            const stored = await read(input);
+            if (stored.kind === "absent")
+                throw new Error("The boot result was not recorded");
+            return stored;
+        },
+    };
+}
+/** The longest a boot capability lease may live: one boot check plus cleanup. */
+export const BOOT_CAPABILITY_MAX_LIFETIME_MS = 60_000;
+const tokenDigestSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[0-9a-f]{64}$/u)));
+const bootCapabilityRowSchema = Schema.Struct({ lease_json: Schema.String });
+/** The catalog's short-lived boot capability rows, over the same App Release D1. */
+export function createD1BootCapabilityRows(database) {
+    return {
+        issue: async (input) => {
+            const tokenDigest = Schema.decodeUnknownSync(tokenDigestSchema)(input.tokenDigest);
+            if (input.expiresAt <= input.now ||
+                input.expiresAt - input.now > BOOT_CAPABILITY_MAX_LIFETIME_MS)
+                throw new RangeError("Boot capability lifetime is out of bounds");
+            await database.batch([
+                database
+                    .prepare("DELETE FROM app_release_boot_capabilities WHERE expires_at <= ?")
+                    .bind(input.now),
+                database
+                    .prepare(`INSERT INTO app_release_boot_capabilities
+               (token_digest, lease_id, release_id, lease_json, expires_at)
+             VALUES (?, ?, ?, ?, ?)`)
+                    .bind(tokenDigest, input.leaseId, parseReleaseId(input.releaseId), input.leaseJson, input.expiresAt),
+            ]);
+        },
+        resolve: async (tokenDigest, now) => {
+            const digest = Schema.decodeUnknownSync(tokenDigestSchema)(tokenDigest);
+            await database
+                .prepare("DELETE FROM app_release_boot_capabilities WHERE token_digest = ? AND expires_at <= ?")
+                .bind(digest, now)
+                .run();
+            const row = await database
+                .prepare("SELECT lease_json FROM app_release_boot_capabilities WHERE token_digest = ? AND expires_at > ?")
+                .bind(digest, now)
+                .first();
+            return row === null
+                ? null
+                : Schema.decodeUnknownSync(bootCapabilityRowSchema)(row).lease_json;
+        },
+        revoke: async (leaseId) => {
+            await database
+                .prepare("DELETE FROM app_release_boot_capabilities WHERE lease_id = ?")
+                .bind(leaseId)
+                .run();
+        },
+    };
+}
 /** Create the D1-backed App Release store with private public-website authority. */
 export function createD1AppReleaseStore(database) {
     const transitionObligations = {

package/dist/git-representation.d.ts

@@ -10,4 +10,4 @@ export declare const gitRefUpdateSchema: z.ZodObject<{
     after: z.ZodString;
 }, z.core.$strict>;
 /** Host push event IDs include the Computer and local event identity. */
-export declare const gitPushEventIdSchema: z.ZodString;
+export declare const gitPushEventIdSchema: z.ZodLazy<z.ZodString>;

package/dist/git-representation.js

@@ -13,4 +13,4 @@ export const gitRefUpdateSchema = z.strictObject({
     after: gitSha1Schema,
 });
 /** Host push event IDs include the Computer and local event identity. */
-export const gitPushEventIdSchema = z.string().min(1).max(512);
+export const gitPushEventIdSchema = z.lazy(() => z.string().min(1).max(512));

package/dist/internal/app-release-schema.d.ts

@@ -1468,6 +1468,9 @@ export declare const decodeReleaseLifecycleStoreResult: (input: unknown, options
                             pending?: true | undefined;
                             hidden?: true | undefined;
                             anonymous?: true | undefined;
+                            present?: Readonly<{
+                                verb: string;
+                            }> | undefined;
                         }>>>;
                         toolFamily?: Readonly<{
                             name: string;

package/dist/internal/public-website-authority.d.ts

@@ -226,6 +226,9 @@ export declare const decodePublicWebsiteAuthorityStoreResult: (input: unknown, o
                                 pending?: true | undefined;
                                 hidden?: true | undefined;
                                 anonymous?: true | undefined;
+                                present?: Readonly<{
+                                    verb: string;
+                                }> | undefined;
                             }>>>;
                             toolFamily?: Readonly<{
                                 name: string;