@fungi.computer/puffball 0.1.0 → 0.3.0

package/dist/app-api.js

@@ -4,13 +4,17 @@ import { isAppApiMethodName } from "./app-method-runtime.js";
 export { appApiReservedMethodNames } from "./app-method-runtime.js";
 /** Public method names, including grouped operations such as desktop.arrange. A name cannot also be a group (`files` with `files.read`). */
 export const appApiMethodNameSchema = Schema.String.check(Schema.makeFilter(isAppApiMethodName));
+/** Distinguish containers only after the owning JSON decoder has succeeded. */
+function isJsonContainer(value) {
+    return value !== null && typeof value === "object";
+}
 function withinDepth(value, depth = 0) {
     if (depth > 16)
         return false;
-    if (Schema.is(Schema.Array(Schema.Json))(value))
-        return value.every((child) => withinDepth(child, depth + 1));
-    if (Schema.is(Schema.JsonObject)(value))
-        return Object.values(value).every((child) => withinDepth(child, depth + 1));
+    if (isJsonContainer(value))
+        for (const child of Object.values(value))
+            if (!withinDepth(child, depth + 1))
+                return false;
     return true;
 }
 /** JSON Schema projections are data, bounded before a renderer or compiler reads them. */
@@ -23,16 +27,12 @@ const method = Schema.Struct({
     output: projection,
     pending: Schema.optional(Schema.Literal(true)),
     hidden: Schema.optional(Schema.Literal(true)),
-    anonymous: Schema.optional(Schema.Literal(true)),
     present: Schema.optional(Schema.Struct({
         verb: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(32)),
     })),
     effect: Schema.Literals(["read", "write", "external"]),
     requires: Schema.Array(Schema.Literals(appCapabilityIds)).pipe(Schema.check(Schema.makeFilter((values) => new Set(values).size === values.length))),
-}).check(Schema.makeFilter((value) => value.anonymous !== true ||
-    (value.effect === "read" && value.requires.length === 0), {
-    message: "Anonymous methods must be reads with no required capabilities",
-}));
+});
 /** The build-generated, digest-covered method and event catalog; it grants no authority. */
 export const appApiSchema = Schema.Struct({
     methods: Schema.Record(Schema.String, method).pipe(Schema.check(Schema.makeFilter((methods) => Object.keys(methods).every(Schema.is(appApiMethodNameSchema)), { message: "Invalid App API method name" })), Schema.check(Schema.makeFilter((methods) => Object.keys(methods).length <= 64)), Schema.check(Schema.makeFilter((methods) => {

package/dist/app-backend-binding-vocabulary.d.ts

@@ -60,6 +60,19 @@ export declare const appBackendBindingKinds: {
     readonly APPS: {
         readonly name: "APPS";
         readonly operations: {
+            /** Register the calling installation's repository as an App from its
+             * exact main manifest. No Computer execution or installation is implied. */
+            readonly register: {
+                readonly cap: "app.register";
+                readonly requires: readonly ["git.repository"];
+                readonly effect: "write";
+            };
+            /** Read the captured installation's registered repository identity. */
+            readonly repository: {
+                readonly cap: "app.catalog.read";
+                readonly requires: readonly ["git.repository"];
+                readonly effect: "read";
+            };
             readonly build: {
                 readonly cap: "app.build";
                 readonly requires: readonly ["git.repository", "computer.execute"];
@@ -120,6 +133,11 @@ export declare const appBackendBindingKinds: {
                 readonly requires: readonly ["workflow.run", "workflow.arm"];
                 readonly effect: "write";
             };
+            readonly pauseSchedule: {
+                readonly cap: "app.workflow.run";
+                readonly requires: readonly ["workflow.run", "workflow.arm"];
+                readonly effect: "write";
+            };
             readonly schedules: {
                 readonly cap: "app.workflow.read";
                 readonly requires: readonly ["workflow.run"];
@@ -228,11 +246,6 @@ export declare const appBackendBindingKinds: {
                 readonly requires: readonly ["computer.writeFile"];
                 readonly effect: "write";
             };
-            readonly workflowGitPass: {
-                readonly cap: "app.computer.exec";
-                readonly requires: readonly ["computer.execute"];
-                readonly effect: "write";
-            };
             readonly preview: {
                 readonly cap: "app.computer.exec";
                 readonly requires: readonly ["computer.execute"];
@@ -283,6 +296,21 @@ export declare const appBackendBindingKinds: {
                 readonly requires: readonly ["agent.send"];
                 readonly effect: "write";
             };
+            readonly schedules: {
+                readonly cap: "agent.read";
+                readonly requires: readonly ["agent.read"];
+                readonly effect: "read";
+            };
+            readonly pauseSchedule: {
+                readonly cap: "agent.manage";
+                readonly requires: readonly ["agent.manage"];
+                readonly effect: "write";
+            };
+            readonly deleteSchedule: {
+                readonly cap: "agent.manage";
+                readonly requires: readonly ["agent.manage"];
+                readonly effect: "write";
+            };
         };
     };
 };

package/dist/app-backend-binding-vocabulary.js

@@ -49,6 +49,19 @@ export const appBackendBindingKinds = {
     APPS: {
         name: "APPS",
         operations: {
+            /** Register the calling installation's repository as an App from its
+             * exact main manifest. No Computer execution or installation is implied. */
+            register: {
+                cap: "app.register",
+                requires: ["git.repository"],
+                effect: "write",
+            },
+            /** Read the captured installation's registered repository identity. */
+            repository: {
+                cap: "app.catalog.read",
+                requires: ["git.repository"],
+                effect: "read",
+            },
             build: {
                 cap: "app.build",
                 requires: ["git.repository", "computer.execute"],
@@ -109,6 +122,11 @@ export const appBackendBindingKinds = {
                 requires: ["workflow.run", "workflow.arm"],
                 effect: "write",
             },
+            pauseSchedule: {
+                cap: "app.workflow.run",
+                requires: ["workflow.run", "workflow.arm"],
+                effect: "write",
+            },
             schedules: {
                 cap: "app.workflow.read",
                 requires: ["workflow.run"],
@@ -217,11 +235,6 @@ export const appBackendBindingKinds = {
                 requires: ["computer.writeFile"],
                 effect: "write",
             },
-            workflowGitPass: {
-                cap: "app.computer.exec",
-                requires: ["computer.execute"],
-                effect: "write",
-            },
             preview: {
                 cap: "app.computer.exec",
                 requires: ["computer.execute"],
@@ -256,6 +269,21 @@ export const appBackendBindingKinds = {
         operations: {
             list: { cap: "agent.list", requires: ["agent.list"], effect: "read" },
             send: { cap: "agent.send", requires: ["agent.send"], effect: "write" },
+            schedules: {
+                cap: "agent.read",
+                requires: ["agent.read"],
+                effect: "read",
+            },
+            pauseSchedule: {
+                cap: "agent.manage",
+                requires: ["agent.manage"],
+                effect: "write",
+            },
+            deleteSchedule: {
+                cap: "agent.manage",
+                requires: ["agent.manage"],
+                effect: "write",
+            },
         },
     },
 };

package/dist/app-backend-bindings.d.ts

@@ -11,7 +11,7 @@ export declare const appBackendShardBindingsSchema: Schema.$Array<Schema.Union<S
     readonly name: Schema.Literal<"BACKGROUND" | "GIT" | "EVENTS" | "APPS" | "WORKFLOWS" | "APP_STORAGE" | "MEDIA" | "COMPUTER" | "INBOX" | "AGENTS">;
     readonly operations: Schema.$Array<Schema.Union<Schema.Struct<{
         readonly name: Schema.Literal<string>;
-        readonly cap: Schema.Literal<"agent.list" | "agent.send" | "app.events.emit" | "app.background.admit" | "app.git.create" | "app.git.fork" | "app.git.read" | "app.git.write" | "app.git.exchange" | "app.build" | "app.select" | "app.catalog.read" | "app.fork" | "app.workflow.read" | "app.workflow.run" | "app.storage.read" | "app.storage.write" | "app.media.read" | "app.media.generate" | "app.computer.read" | "app.computer.write" | "app.computer.exec" | "inbox.read" | "inbox.visit">;
+        readonly cap: Schema.Literal<"agent.list" | "agent.manage" | "agent.read" | "agent.send" | "app.events.emit" | "app.background.admit" | "app.git.create" | "app.git.fork" | "app.git.read" | "app.git.write" | "app.git.exchange" | "app.register" | "app.catalog.read" | "app.build" | "app.select" | "app.fork" | "app.workflow.read" | "app.workflow.run" | "app.storage.read" | "app.storage.write" | "app.media.read" | "app.media.generate" | "app.computer.read" | "app.computer.write" | "app.computer.exec" | "inbox.read" | "inbox.visit">;
     }>[]>>;
 }>[]>>;
 /** Look up an operation within its declared kind; unknown names have no authority. */

package/dist/app-declaration.d.ts

@@ -1,7 +1,7 @@
 import * as Schema from "effect/Schema";
 import { type AppDeclaration, type AppDeclaredCommand } from "./app-vocabulary.js";
 export declare const appRoleSchema: Schema.Literals<readonly ["dashboard", "inbox", "files", "media", "sessions", "terminal"]>;
-export declare const appCapabilityIdSchema: Schema.Literals<readonly ["agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>;
+export declare const appCapabilityIdSchema: Schema.Literals<readonly ["approvals", "agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"]>;
 export declare const appHandlerSchema: Schema.Literals<readonly ["file.open"]>;
 /**
  * One declared command: a Whistle definition's identity and projections.

package/dist/app-vocabulary.d.ts

@@ -58,26 +58,47 @@ export declare function resolveAppRoles(choices: ReadonlyMap<AppRole, string>, c
  * Host capabilities an App may request. A request is never authority; the
  * Team's installation grants decide. Extend this list here.
  */
-export declare const appCapabilityIds: readonly ["agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"];
+export declare const appCapabilityIds: readonly ["approvals", "agent.list", "agent.manage", "agent.rename", "agent.avatar", "agent.toolPolicy", "agent.read", "agent.send", "computer.list", "computer.readFile", "computer.writeFile", "computer.execute", "llm.generation", "media.generation", "games:servers", "git.repository", "apps.open", "apps.call", "app.storage", "app.events.emit", "team.workbenchHost", "marketplace.browse", "marketplace.purchase", "workflow.run", "workflow.publish", "workflow.arm", "world", "channels.read", "channels.personal.manage"];
 /** One requestable host capability id. */
 export type AppCapabilityId = (typeof appCapabilityIds)[number];
 /** Backend requests are narrower than the App capabilities a Team approves. */
 export type { AppBackendBinding } from "./app-backend-binding-vocabulary.js";
 import type { AppBackendBinding } from "./app-backend-binding-vocabulary.js";
+/**
+ * Effect-free DTO projection of the owning JSON schema; equality is tested.
+ * Workers RPC's Serializable mapping unfolds anonymous inline recursion.
+ * A named array branch bounds it without expanding an inline array,
+ * without importing Effect into this declaration graph.
+ * @inline
+ */
+export type AppApiJsonValue = null | boolean | number | string | AppApiJsonArray | AppApiJsonObject;
+/**
+ * Named recursive array branch required by the Workers RPC type mapper.
+ * @inline
+ */
+export type AppApiJsonArray = {
+    readonly [index: number]: AppApiJsonValue;
+    readonly length: number;
+};
+/**
+ * Package-internal declaration name; the public root exports AppApi.
+ * @inline
+ */
+export type AppApiJsonObject = {
+    readonly [key: string]: AppApiJsonValue;
+};
 /** Build-generated method and event metadata. This data-only projection grants no authority. */
 export type AppApi = Readonly<{
     methods: Readonly<Record<string, Readonly<{
         description: string;
-        input: object;
-        output: object;
+        input: AppApiJsonObject;
+        output: AppApiJsonObject;
         effect: "read" | "write" | "external";
         requires: readonly AppCapabilityId[];
         /** This method may return Agar's shared Pending result while working. */
         pending?: true | undefined;
         /** Omit from Workflow and tool discovery, without changing direct-call authority. */
         hidden?: true | undefined;
-        /** Request anonymous read admission; declaration alone grants no authority. */
-        anonymous?: true | undefined;
         /** Finished calls read as a person-facing row projected by the App's hidden `present` method. */
         present?: Readonly<{
             verb: string;
@@ -92,7 +113,7 @@ export type AppApi = Readonly<{
     /** Declared event payload schemas; hosts validate emits against the selected Release. */
     events?: Readonly<Record<string, Readonly<{
         description: string;
-        payload: object;
+        payload: AppApiJsonObject;
     }>>>;
 }>;
 /** Navigation requests an App can handle for the shell. */

package/dist/app-vocabulary.js

@@ -49,6 +49,7 @@ export function resolveAppRoles(choices, candidates) {
  * Team's installation grants decide. Extend this list here.
  */
 export const appCapabilityIds = [
+    "approvals",
     "agent.list",
     "agent.manage",
     "agent.rename",

package/dist/cloudflare.d.ts

@@ -217,6 +217,67 @@ export declare const appArtifactErasureReadbackSchema: Schema.Struct<{
 export declare const APP_RELEASE_D1_FRESH_SCHEMA: string;
 /** Create the native registry that joins a Team publisher to one App/source. */
 export declare function createD1TeamAppPublisherRegistry(database: AppReleaseD1Database): TeamAppPublisherRegistry;
+/** One boot result's identity: the Release and the version of the check that judged it. */
+export type ReleaseBootResultKey = Readonly<{
+    releaseId: string;
+    checkVersion: string;
+}>;
+/** A recorded boot result, opaque JSON owned by the boot gate that wrote it. */
+export type ReleaseBootResultRecord = Readonly<{
+    kind: "recorded";
+    result: Schema.Json;
+    checkedAt: number;
+}>;
+/**
+ * One boot result per Release and check version, beside the Release in the
+ * global catalog. Whoever checks first (the publisher at submission or a
+ * Team's first install) records it; everyone reads it; nobody rechecks.
+ * The catalog owns identity and write-once storage; the boot gate owns the
+ * result's meaning and parses it on read.
+ *
+ * Writers are host-run checkers only, recording only definitive outcomes
+ * (never an inconclusive or "not checked" run) with sanitized diagnostics;
+ * the result covers the UI page check alone, not backend construction.
+ */
+export type ReleaseBootResults = Readonly<{
+    /** The recorded result for this Release and check version, if any. */
+    read: (key: ReleaseBootResultKey) => Promise<Readonly<{
+        kind: "absent";
+    }> | ReleaseBootResultRecord>;
+    /** Record a result unless one exists; always answers with the stored one. */
+    recordIfAbsent: (input: ReleaseBootResultKey & Readonly<{
+        result: Schema.Json;
+        checkedAt: number;
+    }>) => Promise<ReleaseBootResultRecord>;
+}>;
+/** The catalog's write-once boot results, over the same App Release D1. */
+export declare function createD1ReleaseBootResults(database: AppReleaseD1Database): ReleaseBootResults;
+/** The longest a boot capability lease may live: one boot check plus cleanup. */
+export declare const BOOT_CAPABILITY_MAX_LIFETIME_MS = 60000;
+/**
+ * The catalog storage behind a host's boot `BootCapabilityStore`: one
+ * short-lived row per issued lease, keyed by the token's digest (never the
+ * token). The lease itself is opaque JSON owned by the boot capability
+ * contract, which parses it on resolve. Expired rows are deleted on resolve
+ * and purged on every issue; revoke deletes.
+ */
+export type BootCapabilityRows = Readonly<{
+    /** Store one lease; refuses a raw token or a lifetime beyond the maximum. */
+    issue: (input: Readonly<{
+        tokenDigest: string;
+        leaseId: string;
+        releaseId: string;
+        leaseJson: string;
+        expiresAt: number;
+        now: number;
+    }>) => Promise<void>;
+    /** The live lease's JSON for this digest, or `null` when absent or expired. */
+    resolve: (tokenDigest: string, now: number) => Promise<string | null>;
+    /** Delete one lease once its check is done. */
+    revoke: (leaseId: string) => Promise<void>;
+}>;
+/** The catalog's short-lived boot capability rows, over the same App Release D1. */
+export declare function createD1BootCapabilityRows(database: AppReleaseD1Database): BootCapabilityRows;
 /** Create the D1-backed App Release store with private public-website authority. */
 export declare function createD1AppReleaseStore(database: AppReleaseD1Database): PromiseAppReleaseStore & {
     readonly transitionObligations: AppReleaseTransitionObligationStore;

package/dist/cloudflare.js

@@ -512,6 +512,11 @@ CREATE INDEX app_release_team_publishers_team_idx ON app_release_team_publishers
 CREATE TABLE app_release_release_verification_metadata (release_id TEXT PRIMARY KEY REFERENCES app_release_release_verifications(release_id), artifact_digest TEXT NOT NULL, description_json TEXT NOT NULL CHECK(json_valid(description_json))) STRICT;
 CREATE TABLE publisher_template_seed_receipts (template_repository TEXT NOT NULL, seed_revision TEXT NOT NULL, platform_app_id TEXT NOT NULL, source_revision TEXT NOT NULL, source_tree_digest TEXT NOT NULL, recipe_json TEXT CHECK(recipe_json IS NULL OR json_valid(recipe_json)), build_recipe_digest TEXT CHECK(build_recipe_digest IS NULL OR (length(build_recipe_digest) = 71 AND substr(build_recipe_digest, 1, 7) = 'sha256:' AND substr(build_recipe_digest, 8) NOT GLOB '*[^0-9a-f]*')), CHECK((recipe_json IS NULL) = (build_recipe_digest IS NULL)), PRIMARY KEY (template_repository, seed_revision)) STRICT;
 CREATE TABLE publisher_artifacts_repositories (repository_name TEXT PRIMARY KEY CHECK(length(repository_name) BETWEEN 1 AND 128), provider_id TEXT NOT NULL CHECK(length(provider_id) > 0), default_branch TEXT NOT NULL CHECK(default_branch = 'main'), remote TEXT NOT NULL CHECK(length(remote) > 0), parent_repository TEXT REFERENCES publisher_artifacts_repositories(repository_name), CHECK(parent_repository IS NULL OR parent_repository <> repository_name)) STRICT;
+CREATE TABLE app_release_boot_results (release_id TEXT NOT NULL REFERENCES app_release_releases(release_id), check_version TEXT NOT NULL CHECK(length(check_version) BETWEEN 1 AND 64), outcome_json TEXT NOT NULL CHECK(json_valid(outcome_json) AND length(outcome_json) <= 65536), checked_at INTEGER NOT NULL, PRIMARY KEY (release_id, check_version)) STRICT;
+CREATE TRIGGER app_release_boot_results_write_once BEFORE UPDATE ON app_release_boot_results BEGIN SELECT RAISE(ABORT, 'App Release boot results are write-once'); END;
+CREATE TABLE app_release_boot_capabilities (token_digest TEXT PRIMARY KEY CHECK(length(token_digest) = 64 AND token_digest NOT GLOB '*[^0-9a-f]*'), lease_id TEXT NOT NULL UNIQUE CHECK(length(lease_id) BETWEEN 1 AND 128), release_id TEXT NOT NULL REFERENCES app_release_releases(release_id), lease_json TEXT NOT NULL CHECK(json_valid(lease_json) AND length(lease_json) <= 262144), expires_at INTEGER NOT NULL) STRICT;
+CREATE INDEX app_release_boot_capabilities_expiry_idx ON app_release_boot_capabilities(expires_at);
+CREATE TRIGGER app_release_boot_capabilities_write_once BEFORE UPDATE ON app_release_boot_capabilities BEGIN SELECT RAISE(ABORT, 'Boot capability leases are write-once'); END;
 ${publicRouteSchemaSql}
 ${platformOwnerReplaySchemaSql}
 ${buyerReferenceSchemaSql}
@@ -647,6 +652,89 @@ export function createD1TeamAppPublisherRegistry(database) {
         },
     };
 }
+const bootResultRowSchema = Schema.Struct({
+    outcome_json: Schema.fromJsonString(Schema.Json),
+    checked_at: Schema.Number,
+});
+/** The catalog's write-once boot results, over the same App Release D1. */
+export function createD1ReleaseBootResults(database) {
+    const read = async (key) => {
+        const row = await database
+            .prepare(`SELECT outcome_json, checked_at FROM app_release_boot_results
+         WHERE release_id = ? AND check_version = ?`)
+            .bind(parseReleaseId(key.releaseId), key.checkVersion)
+            .first();
+        if (row === null)
+            return { kind: "absent" };
+        const decoded = Schema.decodeUnknownSync(bootResultRowSchema)(row);
+        return {
+            kind: "recorded",
+            result: decoded.outcome_json,
+            checkedAt: decoded.checked_at,
+        };
+    };
+    return {
+        read,
+        recordIfAbsent: async (input) => {
+            await database
+                .prepare(`INSERT INTO app_release_boot_results
+             (release_id, check_version, outcome_json, checked_at)
+           VALUES (?, ?, ?, ?)
+           ON CONFLICT (release_id, check_version) DO NOTHING`)
+                .bind(parseReleaseId(input.releaseId), input.checkVersion, JSON.stringify(input.result), input.checkedAt)
+                .run();
+            const stored = await read(input);
+            if (stored.kind === "absent")
+                throw new Error("The boot result was not recorded");
+            return stored;
+        },
+    };
+}
+/** The longest a boot capability lease may live: one boot check plus cleanup. */
+export const BOOT_CAPABILITY_MAX_LIFETIME_MS = 60_000;
+const tokenDigestSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[0-9a-f]{64}$/u)));
+const bootCapabilityRowSchema = Schema.Struct({ lease_json: Schema.String });
+/** The catalog's short-lived boot capability rows, over the same App Release D1. */
+export function createD1BootCapabilityRows(database) {
+    return {
+        issue: async (input) => {
+            const tokenDigest = Schema.decodeUnknownSync(tokenDigestSchema)(input.tokenDigest);
+            if (input.expiresAt <= input.now ||
+                input.expiresAt - input.now > BOOT_CAPABILITY_MAX_LIFETIME_MS)
+                throw new RangeError("Boot capability lifetime is out of bounds");
+            await database.batch([
+                database
+                    .prepare("DELETE FROM app_release_boot_capabilities WHERE expires_at <= ?")
+                    .bind(input.now),
+                database
+                    .prepare(`INSERT INTO app_release_boot_capabilities
+               (token_digest, lease_id, release_id, lease_json, expires_at)
+             VALUES (?, ?, ?, ?, ?)`)
+                    .bind(tokenDigest, input.leaseId, parseReleaseId(input.releaseId), input.leaseJson, input.expiresAt),
+            ]);
+        },
+        resolve: async (tokenDigest, now) => {
+            const digest = Schema.decodeUnknownSync(tokenDigestSchema)(tokenDigest);
+            await database
+                .prepare("DELETE FROM app_release_boot_capabilities WHERE token_digest = ? AND expires_at <= ?")
+                .bind(digest, now)
+                .run();
+            const row = await database
+                .prepare("SELECT lease_json FROM app_release_boot_capabilities WHERE token_digest = ? AND expires_at > ?")
+                .bind(digest, now)
+                .first();
+            return row === null
+                ? null
+                : Schema.decodeUnknownSync(bootCapabilityRowSchema)(row).lease_json;
+        },
+        revoke: async (leaseId) => {
+            await database
+                .prepare("DELETE FROM app_release_boot_capabilities WHERE lease_id = ?")
+                .bind(leaseId)
+                .run();
+        },
+    };
+}
 /** Create the D1-backed App Release store with private public-website authority. */
 export function createD1AppReleaseStore(database) {
     const transitionObligations = {

package/dist/internal/app-release-schema.d.ts

@@ -1461,13 +1461,12 @@ export declare const decodeReleaseLifecycleStoreResult: (input: unknown, options
                     api?: Readonly<{
                         methods: Readonly<Record<string, Readonly<{
                             description: string;
-                            input: object;
-                            output: object;
+                            input: import("../app-vocabulary.js").AppApiJsonObject;
+                            output: import("../app-vocabulary.js").AppApiJsonObject;
                             effect: "read" | "write" | "external";
                             requires: readonly import("../app-vocabulary.js").AppCapabilityId[];
                             pending?: true | undefined;
                             hidden?: true | undefined;
-                            anonymous?: true | undefined;
                             present?: Readonly<{
                                 verb: string;
                             }> | undefined;
@@ -1479,7 +1478,7 @@ export declare const decodeReleaseLifecycleStoreResult: (input: unknown, options
                         }>;
                         events?: Readonly<Record<string, Readonly<{
                             description: string;
-                            payload: object;
+                            payload: import("../app-vocabulary.js").AppApiJsonObject;
                         }>>>;
                     }>;
                     displayName?: string | undefined;
@@ -1518,7 +1517,9 @@ export declare const decodeReleaseLifecycleStoreResult: (input: unknown, options
                             help?: Readonly<{
                                 order?: number | undefined;
                             }> | undefined;
-                            menu?: Readonly<{
+                            menu
+                            /** Canonical Effect Schema for a verified immutable artifact snapshot. */
+                            ?: Readonly<{
                                 order?: number | undefined;
                             }> | undefined;
                             palette?: Readonly<{

package/dist/internal/public-website-authority.d.ts

@@ -219,13 +219,12 @@ export declare const decodePublicWebsiteAuthorityStoreResult: (input: unknown, o
                         api?: Readonly<{
                             methods: Readonly<Record<string, Readonly<{
                                 description: string;
-                                input: object;
-                                output: object;
+                                input: import("../app-vocabulary.js").AppApiJsonObject;
+                                output: import("../app-vocabulary.js").AppApiJsonObject;
                                 effect: "read" | "write" | "external";
                                 requires: readonly import("../app-vocabulary.js").AppCapabilityId[];
                                 pending?: true | undefined;
                                 hidden?: true | undefined;
-                                anonymous?: true | undefined;
                                 present?: Readonly<{
                                     verb: string;
                                 }> | undefined;
@@ -237,7 +236,7 @@ export declare const decodePublicWebsiteAuthorityStoreResult: (input: unknown, o
                             }>;
                             events?: Readonly<Record<string, Readonly<{
                                 description: string;
-                                payload: object;
+                                payload: import("../app-vocabulary.js").AppApiJsonObject;
                             }>>>;
                         }>;
                         displayName?: string | undefined;