gencow 0.1.228 → 0.1.229

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gencow",
-  "version": "0.1.228",
+  "version": "0.1.229",
   "description": "Gencow — AI Backend Engine",
   "type": "module",
   "bin": {
@@ -37,9 +37,9 @@
     "ai": "^6.0.233",
     "@types/node": "^25.9.5",
     "better-auth": "^1.6.23",
-    "@gencow/client": "0.2.7",
     "@gencow/core": "0.1.44",
-    "@gencow/react": "0.2.7"
+    "@gencow/react": "0.2.7",
+    "@gencow/client": "0.2.7"
   },
   "scripts": {
     "prebuild": "pnpm --filter @gencow/migration-contract run build && pnpm --filter @gencow/server run build",

package/runtime/server.mjs

@@ -9927,6 +9927,14 @@ var init_deployment_executor_authority_contract = __esm({
               "enqueue_tenant_database_authority_request(integer,uuid,text,text,text,text,bigint,text)",
               ["EXECUTE"],
               { phase: "execute", enforcement: "exact" }
+            ),
+            // Topology rows remain owner-only. The executor can perform exactly
+            // one atomic candidate gateway transition through this constrained
+            // security-definer capability; it never receives table write grants.
+            objectAuthority(
+              "transition_app_serving_route_gateway_target(text,text,text,text,text,jsonb,boolean)",
+              ["EXECUTE"],
+              { phase: "execute", enforcement: "exact" }
             )
           ),
           closedWorld: { tables: true, sequences: true },
@@ -101904,6 +101912,164 @@ var init_server_serving_route_publication_bootstrap = __esm({
   )`,
       `CREATE UNIQUE INDEX IF NOT EXISTS app_serving_route_topologies_active_environment_unique
     ON app_serving_route_topologies (environment) WHERE state = 'active'`,
+      `CREATE OR REPLACE FUNCTION public.transition_app_serving_route_gateway_target(
+    requested_environment TEXT,
+    requested_topology_revision TEXT,
+    expected_active_revision TEXT,
+    requested_projector_id TEXT,
+    requested_topology_hash TEXT,
+    requested_target_set_hashes JSONB,
+    requested_remove BOOLEAN
+  )
+  RETURNS TABLE (
+    topology_revision TEXT,
+    previous_topology_revision TEXT,
+    replayed BOOLEAN
+  )
+  LANGUAGE plpgsql
+  SECURITY DEFINER
+  SET search_path = pg_catalog, public
+  AS $transition_app_serving_route_gateway_target$
+  DECLARE
+    active_revision TEXT;
+    existing_state TEXT;
+    existing_previous_revision TEXT;
+  BEGIN
+    -- This is deliberately a PROD emergency-candidate capability, not a
+    -- generic topology writer. The fixed identity prevents an executor
+    -- credential from retiring an incumbent edge/gateway projector.
+    IF requested_environment <> 'prod'
+       OR requested_topology_revision !~ '^prod-route-realtime(?:-rb)?-[a-f0-9]{12}$'
+       OR expected_active_revision !~ '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$'
+       OR requested_projector_id <> 'gateway-node-1-realtime-candidate'
+       OR requested_topology_hash !~ '^[a-f0-9]{64}$'
+       OR requested_target_set_hashes IS NULL
+       OR jsonb_typeof(requested_target_set_hashes) <> 'object'
+       OR requested_topology_revision = expected_active_revision THEN
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_TOPOLOGY_INVALID' USING ERRCODE = '22023';
+    END IF;
+
+    PERFORM pg_advisory_xact_lock(hashtextextended('app-serving-route-topology:' || requested_environment, 0));
+    SELECT topology.state, topology.previous_topology_revision
+      INTO existing_state, existing_previous_revision
+      FROM public.app_serving_route_topologies AS topology
+     WHERE topology.topology_revision = requested_topology_revision
+     FOR UPDATE;
+    IF FOUND THEN
+      IF existing_state = 'active'
+         AND existing_previous_revision = expected_active_revision
+         AND EXISTS (
+           SELECT 1 FROM public.app_serving_route_topologies AS topology
+            WHERE topology.topology_revision = requested_topology_revision
+              AND topology.topology_hash = requested_topology_hash
+         ) THEN
+        RETURN QUERY SELECT requested_topology_revision, expected_active_revision, true;
+        RETURN;
+      END IF;
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_TOPOLOGY_CONFLICT' USING ERRCODE = '23505';
+    END IF;
+
+    SELECT topology.topology_revision
+      INTO active_revision
+      FROM public.app_serving_route_topologies AS topology
+     WHERE topology.environment = requested_environment AND topology.state = 'active'
+     FOR UPDATE;
+    IF active_revision IS NULL OR active_revision <> expected_active_revision THEN
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_TOPOLOGY_CAS_CONFLICT' USING ERRCODE = '40001';
+    END IF;
+
+    IF NOT EXISTS (
+      SELECT 1 FROM public.app_serving_route_target_sets AS target_set
+       WHERE target_set.topology_revision = active_revision
+    ) THEN
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_ACTIVE_TOPOLOGY_INVALID' USING ERRCODE = '23514';
+    END IF;
+    IF EXISTS (
+      SELECT 1
+        FROM public.app_serving_route_target_sets AS target_set
+        LEFT JOIN LATERAL (
+          SELECT requested_target_set_hashes ->> target_set.target_set_id AS target_set_hash
+        ) AS supplied ON true
+       WHERE target_set.topology_revision = active_revision
+         AND (supplied.target_set_hash IS NULL OR supplied.target_set_hash !~ '^[a-f0-9]{64}$')
+    ) OR EXISTS (
+      SELECT 1
+        FROM jsonb_object_keys(requested_target_set_hashes) AS supplied(target_set_id)
+       WHERE NOT EXISTS (
+         SELECT 1 FROM public.app_serving_route_target_sets AS target_set
+          WHERE target_set.topology_revision = active_revision
+            AND target_set.target_set_id = supplied.target_set_id
+       )
+    ) THEN
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_TOPOLOGY_HASH_SET_INVALID' USING ERRCODE = '22023';
+    END IF;
+    IF requested_remove AND NOT EXISTS (
+      SELECT 1 FROM public.app_serving_route_topology_targets AS target
+       WHERE target.topology_revision = active_revision AND target.projector_id = requested_projector_id
+    ) THEN
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_TOPOLOGY_CAS_CONFLICT' USING ERRCODE = '40001';
+    END IF;
+    IF requested_remove AND EXISTS (
+      SELECT 1
+        FROM public.app_serving_route_target_sets AS target_set
+       WHERE target_set.topology_revision = active_revision
+         AND NOT EXISTS (
+           SELECT 1 FROM public.app_serving_route_topology_targets AS target
+            WHERE target.topology_revision = active_revision
+              AND target.target_set_id = target_set.target_set_id
+              AND target.projector_id <> requested_projector_id
+         )
+    ) THEN
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_TOPOLOGY_INVALID' USING ERRCODE = '22023';
+    END IF;
+
+    INSERT INTO public.app_serving_route_topologies (
+      topology_revision, environment, topology_hash, state, created_at, updated_at
+    ) VALUES (
+      requested_topology_revision, requested_environment, requested_topology_hash, 'staged', NOW(), NOW()
+    );
+    INSERT INTO public.app_serving_route_target_sets (
+      topology_revision, target_set_id, purpose, target_set_hash, created_at
+    )
+    SELECT requested_topology_revision, target_set.target_set_id, target_set.purpose,
+           requested_target_set_hashes ->> target_set.target_set_id, NOW()
+      FROM public.app_serving_route_target_sets AS target_set
+     WHERE target_set.topology_revision = active_revision;
+    INSERT INTO public.app_serving_route_topology_targets (
+      topology_revision, target_set_id, projector_id, target_kind, created_at
+    )
+    SELECT requested_topology_revision, target.target_set_id, target.projector_id, target.target_kind, NOW()
+      FROM public.app_serving_route_topology_targets AS target
+     WHERE target.topology_revision = active_revision
+       AND (NOT requested_remove OR target.projector_id <> requested_projector_id)
+    UNION ALL
+    SELECT requested_topology_revision, target_set.target_set_id, requested_projector_id, 'gateway', NOW()
+      FROM public.app_serving_route_target_sets AS target_set
+     WHERE target_set.topology_revision = active_revision
+       AND NOT requested_remove
+       AND NOT EXISTS (
+         SELECT 1 FROM public.app_serving_route_topology_targets AS target
+          WHERE target.topology_revision = active_revision
+            AND target.target_set_id = target_set.target_set_id
+            AND target.projector_id = requested_projector_id
+       );
+
+    UPDATE public.app_serving_route_topologies AS topology
+       SET state = 'retired', retired_at = NOW(), updated_at = NOW()
+     WHERE topology.topology_revision = active_revision AND topology.state = 'active';
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_TOPOLOGY_CAS_CONFLICT' USING ERRCODE = '40001';
+    END IF;
+    UPDATE public.app_serving_route_topologies AS topology
+       SET state = 'active', previous_topology_revision = active_revision,
+           activated_at = NOW(), updated_at = NOW()
+     WHERE topology.topology_revision = requested_topology_revision AND topology.state = 'staged';
+    IF NOT FOUND THEN
+      RAISE EXCEPTION 'APP_SERVING_ROUTE_TOPOLOGY_CAS_CONFLICT' USING ERRCODE = '40001';
+    END IF;
+    RETURN QUERY SELECT requested_topology_revision, active_revision, false;
+  END
+  $transition_app_serving_route_gateway_target$`,
       `CREATE TABLE IF NOT EXISTS app_serving_route_target_sets (
     topology_revision TEXT NOT NULL,
     target_set_id TEXT NOT NULL,
@@ -102279,6 +102445,7 @@ var init_server_serving_route_publication_bootstrap = __esm({
       `REVOKE ALL ON TABLE app_serving_route_topologies FROM PUBLIC`,
       `REVOKE ALL ON TABLE app_serving_route_target_sets FROM PUBLIC`,
       `REVOKE ALL ON TABLE app_serving_route_topology_targets FROM PUBLIC`,
+      `REVOKE ALL ON FUNCTION public.transition_app_serving_route_gateway_target(TEXT, TEXT, TEXT, TEXT, TEXT, JSONB, BOOLEAN) FROM PUBLIC`,
       `DO $app_serving_route_roles$
   DECLARE runtime_role TEXT;
   BEGIN
@@ -103527,6 +103694,7 @@ async function ensurePlatformSchemaUpgrade(params) {
   if (!params.isPlatform)
     return;
   const logger3 = params.logger ?? console;
+  await params.rawSql(`CREATE EXTENSION IF NOT EXISTS pg_trgm`);
   await ensurePlatformNodeSchema({ rawSql: params.rawSql });
   try {
     await params.rawSql(`ALTER TABLE apps ADD COLUMN IF NOT EXISTS display_name TEXT`);
@@ -111712,6 +111880,63 @@ function notifyQueryInvalidate(params) {
   params.onMessageSent?.(sent, sentPayloadBytes);
   return sent;
 }
+function notifyAuthorizedQueryInvalidateByLegacyKeys(params) {
+  const appSubs = authorizedQuerySubscriptions.get(params.appName);
+  if (!appSubs) {
+    params.metrics.noSubscribers++;
+    return 0;
+  }
+  const targets = /* @__PURE__ */ new Map();
+  for (const [subscriptionKey, clients] of appSubs) {
+    const legacyQueries = params.queryKeys.map((queryKey) => queryKey.split("::", 1)[0]);
+    if (!params.queryKeys.some((queryKey) => subscriptionKeyMatchesQueryKey(subscriptionKey, queryKey)) && !legacyQueries.some((query2) => [...clients.values()].some((auth) => auth.query === query2))) continue;
+    for (const [ws2, auth] of clients) {
+      if (auth.expiresAt <= Date.now()) {
+        clients.delete(ws2);
+        params.metrics.staleQuerySubscriptions++;
+        continue;
+      }
+      const set2 = targets.get(ws2) ?? /* @__PURE__ */ new Set();
+      set2.add(auth);
+      targets.set(ws2, set2);
+    }
+  }
+  if (targets.size === 0) {
+    params.metrics.noSubscribers++;
+    return 0;
+  }
+  let sent = 0;
+  let sentPayloadBytes = 0;
+  for (const [ws2, auths] of targets) {
+    for (const auth of auths) {
+      const message = JSON.stringify({
+        type: "query:invalidate",
+        query: auth.query,
+        subscriptionKey: auth.subscriptionKey,
+        eventId: `legacy_${Date.now().toString(36)}`
+      });
+      const payloadBytes = Buffer.byteLength(message);
+      params.metrics.queryInvalidations++;
+      params.metrics.payloadBytes += payloadBytes;
+      if (payloadBytes > params.limits.maxPayloadBytes) {
+        params.metrics.payloadDrops++;
+        continue;
+      }
+      try {
+        ws2.send(message);
+        sent++;
+        sentPayloadBytes += payloadBytes;
+      } catch {
+        params.metrics.sendErrors++;
+        params.metrics.droppedConnections++;
+        params.onSocketFailure(ws2);
+      }
+    }
+  }
+  params.metrics.sent += sent;
+  params.onMessageSent?.(sent, sentPayloadBytes);
+  return sent;
+}
 function notifyQueryRevoke(params) {
   const appSubs = authorizedQuerySubscriptions.get(params.appName);
   const clients = appSubs?.get(params.subscriptionKey);
@@ -149123,18 +149348,20 @@ function notifyEmit(appName, queryKey, data) {
   recordRealtimeMessageDelivery(appName, sent, sent * payloadBytes);
   return sent;
 }
-function notifyInvalidate(appName, queryKeys) {
+function notifyInvalidate(appName, queryKeys, bridgeScoped = true) {
   const appSubs = subscriptions.get(appName);
-  if (!appSubs) {
-    metrics2.noSubscribers++;
-    return 0;
-  }
+  const scopedSent = bridgeScoped ? notifyAuthorizedQueryInvalidateByLegacyKeys({
+    appName,
+    queryKeys,
+    limits: gatewayLimits,
+    metrics: metrics2,
+    onMessageSent: (messageCount, payloadBytes) => recordRealtimeMessageDelivery(appName, messageCount, payloadBytes),
+    onSocketFailure: handleClose
+  }) : 0;
+  if (!appSubs) return scopedSent;
   const targets = /* @__PURE__ */ new Map();
   collectLegacyInvalidateTargets(appSubs, queryKeys, targets);
-  if (targets.size === 0) {
-    metrics2.noSubscribers++;
-    return 0;
-  }
+  if (targets.size === 0) return scopedSent;
   let sent = 0;
   let sentPayloadBytes = 0;
   for (const [ws2, keys2] of targets) {
@@ -149158,12 +149385,12 @@ function notifyInvalidate(appName, queryKeys) {
   }
   metrics2.sent += sent;
   recordRealtimeMessageDelivery(appName, sent, sentPayloadBytes);
-  return sent;
+  return sent + scopedSent;
 }
 function notifyQueryInvalidate2(appName, query2, subscriptionKey, eventId = `evt_${Date.now().toString(36)}`, scopeHash = "", legacyQueryKey, crudRealtimeEmitMode = "dual") {
   countGeneratedCrudEmitModeMetrics(metrics2, crudRealtimeEmitMode, legacyQueryKey !== void 0);
   const emitPlan = getGeneratedCrudEmitPlan({ mode: crudRealtimeEmitMode, legacyQueryKey });
-  const legacySent = emitPlan.sendLegacy && legacyQueryKey ? notifyInvalidate(appName, [legacyQueryKey]) : 0;
+  const legacySent = emitPlan.sendLegacy && legacyQueryKey ? notifyInvalidate(appName, [legacyQueryKey], false) : 0;
   const scopedSent = emitPlan.sendScoped ? notifyQueryInvalidate({
     appName,
     query: query2,
@@ -167055,6 +167282,31 @@ var init_server_platform_runtime_helpers = __esm({
   }
 });
 
+// ../server/dist/server-platform-realtime-forwarder.js
+async function forwardPlatformRealtimeNotify(params) {
+  if (process.env.IS_PLATFORM !== "true")
+    return null;
+  const url2 = process.env.GENCOW_REALTIME_GATEWAY_NOTIFY_URL?.trim() || "http://127.0.0.1:4522/internal/realtime-notify";
+  try {
+    const response = await fetch(url2, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Token": params.token },
+      body: JSON.stringify({ appName: params.appName, ...params.body }),
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (response.status !== 401 && response.status !== 403)
+      return response;
+  } catch (error51) {
+    params.logger?.warn("[realtime] Route Gateway forward unavailable; using local compatibility path", error51);
+  }
+  return null;
+}
+var init_server_platform_realtime_forwarder = __esm({
+  "../server/dist/server-platform-realtime-forwarder.js"() {
+    "use strict";
+  }
+});
+
 // ../server/dist/server-platform-analytics-ingest.js
 import { lstatSync, readFileSync as readFileSync18 } from "node:fs";
 import { isAbsolute as isAbsolute9, resolve as resolve46 } from "node:path";
@@ -185980,6 +186232,96 @@ function rowsFromResult29(result2) {
 function hashCanonical(value) {
   return createHash37("sha256").update(JSON.stringify(value)).digest("hex");
 }
+function normalizeTopology(input) {
+  if (!ENVIRONMENTS.has(input.environment) || !REFERENCE2.test(input.topologyRevision) || input.targetSets.length < 1 || input.targetSets.length > MAX_TARGET_SETS) {
+    fail10("APP_SERVING_ROUTE_TOPOLOGY_INVALID");
+  }
+  const targetSets = input.targetSets.map((set2) => {
+    const targets = [...set2.targets].sort(
+      (left, right) => left.projectorId < right.projectorId ? -1 : left.projectorId > right.projectorId ? 1 : 0
+    );
+    if (!REFERENCE2.test(set2.targetSetId) || set2.purpose !== "upsert" && set2.purpose !== "tombstone" || targets.length < 1 || targets.length > MAX_TARGETS_PER_SET || targets.some(
+      (target) => !REFERENCE2.test(target.projectorId) || !TARGET_KINDS.has(target.targetKind)
+    ) || new Set(targets.map((target) => target.projectorId)).size !== targets.length) {
+      fail10("APP_SERVING_ROUTE_TOPOLOGY_INVALID");
+    }
+    return {
+      targetSetId: set2.targetSetId,
+      purpose: set2.purpose,
+      targets,
+      targetSetHash: hashCanonical([set2.purpose, targets])
+    };
+  }).sort(
+    (left, right) => left.targetSetId < right.targetSetId ? -1 : left.targetSetId > right.targetSetId ? 1 : 0
+  );
+  if (new Set(targetSets.map((set2) => set2.targetSetId)).size !== targetSets.length) {
+    fail10("APP_SERVING_ROUTE_TOPOLOGY_INVALID");
+  }
+  const topologyHash = hashCanonical([
+    1,
+    input.environment,
+    input.topologyRevision,
+    targetSets.map(({ targetSetHash: _hash2, ...set2 }) => set2)
+  ]);
+  return {
+    environment: input.environment,
+    topologyRevision: input.topologyRevision,
+    targetSets,
+    topologyHash,
+    targetCount: targetSets.reduce((count3, set2) => count3 + set2.targets.length, 0)
+  };
+}
+function definitionFromRows(rows4) {
+  if (rows4.length === 0) return null;
+  const first2 = rows4[0];
+  const grouped = /* @__PURE__ */ new Map();
+  for (const row of rows4) {
+    const set2 = grouped.get(row.target_set_id) ?? {
+      targetSetId: row.target_set_id,
+      purpose: row.purpose,
+      targets: []
+    };
+    set2.targets.push({
+      projectorId: row.projector_id,
+      targetKind: row.target_kind
+    });
+    grouped.set(row.target_set_id, set2);
+  }
+  return normalizeTopology({
+    environment: first2.environment,
+    topologyRevision: first2.topology_revision,
+    targetSets: [...grouped.values()]
+  });
+}
+async function readActiveAppServingRouteTopology(input) {
+  if (!ENVIRONMENTS.has(input.environment)) fail10("APP_SERVING_ROUTE_TOPOLOGY_INVALID");
+  const result2 = await input.db.execute(sql65`
+    SELECT topology.environment, topology.topology_revision, topology.topology_hash,
+           topology.state, topology.previous_topology_revision,
+           target_set.target_set_id, target_set.purpose, target_set.target_set_hash,
+           target.projector_id, target.target_kind
+      FROM app_serving_route_topologies topology
+      JOIN app_serving_route_target_sets target_set
+        ON target_set.topology_revision = topology.topology_revision
+      JOIN app_serving_route_topology_targets target
+        ON target.topology_revision = target_set.topology_revision
+       AND target.target_set_id = target_set.target_set_id
+     WHERE topology.environment = ${input.environment}
+       AND topology.state = 'active'
+     ORDER BY target_set.target_set_id, target.projector_id
+  `);
+  const normalized = definitionFromRows(rowsFromResult29(result2));
+  if (!normalized) return null;
+  if (normalized.environment !== input.environment) fail10("APP_SERVING_ROUTE_TOPOLOGY_INVALID");
+  return {
+    topologyRevision: normalized.topologyRevision,
+    targetSets: normalized.targetSets.map(({ targetSetId, purpose, targets }) => ({
+      targetSetId,
+      purpose,
+      targets
+    }))
+  };
+}
 async function resolveAppServingRouteTargetSet(input) {
   if (!ENVIRONMENTS.has(input.environment) || !REFERENCE2.test(input.topologyRevision) || !REFERENCE2.test(input.targetSetId)) {
     fail10("APP_SERVING_ROUTE_TOPOLOGY_INVALID");
@@ -186008,12 +186350,21 @@ async function resolveAppServingRouteTargetSet(input) {
   }
   return targets;
 }
-var REFERENCE2, ENVIRONMENTS;
+var REFERENCE2, ENVIRONMENTS, TARGET_KINDS, MAX_TARGET_SETS, MAX_TARGETS_PER_SET;
 var init_app_serving_route_topology_store = __esm({
   "../platform/src/app-serving-route-topology-store.ts"() {
     "use strict";
     REFERENCE2 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
     ENVIRONMENTS = /* @__PURE__ */ new Set(["local", "dev", "qc", "prod"]);
+    TARGET_KINDS = /* @__PURE__ */ new Set([
+      "edge",
+      "gateway",
+      "static_origin",
+      "analytics_collector",
+      "domain_authorizer"
+    ]);
+    MAX_TARGET_SETS = 64;
+    MAX_TARGETS_PER_SET = 64;
   }
 });
 
@@ -186111,6 +186462,43 @@ function rowsFromResult31(result2) {
   if (Array.isArray(result2)) return result2;
   return result2?.rows ?? [];
 }
+async function resolveAppServingRoutePreparationBindingInTransaction(input) {
+  await input.acquireLock(input.tx, `app-serving-route-topology:${input.environment}`);
+  const existingResult = await input.tx.execute(sql67`
+    SELECT environment, topology_revision, target_set_id
+      FROM app_serving_route_outbox
+     WHERE app_id = ${input.appId}
+       AND app_instance_id = ${input.appInstanceId}
+       AND mutation_kind = ${input.mutationKind}
+       AND source_revision = ${input.sourceRevision}
+       AND phase = 'prepare'
+  `);
+  const existing = rowsFromResult31(existingResult);
+  if (existing.length > 1 || existing[0] && existing[0].environment !== input.environment) {
+    fail12("APP_SERVING_ROUTE_SOURCE_DECISION_CONFLICT");
+  }
+  if (existing[0]) {
+    return {
+      topologyRevision: existing[0].topology_revision,
+      targetSetId: existing[0].target_set_id
+    };
+  }
+  if (input.phase === "commit") {
+    return { topologyRevision: input.topologyRevision, targetSetId: input.targetSetId };
+  }
+  const active = await readActiveAppServingRouteTopology({
+    db: input.tx,
+    environment: input.environment
+  });
+  const upsertTargetSets = active?.targetSets.filter((targetSet) => targetSet.purpose === "upsert") ?? [];
+  if (!active || upsertTargetSets.length !== 1) {
+    fail12("APP_SERVING_ROUTE_TOPOLOGY_TARGET_SET_UNAVAILABLE");
+  }
+  return {
+    topologyRevision: active.topologyRevision,
+    targetSetId: upsertTargetSets[0].targetSetId
+  };
+}
 function normalizeInput(input) {
   const phaseValid = input.phase === "prepare" || input.phase === "commit" || input.phase === "tombstone";
   const dispositionValid = input.disposition === "upsert" || input.disposition === "tombstone";
@@ -186323,7 +186711,7 @@ async function commitAppServingRouteDecisionInTransaction(rawInput) {
   const acquireLock = customAcquireLock ?? ((executor, key) => executor.execute(sql67`SELECT pg_advisory_xact_lock(hashtextextended(${key}::text, 0))`));
   return commitNormalizedDecision(tx, input, acquireLock);
 }
-async function inspectPreparedReplay(tx, input, current, requiredTargets) {
+async function inspectPreparedReplay(tx, input, current) {
   const routeEpoch = input.expectedRouteEpoch + 1;
   const predecessorHash = current?.entry_hash ?? null;
   const eventId = routeEventId({ ...input, routeEpoch, predecessorHash });
@@ -186347,6 +186735,14 @@ async function inspectPreparedReplay(tx, input, current, requiredTargets) {
   `);
   const row = rowsFromResult31(event)[0];
   if (!row) return null;
+  const requiredTargets = await resolveAppServingRouteTargetSet({
+    db: tx,
+    environment: input.environment,
+    topologyRevision: input.topologyRevision,
+    targetSetId: input.targetSetId,
+    purpose: "upsert",
+    allowRetired: true
+  });
   await assertReplayTargets(tx, eventId, "prepare", requiredTargets);
   return outcome(input, routeEpoch, predecessorHash, eventId, Number(row.publication_sequence), true);
 }
@@ -186425,43 +186821,69 @@ async function assertCommitPreparedAuthorityEpoch(tx, current, input) {
 }
 async function prepareNormalizedDecision(tx, input, acquireLock) {
   if (input.phase !== "prepare") fail12("APP_SERVING_ROUTE_DECISION_INVALID");
-  await acquireLock(tx, `app-serving-route:${input.appId}`);
-  const current = await loadAuthority(tx, input.appId);
-  const requiredTargets = await resolveAppServingRouteTargetSet({
-    db: tx,
+  const binding = await resolveAppServingRoutePreparationBindingInTransaction({
+    tx,
     environment: input.environment,
+    appId: input.appId,
+    appInstanceId: input.appInstanceId,
+    phase: input.phase,
+    mutationKind: input.mutationKind,
+    sourceRevision: input.sourceRevision,
     topologyRevision: input.topologyRevision,
     targetSetId: input.targetSetId,
-    purpose: "upsert"
+    acquireLock
   });
-  const replay = await inspectPreparedReplay(tx, input, current, requiredTargets);
+  const boundInput = { ...input, ...binding };
+  await acquireLock(tx, `app-serving-route:${boundInput.appId}`);
+  const current = await loadAuthority(tx, boundInput.appId);
+  const replay = await inspectPreparedReplay(tx, boundInput, current);
   if (replay) return replay;
-  await assertPrepareAuthorityEpoch(tx, current, input);
-  return persistPreparedDecision(tx, input, current, requiredTargets);
+  const requiredTargets = await resolveAppServingRouteTargetSet({
+    db: tx,
+    environment: boundInput.environment,
+    topologyRevision: boundInput.topologyRevision,
+    targetSetId: boundInput.targetSetId,
+    purpose: "upsert"
+  });
+  await assertPrepareAuthorityEpoch(tx, current, boundInput);
+  return persistPreparedDecision(tx, boundInput, current, requiredTargets);
 }
 async function commitPreparedNormalizedDecision(tx, input, acquireLock) {
   if (input.phase !== "commit") fail12("APP_SERVING_ROUTE_DECISION_INVALID");
-  await acquireLock(tx, `app-serving-route:${input.appId}`);
-  const current = await loadAuthority(tx, input.appId);
-  await assertCommitPreparedAuthorityEpoch(tx, current, input);
-  const preparedInput = { ...input, phase: "prepare" };
-  const requiredTargets = await resolveAppServingRouteTargetSet({
-    db: tx,
+  const binding = await resolveAppServingRoutePreparationBindingInTransaction({
+    tx,
     environment: input.environment,
+    appId: input.appId,
+    appInstanceId: input.appInstanceId,
+    phase: input.phase,
+    mutationKind: input.mutationKind,
+    sourceRevision: input.sourceRevision,
     topologyRevision: input.topologyRevision,
     targetSetId: input.targetSetId,
+    acquireLock
+  });
+  const boundInput = { ...input, ...binding };
+  await acquireLock(tx, `app-serving-route:${boundInput.appId}`);
+  const current = await loadAuthority(tx, boundInput.appId);
+  await assertCommitPreparedAuthorityEpoch(tx, current, boundInput);
+  const preparedInput = { ...boundInput, phase: "prepare" };
+  const requiredTargets = await resolveAppServingRouteTargetSet({
+    db: tx,
+    environment: boundInput.environment,
+    topologyRevision: boundInput.topologyRevision,
+    targetSetId: boundInput.targetSetId,
     purpose: "upsert",
     allowRetired: true
   });
-  const prepared = await inspectPreparedReplay(tx, preparedInput, current, requiredTargets);
+  const prepared = await inspectPreparedReplay(tx, preparedInput, current);
   if (!prepared) fail12("APP_SERVING_ROUTE_PREPARE_REQUIRED");
   const convergence = await assessAppServingRouteConvergence({
     db: tx,
     eventId: prepared.eventId,
-    appId: input.appId
+    appId: boundInput.appId
   });
   if (convergence.status !== "converged") fail12("APP_SERVING_ROUTE_PREPARE_NOT_CONVERGED");
-  return persistDecision(tx, input, current, requiredTargets);
+  return persistDecision(tx, boundInput, current, requiredTargets);
 }
 function resolveDecisionLock(customAcquireLock) {
   return customAcquireLock ?? ((tx, key) => tx.execute(sql67`SELECT pg_advisory_xact_lock(hashtextextended(${key}::text, 0))`));
@@ -416540,6 +416962,18 @@ function replayOutcome(row) {
 }
 async function commitAppServingRouteSourceInTransaction(input) {
   const acquireLock = input.acquireLock ?? ((tx, key) => tx.execute(sql83`SELECT pg_advisory_xact_lock(hashtextextended(${key}::text, 0))`));
+  const binding = input.phase === "tombstone" ? { topologyRevision: input.topologyRevision, targetSetId: input.targetSetId } : await resolveAppServingRoutePreparationBindingInTransaction({
+    tx: input.tx,
+    environment: input.environment,
+    appId: input.source.appId,
+    appInstanceId: input.source.appInstanceId,
+    phase: input.phase,
+    mutationKind: input.mutationKind,
+    sourceRevision: input.sourceRevision,
+    topologyRevision: input.topologyRevision,
+    targetSetId: input.targetSetId,
+    acquireLock
+  });
   await acquireLock(input.tx, `app-serving-route:${input.source.appId}`);
   const replayResult = await input.tx.execute(sql83`
     SELECT event_id, publication_sequence, environment, app_id, app_instance_id, route_epoch,
@@ -416558,7 +416992,7 @@ async function commitAppServingRouteSourceInTransaction(input) {
     const replayEntryHash = Number.isSafeInteger(replayEpoch) ? hashServingRouteManifestEntry(
       compileAppServingRouteEntry({ ...input.source, routeEpoch: replayEpoch })
     ) : "";
-    if (replay.environment !== input.environment || replay.phase !== input.phase || replay.disposition !== input.source.disposition || replay.topology_revision !== input.topologyRevision || replay.target_set_id !== input.targetSetId || replay.entry_hash !== replayEntryHash) {
+    if (replay.environment !== input.environment || replay.phase !== input.phase || replay.disposition !== input.source.disposition || replay.topology_revision !== binding.topologyRevision || replay.target_set_id !== binding.targetSetId || replay.entry_hash !== replayEntryHash) {
       fail15("APP_SERVING_ROUTE_SOURCE_DECISION_CONFLICT");
     }
     return replayOutcome(replay);
@@ -416602,7 +417036,7 @@ async function commitAppServingRouteSourceInTransaction(input) {
     const preparedEntryHash = Number.isSafeInteger(preparedEpoch) ? hashServingRouteManifestEntry(
       compileAppServingRouteEntry({ ...input.source, routeEpoch: preparedEpoch })
     ) : "";
-    if (!prepared || prepared.environment !== input.environment || prepared.disposition !== input.source.disposition || prepared.topology_revision !== input.topologyRevision || prepared.target_set_id !== input.targetSetId || prepared.entry_hash !== preparedEntryHash || preparedEpoch < 1) {
+    if (!prepared || prepared.environment !== input.environment || prepared.disposition !== input.source.disposition || prepared.topology_revision !== binding.topologyRevision || prepared.target_set_id !== binding.targetSetId || prepared.entry_hash !== preparedEntryHash || preparedEpoch < 1) {
       fail15("APP_SERVING_ROUTE_SOURCE_DECISION_CONFLICT");
     }
     expectedRouteEpoch = preparedEpoch - 1;
@@ -416624,8 +417058,8 @@ async function commitAppServingRouteSourceInTransaction(input) {
     disposition: input.source.disposition,
     mutationKind: input.mutationKind,
     entry,
-    topologyRevision: input.topologyRevision,
-    targetSetId: input.targetSetId,
+    topologyRevision: binding.topologyRevision,
+    targetSetId: binding.targetSetId,
     sourceRevision: input.sourceRevision,
     acquireLock: async () => void 0
   };
@@ -432960,6 +433394,16 @@ function registerRealtimeNotifyRoute(params) {
       if (rateLimit2 && !rateLimit2.ok) {
         return c.json({ error: "Realtime notify rate limit exceeded", retryAfterMs: rateLimit2.retryAfterMs }, 429);
       }
+      const forwarded = await forwardPlatformRealtimeNotify({
+        appName: auth.appName,
+        body,
+        token: c.req.header("X-Internal-Token") || "",
+        logger: logger3
+      });
+      if (forwarded) {
+        const forwardedBody = await forwarded.json().catch(() => ({ error: "Realtime gateway unavailable" }));
+        return c.json(forwardedBody, forwarded.status);
+      }
       if (body.type === "emit") {
         if (typeof body.queryKey !== "string" || body.queryKey.length === 0) {
           return c.json({ error: "queryKey required" }, 400);
@@ -433514,6 +433958,7 @@ var init_server_platform_runtime_bootstrap = __esm({
     init_server_platform_account_deletion_finalizer_runtime();
     init_server_platform_runtime_helpers();
     init_server_platform_internal_middleware();
+    init_server_platform_realtime_forwarder();
     init_server_platform_analytics_ingest();
     init_server_legacy_runtime_recovery_route();
     init_server_runtime_route_projection_runtime();
@@ -436256,10 +436701,6 @@ var HISTORICAL_INDEX_IDENTITIES = /* @__PURE__ */ new Map([
   ["app_delete_recover_terminal_replay", { legacyIndex: "0072", tagIndex: "0077", legacyIndexAliases: ["0069"] }],
   ["source_static_backup_split", { legacyIndex: "0073", tagIndex: "0078", legacyIndexAliases: ["0070"] }]
 ]);
-var ROOT_HISTORICAL_RECEIPTS = /* @__PURE__ */ new Map([
-  ["0079_serving_route_recovery_capability", { timestampMillis: 1787565607145, createdAt: 1787565607e3 }],
-  ["0080_analytics_collector_route_target", { timestampMillis: 1787565608146, createdAt: 1787565608e3 }]
-]);
 var CANONICAL_HISTORICAL_RECEIPTS = /* @__PURE__ */ new Map([
   ["20260408_add_memory_metering", { timestampMillis: 17756064e5, createdAt: 17756064e5 }],
   ["20260825_add_analytics_ingest_event_id", { timestampMillis: 1787616000099, createdAt: 1787616e6 }],
@@ -436334,7 +436775,6 @@ function parseJournalIdentity(name, createdAt) {
   const rootLegacyCandidate = indexedMatch ? void 0 : ROOT_LEGACY_JOURNAL_NAME.exec(name);
   const rootLegacyMatch = rootLegacyCandidate && /^\d{4}_/u.test(rootLegacyCandidate[3]) && !/^\d{8}_/u.test(rootLegacyCandidate[3]) ? rootLegacyCandidate : void 0;
   const rootLegacyTag = rootLegacyMatch?.[3];
-  const explicitRootMillisecond = rootLegacyMatch?.[2] !== void 0;
   const match2 = indexedMatch ?? rootLegacyMatch ?? CANONICAL_JOURNAL_NAME.exec(name);
   if (!match2)
     throw new Error("PLATFORM_MIGRATION_JOURNAL_IDENTITY_INVALID");
@@ -436346,9 +436786,8 @@ function parseJournalIdentity(name, createdAt) {
   const rootDatedLegacy = !indexedMatch && !rootLegacyMatch && /^\d{8}_[a-zA-Z0-9][a-zA-Z0-9._-]*$/u.test(match2[3]);
   const dateMillis = makeUtcMillis(timestamp31.slice(0, 8), "000000000");
   const rootDatedLegacyTimestampIsBounded = rootDatedLegacy && dateMillis !== void 0 && match2[3].slice(0, 8) === timestamp31.slice(0, 8) && expectedCreatedAt !== void 0 && expectedCreatedAt >= dateMillis && expectedCreatedAt < dateMillis + 1e3 && createdAt === dateMillis;
-  const rootHistoricalReceipt = explicitRootMillisecond && rootLegacyTag ? ROOT_HISTORICAL_RECEIPTS.get(rootLegacyTag) : void 0;
-  const rootHistoricalReceiptIsExact = rootHistoricalReceipt !== void 0 && expectedCreatedAt === rootHistoricalReceipt.timestampMillis && createdAt === rootHistoricalReceipt.createdAt;
-  if (expectedCreatedAt === void 0 || !indexedMatch && expectedCreatedAt !== createdAt && !rootDatedLegacyTimestampIsBounded && !rootHistoricalReceiptIsExact)
+  const rootLegacyTimestampIsSameDay = rootLegacyMatch !== void 0 && dateMillis !== void 0 && createdAt >= dateMillis && createdAt < dateMillis + 24 * 60 * 60 * 1e3;
+  if (expectedCreatedAt === void 0 || !indexedMatch && expectedCreatedAt !== createdAt && !rootDatedLegacyTimestampIsBounded && !rootLegacyTimestampIsSameDay)
     throw new Error("PLATFORM_MIGRATION_JOURNAL_IDENTITY_INVALID");
   return {
     dateMillis,
@@ -436356,6 +436795,7 @@ function parseJournalIdentity(name, createdAt) {
     suffix: indexedMatch ? indexedMatch[5] : rootLegacyMatch ? rootLegacyMatch[3].slice(5) : match2[3],
     ...indexedMatch ? { legacyIndexes: [indexedMatch[3], indexedMatch[4]] } : {},
     ...rootLegacyTag ? { rootLegacyTag } : {},
+    ...rootLegacyTimestampIsSameDay ? { rootLegacyTimestampIsSameDay: true } : {},
     ...rootDatedLegacy ? { rootDatedLegacy: true } : {}
   };
 }
@@ -436521,10 +436961,6 @@ function findAppliedFile(row, files, indexes) {
     if (historicalCandidates.length === 1)
       return historicalCandidates[0];
   }
-  const rootHistoricalReceipt = identity2.rootLegacyTag && identity2.timestampMillis !== row.createdAt ? ROOT_HISTORICAL_RECEIPTS.get(identity2.rootLegacyTag) : void 0;
-  if (rootHistoricalReceipt !== void 0 && identity2.timestampMillis !== row.createdAt && (identity2.timestampMillis !== rootHistoricalReceipt.timestampMillis || row.createdAt !== rootHistoricalReceipt.createdAt)) {
-    throw new Error("PLATFORM_MIGRATION_JOURNAL_IDENTITY_INVALID");
-  }
   if (identity2.legacyIndexes !== void 0 && (row.createdAt < identity2.timestampMillis || row.createdAt >= identity2.timestampMillis + MAX_INDEXED_LEGACY_CREATED_AT_DRIFT_MS)) {
     throw new Error("PLATFORM_MIGRATION_JOURNAL_IDENTITY_INVALID");
   }
@@ -436549,9 +436985,12 @@ function findAppliedFile(row, files, indexes) {
     }
   }
   if (identity2.rootLegacyTag !== void 0 && exactLegacyIdentity.length === 0) {
-    const rootHistoricalReceipt2 = ROOT_HISTORICAL_RECEIPTS.get(identity2.rootLegacyTag);
-    if (rootHistoricalReceipt2 !== void 0) {
+    if (exactLegacyIdentity.length === 0 && identity2.rootLegacyTimestampIsSameDay) {
       exactLegacyIdentity = files.filter((file2) => file2.fileName === `${identity2.rootLegacyTag}.sql` && file2.dateMillis === row.createdAt && file2.hash === row.hash);
+      if (exactLegacyIdentity.length > 1)
+        throw new Error("PLATFORM_MIGRATION_SOURCE_AMBIGUOUS");
+      if (exactLegacyIdentity.length === 1)
+        return exactLegacyIdentity[0];
     }
     const canonicalCandidates = files.filter((file2) => {
       const canonical = CANONICAL_MIGRATION_FILE.exec(file2.fileName);
@@ -436577,9 +437016,6 @@ function findAppliedFile(row, files, indexes) {
   })) {
     throw new Error("PLATFORM_MIGRATION_JOURNAL_IDENTITY_INVALID");
   }
-  if (rootHistoricalReceipt !== void 0 && exactLegacyIdentity.length === 1 && exactLegacyIdentity[0].fileName === `${identity2.rootLegacyTag}.sql`) {
-    return exactLegacyIdentity[0];
-  }
   if (exactLegacyIdentity.length === 1 && exactLegacyIdentity[0].hash !== row.hash && identity2.legacyIndexes === void 0 && identity2.rootLegacyTag === void 0) {
     throw new Error("PLATFORM_MIGRATION_SOURCE_HASH_MISMATCH");
   }