@aippy/runtime 0.4.2-dev.3 → 0.4.2-dev.4

package/README.md

@@ -127,25 +127,20 @@ const image = await generateImage({
 console.log(image.image?.base64);
 ```
 
-### Credits
-
-`@aippy/runtime/credits` provides `getCredits` and `deductCredits` for balance
-queries and user-approved custom credit charges, including non-AI actions.
-The new subpath is unreleased in this change; published `@aippy/runtime@0.4.1`
-does not include it. Install a published release whose package exports and
-installed declarations provide `./credits` and both functions before importing.
-A release that only provides the old AI exports is not sufficient.
-
-```typescript
-import { getCredits, deductCredits } from '@aippy/runtime/credits';
-```
-
-The functions and their options types are no longer exported from
-`@aippy/runtime/ai`; update existing AI imports to the credits subpath. They
-remain available from the root runtime entry. No AI configuration is needed.
-Call them from UI handlers with error handling; model generation already charges
-credits. See the [credits module](./src/credits/README.md) and the
-`aippy-credits-sdk` skill for usage, retry constraints, and host behavior.
+### Ministore (Internal Test Only)
+
+`@aippy/runtime/ministore` provides project entitlement catalogs, holdings,
+mall GEM balance, authorization queries, explicit settlement and records.
+The SDK and its Skill are not available to external creators and are not
+advertised in system prompts. An installed export does not authorize public use.
+App or approved website-parent confirmation uses the specified wallet.authorize
+contract and stays separate from settlement. The synchronous support check is
+native-only; parent confirmation needs a matching deployed website handler.
+Non-native recharge hints do not wait for funds or resume settlement.
+Real host support and service acceptance remain pending; no
+package publication or external enablement is performed by this work.
+See the [ministore module](./src/ministore/README.md) for the verified HTTP
+contract, internal-consumer requirements and recovery rules.
 
 ## Packages
 
@@ -154,7 +149,7 @@ credits. See the [credits module](./src/credits/README.md) and the
 - `@aippy/runtime/utils` - Platform detection, performance monitoring, PWA utilities
 - `@aippy/runtime/audio` - iOS-compatible Web Audio API wrapper
 - `@aippy/runtime/ai` - AI SDK adapter wrapping `ai` package, routes through backend proxy
-- `@aippy/runtime/credits` - Current-user credit balance and explicit deductions
+- `@aippy/runtime/ministore` - Project entitlements, GEM wallet and authorization (internal test only; App integration pending)
 
 ## Publishing
 

package/dist/ai/errors.d.ts

@@ -2,7 +2,7 @@ import { AISDKError } from 'ai';
 /**
  * Normalizes a backend error response into an AISDKError.
  * Extracts and sends appMessage to container if present in the error response.
- * Insufficient credits also asks the native host to open the recharge sheet.
+ * Insufficient quota also asks the native host to open the recharge sheet.
  * Uses [Aippy Runtime] prefix - these errors are NOT reported to LLM.
  */
 export declare function normalizeError(response: Response, body?: unknown): AISDKError;

package/dist/ai/index.js

@@ -1,23 +1,21 @@
-import { D as r, d as i, e as n, c as A, U as C, a as g, b as t, j as f, g as I, h as p, i as _, l as E, p as T, r as U, f as D, s as l, v as L } from "../helper-BQmXeuDs.js";
-import "react";
-import "../bridge-CtB9L5kL.js";
-import { n as m } from "../fetch-lzas52mc.js";
+import { D as o, d as r, e as i, c as n, U as A, a as C, b as g, j as I, g as f, h as t, i as _, l as E, n as T, p as U, r as p, f as D, s as l, v as L } from "../helper-BWszI06u.js";
+import "../bridge-D_-7nPNC.js";
 export {
-  r as DEFAULT_BASE_URL,
-  i as DEFAULT_CHAT_MODEL,
-  n as DEFAULT_CHAT_SYSTEM,
-  A as DEFAULT_UI_BASE_URL,
-  C as UI_CHAT_ENDPOINT,
-  g as aippyAIProvider,
-  t as aippyChatConfig,
-  f as createAIConfig,
-  I as generateCharacter3D,
-  p as generateMotion,
+  o as DEFAULT_BASE_URL,
+  r as DEFAULT_CHAT_MODEL,
+  i as DEFAULT_CHAT_SYSTEM,
+  n as DEFAULT_UI_BASE_URL,
+  A as UI_CHAT_ENDPOINT,
+  C as aippyAIProvider,
+  g as aippyChatConfig,
+  I as createAIConfig,
+  f as generateCharacter3D,
+  t as generateMotion,
   _ as getAIConfigValue,
   E as loadAIConfig,
-  m as normalizeError,
-  T as parseAIConfig,
-  U as resolveOpenAIConfig,
+  T as normalizeError,
+  U as parseAIConfig,
+  p as resolveOpenAIConfig,
   D as resolveUIConfig,
   l as sendAIConfigToContainer,
   L as validateAIConfig

package/dist/bridge-D_-7nPNC.js

@@ -0,0 +1,311 @@
+import { a as v } from "./runtime-CmoG3v2m.js";
+import { r as b, s as q, i as w } from "./app-version-checker-Bz7FrEZz.js";
+import { c as A, a as _ } from "./errors-B3bDbQbD.js";
+const F = ".aippynow.com", k = "https://api.aippy.dev", S = "https://api.aippy.ai";
+function ee(e) {
+  return e === k || e === S;
+}
+let p;
+function j() {
+  if (p) return p;
+  let e = S;
+  if (typeof window < "u" && window.location) {
+    const n = window.location.hostname;
+    (n.endsWith(F) || n === "localhost" || n === "127.0.0.1") && (e = k);
+  }
+  return p = e, e;
+}
+function ne() {
+  p = void 0;
+}
+function I() {
+  if (typeof window > "u" || !window.parent || window.parent === window)
+    return;
+  const e = window.location?.ancestorOrigins?.[0] || (typeof document < "u" ? document.referrer : "");
+  if (e)
+    try {
+      const { origin: n, protocol: t } = new URL(e);
+      return t === "https:" || t === "http:" ? n : void 0;
+    } catch {
+      return;
+    }
+}
+function P(e) {
+  return !!e.data && typeof e.data == "object" && !Array.isArray(e.data);
+}
+function U(e, n = I()) {
+  return typeof window < "u" && !!n && e.source === window.parent && e.origin === n && P(e);
+}
+function N(e) {
+  if (typeof window > "u" || !P(e)) return !1;
+  const n = window.location?.origin;
+  return U(e) || !!n && n !== "null" && e.source === window && e.origin === n;
+}
+const m = {
+  apiBaseUrl: `${j()}/api`,
+  authToken: "",
+  currentUserId: null
+};
+function H(e) {
+  Object.assign(m, e);
+}
+function J(e) {
+  m.authToken = e;
+}
+function V(e) {
+  m.currentUserId = e;
+}
+function te() {
+  return m.currentUserId;
+}
+const O = 3e3, L = 50, f = 500, c = { uid: "", token: "" };
+let l = null, h = !1, a = null, u = null;
+function d(e) {
+  return !!e && typeof e == "object" && !Array.isArray(e);
+}
+function D(e) {
+  return typeof e == "string" && e !== "" ? e : typeof e == "number" && Number.isSafeInteger(e) && e > 0 ? String(e) : null;
+}
+function E(e) {
+  if (!d(e)) return null;
+  let n = e;
+  d(n.credentials) && (n = n.credentials), d(n.user) && n.token && (n = {
+    uid: n.user.uid || n.user.userId || n.user.id,
+    token: n.token,
+    apiBaseUrl: n.apiBaseUrl
+  });
+  const t = D(n.uid || n.userId || n.id), i = n.token || n.authToken;
+  if (!t || typeof i != "string" || i === "") return null;
+  const r = typeof n.apiBaseUrl == "string" ? n.apiBaseUrl : void 0, s = { uid: t, token: i, apiBaseUrl: r };
+  return V(t), J(i), r && H({ apiBaseUrl: r }), s;
+}
+function T(e) {
+  if (!d(e)) return null;
+  let n = e;
+  d(n.userInfo) && (n = n.userInfo), d(n.user) && (n = n.user);
+  const t = D(n.uid || n.userId || n.id);
+  if (!t) return null;
+  const i = { ...n, uid: t };
+  return l = i, h = !0, i;
+}
+function x(e = f) {
+  return a ? new Promise((n) => {
+    const t = a.resolve;
+    a.resolve = (i) => {
+      t(i), n(i);
+    };
+  }) : new Promise((n) => {
+    let t, i;
+    const r = {
+      resolve: (s) => {
+        clearTimeout(t), i?.cancel(), a === r && (a = null), n(s);
+      }
+    };
+    a = r, (async () => {
+      let s = window.webkit?.messageHandlers?.aippyListener;
+      if (s || (s = await M(1500)), a === r) {
+        if (!s) {
+          r.resolve(c);
+          return;
+        }
+        t = setTimeout(() => r.resolve(c), e), i = v.receiveChannel.once(
+          "user.credentials",
+          (o) => {
+            r.resolve(E(o) || c);
+          }
+        );
+        try {
+          s.postMessage({
+            command: "user.getCredentials",
+            parameters: JSON.stringify({
+              timestamp: Date.now(),
+              endpoint: "user.credentials"
+            })
+          });
+        } catch {
+          r.resolve(c);
+        }
+      }
+    })();
+  });
+}
+function z(e = f) {
+  return new Promise((n) => {
+    const t = I();
+    if (!w() || !t) {
+      n(c);
+      return;
+    }
+    const i = setTimeout(() => {
+      window.removeEventListener("message", r), n(c);
+    }, e), r = (s) => {
+      if (!U(s, t) || s.data.type !== "user-credentials-response")
+        return;
+      const o = E(s.data);
+      o && (clearTimeout(i), window.removeEventListener("message", r), n(o));
+    };
+    window.addEventListener("message", r);
+    try {
+      window.parent.postMessage(
+        { type: "user-credentials-request", timestamp: Date.now() },
+        t
+      );
+    } catch {
+      clearTimeout(i), window.removeEventListener("message", r), n(c);
+    }
+  });
+}
+const G = () => /Aippy\/[\d.]+\/\d+\/Android/i.test(navigator.userAgent);
+async function M(e = 1500) {
+  if (!G())
+    return window.webkit?.messageHandlers?.aippyListener || null;
+  const n = Date.now();
+  for (; Date.now() - n < e; ) {
+    const t = window.webkit?.messageHandlers?.aippyListener;
+    if (t) return t;
+    await new Promise((i) => setTimeout(i, 50));
+  }
+  return null;
+}
+function W(e = !1, n = f) {
+  return h && l && !e ? Promise.resolve(l) : u ? new Promise((t) => {
+    const i = u.resolve;
+    u.resolve = (r) => {
+      i(r), t(r);
+    };
+  }) : new Promise((t) => {
+    let i, r;
+    const s = {
+      resolve: (o) => {
+        clearTimeout(i), r?.cancel(), u === s && (u = null), t(o);
+      }
+    };
+    u = s, (async () => {
+      let o = window.webkit?.messageHandlers?.aippyListener;
+      if (o || (o = await M(1500)), u === s) {
+        if (!o) {
+          s.resolve(null);
+          return;
+        }
+        i = setTimeout(() => s.resolve(null), n), r = v.receiveChannel.once("user.info", (B) => {
+          s.resolve(T(B));
+        });
+        try {
+          o.postMessage({
+            command: "user.getUserInfo",
+            parameters: JSON.stringify({
+              timestamp: Date.now(),
+              endpoint: "user.info"
+            })
+          });
+        } catch {
+          s.resolve(null);
+        }
+      }
+    })();
+  });
+}
+function C(e = f) {
+  return new Promise((n) => {
+    const t = I();
+    if (!w() || !t) {
+      n(null);
+      return;
+    }
+    const i = setTimeout(() => {
+      window.removeEventListener("message", r), n(null);
+    }, e), r = (s) => {
+      if (!U(s, t) || s.data.type !== "user-info-response")
+        return;
+      const o = T(s.data);
+      o && (clearTimeout(i), window.removeEventListener("message", r), n(o));
+    };
+    window.addEventListener("message", r);
+    try {
+      window.parent.postMessage(
+        { type: "user-info-request", timestamp: Date.now() },
+        t
+      );
+    } catch {
+      clearTimeout(i), window.removeEventListener("message", r), n(null);
+    }
+  });
+}
+async function R() {
+  const { envCheck: e } = b("userCredentials");
+  switch (e.type) {
+    case "new_app": {
+      const n = await x(O);
+      if (!n?.token)
+        throw A(
+          "Token unavailable in app",
+          _.PERMISSION_DENIED
+        );
+      return n.token;
+    }
+    case "iframe": {
+      const n = await z(L);
+      if (n?.token) return n.token;
+      throw q(
+        "Sign in to continue.Open this project in the app.",
+        "signin"
+      ), A(
+        "Token unavailable: User needs to login",
+        _.PERMISSION_DENIED
+      );
+    }
+    default:
+      return "";
+  }
+}
+async function X(e = !1) {
+  if (h && l && !e)
+    return l;
+  const { envCheck: n } = b("userInfo");
+  switch (n.type) {
+    case "new_app":
+      return await W(e, O);
+    case "iframe":
+      return await C(L);
+    default:
+      return l;
+  }
+}
+async function Y(e = f) {
+  return w() ? await C(e) : null;
+}
+function g(e) {
+  const n = E(e);
+  n && a && (a.resolve(n), a = null);
+}
+function y(e) {
+  const n = T(e);
+  u && (u.resolve(n), u = null);
+}
+function $() {
+  typeof window > "u" || (window.processUserCredentials = g, window.processUserInfo = y, window.addEventListener("message", (e) => {
+    N(e) && (e.data.type === "user-credentials" && g(e.data), e.data.type === "user-info" && y(e.data));
+  }));
+}
+$();
+R().catch(() => {
+});
+const re = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  getAuthTokenAsync: R,
+  getUserInfoAsync: X,
+  getUserInfoFromParent: Y,
+  isInIframe: w,
+  processUserCredentials: g,
+  processUserInfo: y
+}, Symbol.toStringTag, { value: "Module" }));
+export {
+  ne as _,
+  I as a,
+  ee as b,
+  te as c,
+  re as d,
+  R as g,
+  U as i,
+  j as r
+};

package/dist/container-message-DmIChz4h.js

@@ -0,0 +1,56 @@
+import { g as o, a as i } from "./bridge-D_-7nPNC.js";
+const r = "0.4.2-dev.4", c = {
+  version: r
+}, a = c.version, p = "@aippy/runtime";
+function u() {
+  return {
+    name: p,
+    version: a,
+    buildTime: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function g(n) {
+  const { token: t, existingHeaders: s } = n, e = new Headers(s);
+  return e.set("Aippy-Runtime-Authorization", `Bearer ${t}`), e.set("Aippy-Runtime-SDK-Version", a), typeof navigator < "u" && navigator.userAgent && e.set("Aippy-Runtime-UA", navigator.userAgent), e;
+}
+async function m(n) {
+  const t = await o();
+  return g({ token: t, existingHeaders: n });
+}
+function y(n) {
+  if (!(typeof window > "u"))
+    try {
+      const t = window.webkit?.messageHandlers?.aippyListener;
+      if (t)
+        try {
+          const e = {
+            command: "container.message",
+            parameters: n
+          };
+          t.postMessage(e);
+        } catch {
+          console.warn("Failed to send container message to the native host");
+        }
+      const s = i();
+      if (s)
+        try {
+          const e = {
+            type: "container.message",
+            data: n
+          };
+          window.parent.postMessage(e, s);
+        } catch {
+          console.warn("Failed to send container message to the parent host");
+        }
+    } catch {
+      console.warn("Failed to send container message");
+    }
+}
+export {
+  p as S,
+  a as V,
+  m as a,
+  g as c,
+  u as g,
+  y as s
+};

package/dist/core/env.d.ts

@@ -4,6 +4,8 @@
  * All environment-specific URLs live here — no other file should
  * hardcode aippy domain strings.
  */
+/** @internal Runtime credentials may only be sent to these official API origins. */
+export declare function isTrustedApiOrigin(origin: string): boolean;
 /**
  * Resolves the API base URL at runtime by inspecting the page hostname.
  *

package/dist/core/index.js

@@ -1,7 +1,7 @@
 import { D as r, g as s, m as o } from "../config-B0A7gHQM.js";
-import { _ as t, r as i } from "../bridge-CtB9L5kL.js";
+import { _ as t, r as i } from "../bridge-D_-7nPNC.js";
 import { A as R, a as E, E as c, b as m, c as A } from "../errors-B3bDbQbD.js";
-import { S as f, V as g, c as l, a as y, g as _, s as d } from "../container-message-D1_iPvJX.js";
+import { S as f, V as g, c as l, a as y, g as _, s as d } from "../container-message-DmIChz4h.js";
 import { A as D, C as O, R as F, a as I, p as S } from "../runtime-CmoG3v2m.js";
 export {
   D as AippyRuntime,

package/dist/core/parent-message.d.ts

@@ -0,0 +1,5 @@
+/** Browser-observed parent origin; never trust an origin supplied in a message. */
+export declare function getParentOrigin(): string | undefined;
+export declare function isParentMessage(event: MessageEvent, origin?: string | undefined): boolean;
+/** Preserve native self-postMessage callbacks, but reject sibling/foreign frames. */
+export declare function isHostMessage(event: MessageEvent): boolean;

package/dist/core/wallet-recharge.d.ts

@@ -0,0 +1,16 @@
+/** Shared native recharge sheet tracking. No payment or balance is inferred here. */
+export declare const WALLET_SHOW_RECHARGE = "wallet.showRecharge";
+type Failure = 'unavailable' | 'busy' | 'cancelled' | 'timeout' | 'protocol' | 'bridge';
+export declare class WalletRechargeError extends Error {
+    readonly type: Failure;
+    constructor(type: Failure, message: string);
+}
+/** AI keeps fire-and-forget behavior, but shares the sheet lifecycle with MiniStore. */
+export declare function showNativeRecharge(): void;
+/**
+ * At most one continuation owns a sheet. AI-only sheets may be joined.
+ * After timeout/abort, retain a drain-only listener until closed: no requestId
+ * exists, so opening another sheet earlier could mistake an old result for it.
+ */
+export declare function waitForNativeRecharge(signal?: AbortSignal): Promise<boolean>;
+export {};