@aiworkbench/vibe-bridge 0.0.3 → 0.0.5

package/dist/components/VibeHost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"VibeHost.d.ts","sourceRoot":"","sources":["../../src/components/VibeHost.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAiFnD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,2CAiB5C"}
+{"version":3,"file":"VibeHost.d.ts","sourceRoot":"","sources":["../../src/components/VibeHost.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAkFnD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,2CAiB5C"}

package/dist/core/loader.d.ts

@@ -1,3 +1,35 @@
-export declare function loadScript(src: string): Promise<void>;
+/**
+ * Register shared dependencies that mini-app bundles may import as bare
+ * specifiers. Call this once at app startup, *before* any VibeHost renders.
+ *
+ * Example:
+ *   setSharedDependencies({
+ *     "react":            "https://esm.sh/react@19",
+ *     "react/jsx-runtime":"https://esm.sh/react@19/jsx-runtime",
+ *     "react-dom":        "https://esm.sh/react-dom@19",
+ *     "react-dom/client":  "https://esm.sh/react-dom@19/client",
+ *   });
+ */
+export declare function setSharedDependencies(deps: Record<string, string>): void;
+/**
+ * Configure the set of trusted origins for mini-app bundles.
+ * Call this once at app startup before any VibeHost renders.
+ *
+ * Example:
+ *   setAllowedOrigins([
+ *     "https://vibedevstore.blob.core.windows.net",
+ *     "https://vibestagingstore.blob.core.windows.net",
+ *   ]);
+ */
+export declare function setAllowedOrigins(origins: string[]): void;
+export interface LoadScriptOptions {
+    /** SRI integrity hash (e.g. "sha384-..."). If provided, the browser will
+     *  refuse to execute the script if the content doesn't match. */
+    integrity?: string;
+    /** CORS setting for the script. Required for SRI on cross-origin scripts.
+     *  Defaults to "anonymous" when integrity is provided. */
+    crossOrigin?: string;
+}
+export declare function loadScript(src: string, options?: LoadScriptOptions): Promise<void>;
 export declare function waitForElement(tagName: string): Promise<void>;
 //# sourceMappingURL=loader.d.ts.map

package/dist/core/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/core/loader.ts"],"names":[],"mappings":"AAmBA,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BrD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/core/loader.ts"],"names":[],"mappings":"AAoBA;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CASxE;AAgBD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAQzD;AAwBD,MAAM,WAAW,iBAAiB;IAChC;qEACiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;8DAC0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7D"}

package/dist/core/types.d.ts

@@ -5,6 +5,10 @@ export interface VibeHostProps {
     manifest: VibeManifest;
     /** URL to the built JS bundle for the mini-app. */
     src: string;
+    /** SRI integrity hash (e.g. "sha384-...") from the registry entry.
+     *  When provided, the browser refuses to execute the script if the
+     *  content doesn't match — preventing tampered bundles from running. */
+    integrity?: string;
     /** Shown while the script loads and custom element registers. */
     fallback?: ReactNode;
     /** Shown when the script fails to load or the element fails to mount. */

package/dist/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EACZ,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,YAAY,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,EAAE,YAAY,CAAC;IACvB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,yEAAyE;IACzE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC;IAC5C,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrC,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,sCAAsC;IACtC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,SAAS,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACvC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,MAAM,EACN,YAAY,EACZ,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,aAAa,EACb,YAAY,EACb,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,EAAE,YAAY,CAAC;IACvB,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ;;4EAEwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,yEAAyE;IACzE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC;IAC5C,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACrC,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,sCAAsC;IACtC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,SAAS,CAAC;IACf,UAAU,EAAE,gBAAgB,CAAC;IAC7B,KAAK,EAAE,WAAW,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,SAAS,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACvC"}

package/dist/hooks/useVibeLoader.d.ts

@@ -1,3 +1,3 @@
 import type { UseVibeLoaderResult } from "../core/types";
-export declare function useVibeLoader(src: string, tagName: string): UseVibeLoaderResult;
+export declare function useVibeLoader(src: string, tagName: string, integrity?: string): UseVibeLoaderResult;
 //# sourceMappingURL=useVibeLoader.d.ts.map

package/dist/hooks/useVibeLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useVibeLoader.d.ts","sourceRoot":"","sources":["../../src/hooks/useVibeLoader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAgB,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEvE,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,mBAAmB,CAkCrB"}
+{"version":3,"file":"useVibeLoader.d.ts","sourceRoot":"","sources":["../../src/hooks/useVibeLoader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAgB,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEvE,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,mBAAmB,CAkCrB"}

package/dist/index.d.ts

@@ -12,6 +12,7 @@ export { createStorageAdapter } from "./adapters/storage";
 export { createEventsAdapter } from "./adapters/events";
 export { filterByPermissions } from "./core/permissions";
 export { getEventBus, emitEvent } from "./core/event-bus";
+export { setAllowedOrigins, setSharedDependencies } from "./core/loader";
 export type { VibeHostProps, AdapterOverrides, LoaderStatus, UseVibeLoaderResult, } from "./core/types";
 export type { AuthAdapterDeps } from "./adapters/auth";
 export type { ApiAdapterDeps } from "./adapters/api";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGnE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG1D,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAGnE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGzE,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -7,6 +7,31 @@ import { useState, useEffect } from "react";
 // src/core/loader.ts
 var loadedScripts = new Set;
 var ALLOWED_PROTOCOLS = new Set(["https:", "http:"]);
+var allowedOrigins = null;
+var sharedDeps = null;
+var importMapInjected = false;
+function setSharedDependencies(deps) {
+  if (importMapInjected) {
+    console.warn("[vibe-bridge] setSharedDependencies() called after an import map " + "was already injected. The new entries will be ignored.");
+    return;
+  }
+  sharedDeps = { ...deps };
+}
+function ensureImportMap() {
+  if (importMapInjected || !sharedDeps)
+    return;
+  const script = document.createElement("script");
+  script.type = "importmap";
+  script.textContent = JSON.stringify({ imports: sharedDeps });
+  document.head.appendChild(script);
+  importMapInjected = true;
+}
+function setAllowedOrigins(origins) {
+  allowedOrigins = new Set(origins.map((o) => {
+    const url = new URL(o);
+    return url.origin;
+  }));
+}
 function validateScriptSrc(src) {
   let url;
   try {
@@ -17,9 +42,12 @@ function validateScriptSrc(src) {
   if (!ALLOWED_PROTOCOLS.has(url.protocol)) {
     return `Refused to load vibe app script with disallowed protocol "${url.protocol}": ${src}`;
   }
+  if (allowedOrigins && !allowedOrigins.has(url.origin)) {
+    return `Refused to load vibe app script from untrusted origin "${url.origin}": ${src}. ` + `Allowed origins: ${[...allowedOrigins].join(", ")}`;
+  }
   return null;
 }
-function loadScript(src) {
+function loadScript(src, options) {
   const validationError = validateScriptSrc(src);
   if (validationError) {
     return Promise.reject(new Error(validationError));
@@ -37,13 +65,19 @@ function loadScript(src) {
     const script = document.createElement("script");
     script.type = "module";
     script.src = src;
+    if (options?.integrity) {
+      script.integrity = options.integrity;
+      script.crossOrigin = options.crossOrigin ?? "anonymous";
+    }
     script.onload = () => {
       loadedScripts.add(src);
       resolve();
     };
     script.onerror = () => {
-      reject(new Error(`Failed to load vibe app script: ${src}`));
+      const integrityHint = options?.integrity ? " This may be an SRI integrity mismatch — the bundle content doesn't match the expected hash." : "";
+      reject(new Error(`Failed to load vibe app script: ${src}.${integrityHint}`));
     };
+    ensureImportMap();
     document.head.appendChild(script);
   });
 }
@@ -57,14 +91,14 @@ function waitForElement(tagName) {
 }
 
 // src/hooks/useVibeLoader.ts
-function useVibeLoader(src, tagName) {
+function useVibeLoader(src, tagName, integrity) {
   const [status, setStatus] = useState("loading");
   const [error, setError] = useState(null);
   useEffect(() => {
     let cancelled = false;
     setStatus("loading");
     setError(null);
-    loadScript(src).then(() => waitForElement(tagName)).then(() => {
+    loadScript(src, integrity ? { integrity } : undefined).then(() => waitForElement(tagName)).then(() => {
       if (!cancelled) {
         setStatus("ready");
       }
@@ -78,7 +112,7 @@ function useVibeLoader(src, tagName) {
     return () => {
       cancelled = true;
     };
-  }, [src, tagName]);
+  }, [src, tagName, integrity]);
   return { status, error };
 }
 
@@ -339,6 +373,7 @@ import { jsxDEV, Fragment } from "react/jsx-dev-runtime";
 function VibeHostInner({
   manifest,
   src,
+  integrity,
   fallback,
   errorFallback,
   adapters,
@@ -350,7 +385,7 @@ function VibeHostInner({
   const containerRef = useRef(null);
   const elementRef = useRef(null);
   const readyFiredRef = useRef(false);
-  const { status, error: loadError } = useVibeLoader(src, manifest.id);
+  const { status, error: loadError } = useVibeLoader(src, manifest.id, integrity);
   const bridge = useVibeBridge({
     appId: manifest.id,
     permissions: manifest.permissions,
@@ -435,6 +470,8 @@ export {
   useVibeLoader,
   useVibeEvents,
   useVibeBridge,
+  setSharedDependencies,
+  setAllowedOrigins,
   getEventBus,
   filterByPermissions,
   emitEvent,

package/package.json

@@ -1,13 +1,12 @@
 {
   "name": "@aiworkbench/vibe-bridge",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "publishConfig": { "access": "public" },
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
     ".": {
-      "bun": "./src/index.ts",
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     }
@@ -19,9 +18,9 @@
     "clean": "rm -rf dist",
     "prepublishOnly": "bun run build"
   },
-  "files": ["dist", "src"],
+  "files": ["dist"],
   "dependencies": {
-    "@aiworkbench/vibe-types": "^0.0.3"
+    "@aiworkbench/vibe-types": "^0.0.4"
   },
   "peerDependencies": {
     "react": "^19.0.0",

package/src/adapters/api.ts

@@ -1,24 +0,0 @@
-import type { ApiBridge } from "@aiworkbench/vibe-types";
-
-export interface ApiAdapterDeps {
-  getToken: () => Promise<string>;
-}
-
-export function createApiAdapter(deps: ApiAdapterDeps): ApiBridge {
-  return {
-    async fetch(endpoint: string, options?: RequestInit): Promise<Response> {
-      const url = endpoint.startsWith("/api/")
-        ? endpoint
-        : `/api/${endpoint.replace(/^\//, "")}`;
-
-      const token = await deps.getToken();
-      const headers = new Headers(options?.headers);
-      headers.set("Authorization", `Bearer ${token}`);
-
-      return globalThis.fetch(url, {
-        ...options,
-        headers,
-      });
-    },
-  };
-}

package/src/adapters/auth.ts

@@ -1,28 +0,0 @@
-import type { AuthBridge, BridgeUser } from "@aiworkbench/vibe-types";
-
-export interface AuthAdapterDeps {
-  session: {
-    user?: { name?: string | null; email?: string | null } | null;
-    idToken?: string;
-  } | null;
-}
-
-export function createAuthAdapter(deps: AuthAdapterDeps): AuthBridge {
-  return {
-    getUser(): BridgeUser {
-      const user = deps.session?.user;
-      return {
-        id: user?.email ?? "unknown",
-        name: user?.name ?? "Unknown User",
-        email: user?.email ?? undefined,
-      };
-    },
-    async getToken(): Promise<string> {
-      const token = deps.session?.idToken;
-      if (!token) {
-        throw new Error("No authentication token available.");
-      }
-      return token;
-    },
-  };
-}

package/src/adapters/events.ts

@@ -1,16 +0,0 @@
-import type { EventsBridge, EventPayload } from "@aiworkbench/vibe-types";
-import { emitEvent, onEvent, onceEvent } from "../core/event-bus";
-
-export function createEventsAdapter(appId: string): EventsBridge {
-  return {
-    emit(event: string, payload?: EventPayload): void {
-      emitEvent(event, payload ?? {}, appId);
-    },
-    on(event: string, handler: (payload: EventPayload) => void): () => void {
-      return onEvent(event, (detail) => handler(detail.payload));
-    },
-    once(event: string, handler: (payload: EventPayload) => void): () => void {
-      return onceEvent(event, (detail) => handler(detail.payload));
-    },
-  };
-}

package/src/adapters/navigation.ts

@@ -1,21 +0,0 @@
-import type { NavigationBridge } from "@aiworkbench/vibe-types";
-
-export interface NavigationAdapterDeps {
-  push: (path: string) => void;
-}
-
-export function createNavigationAdapter(
-  deps: NavigationAdapterDeps,
-): NavigationBridge {
-  return {
-    navigate(path: string): void {
-      // Block external URLs and javascript: protocol
-      if (/^https?:\/\//i.test(path) || /^javascript:/i.test(path)) {
-        throw new Error(
-          `Navigation to external URLs is not allowed: ${path}`,
-        );
-      }
-      deps.push(path);
-    },
-  };
-}

package/src/adapters/storage.ts

@@ -1,27 +0,0 @@
-import type { StorageBridge } from "@aiworkbench/vibe-types";
-
-export function createStorageAdapter(appId: string): StorageBridge {
-  const prefix = `vibe:${appId}:`;
-
-  return {
-    async get(key: string): Promise<string | null> {
-      return localStorage.getItem(`${prefix}${key}`);
-    },
-    async set(key: string, value: string): Promise<void> {
-      localStorage.setItem(`${prefix}${key}`, value);
-    },
-    async remove(key: string): Promise<void> {
-      localStorage.removeItem(`${prefix}${key}`);
-    },
-    async keys(): Promise<string[]> {
-      const result: string[] = [];
-      for (let i = 0; i < localStorage.length; i++) {
-        const k = localStorage.key(i);
-        if (k?.startsWith(prefix)) {
-          result.push(k.slice(prefix.length));
-        }
-      }
-      return result;
-    },
-  };
-}

package/src/adapters/theme.ts

@@ -1,24 +0,0 @@
-import type { ThemeBridge } from "@aiworkbench/vibe-types";
-
-export function createThemeAdapter(): ThemeBridge {
-  return {
-    current(): "light" | "dark" {
-      // Check <html> class for Tailwind dark mode convention
-      const html = document.documentElement;
-      if (html.classList.contains("dark")) return "dark";
-      if (html.classList.contains("light")) return "light";
-
-      // Check data-theme attribute
-      const dataTheme = html.getAttribute("data-theme");
-      if (dataTheme === "dark") return "dark";
-      if (dataTheme === "light") return "light";
-
-      // Fallback to prefers-color-scheme media query
-      if (globalThis.matchMedia?.("(prefers-color-scheme: dark)").matches) {
-        return "dark";
-      }
-
-      return "light";
-    },
-  };
-}

package/src/adapters/toast.ts

@@ -1,34 +0,0 @@
-import type { ToastBridge } from "@aiworkbench/vibe-types";
-
-export interface ToastAdapterDeps {
-  toast: {
-    (message: string): void;
-    success: (message: string) => void;
-    error: (message: string) => void;
-    info: (message: string) => void;
-  };
-}
-
-export function createToastAdapter(deps: ToastAdapterDeps): ToastBridge {
-  return {
-    show(
-      message: string,
-      options?: { type?: "info" | "success" | "error" },
-    ): void {
-      const type = options?.type ?? "info";
-      switch (type) {
-        case "success":
-          deps.toast.success(message);
-          break;
-        case "error":
-          deps.toast.error(message);
-          break;
-        case "info":
-          deps.toast.info(message);
-          break;
-        default:
-          deps.toast(message);
-      }
-    },
-  };
-}

package/src/components/VibeErrorBoundary.tsx

@@ -1,36 +0,0 @@
-import { Component, type ReactNode, type ErrorInfo } from "react";
-
-interface VibeErrorBoundaryProps {
-  fallback: (error: Error) => ReactNode;
-  onError?: (error: Error) => void;
-  children: ReactNode;
-}
-
-interface VibeErrorBoundaryState {
-  error: Error | null;
-}
-
-export class VibeErrorBoundary extends Component<
-  VibeErrorBoundaryProps,
-  VibeErrorBoundaryState
-> {
-  constructor(props: VibeErrorBoundaryProps) {
-    super(props);
-    this.state = { error: null };
-  }
-
-  static getDerivedStateFromError(error: Error): VibeErrorBoundaryState {
-    return { error };
-  }
-
-  componentDidCatch(error: Error, _info: ErrorInfo): void {
-    this.props.onError?.(error);
-  }
-
-  render(): ReactNode {
-    if (this.state.error) {
-      return this.props.fallback(this.state.error);
-    }
-    return this.props.children;
-  }
-}

package/src/components/VibeHost.tsx

@@ -1,104 +0,0 @@
-import { useRef, useEffect, useCallback } from "react";
-import type { Bridge } from "@aiworkbench/vibe-types";
-import { useVibeLoader } from "../hooks/useVibeLoader";
-import { useVibeBridge } from "../hooks/useVibeBridge";
-import { VibeErrorBoundary } from "./VibeErrorBoundary";
-import type { VibeHostProps } from "../core/types";
-
-interface VibeElementInstance extends HTMLElement {
-  bridge: Bridge;
-}
-
-function VibeHostInner({
-  manifest,
-  src,
-  fallback,
-  errorFallback,
-  adapters,
-  onReady,
-  onError,
-  className,
-  style,
-}: VibeHostProps) {
-  const containerRef = useRef<HTMLDivElement>(null);
-  const elementRef = useRef<VibeElementInstance | null>(null);
-  const readyFiredRef = useRef(false);
-
-  const { status, error: loadError } = useVibeLoader(src, manifest.id);
-
-  const bridge = useVibeBridge({
-    appId: manifest.id,
-    permissions: manifest.permissions,
-    overrides: adapters,
-  });
-
-  // Handle load errors
-  useEffect(() => {
-    if (loadError) {
-      onError?.(loadError);
-    }
-  }, [loadError, onError]);
-
-  // Mount the custom element once it's defined
-  useEffect(() => {
-    const container = containerRef.current;
-    if (status !== "ready" || !container) return;
-
-    // Create and mount the custom element
-    const el = document.createElement(manifest.id) as VibeElementInstance;
-    el.bridge = bridge;
-    container.appendChild(el);
-    elementRef.current = el;
-
-    if (!readyFiredRef.current) {
-      readyFiredRef.current = true;
-      onReady?.();
-    }
-
-    return () => {
-      if (container.contains(el)) {
-        container.removeChild(el);
-      }
-      elementRef.current = null;
-    };
-  }, [status, manifest.id]);
-
-  // Re-inject bridge when it changes (session/theme updates)
-  useEffect(() => {
-    if (elementRef.current) {
-      elementRef.current.bridge = bridge;
-    }
-  }, [bridge]);
-
-  if (status === "error" && loadError) {
-    if (errorFallback) {
-      return <>{errorFallback(loadError)}</>;
-    }
-    return null;
-  }
-
-  if (status === "loading") {
-    return <>{fallback ?? null}</>;
-  }
-
-  return <div ref={containerRef} className={className} style={style} />;
-}
-
-export function VibeHost(props: VibeHostProps) {
-  const defaultErrorFallback = useCallback(
-    (error: Error) => {
-      props.onError?.(error);
-      if (props.errorFallback) {
-        return <>{props.errorFallback(error)}</>;
-      }
-      return null;
-    },
-    [props.onError, props.errorFallback],
-  );
-
-  return (
-    <VibeErrorBoundary fallback={defaultErrorFallback} onError={props.onError}>
-      <VibeHostInner {...props} />
-    </VibeErrorBoundary>
-  );
-}

package/src/core/event-bus.ts

@@ -1,60 +0,0 @@
-const VIBE_EVENT_PREFIX = "vibe:";
-
-export interface VibeEventDetail {
-  payload: Record<string, unknown>;
-  sourceAppId: string;
-}
-
-let sharedBus: EventTarget | null = null;
-
-export function getEventBus(): EventTarget {
-  if (!sharedBus) {
-    sharedBus = new EventTarget();
-  }
-  return sharedBus;
-}
-
-export function prefixedEventName(event: string): string {
-  if (event.startsWith(VIBE_EVENT_PREFIX)) {
-    return event;
-  }
-  return `${VIBE_EVENT_PREFIX}${event}`;
-}
-
-export function emitEvent(
-  event: string,
-  payload: Record<string, unknown>,
-  sourceAppId: string,
-): void {
-  const bus = getEventBus();
-  const detail: VibeEventDetail = { payload, sourceAppId };
-  bus.dispatchEvent(
-    new CustomEvent(prefixedEventName(event), { detail }),
-  );
-}
-
-export function onEvent(
-  event: string,
-  handler: (detail: VibeEventDetail) => void,
-): () => void {
-  const bus = getEventBus();
-  const prefixed = prefixedEventName(event);
-  const listener = (e: Event) => {
-    handler((e as CustomEvent<VibeEventDetail>).detail);
-  };
-  bus.addEventListener(prefixed, listener);
-  return () => bus.removeEventListener(prefixed, listener);
-}
-
-export function onceEvent(
-  event: string,
-  handler: (detail: VibeEventDetail) => void,
-): () => void {
-  const bus = getEventBus();
-  const prefixed = prefixedEventName(event);
-  const listener = (e: Event) => {
-    handler((e as CustomEvent<VibeEventDetail>).detail);
-  };
-  bus.addEventListener(prefixed, listener, { once: true });
-  return () => bus.removeEventListener(prefixed, listener);
-}

package/src/core/loader.ts

@@ -1,57 +0,0 @@
-const loadedScripts = new Set<string>();
-
-const ALLOWED_PROTOCOLS = new Set(["https:", "http:"]);
-
-function validateScriptSrc(src: string): string | null {
-  let url: URL;
-  try {
-    url = new URL(src, window.location.href);
-  } catch {
-    return `Invalid vibe app script URL: ${src}`;
-  }
-
-  if (!ALLOWED_PROTOCOLS.has(url.protocol)) {
-    return `Refused to load vibe app script with disallowed protocol "${url.protocol}": ${src}`;
-  }
-
-  return null;
-}
-
-export function loadScript(src: string): Promise<void> {
-  const validationError = validateScriptSrc(src);
-  if (validationError) {
-    return Promise.reject(new Error(validationError));
-  }
-
-  if (loadedScripts.has(src)) {
-    return Promise.resolve();
-  }
-
-  return new Promise((resolve, reject) => {
-    const existing = document.querySelector(`script[src="${CSS.escape(src)}"]`);
-    if (existing) {
-      loadedScripts.add(src);
-      resolve();
-      return;
-    }
-
-    const script = document.createElement("script");
-    script.type = "module";
-    script.src = src;
-    script.onload = () => {
-      loadedScripts.add(src);
-      resolve();
-    };
-    script.onerror = () => {
-      reject(new Error(`Failed to load vibe app script: ${src}`));
-    };
-    document.head.appendChild(script);
-  });
-}
-
-export function waitForElement(tagName: string): Promise<void> {
-  if (customElements.get(tagName)) {
-    return Promise.resolve();
-  }
-  return customElements.whenDefined(tagName).then(() => undefined);
-}

package/src/core/permissions.ts

@@ -1,41 +0,0 @@
-import type { Bridge, BridgeCapability } from "@aiworkbench/vibe-types";
-
-function createDeniedProxy(capability: string): unknown {
-  return new Proxy(
-    {},
-    {
-      get(_target, prop) {
-        if (typeof prop === "symbol") return undefined;
-        throw new Error(
-          `Access denied: ${capability}.${prop} is not permitted. Add '${capability}' to your manifest.json permissions.`,
-        );
-      },
-    },
-  );
-}
-
-export function filterByPermissions(
-  bridge: Bridge,
-  permissions: BridgeCapability[],
-): Bridge {
-  const allCapabilities: BridgeCapability[] = [
-    "auth",
-    "api",
-    "navigation",
-    "theme",
-    "toast",
-    "storage",
-    "events",
-  ];
-
-  const filtered = {} as Record<string, unknown>;
-  for (const cap of allCapabilities) {
-    if (permissions.includes(cap)) {
-      filtered[cap] = bridge[cap];
-    } else {
-      filtered[cap] = createDeniedProxy(cap);
-    }
-  }
-
-  return filtered as unknown as Bridge;
-}

package/src/core/types.ts

@@ -1,54 +0,0 @@
-import type {
-  Bridge,
-  VibeManifest,
-  AuthBridge,
-  ApiBridge,
-  NavigationBridge,
-  ThemeBridge,
-  ToastBridge,
-  StorageBridge,
-  EventsBridge,
-} from "@aiworkbench/vibe-types";
-import type { ReactNode, CSSProperties } from "react";
-
-export interface VibeHostProps {
-  /** The mini-app manifest describing its id, permissions, etc. */
-  manifest: VibeManifest;
-  /** URL to the built JS bundle for the mini-app. */
-  src: string;
-  /** Shown while the script loads and custom element registers. */
-  fallback?: ReactNode;
-  /** Shown when the script fails to load or the element fails to mount. */
-  errorFallback?: (error: Error) => ReactNode;
-  /** Optional overrides per capability adapter. */
-  adapters?: Partial<AdapterOverrides>;
-  /** Fires when the custom element is mounted and bridge is injected. */
-  onReady?: () => void;
-  /** Fires on load or mount failure. */
-  onError?: (error: Error) => void;
-  className?: string;
-  style?: CSSProperties;
-}
-
-export interface AdapterOverrides {
-  auth: AuthBridge;
-  api: ApiBridge;
-  navigation: NavigationBridge;
-  theme: ThemeBridge;
-  toast: ToastBridge;
-  storage: StorageBridge;
-  events: EventsBridge;
-}
-
-export type LoaderStatus = "loading" | "ready" | "error";
-
-export interface UseVibeLoaderResult {
-  status: LoaderStatus;
-  error: Error | null;
-}
-
-export interface UseVibeBridgeOptions {
-  appId: string;
-  permissions: Bridge extends infer B ? (keyof B)[] : never;
-  overrides?: Partial<AdapterOverrides>;
-}

package/src/hooks/useVibeBridge.ts

@@ -1,49 +0,0 @@
-import { useMemo } from "react";
-import type { Bridge, BridgeCapability } from "@aiworkbench/vibe-types";
-import { useSession } from "next-auth/react";
-import { useRouter } from "next/navigation";
-import { toast } from "sonner";
-import { createAuthAdapter } from "../adapters/auth";
-import { createApiAdapter } from "../adapters/api";
-import { createNavigationAdapter } from "../adapters/navigation";
-import { createThemeAdapter } from "../adapters/theme";
-import { createToastAdapter } from "../adapters/toast";
-import { createStorageAdapter } from "../adapters/storage";
-import { createEventsAdapter } from "../adapters/events";
-import { filterByPermissions } from "../core/permissions";
-import type { AdapterOverrides } from "../core/types";
-
-export interface UseVibeBridgeOptions {
-  appId: string;
-  permissions: BridgeCapability[];
-  overrides?: Partial<AdapterOverrides>;
-}
-
-export function useVibeBridge(options: UseVibeBridgeOptions): Bridge {
-  const { appId, permissions, overrides } = options;
-  const { data: session } = useSession();
-  const router = useRouter();
-
-  return useMemo(() => {
-    const authAdapter =
-      overrides?.auth ?? createAuthAdapter({ session: session ?? null });
-
-    const fullBridge: Bridge = {
-      auth: authAdapter,
-      api:
-        overrides?.api ??
-        createApiAdapter({ getToken: () => authAdapter.getToken() }),
-      navigation:
-        overrides?.navigation ??
-        createNavigationAdapter({ push: (path) => router.push(path) }),
-      theme: overrides?.theme ?? createThemeAdapter(),
-      toast:
-        overrides?.toast ??
-        createToastAdapter({ toast }),
-      storage: overrides?.storage ?? createStorageAdapter(appId),
-      events: overrides?.events ?? createEventsAdapter(appId),
-    };
-
-    return filterByPermissions(fullBridge, permissions);
-  }, [session, router, appId, permissions, overrides]);
-}

package/src/hooks/useVibeEvents.ts

@@ -1,13 +0,0 @@
-import { useEffect } from "react";
-import { onEvent, type VibeEventDetail } from "../core/event-bus";
-
-export function useVibeEvents(
-  event: string,
-  handler: (payload: Record<string, unknown>, sourceAppId: string) => void,
-): void {
-  useEffect(() => {
-    return onEvent(event, (detail: VibeEventDetail) => {
-      handler(detail.payload, detail.sourceAppId);
-    });
-  }, [event, handler]);
-}

package/src/hooks/useVibeLoader.ts

@@ -1,42 +0,0 @@
-import { useState, useEffect } from "react";
-import { loadScript, waitForElement } from "../core/loader";
-import type { LoaderStatus, UseVibeLoaderResult } from "../core/types";
-
-export function useVibeLoader(
-  src: string,
-  tagName: string,
-): UseVibeLoaderResult {
-  const [status, setStatus] = useState<LoaderStatus>("loading");
-  const [error, setError] = useState<Error | null>(null);
-
-  useEffect(() => {
-    let cancelled = false;
-
-    setStatus("loading");
-    setError(null);
-
-    loadScript(src)
-      .then(() => waitForElement(tagName))
-      .then(() => {
-        if (!cancelled) {
-          setStatus("ready");
-        }
-      })
-      .catch((err: unknown) => {
-        if (!cancelled) {
-          const e =
-            err instanceof Error
-              ? err
-              : new Error(`Failed to load vibe app: ${tagName}`);
-          setError(e);
-          setStatus("error");
-        }
-      });
-
-    return () => {
-      cancelled = true;
-    };
-  }, [src, tagName]);
-
-  return { status, error };
-}

package/src/index.ts

@@ -1,33 +0,0 @@
-// Components
-export { VibeHost } from "./components/VibeHost";
-export { VibeErrorBoundary } from "./components/VibeErrorBoundary";
-
-// Hooks
-export { useVibeBridge } from "./hooks/useVibeBridge";
-export { useVibeLoader } from "./hooks/useVibeLoader";
-export { useVibeEvents } from "./hooks/useVibeEvents";
-
-// Adapter factories
-export { createAuthAdapter } from "./adapters/auth";
-export { createApiAdapter } from "./adapters/api";
-export { createNavigationAdapter } from "./adapters/navigation";
-export { createThemeAdapter } from "./adapters/theme";
-export { createToastAdapter } from "./adapters/toast";
-export { createStorageAdapter } from "./adapters/storage";
-export { createEventsAdapter } from "./adapters/events";
-
-// Core utilities
-export { filterByPermissions } from "./core/permissions";
-export { getEventBus, emitEvent } from "./core/event-bus";
-
-// Types
-export type {
-  VibeHostProps,
-  AdapterOverrides,
-  LoaderStatus,
-  UseVibeLoaderResult,
-} from "./core/types";
-export type { AuthAdapterDeps } from "./adapters/auth";
-export type { ApiAdapterDeps } from "./adapters/api";
-export type { NavigationAdapterDeps } from "./adapters/navigation";
-export type { ToastAdapterDeps } from "./adapters/toast";