@appport/sdk 1.0.1

package/node_modules/@appport/core/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,EAAuC,MAAM,mBAAmB,CAAC;AAY9F,MAAM,aAAa,GAAG,qFAAqF,CAAC;AAE5G,sDAAsD;AACtD,MAAM,UAAU,MAAM,CAAC,KAAgB,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,OAAoB,YAAY;IAC1E,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG;gBACb,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC3F,CAAC,CAAC,IAAI,CAAC,OAAO;oBACd,CAAC,CAAC,EAAE,CAAC;gBACP,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;aACrC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3G,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/node_modules/@appport/core/dist/server-internal.d.ts

@@ -0,0 +1,5 @@
+/** Private bridge used by the bundled server workspace. Not re-exported by the SDK. */
+export { AsyncChannel, type StreamExecution } from "./public.js";
+export { toWireError } from "./sanitize.js";
+export type { AppPortApplication } from "./application.js";
+//# sourceMappingURL=server-internal.d.ts.map

package/node_modules/@appport/core/dist/server-internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-internal.d.ts","sourceRoot":"","sources":["../src/server-internal.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC"}

package/node_modules/@appport/core/dist/server-internal.js

@@ -0,0 +1,4 @@
+/** Private bridge used by the bundled server workspace. Not re-exported by the SDK. */
+export { AsyncChannel } from "./public.js";
+export { toWireError } from "./sanitize.js";
+//# sourceMappingURL=server-internal.js.map

package/node_modules/@appport/core/dist/server-internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-internal.js","sourceRoot":"","sources":["../src/server-internal.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,YAAY,EAAwB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC"}

package/node_modules/@appport/core/dist/sessions.d.ts

@@ -0,0 +1,29 @@
+import { type Principal, type Session } from "@appport/protocol";
+export interface CreateSessionInput {
+    applicationId: string;
+    principal?: Principal;
+    permissions?: readonly string[];
+    ttlMs?: number;
+    attributes?: Session["attributes"];
+}
+/**
+ * Session storage (specification §36). Sessions are transport-neutral: the same
+ * session may be observed over IPC and HTTP.
+ */
+export interface SessionStore {
+    create(input: CreateSessionInput): Promise<Session>;
+    get(id: string): Promise<Session | undefined>;
+    /** Replaces a session record; used to refresh expiry or permissions. */
+    put(session: Session): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+/** In-memory session store. The default for local runtimes and tests. */
+export declare class MemorySessionStore implements SessionStore {
+    #private;
+    create(input: CreateSessionInput): Promise<Session>;
+    get(id: string): Promise<Session | undefined>;
+    put(session: Session): Promise<void>;
+    delete(id: string): Promise<void>;
+    get size(): number;
+}
+//# sourceMappingURL=sessions.d.ts.map

package/node_modules/@appport/core/dist/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjG,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9C,wEAAwE;IACxE,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,yEAAyE;AACzE,qBAAa,kBAAmB,YAAW,YAAY;;IAG/C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAenD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAU7C,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/node_modules/@appport/core/dist/sessions.js

@@ -0,0 +1,39 @@
+import { isSessionExpired, newSessionId } from "@appport/protocol";
+/** In-memory session store. The default for local runtimes and tests. */
+export class MemorySessionStore {
+    #sessions = new Map();
+    async create(input) {
+        const now = Date.now();
+        const session = {
+            id: newSessionId(),
+            applicationId: input.applicationId,
+            createdAt: new Date(now).toISOString(),
+            ...(input.principal ? { principal: input.principal } : {}),
+            ...(input.permissions ? { permissions: [...input.permissions] } : {}),
+            ...(input.ttlMs ? { expiresAt: new Date(now + input.ttlMs).toISOString() } : {}),
+            ...(input.attributes ? { attributes: input.attributes } : {})
+        };
+        this.#sessions.set(session.id, session);
+        return session;
+    }
+    async get(id) {
+        const session = this.#sessions.get(id);
+        if (!session)
+            return undefined;
+        if (isSessionExpired(session)) {
+            this.#sessions.delete(id);
+            return undefined;
+        }
+        return session;
+    }
+    async put(session) {
+        this.#sessions.set(session.id, session);
+    }
+    async delete(id) {
+        this.#sessions.delete(id);
+    }
+    get size() {
+        return this.#sessions.size;
+    }
+}
+//# sourceMappingURL=sessions.js.map

package/node_modules/@appport/core/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAgC,MAAM,mBAAmB,CAAC;AAsBjG,yEAAyE;AACzE,MAAM,OAAO,kBAAkB;IACpB,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEhD,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,YAAY,EAAE;YAClB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB;QACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/node_modules/@appport/core/dist/sha256.d.ts

@@ -0,0 +1,3 @@
+/** Small synchronous SHA-256 used for canonical protocol fingerprints in every runtime. */
+export declare function sha256(value: string): string;
+//# sourceMappingURL=sha256.d.ts.map

package/node_modules/@appport/core/dist/sha256.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.d.ts","sourceRoot":"","sources":["../src/sha256.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAsB5C"}

package/node_modules/@appport/core/dist/sha256.js

@@ -0,0 +1,46 @@
+/** Small synchronous SHA-256 used for canonical protocol fingerprints in every runtime. */
+export function sha256(value) {
+    const bytes = new TextEncoder().encode(value);
+    const length = bytes.length;
+    const padded = new Uint8Array(((length + 9 + 63) >> 6) << 6);
+    padded.set(bytes);
+    padded[length] = 0x80;
+    const bits = length * 8;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 4, bits >>> 0);
+    view.setUint32(padded.length - 8, Math.floor(bits / 0x100000000));
+    const k = [0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2];
+    const h = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+    const w = new Uint32Array(64);
+    const r = (x, n) => (x >>> n) | (x << (32 - n));
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(offset + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const a = r(w[i - 15], 7) ^ r(w[i - 15], 18) ^ (w[i - 15] >>> 3), b = r(w[i - 2], 17) ^ r(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + a + w[i - 7] + b) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let i = 0; i < 64; i++) {
+            const s1 = r(e, 6) ^ r(e, 11) ^ r(e, 25), ch = (e & f) ^ (~e & g), t1 = (hh + s1 + ch + k[i] + w[i]) >>> 0, s0 = r(a, 2) ^ r(a, 13) ^ r(a, 22), maj = (a & b) ^ (a & c) ^ (b & c), t2 = (s0 + maj) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] = (h[0] + a) >>> 0;
+        h[1] = (h[1] + b) >>> 0;
+        h[2] = (h[2] + c) >>> 0;
+        h[3] = (h[3] + d) >>> 0;
+        h[4] = (h[4] + e) >>> 0;
+        h[5] = (h[5] + f) >>> 0;
+        h[6] = (h[6] + g) >>> 0;
+        h[7] = (h[7] + hh) >>> 0;
+    }
+    return h.map(n => n.toString(16).padStart(8, "0")).join("");
+}
+//# sourceMappingURL=sha256.js.map

package/node_modules/@appport/core/dist/sha256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.js","sourceRoot":"","sources":["../src/sha256.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,CAAC,CAAC;IAC5sB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,CAAC,CAAC;IACpG,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAC,EAAE,CAAE,EAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAC,EAAE,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,GAAC,EAAE,CAAE,KAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAE,KAAG,EAAE,CAAC,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAC,EAAE,CAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACnL,IAAI,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,EAAE,GAAC,CAAC,CAAC,CAAE,EAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAE,EAAC,EAAE,CAAC,EAAE,EAAE,GAAC,CAAC,CAAE,GAAC,CAAE,CAAC,GAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,EAAE,EAAE,GAAC,CAAC,EAAG,GAAC,EAAE,GAAC,EAAE,GAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAG,CAAC,EAAE,EAAE,GAAC,CAAC,CAAC,CAAE,EAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAE,EAAC,EAAE,CAAC,EAAE,GAAG,GAAC,CAAC,CAAE,GAAC,CAAE,CAAC,GAAC,CAAC,CAAE,GAAC,CAAE,CAAC,GAAC,CAAC,CAAE,GAAC,CAAE,CAAC,EAAE,EAAE,GAAC,CAAC,EAAE,GAAC,GAAG,CAAC,KAAG,CAAC,CAAC;YAAC,EAAE,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAE,GAAC,EAAE,CAAC,KAAG,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,EAAE,GAAC,EAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC;QAClQ,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,EAAG,CAAC,KAAG,CAAC,CAAC;IAC1K,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/node_modules/@appport/core/dist/source-verification.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Source Verification (F6)
+ *
+ * A repository URL is not verification. A source becomes eligible to provide an
+ * implementation only after it establishes, together:
+ *
+ *   repository/source identity
+ *       + verified commit/ref
+ *       + appboundry.contract.json fingerprint
+ *       + runtime implementation coverage
+ *
+ * Verification is provider-neutral: `sourceType = "repository"` is the AppPort
+ * concept, and a GitHub (or any other) adapter merely populates the fields.
+ */
+import { type AppBoundryContractDocument } from "./appboundry-contract.js";
+import { type AuthoritativeContract, type ContractAttestation, type CoverageEvaluation } from "./contract-attestation.js";
+import { type RuntimeImplementationManifest } from "./runtime-manifest.js";
+/** Evidence a source presents for verification. */
+export interface RepositorySourceObservation {
+    readonly sourceType: "repository";
+    /** Provider-neutral source identity, e.g. "github/acme/tracker-history". */
+    readonly repositoryIdentity: string;
+    readonly ref?: string;
+    /** Verified commit. Without it the source is unverified by construction. */
+    readonly commitSha?: string;
+    /** Raw contents of `appboundry.contract.json`. */
+    readonly contractDocument: unknown;
+    /** Raw contents of the runtime implementation manifest. */
+    readonly runtimeManifest: unknown;
+}
+export type SourceVerificationFailure = "CONTRACT_DOCUMENT_INVALID" | "CONTRACT_DOCUMENT_NOT_A_CONTRACT" | "CONTRACT_DOCUMENT_FINGERPRINT_INVALID" | "CONTRACT_MISMATCH" | "IDENTITY_MISMATCH" | "RUNTIME_MANIFEST_INVALID" | "RUNTIME_MANIFEST_IS_A_CONTRACT" | "RUNTIME_MANIFEST_APPLICATION_MISMATCH" | "UNVERIFIED_SOURCE" | "NO_COVERED_CAPABILITY";
+/** The outcome of verifying one source observation. */
+export interface SourceVerification {
+    readonly verified: boolean;
+    readonly repositoryIdentity: string;
+    readonly ref?: string;
+    readonly verifiedCommitSha?: string;
+    readonly contract?: AppBoundryContractDocument;
+    readonly attestation?: ContractAttestation;
+    readonly runtime?: RuntimeImplementationManifest;
+    readonly coverage: CoverageEvaluation;
+    readonly failures: readonly SourceVerificationFailure[];
+    readonly reasons: readonly string[];
+}
+/**
+ * Verify a source observation against the authoritative application contract.
+ *
+ * The contract attestation and the implementation coverage are computed from
+ * two different documents on purpose: a contract mismatch can never be repaired
+ * by a runtime manifest that happens to look compatible.
+ */
+export declare function verifySourceObservation(applicationId: string, observation: RepositorySourceObservation, authoritative: AuthoritativeContract, attestedAt?: string): SourceVerification;
+//# sourceMappingURL=source-verification.d.ts.map

package/node_modules/@appport/core/dist/source-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-verification.d.ts","sourceRoot":"","sources":["../src/source-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAoE,KAAK,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAE7I,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,yBAAyB,GACjC,2BAA2B,GAC3B,kCAAkC,GAClC,uCAAuC,GACvC,mBAAmB,GACnB,mBAAmB,GACnB,0BAA0B,GAC1B,gCAAgC,GAChC,uCAAuC,GACvC,mBAAmB,GACnB,uBAAuB,CAAC;AAE5B,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,6BAA6B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAID;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,2BAA2B,EACxC,aAAa,EAAE,qBAAqB,EACpC,UAAU,GAAE,MAAiC,GAC5C,kBAAkB,CAsEpB"}

package/node_modules/@appport/core/dist/source-verification.js

@@ -0,0 +1,92 @@
+/**
+ * Source Verification (F6)
+ *
+ * A repository URL is not verification. A source becomes eligible to provide an
+ * implementation only after it establishes, together:
+ *
+ *   repository/source identity
+ *       + verified commit/ref
+ *       + appboundry.contract.json fingerprint
+ *       + runtime implementation coverage
+ *
+ * Verification is provider-neutral: `sourceType = "repository"` is the AppPort
+ * concept, and a GitHub (or any other) adapter merely populates the fields.
+ */
+import { parseAppBoundryContract } from "./appboundry-contract.js";
+import { attestAppBoundryContract, evaluateCoverage } from "./contract-attestation.js";
+import { deriveImplementationCoverage, parseRuntimeImplementationManifest } from "./runtime-manifest.js";
+const EMPTY_COVERAGE = { covered: [], undeclared: [], uncovered: [], reasons: [] };
+/**
+ * Verify a source observation against the authoritative application contract.
+ *
+ * The contract attestation and the implementation coverage are computed from
+ * two different documents on purpose: a contract mismatch can never be repaired
+ * by a runtime manifest that happens to look compatible.
+ */
+export function verifySourceObservation(applicationId, observation, authoritative, attestedAt = new Date().toISOString()) {
+    const failures = [];
+    const reasons = [];
+    if (observation.sourceType !== "repository") {
+        failures.push("UNVERIFIED_SOURCE");
+        reasons.push(`Unsupported source type "${String(observation.sourceType)}"`);
+    }
+    if (!observation.repositoryIdentity || !observation.repositoryIdentity.trim()) {
+        failures.push("UNVERIFIED_SOURCE");
+        reasons.push("A source identity is required");
+    }
+    if (!observation.commitSha || !observation.commitSha.trim()) {
+        failures.push("UNVERIFIED_SOURCE");
+        reasons.push("A verified commit is required: a source location alone is not verification");
+    }
+    let contract;
+    try {
+        contract = parseAppBoundryContract(observation.contractDocument);
+    }
+    catch (error) {
+        const code = error.code ?? "CONTRACT_DOCUMENT_INVALID";
+        failures.push(code);
+        reasons.push(error instanceof Error ? error.message : String(error));
+    }
+    let runtime;
+    try {
+        runtime = parseRuntimeImplementationManifest(observation.runtimeManifest);
+        if (runtime.applicationId !== applicationId) {
+            runtime = undefined;
+            failures.push("RUNTIME_MANIFEST_APPLICATION_MISMATCH");
+            reasons.push("The runtime implementation manifest references a different application");
+        }
+    }
+    catch (error) {
+        const code = error.code ?? "RUNTIME_MANIFEST_INVALID";
+        failures.push(code);
+        reasons.push(error instanceof Error ? error.message : String(error));
+    }
+    const attestation = contract ? attestAppBoundryContract(applicationId, contract, authoritative, attestedAt) : undefined;
+    if (attestation && attestation.status !== "verified") {
+        failures.push(attestation.status);
+        reasons.push(...attestation.reasons);
+    }
+    // Coverage is derived from the runtime manifest and validated against the
+    // authoritative contract; it is never derived from the contract document.
+    const coverage = runtime ? evaluateCoverage(deriveImplementationCoverage(runtime), authoritative) : EMPTY_COVERAGE;
+    reasons.push(...coverage.reasons);
+    // Undeclared coverage is dropped, not fatal: a source may still implement the
+    // capabilities the contract does declare (F6.6).
+    if (runtime && coverage.covered.length === 0) {
+        failures.push("NO_COVERED_CAPABILITY");
+        reasons.push("The source implements no capability declared by the application contract");
+    }
+    return {
+        verified: failures.length === 0,
+        repositoryIdentity: observation.repositoryIdentity,
+        ...(observation.ref ? { ref: observation.ref } : {}),
+        ...(observation.commitSha ? { verifiedCommitSha: observation.commitSha } : {}),
+        ...(contract ? { contract } : {}),
+        ...(attestation ? { attestation } : {}),
+        ...(runtime ? { runtime } : {}),
+        coverage,
+        failures,
+        reasons
+    };
+}
+//# sourceMappingURL=source-verification.js.map

package/node_modules/@appport/core/dist/source-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-verification.js","sourceRoot":"","sources":["../src/source-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,uBAAuB,EAAmC,MAAM,0BAA0B,CAAC;AACpG,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAIjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAsC,MAAM,uBAAuB,CAAC;AA0C7I,MAAM,cAAc,GAAuB,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAEvG;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,WAAwC,EACxC,aAAoC,EACpC,aAAqB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAE7C,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,WAAW,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,QAAgD,CAAC;IACrD,IAAI,CAAC;QACH,QAAQ,GAAG,uBAAuB,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA8C,CAAC,IAAI,IAAI,2BAA2B,CAAC;QACjG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,GAAG,kCAAkC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YAC5C,OAAO,GAAG,SAAS,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA8C,CAAC,IAAI,IAAI,0BAA0B,CAAC;QAChG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxH,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACnH,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElC,8EAA8E;IAC9E,iDAAiD;IACjD,IAAI,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;QAClD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,QAAQ;QACR,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}

package/node_modules/@appport/core/dist/state-context.d.ts

@@ -0,0 +1,312 @@
+/**
+ * Application State Context & Transaction (PR27)
+ *
+ * Establishes the invariant:
+ * WASM execution is ephemeral; application state is durable.
+ *
+ * The ApplicationStateContext is the contract available to one invocation.
+ * It provides typed state access with isolation, authorization, and transaction semantics.
+ *
+ * State is scoped to:
+ * - Application identity (owns the state)
+ * - Invocation identity (unique per execution)
+ * - Transaction identity (unique per invocation)
+ *
+ * State operations:
+ * - get(key): Read value, observing transaction writes
+ * - set(key, value): Write value, isolated until commit
+ * - delete(key): Remove value, isolated until commit
+ * - query(pattern): Search state by key pattern
+ *
+ * Transaction lifecycle:
+ * - OPEN: Accepts reads and writes
+ * - COMMITTED: Durable, no mutations allowed
+ * - ABORTED: Discarded, no mutations allowed
+ */
+/**
+ * Execution-facing state context for one invocation.
+ *
+ * Represents the contract between the host and guest for accessing
+ * application durable state within a transactional boundary.
+ *
+ * The context is scoped to exactly one invocation and its transaction.
+ */
+export interface ApplicationStateContext {
+    /**
+     * Unique identifier for this state context.
+     * Matches the invocation's transaction ID.
+     */
+    readonly transactionId: string;
+    /**
+     * The application that owns this state.
+     */
+    readonly applicationId: string;
+    /**
+     * The invocation accessing this state.
+     */
+    readonly invocationId: string;
+    /**
+     * Read a state value by key.
+     *
+     * Reads observe the transaction's current view:
+     * - Values written in this transaction are visible
+     * - Values from prior committed transactions are visible
+     * - Aborted transactions' writes are never visible
+     *
+     * @param key The state key to read
+     * @returns The state value, or undefined if not found
+     * @throws StateOperationError if authorization denies read
+     * @throws TransactionStateError if transaction is not OPEN
+     */
+    get(key: string): Promise<unknown>;
+    /**
+     * Write a state value by key.
+     *
+     * Writes are isolated to this transaction:
+     * - Visible to subsequent reads in this transaction
+     * - Not visible to other concurrent transactions until this commits
+     * - Discarded if this transaction aborts
+     *
+     * @param key The state key to write
+     * @param value The value to write (serializable)
+     * @throws StateOperationError if authorization denies write
+     * @throws TransactionStateError if transaction is not OPEN
+     * @throws InvalidValueError if value is not serializable
+     */
+    set(key: string, value: unknown): Promise<void>;
+    /**
+     * Delete a state value by key.
+     *
+     * Deletion is isolated to this transaction:
+     * - Subsequent reads in this transaction won't find the key
+     * - Not visible to other transactions until this commits
+     * - Discarded if this transaction aborts
+     *
+     * @param key The state key to delete
+     * @throws StateOperationError if authorization denies delete
+     * @throws TransactionStateError if transaction is not OPEN
+     */
+    delete(key: string): Promise<void>;
+    /**
+     * Query state entries by key pattern.
+     *
+     * Returns entries matching a key prefix or pattern,
+     * observing the transaction's current writes.
+     *
+     * @param pattern Key prefix or query pattern
+     * @param limit Optional result limit (default 100, max 1000)
+     * @returns Array of matching entries [{ key, value }, ...]
+     * @throws StateOperationError if authorization denies read
+     * @throws TransactionStateError if transaction is not OPEN
+     */
+    query(pattern: string, limit?: number): Promise<readonly {
+        key: string;
+        value: unknown;
+    }[]>;
+}
+/**
+ * Application state transaction lifecycle.
+ *
+ * Explicit state machine:
+ * OPEN → COMMITTED
+ *     → ABORTED
+ *
+ * Invariants:
+ * - Transition to COMMITTED or ABORTED is explicit
+ * - No implicit auto-commit
+ * - Committed transactions cannot be mutated
+ * - Aborted transactions cannot be mutated
+ * - Both commit and abort are idempotent
+ * - Transaction identity is unique per invocation
+ */
+export declare enum ApplicationStateTransactionState {
+    /**
+     * Transaction is open and accepting operations.
+     * Reads and writes are allowed.
+     */
+    OPEN = "OPEN",
+    /**
+     * Transaction has been committed durably.
+     * All writes are now visible to subsequent transactions.
+     * No further mutations are allowed.
+     */
+    COMMITTED = "COMMITTED",
+    /**
+     * Transaction has been aborted.
+     * All writes have been discarded.
+     * No further mutations are allowed.
+     */
+    ABORTED = "ABORTED"
+}
+/**
+ * Application state transaction.
+ *
+ * Represents an atomic unit of state mutations scoped to one invocation.
+ *
+ * The transaction:
+ * - Starts in OPEN state
+ * - Accepts reads and writes in OPEN state
+ * - Transitions to COMMITTED or ABORTED explicitly
+ * - Never reverts once committed or aborted
+ * - Is idempotent (commit/abort can be called multiple times safely)
+ *
+ * CRITICAL: There is no auto-commit. The host is responsible for
+ * explicit commit or abort based on execution outcome.
+ */
+export interface ApplicationStateTransaction {
+    /**
+     * Unique transaction identifier.
+     * Scoped to one invocation.
+     */
+    readonly transactionId: string;
+    /**
+     * Current transaction state.
+     */
+    readonly state: ApplicationStateTransactionState;
+    /**
+     * The application ID this transaction belongs to.
+     */
+    readonly applicationId: string;
+    /**
+     * The invocation ID this transaction serves.
+     */
+    readonly invocationId: string;
+    /**
+     * Commit this transaction durably.
+     *
+     * Transitions from OPEN to COMMITTED.
+     * All writes become visible to subsequent transactions.
+     *
+     * Effects:
+     * - OPEN state: transition to COMMITTED, persist writes
+     * - COMMITTED state: idempotent, no-op
+     * - ABORTED state: error, cannot commit after abort
+     *
+     * @returns Promise that resolves when commit is durable
+     * @throws TransactionStateError if already ABORTED
+     * @throws CommitFailureError if persistence fails
+     */
+    commit(): Promise<void>;
+    /**
+     * Abort this transaction.
+     *
+     * Transitions from OPEN to ABORTED.
+     * All writes are discarded and never visible to other transactions.
+     *
+     * Effects:
+     * - OPEN state: transition to ABORTED, discard writes
+     * - ABORTED state: idempotent, no-op
+     * - COMMITTED state: error, cannot abort after commit
+     *
+     * @returns Promise that resolves when abort is complete
+     * @throws TransactionStateError if already COMMITTED
+     */
+    abort(): Promise<void>;
+}
+/**
+ * State operation error: operation rejected by authorization or state.
+ */
+export declare class StateOperationError extends Error {
+    readonly message: string;
+    readonly code: "unauthorized" | "not_found" | "already_exists" | "invalid_key" | "other";
+    constructor(message: string, code?: "unauthorized" | "not_found" | "already_exists" | "invalid_key" | "other");
+}
+/**
+ * Transaction state error: operation attempted in wrong transaction state.
+ */
+export declare class TransactionStateError extends Error {
+    readonly currentState: ApplicationStateTransactionState;
+    readonly attemptedOperation: string;
+    constructor(currentState: ApplicationStateTransactionState, attemptedOperation: string);
+}
+/**
+ * Commit failure error: transaction commit failed.
+ */
+export declare class CommitFailureError extends Error {
+    readonly transactionId: string;
+    readonly message: string;
+    constructor(transactionId: string, message: string);
+}
+/**
+ * State capability authorization.
+ *
+ * Defines the state operations an application is authorized to perform.
+ * Authorization is checked at the host boundary before any FeltDB operation.
+ *
+ * The absence of an authorization grants deny-by-default.
+ */
+export interface StateCapabilityAuthorization {
+    /**
+     * Application can read state.
+     * Allows: get(), query()
+     */
+    readonly read?: boolean;
+    /**
+     * Application can write state.
+     * Allows: set()
+     */
+    readonly write?: boolean;
+    /**
+     * Application can delete state.
+     * Allows: delete()
+     */
+    readonly delete?: boolean;
+    /**
+     * Application can query state.
+     * Allows: query()
+     */
+    readonly query?: boolean;
+}
+/**
+ * Application state store: abstracts the durable state implementation.
+ *
+ * Stores application data (key-value pairs) that belong to applications,
+ * separate from ApplicationState (which stores app metadata/registration).
+ *
+ * The store:
+ * - Creates transactions scoped to invocations
+ * - Persists state durably
+ * - Enforces isolation between transactions
+ * - Manages transaction lifecycle
+ *
+ * Implementation examples:
+ * - FeltDbApplicationDataStore (real FeltDB)
+ * - MemoryApplicationDataStore (for testing)
+ *
+ * Do NOT implement in-memory fakes in production paths.
+ */
+export interface ApplicationDataStore {
+    /**
+     * Create a new transaction for an invocation.
+     *
+     * @param options Transaction creation options
+     * @returns A new OPEN transaction
+     */
+    createTransaction(options: CreateTransactionOptions): Promise<ApplicationStateTransaction>;
+    /**
+     * Get an existing transaction by ID.
+     *
+     * @param transactionId The transaction to retrieve
+     * @returns The transaction, or undefined if not found
+     */
+    getTransaction(transactionId: string): Promise<ApplicationStateTransaction | undefined>;
+}
+/**
+ * Options for creating a new state transaction.
+ */
+export interface CreateTransactionOptions {
+    /**
+     * The application owning this state.
+     */
+    readonly applicationId: string;
+    /**
+     * The invocation using this transaction.
+     */
+    readonly invocationId: string;
+    /**
+     * State capability authorization for this invocation.
+     * If undefined, all operations are denied.
+     */
+    readonly authorization?: StateCapabilityAuthorization;
+}
+//# sourceMappingURL=state-context.d.ts.map

package/node_modules/@appport/core/dist/state-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-context.d.ts","sourceRoot":"","sources":["../src/state-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnC;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;GAcG;AACH,oBAAY,gCAAgC;IAC1C;;;OAGG;IACH,IAAI,SAAS;IAEb;;;;OAIG;IACH,SAAS,cAAc;IAEvB;;;;OAIG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,gCAAgC,CAAC;IAEjD;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;OAcG;IACH,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExB;;;;;;;;;;;;;OAaG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAEjB,OAAO,EAAE,MAAM;aACxB,IAAI,EAAE,cAAc,GAAG,WAAW,GAAG,gBAAgB,GAAG,aAAa,GAAG,OAAO;gBADtE,OAAO,EAAE,MAAM,EACxB,IAAI,GAAE,cAAc,GAAG,WAAW,GAAG,gBAAgB,GAAG,aAAa,GAAG,OAAiB;CAK5G;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;aAE5B,YAAY,EAAE,gCAAgC;aAC9C,kBAAkB,EAAE,MAAM;gBAD1B,YAAY,EAAE,gCAAgC,EAC9C,kBAAkB,EAAE,MAAM;CAK7C;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAEzB,aAAa,EAAE,MAAM;aACZ,OAAO,EAAE,MAAM;gBADxB,aAAa,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAExB;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;CACzF;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,4BAA4B,CAAC;CACvD"}