@appport/sdk 1.1.17 → 1.1.19

package/vendor/@appport/authorization/dist/index.d.ts

@@ -1,94 +0,0 @@
-/**
- * `@appport/authorization` — the capability authorization model (§34, §37, §38).
- *
- * Authorization in AppPort operates on capabilities, never on transports.
- * A capability declares the permissions it requires; an {@link Authorizer}
- * decides whether the current principal holds them. Nothing here infers trust
- * from the transport: desktop IPC is not privileged, and HTTPS is not identity.
- */
-import { AppPortError, type CapabilityRef, type Principal, type Session } from "../../protocol/dist/index.d.ts";
-export type Permission = string;
-/**
- * Matches a permission against a granted permission, supporting `*` wildcards
- * at segment granularity: `documents.*` grants `documents.write`, and the bare
- * `*` grants everything.
- */
-export declare function permissionMatches(granted: Permission, required: Permission): boolean;
-export declare function grantsPermission(granted: Iterable<Permission>, required: Permission): boolean;
-/**
- * The authorization view handed to capability handlers (§10).
- *
- * Handlers use it for resource-level checks that the declarative capability
- * permissions cannot express ("may this principal write *this* document").
- */
-export interface AuthorizationContext {
-    readonly session?: Session;
-    readonly principal?: Principal;
-    /** Permissions effectively granted to the caller. */
-    readonly permissions: readonly Permission[];
-    has(permission: Permission): boolean;
-    hasAll(permissions: readonly Permission[]): boolean;
-    /** Throws `FORBIDDEN` (or `UNAUTHORIZED` when anonymous) if not granted. */
-    require(permission: Permission): void;
-}
-export declare function createAuthorizationContext(options: {
-    session?: Session;
-    principal?: Principal;
-    permissions?: readonly Permission[];
-}): AuthorizationContext;
-export interface AuthorizationRequest {
-    capability: CapabilityRef;
-    /** Permissions declared by the capability version. */
-    required: readonly Permission[];
-    session?: Session;
-    principal?: Principal;
-    /** Validated capability input, so policies can make resource-aware decisions. */
-    input: unknown;
-    /** Transport kind, for auditing only — never for granting trust (§37, §38). */
-    transport?: string;
-}
-export type AuthorizationDecision = {
-    allowed: true; /** Permissions to expose on the handler context. */
-    permissions?: readonly Permission[];
-} | {
-    allowed: false;
-    code: "UNAUTHORIZED" | "FORBIDDEN";
-    reason?: string;
-};
-export interface Authorizer {
-    readonly name: string;
-    authorize(request: AuthorizationRequest): AuthorizationDecision | Promise<AuthorizationDecision>;
-}
-export declare const ALLOW: AuthorizationDecision;
-export declare function deny(reason?: string, code?: "UNAUTHORIZED" | "FORBIDDEN"): AuthorizationDecision;
-/**
- * The default authorizer: the session's permission set must cover every
- * permission the capability declares.
- *
- * A capability that declares no permissions is public. A capability that
- * declares permissions with no session present fails `UNAUTHORIZED`, so clients
- * can distinguish "log in" from "not allowed".
- */
-export declare function permissionAuthorizer(options?: {
-    /** Permissions granted to every caller, authenticated or not. */
-    publicPermissions?: readonly Permission[];
-    /** Resolves additional permissions for a principal. */
-    resolvePermissions?: (request: AuthorizationRequest) => readonly Permission[] | Promise<readonly Permission[]>;
-}): Authorizer;
-/**
- * Allows everything. Appropriate for local single-user runtimes and tests, and
- * never appropriate for a networked deployment.
- */
-export declare function allowAllAuthorizer(): Authorizer;
-/** Wraps a plain predicate as an authorizer. */
-export declare function authorizerFrom(name: string, fn: (request: AuthorizationRequest) => boolean | AuthorizationDecision | Promise<boolean | AuthorizationDecision>): Authorizer;
-/**
- * Runs authorizers in order; every authorizer must allow. The first denial
- * wins, so put the cheapest check first.
- */
-export declare function combineAuthorizers(authorizers: readonly Authorizer[]): Authorizer;
-/** Converts a denial into the corresponding protocol error. */
-export declare function decisionToError(decision: Extract<AuthorizationDecision, {
-    allowed: false;
-}>): AppPortError;
-//# sourceMappingURL=index.d.ts.map

package/vendor/@appport/authorization/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAU,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE3G,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAKpF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAK7F;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;IACrC,MAAM,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC;IACpD,4EAA4E;IAC5E,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CACrC,GAAG,oBAAoB,CAgBvB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,aAAa,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,iFAAiF;IACjF,KAAK,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,OAAO,EAAE,IAAI,CAAC,CAAC,oDAAoD;IAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,GAC3G;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,cAAc,GAAG,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAClG;AAED,eAAO,MAAM,KAAK,EAAE,qBAAyC,CAAC;AAE9D,wBAAgB,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,cAAc,GAAG,WAAyB,GAAG,qBAAqB,CAI7G;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE;IACP,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IAC1C,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,SAAS,UAAU,EAAE,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;CAC3G,GACL,UAAU,CAqBZ;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,UAAU,CAE/C;AAED,gDAAgD;AAChD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,GAAG,qBAAqB,GAAG,OAAO,CAAC,OAAO,GAAG,qBAAqB,CAAC,GAChH,UAAU,CAWZ;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,GAAG,UAAU,CAajF;AAED,+DAA+D;AAC/D,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,qBAAqB,EAAE;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,GAAG,YAAY,CAI1G"}

package/vendor/@appport/authorization/dist/index.js

@@ -1,131 +0,0 @@
-/**
- * `@appport/authorization` — the capability authorization model (§34, §37, §38).
- *
- * Authorization in AppPort operates on capabilities, never on transports.
- * A capability declares the permissions it requires; an {@link Authorizer}
- * decides whether the current principal holds them. Nothing here infers trust
- * from the transport: desktop IPC is not privileged, and HTTPS is not identity.
- */
-import { AppPortError, errors } from "../../protocol/dist/index.js";
-/**
- * Matches a permission against a granted permission, supporting `*` wildcards
- * at segment granularity: `documents.*` grants `documents.write`, and the bare
- * `*` grants everything.
- */
-export function permissionMatches(granted, required) {
-    if (granted === "*" || granted === required)
-        return true;
-    if (!granted.endsWith(".*"))
-        return false;
-    const prefix = granted.slice(0, -1); // keep the trailing dot
-    return required.startsWith(prefix);
-}
-export function grantsPermission(granted, required) {
-    for (const permission of granted) {
-        if (permissionMatches(permission, required))
-            return true;
-    }
-    return false;
-}
-export function createAuthorizationContext(options) {
-    const permissions = options.permissions ?? options.session?.permissions ?? [];
-    const principal = options.principal ?? options.session?.principal;
-    const context = {
-        ...(options.session ? { session: options.session } : {}),
-        ...(principal ? { principal } : {}),
-        permissions,
-        has: (permission) => grantsPermission(permissions, permission),
-        hasAll: (required) => required.every((permission) => grantsPermission(permissions, permission)),
-        require: (permission) => {
-            if (grantsPermission(permissions, permission))
-                return;
-            if (!principal)
-                throw errors.unauthorized();
-            throw errors.forbidden(`Missing permission: ${permission}`, { required: [permission] });
-        }
-    };
-    return context;
-}
-export const ALLOW = { allowed: true };
-export function deny(reason, code = "FORBIDDEN") {
-    return code === "UNAUTHORIZED"
-        ? { allowed: false, code, ...(reason ? { reason } : {}) }
-        : { allowed: false, code, ...(reason ? { reason } : {}) };
-}
-/**
- * The default authorizer: the session's permission set must cover every
- * permission the capability declares.
- *
- * A capability that declares no permissions is public. A capability that
- * declares permissions with no session present fails `UNAUTHORIZED`, so clients
- * can distinguish "log in" from "not allowed".
- */
-export function permissionAuthorizer(options = {}) {
-    return {
-        name: "permission",
-        async authorize(request) {
-            const granted = [
-                ...(options.publicPermissions ?? []),
-                ...(request.session?.permissions ?? []),
-                ...(options.resolvePermissions ? await options.resolvePermissions(request) : [])
-            ];
-            if (request.required.length === 0)
-                return { allowed: true, permissions: granted };
-            const missing = request.required.filter((permission) => !grantsPermission(granted, permission));
-            if (missing.length === 0)
-                return { allowed: true, permissions: granted };
-            const principal = request.principal ?? request.session?.principal;
-            if (!principal) {
-                return { allowed: false, code: "UNAUTHORIZED", reason: "Authentication is required" };
-            }
-            return { allowed: false, code: "FORBIDDEN", reason: `Missing permission: ${missing.join(", ")}` };
-        }
-    };
-}
-/**
- * Allows everything. Appropriate for local single-user runtimes and tests, and
- * never appropriate for a networked deployment.
- */
-export function allowAllAuthorizer() {
-    return { name: "allow-all", authorize: () => ({ allowed: true, permissions: ["*"] }) };
-}
-/** Wraps a plain predicate as an authorizer. */
-export function authorizerFrom(name, fn) {
-    return {
-        name,
-        async authorize(request) {
-            const result = await fn(request);
-            if (typeof result === "boolean") {
-                return result ? { allowed: true } : { allowed: false, code: "FORBIDDEN" };
-            }
-            return result;
-        }
-    };
-}
-/**
- * Runs authorizers in order; every authorizer must allow. The first denial
- * wins, so put the cheapest check first.
- */
-export function combineAuthorizers(authorizers) {
-    return {
-        name: `combined(${authorizers.map((a) => a.name).join(",")})`,
-        async authorize(request) {
-            let permissions;
-            for (const authorizer of authorizers) {
-                const decision = await authorizer.authorize(request);
-                if (!decision.allowed)
-                    return decision;
-                if (decision.permissions)
-                    permissions = decision.permissions;
-            }
-            return permissions ? { allowed: true, permissions } : { allowed: true };
-        }
-    };
-}
-/** Converts a denial into the corresponding protocol error. */
-export function decisionToError(decision) {
-    return decision.code === "UNAUTHORIZED"
-        ? errors.unauthorized(decision.reason ?? "Authentication is required")
-        : errors.forbidden(decision.reason ?? "Capability is not authorized");
-}
-//# sourceMappingURL=index.js.map

package/vendor/@appport/authorization/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,EAAoD,MAAM,mBAAmB,CAAC;AAI3G;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAmB,EAAE,QAAoB;IACzE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;IAC7D,OAAO,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA6B,EAAE,QAAoB;IAClF,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QACjC,IAAI,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAmBD,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;IAC9E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;IAClE,MAAM,OAAO,GAAyB;QACpC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,WAAW;QACX,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC;QAC9D,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC/F,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE;YACtB,IAAI,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC;gBAAE,OAAO;YACtD,IAAI,CAAC,SAAS;gBAAE,MAAM,MAAM,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,MAAM,CAAC,SAAS,CAAC,uBAAuB,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAuBD,MAAM,CAAC,MAAM,KAAK,GAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAE9D,MAAM,UAAU,IAAI,CAAC,MAAe,EAAE,OAAqC,WAAW;IACpF,OAAO,IAAI,KAAK,cAAc;QAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACzD,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAKI,EAAE;IAEN,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,OAAO,GAAiB;gBAC5B,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;gBACpC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;gBACvC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC;YACF,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;YAElF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YAChG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;YAEzE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC;YAClE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YACxF,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACpG,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,EAAiH;IAEjH,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAC5E,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAkC;IACnE,OAAO;QACL,IAAI,EAAE,YAAY,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC7D,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,IAAI,WAA8C,CAAC;YACnD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,CAAC,OAAO;oBAAE,OAAO,QAAQ,CAAC;gBACvC,IAAI,QAAQ,CAAC,WAAW;oBAAE,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC/D,CAAC;YACD,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,eAAe,CAAC,QAA4D;IAC1F,OAAO,QAAQ,CAAC,IAAI,KAAK,cAAc;QACrC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,IAAI,4BAA4B,CAAC;QACtE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,IAAI,8BAA8B,CAAC,CAAC;AAC1E,CAAC"}

package/vendor/@appport/authorization/package.json

@@ -1,28 +0,0 @@
-{
-  "name": "@appport/authorization",
-  "version": "1.0.0",
-  "description": "Capability authorization model for AppPort.",
-  "license": "Apache-2.0",
-  "repository": "github:rkendel1/appport",
-  "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "tsc -b",
-    "clean": "tsc -b --clean"
-  },
-  "dependencies": {
-    "@appport/protocol": "1.0.0"
-  },
-  "private": true
-}

package/vendor/@appport/client/README.md

@@ -1,35 +0,0 @@
-# @appport/client
-
-The transport-independent application client.
-
-```ts
-import { createClient } from "@appport/client";
-
-const client = createClient({ transport });
-await client.connect();
-await client.load(); // discovers capabilities and versions from the manifest
-
-await client.call("documents.save", { documentId, content });
-await client.capabilities.documents.save({ documentId, content });
-
-for await (const chunk of client.stream("build.logs", { buildId })) console.log(chunk.line);
-
-const unsubscribe = await client.events.subscribe("documents.changed", (payload) => refresh(payload));
-```
-
-The client builds envelopes, correlates responses, resolves capability versions
-from the manifest, unwraps errors into `AppPortError`, and exposes capabilities
-as a namespaced proxy. Application code never touches a protocol envelope.
-
-`createDuplexTransport` implements request correlation, subscriptions and stream
-reassembly once, for every carrier that can push: WebSocket, Electron IPC, Tauri
-IPC and the in-process bridge.
-
-With a generated contract the client is fully typed:
-
-```ts
-import { createDocumentsClient } from "./appport/generated/client.ts";
-
-const client = createDocumentsClient({ transport });
-const { version } = await client.capabilities.documents.save({ documentId, content });
-```

package/vendor/@appport/client/dist/channel.d.ts

@@ -1,14 +0,0 @@
-/**
- * A minimal async queue used by duplex transports to hand server-pushed chunks
- * to an async iterator. Kept local to the client so `@appport/client` stays
- * dependency-free and browser-safe.
- */
-export declare class ClientChannel<T> implements AsyncIterable<T> {
-    #private;
-    get closed(): boolean;
-    push(value: T): void;
-    end(): void;
-    fail(reason: unknown): void;
-    [Symbol.asyncIterator](): AsyncIterator<T>;
-}
-//# sourceMappingURL=channel.d.ts.map

package/vendor/@appport/client/dist/channel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../src/channel.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,aAAa,CAAC,CAAC,CAAE,YAAW,aAAa,CAAC,CAAC,CAAC;;IAMvD,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI;IAOpB,GAAG,IAAI,IAAI;IAMX,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAOpB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC;CAkBlD"}

package/vendor/@appport/client/dist/channel.js

@@ -1,58 +0,0 @@
-/**
- * A minimal async queue used by duplex transports to hand server-pushed chunks
- * to an async iterator. Kept local to the client so `@appport/client` stays
- * dependency-free and browser-safe.
- */
-export class ClientChannel {
-    #queue = [];
-    #waiters = [];
-    #closed = false;
-    #failure;
-    get closed() {
-        return this.#closed;
-    }
-    push(value) {
-        if (this.#closed)
-            return;
-        const waiter = this.#waiters.shift();
-        if (waiter)
-            waiter.resolve({ value, done: false });
-        else
-            this.#queue.push(value);
-    }
-    end() {
-        if (this.#closed)
-            return;
-        this.#closed = true;
-        while (this.#waiters.length)
-            this.#waiters.shift().resolve({ value: undefined, done: true });
-    }
-    fail(reason) {
-        if (this.#closed)
-            return;
-        this.#closed = true;
-        this.#failure = reason;
-        while (this.#waiters.length)
-            this.#waiters.shift().reject(reason);
-    }
-    async *[Symbol.asyncIterator]() {
-        for (;;) {
-            if (this.#queue.length > 0) {
-                yield this.#queue.shift();
-                continue;
-            }
-            if (this.#failure !== undefined)
-                throw this.#failure;
-            if (this.#closed)
-                return;
-            const next = await new Promise((resolve, reject) => this.#waiters.push({ resolve, reject }));
-            if (next.done) {
-                if (this.#failure !== undefined)
-                    throw this.#failure;
-                return;
-            }
-            yield next.value;
-        }
-    }
-}
-//# sourceMappingURL=channel.js.map

package/vendor/@appport/client/dist/channel.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"channel.js","sourceRoot":"","sources":["../src/channel.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACf,MAAM,GAAQ,EAAE,CAAC;IACjB,QAAQ,GAA+F,EAAE,CAAC;IACnH,OAAO,GAAG,KAAK,CAAC;IAChB,QAAQ,CAAU;IAElB,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,KAAQ;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACrC,IAAI,MAAM;YAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,IAAI,CAAC,MAAe;QAClB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3B,SAAS,CAAC;YACR,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAG,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;YACrD,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CACxC,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;oBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/vendor/@appport/client/dist/client.d.ts

@@ -1,61 +0,0 @@
-import { type AppEventEnvelope, type AppPortManifest, type AppRequest, type AppResponse, type RequestMetadata } from "../../protocol/dist/index.d.ts";
-import type { AnyContract, AppContract, CallOptions, CapabilityProxy, TypedStream } from "./contract.js";
-import type { AppTransport, TransportEventFilter, Unsubscribe } from "./transport.js";
-export interface ClientOptions {
-    transport: AppTransport;
-    /** Client-side deadline sent as `timeoutMs` (§46). */
-    defaultTimeoutMs?: number;
-    /** Manifest used to resolve capability versions and stream capabilities. */
-    manifest?: AppPortManifest;
-    /** Explicit capability versions, overriding the manifest. */
-    versions?: Record<string, number>;
-    /** Capability names that answer with a stream. */
-    streamCapabilities?: Iterable<string>;
-    /** Metadata attached to every request. Never credentials (§53). */
-    metadata?: RequestMetadata;
-    /** Trace identifier factory for correlating a call across processes (§54). */
-    createTraceId?: () => string;
-}
-/**
- * The transport-independent application client.
- *
- * Application code calls capabilities. It never builds an envelope, never sees
- * the transport, and never branches on the runtime (§2, §33).
- */
-export declare class AppPortClient<C extends AppContract = AnyContract> {
-    #private;
-    readonly transport: AppTransport;
-    constructor(options: ClientOptions);
-    get connected(): boolean;
-    connect(): Promise<void>;
-    close(): Promise<void>;
-    /**
-     * Loads the manifest through `appport.manifest`, so discovery works the same
-     * way over every transport (§39, §40).
-     */
-    load(): Promise<AppPortManifest>;
-    get manifest(): AppPortManifest | undefined;
-    /** Resolves the capability version this client will send. */
-    versionOf(name: string): number;
-    isStreamCapability(name: string): boolean;
-    /** Calls a request capability and unwraps the response. */
-    call<Output = unknown>(name: string, input: unknown, options?: CallOptions): Promise<Output>;
-    /** Sends a pre-built envelope. Escape hatch for tooling; applications use `call`. */
-    send(request: AppRequest): Promise<AppResponse>;
-    /** Invokes a stream capability (§20). */
-    stream<Chunk = unknown>(name: string, input: unknown, options?: CallOptions): TypedStream<Chunk>;
-    /** Event subscriptions (§18). */
-    readonly events: {
-        subscribe: (name: string | TransportEventFilter, handler: (payload: never, event: AppEventEnvelope) => void) => Promise<Unsubscribe>;
-    };
-    /**
-     * Namespaced capability accessor: `client.capabilities.documents.save(input)`.
-     * The proxy resolves versions from the manifest and routes stream
-     * capabilities to `stream()`.
-     */
-    get capabilities(): CapabilityProxy<C>;
-}
-/** Turns an error response into a thrown {@link AppPortError} (§14). */
-export declare function unwrap<Output>(response: AppResponse): Output;
-export declare function createClient<C extends AppContract = AnyContract>(options: ClientOptions): AppPortClient<C>;
-//# sourceMappingURL=client.d.ts.map

package/vendor/@appport/client/dist/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEzG,OAAO,KAAK,EAAE,YAAY,EAAgB,oBAAoB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEpG,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,YAAY,CAAC;IACxB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,kDAAkD;IAClD,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,mEAAmE;IACnE,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,qBAAa,aAAa,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW;;IAC5D,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;gBASrB,OAAO,EAAE,aAAa;IAUlC,IAAI,SAAS,IAAI,OAAO,CAEvB;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC;IAOtC,IAAI,QAAQ,IAAI,eAAe,GAAG,SAAS,CAE1C;IAWD,6DAA6D;IAC7D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAI/B,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAoBzC,2DAA2D;IACrD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC;IAOtG,qFAAqF;IAC/E,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAKrD,yCAAyC;IACzC,MAAM,CAAC,KAAK,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,WAAgB,GAAG,WAAW,CAAC,KAAK,CAAC;IAoCpG,iCAAiC;IACjC,QAAQ,CAAC,MAAM;0BAEL,MAAM,GAAG,oBAAoB,WAC1B,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI,KACzD,OAAO,CAAC,WAAW,CAAC;MAQvB;IAEF;;;;OAIG;IACH,IAAI,YAAY,IAAI,eAAe,CAAC,CAAC,CAAC,CAErC;CAwBF;AA4BD,wEAAwE;AACxE,wBAAgB,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,MAAM,CAM5D;AAED,wBAAgB,YAAY,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,EAAE,OAAO,EAAE,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,CAE1G"}

package/vendor/@appport/client/dist/client.js

@@ -1,214 +0,0 @@
-import { AppPortError, createRequest, createStreamRequest, isValidName, newRequestId, newTraceId } from "../../protocol/dist/index.js";
-import { contractFromManifest } from "./contract.js";
-/**
- * The transport-independent application client.
- *
- * Application code calls capabilities. It never builds an envelope, never sees
- * the transport, and never branches on the runtime (§2, §33).
- */
-export class AppPortClient {
-    transport;
-    #versions;
-    #streams;
-    #defaultTimeoutMs;
-    #metadata;
-    #createTraceId;
-    #manifest;
-    #connected = false;
-    constructor(options) {
-        this.transport = options.transport;
-        this.#versions = new Map(Object.entries(options.versions ?? {}));
-        this.#streams = new Set(options.streamCapabilities ?? []);
-        this.#defaultTimeoutMs = options.defaultTimeoutMs;
-        this.#metadata = options.metadata;
-        this.#createTraceId = options.createTraceId ?? newTraceId;
-        if (options.manifest)
-            this.#applyManifest(options.manifest);
-    }
-    get connected() {
-        return this.#connected;
-    }
-    async connect() {
-        if (this.#connected)
-            return;
-        await this.transport.connect();
-        this.#connected = true;
-    }
-    async close() {
-        if (!this.#connected)
-            return;
-        this.#connected = false;
-        await this.transport.close();
-    }
-    /**
-     * Loads the manifest through `appport.manifest`, so discovery works the same
-     * way over every transport (§39, §40).
-     */
-    async load() {
-        if (this.#manifest)
-            return this.#manifest;
-        const manifest = (await this.call("appport.manifest", {}));
-        this.#applyManifest(manifest);
-        return manifest;
-    }
-    get manifest() {
-        return this.#manifest;
-    }
-    #applyManifest(manifest) {
-        this.#manifest = manifest;
-        const { versions, streams } = contractFromManifest(manifest);
-        for (const [name, version] of Object.entries(versions)) {
-            if (!this.#versions.has(name))
-                this.#versions.set(name, version);
-        }
-        for (const name of streams)
-            this.#streams.add(name);
-    }
-    /** Resolves the capability version this client will send. */
-    versionOf(name) {
-        return this.#versions.get(name) ?? 1;
-    }
-    isStreamCapability(name) {
-        return this.#streams.has(name);
-    }
-    #buildRequest(name, input, options = {}) {
-        if (!isValidName(name)) {
-            throw new AppPortError("INVALID_REQUEST", `Invalid capability name: ${name}`);
-        }
-        const timeoutMs = options.timeoutMs ?? this.#defaultTimeoutMs;
-        return createRequest({
-            requestId: newRequestId(),
-            capability: { name, version: options.version ?? this.versionOf(name) },
-            input,
-            traceId: options.traceId ?? this.#createTraceId(),
-            ...(options.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : {}),
-            ...(timeoutMs !== undefined ? { timeoutMs } : {}),
-            ...(this.#metadata ? { metadata: this.#metadata } : {})
-        });
-    }
-    /** Calls a request capability and unwraps the response. */
-    async call(name, input, options = {}) {
-        await this.#ensureConnected();
-        const request = this.#buildRequest(name, input, options);
-        const response = await this.#withAbort(options.signal, () => this.transport.request(request));
-        return unwrap(response);
-    }
-    /** Sends a pre-built envelope. Escape hatch for tooling; applications use `call`. */
-    async send(request) {
-        await this.#ensureConnected();
-        return this.transport.request(request);
-    }
-    /** Invokes a stream capability (§20). */
-    stream(name, input, options = {}) {
-        const base = this.#buildRequest(name, input, options);
-        const request = createStreamRequest({
-            requestId: base.requestId,
-            capability: base.capability,
-            input: base.input,
-            ...(base.traceId ? { traceId: base.traceId } : {}),
-            ...(base.timeoutMs !== undefined ? { timeoutMs: base.timeoutMs } : {}),
-            ...(base.metadata ? { metadata: base.metadata } : {})
-        });
-        const self = this;
-        let handle;
-        let cancelled;
-        const iterable = {
-            cancel(reason) {
-                cancelled = reason ?? "cancelled";
-                handle?.cancel(reason);
-            },
-            async *[Symbol.asyncIterator]() {
-                await self.#ensureConnected();
-                handle = self.transport.stream(request);
-                if (cancelled !== undefined)
-                    handle.cancel(cancelled);
-                const onAbort = () => handle?.cancel("aborted");
-                options.signal?.addEventListener("abort", onAbort, { once: true });
-                try {
-                    for await (const chunk of handle)
-                        yield chunk;
-                }
-                finally {
-                    options.signal?.removeEventListener("abort", onAbort);
-                }
-            }
-        };
-        return iterable;
-    }
-    /** Event subscriptions (§18). */
-    events = {
-        subscribe: async (name, handler) => {
-            await this.#ensureConnected();
-            const filter = typeof name === "string" ? { name } : name;
-            const listener = (event) => {
-                handler(event.payload, event);
-            };
-            return this.transport.subscribe(listener, filter);
-        }
-    };
-    /**
-     * Namespaced capability accessor: `client.capabilities.documents.save(input)`.
-     * The proxy resolves versions from the manifest and routes stream
-     * capabilities to `stream()`.
-     */
-    get capabilities() {
-        return createCapabilityProxy(this, []);
-    }
-    async #ensureConnected() {
-        if (!this.#connected)
-            await this.connect();
-    }
-    async #withAbort(signal, fn) {
-        if (!signal)
-            return fn();
-        if (signal.aborted)
-            throw new AppPortError("CANCELLED", "Request aborted before it was sent");
-        let onAbort;
-        try {
-            return await Promise.race([
-                fn(),
-                new Promise((_, reject) => {
-                    onAbort = () => reject(new AppPortError("CANCELLED", "Request aborted"));
-                    signal.addEventListener("abort", onAbort, { once: true });
-                })
-            ]);
-        }
-        finally {
-            // A caller may reuse one signal across many calls; do not accumulate
-            // listeners on it.
-            if (onAbort)
-                signal.removeEventListener("abort", onAbort);
-        }
-    }
-}
-function createCapabilityProxy(client, path) {
-    const call = (input, options) => {
-        const name = path.join(".");
-        return client.isStreamCapability(name)
-            ? client.stream(name, input, options)
-            : client.call(name, input, options);
-    };
-    return new Proxy(call, {
-        get(_target, property) {
-            if (typeof property !== "string")
-                return undefined;
-            return createCapabilityProxy(client, [...path, property]);
-        },
-        apply(_target, _thisArg, args) {
-            return call(args[0], args[1]);
-        }
-    });
-}
-/** Turns an error response into a thrown {@link AppPortError} (§14). */
-export function unwrap(response) {
-    if (response.ok)
-        return response.output;
-    throw new AppPortError(response.error.code, response.error.message, {
-        ...(response.error.details !== undefined ? { details: response.error.details } : {}),
-        ...(response.error.retryable ? { retryable: true } : {})
-    });
-}
-export function createClient(options) {
-    return new AppPortClient(options);
-}
-//# sourceMappingURL=client.js.map