@appport/sdk 1.1.19 → 1.1.20

package/vendor/@appport/core/dist/runtime-manifest.js

@@ -0,0 +1,84 @@
+/**
+ * Runtime Implementation Manifest (F6)
+ *
+ * The local, per-source description of what a repository/runtime actually
+ * implements. It is implementation metadata and nothing else.
+ *
+ * It establishes:
+ *   - implementation capability coverage
+ *
+ * It does NOT establish:
+ *   - application identity
+ *   - contract authority
+ *   - the application fingerprint
+ *   - authorization
+ *   - provider identity
+ *
+ * This schema is deliberately distinct from `AppBoundryContractDocument`. The
+ * two documents are never aliased, and parsing one rejects the other so a
+ * contract mismatch can never be converted into a runtime-manifest match.
+ */
+import { APPBOUNDRY_CONTRACT_PROTOCOL, capabilityCoverageKey } from "./appboundry-contract.js";
+/** Protocol identifier of the runtime implementation manifest. */
+export const RUNTIME_IMPLEMENTATION_MANIFEST_PROTOCOL = "AppPort/runtime-implementation/1";
+/** Canonical file name of the runtime implementation manifest. */
+export const RUNTIME_IMPLEMENTATION_MANIFEST_FILE = "appport.implementation.json";
+/** Explicit runtime-manifest failure; never silently promoted to a contract. */
+export class RuntimeManifestError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "RuntimeManifestError";
+    }
+}
+/** Parse a runtime implementation manifest, rejecting contract documents. */
+export function parseRuntimeImplementationManifest(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new RuntimeManifestError("RUNTIME_MANIFEST_INVALID", "The runtime implementation manifest must be a JSON object");
+    }
+    const candidate = value;
+    if (candidate.protocol === APPBOUNDRY_CONTRACT_PROTOCOL) {
+        throw new RuntimeManifestError("RUNTIME_MANIFEST_IS_A_CONTRACT", "An AppBoundry contract is not a runtime implementation manifest");
+    }
+    if (candidate.protocol !== RUNTIME_IMPLEMENTATION_MANIFEST_PROTOCOL) {
+        throw new RuntimeManifestError("RUNTIME_MANIFEST_INVALID", `Expected protocol "${RUNTIME_IMPLEMENTATION_MANIFEST_PROTOCOL}" but found "${String(candidate.protocol)}"`);
+    }
+    if (typeof candidate.applicationId !== "string" || !candidate.applicationId.length) {
+        throw new RuntimeManifestError("RUNTIME_MANIFEST_INVALID", "applicationId must be a non-empty string");
+    }
+    if (!Array.isArray(candidate.implements) || candidate.implements.length === 0) {
+        throw new RuntimeManifestError("RUNTIME_MANIFEST_INVALID", "implements must declare at least one capability");
+    }
+    if (candidate.implementationId !== undefined && (typeof candidate.implementationId !== "string" || !candidate.implementationId.length)) {
+        throw new RuntimeManifestError("RUNTIME_MANIFEST_INVALID", "implementationId must be a non-empty string");
+    }
+    if (candidate.implementationId === candidate.applicationId) {
+        throw new RuntimeManifestError("RUNTIME_MANIFEST_INVALID", "implementation identity must be distinct from application identity");
+    }
+    const seen = new Set();
+    for (const entry of candidate.implements) {
+        if (typeof entry?.name !== "string" || !Number.isInteger(entry?.version)) {
+            throw new RuntimeManifestError("RUNTIME_MANIFEST_INVALID", "every implemented capability needs a name and integer version");
+        }
+        const key = `${entry.name}@${entry.version}`;
+        if (seen.has(key))
+            throw new RuntimeManifestError("RUNTIME_MANIFEST_INVALID", `duplicate implemented capability ${key}`);
+        seen.add(key);
+    }
+    return candidate;
+}
+/**
+ * Derive implementation coverage from a runtime manifest.
+ *
+ * Coverage is a claim, not an authority. It becomes meaningful only once
+ * validated against the authoritative contract (see `contract-attestation.ts`).
+ */
+export function deriveImplementationCoverage(manifest) {
+    return [...new Set(manifest.implements.map(capabilityCoverageKey))].sort();
+}
+/** Render a runtime implementation manifest for a repository to commit. */
+export function serializeRuntimeImplementationManifest(manifest) {
+    return `${JSON.stringify(manifest, null, 2)}\n`;
+}
+//# sourceMappingURL=runtime-manifest.js.map

package/vendor/@appport/core/dist/runtime-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-manifest.js","sourceRoot":"","sources":["../src/runtime-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,kEAAkE;AAClE,MAAM,CAAC,MAAM,wCAAwC,GAAG,kCAAkC,CAAC;AAE3F,kEAAkE;AAClE,MAAM,CAAC,MAAM,oCAAoC,GAAG,6BAA6B,CAAC;AAkClF,gFAAgF;AAChF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACxB;IAArB,YAAqB,IAA8B,EAAE,OAAe;QAClE,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAA0B;QAEjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,UAAU,kCAAkC,CAAC,KAAc;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE,2DAA2D,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,SAAS,CAAC,QAAQ,KAAK,4BAA4B,EAAE,CAAC;QACxD,MAAM,IAAI,oBAAoB,CAC5B,gCAAgC,EAChC,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,wCAAwC,EAAE,CAAC;QACpE,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,EAC1B,sBAAsB,wCAAwC,gBAAgB,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QACnF,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE,iDAAiD,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,SAAS,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,OAAO,SAAS,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACvI,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE,6CAA6C,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,SAAS,CAAC,gBAAgB,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;QAC3D,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE,oEAAoE,CAAC,CAAC;IACnI,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAuC,EAAE,CAAC;QACtE,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE,+DAA+D,CAAC,CAAC;QAC9H,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,EAAE,oCAAoC,GAAG,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,SAAqD,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAuC;IAClF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sCAAsC,CAAC,QAAuC;IAC5F,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC"}

package/vendor/@appport/core/dist/sanitize.d.ts

@@ -0,0 +1,14 @@
+import { type AppErrorObject, type JsonValue } from "../../protocol/dist/index.d.ts";
+/**
+ * Error sanitization (specification §16).
+ *
+ * Production responses never carry stack traces, filesystem paths, credentials
+ * or raw driver errors. Development mode may attach diagnostics, and does so
+ * under an explicitly namespaced `diagnostic` detail so it is obvious when a
+ * deployment is leaking.
+ */
+export type RuntimeMode = "development" | "production";
+/** Redacts values whose key suggests a credential. */
+export declare function redact(value: JsonValue, depth?: number): JsonValue;
+export declare function toWireError(error: unknown, mode?: RuntimeMode): AppErrorObject;
+//# sourceMappingURL=sanitize.d.ts.map

package/vendor/@appport/core/dist/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9F;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;AAIvD,sDAAsD;AACtD,wBAAgB,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,SAAI,GAAG,SAAS,CAQ7D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,WAA0B,GAAG,cAAc,CAoB5F"}

package/vendor/@appport/core/dist/sanitize.js

@@ -0,0 +1,49 @@
+import { AppPortError, errors } from "../../protocol/dist/index.js";
+const SENSITIVE_KEY = /(password|secret|token|credential|authorization|api[-_]?key|cookie|session[-_]?id)/i;
+/** Redacts values whose key suggests a credential. */
+export function redact(value, depth = 0) {
+    if (depth > 6 || value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map((entry) => redact(entry, depth + 1));
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        out[key] = SENSITIVE_KEY.test(key) ? "[redacted]" : redact(entry, depth + 1);
+    }
+    return out;
+}
+export function toWireError(error, mode = "production") {
+    if (AppPortError.is(error)) {
+        const wire = error.toErrorObject();
+        if (wire.details !== undefined)
+            wire.details = redact(wire.details);
+        if (mode === "development" && error.internal !== undefined) {
+            wire.details = {
+                ...(typeof wire.details === "object" && wire.details !== null && !Array.isArray(wire.details)
+                    ? wire.details
+                    : {}),
+                diagnostic: describe(error.internal)
+            };
+        }
+        return wire;
+    }
+    const wire = errors.internal().toErrorObject();
+    if (mode === "development") {
+        wire.details = { diagnostic: describe(error) };
+    }
+    return wire;
+}
+function describe(value) {
+    if (value instanceof Error) {
+        return {
+            name: value.name,
+            message: value.message,
+            ...(value.stack ? { stack: value.stack.split("\n").slice(0, 8).join("\n") } : {})
+        };
+    }
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value === null) {
+        return value;
+    }
+    return String(value);
+}
+//# sourceMappingURL=sanitize.js.map

package/vendor/@appport/core/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,EAAuC,MAAM,mBAAmB,CAAC;AAY9F,MAAM,aAAa,GAAG,qFAAqF,CAAC;AAE5G,sDAAsD;AACtD,MAAM,UAAU,MAAM,CAAC,KAAgB,EAAE,KAAK,GAAG,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAA8B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,OAAoB,YAAY;IAC1E,IAAI,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3D,IAAI,CAAC,OAAO,GAAG;gBACb,GAAG,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC3F,CAAC,CAAC,IAAI,CAAC,OAAO;oBACd,CAAC,CAAC,EAAE,CAAC;gBACP,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;aACrC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3G,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/vendor/@appport/core/dist/server-internal.d.ts

@@ -0,0 +1,5 @@
+/** Private bridge used by the bundled server workspace. Not re-exported by the SDK. */
+export { AsyncChannel, type StreamExecution } from "./public.js";
+export { toWireError } from "./sanitize.js";
+export type { AppPortApplication } from "./application.js";
+//# sourceMappingURL=server-internal.d.ts.map

package/vendor/@appport/core/dist/server-internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-internal.d.ts","sourceRoot":"","sources":["../src/server-internal.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC"}

package/vendor/@appport/core/dist/server-internal.js

@@ -0,0 +1,4 @@
+/** Private bridge used by the bundled server workspace. Not re-exported by the SDK. */
+export { AsyncChannel } from "./public.js";
+export { toWireError } from "./sanitize.js";
+//# sourceMappingURL=server-internal.js.map

package/vendor/@appport/core/dist/server-internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-internal.js","sourceRoot":"","sources":["../src/server-internal.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,YAAY,EAAwB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC"}

package/vendor/@appport/core/dist/sessions.d.ts

@@ -0,0 +1,29 @@
+import { type Principal, type Session } from "../../protocol/dist/index.d.ts";
+export interface CreateSessionInput {
+    applicationId: string;
+    principal?: Principal;
+    permissions?: readonly string[];
+    ttlMs?: number;
+    attributes?: Session["attributes"];
+}
+/**
+ * Session storage (specification §36). Sessions are transport-neutral: the same
+ * session may be observed over IPC and HTTP.
+ */
+export interface SessionStore {
+    create(input: CreateSessionInput): Promise<Session>;
+    get(id: string): Promise<Session | undefined>;
+    /** Replaces a session record; used to refresh expiry or permissions. */
+    put(session: Session): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+/** In-memory session store. The default for local runtimes and tests. */
+export declare class MemorySessionStore implements SessionStore {
+    #private;
+    create(input: CreateSessionInput): Promise<Session>;
+    get(id: string): Promise<Session | undefined>;
+    put(session: Session): Promise<void>;
+    delete(id: string): Promise<void>;
+    get size(): number;
+}
+//# sourceMappingURL=sessions.d.ts.map

package/vendor/@appport/core/dist/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjG,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9C,wEAAwE;IACxE,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,yEAAyE;AACzE,qBAAa,kBAAmB,YAAW,YAAY;;IAG/C,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAenD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAU7C,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/vendor/@appport/core/dist/sessions.js

@@ -0,0 +1,39 @@
+import { isSessionExpired, newSessionId } from "../../protocol/dist/index.js";
+/** In-memory session store. The default for local runtimes and tests. */
+export class MemorySessionStore {
+    #sessions = new Map();
+    async create(input) {
+        const now = Date.now();
+        const session = {
+            id: newSessionId(),
+            applicationId: input.applicationId,
+            createdAt: new Date(now).toISOString(),
+            ...(input.principal ? { principal: input.principal } : {}),
+            ...(input.permissions ? { permissions: [...input.permissions] } : {}),
+            ...(input.ttlMs ? { expiresAt: new Date(now + input.ttlMs).toISOString() } : {}),
+            ...(input.attributes ? { attributes: input.attributes } : {})
+        };
+        this.#sessions.set(session.id, session);
+        return session;
+    }
+    async get(id) {
+        const session = this.#sessions.get(id);
+        if (!session)
+            return undefined;
+        if (isSessionExpired(session)) {
+            this.#sessions.delete(id);
+            return undefined;
+        }
+        return session;
+    }
+    async put(session) {
+        this.#sessions.set(session.id, session);
+    }
+    async delete(id) {
+        this.#sessions.delete(id);
+    }
+    get size() {
+        return this.#sessions.size;
+    }
+}
+//# sourceMappingURL=sessions.js.map

package/vendor/@appport/core/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAgC,MAAM,mBAAmB,CAAC;AAsBjG,yEAAyE;AACzE,MAAM,OAAO,kBAAkB;IACpB,SAAS,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEhD,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,YAAY,EAAE;YAClB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACtC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAU;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAgB;QACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7B,CAAC;CACF"}

package/vendor/@appport/core/dist/sha256.d.ts

@@ -0,0 +1,3 @@
+/** Small synchronous SHA-256 used for canonical protocol fingerprints in every runtime. */
+export declare function sha256(value: string): string;
+//# sourceMappingURL=sha256.d.ts.map

package/vendor/@appport/core/dist/sha256.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.d.ts","sourceRoot":"","sources":["../src/sha256.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAsB5C"}

package/vendor/@appport/core/dist/sha256.js

@@ -0,0 +1,46 @@
+/** Small synchronous SHA-256 used for canonical protocol fingerprints in every runtime. */
+export function sha256(value) {
+    const bytes = new TextEncoder().encode(value);
+    const length = bytes.length;
+    const padded = new Uint8Array(((length + 9 + 63) >> 6) << 6);
+    padded.set(bytes);
+    padded[length] = 0x80;
+    const bits = length * 8;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 4, bits >>> 0);
+    view.setUint32(padded.length - 8, Math.floor(bits / 0x100000000));
+    const k = [0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2];
+    const h = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
+    const w = new Uint32Array(64);
+    const r = (x, n) => (x >>> n) | (x << (32 - n));
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(offset + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const a = r(w[i - 15], 7) ^ r(w[i - 15], 18) ^ (w[i - 15] >>> 3), b = r(w[i - 2], 17) ^ r(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + a + w[i - 7] + b) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let i = 0; i < 64; i++) {
+            const s1 = r(e, 6) ^ r(e, 11) ^ r(e, 25), ch = (e & f) ^ (~e & g), t1 = (hh + s1 + ch + k[i] + w[i]) >>> 0, s0 = r(a, 2) ^ r(a, 13) ^ r(a, 22), maj = (a & b) ^ (a & c) ^ (b & c), t2 = (s0 + maj) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] = (h[0] + a) >>> 0;
+        h[1] = (h[1] + b) >>> 0;
+        h[2] = (h[2] + c) >>> 0;
+        h[3] = (h[3] + d) >>> 0;
+        h[4] = (h[4] + e) >>> 0;
+        h[5] = (h[5] + f) >>> 0;
+        h[6] = (h[6] + g) >>> 0;
+        h[7] = (h[7] + hh) >>> 0;
+    }
+    return h.map(n => n.toString(16).padStart(8, "0")).join("");
+}
+//# sourceMappingURL=sha256.js.map

package/vendor/@appport/core/dist/sha256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.js","sourceRoot":"","sources":["../src/sha256.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,CAAC,CAAC;IAC5sB,MAAM,CAAC,GAAG,CAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,CAAC,CAAC;IACpG,MAAM,CAAC,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;YAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAC,EAAE,CAAE,EAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAC,EAAE,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,GAAC,EAAE,CAAE,KAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAE,KAAG,EAAE,CAAC,CAAC;YAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAC,EAAE,CAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAC,CAAC,CAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACnL,IAAI,CAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAAC,MAAM,EAAE,GAAC,CAAC,CAAC,CAAE,EAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAE,EAAC,EAAE,CAAC,EAAE,EAAE,GAAC,CAAC,CAAE,GAAC,CAAE,CAAC,GAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,EAAE,EAAE,GAAC,CAAC,EAAG,GAAC,EAAE,GAAC,EAAE,GAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAG,CAAC,EAAE,EAAE,GAAC,CAAC,CAAC,CAAE,EAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAE,EAAC,EAAE,CAAC,GAAC,CAAC,CAAC,CAAE,EAAC,EAAE,CAAC,EAAE,GAAG,GAAC,CAAC,CAAE,GAAC,CAAE,CAAC,GAAC,CAAC,CAAE,GAAC,CAAE,CAAC,GAAC,CAAC,CAAE,GAAC,CAAE,CAAC,EAAE,EAAE,GAAC,CAAC,EAAE,GAAC,GAAG,CAAC,KAAG,CAAC,CAAC;YAAC,EAAE,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAE,GAAC,EAAE,CAAC,KAAG,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,CAAC;YAAC,CAAC,GAAC,CAAC,EAAE,GAAC,EAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC;QAClQ,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,CAAE,CAAC,KAAG,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAE,GAAC,EAAG,CAAC,KAAG,CAAC,CAAC;IAC1K,CAAC;IACD,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/vendor/@appport/core/dist/source-verification.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Source Verification (F6)
+ *
+ * A repository URL is not verification. A source becomes eligible to provide an
+ * implementation only after it establishes, together:
+ *
+ *   repository/source identity
+ *       + verified commit/ref
+ *       + appboundry.contract.json fingerprint
+ *       + runtime implementation coverage
+ *
+ * Verification is provider-neutral: `sourceType = "repository"` is the AppPort
+ * concept, and a GitHub (or any other) adapter merely populates the fields.
+ */
+import { type AppBoundryContractDocument } from "./appboundry-contract.js";
+import { type AuthoritativeContract, type ContractAttestation, type CoverageEvaluation } from "./contract-attestation.js";
+import { type RuntimeImplementationManifest } from "./runtime-manifest.js";
+/** Evidence a source presents for verification. */
+export interface RepositorySourceObservation {
+    readonly sourceType: "repository";
+    /** Provider-neutral source identity, e.g. "github/acme/tracker-history". */
+    readonly repositoryIdentity: string;
+    readonly ref?: string;
+    /** Verified commit. Without it the source is unverified by construction. */
+    readonly commitSha?: string;
+    /** Raw contents of `appboundry.contract.json`. */
+    readonly contractDocument: unknown;
+    /** Raw contents of the runtime implementation manifest. */
+    readonly runtimeManifest: unknown;
+}
+export type SourceVerificationFailure = "CONTRACT_DOCUMENT_INVALID" | "CONTRACT_DOCUMENT_NOT_A_CONTRACT" | "CONTRACT_DOCUMENT_FINGERPRINT_INVALID" | "CONTRACT_MISMATCH" | "IDENTITY_MISMATCH" | "RUNTIME_MANIFEST_INVALID" | "RUNTIME_MANIFEST_IS_A_CONTRACT" | "RUNTIME_MANIFEST_APPLICATION_MISMATCH" | "UNVERIFIED_SOURCE" | "NO_COVERED_CAPABILITY";
+/** The outcome of verifying one source observation. */
+export interface SourceVerification {
+    readonly verified: boolean;
+    readonly repositoryIdentity: string;
+    readonly ref?: string;
+    readonly verifiedCommitSha?: string;
+    readonly contract?: AppBoundryContractDocument;
+    readonly attestation?: ContractAttestation;
+    readonly runtime?: RuntimeImplementationManifest;
+    readonly coverage: CoverageEvaluation;
+    readonly failures: readonly SourceVerificationFailure[];
+    readonly reasons: readonly string[];
+}
+/**
+ * Verify a source observation against the authoritative application contract.
+ *
+ * The contract attestation and the implementation coverage are computed from
+ * two different documents on purpose: a contract mismatch can never be repaired
+ * by a runtime manifest that happens to look compatible.
+ */
+export declare function verifySourceObservation(applicationId: string, observation: RepositorySourceObservation, authoritative: AuthoritativeContract, attestedAt?: string): SourceVerification;
+//# sourceMappingURL=source-verification.d.ts.map

package/vendor/@appport/core/dist/source-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-verification.d.ts","sourceRoot":"","sources":["../src/source-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACpG,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAoE,KAAK,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAE7I,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,yBAAyB,GACjC,2BAA2B,GAC3B,kCAAkC,GAClC,uCAAuC,GACvC,mBAAmB,GACnB,mBAAmB,GACnB,0BAA0B,GAC1B,gCAAgC,GAChC,uCAAuC,GACvC,mBAAmB,GACnB,uBAAuB,CAAC;AAE5B,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,6BAA6B,CAAC;IACjD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAID;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,2BAA2B,EACxC,aAAa,EAAE,qBAAqB,EACpC,UAAU,GAAE,MAAiC,GAC5C,kBAAkB,CAsEpB"}

package/vendor/@appport/core/dist/source-verification.js

@@ -0,0 +1,92 @@
+/**
+ * Source Verification (F6)
+ *
+ * A repository URL is not verification. A source becomes eligible to provide an
+ * implementation only after it establishes, together:
+ *
+ *   repository/source identity
+ *       + verified commit/ref
+ *       + appboundry.contract.json fingerprint
+ *       + runtime implementation coverage
+ *
+ * Verification is provider-neutral: `sourceType = "repository"` is the AppPort
+ * concept, and a GitHub (or any other) adapter merely populates the fields.
+ */
+import { parseAppBoundryContract } from "./appboundry-contract.js";
+import { attestAppBoundryContract, evaluateCoverage } from "./contract-attestation.js";
+import { deriveImplementationCoverage, parseRuntimeImplementationManifest } from "./runtime-manifest.js";
+const EMPTY_COVERAGE = { covered: [], undeclared: [], uncovered: [], reasons: [] };
+/**
+ * Verify a source observation against the authoritative application contract.
+ *
+ * The contract attestation and the implementation coverage are computed from
+ * two different documents on purpose: a contract mismatch can never be repaired
+ * by a runtime manifest that happens to look compatible.
+ */
+export function verifySourceObservation(applicationId, observation, authoritative, attestedAt = new Date().toISOString()) {
+    const failures = [];
+    const reasons = [];
+    if (observation.sourceType !== "repository") {
+        failures.push("UNVERIFIED_SOURCE");
+        reasons.push(`Unsupported source type "${String(observation.sourceType)}"`);
+    }
+    if (!observation.repositoryIdentity || !observation.repositoryIdentity.trim()) {
+        failures.push("UNVERIFIED_SOURCE");
+        reasons.push("A source identity is required");
+    }
+    if (!observation.commitSha || !observation.commitSha.trim()) {
+        failures.push("UNVERIFIED_SOURCE");
+        reasons.push("A verified commit is required: a source location alone is not verification");
+    }
+    let contract;
+    try {
+        contract = parseAppBoundryContract(observation.contractDocument);
+    }
+    catch (error) {
+        const code = error.code ?? "CONTRACT_DOCUMENT_INVALID";
+        failures.push(code);
+        reasons.push(error instanceof Error ? error.message : String(error));
+    }
+    let runtime;
+    try {
+        runtime = parseRuntimeImplementationManifest(observation.runtimeManifest);
+        if (runtime.applicationId !== applicationId) {
+            runtime = undefined;
+            failures.push("RUNTIME_MANIFEST_APPLICATION_MISMATCH");
+            reasons.push("The runtime implementation manifest references a different application");
+        }
+    }
+    catch (error) {
+        const code = error.code ?? "RUNTIME_MANIFEST_INVALID";
+        failures.push(code);
+        reasons.push(error instanceof Error ? error.message : String(error));
+    }
+    const attestation = contract ? attestAppBoundryContract(applicationId, contract, authoritative, attestedAt) : undefined;
+    if (attestation && attestation.status !== "verified") {
+        failures.push(attestation.status);
+        reasons.push(...attestation.reasons);
+    }
+    // Coverage is derived from the runtime manifest and validated against the
+    // authoritative contract; it is never derived from the contract document.
+    const coverage = runtime ? evaluateCoverage(deriveImplementationCoverage(runtime), authoritative) : EMPTY_COVERAGE;
+    reasons.push(...coverage.reasons);
+    // Undeclared coverage is dropped, not fatal: a source may still implement the
+    // capabilities the contract does declare (F6.6).
+    if (runtime && coverage.covered.length === 0) {
+        failures.push("NO_COVERED_CAPABILITY");
+        reasons.push("The source implements no capability declared by the application contract");
+    }
+    return {
+        verified: failures.length === 0,
+        repositoryIdentity: observation.repositoryIdentity,
+        ...(observation.ref ? { ref: observation.ref } : {}),
+        ...(observation.commitSha ? { verifiedCommitSha: observation.commitSha } : {}),
+        ...(contract ? { contract } : {}),
+        ...(attestation ? { attestation } : {}),
+        ...(runtime ? { runtime } : {}),
+        coverage,
+        failures,
+        reasons
+    };
+}
+//# sourceMappingURL=source-verification.js.map

package/vendor/@appport/core/dist/source-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-verification.js","sourceRoot":"","sources":["../src/source-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,uBAAuB,EAAmC,MAAM,0BAA0B,CAAC;AACpG,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAIjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,4BAA4B,EAAE,kCAAkC,EAAsC,MAAM,uBAAuB,CAAC;AA0C7I,MAAM,cAAc,GAAuB,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAEvG;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,aAAqB,EACrB,WAAwC,EACxC,aAAoC,EACpC,aAAqB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAE7C,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,WAAW,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,QAAgD,CAAC;IACrD,IAAI,CAAC;QACH,QAAQ,GAAG,uBAAuB,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA8C,CAAC,IAAI,IAAI,2BAA2B,CAAC;QACjG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,OAAkD,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,GAAG,kCAAkC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;YAC5C,OAAO,GAAG,SAAS,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA8C,CAAC,IAAI,IAAI,0BAA0B,CAAC;QAChG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxH,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACnH,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAElC,8EAA8E;IAC9E,iDAAiD;IACjD,IAAI,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC/B,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;QAClD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,QAAQ;QACR,QAAQ;QACR,OAAO;KACR,CAAC;AACJ,CAAC"}