@arcforges/api-client 1.0.0-ci.23.1 → 1.0.0-ci.244.1

package/NOTICE

@@ -1,13 +1,65 @@
 ArcForges Contracts
 Copyright 2026 ArcForges contributors
 
-@arcforges/api-client 1.0.0-ci.23.1 (Apache-2.0)
+@arcforges/api-client 1.0.0-ci.244.1 (Apache-2.0)
 
 Resolved runtime dependency inventory (dependencies retain their own licences):
-- @arcforges/proto 1.0.0-ci.23.1: Apache-2.0 (pkg:npm/%40arcforges/proto@1.0.0-ci.23.1)
-- @bufbuild/protobuf 2.14.1: (Apache-2.0 AND BSD-3-Clause) (pkg:npm/%40bufbuild/protobuf@2.14.1)
+- @arcforges/proto 1.0.0-ci.244.1: Apache-2.0 (pkg:npm/%40arcforges/proto@1.0.0-ci.244.1)
+- @bufbuild/protobuf 2.15.0: (Apache-2.0 AND BSD-3-Clause) (pkg:npm/%40bufbuild/protobuf@2.15.0)
 - @connectrpc/connect 2.2.0: Apache-2.0 (pkg:npm/%40connectrpc/connect@2.2.0)
 - @connectrpc/connect-web 2.2.0: Apache-2.0 (pkg:npm/%40connectrpc/connect-web@2.2.0)
 
-Third-party dependencies are referenced, not vendored into this package.
-The installed dependency packages supply their original licence and notice files.
+Third-party dependencies are referenced, not vendored into this package. Installed dependencies supply their original licence and notice files.
+
+ArcForges source provenance notices
+
+Generated from reviewed active records. Original licence files and dependency notices remain authoritative.
+
+contract-bindings-con-08-r1
+Source: https://github.com/ArcForges/Contracts @ 82f7dc331e39674b812ee53296ac5d6dd6badd0b
+Material licence: Apache-2.0
+Notice scope: packages
+Copyright 2026 ArcForges contributors.
+Copyright 2008 Google Inc. All rights reserved.
+Copyright 2015, 2019, 2020 gRPC authors.
+Copyright 2021-2026 Buf Technologies, Inc.
+Copyright 2022-2026 The Connect Authors.
+Selected ArcForges contract bindings are generated from Apache-2.0 schemas using Grpc.Tools 2.84.0, protoc-gen-es 2.15.0 and Connect-Kotlin 0.9.0. Shape validators, domain identity adapters and fixture exports use Apache-2.0 repository tooling. Historical protobuf BSD-3-Clause and applicable generator Apache-2.0 attributions are retained. Build tools are not bundled in client packages. Native-grpc-only Android generation remains retired.
+
+protobuf-generator-licence-r1
+Source: https://github.com/protocolbuffers/protobuf @ 35cd01f9fe9afbeea38cc7b979a3b6bfcde82c03
+Material licence: BSD-3-Clause
+Notice scope: packages
+Copyright 2008 Google Inc. All rights reserved.
+Copyright 2008 Google Inc.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+    * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Code generated by the Protocol Buffer compiler is owned by the owner
+of the input file used when generating it.  This code is not
+standalone and requires a support library to be linked with it.  This
+support library is itself covered by the above license.

package/README.md

@@ -12,10 +12,17 @@ const reply = await client.sayHello({ name: "World" }, { timeoutMs: 5000 });
 console.log(reply.message);
 ```
 
+`createPublicGrpcWebTransport` is the public business transport: binary gRPC-Web
+only, unknown fields retained and the shared 100-level nesting bound. It refuses
+`useBinaryFormat`, `jsonOptions` and `binaryOptions` overrides. The declared HTTP
+exception records have strict codecs such as `tryParsePartReceiptJson` and
+`serializePartReceiptJson`; they enforce the schema byte limit, UTF-8, JSON depth 32,
+duplicate-property and integer-lexeme rules before the closed schema check.
+
 The endpoint must serve gRPC-Web. Browser cross-origin access also requires
 server CORS configuration. The demo host binds to loopback for tests.
 
-React Native uses the same proto types and a separately validated Hermes
-transport; this browser client does not claim RN support.
+Android uses the separately published Kotlin artifacts with binary gRPC-Web.
+This package is the TypeScript Web client; it does not provide a mobile runtime.
 
 Apache-2.0. [Source and full setup](https://github.com/ArcForges/Contracts).

package/build-identity.json

@@ -0,0 +1,209 @@
+{
+  "schema": "arcforges.build-identity.v1",
+  "owner": "Contracts",
+  "artifact": {
+    "id": "@arcforges/api-client",
+    "version": "1.0.0-ci.244.1"
+  },
+  "build": {
+    "sourceCommit": "063762f32c551449fb01936d9ec30fedb77260de",
+    "dirty": false,
+    "kind": "ci",
+    "buildId": "36461962570.1",
+    "runId": "36461962570",
+    "runAttempt": 1,
+    "pipelineRun": "https://github.com/ArcForges/Contracts/actions/runs/36461962570",
+    "sourceDateEpoch": 1790618328
+  },
+  "axes": {
+    "AppVersion": {
+      "status": "not-applicable",
+      "reason": "Contracts distributes libraries, not an installed product."
+    },
+    "ContractSet": {
+      "status": "present",
+      "values": [
+        {
+          "subject": "arcforges.catalog",
+          "version": "1",
+          "source": {
+            "path": "public/proto/arcforges/catalog/v1/catalog.proto",
+            "sha256": "ff77d24be445e107d4fb4a0b3f7fd6b205664317e856a3696e471be1a18f0828"
+          },
+          "descriptorSha256": "4735c9b35035a39773980752ae9f541b8fa04cb0e2c8e449596a4bc0cd01bedf"
+        },
+        {
+          "subject": "arcforges.events",
+          "version": "1",
+          "source": {
+            "path": "public/proto/arcforges/events/v1/events.proto",
+            "sha256": "ea0ac740c06bbb5b81724b4a7e601110424cabc4940b07e579cf97d852880f43"
+          },
+          "descriptorSha256": "4735c9b35035a39773980752ae9f541b8fa04cb0e2c8e449596a4bc0cd01bedf"
+        },
+        {
+          "subject": "arcforges.foundation",
+          "version": "1",
+          "source": {
+            "path": "public/proto/arcforges/foundation/v1/foundation.proto",
+            "sha256": "adff62f65799bc5523965caf40f1f6bf11cbb4e2d769f46d9e3183a72a6d24d5"
+          },
+          "descriptorSha256": "4735c9b35035a39773980752ae9f541b8fa04cb0e2c8e449596a4bc0cd01bedf"
+        },
+        {
+          "subject": "arcforges.hello",
+          "version": "1",
+          "source": {
+            "path": "public/proto/arcforges/hello/v1/hello.proto",
+            "sha256": "92489f89d1898a3d3bbea56c72116416cd0152ae8866c98745739437020c67d9"
+          },
+          "descriptorSha256": "4735c9b35035a39773980752ae9f541b8fa04cb0e2c8e449596a4bc0cd01bedf"
+        },
+        {
+          "subject": "arcforges.publicapi",
+          "version": "1",
+          "descriptorSha256": "4735c9b35035a39773980752ae9f541b8fa04cb0e2c8e449596a4bc0cd01bedf",
+          "sources": [
+            {
+              "path": "public/proto/arcforges/publicapi/v1/commerce.proto",
+              "sha256": "e0ed5700197fdb20006c7ea699d9071dd8c4ac9d4248651f8a148363ad8af9dc"
+            },
+            {
+              "path": "public/proto/arcforges/publicapi/v1/content.proto",
+              "sha256": "1c912ac9fa37633a3e5d186cb6f3838bd886f09f935e1ce41c5a665640c54abd"
+            },
+            {
+              "path": "public/proto/arcforges/publicapi/v1/descriptors.proto",
+              "sha256": "d8a43c27fd345d55786a67ce9776efa0b4bc089f57361c3e532dd1b5f9326161"
+            },
+            {
+              "path": "public/proto/arcforges/publicapi/v1/inprocess-values.proto",
+              "sha256": "24921ae4f54f48800ea1201a9eee27a4e23a476b738cc3903665dff137a10eea"
+            }
+          ]
+        },
+        {
+          "subject": "json:DeclarativePanel",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/panel.schema.json",
+            "sha256": "e47e3fcad128918ca888c7f2a61ac03876ab50467a46b7597cda5cce53de21ce"
+          }
+        },
+        {
+          "subject": "json:ExtensionManifest",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/manifest.schema.json",
+            "sha256": "1f768f3d5cd7ffba35c2f2460914d6a7ab7f2b6988cb90abd02c8e49065ba844"
+          }
+        },
+        {
+          "subject": "json:ExtensionWorkflow",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/workflow.schema.json",
+            "sha256": "a23961e89badb790abca4f7fef01a833d647394b16194c51d7b4f79352181b42"
+          }
+        },
+        {
+          "subject": "json:PackageInventory",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/inventory.schema.json",
+            "sha256": "2d17acc663de43ff847e522ddb16f32b1e7ec356df7db7dcafe8342d3fb014ce"
+          }
+        },
+        {
+          "subject": "json:PartReceipt",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/schema.json",
+            "sha256": "8d4c1282c0f93452a0304e44c832179d4c6f65fa563ae53517aa324af87105ce"
+          }
+        },
+        {
+          "subject": "json:PolicyBody",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/policy-body.schema.json",
+            "sha256": "62509c5a2f104b4d84fcbee28a0bf41946e49a89a3c5baf1e609700e05f24f68"
+          }
+        },
+        {
+          "subject": "json:SignedFormats",
+          "version": "1",
+          "source": {
+            "path": "public/http/v1/signed-formats.schema.json",
+            "sha256": "9719004a495ae2475841dc3506b86a7ba8faa2eeb33d774dbf12effa5d495a03"
+          }
+        }
+      ]
+    },
+    "CapabilityVersion": {
+      "status": "not-produced",
+      "reason": "The selected contract records do not declare implemented product capabilities.",
+      "producer": "WP09 and product capability owners"
+    },
+    "NativeFormatVersion": {
+      "status": "not-produced",
+      "reason": "No portable product format exists here.",
+      "producer": "WP18/28, WP34 and WP38"
+    },
+    "StorageSchemaVersion": {
+      "status": "not-produced",
+      "reason": "Contracts owns no implemented migration set.",
+      "producer": "WP07/21 and product storage owners"
+    },
+    "NativeAbiVersion": {
+      "status": "not-applicable",
+      "reason": "These packages contain no first-party native C boundary."
+    },
+    "PolicySchemaVersion": {
+      "status": "not-produced",
+      "reason": "The selected schemas contain no implemented product policy declaration.",
+      "producer": "WP03 and WP44"
+    },
+    "ExtensionProtocolVersion": {
+      "status": "not-applicable",
+      "reason": "This package closure contains no extension protocol."
+    },
+    "PackageVersion": {
+      "status": "present",
+      "values": [
+        {
+          "subject": "pkg:npm/%40arcforges/proto",
+          "version": "1.0.0-ci.244.1",
+          "source": {
+            "path": "sbom.cdx.json#components",
+            "sha256": "7d1c0506884183be94130c1562bebe4f852bfeddb607cd9607c80cd8d2c00a22"
+          }
+        },
+        {
+          "subject": "pkg:npm/%40bufbuild/protobuf",
+          "version": "2.15.0",
+          "source": {
+            "path": "sbom.cdx.json#components",
+            "sha256": "7d1c0506884183be94130c1562bebe4f852bfeddb607cd9607c80cd8d2c00a22"
+          }
+        },
+        {
+          "subject": "pkg:npm/%40connectrpc/connect",
+          "version": "2.2.0",
+          "source": {
+            "path": "sbom.cdx.json#components",
+            "sha256": "7d1c0506884183be94130c1562bebe4f852bfeddb607cd9607c80cd8d2c00a22"
+          }
+        },
+        {
+          "subject": "pkg:npm/%40connectrpc/connect-web",
+          "version": "2.2.0",
+          "source": {
+            "path": "sbom.cdx.json#components",
+            "sha256": "7d1c0506884183be94130c1562bebe4f852bfeddb607cd9607c80cd8d2c00a22"
+          }
+        }
+      ]
+    }
+  }
+}

package/dist/gen/http.d.ts

@@ -0,0 +1,10 @@
+export * from "../shapes/gen/ExtensionManifest.js";
+export * from "../shapes/gen/ExtensionWorkflow.js";
+export * from "../shapes/gen/DeclarativePanel.js";
+export * from "../shapes/gen/PolicyBody.js";
+export * from "../shapes/gen/PartReceipt.js";
+export * from "../shapes/gen/PackageInventory.js";
+export * from "../shapes/gen/CatalogIndex.js";
+export * from "../shapes/gen/CatalogRevocations.js";
+export * from "../shapes/gen/AndroidUpdate.js";
+export * from "../shapes/gen/RealmDescriptor.js";

package/dist/gen/http.js

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: Apache-2.0
+// <auto-generated />
+// Generated by eng/generate_shapes.py; do not edit.
+export * from "../shapes/gen/ExtensionManifest.js";
+export * from "../shapes/gen/ExtensionWorkflow.js";
+export * from "../shapes/gen/DeclarativePanel.js";
+export * from "../shapes/gen/PolicyBody.js";
+export * from "../shapes/gen/PartReceipt.js";
+export * from "../shapes/gen/PackageInventory.js";
+export * from "../shapes/gen/CatalogIndex.js";
+export * from "../shapes/gen/CatalogRevocations.js";
+export * from "../shapes/gen/AndroidUpdate.js";
+export * from "../shapes/gen/RealmDescriptor.js";

package/dist/index.d.ts

@@ -1,9 +1,18 @@
+import type { Transport } from "@connectrpc/connect";
 import type { GrpcWebTransportOptions } from "@connectrpc/connect-web";
+/** Caller-owned endpoint, fetch, interceptors and timeout; the wire format is fixed. */
+export type PublicGrpcWebTransportOptions = Omit<GrpcWebTransportOptions, "useBinaryFormat" | "jsonOptions" | "binaryOptions">;
+/**
+ * Creates the public business transport: binary gRPC-Web only, unknown fields
+ * retained and the shared nesting bound. JSON selection is refused.
+ */
+export declare function createPublicGrpcWebTransport(options: PublicGrpcWebTransportOptions): Transport;
 /** Creates the example client using the caller's gRPC-Web endpoint and fetch. */
-export declare function createHelloClient(options: GrpcWebTransportOptions): import("@connectrpc/connect").Client<import("@bufbuild/protobuf/codegenv2").GenService<{
+export declare function createHelloClient(options: PublicGrpcWebTransportOptions): import("@connectrpc/connect").Client<import("@bufbuild/protobuf/codegenv2").GenService<{
     sayHello: {
         methodKind: "unary";
         input: typeof import("@arcforges/proto").SayHelloRequestSchema;
         output: typeof import("@arcforges/proto").SayHelloResponseSchema;
     };
 }>>;
+export * from "./gen/http.js";

package/dist/index.js

@@ -1,8 +1,26 @@
 // SPDX-License-Identifier: Apache-2.0
-import { HelloService } from "@arcforges/proto";
+import { contractBinaryReadOptions, HelloService } from "@arcforges/proto";
 import { createClient } from "@connectrpc/connect";
 import { createGrpcWebTransport } from "@connectrpc/connect-web";
+/**
+ * Creates the public business transport: binary gRPC-Web only, unknown fields
+ * retained and the shared nesting bound. JSON selection is refused.
+ */
+export function createPublicGrpcWebTransport(options) {
+    const selected = options;
+    if (selected.useBinaryFormat !== undefined ||
+        selected.jsonOptions !== undefined ||
+        selected.binaryOptions !== undefined) {
+        throw new TypeError("Public ArcForges business calls use binary gRPC-Web with fixed codec options.");
+    }
+    return createGrpcWebTransport({
+        ...options,
+        useBinaryFormat: true,
+        binaryOptions: { ...contractBinaryReadOptions, writeUnknownFields: true },
+    });
+}
 /** Creates the example client using the caller's gRPC-Web endpoint and fetch. */
 export function createHelloClient(options) {
-    return createClient(HelloService, createGrpcWebTransport(options));
+    return createClient(HelloService, createPublicGrpcWebTransport(options));
 }
+export * from "./gen/http.js";

package/dist/shapes/gen/AndroidUpdate.d.ts

@@ -0,0 +1,41 @@
+export interface AndroidUpdate {
+    schemaVersion: string;
+    realmId: string;
+    channel: string;
+    revision: string;
+    issuedAt: string;
+    expiresAt: string;
+    keyId: string;
+    bodyHash: string;
+    body: AndroidUpdateBody;
+    signature: string;
+}
+export interface AndroidUpdateBody {
+    packageId: string;
+    channel: string;
+    versionName: string;
+    versionCode: string;
+    minSdk: number;
+    minSupportedVersionCode: string;
+    apkUrl: string;
+    sha256: string;
+    size: string;
+    signingCertificateSha256: string;
+    releaseNotesUrl: string;
+    publishedAt: string;
+}
+export declare function isAndroidUpdate(value: unknown): value is AndroidUpdate;
+/** The schema's declared UTF-8 document bound in bytes. */
+export declare const androidUpdateJsonMaxBytes = 1048576;
+/** Parses one strict AndroidUpdate document; refusal kinds match the C# codec. */
+export declare function tryParseAndroidUpdateJson(input: Uint8Array | string): {
+    ok: true;
+    value: AndroidUpdate;
+} | {
+    ok: false;
+    failure: "tooLarge" | "malformed" | "invalid";
+};
+/** Parses one strict AndroidUpdate document or throws an error carrying the refusal kind. */
+export declare function parseAndroidUpdateJson(input: Uint8Array | string): AndroidUpdate;
+/** Writes compact UTF-8 in schema property order and refuses output the schema rejects. */
+export declare function serializeAndroidUpdateJson(value: AndroidUpdate): Uint8Array;