@cloudcrane/app-runtime 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chirag Phor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,40 @@
-# Temporary Holding Version
+# @cloudcrane/app-runtime
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Builds a CloudCrane app spec into one HTML page: the same bytes for the same
+spec and runtime version, every time. It writes no code and uses no AI: it
+checks the spec, turns its tokens into CSS, puts the spec in the page as data,
+and inlines the runtime that draws it with A2UI's renderer.
+
+```js
+import { compile } from "@cloudcrane/app-runtime";
+
+const { html, sha256, runtime } = compile(spec);
+```
+
+- `compile(spec)` returns the page, its sha256 and the runtime it was built
+  with (`@cloudcrane/app-runtime@0.2.0+<hash>`); it throws `CompileError`
+  listing every problem when the spec doesn't validate.
+- Each runtime version is locked to one bundle hash (`runtime-lock.json`), so a
+  version always draws apps the same way.
+- A coded component runs in a frame that's sandboxed (scripts only, so it has
+  no storage and nothing of the page's), in a closed shadow root, reached only
+  through a `MessagePort`. Under CloudCrane's lockdown the lockdown makes the
+  frame (`window.__ccFrame`); elsewhere the runtime makes the same kind. The
+  page drives it: a seed and the inputs, then its clock each frame, paused
+  while hidden. The game kit turns that clock into fixed steps, so a game moves
+  the same way for the same time and seed:
+
+  ```js
+  game.start({ rate: 6, setup() {}, step() {}, draw(g, width, height) {} });
+  game.on("swipe", (dir) => {}); // also "tap" and "input"
+  game.state = { score }; // shown at /ui/coded/<id>/state
+  game.emit("over", { score }); // the screen's action for "over" runs
+  game.random(); // seeded by the page
+  ```
+
+- `@cloudcrane/app-runtime/host`: what a host publishing spec apps needs in one
+  import (validate, compile, derive the blueprint).
+
+The runtime inlined in every page includes code from other open-source
+packages; their licences are in `THIRD_PARTY_LICENSES.txt`. `zod` 3.25 is a
+peer dependency. MIT licensed.