@greensecurity/javascript-sdk 0.45.0 → 0.46.0-beta.10

package/dist/commonjs/apps/protocol.js

@@ -0,0 +1,55 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Part of the third-party app platform contract;
+ * see docs/third-party-apps/plan.md.
+ *
+ * Two layers travel between the host and a sandbox:
+ *  1. Bootstrap envelopes (`HostToBootstrap` / `BootstrapToHost`): plain JSON between the host
+ *     and the trusted `runtime.html` page, which owns the worker's lifecycle.
+ *  2. Thread messages: `@quilted/threads` traffic between the host and the app's worker, carried
+ *     inside `{ kind: "thread" }` envelopes. `SandboxExports` and `HostApi` are the two sides.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEARTBEAT_MAX_MISSES = exports.HEARTBEAT_INTERVAL_MS = exports.MAX_ENVELOPE_CHARS = exports.TOAST_MAX_LENGTH = void 0;
+exports.isBootstrapToHost = isBootstrapToHost;
+exports.TOAST_MAX_LENGTH = 30;
+/** Largest single envelope either side accepts, in UTF-16 code units of its JSON form. */
+exports.MAX_ENVELOPE_CHARS = 1000000;
+exports.HEARTBEAT_INTERVAL_MS = 2000;
+exports.HEARTBEAT_MAX_MISSES = 3;
+const LOG_LEVELS = new Set(["debug", "info", "warn", "error"]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isDiagnostic(value) {
+    return isRecord(value) && typeof value["message"] === "string" &&
+        (value["file"] === undefined || typeof value["file"] === "string") &&
+        (value["line"] === undefined || Number.isSafeInteger(value["line"]));
+}
+/**
+ * Shape check for envelopes the host receives from the sandbox, which is untrusted: every
+ * variant's payload is checked, not just its `kind`. The payload of `thread` is checked by the
+ * thread layer.
+ */
+function isBootstrapToHost(value) {
+    if (!isRecord(value))
+        return false;
+    switch (value["kind"]) {
+        case "ready":
+            return true;
+        case "thread":
+            return "data" in value;
+        case "integrity_failed":
+        case "crashed":
+            return typeof value["reason"] === "string";
+        case "reloaded":
+            return Number.isSafeInteger(value["seq"]);
+        case "log":
+            return typeof value["level"] === "string" && LOG_LEVELS.has(value["level"]) && typeof value["message"] === "string";
+        case "build_error":
+            return Array.isArray(value["diagnostics"]) && value["diagnostics"].every(isDiagnostic);
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=protocol.js.map

package/dist/commonjs/apps/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../src/apps/protocol.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAiHH,8CAoBC;AA5EY,QAAA,gBAAgB,GAAG,EAAE,CAAC;AAEnC,0FAA0F;AAC7E,QAAA,kBAAkB,GAAG,OAAS,CAAC;AAE/B,QAAA,qBAAqB,GAAG,IAAK,CAAC;AAC9B,QAAA,oBAAoB,GAAG,CAAC,CAAC;AAiCtC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAE/D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ;QAC5D,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;QAClE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnC,QAAQ,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,MAAM,IAAI,KAAK,CAAC;QACzB,KAAK,kBAAkB,CAAC;QACxB,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;QAC7C,KAAK,UAAU;YACb,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,KAAK,KAAK;YACR,OAAO,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC;QACtH,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACzF;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/commonjs/apps/review.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The thresholds and lists the review applies to a submission's added permissions.
+ *
+ * - `purpose_min_chars`: the shortest `purpose` accepted for an added permission, after trimming.
+ * - `justification_min_chars`: the shortest `justification` accepted for an added sensitive
+ *   permission, after trimming.
+ * - `read_only_actions`: the permission actions that only read. Every other action (`add`, `edit`,
+ *   `delete`, `write`, and any added later) writes, and a permission that writes is sensitive.
+ * - `pii_resources`: the resources whose records identify people or describe them (names, contact
+ *   details, credentials, background checks, visits, payment details). Reading one is sensitive.
+ */
+export declare const REVIEW_RULES: Readonly<{
+    readonly purpose_min_chars: 30;
+    readonly justification_min_chars: 40;
+    readonly read_only_actions: readonly ["view", "search"];
+    readonly pii_resources: readonly ["background_checks", "communications", "company_managers", "contacts", "credentials", "criminal_history", "events", "invoices", "mobile_devices", "payment_profiles", "users", "vendor_credentials", "vendor_scans", "vendor_transactions", "vendors", "visitor_checkins", "visitors", "watchlist_entries"];
+}>;
+/**
+ * Whether a `resource.action` permission is sensitive: it writes (any action that is not read-only)
+ * or it reads a resource about people. A sensitive permission added by a submission needs a
+ * `justification` as well as a `purpose`, and holds the submission for a Green Security admin.
+ */
+export declare function isSensitivePermission(permission: string): boolean;
+/** Why a host is on the denylist. */
+export type CspDenylistCategory = "tunnel" | "pastebin" | "url_shortener" | "raw_code_host" | "dynamic_dns";
+export interface CspDenylistEntry {
+    /** A registrable domain or host. It matches itself and every name under it. */
+    domain: string;
+    category: CspDenylistCategory;
+}
+/**
+ * Hosts a submission may never add to `connect_src` or `image_src`, nor serve its bundle from. Each
+ * lets anybody publish content, or point a name at any address, without owning a domain, so an app
+ * that could reach one could reach anything:
+ *
+ * - `tunnel`: expose a local server under a shared domain;
+ * - `pastebin`: host arbitrary text, including code and exfiltrated data;
+ * - `url_shortener`: redirect to a destination the review never saw;
+ * - `raw_code_host`: serve files straight out of anybody's repository or gist;
+ * - `dynamic_dns`: hand out names under a shared domain, including the wildcard DNS services that
+ *   resolve a name such as `10.0.0.1.nip.io` to the IP address inside it.
+ */
+export declare const CSP_DENYLIST: readonly CspDenylistEntry[];
+/**
+ * The denylist entry a host falls under, or `undefined` when it is on none: the host is the entry's
+ * domain or a name under it (`abc.trycloudflare.com`). Case and a trailing dot are ignored.
+ */
+export declare function cspDenylistEntry(host: string): CspDenylistEntry | undefined;
+/** One problem the review would find with an added permission, as the catalog reports it. */
+export interface PermissionReviewIssue {
+    code: "purpose_too_short" | "purpose_is_permission_name" | "purpose_repeated" | "justification_required" | "justification_too_short" | "justification_repeats_purpose";
+    path: string;
+    message: string;
+}
+/**
+ * The justification rules the review applies to the permissions a submission adds, so the CLI can
+ * report them before upload. `added` names the permissions that are new since the last accepted
+ * version; the rest are not checked. Every entry's `purpose` counts when looking for repeats.
+ */
+export declare function permissionReviewIssues(permissions: ReadonlyArray<{
+    permission: string;
+    purpose: string;
+    justification?: string | undefined;
+}>, added: ReadonlySet<string>): PermissionReviewIssue[];
+//# sourceMappingURL=review.d.ts.map

package/dist/commonjs/apps/review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.d.ts","sourceRoot":"","sources":["../../../src/apps/review.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY;;;;;EAwBd,CAAC;AAKZ;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAOjE;AAED,qCAAqC;AACrC,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,UAAU,GAAG,eAAe,GAAG,eAAe,GAAG,aAAa,CAAC;AAE5G,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAMD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,gBAAgB,EA6FlD,CAAC;AAEH;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAG3E;AAED,6FAA6F;AAC7F,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,GAAG,4BAA4B,GAAG,kBAAkB,GAAG,wBAAwB,GACpG,yBAAyB,GAAG,+BAA+B,CAAC;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,aAAa,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC,EACvG,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,qBAAqB,EAAE,CAqCzB"}

package/dist/commonjs/apps/review.js

@@ -0,0 +1,231 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Part of the third-party app platform contract;
+ * see docs/third-party-apps/plan.md (C18).
+ *
+ * The automated review every catalog submission goes through, as data the server and the CLI
+ * share: which permissions count as sensitive, how long a `purpose` and a `justification` must be,
+ * and which CSP hosts are never accepted. The server reads the JSON these are written to
+ * (`shared/app-platform/review-rules.json` and `csp-denylist.json`); `src/__tests__/apps` keeps the
+ * files in step. Deliberately dependency-free (no zod), like `url.ts`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CSP_DENYLIST = exports.REVIEW_RULES = void 0;
+exports.isSensitivePermission = isSensitivePermission;
+exports.cspDenylistEntry = cspDenylistEntry;
+exports.permissionReviewIssues = permissionReviewIssues;
+/**
+ * The thresholds and lists the review applies to a submission's added permissions.
+ *
+ * - `purpose_min_chars`: the shortest `purpose` accepted for an added permission, after trimming.
+ * - `justification_min_chars`: the shortest `justification` accepted for an added sensitive
+ *   permission, after trimming.
+ * - `read_only_actions`: the permission actions that only read. Every other action (`add`, `edit`,
+ *   `delete`, `write`, and any added later) writes, and a permission that writes is sensitive.
+ * - `pii_resources`: the resources whose records identify people or describe them (names, contact
+ *   details, credentials, background checks, visits, payment details). Reading one is sensitive.
+ */
+exports.REVIEW_RULES = Object.freeze({
+    purpose_min_chars: 30,
+    justification_min_chars: 40,
+    read_only_actions: Object.freeze(["view", "search"]),
+    pii_resources: Object.freeze([
+        "background_checks",
+        "communications",
+        "company_managers",
+        "contacts",
+        "credentials",
+        "criminal_history",
+        "events",
+        "invoices",
+        "mobile_devices",
+        "payment_profiles",
+        "users",
+        "vendor_credentials",
+        "vendor_scans",
+        "vendor_transactions",
+        "vendors",
+        "visitor_checkins",
+        "visitors",
+        "watchlist_entries",
+    ]),
+});
+const READ_ONLY_ACTIONS = new Set(exports.REVIEW_RULES.read_only_actions);
+const PII_RESOURCES = new Set(exports.REVIEW_RULES.pii_resources);
+/**
+ * Whether a `resource.action` permission is sensitive: it writes (any action that is not read-only)
+ * or it reads a resource about people. A sensitive permission added by a submission needs a
+ * `justification` as well as a `purpose`, and holds the submission for a Green Security admin.
+ */
+function isSensitivePermission(permission) {
+    const dot = permission.indexOf(".");
+    if (dot <= 0 || dot === permission.length - 1)
+        return true;
+    const resource = permission.slice(0, dot);
+    const action = permission.slice(dot + 1);
+    return !READ_ONLY_ACTIONS.has(action) || PII_RESOURCES.has(resource);
+}
+function entries(category, domains) {
+    return domains.map((domain) => ({ domain, category }));
+}
+/**
+ * Hosts a submission may never add to `connect_src` or `image_src`, nor serve its bundle from. Each
+ * lets anybody publish content, or point a name at any address, without owning a domain, so an app
+ * that could reach one could reach anything:
+ *
+ * - `tunnel`: expose a local server under a shared domain;
+ * - `pastebin`: host arbitrary text, including code and exfiltrated data;
+ * - `url_shortener`: redirect to a destination the review never saw;
+ * - `raw_code_host`: serve files straight out of anybody's repository or gist;
+ * - `dynamic_dns`: hand out names under a shared domain, including the wildcard DNS services that
+ *   resolve a name such as `10.0.0.1.nip.io` to the IP address inside it.
+ */
+exports.CSP_DENYLIST = Object.freeze([
+    ...entries("tunnel", [
+        "trycloudflare.com",
+        "ngrok.io",
+        "ngrok.app",
+        "ngrok.dev",
+        "ngrok-free.app",
+        "ngrok-free.dev",
+        "loca.lt",
+        "localtunnel.me",
+        "localhost.run",
+        "lhr.life",
+        "serveo.net",
+        "serveousercontent.com",
+        "pagekite.me",
+        "tunnelto.dev",
+        "bore.pub",
+        "loclx.io",
+        "localxpose.io",
+        "pinggy.io",
+        "pinggy.link",
+        "devtunnels.ms",
+        "tunnelmole.net",
+        "localtonet.com",
+        "zrok.io",
+        "sharedwithexpose.com",
+    ]),
+    ...entries("pastebin", [
+        "pastebin.com",
+        "paste.ee",
+        "hastebin.com",
+        "rentry.co",
+        "dpaste.com",
+        "dpaste.org",
+        "paste.rs",
+        "termbin.com",
+        "controlc.com",
+        "justpaste.it",
+        "privatebin.net",
+        "pastes.dev",
+        "ix.io",
+        "sprunge.us",
+    ]),
+    ...entries("url_shortener", [
+        "bit.ly",
+        "tinyurl.com",
+        "t.co",
+        "goo.gl",
+        "ow.ly",
+        "is.gd",
+        "v.gd",
+        "buff.ly",
+        "rebrand.ly",
+        "cutt.ly",
+        "shorturl.at",
+        "rb.gy",
+        "tiny.cc",
+        "t.ly",
+        "bl.ink",
+    ]),
+    ...entries("raw_code_host", [
+        "raw.githubusercontent.com",
+        "gist.githubusercontent.com",
+        "gist.github.com",
+        "raw.githack.com",
+        "rawcdn.githack.com",
+        "cdn.statically.io",
+    ]),
+    ...entries("dynamic_dns", [
+        "duckdns.org",
+        "no-ip.com",
+        "no-ip.org",
+        "ddns.net",
+        "hopto.org",
+        "zapto.org",
+        "sytes.net",
+        "dynu.com",
+        "dynu.net",
+        "dyndns.org",
+        "dynalias.com",
+        "changeip.com",
+        "afraid.org",
+        "mooo.com",
+        "dedyn.io",
+        "nsupdate.info",
+        "ydns.eu",
+        "dynv6.net",
+        "nip.io",
+        "sslip.io",
+        "xip.io",
+        "traefik.me",
+        "localtest.me",
+    ]),
+]);
+/**
+ * The denylist entry a host falls under, or `undefined` when it is on none: the host is the entry's
+ * domain or a name under it (`abc.trycloudflare.com`). Case and a trailing dot are ignored.
+ */
+function cspDenylistEntry(host) {
+    const name = host.toLowerCase().replace(/\.$/, "");
+    return exports.CSP_DENYLIST.find((entry) => name === entry.domain || name.endsWith(`.${entry.domain}`));
+}
+/** Lower case, with every run of non-alphanumerics collapsed to one space: how two texts are compared. */
+function normalizedText(text) {
+    return text.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+}
+/**
+ * The justification rules the review applies to the permissions a submission adds, so the CLI can
+ * report them before upload. `added` names the permissions that are new since the last accepted
+ * version; the rest are not checked. Every entry's `purpose` counts when looking for repeats.
+ */
+function permissionReviewIssues(permissions, added) {
+    const issues = [];
+    const purposeCounts = new Map();
+    for (const entry of permissions) {
+        const key = normalizedText(entry.purpose);
+        purposeCounts.set(key, (purposeCounts.get(key) ?? 0) + 1);
+    }
+    permissions.forEach((entry, index) => {
+        if (!added.has(entry.permission))
+            return;
+        const path = `permissions.${index}`;
+        const purpose = normalizedText(entry.purpose);
+        const [resource = "", action = ""] = entry.permission.split(".");
+        if (entry.purpose.trim().length < exports.REVIEW_RULES.purpose_min_chars) {
+            issues.push({ code: "purpose_too_short", path: `${path}.purpose`, message: `must be at least ${exports.REVIEW_RULES.purpose_min_chars} characters and say what the app does with ${entry.permission}` });
+        }
+        if ([normalizedText(entry.permission), normalizedText(resource), normalizedText(`${action} ${resource}`)].includes(purpose)) {
+            issues.push({ code: "purpose_is_permission_name", path: `${path}.purpose`, message: "must explain what the app does with the permission, not repeat its name" });
+        }
+        if ((purposeCounts.get(purpose) ?? 0) > 1) {
+            issues.push({ code: "purpose_repeated", path: `${path}.purpose`, message: "must be written for this permission; another permission has the same purpose" });
+        }
+        if (!isSensitivePermission(entry.permission))
+            return;
+        const justification = entry.justification?.trim() ?? "";
+        if (justification.length === 0) {
+            issues.push({ code: "justification_required", path: `${path}.justification`, message: `${entry.permission} is sensitive and needs a justification explaining why the app cannot work without it` });
+        }
+        else if (justification.length < exports.REVIEW_RULES.justification_min_chars) {
+            issues.push({ code: "justification_too_short", path: `${path}.justification`, message: `must be at least ${exports.REVIEW_RULES.justification_min_chars} characters` });
+        }
+        else if (normalizedText(justification) === purpose) {
+            issues.push({ code: "justification_repeats_purpose", path: `${path}.justification`, message: "must say why the permission is needed, not repeat its purpose" });
+        }
+    });
+    return issues;
+}
+//# sourceMappingURL=review.js.map

package/dist/commonjs/apps/review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review.js","sourceRoot":"","sources":["../../../src/apps/review.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA+CH,sDAOC;AA8HD,4CAGC;AAoBD,wDAwCC;AAjPD;;;;;;;;;;GAUG;AACU,QAAA,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,iBAAiB,EAAE,EAAE;IACrB,uBAAuB,EAAE,EAAE;IAC3B,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAC;IAC7D,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,mBAAmB;QACnB,gBAAgB;QAChB,kBAAkB;QAClB,UAAU;QACV,aAAa;QACb,kBAAkB;QAClB,QAAQ;QACR,UAAU;QACV,gBAAgB;QAChB,kBAAkB;QAClB,OAAO;QACP,oBAAoB;QACpB,cAAc;QACd,qBAAqB;QACrB,SAAS;QACT,kBAAkB;QAClB,UAAU;QACV,mBAAmB;KACX,CAAC;CACH,CAAC,CAAC;AAEZ,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,oBAAY,CAAC,iBAAiB,CAAC,CAAC;AACvF,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,oBAAY,CAAC,aAAa,CAAC,CAAC;AAE/E;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,UAAkB;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAWD,SAAS,OAAO,CAAC,QAA6B,EAAE,OAA0B;IACxE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACU,QAAA,YAAY,GAAgC,MAAM,CAAC,MAAM,CAAC;IACrE,GAAG,OAAO,CAAC,QAAQ,EAAE;QACnB,mBAAmB;QACnB,UAAU;QACV,WAAW;QACX,WAAW;QACX,gBAAgB;QAChB,gBAAgB;QAChB,SAAS;QACT,gBAAgB;QAChB,eAAe;QACf,UAAU;QACV,YAAY;QACZ,uBAAuB;QACvB,aAAa;QACb,cAAc;QACd,UAAU;QACV,UAAU;QACV,eAAe;QACf,WAAW;QACX,aAAa;QACb,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,SAAS;QACT,sBAAsB;KACvB,CAAC;IACF,GAAG,OAAO,CAAC,UAAU,EAAE;QACrB,cAAc;QACd,UAAU;QACV,cAAc;QACd,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,aAAa;QACb,cAAc;QACd,cAAc;QACd,gBAAgB;QAChB,YAAY;QACZ,OAAO;QACP,YAAY;KACb,CAAC;IACF,GAAG,OAAO,CAAC,eAAe,EAAE;QAC1B,QAAQ;QACR,aAAa;QACb,MAAM;QACN,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,SAAS;QACT,YAAY;QACZ,SAAS;QACT,aAAa;QACb,OAAO;QACP,SAAS;QACT,MAAM;QACN,QAAQ;KACT,CAAC;IACF,GAAG,OAAO,CAAC,eAAe,EAAE;QAC1B,2BAA2B;QAC3B,4BAA4B;QAC5B,iBAAiB;QACjB,iBAAiB;QACjB,oBAAoB;QACpB,mBAAmB;KACpB,CAAC;IACF,GAAG,OAAO,CAAC,aAAa,EAAE;QACxB,aAAa;QACb,WAAW;QACX,WAAW;QACX,UAAU;QACV,WAAW;QACX,WAAW;QACX,WAAW;QACX,UAAU;QACV,UAAU;QACV,YAAY;QACZ,cAAc;QACd,cAAc;QACd,YAAY;QACZ,UAAU;QACV,UAAU;QACV,eAAe;QACf,SAAS;QACT,WAAW;QACX,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,YAAY;QACZ,cAAc;KACf,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,oBAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAUD,0GAA0G;AAC1G,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CACpC,WAAuG,EACvG,KAA0B;IAE1B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO;QAEzC,MAAM,IAAI,GAAG,eAAe,KAAK,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,CAAC,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,oBAAY,CAAC,iBAAiB,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,OAAO,EAAE,oBAAoB,oBAAY,CAAC,iBAAiB,8CAA8C,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACnM,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5H,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,OAAO,EAAE,yEAAyE,EAAE,CAAC,CAAC;QACnK,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,GAAG,IAAI,UAAU,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;QAC9J,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO;QAErD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACxD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,UAAU,uFAAuF,EAAE,CAAC,CAAC;QACtM,CAAC;aAAM,IAAI,aAAa,CAAC,MAAM,GAAG,oBAAY,CAAC,uBAAuB,EAAE,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,EAAE,OAAO,EAAE,oBAAoB,oBAAY,CAAC,uBAAuB,aAAa,EAAE,CAAC,CAAC;QAClK,CAAC;aAAM,IAAI,cAAc,CAAC,aAAa,CAAC,KAAK,OAAO,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,GAAG,IAAI,gBAAgB,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;QAClK,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/commonjs/apps/route.d.ts

@@ -0,0 +1,18 @@
+import { type SurfaceId } from "./surfaces.js";
+/** Values the destination view receives as `environment.queryParams`. Strings only. */
+export type EnvParams = Record<string, string>;
+export type RouteDescriptor = 
+/** The screen a surface lives on, optionally for one record (detail surfaces). */
+{
+    type: "surface";
+    surfaceId: SurfaceId;
+    objectId?: number;
+    envParams?: EnvParams;
+}
+/** The calling app's own settings page (the `settings` surface). */
+ | {
+    type: "appSettings";
+    envParams?: EnvParams;
+};
+export declare function isRouteDescriptor(value: unknown): value is RouteDescriptor;
+//# sourceMappingURL=route.d.ts.map

package/dist/commonjs/apps/route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../src/apps/route.ts"],"names":[],"mappings":"AAQA,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5D,uFAAuF;AACvF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/C,MAAM,MAAM,eAAe;AACzB,kFAAkF;AAChF;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE;AACrF,oEAAoE;GAClE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAEnD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAmB1E"}

package/dist/commonjs/apps/route.js

@@ -0,0 +1,36 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Part of the third-party app platform contract;
+ * see docs/third-party-apps/plan.md.
+ *
+ * Apps never navigate by path. They name a destination and the host maps it to its own routes,
+ * which keeps host URLs free to change and stops an app from steering users to arbitrary pages.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isRouteDescriptor = isRouteDescriptor;
+const surfaces_js_1 = require("./surfaces.js");
+function isRouteDescriptor(value) {
+    if (typeof value !== "object" || value === null || !("type" in value))
+        return false;
+    const v = value;
+    if (v["envParams"] !== undefined && !isEnvParams(v["envParams"]))
+        return false;
+    switch (v["type"]) {
+        case "surface":
+            // Only catalog surfaces: the host has no route for anything else. Safe integers only, so a
+            // record id is never silently rounded on its way through JSON. `settings` is reachable only
+            // as `appSettings`, which always means the calling app: as a plain surface its `objectId`
+            // would name another app's settings page.
+            return (0, surfaces_js_1.isSurfaceId)(v["surfaceId"]) && v["surfaceId"] !== "settings" &&
+                (v["objectId"] === undefined || (Number.isSafeInteger(v["objectId"]) && v["objectId"] > 0));
+        case "appSettings":
+            return true;
+        default:
+            return false;
+    }
+}
+function isEnvParams(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value) &&
+        Object.values(value).every((v) => typeof v === "string");
+}
+//# sourceMappingURL=route.js.map

package/dist/commonjs/apps/route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../src/apps/route.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAaH,8CAmBC;AA9BD,+CAA4D;AAW5D,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpF,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/E,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,2FAA2F;YAC3F,4FAA4F;YAC5F,0FAA0F;YAC1F,0CAA0C;YAC1C,OAAO,IAAA,yBAAW,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,UAAU;gBACjE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAK,CAAC,CAAC,UAAU,CAAY,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5G,KAAK,aAAa;YAChB,OAAO,IAAI,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC7D,CAAC"}

package/dist/commonjs/apps/runtime/console.d.ts

@@ -0,0 +1,23 @@
+import type { BootstrapToHost } from "../protocol.js";
+export type LogEnvelope = Extract<BootstrapToHost, {
+    kind: "log";
+}>;
+export type LogLevel = LogEnvelope["level"];
+/** Longest message forwarded; well under C0's `MAX_ENVELOPE_CHARS`. */
+export declare const MAX_LOG_MESSAGE_CHARS = 8000;
+/** What a credential is replaced with in a forwarded line. */
+export declare const REDACTED = "[redacted]";
+export interface ForwardConsoleOptions {
+    /** Current secrets (the mounted views' access tokens), read on every forwarded line. */
+    secrets?: () => Iterable<string>;
+}
+/** Removes credentials from a line about to leave the sandbox. */
+export declare function redactLogMessage(message: string, secrets?: Iterable<string>): string;
+/**
+ * Patches `console` once; later calls replace the sink. Returns a function that restores the
+ * original methods.
+ */
+export declare function forwardConsole(post: (envelope: LogEnvelope) => void, target?: Console, options?: ForwardConsoleOptions): () => void;
+/** Formats `console` arguments into one redacted line, truncated to {@link MAX_LOG_MESSAGE_CHARS}. */
+export declare function formatLogArgs(args: readonly unknown[], secrets?: Iterable<string>): string;
+//# sourceMappingURL=console.d.ts.map

package/dist/commonjs/apps/runtime/console.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../../../src/apps/runtime/console.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AACpE,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;AAE5C,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAE3C,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,eAAe,CAAC;AASrC,MAAM,WAAW,qBAAqB;IACpC,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;CAClC;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAM,GAAG,MAAM,CAMxF;AAYD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,EACrC,MAAM,GAAE,OAAiB,EACzB,OAAO,GAAE,qBAA0B,GAClC,MAAM,IAAI,CAgCZ;AAED,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAM,GAAG,MAAM,CAI9F"}

package/dist/commonjs/apps/runtime/console.js

@@ -0,0 +1,108 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Third-party app developer kit (C10); see
+ * docs/third-party-apps/plan.md.
+ *
+ * Dev sessions only (`context.environment.devSessionId`): mirrors the worker's `console.*`
+ * calls to the host so `apps-cli dev` can print them. `HostApi` has no log method, so the
+ * runtime posts C0's `BootstrapToHost` `log` envelope on the worker channel, next to (not
+ * inside) the thread traffic. The bootstrap is expected to forward it to the host as-is; see
+ * `transport.ts` for the channel assumptions.
+ *
+ * Forwarded lines leave the sandbox, so credentials are redacted from them first: the current
+ * access tokens of every mounted view (passed in by the runtime), anything token-shaped
+ * (`gsu_…`, `gsi_…`, `gsd_…`, `gsdr_…`), and the value of any `Bearer` credential. The worker's
+ * own console still gets the original arguments.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDACTED = exports.MAX_LOG_MESSAGE_CHARS = void 0;
+exports.redactLogMessage = redactLogMessage;
+exports.forwardConsole = forwardConsole;
+exports.formatLogArgs = formatLogArgs;
+/** Longest message forwarded; well under C0's `MAX_ENVELOPE_CHARS`. */
+exports.MAX_LOG_MESSAGE_CHARS = 8000;
+/** What a credential is replaced with in a forwarded line. */
+exports.REDACTED = "[redacted]";
+/** Green Security token prefixes (`gsu_`, `gsi_`, `gsd_`, `gsdr_`, …) and what follows them. */
+const TOKEN_SHAPED = /\bgs[a-z]{1,4}_[A-Za-z0-9._~+/=-]+/g;
+/** The credential after `Bearer`, as it appears in an Authorization header. */
+const BEARER = /\b(Bearer\s+)[^\s"',;]+/gi;
+/** Shorter strings are not treated as secrets, so a blank or tiny token cannot blank the log. */
+const MIN_SECRET_LENGTH = 8;
+/** Removes credentials from a line about to leave the sandbox. */
+function redactLogMessage(message, secrets = []) {
+    let text = message;
+    for (const secret of secrets) {
+        if (typeof secret === "string" && secret.length >= MIN_SECRET_LENGTH)
+            text = text.split(secret).join(exports.REDACTED);
+    }
+    return text.replace(BEARER, `$1${exports.REDACTED}`).replace(TOKEN_SHAPED, exports.REDACTED);
+}
+const METHODS = [
+    ["debug", "debug"],
+    ["info", "info"],
+    ["log", "info"],
+    ["warn", "warn"],
+    ["error", "error"],
+];
+let restore;
+/**
+ * Patches `console` once; later calls replace the sink. Returns a function that restores the
+ * original methods.
+ */
+function forwardConsole(post, target = console, options = {}) {
+    restore?.();
+    const originals = new Map();
+    let forwarding = false;
+    for (const [method, level] of METHODS) {
+        const original = target[method].bind(target);
+        originals.set(method, target[method]);
+        target[method] = (...args) => {
+            original(...args);
+            if (forwarding)
+                return; // a failing `post` that logs must not recurse
+            forwarding = true;
+            try {
+                post({ kind: "log", level, message: formatLogArgs(args, options.secrets?.() ?? []) });
+            }
+            catch {
+                // Logging must never break the app.
+            }
+            finally {
+                forwarding = false;
+            }
+        };
+    }
+    const undo = () => {
+        for (const [method, original] of originals) {
+            target[method] = original;
+        }
+        if (restore === undo)
+            restore = undefined;
+    };
+    restore = undo;
+    return undo;
+}
+/** Formats `console` arguments into one redacted line, truncated to {@link MAX_LOG_MESSAGE_CHARS}. */
+function formatLogArgs(args, secrets = []) {
+    // Redacted before truncating, so a cut can never leave the start of a credential behind.
+    const text = redactLogMessage(args.map(formatValue).join(" "), secrets);
+    return text.length > exports.MAX_LOG_MESSAGE_CHARS ? `${text.slice(0, exports.MAX_LOG_MESSAGE_CHARS - 1)}…` : text;
+}
+function formatValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (value instanceof Error)
+        return value.stack ?? `${value.name}: ${value.message}`;
+    if (typeof value === "function")
+        return `[function ${value.name || "anonymous"}]`;
+    if (typeof value === "bigint" || typeof value === "symbol")
+        return value.toString();
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//# sourceMappingURL=console.js.map

package/dist/commonjs/apps/runtime/console.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.js","sourceRoot":"","sources":["../../../../src/apps/runtime/console.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AA0BH,4CAMC;AAgBD,wCAoCC;AAGD,sCAIC;AApFD,uEAAuE;AAC1D,QAAA,qBAAqB,GAAG,IAAK,CAAC;AAE3C,8DAA8D;AACjD,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC,gGAAgG;AAChG,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAC3D,+EAA+E;AAC/E,MAAM,MAAM,GAAG,2BAA2B,CAAC;AAC3C,iGAAiG;AACjG,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAO5B,kEAAkE;AAClE,SAAgB,gBAAgB,CAAC,OAAe,EAAE,UAA4B,EAAE;IAC9E,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,iBAAiB;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAQ,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,gBAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAQ,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,OAAO,GAA0F;IACrG,CAAC,OAAO,EAAE,OAAO,CAAC;IAClB,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,KAAK,EAAE,MAAM,CAAC;IACf,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,OAAO,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,IAAI,OAAiC,CAAC;AAEtC;;;GAGG;AACH,SAAgB,cAAc,CAC5B,IAAqC,EACrC,SAAkB,OAAO,EACzB,UAAiC,EAAE;IAEnC,OAAO,EAAE,EAAE,CAAC;IAEZ,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwC,CAAC;IAClE,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAiC,CAAC;QAC7E,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAiC,CAAC,CAAC;QAEtE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YACtC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YAClB,IAAI,UAAU;gBAAE,OAAO,CAAC,8CAA8C;YACtE,UAAU,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;oBAAS,CAAC;gBACT,UAAU,GAAG,KAAK,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1C,MAA6C,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;QACpE,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,CAAC,CAAC;IACF,OAAO,GAAG,IAAI,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sGAAsG;AACtG,SAAgB,aAAa,CAAC,IAAwB,EAAE,UAA4B,EAAE;IACpF,yFAAyF;IACzF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,MAAM,GAAG,6BAAqB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,6BAAqB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrG,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACpF,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,aAAa,KAAK,CAAC,IAAI,IAAI,WAAW,GAAG,CAAC;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/commonjs/apps/runtime/elements.d.ts

@@ -0,0 +1,15 @@
+import { type RemoteElementConstructor } from "@remote-dom/core/elements";
+import { type ComponentName } from "../components.js";
+export declare const REMOTE_ROOT_TAG = "remote-root";
+export declare const REMOTE_FRAGMENT_TAG = "remote-fragment";
+/** Loose constructor type shared by every catalog element. */
+export type CatalogElementConstructor = RemoteElementConstructor<Record<string, unknown>, Record<string, never>, Record<string, unknown>, Record<string, unknown>>;
+/** The element class for each catalog component, keyed by component name. */
+export declare const ELEMENTS: Readonly<Record<ComponentName, CatalogElementConstructor>>;
+/**
+ * Registers `remote-root`, `remote-fragment` and every catalog tag with the polyfilled
+ * `customElements` registry. Idempotent, and tolerant of a tag another copy of the SDK already
+ * registered (a second registration would throw).
+ */
+export declare function defineRemoteElements(): void;
+//# sourceMappingURL=elements.d.ts.map

package/dist/commonjs/apps/runtime/elements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elements.d.ts","sourceRoot":"","sources":["../../../../src/apps/runtime/elements.ts"],"names":[],"mappings":"AAeA,OAAO,EAIL,KAAK,wBAAwB,EAE9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAc,KAAK,aAAa,EAAqC,MAAM,kBAAkB,CAAC;AAErG,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,8DAA8D;AAC9D,MAAM,MAAM,yBAAyB,GAAG,wBAAwB,CAC9D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CACxB,CAAC;AAuCF,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,yBAAyB,CAAC,CAE3B,CAAC;AAItD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAW3C"}