@greensecurity/javascript-sdk 0.46.0-beta.5 → 0.46.0-beta.7

package/dist/commonjs/apps/context.d.ts

@@ -0,0 +1,66 @@
+import type { AppConstants } from "./manifest.js";
+import type { ObjectType, Portal, SurfaceId } from "./surfaces.js";
+export declare const PROTOCOL_VERSION: 1;
+/** The record a surface is showing. Only the id and type travel; apps read the record through the API. */
+export interface ObjectContext {
+    object: ObjectType;
+    id: number;
+}
+export interface AppUserToken {
+    /** `gsu_…`. Acts as the viewer, limited to the app's manifest permissions ∩ the viewer's role. */
+    accessToken: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    scope: string[];
+}
+export interface AppInstallationToken {
+    /** `gsi_…`. Acts as the app's service account, limited to the tenant of one activation. */
+    accessToken: string;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    activationId: number;
+}
+export interface AppTokens {
+    user: AppUserToken;
+    installation: AppInstallationToken;
+}
+export interface ExtensionContext {
+    protocolVersion: typeof PROTOCOL_VERSION;
+    app: {
+        id: number;
+        version: string;
+        permissions: string[];
+        csp: {
+            connectSrc: string[];
+            imageSrc: string[];
+        };
+    };
+    user: {
+        id: number;
+        name: string;
+        userType: string;
+        locale: string;
+        companyId?: number;
+        vendorId?: number;
+    };
+    environment: {
+        surfaceId: SurfaceId;
+        portal: Portal;
+        platform: "web" | "ios" | "android";
+        objectContext?: ObjectContext;
+        queryParams: Record<string, string>;
+        constants: AppConstants;
+        /** Base URL for `@greensecurity/javascript-sdk`, e.g. `https://www.greensecurityllc.com/api`. */
+        apiBaseUrl: string;
+        /** Set while the view is served by `apps-cli dev` instead of the published bundle. */
+        devSessionId?: string;
+    };
+    /** Injected by the host and replaced through `SandboxExports.updateContext` before expiry. */
+    auth: AppTokens;
+}
+/** Milliseconds before expiry at which a token should be refreshed. */
+export declare const TOKEN_REFRESH_MARGIN_MS = 60000;
+export declare function tokenNeedsRefresh(token: {
+    expiresAt: number;
+}, now?: number): boolean;
+//# sourceMappingURL=context.d.ts.map

package/dist/commonjs/apps/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/apps/context.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAEnE,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAE3C,0GAA0G;AAC1G,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,YAAY;IAC3B,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,oBAAoB,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,OAAO,gBAAgB,CAAC;IACzC,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,GAAG,EAAE;YAAE,UAAU,EAAE,MAAM,EAAE,CAAC;YAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KACnD,CAAC;IACF,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,WAAW,EAAE;QACX,SAAS,EAAE,SAAS,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;QACpC,aAAa,CAAC,EAAE,aAAa,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,SAAS,EAAE,YAAY,CAAC;QACxB,iGAAiG;QACjG,UAAU,EAAE,MAAM,CAAC;QACnB,sFAAsF;QACtF,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,8FAA8F;IAC9F,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAEjG"}

package/dist/commonjs/apps/context.js

@@ -0,0 +1,15 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Part of the third-party app platform contract;
+ * see docs/third-party-apps/plan.md.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_REFRESH_MARGIN_MS = exports.PROTOCOL_VERSION = void 0;
+exports.tokenNeedsRefresh = tokenNeedsRefresh;
+exports.PROTOCOL_VERSION = 1;
+/** Milliseconds before expiry at which a token should be refreshed. */
+exports.TOKEN_REFRESH_MARGIN_MS = 60000;
+function tokenNeedsRefresh(token, now = Date.now()) {
+    return token.expiresAt - now <= exports.TOKEN_REFRESH_MARGIN_MS;
+}
+//# sourceMappingURL=context.js.map

package/dist/commonjs/apps/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/apps/context.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAqEH,8CAEC;AAlEY,QAAA,gBAAgB,GAAG,CAAU,CAAC;AA6D3C,uEAAuE;AAC1D,QAAA,uBAAuB,GAAG,KAAM,CAAC;AAE9C,SAAgB,iBAAiB,CAAC,KAA4B,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACtF,OAAO,KAAK,CAAC,SAAS,GAAG,GAAG,IAAI,+BAAuB,CAAC;AAC1D,CAAC"}

package/dist/commonjs/apps/devpreview.d.ts

@@ -0,0 +1,42 @@
+import * as z from "zod/v4";
+import { type AppManifestV2 } from "./manifest.js";
+export * from "./devsession.js";
+/**
+ * Sources a dev manifest may add on top of the published rules: http to loopback, the Android
+ * emulator's host alias and RFC 1918 addresses, with any port and path. Tunnel origins are https
+ * and already pass the published pattern.
+ */
+export declare const DEV_CSP_SOURCE_PATTERN: string;
+/**
+ * `green-app.dev.json`. It may override constants, CSP sources and views while iterating.
+ * Permissions and the bundle cannot be overridden: permissions are granted to the app's role on
+ * `upload`, and the bundle comes from the dev server.
+ */
+export declare const devManifestSchema: z.ZodObject<{
+    extends: z.ZodString;
+    constants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    ui_extensions: z.ZodOptional<z.ZodObject<{
+        views: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            viewport: z.ZodEnum<{
+                [x: string]: string;
+            }>;
+            component: z.ZodString;
+        }, z.core.$strict>>>;
+        csp: z.ZodOptional<z.ZodObject<{
+            connect_src: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodString]>>>;
+            image_src: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodString]>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type DevManifest = z.infer<typeof devManifestSchema>;
+/**
+ * Applies a dev manifest over the published one. Object fields merge; arrays (`views`, CSP
+ * sources) replace, so a developer can drop a view locally without editing the base file.
+ * Throws {@link DevManifestError} if the merged CSP sources exceed the header budget.
+ */
+export declare function mergeDevManifest(base: AppManifestV2, dev: DevManifest): AppManifestV2;
+/** Thrown by {@link mergeDevManifest} when the merged manifest breaks a cross-field limit. */
+export declare class DevManifestError extends Error {
+    readonly name = "DevManifestError";
+}
+//# sourceMappingURL=devpreview.d.ts.map

package/dist/commonjs/apps/devpreview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devpreview.d.ts","sourceRoot":"","sources":["../../../src/apps/devpreview.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAWL,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AAKvB,cAAc,iBAAiB,CAAC;AAGhC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAGV,CAAC;AAO1B;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;kBAiB1B,CAAC;AAEL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,GAAG,aAAa,CAuCrF;AAED,8FAA8F;AAC9F,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;CAC7C"}

package/dist/commonjs/apps/devpreview.js

@@ -0,0 +1,137 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Part of the third-party app platform contract;
+ * see docs/third-party-apps/plan.md.
+ *
+ * `apps-cli dev` serves an unpublished bundle to one developer. In place of the published SRI
+ * hash, every rebuild is announced by a `build` event signed with the session's ECDSA P-256 key;
+ * the bootstrap checks the signature and then the bundle's hash against the signed value.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DevManifestError = exports.devManifestSchema = exports.DEV_CSP_SOURCE_PATTERN = void 0;
+exports.mergeDevManifest = mergeDevManifest;
+const z = __importStar(require("zod/v4"));
+const manifest_js_1 = require("./manifest.js");
+const url_js_1 = require("./url.js");
+// The zod-free half of the dev-preview contract lives in `devsession.ts` so the sandbox
+// bootstrap can import it without bundling zod; re-exported here unchanged.
+__exportStar(require("./devsession.js"), exports);
+/**
+ * Sources a dev manifest may add on top of the published rules: http to loopback, the Android
+ * emulator's host alias and RFC 1918 addresses, with any port and path. Tunnel origins are https
+ * and already pass the published pattern.
+ */
+exports.DEV_CSP_SOURCE_PATTERN = "^http://(localhost|127\\.0\\.0\\.1|10\\.0\\.2\\.2|10(\\." + url_js_1.IPV4_OCTET_PATTERN + "){3}|192\\.168(\\." + url_js_1.IPV4_OCTET_PATTERN + "){2}|172\\.(1[6-9]|2[0-9]|3[01])(\\." + url_js_1.IPV4_OCTET_PATTERN + "){2})" +
+    url_js_1.PORT_PATTERN + "/(" +
+    manifest_js_1.CSP_PATH_CHAR + "|/)*$";
+const devCspSourceSchema = z.union([
+    z.string().max(manifest_js_1.CSP_SOURCE_MAX_CHARS).regex(new RegExp(manifest_js_1.CSP_SOURCE_PATTERN)),
+    z.string().max(manifest_js_1.CSP_SOURCE_MAX_CHARS).regex(new RegExp(exports.DEV_CSP_SOURCE_PATTERN)),
+]);
+/**
+ * `green-app.dev.json`. It may override constants, CSP sources and views while iterating.
+ * Permissions and the bundle cannot be overridden: permissions are granted to the app's role on
+ * `upload`, and the bundle comes from the dev server.
+ */
+exports.devManifestSchema = z
+    .strictObject({
+    extends: z.string().min(1).max(500),
+    constants: manifest_js_1.appConstantsSchema.optional(),
+    ui_extensions: z.strictObject({
+        views: z.array(manifest_js_1.appViewSchema).max(200).optional(),
+        csp: z.strictObject({
+            connect_src: z.array(devCspSourceSchema).max(manifest_js_1.CSP_SOURCES_MAX_PER_DIRECTIVE).optional(),
+            image_src: z.array(devCspSourceSchema).max(manifest_js_1.CSP_SOURCES_MAX_PER_DIRECTIVE).optional(),
+        }).optional(),
+    }).optional(),
+})
+    // Same invariant as published manifests: dev views replace the published list, so a duplicate
+    // here would make view resolution order-dependent.
+    .superRefine((dev, ctx) => {
+    (0, manifest_js_1.addDuplicateViewportIssues)(dev.ui_extensions?.views, ctx, ["ui_extensions", "views"]);
+    (0, manifest_js_1.addCspBudgetIssue)(dev.ui_extensions?.csp, ctx, ["ui_extensions", "csp"]);
+});
+/**
+ * Applies a dev manifest over the published one. Object fields merge; arrays (`views`, CSP
+ * sources) replace, so a developer can drop a view locally without editing the base file.
+ * Throws {@link DevManifestError} if the merged CSP sources exceed the header budget.
+ */
+function mergeDevManifest(base, dev) {
+    const baseUi = base.ui_extensions ?? {};
+    const devUi = dev.ui_extensions ?? {};
+    const merged = { ...base };
+    if (base.constants !== undefined || dev.constants !== undefined) {
+        merged.constants = { ...base.constants, ...dev.constants };
+    }
+    if (base.ui_extensions === undefined && dev.ui_extensions === undefined)
+        return merged;
+    // A preview renders views, and every rendered view needs a version (`ExtensionContext.app.version`).
+    // A dev file cannot supply one, so a versionless (v1) base cannot be previewed with views.
+    if (devUi.views !== undefined && devUi.views.length > 0 && base.version === undefined) {
+        throw new DevManifestError("the base manifest needs a version before its views can be previewed");
+    }
+    const ui = { ...baseUi };
+    if (devUi.views !== undefined)
+        ui.views = devUi.views;
+    if (devUi.csp !== undefined) {
+        ui.csp = {
+            ...(baseUi.csp ?? { purpose: "Local development" }),
+            ...(devUi.csp.connect_src !== undefined ? { connect_src: devUi.csp.connect_src } : {}),
+            ...(devUi.csp.image_src !== undefined ? { image_src: devUi.csp.image_src } : {}),
+        };
+    }
+    merged.ui_extensions = ui;
+    // The dev schema checks the budget on the override alone, but an override replaces only the
+    // directives it names, so the merged CSP (say, the base's image_src plus the dev connect_src)
+    // can still go over. Check the result.
+    const total = (0, manifest_js_1.cspSourcesTotalChars)(merged.ui_extensions.csp);
+    if (total > manifest_js_1.CSP_SOURCES_MAX_TOTAL_CHARS) {
+        throw new DevManifestError(`merged connect_src and image_src use ${total} characters; the limit is ${manifest_js_1.CSP_SOURCES_MAX_TOTAL_CHARS}`);
+    }
+    return merged;
+}
+/** Thrown by {@link mergeDevManifest} when the merged manifest breaks a cross-field limit. */
+class DevManifestError extends Error {
+    constructor() {
+        super(...arguments);
+        this.name = "DevManifestError";
+    }
+}
+exports.DevManifestError = DevManifestError;
+//# sourceMappingURL=devpreview.js.map

package/dist/commonjs/apps/devpreview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devpreview.js","sourceRoot":"","sources":["../../../src/apps/devpreview.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqEH,4CAuCC;AA1GD,0CAA4B;AAC5B,+CAYuB;AACvB,qCAA4D;AAE5D,wFAAwF;AACxF,4EAA4E;AAC5E,kDAAgC;AAGhC;;;;GAIG;AACU,QAAA,sBAAsB,GACjC,0DAA0D,GAAG,2BAAkB,GAAG,oBAAoB,GAAG,2BAAkB,GAAG,sCAAsC,GAAG,2BAAkB,GAAG,OAAO;IACnM,qBAAY,GAAG,IAAI;IACnB,2BAAa,GAAG,OAAO,CAAC;AAE1B,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,kCAAoB,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,gCAAkB,CAAC,CAAC;IAC1E,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,kCAAoB,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,8BAAsB,CAAC,CAAC;CAC/E,CAAC,CAAC;AAEH;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,CAAC;KAC/B,YAAY,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,SAAS,EAAE,gCAAkB,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC,CAAC,YAAY,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,2BAAa,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACjD,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC;YAClB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,2CAA6B,CAAC,CAAC,QAAQ,EAAE;YACtF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,2CAA6B,CAAC,CAAC,QAAQ,EAAE;SACrF,CAAC,CAAC,QAAQ,EAAE;KACd,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC;IACF,8FAA8F;IAC9F,mDAAmD;KAClD,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,IAAA,wCAA0B,EAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,IAAA,+BAAiB,EAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAIL;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAmB,EAAE,GAAgB;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAkB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,CAAC,SAAS,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAC7D,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAEvF,qGAAqG;IACrG,2FAA2F;IAC3F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACtF,MAAM,IAAI,gBAAgB,CAAC,qEAAqE,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,EAAE,GAAgD,EAAE,GAAG,MAAM,EAAE,CAAC;IACtE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACtD,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,EAAE,CAAC,GAAG,GAAG;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,aAAa,GAAG,EAAE,CAAC;IAE1B,4FAA4F;IAC5F,8FAA8F;IAC9F,uCAAuC;IACvC,MAAM,KAAK,GAAG,IAAA,kCAAoB,EAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,KAAK,GAAG,yCAA2B,EAAE,CAAC;QACxC,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,KAAK,6BAA6B,yCAA2B,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8FAA8F;AAC9F,MAAa,gBAAiB,SAAQ,KAAK;IAA3C;;QACoB,SAAI,GAAG,kBAAkB,CAAC;IAC9C,CAAC;CAAA;AAFD,4CAEC"}

package/dist/commonjs/apps/devsession.d.ts

@@ -0,0 +1,80 @@
+import type { AppManifestV2 } from "./manifest.js";
+/** Routes of the CLI's local dev server. All require `Authorization: Bearer <serverToken>`. */
+export declare const DEV_SERVER_ROUTES: {
+    readonly manifest: "/manifest.json";
+    readonly bundle: "/bundle.js";
+    readonly sourceMap: "/bundle.js.map";
+    readonly events: "/events";
+    readonly log: "/log";
+    readonly health: "/health";
+};
+export declare const DEV_SESSION_HEARTBEAT_INTERVAL_MS = 30000;
+/** A session with no heartbeat for this long is treated as closed by the server and host. */
+export declare const DEV_SESSION_STALE_AFTER_MS = 120000;
+export interface DevSessionDescriptor {
+    id: string;
+    appId: number;
+    activationId: number;
+    developerUserId: number;
+    /** Epoch milliseconds. */
+    expiresAt: number;
+    /** Origin of the CLI dev server: localhost, a LAN address, or an https tunnel. */
+    origin: string;
+    serverToken: string;
+    publicKeyJwk: JsonWebKey;
+    manifest: AppManifestV2;
+}
+export type DevEvent = {
+    type: "build";
+    seq: number;
+    ts: number;
+    integrity: string;
+    sig: string;
+} | {
+    type: "error";
+    diagnostics: Array<{
+        file?: string;
+        line?: number;
+        message: string;
+    }>;
+} | {
+    type: "ping";
+    ts: number;
+};
+/**
+ * Body of `POST {origin}/log`: one sandbox console line or uncaught error, forwarded by the
+ * bootstrap so it prints in the developer's terminal. `message` is already stringified.
+ */
+export interface DevLogEntry {
+    level: "debug" | "info" | "warn" | "error";
+    message: string;
+    /** Epoch milliseconds. */
+    ts: number;
+    /** The view mount the line came from, when known. */
+    mountId?: string;
+}
+/** Largest `message` the bootstrap sends and the CLI accepts; longer lines are truncated. */
+export declare const DEV_LOG_MAX_MESSAGE_CHARS = 10000;
+/**
+ * ECDSA parameters shared by the CLI (signing) and the bootstrap (verifying).
+ *
+ * `DevEvent.sig` is the WebCrypto signature over {@link canonicalBuildPayload}: the raw IEEE
+ * P1363 `r‖s` form (64 bytes for P-256), base64url-encoded without padding. Node's
+ * `crypto.sign` defaults to DER, so a non-WebCrypto signer must pass `dsaEncoding: "ieee-p1363"`.
+ */
+export declare const DEV_SIGNATURE_ALGORITHM: {
+    readonly name: "ECDSA";
+    readonly namedCurve: "P-256";
+    readonly hash: "SHA-256";
+};
+/**
+ * The exact string a `build` event's `sig` covers. Fixed key order and no whitespace, so the
+ * CLI and the bootstrap never disagree about what was signed.
+ */
+export declare function canonicalBuildPayload(e: {
+    sessionId: string;
+    integrity: string;
+    seq: number;
+    ts: number;
+}): string;
+//# sourceMappingURL=devsession.d.ts.map

package/dist/commonjs/apps/devsession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devsession.d.ts","sourceRoot":"","sources":["../../../src/apps/devsession.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,+FAA+F;AAC/F,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAC;AAEX,eAAO,MAAM,iCAAiC,QAAS,CAAC;AACxD,6FAA6F;AAC7F,eAAO,MAAM,0BAA0B,SAAU,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACxF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6FAA6F;AAC7F,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;CAAmE,CAAC;AAExG;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAElH"}

package/dist/commonjs/apps/devsession.js

@@ -0,0 +1,42 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Part of the third-party app platform contract;
+ * see docs/third-party-apps/plan.md.
+ *
+ * The dependency-free half of the dev-preview contract: dev-server routes, session and event
+ * shapes, and the signing rules. The sandbox bootstrap imports this, so it must stay free of zod
+ * and of value imports from `manifest.ts`. The dev-manifest schema is in `devpreview.ts`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEV_SIGNATURE_ALGORITHM = exports.DEV_LOG_MAX_MESSAGE_CHARS = exports.DEV_SESSION_STALE_AFTER_MS = exports.DEV_SESSION_HEARTBEAT_INTERVAL_MS = exports.DEV_SERVER_ROUTES = void 0;
+exports.canonicalBuildPayload = canonicalBuildPayload;
+/** Routes of the CLI's local dev server. All require `Authorization: Bearer <serverToken>`. */
+exports.DEV_SERVER_ROUTES = {
+    manifest: "/manifest.json",
+    bundle: "/bundle.js",
+    sourceMap: "/bundle.js.map",
+    events: "/events",
+    log: "/log",
+    health: "/health",
+};
+exports.DEV_SESSION_HEARTBEAT_INTERVAL_MS = 30000;
+/** A session with no heartbeat for this long is treated as closed by the server and host. */
+exports.DEV_SESSION_STALE_AFTER_MS = 120000;
+/** Largest `message` the bootstrap sends and the CLI accepts; longer lines are truncated. */
+exports.DEV_LOG_MAX_MESSAGE_CHARS = 10000;
+/**
+ * ECDSA parameters shared by the CLI (signing) and the bootstrap (verifying).
+ *
+ * `DevEvent.sig` is the WebCrypto signature over {@link canonicalBuildPayload}: the raw IEEE
+ * P1363 `r‖s` form (64 bytes for P-256), base64url-encoded without padding. Node's
+ * `crypto.sign` defaults to DER, so a non-WebCrypto signer must pass `dsaEncoding: "ieee-p1363"`.
+ */
+exports.DEV_SIGNATURE_ALGORITHM = { name: "ECDSA", namedCurve: "P-256", hash: "SHA-256" };
+/**
+ * The exact string a `build` event's `sig` covers. Fixed key order and no whitespace, so the
+ * CLI and the bootstrap never disagree about what was signed.
+ */
+function canonicalBuildPayload(e) {
+    return JSON.stringify({ session_id: e.sessionId, integrity: e.integrity, seq: e.seq, ts: e.ts });
+}
+//# sourceMappingURL=devsession.js.map

package/dist/commonjs/apps/devsession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devsession.js","sourceRoot":"","sources":["../../../src/apps/devsession.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAkEH,sDAEC;AAhED,+FAA+F;AAClF,QAAA,iBAAiB,GAAG;IAC/B,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,gBAAgB;IAC3B,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,MAAM;IACX,MAAM,EAAE,SAAS;CACT,CAAC;AAEE,QAAA,iCAAiC,GAAG,KAAM,CAAC;AACxD,6FAA6F;AAChF,QAAA,0BAA0B,GAAG,MAAO,CAAC;AAkClD,6FAA6F;AAChF,QAAA,yBAAyB,GAAG,KAAM,CAAC;AAEhD;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAExG;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,CAAoE;IACxG,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACnG,CAAC"}

package/dist/commonjs/apps/hooks/index.d.ts

@@ -0,0 +1,22 @@
+import type { ExtensionContext } from "../context.js";
+import { type HostApi, type ToastType } from "../protocol.js";
+import { type RouteDescriptor } from "../route.js";
+/** The context of the view being rendered. A new object after each host `updateContext`. */
+export declare function useExtensionContext(): ExtensionContext;
+/** The host API proxy for the view being rendered. Every method is async. */
+export declare function useHostApi(): HostApi;
+export interface ShowToastOptions {
+    type?: ToastType;
+    /** Defaults to the host of the most recently mounted view. Pass `useHostApi()` to be explicit. */
+    host?: HostApi;
+}
+/**
+ * Shows a toast in the host. `message` must be 1–30 characters (C0's `TOAST_MAX_LENGTH`);
+ * longer messages are rejected here rather than truncated by the host.
+ */
+export declare function showToast(message: string, opts?: ShowToastOptions): Promise<void>;
+/** Asks the host to navigate. Apps name a destination; the host owns its routes. */
+export declare function navigate(to: RouteDescriptor, opts?: {
+    host?: HostApi;
+}): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/commonjs/apps/hooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/apps/hooks/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAatE,4FAA4F;AAC5F,wBAAgB,mBAAmB,IAAI,gBAAgB,CAEtD;AAED,6EAA6E;AAC7E,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAQD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,kGAAkG;IAClG,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBrF;AAED,oFAAoF;AACpF,wBAAgB,QAAQ,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1F"}

package/dist/commonjs/apps/hooks/index.js

@@ -0,0 +1,72 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Third-party app developer kit (C10); see
+ * docs/third-party-apps/plan.md.
+ *
+ * Import as `@greensecurity/javascript-sdk/apps/hooks`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.useExtensionContext = useExtensionContext;
+exports.useHostApi = useHostApi;
+exports.showToast = showToast;
+exports.navigate = navigate;
+const react_1 = require("react");
+const protocol_js_1 = require("../protocol.js");
+const route_js_1 = require("../route.js");
+const session_js_1 = require("../runtime/session.js");
+const TOAST_TYPES = ["success", "caution", "pending"];
+function useSessionValue(hook) {
+    const value = (0, react_1.useContext)(session_js_1.AppSessionContext);
+    if (!value) {
+        throw new Error(`${hook}() must be called inside a view rendered by defineApp() or an ExtensionContextProvider`);
+    }
+    return value;
+}
+/** The context of the view being rendered. A new object after each host `updateContext`. */
+function useExtensionContext() {
+    return useSessionValue("useExtensionContext").context;
+}
+/** The host API proxy for the view being rendered. Every method is async. */
+function useHostApi() {
+    return useSessionValue("useHostApi").host;
+}
+function activeHost(fn, host) {
+    const resolved = host ?? (0, session_js_1.currentSession)()?.host;
+    if (!resolved)
+        throw new Error(`${fn}() needs a mounted view; call it from an event handler or effect`);
+    return resolved;
+}
+/**
+ * Shows a toast in the host. `message` must be 1–30 characters (C0's `TOAST_MAX_LENGTH`);
+ * longer messages are rejected here rather than truncated by the host.
+ */
+function showToast(message, opts = {}) {
+    if (typeof message !== "string" || message.trim().length === 0) {
+        return Promise.reject(new RangeError("showToast() needs a non-empty message"));
+    }
+    if (message.length > protocol_js_1.TOAST_MAX_LENGTH) {
+        return Promise.reject(new RangeError(`showToast() messages are limited to ${protocol_js_1.TOAST_MAX_LENGTH} characters (got ${message.length})`));
+    }
+    if (opts.type !== undefined && !TOAST_TYPES.includes(opts.type)) {
+        return Promise.reject(new TypeError(`Unknown toast type "${String(opts.type)}"`));
+    }
+    try {
+        const host = activeHost("showToast", opts.host);
+        return host.showToast(message, opts.type === undefined ? undefined : { type: opts.type });
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+}
+/** Asks the host to navigate. Apps name a destination; the host owns its routes. */
+function navigate(to, opts = {}) {
+    if (!(0, route_js_1.isRouteDescriptor)(to))
+        return Promise.reject(new TypeError("navigate() needs a valid RouteDescriptor"));
+    try {
+        return activeHost("navigate", opts.host).navigate(to);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/commonjs/apps/hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/apps/hooks/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAmBH,kDAEC;AAGD,gCAEC;AAkBD,8BAmBC;AAGD,4BAOC;AAvED,iCAAmC;AAEnC,gDAAgF;AAChF,0CAAsE;AACtE,sDAAgG;AAEhG,MAAM,WAAW,GAAyB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAE5E,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAA,kBAAU,EAAC,8BAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wFAAwF,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4FAA4F;AAC5F,SAAgB,mBAAmB;IACjC,OAAO,eAAe,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC;AACxD,CAAC;AAED,6EAA6E;AAC7E,SAAgB,UAAU;IACxB,OAAO,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,IAAc;IAC5C,MAAM,QAAQ,GAAG,IAAI,IAAI,IAAA,2BAAc,GAAE,EAAE,IAAI,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,kEAAkE,CAAC,CAAC;IACxG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD;;;GAGG;AACH,SAAgB,SAAS,CAAC,OAAe,EAAE,OAAyB,EAAE;IACpE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,8BAAgB,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,UAAU,CAAC,uCAAuC,8BAAgB,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAC7G,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,uBAAuB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAgB,QAAQ,CAAC,EAAmB,EAAE,OAA2B,EAAE;IACzE,IAAI,CAAC,IAAA,4BAAiB,EAAC,EAAE,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAC7G,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/commonjs/apps/hooks.d.ts

@@ -0,0 +1,2 @@
+export * from "./hooks/index.js";
+//# sourceMappingURL=hooks.d.ts.map

package/dist/commonjs/apps/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/apps/hooks.ts"],"names":[],"mappings":"AAOA,cAAc,kBAAkB,CAAC"}

package/dist/commonjs/apps/hooks.js

@@ -0,0 +1,24 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). Entry point for
+ * `@greensecurity/javascript-sdk/apps/hooks` (third-party app developer kit, C10). The package
+ * `exports` map resolves `./apps/<name>` to `src/apps/<name>.ts`, so each kit folder gets
+ * a one-line entry file next to it.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./hooks/index.js"), exports);
+//# sourceMappingURL=hooks.js.map

package/dist/commonjs/apps/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../../src/apps/hooks.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;AAEH,mDAAiC"}

package/dist/commonjs/apps/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./surfaces.js";
+export * from "./route.js";
+export * from "./manifest.js";
+export * from "./context.js";
+export * from "./protocol.js";
+export * from "./components.js";
+export * from "./devpreview.js";
+export * from "./review.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/commonjs/apps/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/apps/index.ts"],"names":[],"mappings":"AAMA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/commonjs/apps/index.js

@@ -0,0 +1,30 @@
+"use strict";
+/*
+ * Hand-written (not generated by Speakeasy). The third-party app platform contract; see
+ * docs/third-party-apps/plan.md. Also importable per file, e.g.
+ * `@greensecurity/javascript-sdk/apps/surfaces`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./surfaces.js"), exports);
+__exportStar(require("./route.js"), exports);
+__exportStar(require("./manifest.js"), exports);
+__exportStar(require("./context.js"), exports);
+__exportStar(require("./protocol.js"), exports);
+__exportStar(require("./components.js"), exports);
+__exportStar(require("./devpreview.js"), exports);
+__exportStar(require("./review.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/commonjs/apps/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/apps/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;AAEH,gDAA8B;AAC9B,6CAA2B;AAC3B,gDAA8B;AAC9B,+CAA6B;AAC7B,gDAA8B;AAC9B,kDAAgC;AAChC,kDAAgC;AAChC,8CAA4B"}