@holokai/harbor-sdk 0.3.0

package/dist/runtime.d.ts

@@ -0,0 +1,220 @@
+import type { CatalogSkip } from './package';
+/**
+ * How harbor and the extensions server find each other, as data with no
+ * runtime imports: harbor's main process reads this module without any server code.
+ */
+/** The port the extensions server listens on; the providers' sign-in return addresses name it. */
+export declare const EXTENSIONS_PORT = 8830;
+/**
+ * The most header bytes a request to the extensions server or the sign-in
+ * return may carry. A browser sends every cookie it holds for `localhost`,
+ * whatever the port, so Node's 16 KB default refuses a return (431).
+ */
+export declare const EXTENSIONS_HEADER_BYTES: number;
+/** What `GET /health` on the extensions server answers, so harbor can tell it from anything else on the port. */
+export declare const EXTENSIONS_HEALTH: {
+    readonly service: "harbor-first-party-extensions";
+    readonly protocol: 1;
+};
+/** The environment the extensions server reads. An absent `enabled` means every shipped extension. */
+export declare const EXTENSIONS_ENV: {
+    readonly port: "PORT";
+    readonly pagesDir: "EXTENSIONS_PAGES_DIR";
+    readonly accountScope: "EXTENSIONS_ACCOUNT_SCOPE";
+    /** Comma-separated extension names. */
+    readonly enabled: "EXTENSIONS_ENABLED";
+    /** Comma-separated names of the settings whose value came from Moku rather than harbor's environment. */
+    readonly fromMoku: "EXTENSIONS_SETTINGS_FROM_MOKU";
+    /** The sign-in return address the providers are given; absent means this server's own `/auth/callback`. */
+    readonly callbackAddress: "EXTENSIONS_CALLBACK_ADDRESS";
+    /** The connection this server runs for; `/health` names it, so harbor takes an answer only from its own child. */
+    readonly connection: "EXTENSIONS_CONNECTION";
+    /** The dev instance this server runs for. Its sign-in states name it, so the shared return reaches it. */
+    readonly instance: "EXTENSIONS_INSTANCE";
+    /** The installed catalog the server loads its extensions from (`tree/catalog.json`). */
+    readonly catalog: "EXTENSIONS_CATALOG";
+};
+/**
+ * The messages on Node's IPC channel between harbor and an extensions server it started:
+ * `catalog_loaded`, `tools_changed`, `page_notification`, `saved_sign_in`, `extension_state` and
+ * `provider_account` from the server, `saved_sign_in_answer` and `extension_state_answer` back from harbor.
+ */
+export declare const EXTENSIONS_MESSAGE: {
+    readonly toolsChanged: "tools_changed";
+    readonly pageNotification: "page_notification";
+    readonly savedSignIn: "saved_sign_in";
+    readonly savedSignInAnswer: "saved_sign_in_answer";
+    readonly extensionState: "extension_state";
+    readonly extensionStateAnswer: "extension_state_answer";
+    readonly providerAccount: "provider_account";
+    readonly catalogLoaded: "catalog_loaded";
+};
+/**
+ * What the server loaded from its catalog, sent once before it serves: the extensions it runs, the entries the
+ * catalog itself refused, and the ones whose module did not import or export an extension. Names and package names only.
+ */
+export interface CatalogLoadedMessage {
+    type: typeof EXTENSIONS_MESSAGE.catalogLoaded;
+    loaded: string[];
+    skipped: CatalogSkip[];
+    failed: {
+        name: string;
+        package: string;
+    }[];
+}
+/** An extension's tool list changed, so harbor lists that extension's tools again. */
+export interface ToolsChangedMessage {
+    type: typeof EXTENSIONS_MESSAGE.toolsChanged;
+    /** The extension's name, the path segment it is served at. */
+    extension: string;
+}
+/**
+ * Something an extension's server tells every open view of that extension. Harbor hands `name` and
+ * `params` to each view subscribed to its `server.notification` event, as sent.
+ */
+export interface PageNotificationMessage {
+    type: typeof EXTENSIONS_MESSAGE.pageNotification;
+    /** The extension's name, the path segment it is served at. */
+    extension: string;
+    name: string;
+    params: Record<string, unknown>;
+}
+/** What a page notification's `name` may be: the server's own word for it, as a tool's name is spelled. */
+export declare const PAGE_NOTIFICATION_NAME: RegExp;
+/** The longest a saved sign-in request's `id`, `slot` and `value` may be. Harbor refuses a request past them. */
+export declare const SAVED_SIGN_IN_LIMITS: {
+    readonly id: 64;
+    readonly slot: 128;
+    readonly value: 262144;
+};
+/** What follows `<provider>-` in a provider's further slot: lowercase kebab-case, as a provider's name is. */
+export declare const SLOT_SUFFIX: RegExp;
+/**
+ * The server asks harbor to read, write or remove one saved sign-in. `slot` names it without any
+ * scope: harbor keeps it under the identity it started the server for. `id` is the server's own,
+ * unique among its requests still waiting for an answer.
+ */
+export type SavedSignInRequest = {
+    type: typeof EXTENSIONS_MESSAGE.savedSignIn;
+    id: string;
+    op: 'read' | 'remove';
+    slot: string;
+} | {
+    type: typeof EXTENSIONS_MESSAGE.savedSignIn;
+    id: string;
+    op: 'write';
+    slot: string;
+    value: string;
+};
+/**
+ * Harbor's answer to one request. A read answers the saved value, or null, and `move`: true only
+ * when the server may move this slot's old keychain items now. A write or remove that worked answers
+ * `ok` alone. `refused` is a request harbor does not take; `failed` is a store that failed.
+ */
+export type SavedSignInAnswer = {
+    type: typeof EXTENSIONS_MESSAGE.savedSignInAnswer;
+    id: string;
+    ok: true;
+    value: string | null;
+    move: boolean;
+} | {
+    type: typeof EXTENSIONS_MESSAGE.savedSignInAnswer;
+    id: string;
+    ok: true;
+} | {
+    type: typeof EXTENSIONS_MESSAGE.savedSignInAnswer;
+    id: string;
+    ok: false;
+    reason: 'refused' | 'failed';
+};
+/** The longest an extension state request's `key` and `value`, and a provider account, may be. Harbor refuses one past them. */
+export declare const EXTENSION_STATE_LIMITS: {
+    readonly key: 128;
+    readonly value: 262144;
+    readonly account: 256;
+};
+/**
+ * Whose an extension's kept value is: `identity`, the harbor identity's for that extension;
+ * `provider_account`, the provider account signed in now as well, which harbor tracks from
+ * {@link ProviderAccountMessage} and never takes from a request.
+ */
+export type StateRetention = 'identity' | 'provider_account';
+/**
+ * The server asks harbor to read, write or delete one of `extension`'s kept values. `id` is the
+ * server's own, unique among its requests still waiting for an answer.
+ */
+export type ExtensionStateRequest = {
+    type: typeof EXTENSIONS_MESSAGE.extensionState;
+    id: string;
+    extension: string;
+    op: 'get' | 'delete';
+    key: string;
+    retention: StateRetention;
+} | {
+    type: typeof EXTENSIONS_MESSAGE.extensionState;
+    id: string;
+    extension: string;
+    op: 'set';
+    key: string;
+    value: string;
+    retention: StateRetention;
+};
+/**
+ * Harbor's answer to one request: a get answers the kept value, or null; a set or delete that
+ * worked answers `ok` alone. `refused` is a request harbor does not take; `failed` is a store that failed.
+ */
+export type ExtensionStateAnswer = {
+    type: typeof EXTENSIONS_MESSAGE.extensionStateAnswer;
+    id: string;
+    ok: true;
+    value: string | null;
+} | {
+    type: typeof EXTENSIONS_MESSAGE.extensionStateAnswer;
+    id: string;
+    ok: true;
+} | {
+    type: typeof EXTENSIONS_MESSAGE.extensionStateAnswer;
+    id: string;
+    ok: false;
+    reason: 'refused' | 'failed';
+};
+/** The provider account this connection's server is signed in as, sent after every restore, sign-in finish and sign-out. */
+export interface ProviderAccountMessage {
+    type: typeof EXTENSIONS_MESSAGE.providerAccount;
+    /** The provider session's account key; null when signed out or none restored. */
+    account: string | null;
+    reason: 'restored' | 'signed_in' | 'signed_out';
+}
+/**
+ * The JSON Schema keyword that marks a tool input as a local file: a property
+ * carrying it, or an array whose items carry it. The AI fills it with a path
+ * on the person's computer; Harbor contains that path against the folders the
+ * person granted, reads the file, and hands the tool a {@link LocalFileWire}
+ * in its place, so the extension never sees a path. Only a first-party
+ * extension's marks are honoured.
+ */
+export declare const LOCAL_FILE_KEYWORD = "x-holokai-local-file";
+/** A local file as Harbor hands it to an extension tool, in place of the path the AI gave. */
+export interface LocalFileWire {
+    /** The file's name, without its folder. */
+    name: string;
+    /** The file's media type; `application/octet-stream` when Harbor does not know the type. */
+    mime_type: string;
+    /** The file's whole content, base64. */
+    content_base64: string;
+}
+/** The schema mark on a tool input that is a new file: Harbor picks where it goes and the tool sees only its name. */
+export declare const FILE_TARGET_KEYWORD = "x-holokai-file-target";
+/** The `_meta` key under which an answer carries the bytes for the call's file target. */
+export declare const SAVED_FILE_META = "holokai/saved_file";
+/** The most bytes a file may hold when it passes between an extension and Harbor. */
+export declare const SAVED_FILE_MAX_BYTES: number;
+/** What an extension receives for a marked target: the name alone, never the folder. */
+export interface FileTargetWire {
+    name: string;
+}
+/** What an answer carries under `_meta[SAVED_FILE_META]`. */
+export interface SavedFileWire {
+    mime_type: string;
+    content_base64: string;
+}

package/dist/runtime.js

@@ -0,0 +1,56 @@
+import {createRequire as __harborCreateRequire} from 'node:module'; const require = __harborCreateRequire(import.meta.url);
+
+// src/runtime.ts
+var EXTENSIONS_PORT = 8830;
+var EXTENSIONS_HEADER_BYTES = 256 * 1024;
+var EXTENSIONS_HEALTH = { service: "harbor-first-party-extensions", protocol: 1 };
+var EXTENSIONS_ENV = {
+  port: "PORT",
+  pagesDir: "EXTENSIONS_PAGES_DIR",
+  accountScope: "EXTENSIONS_ACCOUNT_SCOPE",
+  /** Comma-separated extension names. */
+  enabled: "EXTENSIONS_ENABLED",
+  /** Comma-separated names of the settings whose value came from Moku rather than harbor's environment. */
+  fromMoku: "EXTENSIONS_SETTINGS_FROM_MOKU",
+  /** The sign-in return address the providers are given; absent means this server's own `/auth/callback`. */
+  callbackAddress: "EXTENSIONS_CALLBACK_ADDRESS",
+  /** The connection this server runs for; `/health` names it, so harbor takes an answer only from its own child. */
+  connection: "EXTENSIONS_CONNECTION",
+  /** The dev instance this server runs for. Its sign-in states name it, so the shared return reaches it. */
+  instance: "EXTENSIONS_INSTANCE",
+  /** The installed catalog the server loads its extensions from (`tree/catalog.json`). */
+  catalog: "EXTENSIONS_CATALOG"
+};
+var EXTENSIONS_MESSAGE = {
+  toolsChanged: "tools_changed",
+  pageNotification: "page_notification",
+  savedSignIn: "saved_sign_in",
+  savedSignInAnswer: "saved_sign_in_answer",
+  extensionState: "extension_state",
+  extensionStateAnswer: "extension_state_answer",
+  providerAccount: "provider_account",
+  catalogLoaded: "catalog_loaded"
+};
+var PAGE_NOTIFICATION_NAME = /^[a-z][a-z0-9_.-]{0,63}$/;
+var SAVED_SIGN_IN_LIMITS = { id: 64, slot: 128, value: 262144 };
+var SLOT_SUFFIX = /^[a-z][a-z0-9-]*$/;
+var EXTENSION_STATE_LIMITS = { key: 128, value: 262144, account: 256 };
+var LOCAL_FILE_KEYWORD = "x-holokai-local-file";
+var FILE_TARGET_KEYWORD = "x-holokai-file-target";
+var SAVED_FILE_META = "holokai/saved_file";
+var SAVED_FILE_MAX_BYTES = 25 * 1024 * 1024;
+export {
+  EXTENSIONS_ENV,
+  EXTENSIONS_HEADER_BYTES,
+  EXTENSIONS_HEALTH,
+  EXTENSIONS_MESSAGE,
+  EXTENSIONS_PORT,
+  EXTENSION_STATE_LIMITS,
+  FILE_TARGET_KEYWORD,
+  LOCAL_FILE_KEYWORD,
+  PAGE_NOTIFICATION_NAME,
+  SAVED_FILE_MAX_BYTES,
+  SAVED_FILE_META,
+  SAVED_SIGN_IN_LIMITS,
+  SLOT_SUFFIX
+};

package/dist/sign-in-page.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The page for one sign-in. `connected` is the name of what was just connected, as a person knows it
+ * (a provider such as Linear, or a connector); null is a sign-in that failed. `app` is the app's name.
+ */
+export declare function authenticationPage(app: string, connected: string | null): string;

package/dist/sign-in-page.js

@@ -0,0 +1,96 @@
+import {createRequire as __harborCreateRequire} from 'node:module'; const require = __harborCreateRequire(import.meta.url);
+
+// src/holokai-logo.ts
+var HOLOKAI_LOGO_PNG = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAjYAAAI2CAMAAAB0aDIHAAAAM1BMVEUAAAAtha0tha0tha0tha0tha0tha0tha0tha0tha0tha0tha0tha0tha0tha0tha0tha2BV9aoAAAAEHRSTlMAgL9AEO9gnzDfIM+PcK9Q+JwXawAAEkVJREFUeNrs3W1OAjEUhtGLMHyJcve/WiWTSCIR5i3885xFPO1ty1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPrY0Ho3L0vyOy63woyU3dvCxL7/nYoSJy65YbUoS+mTcFi656tCpI5Sm5ITS03pLbdckPqrVtuCB175uyGwKlnzm4ITC03DGyI5YaBDbHckN9iyg1DJ8RX3t2QTN9X64Jg+p7tCu7aTH3LDQP3rfqHGway91ltBic96rt1LghiM/sseBAbm2Keic3VR0Eam34vSGIz8yEB7sTGKkUeG6sUA7GxSpHHxirFQGysUuSxsUrxbGy8DSWKjXspXhWbngoexcaTYuLYeOPH4tgYwRmPjUc3DMXG01CWxcbmhtfExq96yWNzq+B3bJzcMBobjydIY+Naiidj40e9LIiNAz/S2NgTE9lcYmNPTGbVf/NdLR58PMs5MXlsnBPzTGz8fIFlsTFKMRwbbycIYpM5Ff/dHBujFGP/ruBWivDfFUzgDMTGBE4eGxM4L4iN7058sXcvuY3DUBBFKVKfSLHjt//VNgJk1JOklHhg+5w1XBAGS5L5wWHj4oZEv2c2x3X66J/e6z/90+bMelCjAunFzaW+8+45wYfU75jNVqWbpzQqEN73rX4kPateZ7VvbWaKJzXqjtl02TypvU47ZPOq1jpvyOZV7bIhtpZsSM17/cIqm9c01W9MsnlJ8yIbYlPJhvywkQ2xrWRD6ijZENtkQ+wo2RDrsiE2SjbEumyIjZINsV02xNaSDbFdNsSuJRvyDVM2xKaSDflhIxtil5INqaNkQ2yTDbG3kg2xLhtio2RDrMuG2K1kQ2yXDbG1ZENq3mVDbCrZkG+YsiF2KdmQOko2xDbZEHsr2RDrsiE2SjbE3mVDbC3ZENtlQ+xaJRvuNyssF9mQbpgfc/u7bCbZPLJjqZ86mmxIZ4WtyYZ4wzxkQzwrbE02xLPCIRtOHDayIZ4VDtkQzwpbkw3prLDMsiGeFaYmG9JZYZllQzwrTE02pLPCPsuGeFZYm2xIb/r2JhviWWHIhviw6U02xLPCkA0nZgXZEL+tcMiGE7OCbMhnBdkQzwprkw3xrNBkQ/wRpCEbTtz0yYb8bQXZEH8E6dJkQzorLLNsiGeFa5MN6U3f3mRDPCsM2RAfNr3JhvgB4jfZcOIjSLIhvelbZtkQzwpTkw3pYbM32RDf9N1kQzwr9CYb4r9sHrIhvunbmmyIZ4VDNsQ3fVOTDemssMyy4ctHcNjIhvymTzbEs8IqG77cgsNGNsSzwpAN8XdJepMN+QPEsvnH3r3kuA0DURQtkvrLVmr/qw2VZJL0QH4M0RKlexbQDRgXb+ASZBQ8QEw2kN9LksgG8lkhGtlA/xVVskHBDxuSDfT3kpAN/liFsSEb6L+iSjYoeN052UD9ps+nitkMZNMy4aywWsVsEtm0TBiblx0byOYJFv9cTIfeTjZPMHpdZPMEk3+KbFBwViAbFJwVyAb6WcHJBvpZwckG4llhRzb4LbiAbCCeFXZkg19eriAb7BaXkA0Kzgpkg4KzAtmg4KxANig4K5ANCs4KZAMbXEU2sNlVZIPgpyOb5nS9n45smnOBsSGb5ix+AWTTmtEvgGwac4mxIZvWRL8CsmnL6WcFsmnRNcaGbNpy/lmBbBp0/lmBbNpzlbEhm5Zc4axANs25wlmBbFpznbEhm4a8/DLIphmLS9Z3OhC+6MnmdkYXbJ39i1c+PtHkisW+4AWzTxRdEKxMTzb3klzQd6Vtks29iGNDNsgGcWwKjWRzK7M2NqUC2dyJODZkA/msMBjZQL1hzkY20MeGbFAwNmQD+YY5kA3kG+ZqZAN5bBLZYLe5IBrZIEv62JTbyOYmYsnYcMp8OHFsyAby2GxGNsgGVyxkA/mBifH//x3Z3EH52PAI+nN1vTY2ZIMsuGIhG2RL74JgZINsrPAoqKQjm/Yl/+6xSWTTvqiNDdkgG8SxIRuYdbM2NmSDLLhiMLKB+k3fbGSDbHTFQDaQHyCejWygjw3ZIEuuWI1skMWSR0E5Ljxc8pLnzjllPtzoikQ2yJazxsbWatm8yea7BRf00wkzN1VKPxiqmc+qxpa+2kjEzy5pqEarpqop+qH+1dmxbvQj22KoR6qmupTeIYtfbCH7kSbhLw1ht8W/hN07JaamrvAxPnkAAAAAAAAAAAAAAH6ydy/ajYJQFIbhoKCCet7/aWcmbSadNpmo8ULk/96gq3vBFqIHADBV4y7sF979we8G8VV3+fFhEBF9RkSs9SSoYM5dsqKLtJIs4SlI5UabJOrrgsH5Vc7bQXQ1dWNwZp2zSWr9g9Tgucr1SXQT3uCEutEOrV6RGjzTeCu1bioZnEjnn29KPEThphsfrTGkBne5tXoM30IpROND1Cdow7ip3IRtidTgpulDqweoz5qaoBrFemfOqhqt6GScDc8cGhUHO57tr5y3yJCaBd/pu4XnFFf8l0XmWPHEqTGj/iTJv/Of7Pqh1cPFc39pbNDfzpKdxqeoWTh5aj7njb1/drrjt6WCUvN8wEItufedj5uCnJw/NcYkfa4dbJYfZM0vMaWkZvqkgzb0GR3wuD5ltCuVlxrT1DpdPD47zWglg2elwlMza1L8bc/qzO4q57MOzEWddxFcU9AFakn95oXnlpchwxJT2Nnwd1XUxSTYcav0NM7bJJkcxXDn/UOjr4qSbL/Oy8/OjdYGybTw8rvhL3pdTSsyXN+hrya+V/0x1mWQ91pZGIdnBt1OLfe8fUZ+akt5iPqrOt3/cBLq8Iuat3hQyVpRdfjKK3i1Zb6k4HR4vrd85M1FicXmQ5X7wX3Oiiw21GKKzXKjgmLD49RDFBtz+GV48QouNuRmscGAWwauorid2kHpxYbcLNEbkBuKDcd+91BsPpGbGSg2f5GbGSg222m41qTY0IuvKDb/IjdTUGy+IzcTcBV1F/dT/8VvbO4hN3uKBvz+Zq6aOvyY4wCHX2Yt0FCMqcMLVIOCgT/z9Qoeorhp4IMkj7BR/cDrLfvreaIiNQt0vCHOgQ0LDgc2D7HgKKnJgC9+wWlJzQJV4d9Oog2zU5GaPblib6kCqXmFL/PUuLBPnBtDcBgGnwdf2FZ16gHNe3IlleNErVlNl2o9RC0iwd4EEdENtc5gRZUX3ZGItY/nxnTO2yAbJNmy1Kyus61urhU7eVRe5XxaMzxDOWMM99WkDZOzcLZi5WyI+jphf9pQY6OurX19cr3rX8tOYKXZWuVDqyuJ4TKv/tiR4dHTafbR+RRfX2Ias77G21mFJ/YsNPtyfRCdTwY7OrOpyk161IppZJ05Rud6KzLtDMYunQm9fKx4kHh/rUu9IzLH665Td/8VrLW9c84cqbmMBP40Ose2BAAAAAAAAAAAAAAAAAAAAAAA8Iu9c9uWGoQBKC3h3kv+/2t1qctlM4yQlOqI2W9ezjQHdmlDGFAURVEURVEURVEURVEURVEURVEURVEURVEURVEURVGUv0C0P/iIE0d/RKP7l/PJ9gKY32IvsPreLmuiZ7GQq3EvLQdOcmBLOhZrHogGLKEz8rxQDKH3ktk8wYIXGm2HF1bTCfgDq6zk/BzGpeXkvWCVw8PoaApS+uwMSDm7jcYL3337B7WxAX/DYf+sNueKvyGMjSYgxZsu3Gtk/5c2dsUGyf85bXzin24pj8ZLO//EFxz8R9rYFTso9s9oYxN2sMZB0URElIV94Cv+v9EGNuwkwPPa5AM7WYZEkx0SCpguACsc/4s2NmE3zj6tzemwmxLvRwMFCS6aPjzWgP9DmwVZLM9qE5CFvx1NYCRRhBVr7P+DNhCQyQHPaQMFmYSbDbEzTCRkrFL+A22gIJsCT2mTBdGEWw1hmR4S46rk6bWBggIKPKNNdigg3GiI6BDFERess82uDRQUUWC8NvJogrghoDB+M0rEN6TZtQkoJDygDRQUskmjOThJFGXDd8S5tVmwStm8hR8nsG8FqyzjtQmNaLLdQ8IqXhbNwkqiKAnfEabWxmKFtGRa5E1YwY7WZq9Gs4O5EDeHr7gsicZX9OvnxLe4mbUBV6s79VaIEozVJrrOYgYstf/JbIj6FcOoCaZzYm2Oxmx9o/qwjdVmRYrbTR2oRc6OBhIviaI4fE+YVxtbKRywpvztSG08q3DgK48pbjSrLImiIdSBabUpjX4SzHDItQFmOdG+PmCY0QROEtUeq8kf/aza+NrLCs8bO06bhXvrR6RkVjSemURRgN5y5EqzapPYN1tEwirVpj3YOGA/JAInmthKopiX32l75jm1OQXNtiPBSrVpf7Igk8n90QA7iaIUeu2NeDSnNiteOSTZThilTUJ+G8LLD3VHA6UxcHKL38fL35QptclIyKIqDIzRxorW43q8krobIrCTqEZ3+NfxJ86ozS4bo2l7e6E27Y+VDH6xM5q9kUTxh0d4/dRtRm0KXsmyou8xRhtHelE4dbL1RWMbSRS/HY7KAJ4m1AbYbzZ13ZxAm7aMm/CeL13RZNfIBvjFb19rGzufNideOaVzo3aENjteicLeQ+iIBkojiRIMj1D7NcJ82ix4RZpB4D5Cm4MO771YgcQHP4lq3XWh2jZuPm3WUQshwwhtkvAZRS+GSyua5nS0KDM46/r7z9MmLL+l1XdJHHJofLREG/GrBtX/aEZzNpIoyZy2e/MEPz5Pmwa8vsVTvphqgDaW8WpD2JgSN+pqshe88C7RgMm0ifKOss9rY8QSu0Y0JTWSKFHx+3z3D34ybfgd1TZOro2nff+YxHgziWq9+npiqWrzriPsfW3om9jj2siTqEaiDXglqzYTaiNJon5ffAp4YVdtPlIbc0ubaLi0iggn+TfV5iO1AbE28p7afjfL5IiYqs0naiN/SMnzqPQ7MwJxSrWZUBvJXF/87XPoJBdQbeo/mu9rc+KVJ7URrQfjjCcOL5wzaZPxiv1Xp/uW1isosUSWTDHeXqhV4bO0uVmTwiteHIcboE3kSiwvLuxICfeK36Xxyzj4KG14FfBmzfmjSpn7g/X4gJTtVmFhbzWtn0mbg94z3SRuR8k7vw3wF04USTrFmQfe8MIxkzZLvVbbJj6xTCtIi1Inf5kWOKREefG7tFsIJtLGNu44yfpNuTa79OUmCBaFxhdvXBYv8Nnb4/E+kTZGWtNLTyxBz8LXVHCSJei+kU5xIvX2FfoCMJM2B17JsvQ7SLRpywiy9fBLXzSbvBK+I588kTZedoOvz3y9bpMVi5Lw63WHOA1PyGebSBsYsbklOjNGmyiavN2lX+YFaToVUUCaSBsTBOM0pKe2DqD9eEg2N9m7o4lO9sXMDSXEibSxSFgErRZHaeORcArOcoL+aKysqplQQphIG7Oy7zf/3LZIxrF7cbm1LdIuSadOFOFm0sYy7rfnN2HbuVvC+ZubsAXBwSwBZZwTaWNWjjfyLR+lOUrJPGs2ZjSFn045lBFm0iYixXlOP2Eeqc3J2u52QYoDZjTguOeHeZQCE2lTywsOeG4DaYp8c+284gueHU3kbl5+oBQ/kzaQ8AW3wOjt6uvIt/KHBV9ZBdF4XjoFKGadSZv67JXbYtfhGHGwNubsOjgkhmo0IIlmYy0S3akLv6HglTyTNsZjlRR2+82KOPAonjbb+4OB8o9oDodVrCyalZOGExUO1jZAU2nz/DFkxdaJQ18evLAhgJFOURNOTvGuzKWNCeOPGexi/YxDDytVhkWwiLo9jse5tJF5E8x4beTehHubGFI8fzVs+/15m0wbiTfBjNdG7k24uUEzxcWe9OFk7kc4mzb8su5mxmsjP8ze314KQHG53UqOvaXqbNoY75CB82a4NvLvEbrbDQGlK51yzEIE4JUwnTYmFuymRPOsNsYm7GYFVjRr5zzjMWAj54P4PZ82xiwOu3CLMU9rY2DjDXzji3O4NR5liT976SfUxuSAHYRsBmtTJ67YwQZGqE171tO3EyNmvfyYURsijlAauTYUuz4RzdqfFcTGNIzgS1xTamNM3hy+xW3ZmGe1qRaf6qQFJNGsjNOkYyOd5j+lJtXmK2dI9SLVaRrwtWlz1s1JpNg6oCEg/TadyqLtBkjw5W9oY5cLuSHZBW8YZL+tCX+S1s1nlt8NeCFFv63u12iWUxBN+6pxecGan+TlSl8IfrlCG5pebgLAfgPMR/A9mikaVlEURVEURVEURVEURVEURVEURVEU5Ut7cEgAAAAAIOj/azfYAQAAAAAAAAAAAAAAAAAAgCEsMZPttaKNCgAAAABJRU5ErkJggg==";
+
+// src/sign-in-page.ts
+var FONT = `'Poppins', ui-sans-serif, system-ui, -apple-system, 'Segoe UI', sans-serif`;
+var BACKGROUND = [
+  "radial-gradient(circle at 82% 12%, rgba(73, 195, 232, 0.2), transparent 46%)",
+  "radial-gradient(circle at 10% 94%, rgba(255, 122, 77, 0.12), transparent 42%)",
+  "linear-gradient(152deg, #04212c 0%, #0a4458 52%, #062834 100%)"
+].join(", ");
+var STYLE = `
+html { background: #062834; }
+body {
+    margin: 0;
+    min-height: 100vh;
+    box-sizing: border-box;
+    display: grid;
+    place-items: center;
+    padding: 32px 16px;
+    background: ${BACKGROUND};
+    color: #ffffff;
+    font-family: ${FONT};
+    font-size: 16px;
+    line-height: 1.55;
+}
+.card {
+    display: grid;
+    gap: 12px;
+    justify-items: center;
+    text-align: center;
+    max-width: 420px;
+    padding: 36px 32px;
+    background: rgba(6, 35, 48, 0.55);
+    border: 1px solid rgba(73, 195, 232, 0.25);
+    border-radius: 12px;
+    box-shadow: 0 22px 60px rgba(6, 35, 48, 0.35);
+    backdrop-filter: blur(6px);
+}
+.logo { display: block; width: 72px; height: 72px; }
+.check { width: 60px; height: 60px; }
+.check circle { fill: none; stroke: #49c3e8; stroke-width: 3; }
+.check path { fill: none; stroke: #49c3e8; stroke-width: 3.5; stroke-linecap: round; stroke-linejoin: round; }
+.title { margin: 0; font-size: 1.5rem; font-weight: 700; line-height: 1.2; color: #ffffff; }
+.sub { margin: 0; font-weight: 500; color: #49c3e8; }
+.note { margin: 0; font-size: 0.95rem; color: rgba(255, 255, 255, 0.78); }
+@media (prefers-reduced-motion: no-preference) {
+    .check circle { stroke-dasharray: 170; animation: ring 0.6s ease-out both; }
+    .check path { stroke-dasharray: 40; animation: tick 0.4s ease-out 0.5s both; }
+    .rise { animation: rise 0.5s ease-out both; }
+    .rise.d1 { animation-delay: 0.25s; }
+    .rise.d2 { animation-delay: 0.45s; }
+    .rise.d3 { animation-delay: 0.65s; }
+    @keyframes ring { from { stroke-dashoffset: 170; } to { stroke-dashoffset: 0; } }
+    @keyframes tick { from { stroke-dashoffset: 40; } to { stroke-dashoffset: 0; } }
+    @keyframes rise { from { opacity: 0; transform: translateY(10px); } to { opacity: 1; transform: none; } }
+}
+`;
+var CHECK = '<svg class="check" viewBox="0 0 60 60" aria-hidden="true"><circle cx="30" cy="30" r="27"/><path d="M19 31 l8 8 l15-16"/></svg>';
+function authenticationPage(app, connected) {
+  const name = escapeHtml(app);
+  const title = connected === null ? "Authentication failed" : "Authentication successful";
+  const lines = connected === null ? [
+    `<h1 class="title rise d1">${title}</h1>`,
+    `<p class="note rise d2">Return to ${name} and try again.</p>`
+  ] : [
+    CHECK,
+    `<h1 class="title rise d1">${title}</h1>`,
+    `<p class="sub rise d2">${escapeHtml(connected)} is now connected to ${name}.</p>`,
+    `<p class="note rise d3">You can close this window and return to ${name}.</p>`
+  ];
+  return [
+    "<!doctype html>",
+    '<html lang="en">',
+    "<head>",
+    '<meta charset="utf-8">',
+    '<meta name="viewport" content="width=device-width, initial-scale=1">',
+    `<title>${title}</title>`,
+    `<style>${STYLE}</style>`,
+    "</head>",
+    "<body>",
+    '<main class="card">',
+    `<img class="logo" src="${HOLOKAI_LOGO_PNG}" alt="${name}" width="72" height="72">`,
+    ...lines,
+    "</main>",
+    "</body>",
+    "</html>"
+  ].join("\n");
+}
+function escapeHtml(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+export {
+  authenticationPage
+};

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@holokai/harbor-sdk",
+  "version": "0.3.0",
+  "type": "module",
+  "description": "The harbor extension to MCP Apps: the public contract a hosted view speaks, and a thin client over @modelcontextprotocol/ext-apps.",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./contract": {
+      "types": "./dist/contract.d.ts",
+      "default": "./dist/contract.js"
+    },
+    "./manifest": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./runtime": {
+      "types": "./dist/runtime.d.ts",
+      "default": "./dist/runtime.js"
+    },
+    "./sign-in-page": {
+      "types": "./dist/sign-in-page.d.ts",
+      "default": "./dist/sign-in-page.js"
+    },
+    "./package": {
+      "types": "./dist/package.d.ts",
+      "default": "./dist/package.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "peerDependencies": {
+    "@modelcontextprotocol/ext-apps": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@modelcontextprotocol/ext-apps": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/client": "2.4.0",
+    "@modelcontextprotocol/core": "2.4.0",
+    "@modelcontextprotocol/ext-apps": "^2.0.0",
+    "@types/node": "^24.0.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.12"
+  },
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "typecheck": "tsc --noEmit"
+  }
+}