@picked/app-protocol 0.0.0-stage → 0.0.115-next.2

package/dist/types/manifest.d.ts

@@ -0,0 +1,132 @@
+/**
+ * @file The app manifest: what an app version declares to Picked, and the parser
+ * the API and the CLI both run over it.
+ */
+/** The dashboard locations an app can render a slot into. */
+export declare const APP_SLOT_LOCATIONS: readonly ['app-home', 'workspace-prepublish-actions', 'workspace-postpublish-actions'];
+/** A dashboard location an app can render a slot into. */
+export type AppSlotLocation = (typeof APP_SLOT_LOCATIONS)[number];
+/** The events an app can subscribe to: Picked POSTs each to `<endpoint>/events`. */
+export declare const APP_EVENTS: readonly ['workspace.published'];
+/** An event an app can subscribe to. */
+export type AppEventName = (typeof APP_EVENTS)[number];
+/** The value types a workflow tool argument or output field takes. */
+export declare const APP_VALUE_TYPES: readonly ['string', 'number', 'boolean', 'json'];
+/** A value type a workflow tool argument or output field takes. */
+export type AppValueType = (typeof APP_VALUE_TYPES)[number];
+/** One iframe an app renders at a dashboard location. */
+export interface AppSlot {
+    /** Where the slot renders. */
+    location: AppSlotLocation;
+    /** The page the iframe loads. HTTPS, or `http://localhost` while developing. */
+    url: string;
+    /** The heading the dashboard shows above the iframe. */
+    title?: string;
+    /** The iframe's starting height in pixels; the frame can resize itself. */
+    height?: number;
+}
+/** One argument a workflow tool takes. */
+export interface AppToolArgument {
+    /** The argument's name for authors. */
+    label: string;
+    /** The value type the argument takes. */
+    type: AppValueType;
+    /** What the argument means, shown under the field. */
+    description?: string;
+    /** Whether a node must set the argument. */
+    required?: boolean;
+    /** The values a `string` argument is limited to. */
+    options?: string[];
+}
+/** One property a workflow tool records for later nodes. */
+export interface AppToolOutputField {
+    /** The property's name for authors. */
+    label: string;
+    /** The value type the property holds. */
+    type: AppValueType;
+    /** What the property holds. */
+    description?: string;
+    /** Whether a call can leave the property out. */
+    optional?: boolean;
+}
+/** A workflow tool whose calls Picked POSTs to the app's endpoint. */
+export interface AppWorkflowTool {
+    /** The tool's name within the app: lower-case letters, digits and underscores. */
+    name: string;
+    /** The tool's name for authors. */
+    label: string;
+    /** What the tool does, for authors. */
+    description: string;
+    /** `write` when a call changes something outside the run; a test run skips writes. */
+    effect: 'read' | 'write';
+    /** The arguments a node sets, by name. */
+    arguments: Record<string, AppToolArgument>;
+    /** What a call records for later nodes, by property name. */
+    output: Record<string, AppToolOutputField>;
+}
+/** What an app version declares. */
+export interface AppManifest {
+    /** The app's handle, unique in its organisation: lower-case letters, digits and hyphens. */
+    handle: string;
+    /** The app's name. */
+    name: string;
+    /** A sentence on what the app does. */
+    description?: string;
+    /**
+     * The base URL Picked appends request paths to: `/lifecycle`, `/events` and
+     * `/tools/<name>`. An app with no endpoint has slots, an MCP server, or both.
+     */
+    endpoint?: string;
+    /** The Picked API scopes the installation token carries, such as `organization_leads/read`. */
+    scopes?: string[];
+    /** The iframes the app renders in the dashboard. */
+    slots?: AppSlot[];
+    /** The workflow tools the app adds to every project it is installed on. */
+    workflowTools?: AppWorkflowTool[];
+    /** An MCP server the dashboard agent can use, at an https `url`. */
+    mcp?: {
+        url: string;
+    };
+    /** The events Picked sends the app for every project it is installed on. */
+    events?: AppEventName[];
+    /**
+     * Whether the app mints installation tokens on its own, outside a request from Picked, such
+     * as for a scheduled sync. The installing user consents to it. Without it, the app calls
+     * Picked with the token each request from Picked carries.
+     */
+    offlineAccess?: boolean;
+}
+/** The result of parsing a manifest: the manifest, or every issue found. */
+export type ParseManifestResult = {
+    ok: true;
+    manifest: AppManifest;
+} | {
+    ok: false;
+    issues: string[];
+};
+/**
+ * Checks a URL is HTTPS, or HTTP on a loopback host.
+ *
+ * @param {unknown} value - The candidate URL.
+ * @returns {boolean} Whether Picked may load or call it.
+ * @example isAppUrl('https://example.com') // true
+ */
+export declare function isAppUrl(value: unknown): value is string;
+/**
+ * Removes every trailing occurrence of a character.
+ *
+ * @param {string} text - The text.
+ * @param {string} char - The character, such as `/`.
+ * @returns {string} The text without it at the end.
+ * @example trimTrailing('https://x.dev//', '/') // 'https://x.dev'
+ */
+export declare function trimTrailing(text: string, char: string): string;
+/**
+ * Parses a manifest, reporting every issue rather than the first.
+ *
+ * @param {unknown} value - The candidate manifest, such as a JSON body.
+ * @returns {ParseManifestResult} The manifest, or the issues.
+ * @example parseManifest({ handle: 'acme', name: 'Acme' })
+ */
+export declare function parseManifest(value: unknown): ParseManifestResult;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/types/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/manifest.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,YAC7B,UAAU,EACV,8BAA8B,EAC9B,+BAA+B,CACvB,CAAA;AAEV,0DAA0D;AAC1D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjE,oFAAoF;AACpF,eAAO,MAAM,UAAU,YAAI,qBAAqB,CAAU,CAAA;AAE1D,wCAAwC;AACxC,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtD,sEAAsE;AACtE,eAAO,MAAM,eAAe,YAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAU,CAAA;AAE/E,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE3D,yDAAyD;AACzD,MAAM,WAAW,OAAO;IACtB,8BAA8B;IAC9B,QAAQ,EAAE,eAAe,CAAA;IACzB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAA;IACX,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,yCAAyC;IACzC,IAAI,EAAE,YAAY,CAAA;IAClB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,yCAAyC;IACzC,IAAI,EAAE,YAAY,CAAA;IAClB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC9B,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;IACxB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC1C,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;CAC3C;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,oDAAoD;IACpD,KAAK,CAAC,EAAE,OAAO,EAAE,CAAA;IACjB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,eAAe,EAAE,CAAA;IACjC,oEAAoE;IACpE,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAA;IACrB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,YAAY,EAAE,CAAA;IACvB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,4EAA4E;AAC5E,MAAM,MAAM,mBAAmB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAA;AAiBvE;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CASxD;AAyLD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/D;AA8GD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAwCjE"}

package/dist/types/protocol.d.ts

@@ -0,0 +1,211 @@
+/**
+ * @file What Picked sends an app and what the app answers: lifecycle events, workflow tool
+ * calls, app events, and the signatures and session tokens both sides check.
+ *
+ * Every request Picked sends carries `picked-signature: t=<unix seconds>,kid=<key id>,v1=<sig>`,
+ * the base64url Ed25519 signature of `<t>.<body>` by Picked's key, whose public half Picked
+ * publishes at {@link PICKED_KEYS_PATH}. Session tokens are EdDSA JWTs Picked signs the same
+ * way. An app calls Picked with an app assertion: a JWT it signs with its own key, whose
+ * public half it registered on deploy.
+ */
+import { type PublicKeySet, type Signer } from './keys';
+/** The header a signed request carries. */
+export declare const SIGNATURE_HEADER = "picked-signature";
+/** The header naming the installation a request is for. */
+export declare const INSTALLATION_HEADER = "picked-installation-id";
+/** The header an app sends its app assertion in. */
+export declare const APP_ASSERTION_HEADER = "picked-app-assertion";
+/**
+ * The header an MCP request carries its installation in: the base64url JSON of an
+ * {@link InstallationRef}, which the request's signature covers with the body.
+ */
+export declare const CONTEXT_HEADER = "picked-context";
+/** Where Picked publishes the public keys it signs with, beneath its API origin. */
+export declare const PICKED_KEYS_PATH = "/.well-known/picked-app-keys.json";
+/** Where an installation lives, and the Picked API it calls back. */
+export interface InstallationRef {
+    installationId: string;
+    organizationId: string;
+    projectId: string;
+    /** The origin of the Picked API that sent this, which the installation calls back. */
+    apiUrl: string;
+    /**
+     * A one-hour token carrying the installation's scopes, on every request from Picked. It
+     * reaches the installation's own labels.
+     */
+    token?: string;
+    /** When `token` expires. */
+    tokenExpiresAt?: string;
+}
+/** Sent when the app is installed on a project. */
+export interface InstallationCreatedEvent extends InstallationRef {
+    type: 'installation.created';
+    /** The scopes the installation's tokens carry. */
+    scopes: string[];
+}
+/** Sent when an installation moves to another version of the app. */
+export interface InstallationUpgradedEvent extends InstallationRef {
+    type: 'installation.upgraded';
+    /** The version the installation now runs. */
+    version: number;
+    /** The scopes the installation's tokens now carry. */
+    scopes: string[];
+}
+/** Sent when the app is removed from a project, just before its tokens and labels go. */
+export interface InstallationDeletedEvent extends InstallationRef {
+    type: 'installation.deleted';
+}
+/** A lifecycle event. */
+export type LifecycleEvent = InstallationCreatedEvent | InstallationUpgradedEvent | InstallationDeletedEvent;
+/** Sent to an app that subscribes to `workspace.published` when a project's workspace publishes. */
+export interface WorkspacePublishedEvent extends InstallationRef {
+    type: 'workspace.published';
+    /** The id the event carries across redeliveries. */
+    eventId: string;
+    workspaceId: string;
+    /** The version the publish wrote. */
+    workspaceVersionId: string;
+    /** When it published, as an ISO 8601 timestamp. */
+    occurredAt: string;
+}
+/** An event an app subscribes to in its manifest's `events`. */
+export type AppEvent = WorkspacePublishedEvent;
+/** A workflow node calling one of the app's tools. */
+export interface ToolCall extends InstallationRef {
+    type: 'workflow_tool.call';
+    /** The tool's name, as the manifest declares it. */
+    tool: string;
+    /** The node's resolved arguments. */
+    arguments: Record<string, unknown>;
+    /** Identifies the call across retries; the same key means the same call. */
+    idempotencyKey: string;
+    /** The run the call belongs to. */
+    run: {
+        runId: string;
+        nodeId: string;
+        test: boolean;
+    };
+}
+/** What a tool answers: its output, or why it failed. */
+export type ToolResult = {
+    output: Record<string, unknown>;
+} | {
+    error: {
+        message: string;
+        retryable?: boolean;
+    };
+};
+/** What a session token asserts: who is looking at the app's frame, where. */
+export interface SessionClaims extends InstallationRef {
+    /** The signed-in dashboard user. */
+    userId: string;
+    /** Expiry, in unix seconds. */
+    exp: number;
+}
+/**
+ * Signs a request body for the `picked-signature` header.
+ *
+ * @param {Signer} signer - Picked's key.
+ * @param {string} body - The exact body sent.
+ * @param {number} [timestamp] - Unix seconds; now when absent.
+ * @returns {Promise<string>} The header value.
+ * @example await signBody(signer, '{}')
+ */
+export declare function signBody(signer: Signer, body: string, timestamp?: number): Promise<string>;
+/**
+ * Checks a `picked-signature` header against a body.
+ *
+ * @param {PublicKeySet} keys - Picked's public keys.
+ * @param {string} body - The exact body received.
+ * @param {string | null} header - The header value.
+ * @returns {Promise<boolean>} Whether Picked signed the body recently.
+ * @example await verifyBody(keys, '{}', request.headers.get('picked-signature'))
+ */
+export declare function verifyBody(keys: PublicKeySet, body: string, header: string | null): Promise<boolean>;
+/**
+ * Signs an MCP request Picked forwards to an app: the signature covers the installation it
+ * is for as well as the JSON-RPC body, which does not name it.
+ *
+ * @param {Signer} signer - Picked's key.
+ * @param {InstallationRef} ref - The installation.
+ * @param {string} body - The exact body forwarded.
+ * @returns {Promise<Record<string, string>>} The headers to send.
+ * @example await signMcpRequest(signer, ref, body)
+ */
+export declare function signMcpRequest(signer: Signer, ref: InstallationRef, body: string): Promise<Record<string, string>>;
+/**
+ * Checks an MCP request's signature and reads the installation it is for.
+ *
+ * @param {PublicKeySet} keys - Picked's public keys.
+ * @param {Headers} headers - The request's headers.
+ * @param {string} body - The exact body received.
+ * @returns {Promise<InstallationRef | null>} The installation, or null when the request is not Picked's.
+ * @example await verifyMcpRequest(keys, request.headers, body)
+ */
+export declare function verifyMcpRequest(keys: PublicKeySet, headers: Headers, body: string): Promise<InstallationRef | null>;
+/**
+ * Mints a session token: an EdDSA JWT of the claims, signed by Picked.
+ *
+ * @param {Signer} signer - Picked's key.
+ * @param {SessionClaims} claims - What the token asserts.
+ * @returns {Promise<string>} The token.
+ * @example await createSessionToken(signer, claims)
+ */
+export declare function createSessionToken(signer: Signer, claims: SessionClaims): Promise<string>;
+/**
+ * Checks a session token and reads its claims.
+ *
+ * @param {PublicKeySet} keys - Picked's public keys.
+ * @param {string} token - The token the frame was handed.
+ * @returns {Promise<SessionClaims | null>} The claims, or null when the token is forged or expired.
+ * @example await verifySessionToken(keys, token)
+ */
+export declare function verifySessionToken(keys: PublicKeySet, token: string): Promise<SessionClaims | null>;
+/** What an app assertion asserts. */
+export interface AppAssertionClaims {
+    /** The installation the app acts for. */
+    installationId: string;
+    /** The assertion's id, which Picked accepts once. */
+    jti: string;
+    /** Expiry, in unix seconds. */
+    exp: number;
+}
+/**
+ * Makes an app assertion: a JWT, signed with the app's key, naming the installation the app
+ * acts for and the Picked API it calls. It lives one minute.
+ *
+ * @param {Signer} signer - The app's key.
+ * @param {object} options - What it asserts.
+ * @param {string} options.installationId - The installation.
+ * @param {string} options.audience - The origin of the Picked API it is sent to.
+ * @returns {Promise<string>} The assertion, for the `picked-app-assertion` header.
+ * @example await createAppAssertion(signer, { installationId, audience: apiUrl })
+ */
+export declare function createAppAssertion(signer: Signer, options: {
+    installationId: string;
+    audience: string;
+}): Promise<string>;
+/**
+ * Checks an app assertion for an audience. One that lives longer than five minutes fails, so
+ * a verifier remembers each `jti` for at most that long.
+ *
+ * @param {PublicKeySet} keys - The app's public keys.
+ * @param {string} assertion - The assertion.
+ * @param {object} options - What it must assert.
+ * @param {string} options.audience - The origin of the Picked API verifying it.
+ * @returns {Promise<AppAssertionClaims | null>} Its claims, or null when it fails.
+ * @example await verifyAppAssertion(keys, assertion, { audience })
+ */
+export declare function verifyAppAssertion(keys: PublicKeySet, assertion: string, options: {
+    audience: string;
+}): Promise<AppAssertionClaims | null>;
+/**
+ * Reads the installation an app assertion names, without checking it. A verifier uses it to
+ * find the app whose keys must then verify the assertion.
+ *
+ * @param {string} assertion - The assertion.
+ * @returns {string | null} The installation, or null when the assertion names none.
+ * @example unverifiedAssertionSubject(assertion)
+ */
+export declare function unverifiedAssertionSubject(assertion: string): string | null;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/types/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAML,KAAK,YAAY,EACjB,KAAK,MAAM,EACZ,MAAM,QAAQ,CAAA;AAEf,2CAA2C;AAC3C,eAAO,MAAM,gBAAgB,qBAAqB,CAAA;AAElD,2DAA2D;AAC3D,eAAO,MAAM,mBAAmB,2BAA2B,CAAA;AAE3D,oDAAoD;AACpD,eAAO,MAAM,oBAAoB,yBAAyB,CAAA;AAE1D;;;GAGG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAA;AAK9C,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,sCAAsC,CAAA;AAKnE,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4BAA4B;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,mDAAmD;AACnD,MAAM,WAAW,wBAAyB,SAAQ,eAAe;IAC/D,IAAI,EAAE,sBAAsB,CAAA;IAC5B,kDAAkD;IAClD,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,yBAA0B,SAAQ,eAAe;IAChE,IAAI,EAAE,uBAAuB,CAAA;IAC7B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,yFAAyF;AACzF,MAAM,WAAW,wBAAyB,SAAQ,eAAe;IAC/D,IAAI,EAAE,sBAAsB,CAAA;CAC7B;AAED,yBAAyB;AACzB,MAAM,MAAM,cAAc,GACxB,wBAAwB,GAAG,yBAAyB,GAAG,wBAAwB,CAAA;AAEjF,oGAAoG;AACpG,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,IAAI,EAAE,qBAAqB,CAAA;IAC3B,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,gEAAgE;AAChE,MAAM,MAAM,QAAQ,GAAG,uBAAuB,CAAA;AAE9C,sDAAsD;AACtD,MAAM,WAAW,QAAS,SAAQ,eAAe;IAC/C,IAAI,EAAE,oBAAoB,CAAA;IAC1B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAA;IACtB,mCAAmC;IACnC,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAA;CACtD;AAED,yDAAyD;AACzD,MAAM,MAAM,UAAU,GACpB;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAA;AAE3F,8EAA8E;AAC9E,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAA;CACZ;AAID;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,MAAsC,GAChD,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOjC;AAuCD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CASjC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/F;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAO/B;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAA;IACtB,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAA;IACX,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,MAAM,CAAC,CASjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC5B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgBpC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU3E"}

package/package.json

@@ -1,6 +1,63 @@
 {
   "name": "@picked/app-protocol",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "description": "The Picked app contract: the app manifest, Ed25519 keys and the signed requests Picked and an app exchange",
+  "version": "0.0.115-next.2",
+  "dependencies": {},
+  "devDependencies": {
+    "@repo/eslint-config": "workspace:*",
+    "@repo/typescript-config": "workspace:*",
+    "@repo/vitest-config": "workspace:*",
+    "@types/node": "^24",
+    "@vitest/coverage-v8": "^5.0.1",
+    "vite": "^8.2.0",
+    "vitest": "^5.0.1"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js",
+      "default": "./dist/esm/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "knip": {
+    "ignoreBinaries": [
+      "knip",
+      "jscpd",
+      "eslint",
+      "tsgo"
+    ],
+    "ignoreDependencies": [
+      "@repo/eslint-config",
+      "@repo/typescript-config",
+      "@repo/vitest-config",
+      "@vitest/coverage-v8"
+    ],
+    "ignore": [
+      "eslint.config.js"
+    ]
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "vite build && tsgo -p tsconfig.build.json",
+    "dev": "node ../../scripts/sdk-watch-build.mjs",
+    "lint": "eslint .",
+    "lint-files": "eslint",
+    "lint:report": "eslint . -o './.reports/eslint.json' -f json || true",
+    "test": "vitest run",
+    "test:coverage": "../../scripts/vitest-coverage.sh",
+    "type-check": "tsgo -p . --noEmit"
+  },
+  "type": "module",
+  "types": "./dist/types/index.d.ts",
+  "sideEffects": false
+}