@tier0/sdk-v2 0.9.10 → 0.10.0

package/skills/tier0-sdk-v2/tier0-sdk-v2-stream/references/http-server.md

@@ -1,12 +1,12 @@
 # HTTPServer 固定前缀与 Stream 路由
 
-先用 [Source 创建](../../tier0-sdk-v2-source/references/create.md)保存 `http-api` + `config.role: server`。Source 使用 `http://managed` 和空 options；业务路径在 Stream 注册。
+先用 [Source 创建](../../tier0-sdk-v2-source/references/create.md)保存 `http-api` + `role: server`。Source 使用 `http://managed` ；业务路径在 Stream 注册。
 
 固定前缀为 `/ingest/v1/{workspaceId}/{sourceId}`。下例路由为 `POST /orders/:id`，完整请求路径为 `POST /ingest/v1/{workspaceId}/{sourceId}/orders/A-001`。前缀由部署环境和已认证的工作空间、Source 身份确定，不从请求 body 推断工作空间。Bearer 凭据由 Source 的既有管理合同取得并在调用时注入，不写入脚本。
 
 ## 保存原生程序草稿
 
-使用完整原生 `document`：script 是 `{code,timeoutMs}`，sources 使用 alias。这与 `program` 的 script 字符串形态不同。
+使用完整原生 `document`：script 是 `{code,timeoutMs}`，sources 使用 alias。这与 `program` 的 script 对象形态不同。
 
 ```ts
 import { createClient, type Tier0Client, type CloudStreamDocument } from '@tier0/sdk-v2';
@@ -18,7 +18,7 @@ export async function createHttpServerStream(
   if (!/^[1-9][0-9]*$/.test(sourceId)) throw new Error('Source ID 必须是正十进制字符串');
   const source = await client.source.documents.get({ id: sourceId, view: 'full' });
   if (!('document' in source.data)) throw new Error('需要完整 Source 文档');
-  const config = source.data.document.config;
+  const config = source.data.document;
   if (source.data.document.protocol !== 'http-api' || config.role !== 'server') {
     throw new Error('此入站路由示例需要 HTTP API Server Source');
   }
@@ -60,7 +60,7 @@ export async function createHttpServerEarlyReplyStream(
   if (!collectionId) throw new Error('需要实际 Collection ID');
   const source = await client.source.documents.get({ id: sourceId, view: 'full' });
   if (!('document' in source.data)) throw new Error('需要完整 Source 文档');
-  const config = source.data.document.config;
+  const config = source.data.document;
   if (source.data.document.protocol !== 'http-api' || config.role !== 'server') {
     throw new Error('此入站路由示例需要 HTTP API Server Source');
   }

package/skills/tier0-sdk-v2/tier0-sdk-v2-stream/references/read.md

@@ -14,9 +14,8 @@ page 从 1 开始，size 最大 200。summary 只需 uns.stream.view 或 uns.str
 import { createClient, type Tier0Client } from '@tier0/sdk-v2';
 
 export async function readStream(id: string, client: Tier0Client = createClient()) {
-  const draft = await client.stream.documents.get({ id });
-  const observation = await client.stream.observations.get({ id });
-  return { draft: draft.data, observation: observation.data };
+  const current = await client.stream.documents.get({ id, view: 'summary' });
+  return { current: current.data };
 }
 export async function* listStreams(client: Tier0Client = createClient()) {
   let page = 1;
@@ -30,6 +29,8 @@ export async function* listStreams(client: Tier0Client = createClient()) {
 }
 ```
 
+查询摘要只需一次请求。编辑完整草稿时显式使用 `documents.get({ id, view: 'full' })`；只看运行观测时直接 `observations.get({ id })`，不先读取草稿。已有写回执时可直接消费其中的状态和修订。
+
 保存、发布、某次执行成功是三个事实。显示实际 revision/activeVersion/release，不用旧 runs 证明新版本生效。版本列表不保证与普通列表相同分页结构；按其 list/total/page/size 读取，versionId 不是 release 序号。
 
 ## 观察本次发布

package/skills/tier0-sdk-v2/tier0-sdk-v2-streams/SKILL.md

@@ -1,11 +1,13 @@
 ---
 name: tier0-sdk-v2-streams
-description: "Tier0 App/Stream requests and live business messages: client.streams.requests describe/invoke/discover, client.streams.messages publish/subscribe, trusted App runtime bootstrap and disposable subscriptions. Use for Stream v3 interactions; UNS history, device MQTT and persisted notifications have their own Skills."
+description: "Tier0 App/Stream requests and live business messages: client.streams.requests describe/invoke/discover, client.streams.messages publish/subscribe on a server client with its own key, and disposable subscriptions. Use for Stream v3 interactions; UNS history, device MQTT and persisted notifications have their own Skills."
 ---
 
 # App / Stream Interactions
 
-Read the [root Skill](../SKILL.md) first. These APIs require an artifact built from the unified SDK implementation: pin its commit and SHA-256 until the corresponding version is published.
+Read the [root Skill](../SKILL.md) first.
+
+**In a Tier0 App's server code** the App's key (`TIER0_API_KEY`) can use both. Stream requests and messages are fixed capabilities of every App (`stream.requests.read` / `invoke` / `write`, `stream.messages.publish` / `subscribe`), not configured per App and not approved by an admin. They are still bounded by the workspace plan (a plan without Stream refuses them) and, for requests, by the Stream request grants: the request code must be granted to this App. Message topics come from published Stream manifests: the App may subscribe to a topic a published Stream declares with `api.stream.messages.use({ topic, access: 'publish' })`, and publish to a topic an active Stream subscribes to. There is no per-App topic list. These APIs require an artifact built from the unified SDK implementation: pin its commit and SHA-256 until the corresponding version is published.
 
 ## Select the interaction
 
@@ -16,13 +18,11 @@ Read the [root Skill](../SKILL.md) first. These APIs require an artifact built f
 
 Import `client` or `createClient` from `@tier0/sdk-v2`. The same client exposes `uns`, `source`, `stream`, `capabilities`, `files` and `notifications`. The singular `stream` manages documents, programs and runs; plural `streams` performs App requests and live messaging. MQTT stays in the separate `/mq` entry.
 
-## Trusted App bootstrap
-
-The SWE host installs `globalThis[Symbol.for('tier0.sdk.app-runtime.v1')]` before the App script. The SDK detects it automatically; App business code must not install a replacement provider or resolve credentials itself. The host's provider returns a `Response` for its authenticated request bridge.
+## Server only
 
-Browser App code knows only public request codes, logical topics and business payloads. Do not add broker URLs, physical subjects, API keys, JWTs, nkey seeds, workspace/principal headers or message identity claims to App configuration. `@tier0/sdk-v2/runtime` is a trusted host integration entry point, not App setup.
+Use `client.streams` from server code with a client that holds a key: `createClient()` reads `TIER0_API_HOST` / `TIER0_API_KEY`, or pass `apiHost` / `apiKey`. Never put that key in a browser bundle. Browser code does not call the platform directly; it calls the App's own server routes, which use `client.streams`. There is no browser host bridge.
 
-For a standalone Node service, the deployment supplies its existing HTTP credential and real App context. Call `createClient()` without literals; never put these server credentials in a browser bundle.
+Callers know only public request codes, logical topics and business payloads. Do not add broker URLs, physical subjects, JWTs, nkey seeds, workspace/principal headers or message identity claims to configuration; the SDK obtains a short-lived broker ticket per connection.
 
 ## Public caller
 
@@ -31,12 +31,12 @@ import { createClient, type StreamMessageError } from '@tier0/sdk-v2';
 
 export async function openOrders(
   reportError: (error: StreamMessageError) => void,
-  renderOrderUpdate: (order: { orderId: string }) => void,
+  onOrderUpdate: (order: { orderId: string }) => void,
 ) {
-  const sdk = createClient(); // automatically uses the trusted App runtime
+  const sdk = createClient(); // server: TIER0_API_HOST / TIER0_API_KEY
   const removeErrorHandler = sdk.streams.messages.onError(reportError);
   const subscription = await sdk.streams.messages.use<{ orderId: string }>({ topic: 'orders/accepted' })
-    .subscribe(message => renderOrderUpdate(message.payload));
+    .subscribe(message => onOrderUpdate(message.payload));
   const request = sdk.streams.requests.use<{ orderId: string }, { accepted: boolean }>({ code: 'orders.approve' });
   return {
     describe: () => request.describe(),
@@ -56,9 +56,9 @@ Persist one caller-owned idempotency key per business intent. A deliberate recon
 
 Messages use a versioned `{ version, messageId, correlationId?, payload }` envelope. Caller-supplied identity in a payload is business data, not authenticated publisher metadata; authorized broker subjects establish identity internally.
 
-The SDK uses native Core NATS over WSS, loaded only when messaging starts. Messages require a browser with WebSocket or Node.js 22+; HTTP-only clients remain usable on Node.js 20.19+. Each initial connection, reconnect and renewal gets a new in-memory user key and a public-key-bound JWT. The old socket closes and its private key is wiped before replacement. No private key leaves the SDK. A successful publish means broker flush, not receiver acknowledgement.
+The SDK uses native Core NATS over WSS, loaded only when messaging starts. Messages require Node.js 22+ (WebSocket); HTTP-only clients remain usable on Node.js 20.19+. Each initial connection, reconnect and renewal gets a new in-memory user key and a public-key-bound JWT. The old socket closes and its private key is wiped before replacement. No private key leaves the SDK. A successful publish means broker flush, not receiver acknowledgement.
 
-Register `messages.onError` (or subscription `onError`) to handle asynchronous broker, decoding and handler failures. After an established session disconnects, publish fails immediately: no offline buffering, write retry or message replay. Credential refresh and reconnection restore subscriptions only. Dispose subscriptions and the owned client when the view/service stops.
+Register `messages.onError` (or subscription `onError`) to handle asynchronous broker, decoding and handler failures. After an established session disconnects, publish fails immediately: no offline buffering, write retry or message replay. Credential refresh and reconnection restore subscriptions only. Dispose subscriptions and the owned client when the service stops.
 
 ## Stream-side code
 

package/skills/tier0-sdk-v2/tier0-sdk-v2-uns/SKILL.md

@@ -5,7 +5,7 @@ description: 使用 @tier0/sdk-v2 的 client.uns 完成新架构集合、Schema
 
 # UNS 数据操作
 
-UNS 管数据命名空间、集合、Record 和 Sample；外部连接与脚本分别用 [Source](../tier0-sdk-v2-source/SKILL.md)、[Stream](../tier0-sdk-v2-stream/SKILL.md)。服务端 `createClient()` 读取 TIER0_API_HOST / TIER0_API_KEY，或显式传 apiHost/apiKey。数据权限不自动授予管理权限：管理操作中 App 凭证只能调用本 App 集合的 appCollectionsEnsure / SchemaReplace / Archive / Restore；appDataPolicyGet/Update 的调用方必须是持有 uns.write 的登录会话、持有 uns.write 且 full_access、不绑定 App 的 personal / agent Key，或治理会话；运行时 App 凭证不能管理数据授权。
+UNS 管数据命名空间、集合、Record 和 Sample；外部连接与脚本分别用 [Source](../tier0-sdk-v2-source/SKILL.md)、[Stream](../tier0-sdk-v2-stream/SKILL.md)。服务端 `createClient()` 读 TIER0_API_HOST / TIER0_API_KEY（平台里由平台注入 App 的 Key），或显式传 apiHost/apiKey。数据权限不自动授予管理权限：管理操作中 App 凭证只能调用本 App 集合的 appCollectionsEnsure / SchemaReplace / Archive / Restore；appDataPolicyGet/Update 的调用方必须是持有 uns.write 的登录会话、持有 uns.write 且 full_access、不绑定 App 的 personal / agent Key，或治理会话；新增授权（新集合、放宽权限、从 disabled 重新启用）只接受工作区 Owner/Admin 的人工会话或平台导入，其他调用方回 403（reason `app_grant_admin_required` / `app_grant_agent_forbidden`），收窄和移除不受此限；运行时 App 凭证不能管理数据授权。
 
 先按[命名空间指导](references/namespace.md)区分凭证：`namespace()` 走 OpenAPI，但当前不对 App Key 开放；App 查询可用集合走 `dataAppContext`，不能改用同样受限的 `appCollectionsList`。Agent / Personal Key 也须满足当前工作空间权限；不要从“使用 SDK / MCP”推定权限。
 
@@ -19,6 +19,7 @@ UNS 管数据命名空间、集合、Record 和 Sample；外部连接与脚本
 | 查询集合、筛选/排序记录 | [查询](references/read.md) | dataAppContext、metadataFind/FindOne（非 App 凭证）、collectionDescribe、recordFind |
 | 改记录、集合名称、扩展 Schema | [修改](references/update.md) | recordUpdateOne、metadataUpdateOne/Many |
 | 删记录、软删除集合 | [删除](references/delete.md) | recordDeleteOne、metadataDeleteOne/Many |
+| 精确删除选中的历史样本 | [删除](references/delete.md#精确删除历史样本) | sampleFind、sampleDeleteExact（非 App 凭证） |
 | 永久删除回收站集合 | [删除](references/delete.md) | metadataPurge、jobs |
 | 恢复集合或记录 | [恢复](references/restore.md) | metadataRestore、recordRestore |
 | 分页、历史采样、事务、写入结果 | [数据工作流](references/data-workflows.md) | sampleFind、recordTransactionExecute |

package/skills/tier0-sdk-v2/tier0-sdk-v2-uns/references/create.md

@@ -29,8 +29,6 @@ export async function createDeviceCollection(
       },
     },
   };
-  const preview = await client.uns.metadataInsertOne({ ...request, dryRun: true });
-  if (preview.data.status !== 'validated') throw new Error('集合预检未通过');
   const receipt = await client.uns.metadataInsertOne({ ...request, dryRun: false, idempotencyKey: intentKey });
   if (receipt.data.status !== 'committed') return { state: 'unconfirmed' as const, receipt };
   const current = await client.uns.metadataFind({ kind: 'collection', filter: { _id: collectionId }, limit: 1 });
@@ -39,6 +37,8 @@ export async function createDeviceCollection(
 }
 ```
 
+普通创建直接提交，服务端在提交时校验。只有需要展示预检结果时才单独使用 `dryRun: true`，预检不锁定提交条件。示例提交后读取一次，是为了返回服务端补全的集合结构和 revision；仅需创建回执时可省略这次读取。
+
 单条 Record 新增默认返回 insertedId/status/replayed。需要创建后的数据、revision 和时间戳时，传 returnDocument:'after'，同一次写入返回 value，无需再查询；可配合 projection，调用者必须同时具有读取权限。幂等重放返回原始创建快照，后续读取最新状态仍用 recordGet/recordFind。dryRun 的 value 是未提交预览。
 
 returnDocument 只允许 none（默认）或 after，不支持 before；projection 只能和 after 一起传。新增仍是 insert，已存在的 ID 不会变成更新。after 的 value 包括服务端补入的字段，但只返回当前授权可见的数据：普通数据权限需 uns.write 和 uns.read，App 还要满足集合的 record:write / record:read 及当前员工、行和字段策略。服务端在提交前校验读取权限，重放时也重新校验；旧回执不能绕过已撤销的授权。

package/skills/tier0-sdk-v2/tier0-sdk-v2-uns/references/delete.md

@@ -54,10 +54,31 @@ metadataDeleteMany 使用明确 filter 和 maxDocs。默认原子；超过上限
 
 恢复范围和授权区别见[恢复](restore.md)。保留的物理索引仍占配额，归档不释放索引空间。
 
-业务记录使用 recordDeleteOne/Many，传 collectionId 和明确 filter，编辑型流程同时传 expectedRevision。不要把元数据软删除解释成逐条删除该集合的 Record。Sample 的删除是独立的显式时间范围操作，具体影响遵循当前数据 API 契约。
+业务记录使用 recordDeleteOne/Many，传 collectionId 和明确 filter，编辑型流程同时传 expectedRevision。不要把元数据软删除解释成逐条删除该集合的 Record。Sample 使用独立的精确清单或显式时间范围删除接口；清理选定样本使用下面的 sampleDeleteExact。
 
 成功回执已确认本次操作，不再固定读回验证。结果未知时保留原意图键，按对象身份核对；需要展示最新状态时再刷新。版本冲突应重新读取并由调用方处理，不自动覆盖。
 
+## 精确删除历史样本
+
+Workspace 管理调用方通过 `client.uns.sampleDeleteExact` 删除当前集合内的明确样本清单，最多 200 条，需要 `uns.delete` 权限；MCP 凭证另需 `uns.write` 授权。运行时 App Key 不支持此操作，也没有对应的 App 数据层方法。
+
+从 `sampleFind` 结果复制 `{recordId,id,time}`，保留原始 Unix 毫秒时间；`id` 不能替代完整身份，`receivedAt` 不能替代 `time`。不接受空清单、重复身份、filter 或时间范围。清理重复样本时，由业务判断哪些样本重复、保留哪条，只把多余项放入清单；接口本身不判断重复，也不改变采集逻辑。
+
+```ts
+import { createClient, type Tier0Client, type UnsV2SampleDeleteExactReq } from '@tier0/sdk-v2';
+
+export async function deleteSelectedSamples(
+  collectionId: string, samples: UnsV2SampleDeleteExactReq['samples'],
+  intentKey: string, dryRun = true, client: Tier0Client = createClient(),
+) {
+  return client.uns.sampleDeleteExact({ collectionId, samples, dryRun, idempotencyKey: intentKey });
+}
+```
+
+`dryRun:true` 仅返回当时的匹配数量，不删除或预留样本。执行时使用同一清单和 `dryRun:false`；省略 dryRun 也会执行。返回 `{deletedCount,missingCount,dryRun}`：deletedCount 在预览时是预计删除数，执行时是实际删除数；missingCount 是未匹配到的完整键数。整批精确删除与回执同事务，不修改父 Record 或未列出的样本。
+
+相同执行请求重试复用相同 `idempotencyKey`，修改清单需要新键。SDK 不自动重试；结局未知时按完整键查询核对，遵循错误中的 execution/retry，不改用范围删除或重建集合。`sampleDeleteRange` 仍不向 MCP 开放。
+
 ## 永久删除回收站集合
 
 Workspace 管理调用方使用 `metadataPurge`，传 `kind:'collection'` 和 1–200 个明确 `ids`。

package/skills/tier0-sdk-v2/tier0-sdk-v2-uns/references/read.md

@@ -36,13 +36,10 @@ export async function readAppRecords(alias: string, client: Tier0Client = create
 import { createClient, type Tier0Client } from '@tier0/sdk-v2';
 
 export async function readDevices(collectionId: string, client: Tier0Client = createClient()) {
-  const collection = await client.uns.metadataFind({ kind: 'collection', filter: { _id: collectionId }, limit: 1 });
-  const definition = collection.data.items[0];
-  if (!definition) throw new Error('集合不存在或不可见');
   const records = await client.uns.recordFind({
     collectionId, filter: { enabled: true }, sort: [['name', 1]], limit: 20,
   });
-  return { definition: definition.data, items: records.data.items, pageInfo: records.data.pageInfo };
+  return { items: records.data.items, pageInfo: records.data.pageInfo };
 }
 
 export async function listCollections(page = 1, client: Tier0Client = createClient()) {
@@ -54,10 +51,12 @@ export async function listCollections(page = 1, client: Tier0Client = createClie
 
 按 pageInfo.hasMore/nextPage 继续元数据分页；不要把第一页当全量。recordFind 的游标循环见[数据工作流](data-workflows.md)。sort 是数组元组。
 
-以上 metadataFind 示例用于 Workspace 集成（会话、personal / agent Key）。App 凭证不能调用 metadataFind：用 dataAppContext 精确选择授权 alias，集合的 revision、indexStatus、ttl 也在其中。数据授权不等于元数据管理授权。网络/权限错误必须传播，不能用空数组掩盖错误。
+已知 collectionId 时直接读取记录，由服务端校验集合及操作权限；不先调用 metadataFind、dataAppContext、collectionDescribe 或 ensure。需要选择集合或查看结构时，再单独读取对应上下文。
+
+listCollections 的 metadataFind 仅用于 Workspace 集成（会话、personal / agent Key）。App 凭证不能调用 metadataFind；未知 collectionId 时用 dataAppContext 选择已授权集合，集合的 revision、indexStatus、ttl 也在其中。readDevices 只需要目标集合的记录读取权限。网络/权限错误必须传播，不能用空数组掩盖错误。
 
 ## 回收集合的历史读取
 
-按原 collectionId 读取 Record、Sample、count 或 aggregate；既有授权、员工行规则和字段权限仍生效。活跃 Topic 可继续读取其引用的回收集合。活跃 App 的 dataAppContext 保留仍可读的回收集合，但不授予新增能力；回收中的 App 自身不能运行。
+按原 collectionId 读取 Record、Sample、count 或 aggregate；既有授权和字段权限仍生效。活跃 Topic 可继续读取其引用的回收集合。活跃 App 的 dataAppContext 保留仍可读的回收集合，但不授予新增能力；回收中的 App 自身不能运行。
 
 已知 ID 直接读取，不必先恢复集合或查询元数据。数据层也可用 `data.collection({ collectionId })`，不会 ensure、写种子或补授权。只有 Workspace 集成确需回收对象定义时，才用 metadataFind 的 state=deleted 或 all；App Key 仍不调用该接口。[回收规则](delete.md#回收规则)说明写入和恢复边界。

package/dist/cjs/app-identity-contract.generated.d.ts

@@ -1,22 +0,0 @@
-export declare const APP_REQUEST_IDENTITY_CONTRACT: {
-    readonly version: "tier0.app-request-identity/v1";
-    readonly header: "X-Tier0-App-Identity";
-    readonly type: "tier0-app-request+jwt";
-    readonly algorithm: "EdDSA";
-    readonly issuer: "tier0-app-gateway";
-    readonly audience: "tier0-app-runtime";
-    readonly maxTokenBytes: 8192;
-    readonly maxBodyBytes: 65536;
-    readonly maxURIBytes: 8192;
-    readonly maxTTLSeconds: 30;
-    readonly clockSkewSeconds: 5;
-    readonly maxRoles: 32;
-    readonly maxRoleBytes: 128;
-    readonly maxKeys: 8;
-    readonly keyIDPattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$";
-    readonly appIDPattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$";
-    readonly requiredClaims: readonly ["ver", "iss", "aud", "sub", "workspaceID", "appID", "method", "requestURI", "bodySHA256", "iat", "exp", "jti", "roles"];
-    readonly methodPattern: "^[A-Z]{1,16}$";
-    readonly requiredHeaderFields: readonly ["alg", "typ", "kid"];
-    readonly publicKeyFields: readonly ["kty", "crv", "x", "kid"];
-};

package/dist/cjs/app-identity-contract.generated.js

@@ -1,51 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.APP_REQUEST_IDENTITY_CONTRACT = void 0;
-// Generated from SWE gatewayheader/app-request-identity.v1.json; do not edit.
-// Source SHA-256: ac5ec2efb882395e63a46c9ec479de16c09943b88fc0bd906dd77c7f9f4bfaa3
-exports.APP_REQUEST_IDENTITY_CONTRACT = {
-    "version": "tier0.app-request-identity/v1",
-    "header": "X-Tier0-App-Identity",
-    "type": "tier0-app-request+jwt",
-    "algorithm": "EdDSA",
-    "issuer": "tier0-app-gateway",
-    "audience": "tier0-app-runtime",
-    "maxTokenBytes": 8192,
-    "maxBodyBytes": 65536,
-    "maxURIBytes": 8192,
-    "maxTTLSeconds": 30,
-    "clockSkewSeconds": 5,
-    "maxRoles": 32,
-    "maxRoleBytes": 128,
-    "maxKeys": 8,
-    "keyIDPattern": "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
-    "appIDPattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$",
-    "requiredClaims": [
-        "ver",
-        "iss",
-        "aud",
-        "sub",
-        "workspaceID",
-        "appID",
-        "method",
-        "requestURI",
-        "bodySHA256",
-        "iat",
-        "exp",
-        "jti",
-        "roles"
-    ],
-    "methodPattern": "^[A-Z]{1,16}$",
-    "requiredHeaderFields": [
-        "alg",
-        "typ",
-        "kid"
-    ],
-    "publicKeyFields": [
-        "kty",
-        "crv",
-        "x",
-        "kid"
-    ]
-};
-//# sourceMappingURL=app-identity-contract.generated.js.map

package/dist/cjs/app-identity-contract.generated.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-identity-contract.generated.js","sourceRoot":"","sources":["../../src/app-identity-contract.generated.ts"],"names":[],"mappings":";;;AAAA,8EAA8E;AAC9E,mFAAmF;AACtE,QAAA,6BAA6B,GAAG;IAC3C,SAAS,EAAE,+BAA+B;IAC1C,QAAQ,EAAE,sBAAsB;IAChC,MAAM,EAAE,uBAAuB;IAC/B,WAAW,EAAE,OAAO;IACpB,QAAQ,EAAE,mBAAmB;IAC7B,UAAU,EAAE,mBAAmB;IAC/B,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,EAAE;IACd,cAAc,EAAE,GAAG;IACnB,SAAS,EAAE,CAAC;IACZ,cAAc,EAAE,mCAAmC;IACnD,cAAc,EAAE,2EAA2E;IAC3F,gBAAgB,EAAE;QAChB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,aAAa;QACb,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK;QACL,OAAO;KACR;IACD,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE;QACtB,KAAK;QACL,KAAK;QACL,KAAK;KACN;IACD,iBAAiB,EAAE;QACjB,KAAK;QACL,KAAK;QACL,GAAG;QACH,KAAK;KACN;CACO,CAAC","sourcesContent":["// Generated from SWE gatewayheader/app-request-identity.v1.json; do not edit.\n// Source SHA-256: ac5ec2efb882395e63a46c9ec479de16c09943b88fc0bd906dd77c7f9f4bfaa3\nexport const APP_REQUEST_IDENTITY_CONTRACT = {\n  \"version\": \"tier0.app-request-identity/v1\",\n  \"header\": \"X-Tier0-App-Identity\",\n  \"type\": \"tier0-app-request+jwt\",\n  \"algorithm\": \"EdDSA\",\n  \"issuer\": \"tier0-app-gateway\",\n  \"audience\": \"tier0-app-runtime\",\n  \"maxTokenBytes\": 8192,\n  \"maxBodyBytes\": 65536,\n  \"maxURIBytes\": 8192,\n  \"maxTTLSeconds\": 30,\n  \"clockSkewSeconds\": 5,\n  \"maxRoles\": 32,\n  \"maxRoleBytes\": 128,\n  \"maxKeys\": 8,\n  \"keyIDPattern\": \"^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$\",\n  \"appIDPattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$\",\n  \"requiredClaims\": [\n    \"ver\",\n    \"iss\",\n    \"aud\",\n    \"sub\",\n    \"workspaceID\",\n    \"appID\",\n    \"method\",\n    \"requestURI\",\n    \"bodySHA256\",\n    \"iat\",\n    \"exp\",\n    \"jti\",\n    \"roles\"\n  ],\n  \"methodPattern\": \"^[A-Z]{1,16}$\",\n  \"requiredHeaderFields\": [\n    \"alg\",\n    \"typ\",\n    \"kid\"\n  ],\n  \"publicKeyFields\": [\n    \"kty\",\n    \"crv\",\n    \"x\",\n    \"kid\"\n  ]\n} as const;\n"]}

package/dist/cjs/runtime.d.ts

@@ -1,13 +0,0 @@
-/** Trusted host integration; application code uses client.streams without configuration. */
-export interface AppRuntime {
-    readonly appId: string;
-    /** Authenticated host bridge. Never expose a service key to the browser. */
-    request(path: string, body: unknown, options: {
-        signal: AbortSignal;
-    }): Promise<Response>;
-}
-/** Internal lifecycle registration, shared across SDK copies in the host page. */
-export declare function onAppRuntimeDispose(runtime: AppRuntime, callback: () => void): () => void;
-export declare function getAppRuntime(): AppRuntime | undefined;
-/** Install before loading App code; disposal removes only this installation. */
-export declare function installAppRuntime(runtime: AppRuntime): () => void;

package/dist/cjs/runtime.js

@@ -1,51 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.onAppRuntimeDispose = onAppRuntimeDispose;
-exports.getAppRuntime = getAppRuntime;
-exports.installAppRuntime = installAppRuntime;
-const runtimeKey = Symbol.for('tier0.sdk.app-runtime.v1');
-const cleanupKey = Symbol.for('tier0.sdk.app-runtime-cleanup.v1');
-/** Internal lifecycle registration, shared across SDK copies in the host page. */
-function onAppRuntimeDispose(runtime, callback) {
-    const target = globalThis;
-    const callbacks = target[cleanupKey] ??= new Map();
-    const listeners = callbacks.get(runtime) ?? new Set();
-    callbacks.set(runtime, listeners);
-    listeners.add(callback);
-    return () => {
-        listeners.delete(callback);
-        if (!listeners.size)
-            callbacks.delete(runtime);
-    };
-}
-function disposeRuntime(runtime) {
-    if (!runtime)
-        return;
-    const callbacks = globalThis[cleanupKey];
-    const listeners = callbacks?.get(runtime);
-    callbacks?.delete(runtime);
-    if (listeners)
-        for (const listener of listeners)
-            listener();
-}
-function getAppRuntime() {
-    return globalThis[runtimeKey];
-}
-/** Install before loading App code; disposal removes only this installation. */
-function installAppRuntime(runtime) {
-    if (!runtime.appId?.trim() || typeof runtime.request !== 'function') {
-        throw new TypeError('Tier0 SDK: invalid trusted App runtime.');
-    }
-    const target = globalThis;
-    const previous = target[runtimeKey];
-    target[runtimeKey] = runtime;
-    if (previous !== runtime)
-        disposeRuntime(previous);
-    return () => {
-        if (target[runtimeKey] === runtime) {
-            delete target[runtimeKey];
-            disposeRuntime(runtime);
-        }
-    };
-}
-//# sourceMappingURL=runtime.js.map

package/dist/cjs/runtime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":";;AAeA,kDAUC;AAUD,sCAEC;AAGD,8CAcC;AA/CD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAMlE,kFAAkF;AAClF,SAAgB,mBAAmB,CAAC,OAAmB,EAAE,QAAoB;IAC3E,MAAM,MAAM,GAAG,UAA2B,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAc,CAAC;IAClE,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI;YAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAA+B;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,SAAS,GAAI,UAA4B,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,SAAS;QAAE,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAQ,UAA4B,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,SAAgB,iBAAiB,CAAC,OAAmB;IACnD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACpE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,UAA2B,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;IAC7B,IAAI,QAAQ,KAAK,OAAO;QAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,GAAG,EAAE;QACV,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/** Trusted host integration; application code uses client.streams without configuration. */\nexport interface AppRuntime {\n  readonly appId: string;\n  /** Authenticated host bridge. Never expose a service key to the browser. */\n  request(path: string, body: unknown, options: { signal: AbortSignal }): Promise<Response>;\n}\n\nconst runtimeKey = Symbol.for('tier0.sdk.app-runtime.v1');\nconst cleanupKey = Symbol.for('tier0.sdk.app-runtime-cleanup.v1');\ntype RuntimeGlobal = typeof globalThis & {\n  [runtimeKey]?: AppRuntime;\n  [cleanupKey]?: Map<AppRuntime, Set<() => void>>;\n};\n\n/** Internal lifecycle registration, shared across SDK copies in the host page. */\nexport function onAppRuntimeDispose(runtime: AppRuntime, callback: () => void): () => void {\n  const target = globalThis as RuntimeGlobal;\n  const callbacks = target[cleanupKey] ??= new Map();\n  const listeners = callbacks.get(runtime) ?? new Set<() => void>();\n  callbacks.set(runtime, listeners);\n  listeners.add(callback);\n  return () => {\n    listeners.delete(callback);\n    if (!listeners.size) callbacks.delete(runtime);\n  };\n}\n\nfunction disposeRuntime(runtime: AppRuntime | undefined): void {\n  if (!runtime) return;\n  const callbacks = (globalThis as RuntimeGlobal)[cleanupKey];\n  const listeners = callbacks?.get(runtime);\n  callbacks?.delete(runtime);\n  if (listeners) for (const listener of listeners) listener();\n}\n\nexport function getAppRuntime(): AppRuntime | undefined {\n  return (globalThis as RuntimeGlobal)[runtimeKey];\n}\n\n/** Install before loading App code; disposal removes only this installation. */\nexport function installAppRuntime(runtime: AppRuntime): () => void {\n  if (!runtime.appId?.trim() || typeof runtime.request !== 'function') {\n    throw new TypeError('Tier0 SDK: invalid trusted App runtime.');\n  }\n  const target = globalThis as RuntimeGlobal;\n  const previous = target[runtimeKey];\n  target[runtimeKey] = runtime;\n  if (previous !== runtime) disposeRuntime(previous);\n  return () => {\n    if (target[runtimeKey] === runtime) {\n      delete target[runtimeKey];\n      disposeRuntime(runtime);\n    }\n  };\n}\n"]}

package/dist/esm/app-identity-contract.generated.d.ts

@@ -1,22 +0,0 @@
-export declare const APP_REQUEST_IDENTITY_CONTRACT: {
-    readonly version: "tier0.app-request-identity/v1";
-    readonly header: "X-Tier0-App-Identity";
-    readonly type: "tier0-app-request+jwt";
-    readonly algorithm: "EdDSA";
-    readonly issuer: "tier0-app-gateway";
-    readonly audience: "tier0-app-runtime";
-    readonly maxTokenBytes: 8192;
-    readonly maxBodyBytes: 65536;
-    readonly maxURIBytes: 8192;
-    readonly maxTTLSeconds: 30;
-    readonly clockSkewSeconds: 5;
-    readonly maxRoles: 32;
-    readonly maxRoleBytes: 128;
-    readonly maxKeys: 8;
-    readonly keyIDPattern: "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$";
-    readonly appIDPattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$";
-    readonly requiredClaims: readonly ["ver", "iss", "aud", "sub", "workspaceID", "appID", "method", "requestURI", "bodySHA256", "iat", "exp", "jti", "roles"];
-    readonly methodPattern: "^[A-Z]{1,16}$";
-    readonly requiredHeaderFields: readonly ["alg", "typ", "kid"];
-    readonly publicKeyFields: readonly ["kty", "crv", "x", "kid"];
-};

package/dist/esm/app-identity-contract.generated.js

@@ -1,48 +0,0 @@
-// Generated from SWE gatewayheader/app-request-identity.v1.json; do not edit.
-// Source SHA-256: ac5ec2efb882395e63a46c9ec479de16c09943b88fc0bd906dd77c7f9f4bfaa3
-export const APP_REQUEST_IDENTITY_CONTRACT = {
-    "version": "tier0.app-request-identity/v1",
-    "header": "X-Tier0-App-Identity",
-    "type": "tier0-app-request+jwt",
-    "algorithm": "EdDSA",
-    "issuer": "tier0-app-gateway",
-    "audience": "tier0-app-runtime",
-    "maxTokenBytes": 8192,
-    "maxBodyBytes": 65536,
-    "maxURIBytes": 8192,
-    "maxTTLSeconds": 30,
-    "clockSkewSeconds": 5,
-    "maxRoles": 32,
-    "maxRoleBytes": 128,
-    "maxKeys": 8,
-    "keyIDPattern": "^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$",
-    "appIDPattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$",
-    "requiredClaims": [
-        "ver",
-        "iss",
-        "aud",
-        "sub",
-        "workspaceID",
-        "appID",
-        "method",
-        "requestURI",
-        "bodySHA256",
-        "iat",
-        "exp",
-        "jti",
-        "roles"
-    ],
-    "methodPattern": "^[A-Z]{1,16}$",
-    "requiredHeaderFields": [
-        "alg",
-        "typ",
-        "kid"
-    ],
-    "publicKeyFields": [
-        "kty",
-        "crv",
-        "x",
-        "kid"
-    ]
-};
-//# sourceMappingURL=app-identity-contract.generated.js.map

package/dist/esm/app-identity-contract.generated.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-identity-contract.generated.js","sourceRoot":"","sources":["../../src/app-identity-contract.generated.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,SAAS,EAAE,+BAA+B;IAC1C,QAAQ,EAAE,sBAAsB;IAChC,MAAM,EAAE,uBAAuB;IAC/B,WAAW,EAAE,OAAO;IACpB,QAAQ,EAAE,mBAAmB;IAC7B,UAAU,EAAE,mBAAmB;IAC/B,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,EAAE;IACd,cAAc,EAAE,GAAG;IACnB,SAAS,EAAE,CAAC;IACZ,cAAc,EAAE,mCAAmC;IACnD,cAAc,EAAE,2EAA2E;IAC3F,gBAAgB,EAAE;QAChB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,aAAa;QACb,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK;QACL,OAAO;KACR;IACD,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE;QACtB,KAAK;QACL,KAAK;QACL,KAAK;KACN;IACD,iBAAiB,EAAE;QACjB,KAAK;QACL,KAAK;QACL,GAAG;QACH,KAAK;KACN;CACO,CAAC","sourcesContent":["// Generated from SWE gatewayheader/app-request-identity.v1.json; do not edit.\n// Source SHA-256: ac5ec2efb882395e63a46c9ec479de16c09943b88fc0bd906dd77c7f9f4bfaa3\nexport const APP_REQUEST_IDENTITY_CONTRACT = {\n  \"version\": \"tier0.app-request-identity/v1\",\n  \"header\": \"X-Tier0-App-Identity\",\n  \"type\": \"tier0-app-request+jwt\",\n  \"algorithm\": \"EdDSA\",\n  \"issuer\": \"tier0-app-gateway\",\n  \"audience\": \"tier0-app-runtime\",\n  \"maxTokenBytes\": 8192,\n  \"maxBodyBytes\": 65536,\n  \"maxURIBytes\": 8192,\n  \"maxTTLSeconds\": 30,\n  \"clockSkewSeconds\": 5,\n  \"maxRoles\": 32,\n  \"maxRoleBytes\": 128,\n  \"maxKeys\": 8,\n  \"keyIDPattern\": \"^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$\",\n  \"appIDPattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$\",\n  \"requiredClaims\": [\n    \"ver\",\n    \"iss\",\n    \"aud\",\n    \"sub\",\n    \"workspaceID\",\n    \"appID\",\n    \"method\",\n    \"requestURI\",\n    \"bodySHA256\",\n    \"iat\",\n    \"exp\",\n    \"jti\",\n    \"roles\"\n  ],\n  \"methodPattern\": \"^[A-Z]{1,16}$\",\n  \"requiredHeaderFields\": [\n    \"alg\",\n    \"typ\",\n    \"kid\"\n  ],\n  \"publicKeyFields\": [\n    \"kty\",\n    \"crv\",\n    \"x\",\n    \"kid\"\n  ]\n} as const;\n"]}

package/dist/esm/runtime.d.ts

@@ -1,13 +0,0 @@
-/** Trusted host integration; application code uses client.streams without configuration. */
-export interface AppRuntime {
-    readonly appId: string;
-    /** Authenticated host bridge. Never expose a service key to the browser. */
-    request(path: string, body: unknown, options: {
-        signal: AbortSignal;
-    }): Promise<Response>;
-}
-/** Internal lifecycle registration, shared across SDK copies in the host page. */
-export declare function onAppRuntimeDispose(runtime: AppRuntime, callback: () => void): () => void;
-export declare function getAppRuntime(): AppRuntime | undefined;
-/** Install before loading App code; disposal removes only this installation. */
-export declare function installAppRuntime(runtime: AppRuntime): () => void;

package/dist/esm/runtime.js

@@ -1,46 +0,0 @@
-const runtimeKey = Symbol.for('tier0.sdk.app-runtime.v1');
-const cleanupKey = Symbol.for('tier0.sdk.app-runtime-cleanup.v1');
-/** Internal lifecycle registration, shared across SDK copies in the host page. */
-export function onAppRuntimeDispose(runtime, callback) {
-    const target = globalThis;
-    const callbacks = target[cleanupKey] ??= new Map();
-    const listeners = callbacks.get(runtime) ?? new Set();
-    callbacks.set(runtime, listeners);
-    listeners.add(callback);
-    return () => {
-        listeners.delete(callback);
-        if (!listeners.size)
-            callbacks.delete(runtime);
-    };
-}
-function disposeRuntime(runtime) {
-    if (!runtime)
-        return;
-    const callbacks = globalThis[cleanupKey];
-    const listeners = callbacks?.get(runtime);
-    callbacks?.delete(runtime);
-    if (listeners)
-        for (const listener of listeners)
-            listener();
-}
-export function getAppRuntime() {
-    return globalThis[runtimeKey];
-}
-/** Install before loading App code; disposal removes only this installation. */
-export function installAppRuntime(runtime) {
-    if (!runtime.appId?.trim() || typeof runtime.request !== 'function') {
-        throw new TypeError('Tier0 SDK: invalid trusted App runtime.');
-    }
-    const target = globalThis;
-    const previous = target[runtimeKey];
-    target[runtimeKey] = runtime;
-    if (previous !== runtime)
-        disposeRuntime(previous);
-    return () => {
-        if (target[runtimeKey] === runtime) {
-            delete target[runtimeKey];
-            disposeRuntime(runtime);
-        }
-    };
-}
-//# sourceMappingURL=runtime.js.map

package/dist/esm/runtime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/runtime.ts"],"names":[],"mappings":"AAOA,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAMlE,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,OAAmB,EAAE,QAAoB;IAC3E,MAAM,MAAM,GAAG,UAA2B,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,EAAc,CAAC;IAClE,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,IAAI;YAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,OAA+B;IACrD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,SAAS,GAAI,UAA4B,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,SAAS;QAAE,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAQ,UAA4B,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,OAAmB;IACnD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACpE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,UAA2B,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;IAC7B,IAAI,QAAQ,KAAK,OAAO;QAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,GAAG,EAAE;QACV,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;YAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/** Trusted host integration; application code uses client.streams without configuration. */\nexport interface AppRuntime {\n  readonly appId: string;\n  /** Authenticated host bridge. Never expose a service key to the browser. */\n  request(path: string, body: unknown, options: { signal: AbortSignal }): Promise<Response>;\n}\n\nconst runtimeKey = Symbol.for('tier0.sdk.app-runtime.v1');\nconst cleanupKey = Symbol.for('tier0.sdk.app-runtime-cleanup.v1');\ntype RuntimeGlobal = typeof globalThis & {\n  [runtimeKey]?: AppRuntime;\n  [cleanupKey]?: Map<AppRuntime, Set<() => void>>;\n};\n\n/** Internal lifecycle registration, shared across SDK copies in the host page. */\nexport function onAppRuntimeDispose(runtime: AppRuntime, callback: () => void): () => void {\n  const target = globalThis as RuntimeGlobal;\n  const callbacks = target[cleanupKey] ??= new Map();\n  const listeners = callbacks.get(runtime) ?? new Set<() => void>();\n  callbacks.set(runtime, listeners);\n  listeners.add(callback);\n  return () => {\n    listeners.delete(callback);\n    if (!listeners.size) callbacks.delete(runtime);\n  };\n}\n\nfunction disposeRuntime(runtime: AppRuntime | undefined): void {\n  if (!runtime) return;\n  const callbacks = (globalThis as RuntimeGlobal)[cleanupKey];\n  const listeners = callbacks?.get(runtime);\n  callbacks?.delete(runtime);\n  if (listeners) for (const listener of listeners) listener();\n}\n\nexport function getAppRuntime(): AppRuntime | undefined {\n  return (globalThis as RuntimeGlobal)[runtimeKey];\n}\n\n/** Install before loading App code; disposal removes only this installation. */\nexport function installAppRuntime(runtime: AppRuntime): () => void {\n  if (!runtime.appId?.trim() || typeof runtime.request !== 'function') {\n    throw new TypeError('Tier0 SDK: invalid trusted App runtime.');\n  }\n  const target = globalThis as RuntimeGlobal;\n  const previous = target[runtimeKey];\n  target[runtimeKey] = runtime;\n  if (previous !== runtime) disposeRuntime(previous);\n  return () => {\n    if (target[runtimeKey] === runtime) {\n      delete target[runtimeKey];\n      disposeRuntime(runtime);\n    }\n  };\n}\n"]}