@vendoai/apps 0.4.0

package/dist/testing/seed-app-row.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-app-row.d.ts","sourceRoot":"","sources":["../../src/testing/seed-app-row.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/D,2DAA2D;AAC3D,eAAO,MAAM,UAAU,GACrB,OAAO,YAAY,EACnB,KAAK,WAAW,EAChB,SAAS,MAAM,EACf,iBAAe,iDAMb,CAAC"}

package/dist/testing/seed-app-row.js

@@ -0,0 +1,7 @@
+/** Seed an app using the reserved vendo_apps row shape. */
+export const seedAppRow = (store, app, subject, enabled = false) => store.records("vendo_apps").put({
+    id: app.id,
+    data: { subject, enabled, doc: app },
+    refs: { subject },
+});
+//# sourceMappingURL=seed-app-row.js.map

package/dist/testing/seed-app-row.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-app-row.js","sourceRoot":"","sources":["../../src/testing/seed-app-row.ts"],"names":[],"mappings":"AAEA,2DAA2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,KAAmB,EACnB,GAAgB,EAChB,OAAe,EACf,OAAO,GAAG,KAAK,EACf,EAAE,CACF,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC;IAC9B,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE;IACpC,IAAI,EAAE,EAAE,OAAO,EAAE;CAClB,CAAC,CAAC"}

package/dist/unified-diff.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Minimal line-based unified diff for pin ship requests (06-apps §8).
+ *
+ * PinShipRequest.diff is "the net diff against the host baseline" a human
+ * approver reviews. Component sources are small (caps in 01-core §9), so a
+ * plain O(n·m) LCS is comfortably fast and keeps this dependency-free.
+ */
+/**
+ * Produce a standard unified diff (`--- a/…`, `+++ b/…`, `@@` hunks) between
+ * two sources. Identical inputs produce an empty string.
+ */
+export declare const unifiedDiff: (label: string, before: string, after: string) => string;
+//# sourceMappingURL=unified-diff.d.ts.map

package/dist/unified-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unified-diff.d.ts","sourceRoot":"","sources":["../src/unified-diff.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkDH;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,MA0E1E,CAAC"}

package/dist/unified-diff.js

@@ -0,0 +1,127 @@
+/**
+ * Minimal line-based unified diff for pin ship requests (06-apps §8).
+ *
+ * PinShipRequest.diff is "the net diff against the host baseline" a human
+ * approver reviews. Component sources are small (caps in 01-core §9), so a
+ * plain O(n·m) LCS is comfortably fast and keeps this dependency-free.
+ */
+const CONTEXT = 3;
+const splitLines = (text) => text === "" ? [] : text.split("\n");
+/** Longest-common-subsequence edit script over lines. */
+const editScript = (before, after) => {
+    const rows = before.length;
+    const cols = after.length;
+    // lcs[i][j] = LCS length of before[i..] vs after[j..]
+    const lcs = Array.from({ length: rows + 1 }, () => new Array(cols + 1).fill(0));
+    for (let i = rows - 1; i >= 0; i -= 1) {
+        for (let j = cols - 1; j >= 0; j -= 1) {
+            lcs[i][j] = before[i] === after[j]
+                ? lcs[i + 1][j + 1] + 1
+                : Math.max(lcs[i + 1][j], lcs[i][j + 1]);
+        }
+    }
+    const ops = [];
+    let i = 0;
+    let j = 0;
+    while (i < rows && j < cols) {
+        if (before[i] === after[j]) {
+            ops.push({ kind: "same", line: before[i] });
+            i += 1;
+            j += 1;
+        }
+        else if (lcs[i + 1][j] >= lcs[i][j + 1]) {
+            ops.push({ kind: "del", line: before[i] });
+            i += 1;
+        }
+        else {
+            ops.push({ kind: "add", line: after[j] });
+            j += 1;
+        }
+    }
+    while (i < rows)
+        ops.push({ kind: "del", line: before[i++] });
+    while (j < cols)
+        ops.push({ kind: "add", line: after[j++] });
+    return ops;
+};
+/**
+ * Produce a standard unified diff (`--- a/…`, `+++ b/…`, `@@` hunks) between
+ * two sources. Identical inputs produce an empty string.
+ */
+export const unifiedDiff = (label, before, after) => {
+    if (before === after)
+        return "";
+    const ops = editScript(splitLines(before), splitLines(after));
+    const hunks = [];
+    let current;
+    let beforeLine = 1;
+    let afterLine = 1;
+    let trailingContext = 0;
+    const flush = () => {
+        if (current === undefined)
+            return;
+        // Trim context beyond CONTEXT lines at the hunk tail.
+        while (trailingContext > CONTEXT) {
+            current.lines.pop();
+            current.beforeCount -= 1;
+            current.afterCount -= 1;
+            trailingContext -= 1;
+        }
+        hunks.push(current);
+        current = undefined;
+        trailingContext = 0;
+    };
+    const pending = [];
+    for (const op of ops) {
+        if (op.kind === "same") {
+            if (current !== undefined) {
+                current.lines.push(` ${op.line}`);
+                current.beforeCount += 1;
+                current.afterCount += 1;
+                trailingContext += 1;
+                if (trailingContext > CONTEXT * 2)
+                    flush();
+            }
+            else {
+                pending.push(op);
+                if (pending.length > CONTEXT)
+                    pending.shift();
+            }
+            beforeLine += 1;
+            afterLine += 1;
+            continue;
+        }
+        if (current === undefined) {
+            current = {
+                beforeStart: beforeLine - pending.length,
+                beforeCount: pending.length,
+                afterStart: afterLine - pending.length,
+                afterCount: pending.length,
+                lines: pending.map((context) => ` ${context.line}`),
+            };
+            pending.length = 0;
+        }
+        trailingContext = 0;
+        if (op.kind === "del") {
+            current.lines.push(`-${op.line}`);
+            current.beforeCount += 1;
+            beforeLine += 1;
+        }
+        else {
+            current.lines.push(`+${op.line}`);
+            current.afterCount += 1;
+            afterLine += 1;
+        }
+    }
+    flush();
+    const body = hunks.map((hunk) => {
+        const beforeStart = hunk.beforeCount === 0 ? hunk.beforeStart - 1 : hunk.beforeStart;
+        const afterStart = hunk.afterCount === 0 ? hunk.afterStart - 1 : hunk.afterStart;
+        return [
+            `@@ -${beforeStart},${hunk.beforeCount} +${afterStart},${hunk.afterCount} @@`,
+            ...hunk.lines,
+        ].join("\n");
+    }).join("\n");
+    return `--- a/${label}\n+++ b/${label}\n${body}\n`;
+};
+//# sourceMappingURL=unified-diff.js.map

package/dist/unified-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unified-diff.js","sourceRoot":"","sources":["../src/unified-diff.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,MAAM,OAAO,GAAG,CAAC,CAAC;AAElB,MAAM,UAAU,GAAG,CAAC,IAAY,EAAY,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAInF,yDAAyD;AACzD,MAAM,UAAU,GAAG,CAAC,MAAgB,EAAE,KAAe,EAAQ,EAAE;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,sDAAsD;IACtD,MAAM,GAAG,GAAe,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAAS,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;gBACjC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC;gBACzB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAS,EAAE,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YAC7C,CAAC,IAAI,CAAC,CAAC;YACP,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC,CAAE,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YAC5C,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;YAC3C,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,KAAa,EAAU,EAAE;IAClF,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,OAAyB,CAAC;IAC9B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,sDAAsD;QACtD,OAAO,eAAe,GAAG,OAAO,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACpB,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;YACzB,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;YACxB,eAAe,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,GAAG,SAAS,CAAC;QACpB,eAAe,GAAG,CAAC,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAS,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACvB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;gBACzB,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;gBACxB,eAAe,IAAI,CAAC,CAAC;gBACrB,IAAI,eAAe,GAAG,OAAO,GAAG,CAAC;oBAAE,KAAK,EAAE,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjB,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO;oBAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChD,CAAC;YACD,UAAU,IAAI,CAAC,CAAC;YAChB,SAAS,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG;gBACR,WAAW,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM;gBACxC,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM;gBACtC,UAAU,EAAE,OAAO,CAAC,MAAM;gBAC1B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;aACpD,CAAC;YACF,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,eAAe,GAAG,CAAC,CAAC;QACpB,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;YACzB,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;YACxB,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IAER,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QACjF,OAAO;YACL,OAAO,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,KAAK;YAC7E,GAAG,IAAI,CAAC,KAAK;SACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,SAAS,KAAK,WAAW,KAAK,KAAK,IAAI,IAAI,CAAC;AACrD,CAAC,CAAC"}

package/dist/version-hash.d.ts

@@ -0,0 +1,9 @@
+import { type AppDocument } from "@vendoai/core";
+/**
+ * Hash the execution-bearing content of an app version for in-client approval.
+ * `id` and `forkedFrom` are copy identity/provenance, not content: import mints a
+ * fresh id and intentionally drops lineage. All other fields, including the
+ * server snapshot reference, affect what the approved app can render or do.
+ */
+export declare const appVersionHash: (doc: AppDocument) => string;
+//# sourceMappingURL=version-hash.d.ts.map

package/dist/version-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-hash.d.ts","sourceRoot":"","sources":["../src/version-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,WAAW,KAAG,MAGjD,CAAC"}

package/dist/version-hash.js

@@ -0,0 +1,12 @@
+import { canonicalJson, sha256Hex } from "@vendoai/core";
+/**
+ * Hash the execution-bearing content of an app version for in-client approval.
+ * `id` and `forkedFrom` are copy identity/provenance, not content: import mints a
+ * fresh id and intentionally drops lineage. All other fields, including the
+ * server snapshot reference, affect what the approved app can render or do.
+ */
+export const appVersionHash = (doc) => {
+    const { id: _id, forkedFrom: _forkedFrom, ...content } = structuredClone(doc);
+    return `sha256:${sha256Hex(canonicalJson(content))}`;
+};
+//# sourceMappingURL=version-hash.js.map

package/dist/version-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-hash.js","sourceRoot":"","sources":["../src/version-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,eAAe,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAgB,EAAU,EAAE;IACzD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,UAAU,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,84 @@
+{
+  "name": "@vendoai/apps",
+  "version": "0.4.0",
+  "description": "The Vendo app artifact, build engine, sandbox seam, and runtime.",
+  "keywords": [
+    "ai",
+    "agent",
+    "apps",
+    "vendo"
+  ],
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/runvendo/vendo.git",
+    "directory": "packages/apps"
+  },
+  "homepage": "https://vendo.run",
+  "bugs": "https://github.com/runvendo/vendo/issues",
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./e2b": {
+      "types": "./dist/e2b/index.d.ts",
+      "default": "./dist/e2b/index.js"
+    },
+    "./adapter-conformance": {
+      "types": "./dist/adapter-conformance.d.ts",
+      "default": "./dist/adapter-conformance.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "croner": "^9.0.0",
+    "esbuild": "^0.25.0",
+    "fflate": "^0.8.2",
+    "zod": "^3.25.0",
+    "@vendoai/core": "0.4.0"
+  },
+  "peerDependencies": {
+    "ai": ">=6.0.0 <7",
+    "e2b": "^2.32.0",
+    "vitest": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "ai": {
+      "optional": true
+    },
+    "e2b": {
+      "optional": true
+    },
+    "vitest": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@ai-sdk/anthropic": "3.0.12",
+    "@types/node": "^22.0.0",
+    "ai": "6.0.28",
+    "e2b": "^2.32.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test:coverage": "vitest run --coverage"
+  }
+}