@vibesdotdev/applets 0.0.0-stage → 1.0.0-rc.2

package/dist/host/local-host.impl.js

@@ -0,0 +1,41 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { requireConsumerSessionUser } from '@vibesdotdev/auth/server/consumer-session-user';
+import { createServedAppletRpc } from "../cli/commands/served-applet-rpc.js";
+import { resolveAppletWorkspaceRoot } from "../cli/project-files.js";
+import { appletProjectIdSchema } from "../local-project.js";
+export default class RuntimeLocalAppletHost extends BaseRuntimeClient {
+    peers = new Map();
+    async handleRpc(projectId, request) {
+        await this.ensureLoaded();
+        const id = appletProjectIdSchema.parse(projectId);
+        const principal = this.runtime.requestPrincipal();
+        if (principal.kind !== 'user')
+            throw new CapabilityError('Sign in to use workspace applets.', 'AUTH_REQUIRED', {
+                reason: 'applet-host-sign-in-required', retryable: false
+            });
+        await requireConsumerSessionUser(this.runtime);
+        const workspaceRoot = await resolveAppletWorkspaceRoot(this.runtime);
+        let peer = this.peers.get(principal.userId);
+        if (!peer) {
+            peer = createServedAppletRpc({
+                runtime: this.runtime,
+                workspaceRoot,
+                routePrefix: project => `/${encodeURIComponent(project)}`,
+                runInvocation: (work, connection) => this.runtime.runInvocation(work, {
+                    principal: this.runtime.requestPrincipal(), signal: connection.signal
+                })
+            });
+            this.peers.set(principal.userId, peer);
+        }
+        return peer.handle(id, request);
+    }
+    async onDispose() {
+        const outcomes = await Promise.allSettled([...this.peers.values()].map(peer => peer.close()));
+        this.peers.clear();
+        const failures = outcomes.flatMap(outcome => outcome.status === 'rejected' ? [outcome.reason] : []);
+        if (failures.length)
+            throw new AggregateError(failures, 'Local applet connections failed to close.');
+    }
+}
+//# sourceMappingURL=local-host.impl.js.map

package/dist/host/local-host.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-host.impl.js","sourceRoot":"","sources":["../../src/host/local-host.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,MAAM,CAAC,OAAO,OAAO,sBAAuB,SAAQ,iBAA+B;IACjE,KAAK,GAAG,IAAI,GAAG,EAAoD,CAAC;IAErF,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,OAAgB;QAClD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,mCAAmC,EAAE,eAAe,EAAE;gBAC9G,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK;aACxD,CAAC,CAAC;QACH,MAAM,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,GAAG,qBAAqB,CAAC;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,aAAa;gBACb,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE;gBACzD,aAAa,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE;oBACrE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;iBACrE,CAAC;aACF,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAEkB,KAAK,CAAC,SAAS;QACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpG,IAAI,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,cAAc,CAAC,QAAQ,EAAE,2CAA2C,CAAC,CAAC;IACtG,CAAC;CACD"}

package/dist/host/local-host.plugin.d.ts

@@ -0,0 +1,3 @@
+declare const localHostPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default localHostPlugin;
+//# sourceMappingURL=local-host.plugin.d.ts.map

package/dist/host/local-host.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-host.plugin.d.ts","sourceRoot":"","sources":["../../src/host/local-host.plugin.ts"],"names":[],"mappings":"AAKA,QAAA,MAAM,eAAe,6CAUnB,CAAC;AAEH,eAAe,eAAe,CAAC"}

package/dist/host/local-host.plugin.js

@@ -0,0 +1,16 @@
+import { createRuntimeAsset, createRuntimePlugin, loader } from '@vibesdotdev/kernel';
+import localStore from "../cli/applet-local-store.storage.descriptor.js";
+import localServeAuthzPolicy from "../cli/local-serve.authz-policy.descriptor.js";
+import { LOCAL_APPLET_HOST_ID } from "./local-host.contract.js";
+const localHostPlugin = createRuntimePlugin({
+    id: 'applets.local-host',
+    name: 'Local applet host',
+    dependencies: ['auth'],
+    descriptors: [localStore, localServeAuthzPolicy, createRuntimeAsset({
+            id: LOCAL_APPLET_HOST_ID, kind: 'runtime/client', name: 'Local applet host',
+            description: 'Authenticated local applet RPC, using the existing AppletRootSurface.'
+        })],
+    loaders: [loader(LOCAL_APPLET_HOST_ID, { kind: 'runtime/client', scope: 'consumer' }, () => import("./local-host.impl.js"))]
+});
+export default localHostPlugin;
+//# sourceMappingURL=local-host.plugin.js.map

package/dist/host/local-host.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-host.plugin.js","sourceRoot":"","sources":["../../src/host/local-host.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,UAAU,MAAM,iDAAiD,CAAC;AACzE,OAAO,qBAAqB,MAAM,+CAA+C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,eAAe,GAAG,mBAAmB,CAAC;IAC3C,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,mBAAmB;IACzB,YAAY,EAAE,CAAC,MAAM,CAAC;IACtB,WAAW,EAAE,CAAC,UAAU,EAAE,qBAAqB,EAAE,kBAAkB,CAAC;YACnE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,mBAAmB;YAC3E,WAAW,EAAE,uEAAuE;SACpF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,EACnF,GAAG,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC;AAEH,eAAe,eAAe,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+export * from './schemas/index.ts';
+export { appletsClientDescriptor, getVibesAppletsClient, APPLETS_REPOSITORY_CONTEXT_ID, appletsRepositoryContextDescriptor } from './client/contract.ts';
+export type { AppletsClient, AppletsOwnerScope, AppletsRepositoryOwner, AppletsRepository } from './client/contract.ts';
+export * from './storage/index.ts';
+export * from './tools/index.ts';
+export * from './authorization.ts';
+export * from './build-definition.ts';
+export * from './applet-gate.ts';
+export * from './applet-root-surface.ts';
+export * from './templates/index.ts';
+export * from './composition-plan.ts';
+export * from './local-project.ts';
+export * from './companion-path.ts';
+export * from './manifest-hash.ts';
+export * from './composition.ts';
+export * from './content-path.ts';
+export * from './contribution-registry.ts';
+export * from './upgrade.ts';
+export * from './component-ref.ts';
+export * from './selection.ts';
+export * from './browser-runtime.ts';
+export * from './presentation.ts';
+export * from './host/local-host.contract.ts';
+export { findReleaseReferences, isReleaseRetained, type ReleaseReference } from './retention.ts';
+export { appletsPlugin } from './applets.plugin.ts';
+export * from './capabilities/capability.kind.ts';
+export * from './capabilities/runtime-dispatch.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACN,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,kCAAkC,EAClC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACX,aAAa,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,iBAAiB,EAC3E,MAAM,sBAAsB,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,+BAA+B,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC"}

package/dist/index.js

@@ -0,0 +1,27 @@
+export * from "./schemas/index.js";
+export { appletsClientDescriptor, getVibesAppletsClient, APPLETS_REPOSITORY_CONTEXT_ID, appletsRepositoryContextDescriptor } from "./client/contract.js";
+export * from "./storage/index.js";
+export * from "./tools/index.js";
+export * from "./authorization.js";
+export * from "./build-definition.js";
+export * from "./applet-gate.js";
+export * from "./applet-root-surface.js";
+export * from "./templates/index.js";
+export * from "./composition-plan.js";
+export * from "./local-project.js";
+export * from "./companion-path.js";
+export * from "./manifest-hash.js";
+export * from "./composition.js";
+export * from "./content-path.js";
+export * from "./contribution-registry.js";
+export * from "./upgrade.js";
+export * from "./component-ref.js";
+export * from "./selection.js";
+export * from "./browser-runtime.js";
+export * from "./presentation.js";
+export * from "./host/local-host.contract.js";
+export { findReleaseReferences, isReleaseRetained } from "./retention.js";
+export { appletsPlugin } from "./applets.plugin.js";
+export * from "./capabilities/capability.kind.js";
+export * from "./capabilities/runtime-dispatch.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACN,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,kCAAkC,EAClC,MAAM,sBAAsB,CAAC;AAI9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,+BAA+B,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAyB,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC"}

package/dist/local-project.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Local authoring: an applet on disk, in `.vibes/applets/{id}/`.
+ *
+ * Drew chose this shape — a descriptor plus a component that may import others —
+ * over a single-file format. The consequence for the compiler was that it had to
+ * accept a file SET; the consequence here is that the on-disk layout must produce
+ * exactly what `buildAppletDefinitionManifest` already consumes, rather than a
+ * second parallel notion of "what an applet is".
+ *
+ * FILESYSTEM ACCESS IS INJECTED. This module reads no files itself, which keeps
+ * it usable from a CLI, from a dev server, and from a test with no fixtures on
+ * disk. It also means the traversal rules below are testable as rules rather
+ * than as directory listings.
+ */
+import * as z from 'zod/v4';
+import type { AppletOwnStorageDescriptor, AppletPackageFile, AppletServerAction } from './schemas/definition.ts';
+import { type AppletDefinitionBuildResult } from './build-definition.ts';
+/**
+ * The directory an applet lives in, relative to the workspace root.
+ *
+ * Built from `PROJECT_STATE_DIRNAME` rather than spelling `.vibes` privately.
+ * `@vibesdotdev/paths` owns filesystem root policy and documents this exact case
+ * — "feature packages that need the bare dirname (to build a relative pattern
+ * rather than an absolute path) consume this instead" — and `check:path-roots`
+ * caught the private spelling within a minute of it being written.
+ */
+export declare const APPLET_PROJECT_ROOT = ".vibes/applets";
+/** The descriptor file every applet project must have. */
+export declare const APPLET_DESCRIPTOR_FILENAME = "applet.descriptor.ts";
+/**
+ * The stores a local project declares: the manifest's own `storage` field, as
+ * JSON.
+ *
+ * Data rather than a field on the TypeScript descriptor, because reading a
+ * descriptor means executing it, and nothing in this pipeline executes author
+ * code on the host. Parsed by the manifest's own schema, so a declaration that
+ * would not publish does not serve either. Like the descriptor it is authoring
+ * metadata, not a published file: what it says becomes `manifest.storage`.
+ */
+export declare const APPLET_STORAGE_FILENAME = "applet.storage.json";
+/**
+ * The A2b approved server actions a local project declares: the manifest's own
+ * `serverActions` field, as JSON. Authoring metadata like the storage file —
+ * read as data, never inventoried, never executed.
+ */
+export declare const APPLET_ACTIONS_FILENAME = "applet.actions.json";
+/**
+ * What one project's files look like once read.
+ *
+ * `sources` feeds the compiler; `files` feeds the manifest. They are produced
+ * together from one traversal so the two can never describe different sets —
+ * a manifest that inventories a file the bundle does not contain is exactly the
+ * digest-pinning failure this whole contract exists to prevent.
+ */
+export interface AppletLocalProject {
+    readonly id: string;
+    readonly entry: string;
+    readonly sources: Record<string, string>;
+    readonly files: AppletPackageFile[];
+    /** The stores `applet.storage.json` declares; empty when the project has none. */
+    readonly storage: AppletOwnStorageDescriptor[];
+    /** The actions `applet.actions.json` declares; empty when the project has none. */
+    readonly actions: AppletServerAction[];
+}
+export interface AppletLocalProjectError {
+    readonly path: string;
+    readonly message: string;
+    /** The underlying failure, when one produced this error (malformed JSON, for one). */
+    readonly cause?: Error;
+}
+export declare function isBinaryMediaType(mediaType: string): boolean;
+export declare function mediaTypeFor(path: string): string | undefined;
+export declare const appletProjectIdSchema: z.ZodString;
+/**
+ * Turn one project directory's contents into a compilable, inventoriable applet.
+ *
+ * `entries` is what the caller found on disk: path relative to the project root,
+ * and the bytes. Everything else is decided here so a CLI and a dev server cannot
+ * disagree about which files count.
+ */
+export declare function readAppletLocalProject(input: {
+    id: string;
+    entry?: string;
+    entries: {
+        path: string;
+        contents: string;
+        encoding?: 'utf8' | 'base64';
+    }[];
+    digest: (bytes: Uint8Array) => Promise<string>;
+}): Promise<{
+    ok: true;
+    project: AppletLocalProject;
+} | {
+    ok: false;
+    errors: AppletLocalProjectError[];
+}>;
+/**
+ * The definition manifest a local project publishes as: its inventory and its
+ * declared stores, seeded the way `vibes applet build` always seeded it.
+ *
+ * One producer, so `build` (which prints the manifest hash an author pins) and
+ * `serve` (which binds the stores an applet may reach) cannot describe two
+ * different applets.
+ */
+export declare function buildAppletLocalDefinitionManifest(project: AppletLocalProject): AppletDefinitionBuildResult;
+//# sourceMappingURL=local-project.d.ts.map

package/dist/local-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-project.d.ts","sourceRoot":"","sources":["../src/local-project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,OAAO,KAAK,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACjH,OAAO,EAAiC,KAAK,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAExG;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,mBAAqC,CAAC;AAEtE,0DAA0D;AAC1D,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAO7D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC/C,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACvB;AA8BD,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE5D;AAKD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM7D;AAUD,eAAO,MAAM,qBAAqB,aAI4C,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;KAAE,EAAE,CAAC;IAC5E,MAAM,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C,GAAG,OAAO,CACV;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,uBAAuB,EAAE,CAAA;CAAE,CAC5F,CA2FA;AAsDD;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,kBAAkB,GAAG,2BAA2B,CAe3G"}

package/dist/local-project.js

@@ -0,0 +1,277 @@
+/**
+ * Local authoring: an applet on disk, in `.vibes/applets/{id}/`.
+ *
+ * Drew chose this shape — a descriptor plus a component that may import others —
+ * over a single-file format. The consequence for the compiler was that it had to
+ * accept a file SET; the consequence here is that the on-disk layout must produce
+ * exactly what `buildAppletDefinitionManifest` already consumes, rather than a
+ * second parallel notion of "what an applet is".
+ *
+ * FILESYSTEM ACCESS IS INJECTED. This module reads no files itself, which keeps
+ * it usable from a CLI, from a dev server, and from a test with no fixtures on
+ * disk. It also means the traversal rules below are testable as rules rather
+ * than as directory listings.
+ */
+import * as z from 'zod/v4';
+import { PROJECT_STATE_DIRNAME } from '@vibesdotdev/paths';
+import { appletDefinitionManifestSchema, appletRelativePathSchema } from "./schemas/definition.js";
+import { buildAppletDefinitionManifest } from "./build-definition.js";
+/**
+ * The directory an applet lives in, relative to the workspace root.
+ *
+ * Built from `PROJECT_STATE_DIRNAME` rather than spelling `.vibes` privately.
+ * `@vibesdotdev/paths` owns filesystem root policy and documents this exact case
+ * — "feature packages that need the bare dirname (to build a relative pattern
+ * rather than an absolute path) consume this instead" — and `check:path-roots`
+ * caught the private spelling within a minute of it being written.
+ */
+export const APPLET_PROJECT_ROOT = `${PROJECT_STATE_DIRNAME}/applets`;
+/** The descriptor file every applet project must have. */
+export const APPLET_DESCRIPTOR_FILENAME = 'applet.descriptor.ts';
+/**
+ * The stores a local project declares: the manifest's own `storage` field, as
+ * JSON.
+ *
+ * Data rather than a field on the TypeScript descriptor, because reading a
+ * descriptor means executing it, and nothing in this pipeline executes author
+ * code on the host. Parsed by the manifest's own schema, so a declaration that
+ * would not publish does not serve either. Like the descriptor it is authoring
+ * metadata, not a published file: what it says becomes `manifest.storage`.
+ */
+export const APPLET_STORAGE_FILENAME = 'applet.storage.json';
+/**
+ * The A2b approved server actions a local project declares: the manifest's own
+ * `serverActions` field, as JSON. Authoring metadata like the storage file —
+ * read as data, never inventoried, never executed.
+ */
+export const APPLET_ACTIONS_FILENAME = 'applet.actions.json';
+/** The manifest's `storage` field, bounds included. One owner schema, not a copy. */
+const appletStorageDeclarationSchema = appletDefinitionManifestSchema.shape.storage;
+/** The manifest's `serverActions` field, bounds included. One owner schema, not a copy. */
+const appletActionsDeclarationSchema = appletDefinitionManifestSchema.shape.serverActions;
+/** Media types by extension. Deliberately small: an applet is source, not a CDN. */
+const MEDIA_TYPES = {
+    '.svelte': 'text/x-svelte',
+    '.ts': 'text/typescript',
+    '.mjs': 'text/javascript',
+    '.js': 'text/javascript',
+    '.json': 'application/json',
+    '.css': 'text/css',
+    '.html': 'text/html',
+    '.md': 'text/markdown',
+    '.txt': 'text/plain',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.ico': 'image/x-icon'
+};
+/**
+ * Media the bundle carries as BYTES: never a `source`, never compiled — served
+ * with its media type. The applet contract admits them as companions (A2b,
+ * Drew: "assets" alongside ts/css/js/md), so images travel digest-pinned like
+ * every other file.
+ */
+const BINARY_MEDIA_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/x-icon']);
+export function isBinaryMediaType(mediaType) {
+    return BINARY_MEDIA_TYPES.has(mediaType);
+}
+/** Files that are never part of an applet, whatever an author leaves lying around. */
+const IGNORED = new Set(['node_modules', '.git', 'dist', '.svelte-kit', '.DS_Store']);
+export function mediaTypeFor(path) {
+    const dot = path.lastIndexOf('.');
+    if (dot === -1)
+        return undefined;
+    const ext = path.slice(dot).toLowerCase();
+    // SAFETY: ext is verified to be an owned property of MEDIA_TYPES before lookup
+    return Object.hasOwn(MEDIA_TYPES, ext) ? MEDIA_TYPES[ext] : undefined;
+}
+/** Base64 to bytes without Buffer: the reader hands binary companions back encoded. */
+function base64ToBytes(text) {
+    const binary = atob(text);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1)
+        bytes[index] = binary.charCodeAt(index);
+    return bytes;
+}
+export const appletProjectIdSchema = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Applet project ids must be kebab-case');
+/**
+ * Turn one project directory's contents into a compilable, inventoriable applet.
+ *
+ * `entries` is what the caller found on disk: path relative to the project root,
+ * and the bytes. Everything else is decided here so a CLI and a dev server cannot
+ * disagree about which files count.
+ */
+export async function readAppletLocalProject(input) {
+    const errors = [];
+    const id = appletProjectIdSchema.safeParse(input.id);
+    if (!id.success) {
+        errors.push({ path: input.id, message: id.error.issues[0]?.message ?? 'Invalid applet id' });
+    }
+    const sources = {};
+    const files = [];
+    let storage = [];
+    let actions = [];
+    for (const entry of input.entries) {
+        const segments = entry.path.split('/');
+        if (segments.some((segment) => IGNORED.has(segment)))
+            continue;
+        // The DESCRIPTOR is authoring metadata, not a published file. Inventorying
+        // it would publish the author's local configuration as part of the applet.
+        if (entry.path === APPLET_DESCRIPTOR_FILENAME)
+            continue;
+        // So is the storage declaration: it becomes `manifest.storage`, not a file.
+        if (entry.path === APPLET_STORAGE_FILENAME) {
+            const declared = readStorageDeclaration(entry.contents);
+            if (declared.ok)
+                storage = declared.storage;
+            else
+                errors.push(...declared.errors);
+            continue;
+        }
+        // The actions file is authoring metadata too: it becomes
+        // `manifest.serverActions`, not a published file.
+        if (entry.path === APPLET_ACTIONS_FILENAME) {
+            const declared = readActionsDeclaration(entry.contents);
+            if (declared.ok)
+                actions = declared.actions;
+            else
+                errors.push(...declared.errors);
+            continue;
+        }
+        const path = appletRelativePathSchema.safeParse(entry.path);
+        if (!path.success) {
+            // Refused rather than sanitised: a path that escapes the project is a
+            // question about intent, and guessing at it is how a build starts
+            // reading files nobody meant to publish.
+            errors.push({
+                path: entry.path,
+                message: path.error.issues[0]?.message ?? 'Invalid applet file path'
+            });
+            continue;
+        }
+        const mediaType = mediaTypeFor(entry.path);
+        if (!mediaType) {
+            errors.push({
+                path: entry.path,
+                message: `Unsupported file type. An applet may contain: ${Object.keys(MEDIA_TYPES).join(', ')}`
+            });
+            continue;
+        }
+        // BYTES, not characters. A file of emoji is longer than its length, and a
+        // PNG has no text length at all. Binary companions arrive base64 from the
+        // reader and stay out of `sources`: nothing compiles an image.
+        const bytes = entry.encoding === 'base64' ? base64ToBytes(entry.contents) : new TextEncoder().encode(entry.contents);
+        if (!isBinaryMediaType(mediaType))
+            sources[entry.path] = entry.contents;
+        files.push({
+            path: entry.path,
+            mediaType,
+            digest: await input.digest(bytes),
+            size: bytes.length
+        });
+    }
+    const entry = input.entry ?? 'Applet.svelte';
+    if (!(entry in sources)) {
+        errors.push({ path: entry, message: `Entry "${entry}" is not present in the project` });
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return {
+        ok: true,
+        project: {
+            id: input.id,
+            entry,
+            sources,
+            // CODEPOINT order, not `localeCompare`. Locale ordering is by definition
+            // machine-dependent — it sorts `a.ts` before `Applet.svelte` under most
+            // locales and the other way under a byte comparison — so using it to
+            // make a manifest "stable across machines" achieves the opposite.
+            files: files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0)),
+            storage,
+            actions
+        }
+    };
+}
+/** Every problem with an actions declaration, in the shape every other project error has. */
+function readActionsDeclaration(contents) {
+    let declared;
+    try {
+        declared = JSON.parse(contents);
+    }
+    catch (cause) {
+        if (!(cause instanceof SyntaxError))
+            throw cause;
+        return {
+            ok: false,
+            errors: [{ path: APPLET_ACTIONS_FILENAME, message: `Not valid JSON: ${cause.message}`, cause }]
+        };
+    }
+    const parsed = appletActionsDeclarationSchema.safeParse(declared);
+    if (parsed.success)
+        return { ok: true, actions: parsed.data ?? [] };
+    return {
+        ok: false,
+        errors: parsed.error.issues.map((issue) => ({
+            path: [APPLET_ACTIONS_FILENAME, ...issue.path].join('.'),
+            message: issue.message
+        }))
+    };
+}
+/** Every problem with a storage declaration, in the shape every other project error has. */
+function readStorageDeclaration(contents) {
+    let declared;
+    try {
+        declared = JSON.parse(contents);
+    }
+    catch (cause) {
+        // Malformed JSON is an authoring error to report with the rest, like an
+        // unsupported file type. Anything else is not this file's problem.
+        if (!(cause instanceof SyntaxError))
+            throw cause;
+        return {
+            ok: false,
+            errors: [{ path: APPLET_STORAGE_FILENAME, message: `Not valid JSON: ${cause.message}`, cause }]
+        };
+    }
+    const parsed = appletStorageDeclarationSchema.safeParse(declared);
+    if (parsed.success)
+        return { ok: true, storage: parsed.data };
+    return {
+        ok: false,
+        errors: parsed.error.issues.map((issue) => ({
+            path: [APPLET_STORAGE_FILENAME, ...issue.path].join('.'),
+            message: issue.message
+        }))
+    };
+}
+/**
+ * The definition manifest a local project publishes as: its inventory and its
+ * declared stores, seeded the way `vibes applet build` always seeded it.
+ *
+ * One producer, so `build` (which prints the manifest hash an author pins) and
+ * `serve` (which binds the stores an applet may reach) cannot describe two
+ * different applets.
+ */
+export function buildAppletLocalDefinitionManifest(project) {
+    // A local declaration a v2 host would publish but not enforce moves the
+    // project to v3: server actions and write conditions exist only there.
+    const schemaVersion = project.actions.length > 0 || project.storage.some((store) => store.writeConditions !== undefined) ? 3 : 2;
+    return buildAppletDefinitionManifest({
+        seed: {
+            schemaVersion,
+            entrypoint: { kind: 'svelte', path: project.entry },
+            storage: project.storage,
+            capabilities: [],
+            serverActions: project.actions
+        },
+        files: project.files
+    });
+}
+//# sourceMappingURL=local-project.js.map

package/dist/local-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-project.js","sourceRoot":"","sources":["../src/local-project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,8BAA8B,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnG,OAAO,EAAE,6BAA6B,EAAoC,MAAM,uBAAuB,CAAC;AAExG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,qBAAqB,UAAU,CAAC;AAEtE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,qFAAqF;AACrF,MAAM,8BAA8B,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC;AACpF,2FAA2F;AAC3F,MAAM,8BAA8B,GAAG,8BAA8B,CAAC,KAAK,CAAC,aAAa,CAAC;AA4B1F,oFAAoF;AACpF,MAAM,WAAW,GAAG;IACnB,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,iBAAiB;IACzB,KAAK,EAAE,iBAAiB;IACxB,OAAO,EAAE,kBAAkB;IAC3B,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,WAAW;IACpB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,cAAc;CACoB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;AAE3G,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAClD,OAAO,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAEtF,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,+EAA+E;IAC/E,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAA+B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnG,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,4BAA4B,EAAE,uCAAuC,CAAC,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IAGA,MAAM,MAAM,GAA8B,EAAE,CAAC;IAE7C,MAAM,EAAE,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,mBAAmB,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,IAAI,OAAO,GAAiC,EAAE,CAAC;IAC/C,IAAI,OAAO,GAAyB,EAAE,CAAC;IAEvC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAAE,SAAS;QAC/D,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B;YAAE,SAAS;QACxD,4EAA4E;QAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;;gBACvC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrC,SAAS;QACV,CAAC;QACD,yDAAyD;QACzD,kDAAkD;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,QAAQ,CAAC,EAAE;gBAAE,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;;gBACvC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrC,SAAS;QACV,CAAC;QAED,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,sEAAsE;YACtE,kEAAkE;YAClE,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,0BAA0B;aACpE,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,iDAAiD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC/F,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QAED,0EAA0E;QAC1E,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,KAAK,GACV,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QACxE,KAAK,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS;YACT,MAAM,EAAE,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,KAAK,CAAC,MAAM;SAClB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,eAAe,CAAC;IAC7C,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,KAAK,iCAAiC,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO;QACN,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACR,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK;YACL,OAAO;YACP,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,kEAAkE;YAClE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClG,OAAO;YACP,OAAO;SACP;KACD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,sBAAsB,CAC9B,QAAgB;IAEhB,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC;SAC/F,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IACpE,OAAO;QACN,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,uBAAuB,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxD,OAAO,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC,CAAC;KACH,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,sBAAsB,CAC9B,QAAgB;IAEhB,IAAI,QAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,wEAAwE;QACxE,mEAAmE;QACnE,IAAI,CAAC,CAAC,KAAK,YAAY,WAAW,CAAC;YAAE,MAAM,KAAK,CAAC;QACjD,OAAO;YACN,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC;SAC/F,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9D,OAAO;QACN,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,EAAE,CAAC,uBAAuB,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACxD,OAAO,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC,CAAC;KACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kCAAkC,CAAC,OAA2B;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,aAAa,GAClB,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5G,OAAO,6BAA6B,CAAC;QACpC,IAAI,EAAE;YACL,aAAa;YACb,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE;YACnD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,EAAE;YAChB,aAAa,EAAE,OAAO,CAAC,OAAO;SAC9B;QACD,KAAK,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/manifest-hash.d.ts

@@ -0,0 +1,12 @@
+import type { AppletDefinitionManifest } from './schemas/definition.ts';
+/** `sha256:<hex>` over the canonical form. */
+export declare function computeAppletManifestHash(manifest: AppletDefinitionManifest): Promise<string>;
+/**
+ * Does this manifest match what a release ref pinned?
+ *
+ * `false` when the ref pins nothing — deliberately. An unpinned manifest is
+ * unauthenticated, and treating "nothing to check" as "checks out" is how a
+ * commitment becomes decoration.
+ */
+export declare function appletManifestMatchesPin(manifest: AppletDefinitionManifest, pinnedManifestHash: string | null | undefined): Promise<boolean>;
+//# sourceMappingURL=manifest-hash.d.ts.map

package/dist/manifest-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-hash.d.ts","sourceRoot":"","sources":["../src/manifest-hash.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AA6DxE,8CAA8C;AAC9C,wBAAsB,yBAAyB,CAC9C,QAAQ,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC7C,QAAQ,EAAE,wBAAwB,EAClC,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC3C,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/manifest-hash.js

@@ -0,0 +1,76 @@
+function isNumber(val) {
+    return typeof val === 'number';
+}
+function isObject(val) {
+    return typeof val === 'object' && val !== null;
+}
+function canonical(value) {
+    // `undefined` gets its own token rather than falling through to `null`.
+    //
+    // `JSON.stringify(undefined)` is `undefined`, and a `?? 'null'` fallback made
+    // `[undefined]` and `[null]` hash identically — two different documents with
+    // one commitment. Unreachable from a manifest read out of storage, because
+    // JSON has no `undefined`, and this function is exported and callable on
+    // in-memory manifests where it is very reachable.
+    //
+    // In OBJECTS undefined is filtered out below, because an absent key and a key
+    // set to undefined are the same document. In ARRAYS they are not: a hole is a
+    // position.
+    if (value === undefined)
+        return '\u0000undefined';
+    if (value === null)
+        return 'null';
+    // TOTAL over the primitives, not just the ones JSON survives.
+    //
+    // Fixing `undefined` alone patched an instance of the bug rather than the
+    // class: `JSON.stringify` returns the STRING "null" for NaN and both
+    // Infinities, and `undefined` for functions and symbols — so each of those
+    // collided with a real `null`. And a Date, Map, or Set is `typeof 'object'`
+    // with no own enumerable keys, so every one of them encoded as `{}`.
+    //
+    // None reach here from a manifest read out of storage, which is JSON. All of
+    // them reach here through the exported function, which is the same
+    // reachability argument that justified fixing `undefined`.
+    if (isNumber(value)) {
+        return Number.isFinite(value) ? JSON.stringify(Object.is(value, -0) ? '-0' : value) : `\u0000num:${String(value)}`;
+    }
+    if (!isObject(value)) {
+        const encoded = JSON.stringify(value);
+        return encoded ?? `\u0000${String(value)}`;
+    }
+    if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+        // A Date/Map/Set is not a manifest node. Refusing to encode it beats
+        // encoding every one of them as the same empty object.
+        throw new TypeError(`Applet manifests contain only JSON values; received ${Object.prototype.toString.call(value)}`);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    const entries = Object.entries(value)
+        // `undefined` is absent, not a value: a manifest that omits `manifestHash`
+        // and one that sets it undefined are the same document.
+        .filter(([, item]) => item !== undefined)
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
+    return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
+}
+/** `sha256:<hex>` over the canonical form. */
+export async function computeAppletManifestHash(manifest) {
+    const bytes = new TextEncoder().encode(canonical(manifest));
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
+    const hex = Array.from(new Uint8Array(digest))
+        .map((byte) => byte.toString(16).padStart(2, '0'))
+        .join('');
+    return `sha256:${hex}`;
+}
+/**
+ * Does this manifest match what a release ref pinned?
+ *
+ * `false` when the ref pins nothing — deliberately. An unpinned manifest is
+ * unauthenticated, and treating "nothing to check" as "checks out" is how a
+ * commitment becomes decoration.
+ */
+export async function appletManifestMatchesPin(manifest, pinnedManifestHash) {
+    if (!pinnedManifestHash)
+        return false;
+    return (await computeAppletManifestHash(manifest)) === pinnedManifestHash;
+}
+//# sourceMappingURL=manifest-hash.js.map