@vibesdotdev/applets 0.0.0-stage → 1.0.0-rc.2

package/dist/schemas/grants.js

@@ -0,0 +1,64 @@
+/**
+ * Access and capability grants — who may open an applet, and what exact
+ * operations/resources they approved for one exact release.
+ *
+ * Authority separation:
+ * - AccessGrant: identity-based (who may open)
+ * - CapabilityGrant: operation-based (what the applet may do)
+ * - LaunchLease: time-bound authority for one run/frame generation
+ *
+ * Grants are version-bound — they pin to the exact Component release that
+ * was consented to. Upgrading the instance requires re-consent.
+ */
+import * as z from 'zod/v4';
+import { componentReleaseRefSchema } from "./component-release-ref.js";
+export const appletAccessGrantSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    /** Grantee identity — server-derived, never client-supplied. */
+    viewerUserId: z.string().nullable(),
+    viewerOrgId: z.string().nullable(),
+    /** Scope of access. */
+    scope: z.enum(['open', 'edit', 'admin']).default('open'),
+    grantReason: z.string().nullable(),
+    createdAt: z.date(),
+    revokedAt: z.date().nullable()
+});
+export const appletCapabilityGrantSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    /** Exact release the user consented to. */
+    release: componentReleaseRefSchema,
+    /** Capability tags approved by the user. */
+    capabilities: z.array(z.string()).min(0),
+    /** User-supplied reason text for each capability (from consent UI). */
+    capabilityReasons: z.record(z.string(), z.string()).default({}),
+    /** Viewer identity at consent time. */
+    viewerUserId: z.string().nullable(),
+    viewerOrgId: z.string().nullable(),
+    consentedAt: z.date(),
+    revokedAt: z.date().nullable()
+});
+export const appletLaunchLeaseSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    runId: z.uuid(),
+    /** Short-lived authority for one run/frame generation. */
+    /**
+     * Opaque value stored with the lease.
+     *
+     * NOT a launch secret. It is generated at lease creation and compared to
+     * nothing, anywhere — the runner's mount handshake carries its own unrelated
+     * per-message nonce. Authorization binds a dispatch through `runId`, the
+     * lease's expiry, and its revocation, none of which involve this field.
+     *
+     * Left in place because it is pre-existing storage, but do not add a check
+     * that reads it as proof of anything without first making the runtime
+     * actually present it.
+     */
+    nonce: z.string().min(1),
+    issuedAt: z.date(),
+    expiresAt: z.date(),
+    revokedAt: z.date().nullable()
+});
+//# sourceMappingURL=grants.js.map

package/dist/schemas/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/schemas/grants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,gEAAgE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,uBAAuB;IACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,2CAA2C;IAC3C,OAAO,EAAE,yBAAyB;IAClC,4CAA4C;IAC5C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,uEAAuE;IACvE,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,uCAAuC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;IACf,0DAA0D;IAC1D;;;;;;;;;;;OAWG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC"}

package/dist/schemas/index.d.ts

@@ -0,0 +1,16 @@
+export * from './component-release-ref.ts';
+export * from './template-revision.ts';
+export * from './instance.ts';
+export * from './run.ts';
+export * from './grants.ts';
+export * from './state-events.ts';
+export * from './lineage.ts';
+export * from './capabilities.ts';
+export * from './contributes.ts';
+export * from './definition.ts';
+export * from './observation.ts';
+export * from './share-link.ts';
+export * from './subscription.ts';
+export * from './publishing.ts';
+export * from './dispatch.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,16 @@
+export * from "./component-release-ref.js";
+export * from "./template-revision.js";
+export * from "./instance.js";
+export * from "./run.js";
+export * from "./grants.js";
+export * from "./state-events.js";
+export * from "./lineage.js";
+export * from "./capabilities.js";
+export * from "./contributes.js";
+export * from "./definition.js";
+export * from "./observation.js";
+export * from "./share-link.js";
+export * from "./subscription.js";
+export * from "./publishing.js";
+export * from "./dispatch.js";
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC"}

package/dist/schemas/instance.d.ts

@@ -0,0 +1,230 @@
+/**
+ * AppletInstance — stable owner-scoped installation pinned to exact release
+ * and digests. The central record that grants, leases, state, and events
+ * reference.
+ */
+import * as z from 'zod/v4';
+export declare const appletInstanceStatusSchema: z.ZodEnum<{
+    active: "active";
+    pending: "pending";
+    archived: "archived";
+    restricted: "restricted";
+    revoked: "revoked";
+    expired: "expired";
+}>;
+export declare const appletInstanceSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    release: z.ZodObject<{
+        componentId: z.ZodUUID;
+        version: z.ZodString;
+        bundleHash: z.ZodString;
+        manifestHash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    templateRevisionId: z.ZodNullable<z.ZodUUID>;
+    title: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    ownerType: z.ZodEnum<{
+        user: "user";
+        organization: "organization";
+        system: "system";
+    }>;
+    ownerId: z.ZodString;
+    visibility: z.ZodDefault<z.ZodEnum<{
+        public: "public";
+        private: "private";
+        org: "org";
+    }>>;
+    status: z.ZodDefault<z.ZodEnum<{
+        active: "active";
+        pending: "pending";
+        archived: "archived";
+        restricted: "restricted";
+        revoked: "revoked";
+        expired: "expired";
+    }>>;
+    definitionManifest: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        schemaVersion: z.ZodUnion<readonly [z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>]>;
+        entrypoint: z.ZodObject<{
+            kind: z.ZodEnum<{
+                html: "html";
+                svelte: "svelte";
+            }>;
+            path: z.ZodString;
+        }, z.core.$strip>;
+        files: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            mediaType: z.ZodString;
+            digest: z.ZodString;
+            size: z.ZodNumber;
+        }, z.core.$strip>>;
+        storage: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            authority: z.ZodDefault<z.ZodEnum<{
+                "applet-owned": "applet-owned";
+                "author-owned": "author-owned";
+                "viewer-owned": "viewer-owned";
+            }>>;
+            scope: z.ZodDefault<z.ZodEnum<{
+                instance: "instance";
+                viewer: "viewer";
+            }>>;
+            schemaVersion: z.ZodNumber;
+            recordSchema: z.ZodPipe<z.ZodCustom<import("@vibesdotdev/shared/types").RecordObject, import("@vibesdotdev/shared/types").RecordObject>, z.ZodTransform<import("@vibesdotdev/shared/types").JsonObject, import("@vibesdotdev/shared/types").RecordObject>>;
+            quotaBytes: z.ZodOptional<z.ZodNumber>;
+            writeConditions: z.ZodOptional<z.ZodPipe<z.ZodCustom<import("@vibesdotdev/shared/types").RecordObject, import("@vibesdotdev/shared/types").RecordObject>, z.ZodTransform<import("@vibesdotdev/shared/types").JsonObject, import("@vibesdotdev/shared/types").RecordObject>>>;
+        }, z.core.$strip>>>;
+        assets: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            assetId: z.ZodString;
+            revision: z.ZodString;
+            digest: z.ZodString;
+            mountPath: z.ZodString;
+        }, z.core.$strip>>>;
+        composition: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            mode: z.ZodEnum<{
+                extends: "extends";
+                renders: "renders";
+            }>;
+            release: z.ZodObject<{
+                componentId: z.ZodUUID;
+                version: z.ZodString;
+                bundleHash: z.ZodString;
+                manifestHash: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            slot: z.ZodString;
+            props: z.ZodDefault<z.ZodPipe<z.ZodCustom<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>, z.ZodTransform<string | number | boolean | import("@vibesdotdev/kernel/schemas/json").JsonObject | import("@vibesdotdev/kernel/schemas/json").JsonArray | null, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+        }, z.core.$strip>>>;
+        capabilities: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            tag: z.ZodString;
+            reason: z.ZodString;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>>;
+        contributes: z.ZodOptional<z.ZodObject<{
+            config: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                description: z.ZodString;
+                valueSchema: z.ZodPipe<z.ZodCustom<import("@vibesdotdev/shared/types").RecordObject, import("@vibesdotdev/shared/types").RecordObject>, z.ZodTransform<import("@vibesdotdev/shared/types").JsonObject, import("@vibesdotdev/shared/types").RecordObject>>;
+                default: z.ZodOptional<z.ZodPipe<z.ZodCustom<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>, z.ZodTransform<string | number | boolean | import("@vibesdotdev/kernel/schemas/json").JsonObject | import("@vibesdotdev/kernel/schemas/json").JsonArray | null, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+                secret: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                description: z.ZodString;
+                inputSchema: z.ZodPipe<z.ZodCustom<import("@vibesdotdev/shared/types").RecordObject, import("@vibesdotdev/shared/types").RecordObject>, z.ZodTransform<import("@vibesdotdev/shared/types").JsonObject, import("@vibesdotdev/shared/types").RecordObject>>;
+                outputSchema: z.ZodOptional<z.ZodPipe<z.ZodCustom<import("@vibesdotdev/shared/types").RecordObject, import("@vibesdotdev/shared/types").RecordObject>, z.ZodTransform<import("@vibesdotdev/shared/types").JsonObject, import("@vibesdotdev/shared/types").RecordObject>>>;
+                impl: z.ZodObject<{
+                    surface: z.ZodEnum<{
+                        server: "server";
+                        client: "client";
+                    }>;
+                    entry: z.ZodString;
+                    export: z.ZodString;
+                }, z.core.$strict>;
+                requires: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                    "storage.read": "storage.read";
+                    "storage.write": "storage.write";
+                    "network.fetch": "network.fetch";
+                    "clipboard.read": "clipboard.read";
+                    "clipboard.write": "clipboard.write";
+                    "geolocation.read": "geolocation.read";
+                    "notification.send": "notification.send";
+                    "workboard.create": "workboard.create";
+                    "workboard.update": "workboard.update";
+                    "applet.snapshot.create": "applet.snapshot.create";
+                    "applet.snapshot.update": "applet.snapshot.update";
+                    "output.create": "output.create";
+                    "output.update": "output.update";
+                }>>>;
+            }, z.core.$strict>>>;
+            cli: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                command: z.ZodString;
+                description: z.ZodString;
+                arguments: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    name: z.ZodString;
+                    description: z.ZodString;
+                    required: z.ZodDefault<z.ZodBoolean>;
+                    variadic: z.ZodDefault<z.ZodBoolean>;
+                }, z.core.$strict>>>;
+                options: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    flags: z.ZodString;
+                    description: z.ZodString;
+                    type: z.ZodDefault<z.ZodEnum<{
+                        string: "string";
+                        number: "number";
+                        boolean: "boolean";
+                    }>>;
+                    choices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                }, z.core.$strict>>>;
+                impl: z.ZodObject<{
+                    surface: z.ZodEnum<{
+                        server: "server";
+                        client: "client";
+                    }>;
+                    entry: z.ZodString;
+                    export: z.ZodString;
+                }, z.core.$strict>;
+                requires: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                    "storage.read": "storage.read";
+                    "storage.write": "storage.write";
+                    "network.fetch": "network.fetch";
+                    "clipboard.read": "clipboard.read";
+                    "clipboard.write": "clipboard.write";
+                    "geolocation.read": "geolocation.read";
+                    "notification.send": "notification.send";
+                    "workboard.create": "workboard.create";
+                    "workboard.update": "workboard.update";
+                    "applet.snapshot.create": "applet.snapshot.create";
+                    "applet.snapshot.update": "applet.snapshot.update";
+                    "output.create": "output.create";
+                    "output.update": "output.update";
+                }>>>;
+            }, z.core.$strict>>>;
+            events: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                event: z.ZodString;
+                description: z.ZodString;
+                impl: z.ZodObject<{
+                    surface: z.ZodEnum<{
+                        server: "server";
+                        client: "client";
+                    }>;
+                    entry: z.ZodString;
+                    export: z.ZodString;
+                }, z.core.$strict>;
+                requires: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                    "storage.read": "storage.read";
+                    "storage.write": "storage.write";
+                    "network.fetch": "network.fetch";
+                    "clipboard.read": "clipboard.read";
+                    "clipboard.write": "clipboard.write";
+                    "geolocation.read": "geolocation.read";
+                    "notification.send": "notification.send";
+                    "workboard.create": "workboard.create";
+                    "workboard.update": "workboard.update";
+                    "applet.snapshot.create": "applet.snapshot.create";
+                    "applet.snapshot.update": "applet.snapshot.update";
+                    "output.create": "output.create";
+                    "output.update": "output.update";
+                }>>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        serverActions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            principal: z.ZodEnum<{
+                author: "author";
+                viewer: "viewer";
+            }>;
+            handler: z.ZodObject<{
+                entry: z.ZodString;
+                export: z.ZodString;
+                surface: z.ZodLiteral<"server">;
+            }, z.core.$strict>;
+            policy: z.ZodDefault<z.ZodPipe<z.ZodCustom<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>, z.ZodTransform<string | number | boolean | import("@vibesdotdev/kernel/schemas/json").JsonObject | import("@vibesdotdev/kernel/schemas/json").JsonArray | null, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strip>>>;
+    stateRevision: z.ZodDefault<z.ZodNumber>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>;
+export type AppletInstance = z.infer<typeof appletInstanceSchema>;
+export type AppletInstanceStatus = z.infer<typeof appletInstanceStatusSchema>;
+//# sourceMappingURL=instance.d.ts.map

package/dist/schemas/instance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/schemas/instance.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,eAAO,MAAM,0BAA0B;;;;;;;EAOrC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0B/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/instance.js

@@ -0,0 +1,44 @@
+/**
+ * AppletInstance — stable owner-scoped installation pinned to exact release
+ * and digests. The central record that grants, leases, state, and events
+ * reference.
+ */
+import * as z from 'zod/v4';
+import { componentReleaseRefSchema } from "./component-release-ref.js";
+import { appletDefinitionManifestSchema } from "./definition.js";
+export const appletInstanceStatusSchema = z.enum([
+    'pending',
+    'active',
+    'restricted',
+    'revoked',
+    'expired',
+    'archived'
+]);
+export const appletInstanceSchema = z.object({
+    id: z.uuid(),
+    /** Exact release this instance is pinned to. */
+    release: componentReleaseRefSchema,
+    /** Template revision this instance was created from, if any. */
+    templateRevisionId: z.uuid().nullable(),
+    title: z.string().min(1).max(200),
+    description: z.string().nullable(),
+    ownerType: z.enum(['user', 'organization', 'system']),
+    ownerId: z.string(),
+    visibility: z.enum(['private', 'org', 'public']).default('private'),
+    status: appletInstanceStatusSchema.default('pending'),
+    /**
+     * The Applet definition manifest this instance runs under.
+     *
+     * Nullable because instances predate it. Without a stored manifest the host
+     * cannot know what a release declares — which storage it owns, which
+     * capabilities it requests, or what it contributes — so contribution
+     * registration and consent have nothing to read. `manifest_hash` alone
+     * identifies a manifest without containing one.
+     */
+    definitionManifest: appletDefinitionManifestSchema.nullable().optional(),
+    /** Current shared state revision (optimistic concurrency). */
+    stateRevision: z.number().int().nonnegative().default(0),
+    createdAt: z.date(),
+    updatedAt: z.date()
+});
+//# sourceMappingURL=instance.js.map

package/dist/schemas/instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/schemas/instance.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AAEjE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,SAAS;IACT,UAAU;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,gDAAgD;IAChD,OAAO,EAAE,yBAAyB;IAClC,gEAAgE;IAChE,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACnE,MAAM,EAAE,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC;IACrD;;;;;;;;OAQG;IACH,kBAAkB,EAAE,8BAA8B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxE,8DAA8D;IAC9D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC"}

package/dist/schemas/lineage.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Lineage edges and projection receipts.
+ *
+ * Lineage records the provenance of each applet: instantiate, duplicate,
+ * remix, copy/import, migrate, or adopt. Each edge is immutable.
+ *
+ * Projection receipts track idempotent delivery of selected events to
+ * Workboard, Outputs, or notifications. Applet state remains canonical;
+ * projections are derived.
+ */
+import * as z from 'zod/v4';
+export declare const appletLineageEdgeTypeSchema: z.ZodEnum<{
+    duplicate: "duplicate";
+    migrate: "migrate";
+    instantiate: "instantiate";
+    remix: "remix";
+    copy_import: "copy_import";
+    adopt: "adopt";
+}>;
+export declare const appletLineageEdgeSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    targetInstanceId: z.ZodUUID;
+    sourceInstanceId: z.ZodNullable<z.ZodUUID>;
+    sourceReleaseId: z.ZodNullable<z.ZodUUID>;
+    edgeType: z.ZodEnum<{
+        duplicate: "duplicate";
+        migrate: "migrate";
+        instantiate: "instantiate";
+        remix: "remix";
+        copy_import: "copy_import";
+        adopt: "adopt";
+    }>;
+    sourceCheckpointId: z.ZodNullable<z.ZodUUID>;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export declare const appletProjectionTargetSchema: z.ZodEnum<{
+    output: "output";
+    notification: "notification";
+    workboard: "workboard";
+    applet_snapshot: "applet_snapshot";
+}>;
+export declare const appletProjectionReceiptSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    eventId: z.ZodUUID;
+    target: z.ZodEnum<{
+        output: "output";
+        notification: "notification";
+        workboard: "workboard";
+        applet_snapshot: "applet_snapshot";
+    }>;
+    targetReceiptId: z.ZodString;
+    delivered: z.ZodBoolean;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export type AppletLineageEdgeType = z.infer<typeof appletLineageEdgeTypeSchema>;
+export type AppletLineageEdge = z.infer<typeof appletLineageEdgeSchema>;
+export type AppletProjectionTarget = z.infer<typeof appletProjectionTargetSchema>;
+export type AppletProjectionReceipt = z.infer<typeof appletProjectionReceiptSchema>;
+//# sourceMappingURL=lineage.d.ts.map

package/dist/schemas/lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.d.ts","sourceRoot":"","sources":["../../src/schemas/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,2BAA2B;;;;;;;EAOtC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;iBAWlC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;EAMvC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;iBAYxC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/schemas/lineage.js

@@ -0,0 +1,52 @@
+/**
+ * Lineage edges and projection receipts.
+ *
+ * Lineage records the provenance of each applet: instantiate, duplicate,
+ * remix, copy/import, migrate, or adopt. Each edge is immutable.
+ *
+ * Projection receipts track idempotent delivery of selected events to
+ * Workboard, Outputs, or notifications. Applet state remains canonical;
+ * projections are derived.
+ */
+import * as z from 'zod/v4';
+export const appletLineageEdgeTypeSchema = z.enum([
+    'instantiate',
+    'duplicate',
+    'remix',
+    'copy_import',
+    'migrate',
+    'adopt'
+]);
+export const appletLineageEdgeSchema = z.object({
+    id: z.uuid(),
+    /** The instance this edge points TO (the new instance). */
+    targetInstanceId: z.uuid(),
+    /** The instance or release this edge points FROM (the source). */
+    sourceInstanceId: z.uuid().nullable(),
+    sourceReleaseId: z.uuid().nullable(),
+    edgeType: appletLineageEdgeTypeSchema,
+    /** Checkpoint used as the duplication source, if any. */
+    sourceCheckpointId: z.uuid().nullable(),
+    createdAt: z.date()
+});
+export const appletProjectionTargetSchema = z.enum([
+    'workboard',
+    'applet_snapshot',
+    /** @deprecated Persistence compatibility only; use applet_snapshot. */
+    'output',
+    'notification'
+]);
+export const appletProjectionReceiptSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    /** The event being projected. */
+    eventId: z.uuid(),
+    /** Where the event was projected to. */
+    target: appletProjectionTargetSchema,
+    /** Idempotency key — the target's receipt id. */
+    targetReceiptId: z.string().min(1),
+    /** Whether the projection was delivered or was a duplicate. */
+    delivered: z.boolean(),
+    createdAt: z.date()
+});
+//# sourceMappingURL=lineage.js.map

package/dist/schemas/lineage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.js","sourceRoot":"","sources":["../../src/schemas/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,aAAa;IACb,WAAW;IACX,OAAO;IACP,aAAa;IACb,SAAS;IACT,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE;IAC1B,kEAAkE;IAClE,gBAAgB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACrC,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,2BAA2B;IACrC,yDAAyD;IACzD,kBAAkB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IAClD,WAAW;IACX,iBAAiB;IACjB,uEAAuE;IACvE,QAAQ;IACR,cAAc;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,iCAAiC;IACjC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,wCAAwC;IACxC,MAAM,EAAE,4BAA4B;IACpC,iDAAiD;IACjD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,+DAA+D;IAC/D,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC"}

package/dist/schemas/observation.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Observation ledger — what a subscribed Applet actually did.
+ *
+ * The receipts half of "trusted, with receipts". Cloudflare OS gates every write
+ * behind human approval; we record instead, and gate only at real tenancy
+ * boundaries. That trade is only honest if the recording is real and cheap, so
+ * an observation is appended on every AUTHORIZED-or-DENIED capability dispatch —
+ * successes and refusals alike (see SCOPE below).
+ *
+ * A refusal is the more interesting row. "Nothing happened" and "something was
+ * stopped" look identical in a system that only logs successes, and the second
+ * is what tells you an applet is probing.
+ *
+ * SCOPE, stated precisely because "every dispatch" was too strong: an
+ * observation is recorded once a dispatch has been AUTHORIZED or DENIED — that
+ * is, once there is a subscription and grant to attribute it to. Failures before
+ * that point (a malformed correlation id, non-cloneable arguments, a missing
+ * lease) throw without a row, because there is no authority context to record
+ * against and inventing one would put fiction in the ledger. A host-side timeout
+ * likewise records nothing today; that is a genuine gap, not a design choice.
+ */
+import * as z from 'zod/v4';
+import { componentReleaseRefSchema } from './component-release-ref.ts';
+export declare const appletObservationOutcomeSchema: z.ZodEnum<{
+    denied: "denied";
+    failed: "failed";
+    allowed: "allowed";
+}>;
+export declare const appletObservationSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    subscriptionId: z.ZodNullable<z.ZodUUID>;
+    capabilityGrantId: z.ZodNullable<z.ZodUUID>;
+    release: z.ZodObject<{
+        componentId: z.ZodUUID;
+        version: z.ZodString;
+        bundleHash: z.ZodString;
+        manifestHash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    registrationId: z.ZodNullable<z.ZodString>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    outcome: z.ZodEnum<{
+        denied: "denied";
+        failed: "failed";
+        allowed: "allowed";
+    }>;
+    reason: z.ZodNullable<z.ZodString>;
+    viewerUserId: z.ZodNullable<z.ZodString>;
+    viewerOrgId: z.ZodNullable<z.ZodString>;
+    occurredAt: z.ZodDate;
+}, z.core.$strip>;
+export type AppletObservationOutcome = z.infer<typeof appletObservationOutcomeSchema>;
+export type AppletObservation = z.infer<typeof appletObservationSchema>;
+/** What the dispatch boundary records. The host supplies identity and time. */
+export interface AppletObservationInput {
+    instanceId: string;
+    subscriptionId: string | null;
+    capabilityGrantId: string | null;
+    release: z.infer<typeof componentReleaseRefSchema>;
+    registrationId: string | null;
+    capabilities: readonly string[];
+    outcome: AppletObservationOutcome;
+    reason: string | null;
+}
+/**
+ * Appends an observation. Deliberately returns void and is never awaited for its
+ * value: a ledger that can fail a dispatch is a ledger someone will disable.
+ */
+export type AppletObservationRecorder = (observation: AppletObservationInput) => void;
+//# sourceMappingURL=observation.d.ts.map

package/dist/schemas/observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observation.d.ts","sourceRoot":"","sources":["../../src/schemas/observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,eAAO,MAAM,8BAA8B;;;;EAA0C,CAAC;AAEtF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;iBAuBlC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,OAAO,EAAE,wBAAwB,CAAC;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,WAAW,EAAE,sBAAsB,KAAK,IAAI,CAAC"}

package/dist/schemas/observation.js

@@ -0,0 +1,49 @@
+/**
+ * Observation ledger — what a subscribed Applet actually did.
+ *
+ * The receipts half of "trusted, with receipts". Cloudflare OS gates every write
+ * behind human approval; we record instead, and gate only at real tenancy
+ * boundaries. That trade is only honest if the recording is real and cheap, so
+ * an observation is appended on every AUTHORIZED-or-DENIED capability dispatch —
+ * successes and refusals alike (see SCOPE below).
+ *
+ * A refusal is the more interesting row. "Nothing happened" and "something was
+ * stopped" look identical in a system that only logs successes, and the second
+ * is what tells you an applet is probing.
+ *
+ * SCOPE, stated precisely because "every dispatch" was too strong: an
+ * observation is recorded once a dispatch has been AUTHORIZED or DENIED — that
+ * is, once there is a subscription and grant to attribute it to. Failures before
+ * that point (a malformed correlation id, non-cloneable arguments, a missing
+ * lease) throw without a row, because there is no authority context to record
+ * against and inventing one would put fiction in the ledger. A host-side timeout
+ * likewise records nothing today; that is a genuine gap, not a design choice.
+ */
+import * as z from 'zod/v4';
+import { componentReleaseRefSchema } from "./component-release-ref.js";
+export const appletObservationOutcomeSchema = z.enum(['allowed', 'denied', 'failed']);
+export const appletObservationSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    /** The subscription this ran under, when the call came through one. */
+    subscriptionId: z.uuid().nullable(),
+    /** The grant that authority was checked against. */
+    capabilityGrantId: z.uuid().nullable(),
+    release: componentReleaseRefSchema,
+    /** Host-assigned registration id, e.g. `applet.notes.tool.summarize`. */
+    registrationId: z.string().min(1).max(200).nullable(),
+    /** Capability tags the call required. Empty for a contribution needing none. */
+    capabilities: z.array(z.string().min(1).max(128)).max(16).default([]),
+    outcome: appletObservationOutcomeSchema,
+    /**
+     * Why, for a denial. A stable machine reason from
+     * `AppletAuthorizationDenial` — never applet-supplied text, which would put
+     * attacker-chosen strings into an operator's ledger.
+     */
+    reason: z.string().min(1).max(120).nullable(),
+    /** Server-derived viewer identity at call time. */
+    viewerUserId: z.string().nullable(),
+    viewerOrgId: z.string().nullable(),
+    occurredAt: z.date()
+});
+//# sourceMappingURL=observation.js.map

package/dist/schemas/observation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observation.js","sourceRoot":"","sources":["../../src/schemas/observation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,uEAAuE;IACvE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACnC,oDAAoD;IACpD,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,yBAAyB;IAClC,yEAAyE;IACzE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,gFAAgF;IAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrE,OAAO,EAAE,8BAA8B;IACvC;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC7C,mDAAmD;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;CACpB,CAAC,CAAC"}