@vibesdotdev/applets 0.0.0-stage → 1.0.0-rc.2

package/dist/schemas/patterns.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shared lexical patterns for author-supplied identifiers and paths.
+ *
+ * These lived in two files. `definition.ts` and `contributes.ts` each declared
+ * their own `SAFE_ID` and `SAFE_RELATIVE_PATH`, byte-identical and independent,
+ * which is a drift waiting to happen: tightening one and not the other means the
+ * manifest and the `contributes` block disagree about what an author may name,
+ * and the looser file wins wherever it is checked last.
+ *
+ * They are security-relevant. `SAFE_ID` is what makes contributed CLI commands
+ * and tools namespaceable — an author cannot pick a slug containing a dot or a
+ * slash and collide with a host command. `SAFE_RELATIVE_PATH` is what stops a
+ * manifest naming `../../etc/passwd` as one of its files.
+ */
+/** kebab-case only: no dots, no slashes, no leading or trailing dash. */
+export declare const SAFE_ID: RegExp;
+/**
+ * Relative POSIX path with no traversal and no backslash. Rejects a leading
+ * `/`, any `..` segment, and `\` (which Windows would treat as a separator).
+ */
+export declare const SAFE_RELATIVE_PATH: RegExp;
+/** Capability tags: lowercase, dotted or slashed namespaces permitted. */
+export declare const SAFE_CAPABILITY: RegExp;
+//# sourceMappingURL=patterns.d.ts.map

package/dist/schemas/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../src/schemas/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,yEAAyE;AACzE,eAAO,MAAM,OAAO,QAA+B,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAA+D,CAAC;AAE/F,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAA4B,CAAC"}

package/dist/schemas/patterns.js

@@ -0,0 +1,24 @@
+/**
+ * Shared lexical patterns for author-supplied identifiers and paths.
+ *
+ * These lived in two files. `definition.ts` and `contributes.ts` each declared
+ * their own `SAFE_ID` and `SAFE_RELATIVE_PATH`, byte-identical and independent,
+ * which is a drift waiting to happen: tightening one and not the other means the
+ * manifest and the `contributes` block disagree about what an author may name,
+ * and the looser file wins wherever it is checked last.
+ *
+ * They are security-relevant. `SAFE_ID` is what makes contributed CLI commands
+ * and tools namespaceable — an author cannot pick a slug containing a dot or a
+ * slash and collide with a host command. `SAFE_RELATIVE_PATH` is what stops a
+ * manifest naming `../../etc/passwd` as one of its files.
+ */
+/** kebab-case only: no dots, no slashes, no leading or trailing dash. */
+export const SAFE_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+ * Relative POSIX path with no traversal and no backslash. Rejects a leading
+ * `/`, any `..` segment, and `\` (which Windows would treat as a separator).
+ */
+export const SAFE_RELATIVE_PATH = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))(?!.*\\)[a-zA-Z0-9._/-]+$/;
+/** Capability tags: lowercase, dotted or slashed namespaces permitted. */
+export const SAFE_CAPABILITY = /^[a-z0-9][a-z0-9._/-]*$/;
+//# sourceMappingURL=patterns.js.map

package/dist/schemas/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../../src/schemas/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,4DAA4D,CAAC;AAE/F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,yBAAyB,CAAC"}

package/dist/schemas/publishing.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Applet publication — the shareable identity for an installed applet.
+ *
+ * Publication is deliberately separate from AppletInstance. A private
+ * installation can exist without a discoverable URL, and unpublishing removes
+ * the viewer-facing identity without changing the pinned release or state.
+ */
+import * as z from 'zod/v4';
+export declare const appletSlugSchema: z.ZodString;
+export declare const appletPublicationVisibilitySchema: z.ZodEnum<{
+    public: "public";
+    org: "org";
+}>;
+export declare const appletPublicationSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    slug: z.ZodString;
+    visibility: z.ZodEnum<{
+        public: "public";
+        org: "org";
+    }>;
+    publishedAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>;
+export type AppletPublication = z.infer<typeof appletPublicationSchema>;
+export type AppletPublicationVisibility = z.infer<typeof appletPublicationVisibilitySchema>;
+//# sourceMappingURL=publishing.d.ts.map

package/dist/schemas/publishing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publishing.d.ts","sourceRoot":"","sources":["../../src/schemas/publishing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,gBAAgB,aAAa,CAAC;AAE3C,eAAO,MAAM,iCAAiC;;;EAA4B,CAAC;AAE3E,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAOlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/schemas/publishing.js

@@ -0,0 +1,20 @@
+/**
+ * Applet publication — the shareable identity for an installed applet.
+ *
+ * Publication is deliberately separate from AppletInstance. A private
+ * installation can exist without a discoverable URL, and unpublishing removes
+ * the viewer-facing identity without changing the pinned release or state.
+ */
+import * as z from 'zod/v4';
+import { slugSchema } from '@vibesdotdev/shared/schemas';
+export const appletSlugSchema = slugSchema;
+export const appletPublicationVisibilitySchema = z.enum(['org', 'public']);
+export const appletPublicationSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    slug: appletSlugSchema,
+    visibility: appletPublicationVisibilitySchema,
+    publishedAt: z.date(),
+    updatedAt: z.date()
+});
+//# sourceMappingURL=publishing.js.map

package/dist/schemas/publishing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publishing.js","sourceRoot":"","sources":["../../src/schemas/publishing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE3C,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,IAAI,EAAE,gBAAgB;IACtB,UAAU,EAAE,iCAAiC;IAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC"}

package/dist/schemas/run.d.ts

@@ -0,0 +1,35 @@
+/**
+ * AppletRun — bounded execution only; no presentation custody. A run is
+ * created when a user opens an applet and destroyed when they leave or
+ * revoke. The run holds the launch lease and capability grants in effect.
+ */
+import * as z from 'zod/v4';
+export declare const appletRunStatusSchema: z.ZodEnum<{
+    ready: "ready";
+    pending: "pending";
+    revoked: "revoked";
+    expired: "expired";
+    loading: "loading";
+    crashed: "crashed";
+    unresponsive: "unresponsive";
+}>;
+export declare const appletRunSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    viewerUserId: z.ZodNullable<z.ZodString>;
+    viewerOrgId: z.ZodNullable<z.ZodString>;
+    status: z.ZodDefault<z.ZodEnum<{
+        ready: "ready";
+        pending: "pending";
+        revoked: "revoked";
+        expired: "expired";
+        loading: "loading";
+        crashed: "crashed";
+        unresponsive: "unresponsive";
+    }>>;
+    startedAt: z.ZodDate;
+    endedAt: z.ZodNullable<z.ZodDate>;
+}, z.core.$strip>;
+export type AppletRun = z.infer<typeof appletRunSchema>;
+export type AppletRunStatus = z.infer<typeof appletRunStatusSchema>;
+//# sourceMappingURL=run.d.ts.map

package/dist/schemas/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/schemas/run.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,qBAAqB;;;;;;;;EAQhC,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;iBAS1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/schemas/run.js

@@ -0,0 +1,26 @@
+/**
+ * AppletRun — bounded execution only; no presentation custody. A run is
+ * created when a user opens an applet and destroyed when they leave or
+ * revoke. The run holds the launch lease and capability grants in effect.
+ */
+import * as z from 'zod/v4';
+export const appletRunStatusSchema = z.enum([
+    'pending',
+    'loading',
+    'ready',
+    'crashed',
+    'unresponsive',
+    'revoked',
+    'expired'
+]);
+export const appletRunSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    /** Viewer identity — server-derived, never client-supplied. */
+    viewerUserId: z.string().nullable(),
+    viewerOrgId: z.string().nullable(),
+    status: appletRunStatusSchema.default('pending'),
+    startedAt: z.date(),
+    endedAt: z.date().nullable()
+});
+//# sourceMappingURL=run.js.map

package/dist/schemas/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/schemas/run.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,SAAS;IACT,SAAS;IACT,OAAO;IACP,SAAS;IACT,cAAc;IACd,SAAS;IACT,SAAS;CACT,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,+DAA+D;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC"}

package/dist/schemas/share-link.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Share links — "anyone with the URL", as a revocable credential.
+ *
+ * `appletInstance.visibility` already covers `private | org | public`, which are
+ * IDENTITY decisions the host can evaluate. "Anyone with the link" is not: the
+ * link IS the authority, so it needs the things a credential needs — its own
+ * row, an expiry, a revocation, and a record of use. Adding a fourth enum value
+ * to `visibility` would have hidden all of that behind a word.
+ *
+ * Mirrors the shape `media_share_tokens` already uses for files rather than
+ * inventing a second vocabulary for the same idea.
+ */
+import * as z from 'zod/v4';
+/**
+ * Unguessable and URL-safe. Length is the whole defence — this token is handed
+ * to whoever holds the link, so it must not be searchable or brute-forceable.
+ */
+export declare const appletShareTokenValueSchema: z.ZodString;
+export declare const appletShareLinkSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    token: z.ZodString;
+    label: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodDate>;
+    revokedAt: z.ZodNullable<z.ZodDate>;
+    viewCount: z.ZodDefault<z.ZodNumber>;
+    lastViewedAt: z.ZodNullable<z.ZodDate>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>;
+export type AppletShareLink = z.infer<typeof appletShareLinkSchema>;
+export type AppletShareRefusal = 'share-not-found' | 'share-revoked' | 'share-expired';
+export type AppletShareDecision = {
+    allowed: true;
+    instanceId: string;
+} | {
+    allowed: false;
+    reason: AppletShareRefusal;
+};
+/**
+ * Decide whether a bearer may open the applet behind this link.
+ *
+ * Fails closed. The reason DISCRIMINATES between "no such token", "revoked", and
+ * "expired", which is an existence oracle: a bearer probing tokens learns which
+ * ones once existed. That is deliberate for the owner-facing path, where an
+ * author needs to know why their link stopped working — and it means a
+ * public redemption route must collapse every refusal to one response before it
+ * reaches a bearer. An earlier version of this comment claimed the distinction
+ * went "to the ledger, not the caller", which was simply untrue: it is the
+ * return value.
+ */
+export declare function authorizeAppletShareLink(link: AppletShareLink | null, now: Date): AppletShareDecision;
+/**
+ * A link bearer is ANONYMOUS. They hold a URL, not an identity.
+ *
+ * So a share link may never carry the sharer's capability grant: sharing a URL
+ * would then be sharing authority, and a public link would become a way to
+ * invoke the sharer's capabilities. A bearer gets the applet and nothing else.
+ */
+export declare const APPLET_SHARE_BEARER_CAPABILITIES: readonly string[];
+//# sourceMappingURL=share-link.d.ts.map

package/dist/schemas/share-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-link.d.ts","sourceRoot":"","sources":["../../src/schemas/share-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;GAGG;AACH,eAAO,MAAM,2BAA2B,aAIoB,CAAC;AAE7D,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAchC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,MAAM,kBAAkB,GAC3B,iBAAiB,GACjB,eAAe,GACf,eAAe,CAAC;AAEnB,MAAM,MAAM,mBAAmB,GAC5B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,eAAe,GAAG,IAAI,EAC5B,GAAG,EAAE,IAAI,GACP,mBAAmB,CAOrB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAAsB,CAAC"}

package/dist/schemas/share-link.js

@@ -0,0 +1,68 @@
+/**
+ * Share links — "anyone with the URL", as a revocable credential.
+ *
+ * `appletInstance.visibility` already covers `private | org | public`, which are
+ * IDENTITY decisions the host can evaluate. "Anyone with the link" is not: the
+ * link IS the authority, so it needs the things a credential needs — its own
+ * row, an expiry, a revocation, and a record of use. Adding a fourth enum value
+ * to `visibility` would have hidden all of that behind a word.
+ *
+ * Mirrors the shape `media_share_tokens` already uses for files rather than
+ * inventing a second vocabulary for the same idea.
+ */
+import * as z from 'zod/v4';
+/**
+ * Unguessable and URL-safe. Length is the whole defence — this token is handed
+ * to whoever holds the link, so it must not be searchable or brute-forceable.
+ */
+export const appletShareTokenValueSchema = z
+    .string()
+    .min(32)
+    .max(128)
+    .regex(/^[A-Za-z0-9_-]+$/, 'Share tokens must be URL-safe');
+export const appletShareLinkSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    token: appletShareTokenValueSchema,
+    /** Author-facing label, so a person can tell two links apart before revoking. */
+    label: z.string().min(1).max(120).nullable(),
+    /** Null means it does not expire, which should be a deliberate choice. */
+    expiresAt: z.date().nullable(),
+    revokedAt: z.date().nullable(),
+    /** Cheap abuse signal: a link being hit far more than expected. */
+    viewCount: z.number().int().nonnegative().default(0),
+    lastViewedAt: z.date().nullable(),
+    createdAt: z.date(),
+    updatedAt: z.date()
+});
+/**
+ * Decide whether a bearer may open the applet behind this link.
+ *
+ * Fails closed. The reason DISCRIMINATES between "no such token", "revoked", and
+ * "expired", which is an existence oracle: a bearer probing tokens learns which
+ * ones once existed. That is deliberate for the owner-facing path, where an
+ * author needs to know why their link stopped working — and it means a
+ * public redemption route must collapse every refusal to one response before it
+ * reaches a bearer. An earlier version of this comment claimed the distinction
+ * went "to the ledger, not the caller", which was simply untrue: it is the
+ * return value.
+ */
+export function authorizeAppletShareLink(link, now) {
+    if (!link)
+        return { allowed: false, reason: 'share-not-found' };
+    if (link.revokedAt !== null)
+        return { allowed: false, reason: 'share-revoked' };
+    if (link.expiresAt !== null && link.expiresAt.getTime() <= now.getTime()) {
+        return { allowed: false, reason: 'share-expired' };
+    }
+    return { allowed: true, instanceId: link.instanceId };
+}
+/**
+ * A link bearer is ANONYMOUS. They hold a URL, not an identity.
+ *
+ * So a share link may never carry the sharer's capability grant: sharing a URL
+ * would then be sharing authority, and a public link would become a way to
+ * invoke the sharer's capabilities. A bearer gets the applet and nothing else.
+ */
+export const APPLET_SHARE_BEARER_CAPABILITIES = Object.freeze([]);
+//# sourceMappingURL=share-link.js.map

package/dist/schemas/share-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-link.js","sourceRoot":"","sources":["../../src/schemas/share-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KAC1C,MAAM,EAAE;KACR,GAAG,CAAC,EAAE,CAAC;KACP,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,KAAK,EAAE,2BAA2B;IAClC,iFAAiF;IACjF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,0EAA0E;IAC1E,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,mEAAmE;IACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC;AAaH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACvC,IAA4B,EAC5B,GAAS;IAET,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChE,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChF,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAsB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC"}

package/dist/schemas/state-events.d.ts

@@ -0,0 +1,66 @@
+/**
+ * State, events, mutation receipts, and checkpoints.
+ *
+ * One owner-app command validates `expectedRevision` and `operationId`,
+ * updates the shared or viewer state head, and writes one mutation receipt
+ * in the same database transaction. Duplicate operations return the original
+ * result.
+ *
+ * Generic cloud-api PATCH cannot update state heads.
+ */
+import * as z from 'zod/v4';
+export declare const appletStateScopeSchema: z.ZodEnum<{
+    shared: "shared";
+    viewer: "viewer";
+}>;
+export declare const appletStateHeadSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    scope: z.ZodEnum<{
+        shared: "shared";
+        viewer: "viewer";
+    }>;
+    viewerUserId: z.ZodNullable<z.ZodString>;
+    revision: z.ZodDefault<z.ZodNumber>;
+    state: z.ZodDefault<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>;
+export declare const appletEventSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    sequence: z.ZodNumber;
+    eventType: z.ZodString;
+    payload: z.ZodDefault<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+    viewerUserId: z.ZodNullable<z.ZodString>;
+    viewerOrgId: z.ZodNullable<z.ZodString>;
+    emittedAt: z.ZodDate;
+}, z.core.$strip>;
+export declare const appletMutationReceiptSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    operationId: z.ZodString;
+    eventId: z.ZodUUID;
+    fromRevision: z.ZodNumber;
+    toRevision: z.ZodNumber;
+    applied: z.ZodBoolean;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export declare const appletCheckpointSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    instanceId: z.ZodUUID;
+    revision: z.ZodNumber;
+    stateSnapshot: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    reason: z.ZodDefault<z.ZodEnum<{
+        manual: "manual";
+        duplicate: "duplicate";
+        migrate: "migrate";
+        rollback: "rollback";
+    }>>;
+    createdAt: z.ZodDate;
+}, z.core.$strip>;
+export type AppletStateScope = z.infer<typeof appletStateScopeSchema>;
+export type AppletStateHead = z.infer<typeof appletStateHeadSchema>;
+export type AppletEvent = z.infer<typeof appletEventSchema>;
+export type AppletMutationReceipt = z.infer<typeof appletMutationReceiptSchema>;
+export type AppletCheckpoint = z.infer<typeof appletCheckpointSchema>;
+//# sourceMappingURL=state-events.d.ts.map

package/dist/schemas/state-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-events.d.ts","sourceRoot":"","sources":["../../src/schemas/state-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,sBAAsB;;;EAA+B,CAAC;AAEnE,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAWhC,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;iBAa5B,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;iBActC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAUjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/state-events.js

@@ -0,0 +1,66 @@
+/**
+ * State, events, mutation receipts, and checkpoints.
+ *
+ * One owner-app command validates `expectedRevision` and `operationId`,
+ * updates the shared or viewer state head, and writes one mutation receipt
+ * in the same database transaction. Duplicate operations return the original
+ * result.
+ *
+ * Generic cloud-api PATCH cannot update state heads.
+ */
+import * as z from 'zod/v4';
+import { JsonObjectSchema } from '@vibesdotdev/kernel/schemas/json';
+export const appletStateScopeSchema = z.enum(['shared', 'viewer']);
+export const appletStateHeadSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    scope: appletStateScopeSchema,
+    /** Viewer identity for viewer-scoped state (null for shared). */
+    viewerUserId: z.string().nullable(),
+    /** Optimistic concurrency revision. */
+    revision: z.number().int().nonnegative().default(0),
+    /** JSON-serializable state document. */
+    state: JsonObjectSchema.default({}),
+    updatedAt: z.date()
+});
+export const appletEventSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    /** Monotonic sequence within the instance. */
+    sequence: z.number().int().nonnegative(),
+    /** Event type — typed by the Component's declared event schema. */
+    eventType: z.string().min(1),
+    /** JSON-serializable event payload. */
+    payload: JsonObjectSchema.default({}),
+    /** Viewer identity that emitted the event (null for system events). */
+    viewerUserId: z.string().nullable(),
+    viewerOrgId: z.string().nullable(),
+    emittedAt: z.date()
+});
+export const appletMutationReceiptSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    /** Caller-supplied idempotency key — duplicates return the original result. */
+    operationId: z.string().min(1),
+    /** The event this mutation produced. */
+    eventId: z.uuid(),
+    /** State revision before the mutation. */
+    fromRevision: z.number().int().nonnegative(),
+    /** State revision after the mutation. */
+    toRevision: z.number().int().nonnegative(),
+    /** Whether the mutation was applied or was a duplicate. */
+    applied: z.boolean(),
+    createdAt: z.date()
+});
+export const appletCheckpointSchema = z.object({
+    id: z.uuid(),
+    instanceId: z.uuid(),
+    /** State revision captured by this checkpoint. */
+    revision: z.number().int().nonnegative(),
+    /** Materialized state snapshot. */
+    stateSnapshot: z.record(z.string(), z.unknown()),
+    /** Reason this checkpoint was created (duplicate, migrate, rollback). */
+    reason: z.enum(['duplicate', 'migrate', 'rollback', 'manual']).default('manual'),
+    createdAt: z.date()
+});
+//# sourceMappingURL=state-events.js.map

package/dist/schemas/state-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-events.js","sourceRoot":"","sources":["../../src/schemas/state-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,KAAK,EAAE,sBAAsB;IAC7B,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,uCAAuC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,wCAAwC;IACxC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,8CAA8C;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,mEAAmE;IACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,uCAAuC;IACvC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,uEAAuE;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,+EAA+E;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,wCAAwC;IACxC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;IACjB,0CAA0C;IAC1C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC1C,2DAA2D;IAC3D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,mCAAmC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,yEAAyE;IACzE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC"}

package/dist/schemas/subscription.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Subscription — a user installing an Applet into their own runtime.
+ *
+ * Deliberately thin. The consent half already exists in `grants.ts`:
+ * `appletCapabilityGrant` is release-pinned and revocable, and
+ * `appletLaunchLease` carries short-lived per-run authority. A subscription adds
+ * only DISTRIBUTION — who installed what, where it is registered, and with what
+ * configuration — and REFERENCES the grant rather than restating it. Duplicating
+ * `capabilities` here would create a second source of truth for the same fact,
+ * and the two would drift.
+ *
+ * "Subscription" here never means an event subscription. An Applet reacting to
+ * an event is an event handler (`contributes.events`).
+ */
+import * as z from 'zod/v4';
+export declare const appletSubscriptionStateSchema: z.ZodEnum<{
+    active: "active";
+    paused: "paused";
+    revoked: "revoked";
+    "needs-consent": "needs-consent";
+}>;
+export declare const appletSubscriptionSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    subscriberId: z.ZodString;
+    definitionId: z.ZodString;
+    instanceId: z.ZodUUID;
+    release: z.ZodObject<{
+        componentId: z.ZodUUID;
+        version: z.ZodString;
+        bundleHash: z.ZodString;
+        manifestHash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    consentedContentDigest: z.ZodString;
+    capabilityGrantId: z.ZodUUID;
+    configValues: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    state: z.ZodEnum<{
+        active: "active";
+        paused: "paused";
+        revoked: "revoked";
+        "needs-consent": "needs-consent";
+    }>;
+    subscribedAt: z.ZodDate;
+    revokedAt: z.ZodNullable<z.ZodDate>;
+}, z.core.$strip>;
+export type AppletSubscriptionState = z.infer<typeof appletSubscriptionStateSchema>;
+export type AppletSubscription = z.infer<typeof appletSubscriptionSchema>;
+//# sourceMappingURL=subscription.d.ts.map

package/dist/schemas/subscription.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription.d.ts","sourceRoot":"","sources":["../../src/schemas/subscription.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,6BAA6B;;;;;EAKxC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;iBAsBnC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/schemas/subscription.js

@@ -0,0 +1,46 @@
+/**
+ * Subscription — a user installing an Applet into their own runtime.
+ *
+ * Deliberately thin. The consent half already exists in `grants.ts`:
+ * `appletCapabilityGrant` is release-pinned and revocable, and
+ * `appletLaunchLease` carries short-lived per-run authority. A subscription adds
+ * only DISTRIBUTION — who installed what, where it is registered, and with what
+ * configuration — and REFERENCES the grant rather than restating it. Duplicating
+ * `capabilities` here would create a second source of truth for the same fact,
+ * and the two would drift.
+ *
+ * "Subscription" here never means an event subscription. An Applet reacting to
+ * an event is an event handler (`contributes.events`).
+ */
+import * as z from 'zod/v4';
+import { componentReleaseRefSchema } from "./component-release-ref.js";
+export const appletSubscriptionStateSchema = z.enum([
+    'active',
+    'paused',
+    'revoked',
+    'needs-consent'
+]);
+export const appletSubscriptionSchema = z.object({
+    id: z.uuid(),
+    subscriberId: z.string().min(1),
+    definitionId: z.string().min(1),
+    instanceId: z.uuid(),
+    /** Exact release. Never a mutable alias. */
+    release: componentReleaseRefSchema,
+    /**
+     * Digest set of the release's `files[]` at consent time.
+     *
+     * Comparing capability sets and contribution SHAPES is not enough on upgrade:
+     * implementation files can be swapped wholesale while every tag, name, and
+     * schema stays byte-identical, which is a total behaviour replacement under
+     * prior consent. The content digest is what makes that detectable.
+     */
+    consentedContentDigest: z.string().min(1),
+    /** FK to `appletCapabilityGrant`. Capabilities are NOT duplicated here. */
+    capabilityGrantId: z.uuid(),
+    configValues: z.record(z.string(), z.unknown()).default({}),
+    state: appletSubscriptionStateSchema,
+    subscribedAt: z.date(),
+    revokedAt: z.date().nullable()
+});
+//# sourceMappingURL=subscription.js.map

package/dist/schemas/subscription.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription.js","sourceRoot":"","sources":["../../src/schemas/subscription.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,IAAI,CAAC;IACnD,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,eAAe;CACf,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE;IACpB,4CAA4C;IAC5C,OAAO,EAAE,yBAAyB;IAClC;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,IAAI,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,KAAK,EAAE,6BAA6B;IACpC,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC"}

package/dist/schemas/template-revision.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Applet template revision — exact Component release plus immutable launch
+ * defaults and policy ceilings. Built-in templates become system-owned exact
+ * Component releases.
+ */
+import * as z from 'zod/v4';
+/** One canonical executable template payload: an immutable release and policy. */
+export declare const appletTemplateReleaseSchema: z.ZodObject<{
+    release: z.ZodObject<{
+        componentId: z.ZodUUID;
+        version: z.ZodString;
+        bundleHash: z.ZodString;
+        manifestHash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    defaults: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    policy: z.ZodDefault<z.ZodObject<{
+        maxVisibility: z.ZodDefault<z.ZodEnum<{
+            public: "public";
+            private: "private";
+            org: "org";
+        }>>;
+        maxCapabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const appletTemplateRevisionSchema: z.ZodObject<{
+    release: z.ZodObject<{
+        componentId: z.ZodUUID;
+        version: z.ZodString;
+        bundleHash: z.ZodString;
+        manifestHash: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    defaults: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    policy: z.ZodDefault<z.ZodObject<{
+        maxVisibility: z.ZodDefault<z.ZodEnum<{
+            public: "public";
+            private: "private";
+            org: "org";
+        }>>;
+        maxCapabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    id: z.ZodUUID;
+    templateId: z.ZodString;
+    ownerType: z.ZodEnum<{
+        user: "user";
+        organization: "organization";
+        system: "system";
+    }>;
+    ownerId: z.ZodString;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>;
+export type AppletTemplateRevision = z.infer<typeof appletTemplateRevisionSchema>;
+//# sourceMappingURL=template-revision.d.ts.map

package/dist/schemas/template-revision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-revision.d.ts","sourceRoot":"","sources":["../../src/schemas/template-revision.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,kFAAkF;AAClF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;iBAYtC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}