@vibesdotdev/applets 0.0.0-stage → 1.0.0-rc.2

package/dist/authorization.js

@@ -0,0 +1,189 @@
+/**
+ * Release identity is the BYTES, not the version string.
+ *
+ * `componentReleaseRefSchema.bundleHash` is documented as "the exact bytes
+ * consent and execution bind to". Comparing only componentId+version meant a
+ * republished or repointed `1.0.0` inherited full consent — the pin was a label.
+ */
+function sameRelease(left, right) {
+    return (left.componentId === right.componentId &&
+        left.version === right.version &&
+        left.bundleHash === right.bundleHash &&
+        (left.manifestHash ?? null) === (right.manifestHash ?? null));
+}
+/**
+ * Decide whether one contributed implementation may run right now.
+ *
+ * Fails closed on every branch: an unexpected state is a denial, never a
+ * fallthrough to allowed.
+ */
+export function authorizeAppletContribution(input) {
+    const { subscription, grant, lease, release, requires, now, runId } = input;
+    const leaseRequired = input.leaseRequired ?? true;
+    // --- Subscription liveness. Re-read per call; never trust registration. ---
+    if (subscription.revokedAt !== null) {
+        return { allowed: false, reason: 'subscription-revoked', detail: 'Subscription was revoked' };
+    }
+    switch (subscription.state) {
+        case 'revoked':
+            return { allowed: false, reason: 'subscription-revoked', detail: 'Subscription is revoked' };
+        case 'paused':
+            return { allowed: false, reason: 'subscription-paused', detail: 'Subscription is paused' };
+        case 'needs-consent':
+            return {
+                allowed: false,
+                reason: 'subscription-needs-consent',
+                detail: 'Subscription is awaiting re-consent'
+            };
+        case 'active':
+            break;
+        default:
+            return {
+                allowed: false,
+                reason: 'subscription-revoked',
+                detail: 'Subscription is in an unrecognized state'
+            };
+    }
+    // --- The grant must be the one this subscription consented through. ---
+    if (grant.id !== subscription.capabilityGrantId) {
+        return {
+            allowed: false,
+            reason: 'grant-mismatched',
+            detail: 'Grant does not belong to this subscription'
+        };
+    }
+    if (grant.revokedAt !== null) {
+        return { allowed: false, reason: 'grant-revoked', detail: 'Capability grant was revoked' };
+    }
+    // The grant must record the SUBSCRIBER's consent.
+    //
+    // A published applet accumulates a grant from every viewer who approves it,
+    // all attached to the owner's instance, so "a valid grant for this instance"
+    // is not the same claim as "this subscriber agreed". Creation enforces this
+    // too; re-checking here is not redundant, because everything else in this
+    // function is re-read per call precisely so that a row written under one set
+    // of rules cannot keep authorizing calls under another.
+    const consentedBySubscriber = grant.viewerOrgId === subscription.subscriberId ||
+        (grant.viewerOrgId === null && grant.viewerUserId === subscription.subscriberId);
+    if (!consentedBySubscriber) {
+        return {
+            allowed: false,
+            reason: 'grant-mismatched',
+            detail: 'Capability grant records a different viewer than the subscriber'
+        };
+    }
+    // Defence in depth: the id match above already binds these, so a mismatch
+    // here means the store handed back an inconsistent pair. Refuse rather than
+    // proceed on authority that does not belong to this instance.
+    if (grant.instanceId !== subscription.instanceId) {
+        return {
+            allowed: false,
+            reason: 'grant-instance-mismatch',
+            detail: 'Grant was minted for a different Applet instance'
+        };
+    }
+    // --- Release pinning, on both edges. A grant is authority for ONE release. ---
+    if (!sameRelease(subscription.release, release)) {
+        return {
+            allowed: false,
+            reason: 'release-mismatch',
+            detail: 'Dispatch release does not match the subscribed release'
+        };
+    }
+    if (!sameRelease(grant.release, release)) {
+        return {
+            allowed: false,
+            reason: 'grant-release-mismatch',
+            detail: 'Capability grant was consented for a different release'
+        };
+    }
+    // --- Lease, when the dispatch is run-scoped. ---
+    if (leaseRequired && !lease) {
+        return {
+            allowed: false,
+            reason: 'lease-required',
+            detail: 'This dispatch requires a live launch lease'
+        };
+    }
+    if (lease) {
+        if (lease.instanceId !== subscription.instanceId) {
+            return {
+                allowed: false,
+                reason: 'lease-mismatched',
+                detail: 'Lease is for another instance'
+            };
+        }
+        if (lease.revokedAt !== null) {
+            return { allowed: false, reason: 'lease-revoked', detail: 'Launch lease was revoked' };
+        }
+        if (lease.expiresAt.getTime() <= now.getTime()) {
+            return { allowed: false, reason: 'lease-expired', detail: 'Launch lease has expired' };
+        }
+        if (runId !== undefined && lease.runId !== runId) {
+            return {
+                allowed: false,
+                reason: 'lease-run-mismatch',
+                detail: 'Launch lease belongs to a different run'
+            };
+        }
+    }
+    // --- The actual escalation check: against the GRANT, not the manifest. ---
+    const granted = new Set(grant.capabilities);
+    for (const capability of requires) {
+        if (!granted.has(capability)) {
+            return {
+                allowed: false,
+                reason: 'capability-not-granted',
+                // Names the capability the CALLER already declared, never the grant's
+                // contents — a denial must not enumerate what else was approved.
+                detail: `Capability ${capability} was not granted`
+            };
+        }
+    }
+    return { allowed: true };
+}
+/**
+ * Whether a contribution should be REGISTERED at all for this grant.
+ *
+ * A capability marked `required: false` may be declined at consent. A tool that
+ * needs a declined capability must be absent from `vibes tools list` rather than
+ * present and always throwing — a listed tool that never works is worse than one
+ * that was never offered.
+ */
+export function isContributionRegistrable(requires, grantedCapabilities) {
+    const granted = new Set(grantedCapabilities);
+    return requires.every((capability) => granted.has(capability));
+}
+/** Consent cannot promise authority for which the trusted host has no implementation. */
+export function assertSupportedAppletCapabilities(requested, supported) {
+    const available = new Set(supported);
+    for (const capability of requested) {
+        if (!available.has(capability))
+            throw new Error(`Capability ${capability} is not supported by this host.`);
+    }
+}
+/** Derive consent from pinned metadata; legacy releases without a definition treat every tag as required. */
+export function selectSupportedAppletCapabilities(tags, definition, supported) {
+    const available = new Set(supported);
+    const declared = definition
+        ? new Map(definition.capabilities.map((request) => [request.tag, request]))
+        : null;
+    const accepted = [];
+    for (const tag of new Set(tags)) {
+        const request = declared?.get(tag);
+        if (declared && !request)
+            throw new Error(`Capability ${tag} is not declared by the pinned definition.`);
+        if (available.has(tag))
+            accepted.push(tag);
+        else if (!request || request.required !== false)
+            throw new Error(`Required capability ${tag} is not supported by this host.`);
+    }
+    if (definition) {
+        for (const request of definition.capabilities) {
+            if (request.required !== false && !tags.includes(request.tag))
+                throw new Error(`Required capability ${request.tag} is missing from the pinned release.`);
+        }
+    }
+    return accepted;
+}
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AA0EA;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,IAAyB,EAAE,KAA0B;IACzE,OAAO,CACN,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QACpC,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAC,CAC5D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAC1C,KAA+B;IAE/B,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC5E,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;IAElD,6EAA6E;IAC7E,IAAI,YAAY,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC/F,CAAC;IACD,QAAQ,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,KAAK,SAAS;YACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC9F,KAAK,QAAQ;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC5F,KAAK,eAAe;YACnB,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,4BAA4B;gBACpC,MAAM,EAAE,qCAAqC;aAC7C,CAAC;QACH,KAAK,QAAQ;YACZ,MAAM;QACP;YACC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,sBAAsB;gBAC9B,MAAM,EAAE,0CAA0C;aAClD,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,iBAAiB,EAAE,CAAC;QACjD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,4CAA4C;SACpD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAC5F,CAAC;IACD,kDAAkD;IAClD,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,qBAAqB,GAC1B,KAAK,CAAC,WAAW,KAAK,YAAY,CAAC,YAAY;QAC/C,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,YAAY,CAAC,YAAY,CAAC,CAAC;IAClF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC5B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,iEAAiE;SACzE,CAAC;IACH,CAAC;IACD,0EAA0E;IAC1E,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QAClD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,kDAAkD;SAC1D,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,kBAAkB;YAC1B,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1C,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,wDAAwD;SAChE,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7B,OAAO;YACN,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,4CAA4C;SACpD,CAAC;IACH,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACX,IAAI,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;YAClD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB;gBAC1B,MAAM,EAAE,+BAA+B;aACvC,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAClD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,oBAAoB;gBAC5B,MAAM,EAAE,yCAAyC;aACjD,CAAC;QACH,CAAC;IACF,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5C,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,wBAAwB;gBAChC,sEAAsE;gBACtE,iEAAiE;gBACjE,MAAM,EAAE,cAAc,UAAU,kBAAkB;aAClD,CAAC;QACH,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACxC,QAA2B,EAC3B,mBAAsC;IAEtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iCAAiC,CAChD,SAA4B,EAC5B,SAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,cAAc,UAAU,iCAAiC,CAAC,CAAC;IAC7E,CAAC;AACF,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,iCAAiC,CAChD,IAAuB,EACvB,UAAmF,EACnF,SAA2B;IAE3B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,UAAU;QAC1B,CAAC,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,IAAI,CAAC,OAAO;YACvB,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,4CAA4C,CAAC,CAAC;QAChF,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;YAC9C,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,iCAAiC,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,GAAG,sCAAsC,CAAC,CAAC;QAC5F,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/browser-runtime.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Where the applet-facing client is delivered, and under what name.
+ *
+ * The CLIENT itself lives in `applet-runtime.ts`. This file is only the delivery
+ * contract: an HTML entrypoint reads it off `window.vibes`, a Svelte entrypoint
+ * takes it as the `vibes` prop.
+ *
+ * It used to declare a whole parallel API — `AppletOwnStorageClient`,
+ * `AppletAssetClient`, `AppletViewerScopeClient`, `AppletEventClient`,
+ * `AppletBrowserRuntimeClient` — opening with the line "deliberately not the
+ * host RuntimeClient". Nothing implemented any of it and nothing injected it,
+ * so the runner mounted applets with empty props while the web editor squatted
+ * the same `window.vibes` name with a different object again.
+ *
+ * Those five interfaces are deleted rather than implemented. There is one
+ * client contract, `AppletRootSurface`, and what differs between a
+ * host-rendered applet and a sandboxed one is the transport.
+ */
+import type { AppletRootSurface } from './applet-root-surface.ts';
+export declare const APPLET_HTML_RUNTIME_GLOBAL: "vibes";
+/** @deprecated Migration only. New applets read `window.vibes`. */
+export declare const APPLET_HTML_RUNTIME_GLOBAL_LEGACY: "vibesApplet";
+export declare const APPLET_SVELTE_RUNTIME_PROP: "vibes";
+/** What an HTML entrypoint sees on `window`. */
+export interface AppletRuntimeWindow {
+    [APPLET_HTML_RUNTIME_GLOBAL]?: AppletRootSurface;
+    /** @deprecated Migration only. */
+    [APPLET_HTML_RUNTIME_GLOBAL_LEGACY]?: AppletRootSurface;
+}
+/** What a Svelte entrypoint receives as props. */
+export interface AppletSvelteRuntimeProps {
+    [APPLET_SVELTE_RUNTIME_PROP]: AppletRootSurface;
+}
+//# sourceMappingURL=browser-runtime.d.ts.map

package/dist/browser-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-runtime.d.ts","sourceRoot":"","sources":["../src/browser-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE,eAAO,MAAM,0BAA0B,EAAG,OAAgB,CAAC;AAC3D,mEAAmE;AACnE,eAAO,MAAM,iCAAiC,EAAG,aAAsB,CAAC;AACxE,eAAO,MAAM,0BAA0B,EAAG,OAAgB,CAAC;AAE3D,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IACnC,CAAC,0BAA0B,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACjD,kCAAkC;IAClC,CAAC,iCAAiC,CAAC,CAAC,EAAE,iBAAiB,CAAC;CACxD;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACxC,CAAC,0BAA0B,CAAC,EAAE,iBAAiB,CAAC;CAChD"}

package/dist/browser-runtime.js

@@ -0,0 +1,5 @@
+export const APPLET_HTML_RUNTIME_GLOBAL = 'vibes';
+/** @deprecated Migration only. New applets read `window.vibes`. */
+export const APPLET_HTML_RUNTIME_GLOBAL_LEGACY = 'vibesApplet';
+export const APPLET_SVELTE_RUNTIME_PROP = 'vibes';
+//# sourceMappingURL=browser-runtime.js.map

package/dist/browser-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-runtime.js","sourceRoot":"","sources":["../src/browser-runtime.ts"],"names":[],"mappings":"AAoBA,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAgB,CAAC;AAC3D,mEAAmE;AACnE,MAAM,CAAC,MAAM,iCAAiC,GAAG,aAAsB,CAAC;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,OAAgB,CAAC"}

package/dist/build-definition.d.ts

@@ -0,0 +1,34 @@
+import { type AppletAssetRef, type AppletComposition, type AppletDefinitionManifest, type AppletPackageFile } from './schemas/definition.ts';
+/**
+ * The seeded half. Structural rather than imported from
+ * `@vibesdotdev/platform` so this stays usable by any producer — a starter is
+ * one way to seed a manifest, not the only conceivable one.
+ */
+export interface AppletDefinitionSeed {
+    schemaVersion: number;
+    entrypoint: {
+        kind: 'html' | 'svelte';
+        path: string;
+    };
+    storage?: unknown[];
+    capabilities?: unknown[];
+    contributes?: unknown;
+    /** A2b approved server actions; judged by the manifest's own schema. */
+    serverActions?: unknown[];
+}
+export interface AppletDefinitionBuildInput {
+    seed: AppletDefinitionSeed;
+    /** The immutable inventory the build produced. */
+    files: AppletPackageFile[];
+    assets?: AppletAssetRef[];
+    composition?: AppletComposition[];
+}
+export type AppletDefinitionBuildResult = {
+    ok: true;
+    manifest: AppletDefinitionManifest;
+} | {
+    ok: false;
+    errors: string[];
+};
+export declare function buildAppletDefinitionManifest(input: AppletDefinitionBuildInput): AppletDefinitionBuildResult;
+//# sourceMappingURL=build-definition.d.ts.map

package/dist/build-definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-definition.d.ts","sourceRoot":"","sources":["../src/build-definition.ts"],"names":[],"mappings":"AAcA,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,MAAM,MAAM,2BAA2B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,wBAAwB,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAsBnC,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,0BAA0B,GAC/B,2BAA2B,CA6B7B"}

package/dist/build-definition.js

@@ -0,0 +1,44 @@
+/**
+ * Build a complete Applet definition manifest.
+ *
+ * The missing producer. `starterDefinitionSkeleton` seeds entrypoint, storage,
+ * capabilities, and contributions; the BUILD supplies the immutable file
+ * inventory, Asset references, and composition pins. Nothing joined the two, so
+ * no manifest was ever constructed in production and every control that reads
+ * one was reachable only from tests.
+ *
+ * Returns errors rather than throwing, matching `validateStarter` on the
+ * platform side: this runs during authoring, where the caller wants to show a
+ * person everything that is wrong at once, not the first thing.
+ */
+import * as z from 'zod/v4';
+import { appletDefinitionManifestSchema } from "./schemas/definition.js";
+export function buildAppletDefinitionManifest(input) {
+    const { seed, files } = input;
+    const candidate = {
+        schemaVersion: seed.schemaVersion,
+        entrypoint: seed.entrypoint,
+        files,
+        storage: seed.storage ?? [],
+        assets: input.assets ?? [],
+        composition: input.composition ?? [],
+        capabilities: seed.capabilities ?? []
+    };
+    if (seed.serverActions && seed.serverActions.length > 0)
+        candidate.serverActions = seed.serverActions;
+    // Forwarded only when the seed declares one. Note the guard is TRUTHINESS:
+    // an explicitly empty `{config:[],tools:[],cli:[],events:[]}` is truthy and
+    // IS forwarded, so a seed that passes an empty block at schemaVersion 1 is
+    // rejected. That is the seed's error to fix, not something to paper over
+    // here — silently dropping a declared field is how a mirror starts lying.
+    if (seed.contributes)
+        candidate.contributes = seed.contributes;
+    const parsed = appletDefinitionManifestSchema.safeParse(candidate);
+    if (parsed.success)
+        return { ok: true, manifest: parsed.data };
+    return {
+        ok: false,
+        errors: parsed.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`)
+    };
+}
+//# sourceMappingURL=build-definition.js.map

package/dist/build-definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-definition.js","sourceRoot":"","sources":["../src/build-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,8BAA8B,EAK9B,MAAM,yBAAyB,CAAC;AAiDjC,MAAM,UAAU,6BAA6B,CAC5C,KAAiC;IAEjC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAE9B,MAAM,SAAS,GAAsC;QACpD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,EAAE;QACpC,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;KACrC,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IACtG,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,IAAI,CAAC,WAAW;QAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAE/D,MAAM,MAAM,GAAG,8BAA8B,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAE/D,OAAO;QACN,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAC9B,CAAC,KAAuB,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CACxE;KACD,CAAC;AACH,CAAC"}

package/dist/capabilities/capability.kind.d.ts

@@ -0,0 +1,44 @@
+import * as z from 'zod/v4';
+import type { ComponentReleaseRef } from '../schemas/component-release-ref.ts';
+export declare const APPLET_CAPABILITY_KIND = "applet/capability";
+export declare const appletCapabilityDescriptorSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"applet/capability">;
+    id: z.ZodString;
+    risk: z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>;
+}, z.core.$strip>;
+export declare const appletCapabilityKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<unknown>;
+/** Constructed by an authenticated host, never from the authored call payload. */
+export interface AppletCapabilityBinding {
+    instanceId: string;
+    release: ComponentReleaseRef;
+    viewerUserId: string | null;
+    hostContext: Readonly<Record<string, string>>;
+}
+import type { JsonValue } from '@vibesdotdev/kernel/schemas/json';
+export interface AppletCapabilityBroker {
+    invoke(value: JsonValue, binding: AppletCapabilityBinding): Promise<JsonValue>;
+}
+//# sourceMappingURL=capability.kind.d.ts.map

package/dist/capabilities/capability.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.kind.d.ts","sourceRoot":"","sources":["../../src/capabilities/capability.kind.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQ3C,CAAC;AACH,eAAO,MAAM,oBAAoB,oEAG/B,CAAC;AACH,kFAAkF;AAClF,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC9C;AACD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACtC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC/E"}

package/dist/capabilities/capability.kind.js

@@ -0,0 +1,17 @@
+import { createRuntimeKind, RuntimeDescriptorSchema } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+export const APPLET_CAPABILITY_KIND = 'applet/capability';
+export const appletCapabilityDescriptorSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal(APPLET_CAPABILITY_KIND),
+    id: z
+        .string()
+        .min(1)
+        .max(128)
+        .regex(/^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/),
+    risk: z.enum(['low', 'medium', 'high'])
+});
+export const appletCapabilityKind = createRuntimeKind({
+    id: APPLET_CAPABILITY_KIND,
+    descriptorSchema: appletCapabilityDescriptorSchema
+});
+//# sourceMappingURL=capability.kind.js.map

package/dist/capabilities/capability.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.kind.js","sourceRoot":"","sources":["../../src/capabilities/capability.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,gCAAgC,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC9E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACvC,EAAE,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,oCAAoC,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;CACvC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;IACrD,EAAE,EAAE,sBAAsB;IAC1B,gBAAgB,EAAE,gCAAgC;CAClD,CAAC,CAAC"}

package/dist/capabilities/runtime-dispatch.d.ts

@@ -0,0 +1,9 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { JsonValue } from '@vibesdotdev/kernel/schemas/json';
+import { type AppletGateBinding } from '../applet-gate.ts';
+import { type AppletCapabilityBinding } from './capability.kind.ts';
+/** Host-owned entrypoint for any sandbox transport. It exposes no runtime to authored code. */
+export declare function createAppletCapabilityDispatcher(runtime: VibesRuntime, bindingFor: (connectionId: string) => (AppletGateBinding & {
+    hostContext: AppletCapabilityBinding['hostContext'];
+}) | undefined): (connectionId: string, capability: string, value: JsonValue) => Promise<JsonValue>;
+//# sourceMappingURL=runtime-dispatch.d.ts.map

package/dist/capabilities/runtime-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-dispatch.d.ts","sourceRoot":"","sources":["../../src/capabilities/runtime-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuC,KAAK,YAAY,EAA0B,MAAM,qBAAqB,CAAC;AACrH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE,OAAO,EAA0B,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEnF,OAAO,EAEN,KAAK,uBAAuB,EAE5B,MAAM,sBAAsB,CAAC;AAM9B,+FAA+F;AAC/F,wBAAgB,gCAAgC,CAC/C,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,CACX,YAAY,EAAE,MAAM,KAChB,CAAC,iBAAiB,GAAG;IAAE,WAAW,EAAE,uBAAuB,CAAC,aAAa,CAAC,CAAA;CAAE,CAAC,GAAG,SAAS,IAEhF,cAAc,MAAM,EAAE,YAAY,MAAM,EAAE,OAAO,SAAS,KAAG,OAAO,CAAC,SAAS,CAAC,CAwD7F"}

package/dist/capabilities/runtime-dispatch.js

@@ -0,0 +1,62 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { createAppletInvokeGate } from "../applet-gate.js";
+import { boundAppletValue } from "../applet-value-bound.js";
+import { APPLET_CAPABILITY_KIND } from "./capability.kind.js";
+const brokerSchema = z.object({
+    invoke: z.custom((fn) => typeof fn === 'function')
+});
+/** Host-owned entrypoint for any sandbox transport. It exposes no runtime to authored code. */
+export function createAppletCapabilityDispatcher(runtime, bindingFor) {
+    return async (connectionId, capability, value) => {
+        // One snapshot per invocation binds gate and broker to the same live authority.
+        const live = bindingFor(connectionId);
+        const binding = live ? structuredClone(live) : undefined;
+        const descriptors = await runtime.query(APPLET_CAPABILITY_KIND).enabled().descriptors();
+        const supported = descriptors.some((descriptor) => descriptor.id === capability);
+        const gate = createAppletInvokeGate({
+            bindingFor: () => binding,
+            supportsCapability: () => supported
+        });
+        const context = {
+            kind: 'applets/root',
+            implId: 'capability',
+            method: 'capabilityInvoke',
+            args: [capability, value],
+            origin: 'remote',
+            remotePeer: { runtimeId: 'applet', transport: 'applet', connectionId },
+            scope: runtime.scope
+        };
+        const intercepted = await gate.intercept(context, async () => {
+            if (!binding) {
+                throw new CapabilityError('Applet binding is unavailable', 'UNAVAILABLE', {
+                    reason: 'applet-binding-unavailable',
+                    retryable: false
+                });
+            }
+            const parsedValue = boundAppletValue(value, 'value');
+            const broker = await runtime
+                .query(APPLET_CAPABILITY_KIND)
+                .withId(capability)
+                .enabled()
+                .resolve();
+            const parsedBroker = brokerSchema.safeParse(broker);
+            if (!parsedBroker.success) {
+                throw new CapabilityError('Capability has no callable host implementation', 'UNAVAILABLE', {
+                    reason: 'applet-capability-unimplemented',
+                    retryable: false,
+                    details: { capability }
+                });
+            }
+            // Bounded once, as it leaves the dispatcher: the gate returns `next()` unchanged.
+            return await parsedBroker.data.invoke(parsedValue, structuredClone({
+                instanceId: binding.instanceId,
+                release: binding.release,
+                viewerUserId: binding.grant.viewerUserId,
+                hostContext: binding.hostContext
+            }));
+        });
+        return boundAppletValue(intercepted, 'answer');
+    };
+}
+//# sourceMappingURL=runtime-dispatch.js.map

package/dist/capabilities/runtime-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-dispatch.js","sourceRoot":"","sources":["../../src/capabilities/runtime-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAiE,MAAM,qBAAqB,CAAC;AAErH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAA0B,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EACN,sBAAsB,EAGtB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAmC,CAAC,EAAE,EAA0C,EAAE,CAAC,OAAO,EAAE,KAAK,UAAU,CAAC;CAC5H,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,UAAU,gCAAgC,CAC/C,OAAqB,EACrB,UAE8F;IAE9F,OAAO,KAAK,EAAE,YAAoB,EAAE,UAAkB,EAAE,KAAgB,EAAsB,EAAE;QAC/F,gFAAgF;QAChF,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;QACxF,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,sBAAsB,CAAC;YACnC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;YACzB,kBAAkB,EAAE,GAAG,EAAE,CAAC,SAAS;SACnC,CAAC,CAAC;QACH,MAAM,OAAO,GAAkB;YAC9B,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC;YACzB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE;YACtE,KAAK,EAAE,OAAO,CAAC,KAAK;SACpB,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CACvC,OAAO,EACP,KAAK,IAAI,EAAE;YACV,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,MAAM,IAAI,eAAe,CAAC,+BAA+B,EAAE,aAAa,EAAE;oBACzE,MAAM,EAAE,4BAA4B;oBACpC,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,OAAO;iBAC1B,KAAK,CAA4C,sBAAsB,CAAC;iBACxE,MAAM,CAAC,UAAU,CAAC;iBAClB,OAAO,EAAE;iBACT,OAAO,EAAE,CAAC;YACZ,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC3B,MAAM,IAAI,eAAe,CAAC,gDAAgD,EAAE,aAAa,EAAE;oBAC1F,MAAM,EAAE,iCAAiC;oBACzC,SAAS,EAAE,KAAK;oBAChB,OAAO,EAAE,EAAE,UAAU,EAAE;iBACvB,CAAC,CAAC;YACJ,CAAC;YACD,kFAAkF;YAClF,OAAO,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CACpC,WAAW,EACX,eAAe,CAAC;gBACf,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;gBACxC,WAAW,EAAE,OAAO,CAAC,WAAW;aAChC,CAAC,CACF,CAAC;QACH,CAAC,CACD,CAAC;QACF,OAAO,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC;AACH,CAAC"}

package/dist/cli/applet-group.descriptor.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `vibes applet *` — the local authoring surface.
+ *
+ * Canonical `{feature}/cli` in-package export. The
+ * commands here operate on `.vibes/applets/{id}/` directories; nothing in this
+ * group talks to a server, which is what makes local authoring local.
+ */
+import type { CLIGroupAssetDescriptor } from '@vibesdotdev/cli/schemas/descriptors';
+declare const descriptor: CLIGroupAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=applet-group.descriptor.d.ts.map

package/dist/cli/applet-group.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applet-group.descriptor.d.ts","sourceRoot":"","sources":["../../src/cli/applet-group.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAEpF,QAAA,MAAM,UAAU,EAAE,uBASjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/applet-group.descriptor.js

@@ -0,0 +1,19 @@
+/**
+ * `vibes applet *` — the local authoring surface.
+ *
+ * Canonical `{feature}/cli` in-package export. The
+ * commands here operate on `.vibes/applets/{id}/` directories; nothing in this
+ * group talks to a server, which is what makes local authoring local.
+ */
+const descriptor = {
+    kind: 'cli/group',
+    id: 'applet',
+    name: 'applet',
+    description: 'Author Applets locally: list and inspect projects under .vibes/applets',
+    surfaces: ['cli'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true,
+    order: 45
+};
+export default descriptor;
+//# sourceMappingURL=applet-group.descriptor.js.map

package/dist/cli/applet-group.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applet-group.descriptor.js","sourceRoot":"","sources":["../../src/cli/applet-group.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,UAAU,GAA4B;IAC3C,IAAI,EAAE,WAAW;IACjB,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,wEAAwE;IACrF,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;CACT,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/applet-local-store.storage.descriptor.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Where `vibes applet serve` keeps the stores a local applet declares.
+ *
+ * One `storage/manifest`, partitioned per applet project and then per declared
+ * store (`StorageManifest.partition`), so one applet's store can never address
+ * another's rows and deleting one store cannot touch its neighbour. Each
+ * partition is one document: the store's keys and their values.
+ *
+ * LocalDB only, in the bound workspace (`project` scope): an applet's data is
+ * durable workspace state, so a host without LocalDB refuses rather than
+ * quietly keeping the data in memory until the next restart.
+ *
+ * Registered by the applets CLI plugin; it waits, like any descriptor, for the
+ * `storage/manifest` kind that the Storage plugin owns.
+ */
+import * as z from 'zod/v4';
+export declare const APPLET_LOCAL_STORE_MANIFEST_ID = "applets.local-store";
+/** One declared store: each key and its bounded JSON value. */
+export declare const appletLocalStoreDocumentSchema: z.ZodRecord<z.ZodString, z.ZodPipe<z.ZodCustom<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>, z.ZodTransform<string | number | boolean | import("@vibesdotdev/kernel/schemas/json").JsonObject | import("@vibesdotdev/kernel/schemas/json").JsonArray | null, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+export type AppletLocalStoreDocument = z.infer<typeof appletLocalStoreDocumentSchema>;
+export declare const appletLocalStoreStorageDescriptor: {
+    id: string;
+    kind: "storage/manifest";
+    namespace: string;
+    schema: unknown;
+    allowedAdapters: string[];
+    scope: "local" | "global" | "project" | "auto";
+    customTables: boolean;
+    version: number;
+    internal: boolean;
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    config?: unknown;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    dataType?: "raw" | "objects" | "records" | undefined;
+    idField?: string | undefined;
+    collectionField?: string | undefined;
+    defaultAdapter?: string | undefined;
+    adapterConfig?: Record<string, unknown> | undefined;
+    scopePaths?: {
+        global?: string | undefined;
+        project?: string | undefined;
+        local?: string | undefined;
+    } | undefined;
+    sensitiveFields?: string[] | undefined;
+    migrationKey?: string | undefined;
+    configManifestId?: string | undefined;
+    providesRuntimeKinds?: Record<string, unknown> | undefined;
+};
+export default appletLocalStoreStorageDescriptor;
+//# sourceMappingURL=applet-local-store.storage.descriptor.d.ts.map

package/dist/cli/applet-local-store.storage.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applet-local-store.storage.descriptor.d.ts","sourceRoot":"","sources":["../../src/cli/applet-local-store.storage.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAO5B,eAAO,MAAM,8BAA8B,wBAAwB,CAAC;AAKpE,+DAA+D;AAC/D,eAAO,MAAM,8BAA8B,4WAG1C,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAcR,CAAC;AAEvC,eAAe,iCAAiC,CAAC"}