@vibesdotdev/applets 0.0.0-stage → 1.0.0-rc.3

package/dist/manifest-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-hash.js","sourceRoot":"","sources":["../src/manifest-hash.ts"],"names":[],"mappings":"AA2BA,SAAS,QAAQ,CAAC,GAAY;IAC7B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY;IAC7B,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,KAAmB;IACrC,wEAAwE;IACxE,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,kDAAkD;IAClD,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,YAAY;IACZ,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IAClD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAElC,8DAA8D;IAC9D,EAAE;IACF,0EAA0E;IAC1E,qEAAqE;IACrE,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,6EAA6E;IAC7E,mEAAmE;IACnE,2DAA2D;IAC3D,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,OAAO,IAAI,SAAS,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QACzH,qEAAqE;QACrE,uDAAuD;QACvD,MAAM,IAAI,SAAS,CAClB,uDAAuD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC9F,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,2EAA2E;QAC3E,wDAAwD;SACvD,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACnG,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,QAAkC;IAElC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,UAAU,GAAG,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,QAAkC,EAClC,kBAA6C;IAE7C,IAAI,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,CAAC,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC,KAAK,kBAAkB,CAAC;AAC3E,CAAC"}

package/dist/presentation.d.ts

@@ -0,0 +1,43 @@
+import * as z from 'zod/v4';
+import type { Component } from 'svelte';
+import type { Manifest } from '@vibesdotdev/kit/forms';
+import { type JsonObject } from '@vibesdotdev/kernel/schemas/json';
+import type { AppletSvelteRuntimeProps } from './browser-runtime.ts';
+/** Presentation metadata is shared by the catalog and the applet route. */
+export declare const AppletPresentationSchema: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    description: z.ZodDefault<z.ZodString>;
+    entry: z.ZodDefault<z.ZodString>;
+    shell: z.ZodDefault<z.ZodEnum<{
+        none: "none";
+        standard: "standard";
+    }>>;
+}, z.core.$strip>;
+export type AppletPresentation = z.infer<typeof AppletPresentationSchema>;
+/** Local, build-visible descriptors may compose Kit's existing form contract. */
+export interface AppletInputForm extends Omit<Manifest, 'schema'> {
+    schema: z.ZodType<JsonObject>;
+}
+export interface AppletViewDefinition extends AppletPresentation {
+    inputs?: AppletInputForm;
+}
+export declare const AppletRouteSchema: z.ZodObject<{
+    path: z.ZodArray<z.ZodString>;
+    query: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type AppletRoute = z.infer<typeof AppletRouteSchema>;
+export type AppletViewProps = AppletSvelteRuntimeProps & {
+    input: JsonObject;
+    route: AppletRoute;
+};
+export type AppletComponentLoader = () => Promise<Component<AppletViewProps>>;
+/** Preserve repeated query values and nested paths; authored schemas own input validation. */
+export declare function readAppletLocation(definition: AppletViewDefinition, path: string | undefined, url: URL): {
+    route: {
+        path: string[];
+        query: Record<string, string[]>;
+    };
+    input: JsonObject;
+};
+//# sourceMappingURL=presentation.d.ts.map

package/dist/presentation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation.d.ts","sourceRoot":"","sources":["../src/presentation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAGrF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB;;;;;;;;;iBAMnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,iFAAiF;AACjF,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;CAC9B;AACD,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC/D,MAAM,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,eAAO,MAAM,iBAAiB;;;iBAG5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,eAAe,GAAG,wBAAwB,GAAG;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AACnG,MAAM,MAAM,qBAAqB,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;AAE9E,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,GAAG;;;;;;EAetG"}

package/dist/presentation.js

@@ -0,0 +1,36 @@
+import * as z from 'zod/v4';
+import { JsonObjectSchema } from '@vibesdotdev/kernel/schemas/json';
+import { appletProjectIdSchema } from "./local-project.js";
+import { appletRelativePathSchema } from "./schemas/definition.js";
+/** Presentation metadata is shared by the catalog and the applet route. */
+export const AppletPresentationSchema = z.object({
+    id: appletProjectIdSchema,
+    title: z.string().min(1).max(160),
+    description: z.string().max(1000).default(''),
+    entry: appletRelativePathSchema.default('Applet.svelte'),
+    shell: z.enum(['standard', 'none']).default('standard')
+});
+export const AppletRouteSchema = z.object({
+    path: z.array(z.string().max(2048)).max(128),
+    query: z.record(z.string().max(256), z.array(z.string().max(8192)).max(128))
+});
+/** Preserve repeated query values and nested paths; authored schemas own input validation. */
+export function readAppletLocation(definition, path, url) {
+    const query = Object.create(null);
+    for (const [key, value] of url.searchParams)
+        (query[key] ??= []).push(value);
+    const route = {
+        path: AppletRouteSchema.shape.path.parse(path ? path.split('/') : []),
+        query: Object.fromEntries(Object.entries(query).map(([key, values]) => [
+            AppletRouteSchema.shape.query.keyType.parse(key),
+            AppletRouteSchema.shape.query.valueType.parse(values)
+        ]))
+    };
+    const encoded = url.searchParams.getAll('_input');
+    if (encoded.length > 1 || (encoded[0]?.length ?? 0) > 8192)
+        throw new Error('Applet input is too large or repeated.');
+    const values = JsonObjectSchema.parse(encoded[0] ? JSON.parse(encoded[0]) : {});
+    const input = definition.inputs ? definition.inputs.schema.parse(values) : values;
+    return { route, input: JsonObjectSchema.parse(input) };
+}
+//# sourceMappingURL=presentation.js.map

package/dist/presentation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation.js","sourceRoot":"","sources":["../src/presentation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,eAAe,CAAC;IACxD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CACvD,CAAC,CAAC;AAWH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CAC5E,CAAC,CAAC;AAKH,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,UAAgC,EAAE,IAAwB,EAAE,GAAQ;IACtG,MAAM,KAAK,GAA6B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY;QAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAgB;QAC1B,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YACtE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;YAChD,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;SACrD,CAAC,CAAC;KACH,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACtH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/retention.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Release retention — refuse Component deletion while an exact release is
+ * referenced by an applet (surface notification carrying an `applet` or
+ * `component` artifact with a matching componentRef).
+ *
+ * The check is a pure function over a notification list so it is testable
+ * without a runtime. The caller (platform-web DELETE handler) is responsible
+ * for sourcing the notification list via the surface store.
+ */
+import type { SurfaceNotification } from '@vibesdotdev/os/surface/schemas/artifact';
+export interface ReleaseReference {
+    notificationId: string;
+    componentRef: string;
+    /** The artifact that carries the reference. */
+    artifactType: string;
+    /** Parsed component id from the componentRef. */
+    componentId: string;
+    /** Parsed version from the componentRef, or 'latest'. */
+    componentVersion: string;
+}
+/**
+ * Scan surface notifications for artifacts that reference the given Component id.
+ *
+ * Matches on the UUID portion of the componentRef — any version (including
+ * 'latest') counts as a reference. The caller decides whether to refuse
+ * deletion or warn.
+ */
+export declare function findReleaseReferences(notifications: SurfaceNotification[], componentId: string): ReleaseReference[];
+/**
+ * Retention verdict — true means the Component is referenced and deletion
+ * should be refused.
+ */
+export declare function isReleaseRetained(notifications: SurfaceNotification[], componentId: string): boolean;
+//# sourceMappingURL=retention.d.ts.map

package/dist/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAEpF,MAAM,WAAW,gBAAgB;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACpC,aAAa,EAAE,mBAAmB,EAAE,EACpC,WAAW,EAAE,MAAM,GACjB,gBAAgB,EAAE,CA0BpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAChC,aAAa,EAAE,mBAAmB,EAAE,EACpC,WAAW,EAAE,MAAM,GACjB,OAAO,CAET"}

package/dist/retention.js

@@ -0,0 +1,51 @@
+/**
+ * Release retention — refuse Component deletion while an exact release is
+ * referenced by an applet (surface notification carrying an `applet` or
+ * `component` artifact with a matching componentRef).
+ *
+ * The check is a pure function over a notification list so it is testable
+ * without a runtime. The caller (platform-web DELETE handler) is responsible
+ * for sourcing the notification list via the surface store.
+ */
+import { parseAppletComponentRef } from "./component-ref.js";
+/**
+ * Scan surface notifications for artifacts that reference the given Component id.
+ *
+ * Matches on the UUID portion of the componentRef — any version (including
+ * 'latest') counts as a reference. The caller decides whether to refuse
+ * deletion or warn.
+ */
+export function findReleaseReferences(notifications, componentId) {
+    const refs = [];
+    const normalizedId = componentId.toLowerCase();
+    for (const notification of notifications) {
+        for (const artifact of notification.artifacts ?? []) {
+            if (artifact.type !== 'applet' && artifact.type !== 'component')
+                continue;
+            const rawRef = artifact.componentRef;
+            if (!rawRef)
+                continue;
+            const parsed = parseAppletComponentRef(rawRef);
+            if (!parsed)
+                continue;
+            if (parsed.id === normalizedId) {
+                refs.push({
+                    notificationId: notification.id,
+                    componentRef: rawRef,
+                    artifactType: artifact.type,
+                    componentId: parsed.id,
+                    componentVersion: parsed.version
+                });
+            }
+        }
+    }
+    return refs;
+}
+/**
+ * Retention verdict — true means the Component is referenced and deletion
+ * should be refused.
+ */
+export function isReleaseRetained(notifications, componentId) {
+    return findReleaseReferences(notifications, componentId).length > 0;
+}
+//# sourceMappingURL=retention.js.map

package/dist/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../src/retention.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAc7D;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACpC,aAAoC,EACpC,WAAmB;IAEnB,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IAE/C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QAC1C,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;YACrD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YAC1E,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,SAAS;YAEtB,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM;gBAAE,SAAS;YAEtB,IAAI,MAAM,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC;oBACT,cAAc,EAAE,YAAY,CAAC,EAAE;oBAC/B,YAAY,EAAE,MAAM;oBACpB,YAAY,EAAE,QAAQ,CAAC,IAAI;oBAC3B,WAAW,EAAE,MAAM,CAAC,EAAE;oBACtB,gBAAgB,EAAE,MAAM,CAAC,OAAO;iBAChC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAChC,aAAoC,EACpC,WAAmB;IAEnB,OAAO,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACrE,CAAC"}

package/dist/schemas/applet-messages.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Host→applet message contracts — schema-first, shared by both sides.
+ *
+ * A host that hands one of these messages and an applet that validates
+ * against the same schema are speaking a versioned contract from
+ * @vibesdotdev/applets, not ad-hoc shapes copied between files. The local
+ * serve server and the upstream consent canvas both speak these.
+ */
+import * as z from 'zod/v4';
+export declare const appletIdSchema: z.ZodString;
+/** file-viewer: the handed file set. */
+export declare const filesMessageSchema: z.ZodObject<{
+    type: z.ZodLiteral<"files">;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        content: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type FilesMessage = z.infer<typeof filesMessageSchema>;
+/** file-diff-viewer: one handed before/after pair. */
+export declare const diffMessageSchema: z.ZodObject<{
+    type: z.ZodLiteral<"diff">;
+    path: z.ZodString;
+    before: z.ZodString;
+    after: z.ZodString;
+}, z.core.$strip>;
+export type DiffMessage = z.infer<typeof diffMessageSchema>;
+/** storage-viewer: a handed directory tree. */
+export declare const treeEntrySchema: z.ZodObject<{
+    path: z.ZodString;
+    kind: z.ZodEnum<{
+        file: "file";
+        dir: "dir";
+    }>;
+    size: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const treeMessageSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tree">;
+    root: z.ZodOptional<z.ZodString>;
+    entries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        kind: z.ZodEnum<{
+            file: "file";
+            dir: "dir";
+        }>;
+        size: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type TreeMessage = z.infer<typeof treeMessageSchema>;
+/** applet-tour: a handed walkthrough. */
+export declare const tourStepSchema: z.ZodObject<{
+    title: z.ZodString;
+    body: z.ZodString;
+    url: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const tourMessageSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tour">;
+    steps: z.ZodArray<z.ZodObject<{
+        title: z.ZodString;
+        body: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type TourMessage = z.infer<typeof tourMessageSchema>;
+/** Union for dispatch: parse an unknown message into its contract. */
+export declare const appletMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"files">;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        content: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"diff">;
+    path: z.ZodString;
+    before: z.ZodString;
+    after: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tree">;
+    root: z.ZodOptional<z.ZodString>;
+    entries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        kind: z.ZodEnum<{
+            file: "file";
+            dir: "dir";
+        }>;
+        size: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tour">;
+    steps: z.ZodArray<z.ZodObject<{
+        title: z.ZodString;
+        body: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>], "type">;
+export type AppletMessage = z.infer<typeof appletMessageSchema>;
+//# sourceMappingURL=applet-messages.d.ts.map

package/dist/schemas/applet-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applet-messages.d.ts","sourceRoot":"","sources":["../../src/schemas/applet-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,cAAc,aAA2C,CAAC;AAEvE,wCAAwC;AACxC,eAAO,MAAM,kBAAkB;;;;;;iBAG7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+CAA+C;AAC/C,eAAO,MAAM,eAAe;;;;;;;iBAI1B,CAAC;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,yCAAyC;AACzC,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,eAAO,MAAM,iBAAiB;;;;;;;iBAG5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,sEAAsE;AACtE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/schemas/applet-messages.js

@@ -0,0 +1,51 @@
+/**
+ * Host→applet message contracts — schema-first, shared by both sides.
+ *
+ * A host that hands one of these messages and an applet that validates
+ * against the same schema are speaking a versioned contract from
+ * @vibesdotdev/applets, not ad-hoc shapes copied between files. The local
+ * serve server and the upstream consent canvas both speak these.
+ */
+import * as z from 'zod/v4';
+export const appletIdSchema = z.string().regex(/^[a-z0-9][a-z0-9-]*$/);
+/** file-viewer: the handed file set. */
+export const filesMessageSchema = z.object({
+    type: z.literal('files'),
+    files: z.array(z.object({ path: z.string(), content: z.string() }))
+});
+/** file-diff-viewer: one handed before/after pair. */
+export const diffMessageSchema = z.object({
+    type: z.literal('diff'),
+    path: z.string(),
+    before: z.string(),
+    after: z.string()
+});
+/** storage-viewer: a handed directory tree. */
+export const treeEntrySchema = z.object({
+    path: z.string(),
+    kind: z.enum(['dir', 'file']),
+    size: z.number().optional()
+});
+export const treeMessageSchema = z.object({
+    type: z.literal('tree'),
+    root: z.string().optional(),
+    entries: z.array(treeEntrySchema)
+});
+/** applet-tour: a handed walkthrough. */
+export const tourStepSchema = z.object({
+    title: z.string(),
+    body: z.string(),
+    url: z.string().optional()
+});
+export const tourMessageSchema = z.object({
+    type: z.literal('tour'),
+    steps: z.array(tourStepSchema).min(1)
+});
+/** Union for dispatch: parse an unknown message into its contract. */
+export const appletMessageSchema = z.discriminatedUnion('type', [
+    filesMessageSchema,
+    diffMessageSchema,
+    treeMessageSchema,
+    tourMessageSchema
+]);
+//# sourceMappingURL=applet-messages.js.map

package/dist/schemas/applet-messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applet-messages.js","sourceRoot":"","sources":["../../src/schemas/applet-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAEvE,wCAAwC;AACxC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;CACnE,CAAC,CAAC;AAGH,sDAAsD;AACtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAGH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CACjC,CAAC,CAAC;AAGH,yCAAyC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC,CAAC;AAGH,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC/D,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;CACjB,CAAC,CAAC"}

package/dist/schemas/capabilities.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Capability vocabulary — stable names for authority an Applet may request.
+ *
+ * Component authors may explain why a capability is needed but cannot define
+ * or grant authority. Trust is server-attested policy; this module deliberately
+ * does not claim a broker registry while no broker invocation boundary exists.
+ */
+import * as z from 'zod/v4';
+export declare const appletCapabilityKindSchema: z.ZodEnum<{
+    "storage.read": "storage.read";
+    "storage.write": "storage.write";
+    "network.fetch": "network.fetch";
+    "clipboard.read": "clipboard.read";
+    "clipboard.write": "clipboard.write";
+    "geolocation.read": "geolocation.read";
+    "notification.send": "notification.send";
+    "workboard.create": "workboard.create";
+    "workboard.update": "workboard.update";
+    "applet.snapshot.create": "applet.snapshot.create";
+    "applet.snapshot.update": "applet.snapshot.update";
+    "output.create": "output.create";
+    "output.update": "output.update";
+}>;
+export declare const appletCapabilityRiskSchema: z.ZodEnum<{
+    low: "low";
+    medium: "medium";
+    high: "high";
+}>;
+export declare const appletCapabilityCostPostureSchema: z.ZodEnum<{
+    free: "free";
+    metered: "metered";
+    quota: "quota";
+}>;
+export type AppletCapabilityKind = z.infer<typeof appletCapabilityKindSchema>;
+export type AppletCapabilityRisk = z.infer<typeof appletCapabilityRiskSchema>;
+export type AppletCapabilityCostPosture = z.infer<typeof appletCapabilityCostPostureSchema>;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/schemas/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/schemas/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;EAgBrC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;EAAoC,CAAC;AAE5E,eAAO,MAAM,iCAAiC;;;;EAAuC,CAAC;AAEtF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/schemas/capabilities.js

@@ -0,0 +1,28 @@
+/**
+ * Capability vocabulary — stable names for authority an Applet may request.
+ *
+ * Component authors may explain why a capability is needed but cannot define
+ * or grant authority. Trust is server-attested policy; this module deliberately
+ * does not claim a broker registry while no broker invocation boundary exists.
+ */
+import * as z from 'zod/v4';
+export const appletCapabilityKindSchema = z.enum([
+    'storage.read',
+    'storage.write',
+    'network.fetch',
+    'clipboard.read',
+    'clipboard.write',
+    'geolocation.read',
+    'notification.send',
+    'workboard.create',
+    'workboard.update',
+    'applet.snapshot.create',
+    'applet.snapshot.update',
+    /** @deprecated Persistence compatibility only; use applet.snapshot.*. */
+    'output.create',
+    /** @deprecated Persistence compatibility only; use applet.snapshot.*. */
+    'output.update'
+]);
+export const appletCapabilityRiskSchema = z.enum(['low', 'medium', 'high']);
+export const appletCapabilityCostPostureSchema = z.enum(['free', 'metered', 'quota']);
+//# sourceMappingURL=capabilities.js.map

package/dist/schemas/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/schemas/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,kBAAkB;IAClB,wBAAwB;IACxB,wBAAwB;IACxB,yEAAyE;IACzE,eAAe;IACf,yEAAyE;IACzE,eAAe;CACf,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC"}

package/dist/schemas/component-release-ref.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Component release reference — pins an applet to one exact Platform Component
+ * release. No mutable/latest binding; the version and digests are immutable.
+ */
+import * as z from 'zod/v4';
+export declare const componentReleaseRefSchema: z.ZodObject<{
+    componentId: z.ZodUUID;
+    version: z.ZodString;
+    bundleHash: z.ZodString;
+    manifestHash: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ComponentReleaseRef = z.infer<typeof componentReleaseRefSchema>;
+//# sourceMappingURL=component-release-ref.d.ts.map

package/dist/schemas/component-release-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-release-ref.d.ts","sourceRoot":"","sources":["../../src/schemas/component-release-ref.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,yBAAyB;;;;;iBAcpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/schemas/component-release-ref.js

@@ -0,0 +1,21 @@
+/**
+ * Component release reference — pins an applet to one exact Platform Component
+ * release. No mutable/latest binding; the version and digests are immutable.
+ */
+import * as z from 'zod/v4';
+export const componentReleaseRefSchema = z.object({
+    componentId: z.uuid(),
+    version: z
+        .string()
+        .min(1)
+        .max(32)
+        .regex(/^[a-zA-Z0-9.+_-]+$/, 'Component release versions must be URL-safe')
+        .refine((version) => version.toLowerCase() !== 'latest', {
+        message: 'Applet instances and composition must pin an exact Component release'
+    }),
+    /** Bundle digest at publish time — the exact bytes consent and execution bind to. */
+    bundleHash: z.string().min(1),
+    /** Manifest digest at publish time — exact capabilities/props/schemas. */
+    manifestHash: z.string().min(1).optional()
+});
+//# sourceMappingURL=component-release-ref.js.map

package/dist/schemas/component-release-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-release-ref.js","sourceRoot":"","sources":["../../src/schemas/component-release-ref.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE;IACrB,OAAO,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC1E,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE;QACxD,OAAO,EAAE,sEAAsE;KAC/E,CAAC;IACH,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,0EAA0E;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC"}