# B A C Applet SDK & Zero-Trust Architecture (v1.2.0)
> Machine-readable specification for AI Coding Agents building on B A C Cloud Matrix.
> Documentation Hub: https://applet.officialbac.in/
> Shield AI Sandbox: https://applet.officialbac.in/shield-ai

## 1. Project Directory Structure
Each Applet project requires at least two root files:
- applet.json: Manifest metadata and permission scopes.
- index.html: Entrypoint user interface.
Optional:
- app.js: Bridge SDK RPC logic.
- style.css: Applet styles.

## 2. Manifest Specification (applet.json)
```json
{
  "id": "<developer_namespace>.<applet_name>",
  "name": "Human Readable Title",
  "version": "1.0.0",
  "author": "Developer or Team Name",
  "description": "Clear explanation of applet functionality",
  "category": "Developer Tools | Productivity | Monitoring | Utilities",
  "icon": "fa-solid fa-cube",
  "scope": "widget | application",
  "entrypoint": "index.html",
  "permissions": [
    "storage:kv",
    "ui:toast",
    "files:read",
    "files:write",
    "apps:read",
    "apps:control",
    "metrics:read",
    "network:proxy"
  ]
}
```

## 3. Bridge SDK API Reference (@officialbac.in/applet-sdk)
Import via ESM:
```javascript
import BAC from 'https://clientdash.officialbac.in/sdk/bac-applet.v1.js';

// 1. Initialization
await BAC.init({
  onReady: (context) => {
    console.log('Applet ready in context:', context.appletId);
  }
});

// 2. Persistent KV Storage (requires "storage:kv" permission)
await BAC.storage.set('key_name', value);
const val = await BAC.storage.get('key_name');
await BAC.storage.delete('key_name');
const allKeys = await BAC.storage.list();

// 3. Native Dashboard UI Notifications (requires "ui:toast" permission)
BAC.ui.toast('Settings updated!', 'success'); // 'success' | 'error' | 'info'

// 4. Server Health Metrics (requires "metrics:read" permission)
const metrics = await BAC.metrics.getOverview();

// 5. Client Apps & Processes (requires "apps:read" / "apps:control")
const apps = await BAC.apps.list();
await BAC.apps.restart(appId);
```

## 4. Zero-Trust Build CLI Commands
Package assets into proprietary encrypted .bacapp containers:
```bash
# Authenticate developer session
npx bac-applet login --key <your_developer_api_key>

# Check active identity
npx bac-applet whoami

# Compile & Encrypt
npx bac-applet build
```
## 5. Security & Shield AI Audit Constraints
- NEVER invoke eval() or new Function(). Bundles will be rejected immediately.
- Do NOT attempt iframe escapes (parent.window.location, top.location, document.domain).
- Do NOT hardcode developer API keys inside source code.
- Only use SDK hooks for permissions declared in applet.json.
- Always verify your bundle at https://applet.officialbac.in/shield-ai before publishing.