@immediately-run/sdk 0.38.0 → 0.40.0

package/dist/components/SafeInclude.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/SafeInclude.tsx"],"sourcesContent":["import { Suspense, use, useMemo } from 'react';\nimport { ErrorBoundary } from 'react-error-boundary';\n\nimport { openAppFs } from '../fs';\nimport { getAppMountPath } from '../mounts';\nimport { useMDXComponents } from '../MDXProvider';\nimport { SafeContent } from '../safeContent/SafeContent';\nimport { createSourceCache, type SourceReader } from '../sourceCache';\nimport { RenderExportedComponentContext } from './includeContexts';\nimport { defaultErrorComponent, defaultLoadingComponent } from './defaults';\n\n// `<Include mode=\"interpreted\">` — the same tag, the NON-EXECUTABLE renderer. (R3-263)\n//\n// WHY THIS EXISTS. `<Include>` resolves a file through the module cache and *evaluates* it,\n// which is right for an app's own source and wrong for content. An interpreter app\n// (TRUST_MODES_SPEC §5) had no way to say \"include this file, but as data\": it could render\n// its own bodies through `<SafeContent>` while any file it pulled in with `<Include>` still\n// executed. Grove hit exactly that — a wiki declaring `render: safe` still ran author\n// JavaScript out of its `_layout.mdx`, because the layout chain went through `<Include>`.\n//\n// It is also what makes such a file renderable AT ALL when it does not live in the app: the\n// compiled path evaluates an app-source module, which a file resident in a content mount is\n// not. That is the `AGENT_AUTHORING §10` MDX-from-mount gate, which `TRUST_MODES §5.1` says\n// MUST terminate in the safe renderer and never in compiled MDX.\n//\n// The component map comes from `useMDXComponents` — the SAME provider map `boot({\n// mdxComponents })` establishes for the compiled path — so a document resolves the identical\n// vocabulary under either renderer and an app wires nothing extra to get it.\n\n/** Strip a leading YAML frontmatter block (and an optional BOM). The compiled path never\n *  renders frontmatter — the MDX loader consumes it — so the safe path must not either, or\n *  the same file gains a wall of raw YAML when the renderer changes. */\nexport function stripFrontmatter(source: string): string {\n  return source.replace(/^\\uFEFF?---\\r?\\n[\\s\\S]*?\\r?\\n---[ \\t]*\\r?\\n?/, '');\n}\n\n/** `/app/content/x.mdx` → `content/x.mdx`. {@link openAppFs} is anchored at the app mount,\n *  so an absolute module path has to be made mount-relative before it is read. A path that\n *  is already relative is passed through untouched. */\nexport function appMountRelative(filename: string): string {\n  const root = getAppMountPath().replace(/\\/+$/, '');\n  const abs = filename.startsWith(root + '/') ? filename.slice(root.length) : filename;\n  return abs.replace(/^\\/+/, '');\n}\n\n// One cache for every interpreted include in the app: a layout file is included on every\n// page, so a per-component cache would re-read it per navigation. See `../sourceCache` for\n// why a REJECTED read must not be memoised.\nconst defaultSources = createSourceCache(\n  (path) => openAppFs().readFile(path, 'utf8') as Promise<string>,\n);\n\nfunction InterpretedBody({\n  filename,\n  components,\n  readSource,\n}: {\n  filename: string;\n  components?: Record<string, unknown>;\n  readSource?: SourceReader;\n}) {\n  // A caller-supplied reader gets its own cache; the shared one is used otherwise. Memoised\n  // on the reader identity so `use()` still sees a stable promise across renders.\n  const sources = useMemo(\n    () => (readSource ? createSourceCache(readSource) : defaultSources),\n    [readSource],\n  );\n  const raw = use(sources.read(appMountRelative(filename)));\n  const provided = useMDXComponents(components) as Record<string, unknown>;\n  const body = stripFrontmatter(raw);\n  return (\n    // Publishing the included file's path is what lets the WikiLink resolver know which file\n    // a relative `[[target]]` (and its `#sec-…` fragment) is relative TO — the same context\n    // the compiled path publishes from the module's evaluation.\n    <RenderExportedComponentContext\n      value={{ evaluationContext: { evaluation: { module: { filepath: filename } } } } as never}\n    >\n      <SafeContent source={body} components={provided as never} />\n    </RenderExportedComponentContext>\n  );\n}\n\n/** Render another file's Markdown/MDX **as data** — no author JavaScript executes. Reached\n *  via `<Include mode=\"interpreted\">` or `<IncludeModeContext value=\"interpreted\">`. */\nexport const SafeInclude = ({\n  filename,\n  components,\n  readSource,\n  LoadingComponent = defaultLoadingComponent,\n  ErrorComponent = defaultErrorComponent,\n}: {\n  filename: string;\n  /** Extra/override components, merged OVER the surrounding MDXProvider map. */\n  components?: Record<string, unknown>;\n  /** Read the raw bytes yourself — e.g. from a content mount rather than the app repo. */\n  readSource?: SourceReader;\n  LoadingComponent?: typeof defaultLoadingComponent;\n  ErrorComponent?: typeof defaultErrorComponent;\n}) => (\n  // Same boundary shape as the compiled path: a file that fails to read renders the error\n  // component rather than taking down the tree that included it.\n  <ErrorBoundary fallbackRender={ErrorComponent}>\n    <Suspense fallback={<LoadingComponent />}>\n      <InterpretedBody filename={filename} components={components} readSource={readSource} />\n    </Suspense>\n  </ErrorBoundary>\n);\n"],"mappings":";AA6EM;AA7EN,SAAS,UAAU,KAAK,eAAe;AACvC,SAAS,qBAAqB;AAE9B,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,mBAAmB;AAC5B,SAAS,yBAA4C;AACrD,SAAS,sCAAsC;AAC/C,SAAS,uBAAuB,+BAA+B;AAuBxD,SAAS,iBAAiB,QAAwB;AACvD,SAAO,OAAO,QAAQ,gDAAgD,EAAE;AAC1E;AAKO,SAAS,iBAAiB,UAA0B;AACzD,QAAM,OAAO,gBAAgB,EAAE,QAAQ,QAAQ,EAAE;AACjD,QAAM,MAAM,SAAS,WAAW,OAAO,GAAG,IAAI,SAAS,MAAM,KAAK,MAAM,IAAI;AAC5E,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAKA,MAAM,iBAAiB;AAAA,EACrB,CAAC,SAAS,UAAU,EAAE,SAAS,MAAM,MAAM;AAC7C;AAEA,SAAS,gBAAgB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AACF,GAIG;AAGD,QAAM,UAAU;AAAA,IACd,MAAO,aAAa,kBAAkB,UAAU,IAAI;AAAA,IACpD,CAAC,UAAU;AAAA,EACb;AACA,QAAM,MAAM,IAAI,QAAQ,KAAK,iBAAiB,QAAQ,CAAC,CAAC;AACxD,QAAM,WAAW,iBAAiB,UAAU;AAC5C,QAAM,OAAO,iBAAiB,GAAG;AACjC;AAAA;AAAA;AAAA;AAAA,IAIE;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,SAAS,EAAE,EAAE,EAAE;AAAA,QAE/E,8BAAC,eAAY,QAAQ,MAAM,YAAY,UAAmB;AAAA;AAAA,IAC5D;AAAA;AAEJ;AAIO,MAAM,cAAc,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB,iBAAiB;AACnB;AAAA;AAAA;AAAA,EAWE,oBAAC,iBAAc,gBAAgB,gBAC7B,8BAAC,YAAS,UAAU,oBAAC,oBAAiB,GACpC,8BAAC,mBAAgB,UAAoB,YAAwB,YAAwB,GACvF,GACF;AAAA;","names":[]}

package/dist/components/includeContexts.cjs

@@ -0,0 +1,33 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var includeContexts_exports = {};
+__export(includeContexts_exports, {
+  IncludeModeContext: () => IncludeModeContext,
+  RenderExportedComponentContext: () => RenderExportedComponentContext
+});
+module.exports = __toCommonJS(includeContexts_exports);
+var import_react = require("react");
+const RenderExportedComponentContext = (0, import_react.createContext)(null);
+const IncludeModeContext = (0, import_react.createContext)("compiled");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IncludeModeContext,
+  RenderExportedComponentContext
+});
+//# sourceMappingURL=includeContexts.cjs.map

package/dist/components/includeContexts.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/includeContexts.ts"],"sourcesContent":["import { createContext } from 'react';\n\nimport { EvaluationContext } from '../sandboxTypes';\n\n// The contexts `<Include>` publishes and reads, in their own module so that `Include` and\n// `SafeInclude` can each import them without importing each other. `Include` branches to\n// `SafeInclude` and `SafeInclude` publishes `RenderExportedComponentContext`, which would be\n// a cycle if either owned the contexts — and `check:circular` is a CI gate, because a\n// circular SDK import once made the bundler infinite-loop.\n//\n// Both are re-exported from `./Include`, which is the public entry point; nothing outside\n// needs to know this module exists.\n\n/** The value exposed on {@link RenderExportedComponentContext}: the evaluation\n *  context of the module `Include` resolved. */\nexport type RenderFileContextType = {\n  evaluationContext: EvaluationContext;\n};\n\n/** Context carrying the included module's {@link EvaluationContext} to its subtree. */\nexport const RenderExportedComponentContext = createContext<RenderFileContextType | null>(null);\n\n/** Which renderer `Include` uses: `compiled` evaluates the module (the default, unchanged\n *  behaviour); `interpreted` renders the file's Markdown/MDX **as data** through the safe\n *  renderer, so no author JavaScript executes. */\nexport type IncludeMode = 'compiled' | 'interpreted';\n\n/** Declare the renderer for every `Include` in a subtree. An **interpreter** app\n *  (TRUST_MODES_SPEC §5) sets this once at its root instead of remembering to pass `mode` at\n *  each call site — the failure mode being silent (one forgotten `<Include>` executes author\n *  code while the app believes it renders nothing but data). Defaults to `compiled`, so every\n *  existing consumer is unaffected. */\nexport const IncludeModeContext = createContext<IncludeMode>('compiled');\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA8B;AAoBvB,MAAM,qCAAiC,4BAA4C,IAAI;AAYvF,MAAM,yBAAqB,4BAA2B,UAAU;","names":[]}

package/dist/components/includeContexts.d.cts

@@ -0,0 +1,22 @@
+import * as react from 'react';
+import { EvaluationContext } from '../sandboxTypes.cjs';
+
+/** The value exposed on {@link RenderExportedComponentContext}: the evaluation
+ *  context of the module `Include` resolved. */
+type RenderFileContextType = {
+    evaluationContext: EvaluationContext;
+};
+/** Context carrying the included module's {@link EvaluationContext} to its subtree. */
+declare const RenderExportedComponentContext: react.Context<RenderFileContextType | null>;
+/** Which renderer `Include` uses: `compiled` evaluates the module (the default, unchanged
+ *  behaviour); `interpreted` renders the file's Markdown/MDX **as data** through the safe
+ *  renderer, so no author JavaScript executes. */
+type IncludeMode = 'compiled' | 'interpreted';
+/** Declare the renderer for every `Include` in a subtree. An **interpreter** app
+ *  (TRUST_MODES_SPEC §5) sets this once at its root instead of remembering to pass `mode` at
+ *  each call site — the failure mode being silent (one forgotten `<Include>` executes author
+ *  code while the app believes it renders nothing but data). Defaults to `compiled`, so every
+ *  existing consumer is unaffected. */
+declare const IncludeModeContext: react.Context<IncludeMode>;
+
+export { type IncludeMode, IncludeModeContext, RenderExportedComponentContext, type RenderFileContextType };

package/dist/components/includeContexts.d.ts

@@ -0,0 +1,22 @@
+import * as react from 'react';
+import { EvaluationContext } from '../sandboxTypes.js';
+
+/** The value exposed on {@link RenderExportedComponentContext}: the evaluation
+ *  context of the module `Include` resolved. */
+type RenderFileContextType = {
+    evaluationContext: EvaluationContext;
+};
+/** Context carrying the included module's {@link EvaluationContext} to its subtree. */
+declare const RenderExportedComponentContext: react.Context<RenderFileContextType | null>;
+/** Which renderer `Include` uses: `compiled` evaluates the module (the default, unchanged
+ *  behaviour); `interpreted` renders the file's Markdown/MDX **as data** through the safe
+ *  renderer, so no author JavaScript executes. */
+type IncludeMode = 'compiled' | 'interpreted';
+/** Declare the renderer for every `Include` in a subtree. An **interpreter** app
+ *  (TRUST_MODES_SPEC §5) sets this once at its root instead of remembering to pass `mode` at
+ *  each call site — the failure mode being silent (one forgotten `<Include>` executes author
+ *  code while the app believes it renders nothing but data). Defaults to `compiled`, so every
+ *  existing consumer is unaffected. */
+declare const IncludeModeContext: react.Context<IncludeMode>;
+
+export { type IncludeMode, IncludeModeContext, RenderExportedComponentContext, type RenderFileContextType };

package/dist/components/includeContexts.js

@@ -0,0 +1,9 @@
+import "../chunk-VHAA22YE.js";
+import { createContext } from "react";
+const RenderExportedComponentContext = createContext(null);
+const IncludeModeContext = createContext("compiled");
+export {
+  IncludeModeContext,
+  RenderExportedComponentContext
+};
+//# sourceMappingURL=includeContexts.js.map

package/dist/components/includeContexts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/includeContexts.ts"],"sourcesContent":["import { createContext } from 'react';\n\nimport { EvaluationContext } from '../sandboxTypes';\n\n// The contexts `<Include>` publishes and reads, in their own module so that `Include` and\n// `SafeInclude` can each import them without importing each other. `Include` branches to\n// `SafeInclude` and `SafeInclude` publishes `RenderExportedComponentContext`, which would be\n// a cycle if either owned the contexts — and `check:circular` is a CI gate, because a\n// circular SDK import once made the bundler infinite-loop.\n//\n// Both are re-exported from `./Include`, which is the public entry point; nothing outside\n// needs to know this module exists.\n\n/** The value exposed on {@link RenderExportedComponentContext}: the evaluation\n *  context of the module `Include` resolved. */\nexport type RenderFileContextType = {\n  evaluationContext: EvaluationContext;\n};\n\n/** Context carrying the included module's {@link EvaluationContext} to its subtree. */\nexport const RenderExportedComponentContext = createContext<RenderFileContextType | null>(null);\n\n/** Which renderer `Include` uses: `compiled` evaluates the module (the default, unchanged\n *  behaviour); `interpreted` renders the file's Markdown/MDX **as data** through the safe\n *  renderer, so no author JavaScript executes. */\nexport type IncludeMode = 'compiled' | 'interpreted';\n\n/** Declare the renderer for every `Include` in a subtree. An **interpreter** app\n *  (TRUST_MODES_SPEC §5) sets this once at its root instead of remembering to pass `mode` at\n *  each call site — the failure mode being silent (one forgotten `<Include>` executes author\n *  code while the app believes it renders nothing but data). Defaults to `compiled`, so every\n *  existing consumer is unaffected. */\nexport const IncludeModeContext = createContext<IncludeMode>('compiled');\n"],"mappings":";AAAA,SAAS,qBAAqB;AAoBvB,MAAM,iCAAiC,cAA4C,IAAI;AAYvF,MAAM,qBAAqB,cAA2B,UAAU;","names":[]}

package/dist/fs.d.cts

@@ -1,4 +1,5 @@
 import { SandboxMount } from './mounts.cjs';
+import './generated/spaces.cjs';
 import './tasks.cjs';
 
 /** The node-compatible promises surface the sandbox ZenFS exposes (the subset we use). */

package/dist/fs.d.ts

@@ -1,4 +1,5 @@
 import { SandboxMount } from './mounts.js';
+import './generated/spaces.js';
 import './tasks.js';
 
 /** The node-compatible promises surface the sandbox ZenFS exposes (the subset we use). */

package/dist/generated/spaces.cjs

@@ -0,0 +1,62 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var spaces_exports = {};
+__export(spaces_exports, {
+  getSpaceMembers: () => getSpaceMembers,
+  inviteToSpace: () => inviteToSpace,
+  listAllSpaces: () => listAllSpaces,
+  listGrants: () => listGrants,
+  listSpaces: () => listSpaces,
+  lookupUser: () => lookupUser,
+  revokeGrant: () => revokeGrant,
+  setSpaceRole: () => setSpaceRole,
+  unshareSpace: () => unshareSpace
+});
+module.exports = __toCommonJS(spaces_exports);
+var import_catalog = require("../catalog");
+const listSpaces = (opts = {}) => (0, import_catalog.invoke)("spaces:list", opts);
+const listAllSpaces = () => (0, import_catalog.invoke)("spaces:listAll", {});
+const getSpaceMembers = (spaceId) => (0, import_catalog.invoke)("spaces:members", { spaceId });
+const inviteToSpace = async (spaceId, login, role) => {
+  await (0, import_catalog.invoke)("spaces:invite", { spaceId, login, role });
+};
+const unshareSpace = async (spaceId, uid) => {
+  await (0, import_catalog.invoke)("spaces:unshare", { spaceId, uid });
+};
+const setSpaceRole = async (spaceId, uid, role) => {
+  await (0, import_catalog.invoke)("spaces:setRole", { spaceId, uid, role });
+};
+const lookupUser = (login) => (0, import_catalog.invoke)("spaces:lookupUser", { login });
+const listGrants = () => (0, import_catalog.invoke)("spaces:grants", {});
+const revokeGrant = async (appKey, spaceId) => {
+  await (0, import_catalog.invoke)("spaces:revokeGrant", { appKey, spaceId });
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getSpaceMembers,
+  inviteToSpace,
+  listAllSpaces,
+  listGrants,
+  listSpaces,
+  lookupUser,
+  revokeGrant,
+  setSpaceRole,
+  unshareSpace
+});
+//# sourceMappingURL=spaces.cjs.map

package/dist/generated/spaces.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/generated/spaces.ts"],"sourcesContent":["// GENERATED by scripts/codegen-prototype/generate.mjs — DO NOT EDIT.\n// Source of truth: descriptors.spaces.mjs\n// Family: spaces — Space management (the space-manager app) — UI_AS_APPS_SPEC §5.\n\nimport { invoke } from '../catalog';\n\n/** A collaborator's role on a shared space: full `owner`, read-write `writer`, or read-only `reader`. */\nexport type Role =\n  | 'owner'\n  | 'writer'\n  | 'reader';\n\n/** Summary of a space, as returned by {@link listSpaces}. */\nexport interface SpaceInfo {\n  spaceId: string;\n  role?: Role;\n  owner?: string;\n  name?: string;\n}\n\n/** A member of a space (for the share/manage UI). */\nexport interface Member {\n  /** The **grantee** — `user:{uid}` | `group:{gid}`. This is the canonical name (core_concepts §4: \"principal\" is reserved for the authority context; a space member is a *grantee*). The host populates this on every member row. */\n  grantee: string;\n  /** @deprecated Use {@link Member.grantee}. Kept as an alias (same value) for back-compat during the `principal`→`grantee` migration; will be removed in a future major. The host still populates both. */\n  principal: string;\n  role: Role;\n  login?: string;\n  avatarUrl?: string;\n}\n\n/** A handle resolved to a principal (handle → who). */\nexport interface ResolvedUser {\n  uid: string;\n  login: string;\n  avatarUrl?: string;\n}\n\n/** One durable grant an app holds, for the §8.11 capability audit view. */\nexport interface GrantRecord {\n  /** The app's provider-qualified **program** identity (AA-01 `appKey`). The DEFAULT program keys to the bare `provider__namespace__repository`; a NAMED mini-app appends a fourth `enc()`-escaped component (`provider__namespace__repository__name`) so its grants isolate from the repo's other programs. Host-supplied — the app never builds this key. */\n  appKey: string;\n  spaceId: string;\n  /** Universal mount id (§3.5). */\n  mountId: string;\n  subtree?: string;\n  mode: 'ro' | 'rw';\n  name?: string;\n}\n\nexport type ListSpacesError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * List spaces you can access — all of them, or just those bound to this app.\n *\n * Capability: `spaces:app`. Catalog name: `spaces:list`.\n * @throws `Error & { code: ListSpacesError }` on host refusal.\n */\nexport const listSpaces = (opts: { app?: boolean } = {}): Promise<SpaceInfo[]> =>\n  invoke<SpaceInfo[]>(\"spaces:list\", opts);\n\nexport type ListAllSpacesError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Enumerate ALL the user's spaces (not just this app's).\n *\n * Capability: `spaces:user`. Catalog name: `spaces:listAll`.\n * @throws `Error & { code: ListAllSpacesError }` on host refusal.\n */\nexport const listAllSpaces = (): Promise<SpaceInfo[]> =>\n  invoke<SpaceInfo[]>(\"spaces:listAll\", {});\n\nexport type GetSpaceMembersError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Read a space's members one-shot.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:members`.\n * @throws `Error & { code: GetSpaceMembersError }` on host refusal.\n */\nexport const getSpaceMembers = (spaceId: string): Promise<Member[]> =>\n  invoke<Member[]>(\"spaces:members\", { spaceId });\n\nexport type InviteToSpaceError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Invite a user (by provider handle) to a space at a role. The host resolves\n * the handle, so the app never sees other users' uids except the one it\n * invited. Pull-based (FILE_SHARING_SPEC §6.4): this writes an INVITATION,\n * not membership — the recipient must {@link acceptInvite}. Re-inviting an\n * already-invited/member user is idempotent.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:invite`.\n * @throws `Error & { code: InviteToSpaceError }` on host refusal.\n */\nexport const inviteToSpace = async (spaceId: string, login: string, role: Role): Promise<void> => { await invoke<void>(\"spaces:invite\", { spaceId, login, role }); };\n\nexport type UnshareSpaceError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown' | 'conflict';\n\n/**\n * Remove a member from a space. Refused if it would orphan the space\n * (owner-lockout, T41).\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:unshare`.\n * @throws `Error & { code: UnshareSpaceError }` on host refusal.\n */\nexport const unshareSpace = async (spaceId: string, uid: string): Promise<void> => { await invoke<void>(\"spaces:unshare\", { spaceId, uid }); };\n\nexport type SetSpaceRoleError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown' | 'conflict';\n\n/**\n * Change a member's role. Refused if it would drop the sole owner\n * (owner-lockout, T41).\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:setRole`.\n * @throws `Error & { code: SetSpaceRoleError }` on host refusal.\n */\nexport const setSpaceRole = async (spaceId: string, uid: string, role: Role): Promise<void> => { await invoke<void>(\"spaces:setRole\", { spaceId, uid, role }); };\n\nexport type LookupUserError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Resolve a provider handle to a principal (for the invite flow).\n * Rate-limited host-side.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:lookupUser`.\n * @throws `Error & { code: LookupUserError }` on host refusal.\n */\nexport const lookupUser = (login: string): Promise<ResolvedUser> =>\n  invoke<ResolvedUser>(\"spaces:lookupUser\", { login });\n\nexport type ListGrantsError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Enumerate every (app, mount) grant the user holds — the audit view\n * (§8.11). Elevated.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:grants`.\n * @throws `Error & { code: ListGrantsError }` on host refusal.\n */\nexport const listGrants = (): Promise<GrantRecord[]> =>\n  invoke<GrantRecord[]>(\"spaces:grants\", {});\n\nexport type RevokeGrantError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Revoke one app's grant on a space — durable (the app can't re-mount) plus\n * a best-effort live teardown. Elevated.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:revokeGrant`.\n * @throws `Error & { code: RevokeGrantError }` on host refusal.\n */\nexport const revokeGrant = async (appKey: string, spaceId: string): Promise<void> => { await invoke<void>(\"spaces:revokeGrant\", { appKey, spaceId }); };\n\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,qBAAuB;AAuDhB,MAAM,aAAa,CAAC,OAA0B,CAAC,UACpD,uBAAoB,eAAe,IAAI;AAWlC,MAAM,gBAAgB,UAC3B,uBAAoB,kBAAkB,CAAC,CAAC;AAWnC,MAAM,kBAAkB,CAAC,gBAC9B,uBAAiB,kBAAkB,EAAE,QAAQ,CAAC;AAezC,MAAM,gBAAgB,OAAO,SAAiB,OAAe,SAA8B;AAAE,YAAM,uBAAa,iBAAiB,EAAE,SAAS,OAAO,KAAK,CAAC;AAAG;AAY5J,MAAM,eAAe,OAAO,SAAiB,QAA+B;AAAE,YAAM,uBAAa,kBAAkB,EAAE,SAAS,IAAI,CAAC;AAAG;AAYtI,MAAM,eAAe,OAAO,SAAiB,KAAa,SAA8B;AAAE,YAAM,uBAAa,kBAAkB,EAAE,SAAS,KAAK,KAAK,CAAC;AAAG;AAYxJ,MAAM,aAAa,CAAC,cACzB,uBAAqB,qBAAqB,EAAE,MAAM,CAAC;AAY9C,MAAM,aAAa,UACxB,uBAAsB,iBAAiB,CAAC,CAAC;AAYpC,MAAM,cAAc,OAAO,QAAgB,YAAmC;AAAE,YAAM,uBAAa,sBAAsB,EAAE,QAAQ,QAAQ,CAAC;AAAG;","names":[]}

package/dist/generated/spaces.d.cts

@@ -0,0 +1,121 @@
+/** A collaborator's role on a shared space: full `owner`, read-write `writer`, or read-only `reader`. */
+type Role = 'owner' | 'writer' | 'reader';
+/** Summary of a space, as returned by {@link listSpaces}. */
+interface SpaceInfo {
+    spaceId: string;
+    role?: Role;
+    owner?: string;
+    name?: string;
+}
+/** A member of a space (for the share/manage UI). */
+interface Member {
+    /** The **grantee** — `user:{uid}` | `group:{gid}`. This is the canonical name (core_concepts §4: "principal" is reserved for the authority context; a space member is a *grantee*). The host populates this on every member row. */
+    grantee: string;
+    /** @deprecated Use {@link Member.grantee}. Kept as an alias (same value) for back-compat during the `principal`→`grantee` migration; will be removed in a future major. The host still populates both. */
+    principal: string;
+    role: Role;
+    login?: string;
+    avatarUrl?: string;
+}
+/** A handle resolved to a principal (handle → who). */
+interface ResolvedUser {
+    uid: string;
+    login: string;
+    avatarUrl?: string;
+}
+/** One durable grant an app holds, for the §8.11 capability audit view. */
+interface GrantRecord {
+    /** The app's provider-qualified **program** identity (AA-01 `appKey`). The DEFAULT program keys to the bare `provider__namespace__repository`; a NAMED mini-app appends a fourth `enc()`-escaped component (`provider__namespace__repository__name`) so its grants isolate from the repo's other programs. Host-supplied — the app never builds this key. */
+    appKey: string;
+    spaceId: string;
+    /** Universal mount id (§3.5). */
+    mountId: string;
+    subtree?: string;
+    mode: 'ro' | 'rw';
+    name?: string;
+}
+type ListSpacesError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * List spaces you can access — all of them, or just those bound to this app.
+ *
+ * Capability: `spaces:app`. Catalog name: `spaces:list`.
+ * @throws `Error & { code: ListSpacesError }` on host refusal.
+ */
+declare const listSpaces: (opts?: {
+    app?: boolean;
+}) => Promise<SpaceInfo[]>;
+type ListAllSpacesError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Enumerate ALL the user's spaces (not just this app's).
+ *
+ * Capability: `spaces:user`. Catalog name: `spaces:listAll`.
+ * @throws `Error & { code: ListAllSpacesError }` on host refusal.
+ */
+declare const listAllSpaces: () => Promise<SpaceInfo[]>;
+type GetSpaceMembersError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Read a space's members one-shot.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:members`.
+ * @throws `Error & { code: GetSpaceMembersError }` on host refusal.
+ */
+declare const getSpaceMembers: (spaceId: string) => Promise<Member[]>;
+type InviteToSpaceError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Invite a user (by provider handle) to a space at a role. The host resolves
+ * the handle, so the app never sees other users' uids except the one it
+ * invited. Pull-based (FILE_SHARING_SPEC §6.4): this writes an INVITATION,
+ * not membership — the recipient must {@link acceptInvite}. Re-inviting an
+ * already-invited/member user is idempotent.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:invite`.
+ * @throws `Error & { code: InviteToSpaceError }` on host refusal.
+ */
+declare const inviteToSpace: (spaceId: string, login: string, role: Role) => Promise<void>;
+type UnshareSpaceError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown' | 'conflict';
+/**
+ * Remove a member from a space. Refused if it would orphan the space
+ * (owner-lockout, T41).
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:unshare`.
+ * @throws `Error & { code: UnshareSpaceError }` on host refusal.
+ */
+declare const unshareSpace: (spaceId: string, uid: string) => Promise<void>;
+type SetSpaceRoleError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown' | 'conflict';
+/**
+ * Change a member's role. Refused if it would drop the sole owner
+ * (owner-lockout, T41).
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:setRole`.
+ * @throws `Error & { code: SetSpaceRoleError }` on host refusal.
+ */
+declare const setSpaceRole: (spaceId: string, uid: string, role: Role) => Promise<void>;
+type LookupUserError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Resolve a provider handle to a principal (for the invite flow).
+ * Rate-limited host-side.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:lookupUser`.
+ * @throws `Error & { code: LookupUserError }` on host refusal.
+ */
+declare const lookupUser: (login: string) => Promise<ResolvedUser>;
+type ListGrantsError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Enumerate every (app, mount) grant the user holds — the audit view
+ * (§8.11). Elevated.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:grants`.
+ * @throws `Error & { code: ListGrantsError }` on host refusal.
+ */
+declare const listGrants: () => Promise<GrantRecord[]>;
+type RevokeGrantError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Revoke one app's grant on a space — durable (the app can't re-mount) plus
+ * a best-effort live teardown. Elevated.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:revokeGrant`.
+ * @throws `Error & { code: RevokeGrantError }` on host refusal.
+ */
+declare const revokeGrant: (appKey: string, spaceId: string) => Promise<void>;
+
+export { type GetSpaceMembersError, type GrantRecord, type InviteToSpaceError, type ListAllSpacesError, type ListGrantsError, type ListSpacesError, type LookupUserError, type Member, type ResolvedUser, type RevokeGrantError, type Role, type SetSpaceRoleError, type SpaceInfo, type UnshareSpaceError, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace };

package/dist/generated/spaces.d.ts

@@ -0,0 +1,121 @@
+/** A collaborator's role on a shared space: full `owner`, read-write `writer`, or read-only `reader`. */
+type Role = 'owner' | 'writer' | 'reader';
+/** Summary of a space, as returned by {@link listSpaces}. */
+interface SpaceInfo {
+    spaceId: string;
+    role?: Role;
+    owner?: string;
+    name?: string;
+}
+/** A member of a space (for the share/manage UI). */
+interface Member {
+    /** The **grantee** — `user:{uid}` | `group:{gid}`. This is the canonical name (core_concepts §4: "principal" is reserved for the authority context; a space member is a *grantee*). The host populates this on every member row. */
+    grantee: string;
+    /** @deprecated Use {@link Member.grantee}. Kept as an alias (same value) for back-compat during the `principal`→`grantee` migration; will be removed in a future major. The host still populates both. */
+    principal: string;
+    role: Role;
+    login?: string;
+    avatarUrl?: string;
+}
+/** A handle resolved to a principal (handle → who). */
+interface ResolvedUser {
+    uid: string;
+    login: string;
+    avatarUrl?: string;
+}
+/** One durable grant an app holds, for the §8.11 capability audit view. */
+interface GrantRecord {
+    /** The app's provider-qualified **program** identity (AA-01 `appKey`). The DEFAULT program keys to the bare `provider__namespace__repository`; a NAMED mini-app appends a fourth `enc()`-escaped component (`provider__namespace__repository__name`) so its grants isolate from the repo's other programs. Host-supplied — the app never builds this key. */
+    appKey: string;
+    spaceId: string;
+    /** Universal mount id (§3.5). */
+    mountId: string;
+    subtree?: string;
+    mode: 'ro' | 'rw';
+    name?: string;
+}
+type ListSpacesError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * List spaces you can access — all of them, or just those bound to this app.
+ *
+ * Capability: `spaces:app`. Catalog name: `spaces:list`.
+ * @throws `Error & { code: ListSpacesError }` on host refusal.
+ */
+declare const listSpaces: (opts?: {
+    app?: boolean;
+}) => Promise<SpaceInfo[]>;
+type ListAllSpacesError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Enumerate ALL the user's spaces (not just this app's).
+ *
+ * Capability: `spaces:user`. Catalog name: `spaces:listAll`.
+ * @throws `Error & { code: ListAllSpacesError }` on host refusal.
+ */
+declare const listAllSpaces: () => Promise<SpaceInfo[]>;
+type GetSpaceMembersError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Read a space's members one-shot.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:members`.
+ * @throws `Error & { code: GetSpaceMembersError }` on host refusal.
+ */
+declare const getSpaceMembers: (spaceId: string) => Promise<Member[]>;
+type InviteToSpaceError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Invite a user (by provider handle) to a space at a role. The host resolves
+ * the handle, so the app never sees other users' uids except the one it
+ * invited. Pull-based (FILE_SHARING_SPEC §6.4): this writes an INVITATION,
+ * not membership — the recipient must {@link acceptInvite}. Re-inviting an
+ * already-invited/member user is idempotent.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:invite`.
+ * @throws `Error & { code: InviteToSpaceError }` on host refusal.
+ */
+declare const inviteToSpace: (spaceId: string, login: string, role: Role) => Promise<void>;
+type UnshareSpaceError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown' | 'conflict';
+/**
+ * Remove a member from a space. Refused if it would orphan the space
+ * (owner-lockout, T41).
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:unshare`.
+ * @throws `Error & { code: UnshareSpaceError }` on host refusal.
+ */
+declare const unshareSpace: (spaceId: string, uid: string) => Promise<void>;
+type SetSpaceRoleError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown' | 'conflict';
+/**
+ * Change a member's role. Refused if it would drop the sole owner
+ * (owner-lockout, T41).
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:setRole`.
+ * @throws `Error & { code: SetSpaceRoleError }` on host refusal.
+ */
+declare const setSpaceRole: (spaceId: string, uid: string, role: Role) => Promise<void>;
+type LookupUserError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Resolve a provider handle to a principal (for the invite flow).
+ * Rate-limited host-side.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:lookupUser`.
+ * @throws `Error & { code: LookupUserError }` on host refusal.
+ */
+declare const lookupUser: (login: string) => Promise<ResolvedUser>;
+type ListGrantsError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Enumerate every (app, mount) grant the user holds — the audit view
+ * (§8.11). Elevated.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:grants`.
+ * @throws `Error & { code: ListGrantsError }` on host refusal.
+ */
+declare const listGrants: () => Promise<GrantRecord[]>;
+type RevokeGrantError = 'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';
+/**
+ * Revoke one app's grant on a space — durable (the app can't re-mount) plus
+ * a best-effort live teardown. Elevated.
+ *
+ * Capability: `spaces:admin`. Catalog name: `spaces:revokeGrant`.
+ * @throws `Error & { code: RevokeGrantError }` on host refusal.
+ */
+declare const revokeGrant: (appKey: string, spaceId: string) => Promise<void>;
+
+export { type GetSpaceMembersError, type GrantRecord, type InviteToSpaceError, type ListAllSpacesError, type ListGrantsError, type ListSpacesError, type LookupUserError, type Member, type ResolvedUser, type RevokeGrantError, type Role, type SetSpaceRoleError, type SpaceInfo, type UnshareSpaceError, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace };

package/dist/generated/spaces.js

@@ -0,0 +1,31 @@
+import "../chunk-VHAA22YE.js";
+import { invoke } from "../catalog";
+const listSpaces = (opts = {}) => invoke("spaces:list", opts);
+const listAllSpaces = () => invoke("spaces:listAll", {});
+const getSpaceMembers = (spaceId) => invoke("spaces:members", { spaceId });
+const inviteToSpace = async (spaceId, login, role) => {
+  await invoke("spaces:invite", { spaceId, login, role });
+};
+const unshareSpace = async (spaceId, uid) => {
+  await invoke("spaces:unshare", { spaceId, uid });
+};
+const setSpaceRole = async (spaceId, uid, role) => {
+  await invoke("spaces:setRole", { spaceId, uid, role });
+};
+const lookupUser = (login) => invoke("spaces:lookupUser", { login });
+const listGrants = () => invoke("spaces:grants", {});
+const revokeGrant = async (appKey, spaceId) => {
+  await invoke("spaces:revokeGrant", { appKey, spaceId });
+};
+export {
+  getSpaceMembers,
+  inviteToSpace,
+  listAllSpaces,
+  listGrants,
+  listSpaces,
+  lookupUser,
+  revokeGrant,
+  setSpaceRole,
+  unshareSpace
+};
+//# sourceMappingURL=spaces.js.map

package/dist/generated/spaces.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/generated/spaces.ts"],"sourcesContent":["// GENERATED by scripts/codegen-prototype/generate.mjs — DO NOT EDIT.\n// Source of truth: descriptors.spaces.mjs\n// Family: spaces — Space management (the space-manager app) — UI_AS_APPS_SPEC §5.\n\nimport { invoke } from '../catalog';\n\n/** A collaborator's role on a shared space: full `owner`, read-write `writer`, or read-only `reader`. */\nexport type Role =\n  | 'owner'\n  | 'writer'\n  | 'reader';\n\n/** Summary of a space, as returned by {@link listSpaces}. */\nexport interface SpaceInfo {\n  spaceId: string;\n  role?: Role;\n  owner?: string;\n  name?: string;\n}\n\n/** A member of a space (for the share/manage UI). */\nexport interface Member {\n  /** The **grantee** — `user:{uid}` | `group:{gid}`. This is the canonical name (core_concepts §4: \"principal\" is reserved for the authority context; a space member is a *grantee*). The host populates this on every member row. */\n  grantee: string;\n  /** @deprecated Use {@link Member.grantee}. Kept as an alias (same value) for back-compat during the `principal`→`grantee` migration; will be removed in a future major. The host still populates both. */\n  principal: string;\n  role: Role;\n  login?: string;\n  avatarUrl?: string;\n}\n\n/** A handle resolved to a principal (handle → who). */\nexport interface ResolvedUser {\n  uid: string;\n  login: string;\n  avatarUrl?: string;\n}\n\n/** One durable grant an app holds, for the §8.11 capability audit view. */\nexport interface GrantRecord {\n  /** The app's provider-qualified **program** identity (AA-01 `appKey`). The DEFAULT program keys to the bare `provider__namespace__repository`; a NAMED mini-app appends a fourth `enc()`-escaped component (`provider__namespace__repository__name`) so its grants isolate from the repo's other programs. Host-supplied — the app never builds this key. */\n  appKey: string;\n  spaceId: string;\n  /** Universal mount id (§3.5). */\n  mountId: string;\n  subtree?: string;\n  mode: 'ro' | 'rw';\n  name?: string;\n}\n\nexport type ListSpacesError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * List spaces you can access — all of them, or just those bound to this app.\n *\n * Capability: `spaces:app`. Catalog name: `spaces:list`.\n * @throws `Error & { code: ListSpacesError }` on host refusal.\n */\nexport const listSpaces = (opts: { app?: boolean } = {}): Promise<SpaceInfo[]> =>\n  invoke<SpaceInfo[]>(\"spaces:list\", opts);\n\nexport type ListAllSpacesError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Enumerate ALL the user's spaces (not just this app's).\n *\n * Capability: `spaces:user`. Catalog name: `spaces:listAll`.\n * @throws `Error & { code: ListAllSpacesError }` on host refusal.\n */\nexport const listAllSpaces = (): Promise<SpaceInfo[]> =>\n  invoke<SpaceInfo[]>(\"spaces:listAll\", {});\n\nexport type GetSpaceMembersError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Read a space's members one-shot.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:members`.\n * @throws `Error & { code: GetSpaceMembersError }` on host refusal.\n */\nexport const getSpaceMembers = (spaceId: string): Promise<Member[]> =>\n  invoke<Member[]>(\"spaces:members\", { spaceId });\n\nexport type InviteToSpaceError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Invite a user (by provider handle) to a space at a role. The host resolves\n * the handle, so the app never sees other users' uids except the one it\n * invited. Pull-based (FILE_SHARING_SPEC §6.4): this writes an INVITATION,\n * not membership — the recipient must {@link acceptInvite}. Re-inviting an\n * already-invited/member user is idempotent.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:invite`.\n * @throws `Error & { code: InviteToSpaceError }` on host refusal.\n */\nexport const inviteToSpace = async (spaceId: string, login: string, role: Role): Promise<void> => { await invoke<void>(\"spaces:invite\", { spaceId, login, role }); };\n\nexport type UnshareSpaceError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown' | 'conflict';\n\n/**\n * Remove a member from a space. Refused if it would orphan the space\n * (owner-lockout, T41).\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:unshare`.\n * @throws `Error & { code: UnshareSpaceError }` on host refusal.\n */\nexport const unshareSpace = async (spaceId: string, uid: string): Promise<void> => { await invoke<void>(\"spaces:unshare\", { spaceId, uid }); };\n\nexport type SetSpaceRoleError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown' | 'conflict';\n\n/**\n * Change a member's role. Refused if it would drop the sole owner\n * (owner-lockout, T41).\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:setRole`.\n * @throws `Error & { code: SetSpaceRoleError }` on host refusal.\n */\nexport const setSpaceRole = async (spaceId: string, uid: string, role: Role): Promise<void> => { await invoke<void>(\"spaces:setRole\", { spaceId, uid, role }); };\n\nexport type LookupUserError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Resolve a provider handle to a principal (for the invite flow).\n * Rate-limited host-side.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:lookupUser`.\n * @throws `Error & { code: LookupUserError }` on host refusal.\n */\nexport const lookupUser = (login: string): Promise<ResolvedUser> =>\n  invoke<ResolvedUser>(\"spaces:lookupUser\", { login });\n\nexport type ListGrantsError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Enumerate every (app, mount) grant the user holds — the audit view\n * (§8.11). Elevated.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:grants`.\n * @throws `Error & { code: ListGrantsError }` on host refusal.\n */\nexport const listGrants = (): Promise<GrantRecord[]> =>\n  invoke<GrantRecord[]>(\"spaces:grants\", {});\n\nexport type RevokeGrantError =\n  'auth-required' | 'cancelled' | 'forbidden' | 'not-found' | 'unsupported-scheme' | 'unknown';\n\n/**\n * Revoke one app's grant on a space — durable (the app can't re-mount) plus\n * a best-effort live teardown. Elevated.\n *\n * Capability: `spaces:admin`. Catalog name: `spaces:revokeGrant`.\n * @throws `Error & { code: RevokeGrantError }` on host refusal.\n */\nexport const revokeGrant = async (appKey: string, spaceId: string): Promise<void> => { await invoke<void>(\"spaces:revokeGrant\", { appKey, spaceId }); };\n\n"],"mappings":";AAIA,SAAS,cAAc;AAuDhB,MAAM,aAAa,CAAC,OAA0B,CAAC,MACpD,OAAoB,eAAe,IAAI;AAWlC,MAAM,gBAAgB,MAC3B,OAAoB,kBAAkB,CAAC,CAAC;AAWnC,MAAM,kBAAkB,CAAC,YAC9B,OAAiB,kBAAkB,EAAE,QAAQ,CAAC;AAezC,MAAM,gBAAgB,OAAO,SAAiB,OAAe,SAA8B;AAAE,QAAM,OAAa,iBAAiB,EAAE,SAAS,OAAO,KAAK,CAAC;AAAG;AAY5J,MAAM,eAAe,OAAO,SAAiB,QAA+B;AAAE,QAAM,OAAa,kBAAkB,EAAE,SAAS,IAAI,CAAC;AAAG;AAYtI,MAAM,eAAe,OAAO,SAAiB,KAAa,SAA8B;AAAE,QAAM,OAAa,kBAAkB,EAAE,SAAS,KAAK,KAAK,CAAC;AAAG;AAYxJ,MAAM,aAAa,CAAC,UACzB,OAAqB,qBAAqB,EAAE,MAAM,CAAC;AAY9C,MAAM,aAAa,MACxB,OAAsB,iBAAiB,CAAC,CAAC;AAYpC,MAAM,cAAc,OAAO,QAAgB,YAAmC;AAAE,QAAM,OAAa,sBAAsB,EAAE,QAAQ,QAAQ,CAAC;AAAG;","names":[]}

package/dist/hooks.d.cts

@@ -1,6 +1,7 @@
 import { FsError } from './fs.cjs';
 import { SandboxMount } from './mounts.cjs';
 import { Metadata, FilesMetadata, MetadataQueryFunction, MetadataQueryResult } from './sandboxTypes.cjs';
+import './generated/spaces.cjs';
 import './tasks.cjs';
 
 /**

package/dist/hooks.d.ts

@@ -1,6 +1,7 @@
 import { FsError } from './fs.js';
 import { SandboxMount } from './mounts.js';
 import { Metadata, FilesMetadata, MetadataQueryFunction, MetadataQueryResult } from './sandboxTypes.js';
+import './generated/spaces.js';
 import './tasks.js';
 
 /**

package/dist/index.cjs

@@ -3,6 +3,10 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -14,11 +18,16 @@ var __copyProps = (to, from, except, desc) => {
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var index_exports = {};
+__export(index_exports, {
+  SafeInclude: () => import_SafeInclude.SafeInclude
+});
 module.exports = __toCommonJS(index_exports);
 __reExport(index_exports, require("./MDXProvider"), module.exports);
 __reExport(index_exports, require("./routing"), module.exports);
 __reExport(index_exports, require("./boot"), module.exports);
 __reExport(index_exports, require("./components/Include"), module.exports);
+var import_SafeInclude = require("./components/SafeInclude");
+__reExport(index_exports, require("./sourceCache"), module.exports);
 __reExport(index_exports, require("./components/MDXComponents"), module.exports);
 __reExport(index_exports, require("./components/MountImage"), module.exports);
 __reExport(index_exports, require("./components/Routes"), module.exports);
@@ -53,10 +62,12 @@ __reExport(index_exports, require("./sandboxTypes"), module.exports);
 __reExport(index_exports, require("./safeContent"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  SafeInclude,
   ...require("./MDXProvider"),
   ...require("./routing"),
   ...require("./boot"),
   ...require("./components/Include"),
+  ...require("./sourceCache"),
   ...require("./components/MDXComponents"),
   ...require("./components/MountImage"),
   ...require("./components/Routes"),

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\nexport * from './components/MDXComponents';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAIA,0BAAc,uCAJd;AAKA,0BAAc,oCALd;AAMA,0BAAc,gCANd;AAOA,0BAAc,oBAPd;AAQA,0BAAc,mBARd;AASA,0BAAc,oBATd;AAUA,0BAAc,4BAVd;AAWA,0BAAc,qBAXd;AAYA,0BAAc,yBAZd;AAaA,0BAAc,qBAbd;AAcA,0BAAc,qBAdd;AAeA,0BAAc,yBAfd;AAgBA,0BAAc,sBAhBd;AAiBA,0BAAc,kBAjBd;AAkBA,0BAAc,kBAlBd;AAmBA,0BAAc,uBAnBd;AAoBA,0BAAc,sBApBd;AAqBA,0BAAc,kBArBd;AAsBA,0BAAc,0BAtBd;AAuBA,0BAAc,kBAvBd;AAwBA,0BAAc,yBAxBd;AAyBA,0BAAc,iBAzBd;AA0BA,0BAAc,oBA1Bd;AA2BA,0BAAc,oBA3Bd;AA4BA,0BAAc,qBA5Bd;AA6BA,0BAAc,sBA7Bd;AA8BA,0BAAc,wBA9Bd;AA+BA,0BAAc,oBA/Bd;AAgCA,0BAAc,sBAhCd;AAiCA,0BAAc,6BAjCd;AAkCA,0BAAc,2BAlCd;AAmCA,0BAAc,0BAnCd;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,oCAXd;AAYA,0BAAc,gCAZd;AAaA,0BAAc,oBAbd;AAcA,0BAAc,mBAdd;AAeA,0BAAc,oBAfd;AAgBA,0BAAc,4BAhBd;AAiBA,0BAAc,qBAjBd;AAkBA,0BAAc,yBAlBd;AAmBA,0BAAc,qBAnBd;AAoBA,0BAAc,qBApBd;AAqBA,0BAAc,yBArBd;AAsBA,0BAAc,sBAtBd;AAuBA,0BAAc,kBAvBd;AAwBA,0BAAc,kBAxBd;AAyBA,0BAAc,uBAzBd;AA0BA,0BAAc,sBA1Bd;AA2BA,0BAAc,kBA3Bd;AA4BA,0BAAc,0BA5Bd;AA6BA,0BAAc,kBA7Bd;AA8BA,0BAAc,yBA9Bd;AA+BA,0BAAc,iBA/Bd;AAgCA,0BAAc,oBAhCd;AAiCA,0BAAc,oBAjCd;AAkCA,0BAAc,qBAlCd;AAmCA,0BAAc,sBAnCd;AAoCA,0BAAc,wBApCd;AAqCA,0BAAc,oBArCd;AAsCA,0BAAc,sBAtCd;AAuCA,0BAAc,6BAvCd;AAwCA,0BAAc,2BAxCd;AAyCA,0BAAc,0BAzCd;","names":[]}

package/dist/index.d.cts

@@ -1,7 +1,9 @@
 export { MDXProvider, useMDXComponents } from './MDXProvider.cjs';
 export { AppliedRoutingRule, Router, applyRoutingRule, navigate, renderRoute, useRoute, useRouteParams, useTinkerableLink } from './routing.cjs';
 export { BootProps, CATCH_ALL_ROUTING_SPEC, DEFAULT_ROUTING_SPEC, MdxComponents, TinkerableApp, boot, resolveMdxComponents } from './boot.cjs';
-export { Include, RenderExportedComponent, RenderExportedComponentContext, RenderFileContextType } from './components/Include.cjs';
+export { Include, RenderExportedComponent } from './components/Include.cjs';
+export { SafeInclude } from './components/SafeInclude.cjs';
+export { SourceCache, SourceReader, createSourceCache } from './sourceCache.cjs';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.cjs';
 export { MountImage, MountImageProps } from './components/MountImage.cjs';
 export { Route, RouteProps, Routes } from './components/Routes.cjs';
@@ -12,7 +14,7 @@ export { EditorContext, getEditorContext, onEditorContextChange, useEditorContex
 export { EditTarget, EditorOpenError, EditorSessionError, EditorWriteError, RequestEditError, closeFile, createFile, createFolder, deleteEntry, openInEditor, renameEntry, requestEdit, setActiveFile, uploadFile } from './editor.cjs';
 export { FormFactor, FormFactorClass, Orientation, getFormFactor, onFormFactorChange, useFormFactor } from './formFactor.cjs';
 export { getRegion, useRegion } from './region.cjs';
-export { GrantRecord, Invite, Member, MountQuery, MountRemoveReason, MountRule, RemovedMount, ResolvedUser, Role, SandboxMount, SessionMount, SpaceError, SpaceInfo, acceptInvite, awaitMatchingMount, createSpace, declineInvite, findMount, getAppMountPath, getInvites, getMounts, getSessionMounts, getSpaceMembers, importSettingsFromParent, inviteToSpace, listAllSpaces, listGrants, listMyInvites, listPendingInvites, listSettingsApps, listSpaces, lookupUser, makeContentRef, mount, mountSpace, onInvitesChange, onMountsChange, onSessionMountsChange, openSettings, openSettingsOf, requestMount, requestSpace, resolveContentRef, resolveContentRefs, revokeGrant, revokeInvite, setSpaceRole, unmountSpace, unshareSpace, useInvites, useMounts, useSessionMounts, waitForMount } from './mounts.cjs';
+export { Invite, MountQuery, MountRemoveReason, MountRule, RemovedMount, SandboxMount, SessionMount, SpaceError, acceptInvite, awaitMatchingMount, createSpace, declineInvite, findMount, getAppMountPath, getInvites, getMounts, getSessionMounts, importSettingsFromParent, listMyInvites, listPendingInvites, listSettingsApps, makeContentRef, mount, mountSpace, onInvitesChange, onMountsChange, onSessionMountsChange, openSettings, openSettingsOf, requestMount, requestSpace, resolveContentRef, resolveContentRefs, revokeInvite, unmountSpace, useInvites, useMounts, useSessionMounts, waitForMount } from './mounts.cjs';
 export { ContributeMode, ContributeOptions, ContributionEvent, ContributionResult, contribute } from './contribute.cjs';
 export { ApiMethod, getCatalog, invoke, invokeStream, onCatalogChange, useCatalog } from './catalog.cjs';
 export { RegionMessage, onRegionMessage, postToRegion, revealRegion, useRegionMessage } from './ipc.cjs';
@@ -39,8 +41,10 @@ export { ParseSafeMdastOptions, SafeMdastNode, SafeMdxAttribute, parseSafeMdast
 export { sanitizeUrl } from './safeContent/sanitizeUrl.cjs';
 export { WikiLinkToken, WikiPart, parseWikiInner, splitWikiLinks } from './safeContent/wikilink.cjs';
 export { Admonition, AdmonitionType } from './components/Admonition.cjs';
+export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.cjs';
 export { HeadingAnchor } from './components/HeadingAnchor.cjs';
 export { ImmediatelyRunGlobal, getHostRuntime } from './hostRuntime.cjs';
+export { IncludeMode, IncludeModeContext, RenderExportedComponentContext, RenderFileContextType } from './components/includeContexts.cjs';
 export { InternalLink, Link } from './components/Link.cjs';
 export { SDK_VERSION } from './version.cjs';
 export { WikiLink } from './components/WikiLink.cjs';