@immediately-run/sdk 0.39.0 → 0.41.0

package/dist/components/Include.cjs

@@ -19,8 +19,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var Include_exports = {};
 __export(Include_exports, {
   Include: () => Include,
+  IncludeModeContext: () => import_includeContexts2.IncludeModeContext,
   RenderExportedComponent: () => RenderExportedComponent,
-  RenderExportedComponentContext: () => RenderExportedComponentContext
+  RenderExportedComponentContext: () => import_includeContexts2.RenderExportedComponentContext
 });
 module.exports = __toCommonJS(Include_exports);
 var import_jsx_runtime = require("react/jsx-runtime");
@@ -28,29 +29,48 @@ var import_react = require("react");
 var import_react_error_boundary = require("react-error-boundary");
 var import_moduleCache = require("../moduleCache");
 var import_defaults = require("./defaults");
-const RenderExportedComponentContext = (0, import_react.createContext)(null);
+var import_includeContexts = require("./includeContexts");
+var import_SafeInclude = require("./SafeInclude");
+var import_includeContexts2 = require("./includeContexts");
 const RenderExportedComponent = ({
   evaluationContextPromise,
   exportedSymbol = "default"
 }) => {
   const evaluationContext = (0, import_react.use)(evaluationContextPromise);
   const Component = exportedSymbol === "*" ? evaluationContext.exports : evaluationContext.exports[exportedSymbol];
-  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RenderExportedComponentContext, { value: { evaluationContext }, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Component, {}) });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_includeContexts.RenderExportedComponentContext, { value: { evaluationContext }, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Component, {}) });
 };
 const Include = ({
   filename,
+  readSource,
   exportedSymbol = "default",
   LoadingComponent = import_defaults.defaultLoadingComponent,
   ErrorComponent = import_defaults.defaultErrorComponent,
-  baseModule
+  baseModule,
+  mode,
+  components
 }) => {
+  const contextMode = (0, import_react.use)(import_includeContexts.IncludeModeContext);
   const moduleCache = (0, import_react.use)(import_moduleCache.ModuleCacheContext);
+  if ((mode ?? contextMode) === "interpreted") {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      import_SafeInclude.SafeInclude,
+      {
+        filename,
+        components,
+        readSource,
+        LoadingComponent,
+        ErrorComponent
+      }
+    );
+  }
   const evaluationContextPromise = moduleCache.getEvaluationContext(filename, baseModule ?? module);
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_error_boundary.ErrorBoundary, { fallbackRender: ErrorComponent, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react.Suspense, { fallback: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoadingComponent, {}), children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RenderExportedComponent, { evaluationContextPromise, exportedSymbol }) }) });
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Include,
+  IncludeModeContext,
   RenderExportedComponent,
   RenderExportedComponentContext
 });

package/dist/components/Include.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/Include.tsx"],"sourcesContent":["import { Suspense, createContext, use } from 'react';\nimport { ErrorBoundary } from 'react-error-boundary';\n\nimport { ModuleCacheContext } from '../moduleCache';\nimport { EvaluationContext } from '../sandboxTypes';\nimport { defaultErrorComponent, defaultLoadingComponent } from './defaults';\n\n/** The value exposed on {@link RenderExportedComponentContext}: the evaluation\n *  context of the module {@link Include} resolved. */\nexport type RenderFileContextType = {\n  evaluationContext: EvaluationContext;\n};\n\n/** Context carrying the included module's {@link EvaluationContext} to its subtree. */\nexport const RenderExportedComponentContext = createContext<RenderFileContextType | null>(null);\n\n/** Low-level: render one export of an already-resolving module evaluation. Most\n *  code should use {@link Include}, which resolves the module and adds Suspense. */\nexport const RenderExportedComponent = ({\n  evaluationContextPromise,\n  exportedSymbol = 'default',\n}: {\n  evaluationContextPromise: Promise<EvaluationContext>;\n  exportedSymbol: string;\n}) => {\n  const evaluationContext = use(evaluationContextPromise);\n  // TODO: handle case where exported symbol not found.\n  const Component = exportedSymbol === '*' ? evaluationContext.exports : evaluationContext.exports[exportedSymbol];\n  return (\n    <RenderExportedComponentContext value={{ evaluationContext }}>\n      <Component />\n    </RenderExportedComponentContext>\n  );\n};\n\n/** Render another repo file's exported component inline, resolving + evaluating it\n *  through the module cache (with Suspense + an error boundary). */\nexport const Include = ({\n  filename,\n  exportedSymbol = 'default',\n  LoadingComponent = defaultLoadingComponent,\n  ErrorComponent = defaultErrorComponent,\n  baseModule,\n}: {\n  filename: string;\n  exportedSymbol?: string;\n  LoadingComponent?: typeof defaultLoadingComponent;\n  ErrorComponent?: typeof defaultErrorComponent;\n  baseModule?: EvaluationContext;\n}) => {\n  const moduleCache = use(ModuleCacheContext);\n  // @ts-ignore\n  const evaluationContextPromise = moduleCache!.getEvaluationContext(filename, baseModule ?? module);\n  return (\n    <ErrorBoundary fallbackRender={ErrorComponent}>\n      <Suspense fallback={<LoadingComponent />}>\n        <RenderExportedComponent evaluationContextPromise={evaluationContextPromise} exportedSymbol={exportedSymbol} />\n      </Suspense>\n    </ErrorBoundary>\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BM;AA9BN,mBAA6C;AAC7C,kCAA8B;AAE9B,yBAAmC;AAEnC,sBAA+D;AASxD,MAAM,qCAAiC,4BAA4C,IAAI;AAIvF,MAAM,0BAA0B,CAAC;AAAA,EACtC;AAAA,EACA,iBAAiB;AACnB,MAGM;AACJ,QAAM,wBAAoB,kBAAI,wBAAwB;AAEtD,QAAM,YAAY,mBAAmB,MAAM,kBAAkB,UAAU,kBAAkB,QAAQ,cAAc;AAC/G,SACE,4CAAC,kCAA+B,OAAO,EAAE,kBAAkB,GACzD,sDAAC,aAAU,GACb;AAEJ;AAIO,MAAM,UAAU,CAAC;AAAA,EACtB;AAAA,EACA,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB;AACF,MAMM;AACJ,QAAM,kBAAc,kBAAI,qCAAkB;AAE1C,QAAM,2BAA2B,YAAa,qBAAqB,UAAU,cAAc,MAAM;AACjG,SACE,4CAAC,6CAAc,gBAAgB,gBAC7B,sDAAC,yBAAS,UAAU,4CAAC,oBAAiB,GACpC,sDAAC,2BAAwB,0BAAoD,gBAAgC,GAC/G,GACF;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/components/Include.tsx"],"sourcesContent":["import { Suspense, use } from 'react';\nimport { ErrorBoundary } from 'react-error-boundary';\n\nimport { ModuleCacheContext } from '../moduleCache';\nimport { EvaluationContext } from '../sandboxTypes';\nimport { defaultErrorComponent, defaultLoadingComponent } from './defaults';\nimport { IncludeModeContext, RenderExportedComponentContext, type IncludeMode } from './includeContexts';\nimport { SafeInclude } from './SafeInclude';\nimport type { SourceReader } from '../sourceCache';\n\n// The contexts live in `./includeContexts` so `Include` and `SafeInclude` do not import each\n// other (`check:circular`); re-exported here because this is the public entry point and the\n// import path must not change.\nexport { IncludeModeContext, RenderExportedComponentContext } from './includeContexts';\nexport type { IncludeMode, RenderFileContextType } from './includeContexts';\n\n/** Low-level: render one export of an already-resolving module evaluation. Most\n *  code should use {@link Include}, which resolves the module and adds Suspense. */\nexport const RenderExportedComponent = ({\n  evaluationContextPromise,\n  exportedSymbol = 'default',\n}: {\n  evaluationContextPromise: Promise<EvaluationContext>;\n  exportedSymbol: string;\n}) => {\n  const evaluationContext = use(evaluationContextPromise);\n  // TODO: handle case where exported symbol not found.\n  const Component = exportedSymbol === '*' ? evaluationContext.exports : evaluationContext.exports[exportedSymbol];\n  return (\n    <RenderExportedComponentContext value={{ evaluationContext }}>\n      <Component />\n    </RenderExportedComponentContext>\n  );\n};\n\n/** Render another repo file's exported component inline, resolving + evaluating it\n *  through the module cache (with Suspense + an error boundary).\n *\n *  Under `mode=\"interpreted\"` (or inside an {@link IncludeModeContext} set to it) the file is\n *  instead rendered **as data** through the safe renderer — no author JavaScript executes,\n *  and the file need not be an evaluable module at all. */\nexport const Include = ({\n  filename,\n  readSource,\n  exportedSymbol = 'default',\n  LoadingComponent = defaultLoadingComponent,\n  ErrorComponent = defaultErrorComponent,\n  baseModule,\n  mode,\n  components,\n}: {\n  filename: string;\n  exportedSymbol?: string;\n  LoadingComponent?: typeof defaultLoadingComponent;\n  ErrorComponent?: typeof defaultErrorComponent;\n  baseModule?: EvaluationContext;\n  /** Override {@link IncludeModeContext} for this one include. */\n  mode?: IncludeMode;\n  /** Interpreted mode only: components merged OVER the surrounding MDXProvider map.\n   *\n   *  An app's SAFE component set is not always the same as the one it hands\n   *  `boot({ mdxComponents })`. Grove is the worked example: under the safe renderer it also\n   *  needs sanitizing wrappers for structural tags (`main`, `section`, …), and it must NOT\n   *  register those globally, because MDX consults the provider for intrinsics on the\n   *  COMPILED path too — so a global registration would silently strip `style` and other\n   *  non-allow-listed props from compiled authors who legitimately pass them. Ignored in\n   *  compiled mode, where components come from the provider as they always have. */\n  components?: Record<string, unknown>;\n  /** Interpreted mode only: read the raw bytes yourself — e.g. through a mount fs you\n   *  already hold, or a cache you share with the rest of your app. The default reader\n   *  handles both an app-source path and an absolute path in a mount, so this is for\n   *  control, not for reach. Ignored in compiled mode. */\n  readSource?: SourceReader;\n}) => {\n  // Both contexts are read unconditionally, before the branch, so hook order is stable\n  // whichever renderer this include resolves to.\n  const contextMode = use(IncludeModeContext);\n  const moduleCache = use(ModuleCacheContext);\n  // The prop wins over the context so a single file can opt out either way: an interpreter\n  // app including one trusted, executable component of its own, or a compiled app rendering\n  // one file it does not trust (the shape Grove's non-executable proof page needs).\n  if ((mode ?? contextMode) === 'interpreted') {\n    return (\n      <SafeInclude\n        filename={filename}\n        components={components}\n        readSource={readSource}\n        LoadingComponent={LoadingComponent}\n        ErrorComponent={ErrorComponent}\n      />\n    );\n  }\n  // @ts-ignore\n  const evaluationContextPromise = moduleCache!.getEvaluationContext(filename, baseModule ?? module);\n  return (\n    <ErrorBoundary fallbackRender={ErrorComponent}>\n      <Suspense fallback={<LoadingComponent />}>\n        <RenderExportedComponent evaluationContextPromise={evaluationContextPromise} exportedSymbol={exportedSymbol} />\n      </Suspense>\n    </ErrorBoundary>\n  );\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BM;AA9BN,mBAA8B;AAC9B,kCAA8B;AAE9B,yBAAmC;AAEnC,sBAA+D;AAC/D,6BAAqF;AACrF,yBAA4B;AAM5B,IAAAA,0BAAmE;AAK5D,MAAM,0BAA0B,CAAC;AAAA,EACtC;AAAA,EACA,iBAAiB;AACnB,MAGM;AACJ,QAAM,wBAAoB,kBAAI,wBAAwB;AAEtD,QAAM,YAAY,mBAAmB,MAAM,kBAAkB,UAAU,kBAAkB,QAAQ,cAAc;AAC/G,SACE,4CAAC,yDAA+B,OAAO,EAAE,kBAAkB,GACzD,sDAAC,aAAU,GACb;AAEJ;AAQO,MAAM,UAAU,CAAC;AAAA,EACtB;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AACF,MAuBM;AAGJ,QAAM,kBAAc,kBAAI,yCAAkB;AAC1C,QAAM,kBAAc,kBAAI,qCAAkB;AAI1C,OAAK,QAAQ,iBAAiB,eAAe;AAC3C,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,QAAM,2BAA2B,YAAa,qBAAqB,UAAU,cAAc,MAAM;AACjG,SACE,4CAAC,6CAAc,gBAAgB,gBAC7B,sDAAC,yBAAS,UAAU,4CAAC,oBAAiB,GACpC,sDAAC,2BAAwB,0BAAoD,gBAAgC,GAC/G,GACF;AAEJ;","names":["import_includeContexts"]}

package/dist/components/Include.d.cts

@@ -1,15 +1,11 @@
 import * as react from 'react';
 import { EvaluationContext } from '../sandboxTypes.cjs';
 import { defaultLoadingComponent, defaultErrorComponent } from './defaults.cjs';
+import { IncludeMode } from './includeContexts.cjs';
+export { IncludeModeContext, RenderExportedComponentContext, RenderFileContextType } from './includeContexts.cjs';
+import { SourceReader } from '../sourceCache.cjs';
 import 'react-error-boundary';
 
-/** The value exposed on {@link RenderExportedComponentContext}: the evaluation
- *  context of the module {@link Include} resolved. */
-type RenderFileContextType = {
-    evaluationContext: EvaluationContext;
-};
-/** Context carrying the included module's {@link EvaluationContext} to its subtree. */
-declare const RenderExportedComponentContext: react.Context<RenderFileContextType | null>;
 /** Low-level: render one export of an already-resolving module evaluation. Most
  *  code should use {@link Include}, which resolves the module and adds Suspense. */
 declare const RenderExportedComponent: ({ evaluationContextPromise, exportedSymbol, }: {
@@ -17,13 +13,34 @@ declare const RenderExportedComponent: ({ evaluationContextPromise, exportedSymb
     exportedSymbol: string;
 }) => react.JSX.Element;
 /** Render another repo file's exported component inline, resolving + evaluating it
- *  through the module cache (with Suspense + an error boundary). */
-declare const Include: ({ filename, exportedSymbol, LoadingComponent, ErrorComponent, baseModule, }: {
+ *  through the module cache (with Suspense + an error boundary).
+ *
+ *  Under `mode="interpreted"` (or inside an {@link IncludeModeContext} set to it) the file is
+ *  instead rendered **as data** through the safe renderer — no author JavaScript executes,
+ *  and the file need not be an evaluable module at all. */
+declare const Include: ({ filename, readSource, exportedSymbol, LoadingComponent, ErrorComponent, baseModule, mode, components, }: {
     filename: string;
     exportedSymbol?: string;
     LoadingComponent?: typeof defaultLoadingComponent;
     ErrorComponent?: typeof defaultErrorComponent;
     baseModule?: EvaluationContext;
+    /** Override {@link IncludeModeContext} for this one include. */
+    mode?: IncludeMode;
+    /** Interpreted mode only: components merged OVER the surrounding MDXProvider map.
+     *
+     *  An app's SAFE component set is not always the same as the one it hands
+     *  `boot({ mdxComponents })`. Grove is the worked example: under the safe renderer it also
+     *  needs sanitizing wrappers for structural tags (`main`, `section`, …), and it must NOT
+     *  register those globally, because MDX consults the provider for intrinsics on the
+     *  COMPILED path too — so a global registration would silently strip `style` and other
+     *  non-allow-listed props from compiled authors who legitimately pass them. Ignored in
+     *  compiled mode, where components come from the provider as they always have. */
+    components?: Record<string, unknown>;
+    /** Interpreted mode only: read the raw bytes yourself — e.g. through a mount fs you
+     *  already hold, or a cache you share with the rest of your app. The default reader
+     *  handles both an app-source path and an absolute path in a mount, so this is for
+     *  control, not for reach. Ignored in compiled mode. */
+    readSource?: SourceReader;
 }) => react.JSX.Element;
 
-export { Include, RenderExportedComponent, RenderExportedComponentContext, type RenderFileContextType };
+export { Include, IncludeMode, RenderExportedComponent };

package/dist/components/Include.d.ts

@@ -1,15 +1,11 @@
 import * as react from 'react';
 import { EvaluationContext } from '../sandboxTypes.js';
 import { defaultLoadingComponent, defaultErrorComponent } from './defaults.js';
+import { IncludeMode } from './includeContexts.js';
+export { IncludeModeContext, RenderExportedComponentContext, RenderFileContextType } from './includeContexts.js';
+import { SourceReader } from '../sourceCache.js';
 import 'react-error-boundary';
 
-/** The value exposed on {@link RenderExportedComponentContext}: the evaluation
- *  context of the module {@link Include} resolved. */
-type RenderFileContextType = {
-    evaluationContext: EvaluationContext;
-};
-/** Context carrying the included module's {@link EvaluationContext} to its subtree. */
-declare const RenderExportedComponentContext: react.Context<RenderFileContextType | null>;
 /** Low-level: render one export of an already-resolving module evaluation. Most
  *  code should use {@link Include}, which resolves the module and adds Suspense. */
 declare const RenderExportedComponent: ({ evaluationContextPromise, exportedSymbol, }: {
@@ -17,13 +13,34 @@ declare const RenderExportedComponent: ({ evaluationContextPromise, exportedSymb
     exportedSymbol: string;
 }) => react.JSX.Element;
 /** Render another repo file's exported component inline, resolving + evaluating it
- *  through the module cache (with Suspense + an error boundary). */
-declare const Include: ({ filename, exportedSymbol, LoadingComponent, ErrorComponent, baseModule, }: {
+ *  through the module cache (with Suspense + an error boundary).
+ *
+ *  Under `mode="interpreted"` (or inside an {@link IncludeModeContext} set to it) the file is
+ *  instead rendered **as data** through the safe renderer — no author JavaScript executes,
+ *  and the file need not be an evaluable module at all. */
+declare const Include: ({ filename, readSource, exportedSymbol, LoadingComponent, ErrorComponent, baseModule, mode, components, }: {
     filename: string;
     exportedSymbol?: string;
     LoadingComponent?: typeof defaultLoadingComponent;
     ErrorComponent?: typeof defaultErrorComponent;
     baseModule?: EvaluationContext;
+    /** Override {@link IncludeModeContext} for this one include. */
+    mode?: IncludeMode;
+    /** Interpreted mode only: components merged OVER the surrounding MDXProvider map.
+     *
+     *  An app's SAFE component set is not always the same as the one it hands
+     *  `boot({ mdxComponents })`. Grove is the worked example: under the safe renderer it also
+     *  needs sanitizing wrappers for structural tags (`main`, `section`, …), and it must NOT
+     *  register those globally, because MDX consults the provider for intrinsics on the
+     *  COMPILED path too — so a global registration would silently strip `style` and other
+     *  non-allow-listed props from compiled authors who legitimately pass them. Ignored in
+     *  compiled mode, where components come from the provider as they always have. */
+    components?: Record<string, unknown>;
+    /** Interpreted mode only: read the raw bytes yourself — e.g. through a mount fs you
+     *  already hold, or a cache you share with the rest of your app. The default reader
+     *  handles both an app-source path and an absolute path in a mount, so this is for
+     *  control, not for reach. Ignored in compiled mode. */
+    readSource?: SourceReader;
 }) => react.JSX.Element;
 
-export { Include, RenderExportedComponent, RenderExportedComponentContext, type RenderFileContextType };
+export { Include, IncludeMode, RenderExportedComponent };

package/dist/components/Include.js

@@ -1,10 +1,12 @@
 import "../chunk-VHAA22YE.js";
 import { jsx } from "react/jsx-runtime";
-import { Suspense, createContext, use } from "react";
+import { Suspense, use } from "react";
 import { ErrorBoundary } from "react-error-boundary";
 import { ModuleCacheContext } from "../moduleCache";
 import { defaultErrorComponent, defaultLoadingComponent } from "./defaults";
-const RenderExportedComponentContext = createContext(null);
+import { IncludeModeContext, RenderExportedComponentContext } from "./includeContexts";
+import { SafeInclude } from "./SafeInclude";
+import { IncludeModeContext as IncludeModeContext2, RenderExportedComponentContext as RenderExportedComponentContext2 } from "./includeContexts";
 const RenderExportedComponent = ({
   evaluationContextPromise,
   exportedSymbol = "default"
@@ -15,18 +17,35 @@ const RenderExportedComponent = ({
 };
 const Include = ({
   filename,
+  readSource,
   exportedSymbol = "default",
   LoadingComponent = defaultLoadingComponent,
   ErrorComponent = defaultErrorComponent,
-  baseModule
+  baseModule,
+  mode,
+  components
 }) => {
+  const contextMode = use(IncludeModeContext);
   const moduleCache = use(ModuleCacheContext);
+  if ((mode ?? contextMode) === "interpreted") {
+    return /* @__PURE__ */ jsx(
+      SafeInclude,
+      {
+        filename,
+        components,
+        readSource,
+        LoadingComponent,
+        ErrorComponent
+      }
+    );
+  }
   const evaluationContextPromise = moduleCache.getEvaluationContext(filename, baseModule ?? module);
   return /* @__PURE__ */ jsx(ErrorBoundary, { fallbackRender: ErrorComponent, children: /* @__PURE__ */ jsx(Suspense, { fallback: /* @__PURE__ */ jsx(LoadingComponent, {}), children: /* @__PURE__ */ jsx(RenderExportedComponent, { evaluationContextPromise, exportedSymbol }) }) });
 };
 export {
   Include,
+  IncludeModeContext2 as IncludeModeContext,
   RenderExportedComponent,
-  RenderExportedComponentContext
+  RenderExportedComponentContext2 as RenderExportedComponentContext
 };
 //# sourceMappingURL=Include.js.map

package/dist/components/Include.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/components/Include.tsx"],"sourcesContent":["import { Suspense, createContext, use } from 'react';\nimport { ErrorBoundary } from 'react-error-boundary';\n\nimport { ModuleCacheContext } from '../moduleCache';\nimport { EvaluationContext } from '../sandboxTypes';\nimport { defaultErrorComponent, defaultLoadingComponent } from './defaults';\n\n/** The value exposed on {@link RenderExportedComponentContext}: the evaluation\n *  context of the module {@link Include} resolved. */\nexport type RenderFileContextType = {\n  evaluationContext: EvaluationContext;\n};\n\n/** Context carrying the included module's {@link EvaluationContext} to its subtree. */\nexport const RenderExportedComponentContext = createContext<RenderFileContextType | null>(null);\n\n/** Low-level: render one export of an already-resolving module evaluation. Most\n *  code should use {@link Include}, which resolves the module and adds Suspense. */\nexport const RenderExportedComponent = ({\n  evaluationContextPromise,\n  exportedSymbol = 'default',\n}: {\n  evaluationContextPromise: Promise<EvaluationContext>;\n  exportedSymbol: string;\n}) => {\n  const evaluationContext = use(evaluationContextPromise);\n  // TODO: handle case where exported symbol not found.\n  const Component = exportedSymbol === '*' ? evaluationContext.exports : evaluationContext.exports[exportedSymbol];\n  return (\n    <RenderExportedComponentContext value={{ evaluationContext }}>\n      <Component />\n    </RenderExportedComponentContext>\n  );\n};\n\n/** Render another repo file's exported component inline, resolving + evaluating it\n *  through the module cache (with Suspense + an error boundary). */\nexport const Include = ({\n  filename,\n  exportedSymbol = 'default',\n  LoadingComponent = defaultLoadingComponent,\n  ErrorComponent = defaultErrorComponent,\n  baseModule,\n}: {\n  filename: string;\n  exportedSymbol?: string;\n  LoadingComponent?: typeof defaultLoadingComponent;\n  ErrorComponent?: typeof defaultErrorComponent;\n  baseModule?: EvaluationContext;\n}) => {\n  const moduleCache = use(ModuleCacheContext);\n  // @ts-ignore\n  const evaluationContextPromise = moduleCache!.getEvaluationContext(filename, baseModule ?? module);\n  return (\n    <ErrorBoundary fallbackRender={ErrorComponent}>\n      <Suspense fallback={<LoadingComponent />}>\n        <RenderExportedComponent evaluationContextPromise={evaluationContextPromise} exportedSymbol={exportedSymbol} />\n      </Suspense>\n    </ErrorBoundary>\n  );\n};\n"],"mappings":";AA8BM;AA9BN,SAAS,UAAU,eAAe,WAAW;AAC7C,SAAS,qBAAqB;AAE9B,SAAS,0BAA0B;AAEnC,SAAS,uBAAuB,+BAA+B;AASxD,MAAM,iCAAiC,cAA4C,IAAI;AAIvF,MAAM,0BAA0B,CAAC;AAAA,EACtC;AAAA,EACA,iBAAiB;AACnB,MAGM;AACJ,QAAM,oBAAoB,IAAI,wBAAwB;AAEtD,QAAM,YAAY,mBAAmB,MAAM,kBAAkB,UAAU,kBAAkB,QAAQ,cAAc;AAC/G,SACE,oBAAC,kCAA+B,OAAO,EAAE,kBAAkB,GACzD,8BAAC,aAAU,GACb;AAEJ;AAIO,MAAM,UAAU,CAAC;AAAA,EACtB;AAAA,EACA,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB;AACF,MAMM;AACJ,QAAM,cAAc,IAAI,kBAAkB;AAE1C,QAAM,2BAA2B,YAAa,qBAAqB,UAAU,cAAc,MAAM;AACjG,SACE,oBAAC,iBAAc,gBAAgB,gBAC7B,8BAAC,YAAS,UAAU,oBAAC,oBAAiB,GACpC,8BAAC,2BAAwB,0BAAoD,gBAAgC,GAC/G,GACF;AAEJ;","names":[]}
+{"version":3,"sources":["../../src/components/Include.tsx"],"sourcesContent":["import { Suspense, use } from 'react';\nimport { ErrorBoundary } from 'react-error-boundary';\n\nimport { ModuleCacheContext } from '../moduleCache';\nimport { EvaluationContext } from '../sandboxTypes';\nimport { defaultErrorComponent, defaultLoadingComponent } from './defaults';\nimport { IncludeModeContext, RenderExportedComponentContext, type IncludeMode } from './includeContexts';\nimport { SafeInclude } from './SafeInclude';\nimport type { SourceReader } from '../sourceCache';\n\n// The contexts live in `./includeContexts` so `Include` and `SafeInclude` do not import each\n// other (`check:circular`); re-exported here because this is the public entry point and the\n// import path must not change.\nexport { IncludeModeContext, RenderExportedComponentContext } from './includeContexts';\nexport type { IncludeMode, RenderFileContextType } from './includeContexts';\n\n/** Low-level: render one export of an already-resolving module evaluation. Most\n *  code should use {@link Include}, which resolves the module and adds Suspense. */\nexport const RenderExportedComponent = ({\n  evaluationContextPromise,\n  exportedSymbol = 'default',\n}: {\n  evaluationContextPromise: Promise<EvaluationContext>;\n  exportedSymbol: string;\n}) => {\n  const evaluationContext = use(evaluationContextPromise);\n  // TODO: handle case where exported symbol not found.\n  const Component = exportedSymbol === '*' ? evaluationContext.exports : evaluationContext.exports[exportedSymbol];\n  return (\n    <RenderExportedComponentContext value={{ evaluationContext }}>\n      <Component />\n    </RenderExportedComponentContext>\n  );\n};\n\n/** Render another repo file's exported component inline, resolving + evaluating it\n *  through the module cache (with Suspense + an error boundary).\n *\n *  Under `mode=\"interpreted\"` (or inside an {@link IncludeModeContext} set to it) the file is\n *  instead rendered **as data** through the safe renderer — no author JavaScript executes,\n *  and the file need not be an evaluable module at all. */\nexport const Include = ({\n  filename,\n  readSource,\n  exportedSymbol = 'default',\n  LoadingComponent = defaultLoadingComponent,\n  ErrorComponent = defaultErrorComponent,\n  baseModule,\n  mode,\n  components,\n}: {\n  filename: string;\n  exportedSymbol?: string;\n  LoadingComponent?: typeof defaultLoadingComponent;\n  ErrorComponent?: typeof defaultErrorComponent;\n  baseModule?: EvaluationContext;\n  /** Override {@link IncludeModeContext} for this one include. */\n  mode?: IncludeMode;\n  /** Interpreted mode only: components merged OVER the surrounding MDXProvider map.\n   *\n   *  An app's SAFE component set is not always the same as the one it hands\n   *  `boot({ mdxComponents })`. Grove is the worked example: under the safe renderer it also\n   *  needs sanitizing wrappers for structural tags (`main`, `section`, …), and it must NOT\n   *  register those globally, because MDX consults the provider for intrinsics on the\n   *  COMPILED path too — so a global registration would silently strip `style` and other\n   *  non-allow-listed props from compiled authors who legitimately pass them. Ignored in\n   *  compiled mode, where components come from the provider as they always have. */\n  components?: Record<string, unknown>;\n  /** Interpreted mode only: read the raw bytes yourself — e.g. through a mount fs you\n   *  already hold, or a cache you share with the rest of your app. The default reader\n   *  handles both an app-source path and an absolute path in a mount, so this is for\n   *  control, not for reach. Ignored in compiled mode. */\n  readSource?: SourceReader;\n}) => {\n  // Both contexts are read unconditionally, before the branch, so hook order is stable\n  // whichever renderer this include resolves to.\n  const contextMode = use(IncludeModeContext);\n  const moduleCache = use(ModuleCacheContext);\n  // The prop wins over the context so a single file can opt out either way: an interpreter\n  // app including one trusted, executable component of its own, or a compiled app rendering\n  // one file it does not trust (the shape Grove's non-executable proof page needs).\n  if ((mode ?? contextMode) === 'interpreted') {\n    return (\n      <SafeInclude\n        filename={filename}\n        components={components}\n        readSource={readSource}\n        LoadingComponent={LoadingComponent}\n        ErrorComponent={ErrorComponent}\n      />\n    );\n  }\n  // @ts-ignore\n  const evaluationContextPromise = moduleCache!.getEvaluationContext(filename, baseModule ?? module);\n  return (\n    <ErrorBoundary fallbackRender={ErrorComponent}>\n      <Suspense fallback={<LoadingComponent />}>\n        <RenderExportedComponent evaluationContextPromise={evaluationContextPromise} exportedSymbol={exportedSymbol} />\n      </Suspense>\n    </ErrorBoundary>\n  );\n};\n"],"mappings":";AA8BM;AA9BN,SAAS,UAAU,WAAW;AAC9B,SAAS,qBAAqB;AAE9B,SAAS,0BAA0B;AAEnC,SAAS,uBAAuB,+BAA+B;AAC/D,SAAS,oBAAoB,sCAAwD;AACrF,SAAS,mBAAmB;AAM5B,SAAS,sBAAAA,qBAAoB,kCAAAC,uCAAsC;AAK5D,MAAM,0BAA0B,CAAC;AAAA,EACtC;AAAA,EACA,iBAAiB;AACnB,MAGM;AACJ,QAAM,oBAAoB,IAAI,wBAAwB;AAEtD,QAAM,YAAY,mBAAmB,MAAM,kBAAkB,UAAU,kBAAkB,QAAQ,cAAc;AAC/G,SACE,oBAAC,kCAA+B,OAAO,EAAE,kBAAkB,GACzD,8BAAC,aAAU,GACb;AAEJ;AAQO,MAAM,UAAU,CAAC;AAAA,EACtB;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AACF,MAuBM;AAGJ,QAAM,cAAc,IAAI,kBAAkB;AAC1C,QAAM,cAAc,IAAI,kBAAkB;AAI1C,OAAK,QAAQ,iBAAiB,eAAe;AAC3C,WACE;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,IACF;AAAA,EAEJ;AAEA,QAAM,2BAA2B,YAAa,qBAAqB,UAAU,cAAc,MAAM;AACjG,SACE,oBAAC,iBAAc,gBAAgB,gBAC7B,8BAAC,YAAS,UAAU,oBAAC,oBAAiB,GACpC,8BAAC,2BAAwB,0BAAoD,gBAAgC,GAC/G,GACF;AAEJ;","names":["IncludeModeContext","RenderExportedComponentContext"]}

package/dist/components/SafeInclude.cjs

@@ -0,0 +1,103 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var SafeInclude_exports = {};
+__export(SafeInclude_exports, {
+  SafeInclude: () => SafeInclude,
+  appMountRelative: () => appMountRelative,
+  isForeignMountPath: () => isForeignMountPath,
+  stripFrontmatter: () => stripFrontmatter
+});
+module.exports = __toCommonJS(SafeInclude_exports);
+var import_jsx_runtime = require("react/jsx-runtime");
+var import_react = require("react");
+var import_react_error_boundary = require("react-error-boundary");
+var import_fs = require("../fs");
+var import_mounts = require("../mounts");
+var import_MDXProvider = require("../MDXProvider");
+var import_SafeContent = require("../safeContent/SafeContent");
+var import_sourceCache = require("../sourceCache");
+var import_includeContexts = require("./includeContexts");
+var import_defaults = require("./defaults");
+function stripFrontmatter(source) {
+  return source.replace(/^\uFEFF?---\r?\n[\s\S]*?\r?\n---[ \t]*\r?\n?/, "");
+}
+function appMountRelative(filename) {
+  const root = (0, import_mounts.getAppMountPath)().replace(/\/+$/, "");
+  const abs = filename.startsWith(root + "/") ? filename.slice(root.length) : filename;
+  return abs.replace(/^\/+/, "");
+}
+function isForeignMountPath(filename) {
+  if (!filename.startsWith("/")) return false;
+  const root = (0, import_mounts.getAppMountPath)().replace(/\/+$/, "");
+  return !filename.startsWith(`${root}/`) && filename !== root;
+}
+function readInterpretedSource(filename) {
+  if (isForeignMountPath(filename)) {
+    return (0, import_fs.openFs)({ path: "/", type: "mount" }).readFile(
+      filename.replace(/^\/+/, ""),
+      "utf8"
+    );
+  }
+  return (0, import_fs.openAppFs)().readFile(appMountRelative(filename), "utf8");
+}
+const defaultSources = (0, import_sourceCache.createSourceCache)(readInterpretedSource);
+function InterpretedBody({
+  filename,
+  components,
+  readSource
+}) {
+  const sources = (0, import_react.useMemo)(
+    () => readSource ? (0, import_sourceCache.createSourceCache)(readSource) : defaultSources,
+    [readSource]
+  );
+  const raw = (0, import_react.use)(sources.read(filename));
+  const provided = (0, import_MDXProvider.useMDXComponents)(components);
+  const body = stripFrontmatter(raw);
+  return (
+    // Publishing the included file's path is what lets the WikiLink resolver know which file
+    // a relative `[[target]]` (and its `#sec-…` fragment) is relative TO — the same context
+    // the compiled path publishes from the module's evaluation.
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+      import_includeContexts.RenderExportedComponentContext,
+      {
+        value: { evaluationContext: { evaluation: { module: { filepath: filename } } } },
+        children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_SafeContent.SafeContent, { source: body, components: provided })
+      }
+    )
+  );
+}
+const SafeInclude = ({
+  filename,
+  components,
+  readSource,
+  LoadingComponent = import_defaults.defaultLoadingComponent,
+  ErrorComponent = import_defaults.defaultErrorComponent
+}) => (
+  // Same boundary shape as the compiled path: a file that fails to read renders the error
+  // component rather than taking down the tree that included it.
+  /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react_error_boundary.ErrorBoundary, { fallbackRender: ErrorComponent, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react.Suspense, { fallback: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoadingComponent, {}), children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(InterpretedBody, { filename, components, readSource }) }) })
+);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SafeInclude,
+  appMountRelative,
+  isForeignMountPath,
+  stripFrontmatter
+});
+//# sourceMappingURL=SafeInclude.cjs.map

package/dist/components/SafeInclude.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/SafeInclude.tsx"],"sourcesContent":["import { Suspense, use, useMemo } from 'react';\nimport { ErrorBoundary } from 'react-error-boundary';\n\nimport { openAppFs, openFs } from '../fs';\nimport { getAppMountPath } from '../mounts';\nimport { useMDXComponents } from '../MDXProvider';\nimport { SafeContent } from '../safeContent/SafeContent';\nimport { createSourceCache, type SourceReader } from '../sourceCache';\nimport { RenderExportedComponentContext } from './includeContexts';\nimport { defaultErrorComponent, defaultLoadingComponent } from './defaults';\n\n// `<Include mode=\"interpreted\">` — the same tag, the NON-EXECUTABLE renderer. (R3-263)\n//\n// WHY THIS EXISTS. `<Include>` resolves a file through the module cache and *evaluates* it,\n// which is right for an app's own source and wrong for content. An interpreter app\n// (TRUST_MODES_SPEC §5) had no way to say \"include this file, but as data\": it could render\n// its own bodies through `<SafeContent>` while any file it pulled in with `<Include>` still\n// executed. Grove hit exactly that — a wiki declaring `render: safe` still ran author\n// JavaScript out of its `_layout.mdx`, because the layout chain went through `<Include>`.\n//\n// It is also what makes such a file renderable AT ALL when it does not live in the app: the\n// compiled path evaluates an app-source module, which a file resident in a content mount is\n// not. That is the `AGENT_AUTHORING §10` MDX-from-mount gate, which `TRUST_MODES §5.1` says\n// MUST terminate in the safe renderer and never in compiled MDX.\n//\n// The component map comes from `useMDXComponents` — the SAME provider map `boot({\n// mdxComponents })` establishes for the compiled path — so a document resolves the identical\n// vocabulary under either renderer and an app wires nothing extra to get it.\n\n/** Strip a leading YAML frontmatter block (and an optional BOM). The compiled path never\n *  renders frontmatter — the MDX loader consumes it — so the safe path must not either, or\n *  the same file gains a wall of raw YAML when the renderer changes. */\nexport function stripFrontmatter(source: string): string {\n  return source.replace(/^\\uFEFF?---\\r?\\n[\\s\\S]*?\\r?\\n---[ \\t]*\\r?\\n?/, '');\n}\n\n/** `/app/content/x.mdx` → `content/x.mdx`. {@link openAppFs} is anchored at the app mount,\n *  so an absolute module path has to be made mount-relative before it is read. A path that\n *  is already relative is passed through untouched. */\nexport function appMountRelative(filename: string): string {\n  const root = getAppMountPath().replace(/\\/+$/, '');\n  const abs = filename.startsWith(root + '/') ? filename.slice(root.length) : filename;\n  return abs.replace(/^\\/+/, '');\n}\n\n/** Is this an absolute path that lies OUTSIDE this app's own repo mount — i.e. a file\n *  resident in a content mount rather than in the app? */\nexport function isForeignMountPath(filename: string): boolean {\n  if (!filename.startsWith('/')) return false;\n  const root = getAppMountPath().replace(/\\/+$/, '');\n  return !filename.startsWith(`${root}/`) && filename !== root;\n}\n\n/**\n * Read an interpreted include's bytes.\n *\n * The reason this is not just `openAppFs()`: **the whole point of the interpreted include\n * is files the app did not author**, and the two consumers named in this file's header —\n * a dispatched wiki's `_layout.mdx`, a whiteboard object body — live in a MOUNT. An\n * app-anchored read cannot reach them, and it does not fail loudly either: the absolute\n * path is stripped to a relative one and looked up *inside the app*, so\n * `/task/<slot>/dir/_layout.mdx` becomes a miss at `task/<slot>/dir/_layout.mdx` in the\n * app's own tree. A silent wrong-file lookup, in the component whose job is rendering\n * other people's content.\n *\n * So: a path under the app mount reads exactly as before, and an absolute path outside it\n * — which could only ever have failed — reads from the unified sandbox namespace, where\n * every mount is addressable. This widens what resolves and changes nothing that resolved.\n */\nfunction readInterpretedSource(filename: string): Promise<string> {\n  if (isForeignMountPath(filename)) {\n    // Anchored at the namespace root: mounts are addressable by their absolute paths, and\n    // this component has no way to know (and no need to know) which mount a path belongs\n    // to. It confers nothing — the ZenFS port is already chroot/`ro`-enforced host-side.\n    return openFs({ path: '/', type: 'mount' } as never).readFile(\n      filename.replace(/^\\/+/, ''),\n      'utf8',\n    ) as Promise<string>;\n  }\n  return openAppFs().readFile(appMountRelative(filename), 'utf8') as Promise<string>;\n}\n\n// One cache for every interpreted include in the app: a layout file is included on every\n// page, so a per-component cache would re-read it per navigation. See `../sourceCache` for\n// why a REJECTED read must not be memoised.\nconst defaultSources = createSourceCache(readInterpretedSource);\n\nfunction InterpretedBody({\n  filename,\n  components,\n  readSource,\n}: {\n  filename: string;\n  components?: Record<string, unknown>;\n  readSource?: SourceReader;\n}) {\n  // A caller-supplied reader gets its own cache; the shared one is used otherwise. Memoised\n  // on the reader identity so `use()` still sees a stable promise across renders.\n  const sources = useMemo(\n    () => (readSource ? createSourceCache(readSource) : defaultSources),\n    [readSource],\n  );\n  const raw = use(sources.read(filename));\n  const provided = useMDXComponents(components) as Record<string, unknown>;\n  const body = stripFrontmatter(raw);\n  return (\n    // Publishing the included file's path is what lets the WikiLink resolver know which file\n    // a relative `[[target]]` (and its `#sec-…` fragment) is relative TO — the same context\n    // the compiled path publishes from the module's evaluation.\n    <RenderExportedComponentContext\n      value={{ evaluationContext: { evaluation: { module: { filepath: filename } } } } as never}\n    >\n      <SafeContent source={body} components={provided as never} />\n    </RenderExportedComponentContext>\n  );\n}\n\n/** Render another file's Markdown/MDX **as data** — no author JavaScript executes. Reached\n *  via `<Include mode=\"interpreted\">` or `<IncludeModeContext value=\"interpreted\">`. */\nexport const SafeInclude = ({\n  filename,\n  components,\n  readSource,\n  LoadingComponent = defaultLoadingComponent,\n  ErrorComponent = defaultErrorComponent,\n}: {\n  filename: string;\n  /** Extra/override components, merged OVER the surrounding MDXProvider map. */\n  components?: Record<string, unknown>;\n  /** Read the raw bytes yourself — e.g. from a content mount rather than the app repo. */\n  readSource?: SourceReader;\n  LoadingComponent?: typeof defaultLoadingComponent;\n  ErrorComponent?: typeof defaultErrorComponent;\n}) => (\n  // Same boundary shape as the compiled path: a file that fails to read renders the error\n  // component rather than taking down the tree that included it.\n  <ErrorBoundary fallbackRender={ErrorComponent}>\n    <Suspense fallback={<LoadingComponent />}>\n      <InterpretedBody filename={filename} components={components} readSource={readSource} />\n    </Suspense>\n  </ErrorBoundary>\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgHM;AAhHN,mBAAuC;AACvC,kCAA8B;AAE9B,gBAAkC;AAClC,oBAAgC;AAChC,yBAAiC;AACjC,yBAA4B;AAC5B,yBAAqD;AACrD,6BAA+C;AAC/C,sBAA+D;AAuBxD,SAAS,iBAAiB,QAAwB;AACvD,SAAO,OAAO,QAAQ,gDAAgD,EAAE;AAC1E;AAKO,SAAS,iBAAiB,UAA0B;AACzD,QAAM,WAAO,+BAAgB,EAAE,QAAQ,QAAQ,EAAE;AACjD,QAAM,MAAM,SAAS,WAAW,OAAO,GAAG,IAAI,SAAS,MAAM,KAAK,MAAM,IAAI;AAC5E,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAIO,SAAS,mBAAmB,UAA2B;AAC5D,MAAI,CAAC,SAAS,WAAW,GAAG,EAAG,QAAO;AACtC,QAAM,WAAO,+BAAgB,EAAE,QAAQ,QAAQ,EAAE;AACjD,SAAO,CAAC,SAAS,WAAW,GAAG,IAAI,GAAG,KAAK,aAAa;AAC1D;AAkBA,SAAS,sBAAsB,UAAmC;AAChE,MAAI,mBAAmB,QAAQ,GAAG;AAIhC,eAAO,kBAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,CAAU,EAAE;AAAA,MACnD,SAAS,QAAQ,QAAQ,EAAE;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,aAAO,qBAAU,EAAE,SAAS,iBAAiB,QAAQ,GAAG,MAAM;AAChE;AAKA,MAAM,qBAAiB,sCAAkB,qBAAqB;AAE9D,SAAS,gBAAgB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AACF,GAIG;AAGD,QAAM,cAAU;AAAA,IACd,MAAO,iBAAa,sCAAkB,UAAU,IAAI;AAAA,IACpD,CAAC,UAAU;AAAA,EACb;AACA,QAAM,UAAM,kBAAI,QAAQ,KAAK,QAAQ,CAAC;AACtC,QAAM,eAAW,qCAAiB,UAAU;AAC5C,QAAM,OAAO,iBAAiB,GAAG;AACjC;AAAA;AAAA;AAAA;AAAA,IAIE;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,SAAS,EAAE,EAAE,EAAE;AAAA,QAE/E,sDAAC,kCAAY,QAAQ,MAAM,YAAY,UAAmB;AAAA;AAAA,IAC5D;AAAA;AAEJ;AAIO,MAAM,cAAc,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB,iBAAiB;AACnB;AAAA;AAAA;AAAA,EAWE,4CAAC,6CAAc,gBAAgB,gBAC7B,sDAAC,yBAAS,UAAU,4CAAC,oBAAiB,GACpC,sDAAC,mBAAgB,UAAoB,YAAwB,YAAwB,GACvF,GACF;AAAA;","names":[]}

package/dist/components/SafeInclude.d.cts

@@ -0,0 +1,29 @@
+import * as react from 'react';
+import { SourceReader } from '../sourceCache.cjs';
+import { defaultLoadingComponent, defaultErrorComponent } from './defaults.cjs';
+import 'react-error-boundary';
+
+/** Strip a leading YAML frontmatter block (and an optional BOM). The compiled path never
+ *  renders frontmatter — the MDX loader consumes it — so the safe path must not either, or
+ *  the same file gains a wall of raw YAML when the renderer changes. */
+declare function stripFrontmatter(source: string): string;
+/** `/app/content/x.mdx` → `content/x.mdx`. {@link openAppFs} is anchored at the app mount,
+ *  so an absolute module path has to be made mount-relative before it is read. A path that
+ *  is already relative is passed through untouched. */
+declare function appMountRelative(filename: string): string;
+/** Is this an absolute path that lies OUTSIDE this app's own repo mount — i.e. a file
+ *  resident in a content mount rather than in the app? */
+declare function isForeignMountPath(filename: string): boolean;
+/** Render another file's Markdown/MDX **as data** — no author JavaScript executes. Reached
+ *  via `<Include mode="interpreted">` or `<IncludeModeContext value="interpreted">`. */
+declare const SafeInclude: ({ filename, components, readSource, LoadingComponent, ErrorComponent, }: {
+    filename: string;
+    /** Extra/override components, merged OVER the surrounding MDXProvider map. */
+    components?: Record<string, unknown>;
+    /** Read the raw bytes yourself — e.g. from a content mount rather than the app repo. */
+    readSource?: SourceReader;
+    LoadingComponent?: typeof defaultLoadingComponent;
+    ErrorComponent?: typeof defaultErrorComponent;
+}) => react.JSX.Element;
+
+export { SafeInclude, appMountRelative, isForeignMountPath, stripFrontmatter };

package/dist/components/SafeInclude.d.ts

@@ -0,0 +1,29 @@
+import * as react from 'react';
+import { SourceReader } from '../sourceCache.js';
+import { defaultLoadingComponent, defaultErrorComponent } from './defaults.js';
+import 'react-error-boundary';
+
+/** Strip a leading YAML frontmatter block (and an optional BOM). The compiled path never
+ *  renders frontmatter — the MDX loader consumes it — so the safe path must not either, or
+ *  the same file gains a wall of raw YAML when the renderer changes. */
+declare function stripFrontmatter(source: string): string;
+/** `/app/content/x.mdx` → `content/x.mdx`. {@link openAppFs} is anchored at the app mount,
+ *  so an absolute module path has to be made mount-relative before it is read. A path that
+ *  is already relative is passed through untouched. */
+declare function appMountRelative(filename: string): string;
+/** Is this an absolute path that lies OUTSIDE this app's own repo mount — i.e. a file
+ *  resident in a content mount rather than in the app? */
+declare function isForeignMountPath(filename: string): boolean;
+/** Render another file's Markdown/MDX **as data** — no author JavaScript executes. Reached
+ *  via `<Include mode="interpreted">` or `<IncludeModeContext value="interpreted">`. */
+declare const SafeInclude: ({ filename, components, readSource, LoadingComponent, ErrorComponent, }: {
+    filename: string;
+    /** Extra/override components, merged OVER the surrounding MDXProvider map. */
+    components?: Record<string, unknown>;
+    /** Read the raw bytes yourself — e.g. from a content mount rather than the app repo. */
+    readSource?: SourceReader;
+    LoadingComponent?: typeof defaultLoadingComponent;
+    ErrorComponent?: typeof defaultErrorComponent;
+}) => react.JSX.Element;
+
+export { SafeInclude, appMountRelative, isForeignMountPath, stripFrontmatter };

package/dist/components/SafeInclude.js

@@ -0,0 +1,77 @@
+import "../chunk-VHAA22YE.js";
+import { jsx } from "react/jsx-runtime";
+import { Suspense, use, useMemo } from "react";
+import { ErrorBoundary } from "react-error-boundary";
+import { openAppFs, openFs } from "../fs";
+import { getAppMountPath } from "../mounts";
+import { useMDXComponents } from "../MDXProvider";
+import { SafeContent } from "../safeContent/SafeContent";
+import { createSourceCache } from "../sourceCache";
+import { RenderExportedComponentContext } from "./includeContexts";
+import { defaultErrorComponent, defaultLoadingComponent } from "./defaults";
+function stripFrontmatter(source) {
+  return source.replace(/^\uFEFF?---\r?\n[\s\S]*?\r?\n---[ \t]*\r?\n?/, "");
+}
+function appMountRelative(filename) {
+  const root = getAppMountPath().replace(/\/+$/, "");
+  const abs = filename.startsWith(root + "/") ? filename.slice(root.length) : filename;
+  return abs.replace(/^\/+/, "");
+}
+function isForeignMountPath(filename) {
+  if (!filename.startsWith("/")) return false;
+  const root = getAppMountPath().replace(/\/+$/, "");
+  return !filename.startsWith(`${root}/`) && filename !== root;
+}
+function readInterpretedSource(filename) {
+  if (isForeignMountPath(filename)) {
+    return openFs({ path: "/", type: "mount" }).readFile(
+      filename.replace(/^\/+/, ""),
+      "utf8"
+    );
+  }
+  return openAppFs().readFile(appMountRelative(filename), "utf8");
+}
+const defaultSources = createSourceCache(readInterpretedSource);
+function InterpretedBody({
+  filename,
+  components,
+  readSource
+}) {
+  const sources = useMemo(
+    () => readSource ? createSourceCache(readSource) : defaultSources,
+    [readSource]
+  );
+  const raw = use(sources.read(filename));
+  const provided = useMDXComponents(components);
+  const body = stripFrontmatter(raw);
+  return (
+    // Publishing the included file's path is what lets the WikiLink resolver know which file
+    // a relative `[[target]]` (and its `#sec-…` fragment) is relative TO — the same context
+    // the compiled path publishes from the module's evaluation.
+    /* @__PURE__ */ jsx(
+      RenderExportedComponentContext,
+      {
+        value: { evaluationContext: { evaluation: { module: { filepath: filename } } } },
+        children: /* @__PURE__ */ jsx(SafeContent, { source: body, components: provided })
+      }
+    )
+  );
+}
+const SafeInclude = ({
+  filename,
+  components,
+  readSource,
+  LoadingComponent = defaultLoadingComponent,
+  ErrorComponent = defaultErrorComponent
+}) => (
+  // Same boundary shape as the compiled path: a file that fails to read renders the error
+  // component rather than taking down the tree that included it.
+  /* @__PURE__ */ jsx(ErrorBoundary, { fallbackRender: ErrorComponent, children: /* @__PURE__ */ jsx(Suspense, { fallback: /* @__PURE__ */ jsx(LoadingComponent, {}), children: /* @__PURE__ */ jsx(InterpretedBody, { filename, components, readSource }) }) })
+);
+export {
+  SafeInclude,
+  appMountRelative,
+  isForeignMountPath,
+  stripFrontmatter
+};
+//# sourceMappingURL=SafeInclude.js.map

package/dist/components/SafeInclude.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/SafeInclude.tsx"],"sourcesContent":["import { Suspense, use, useMemo } from 'react';\nimport { ErrorBoundary } from 'react-error-boundary';\n\nimport { openAppFs, openFs } from '../fs';\nimport { getAppMountPath } from '../mounts';\nimport { useMDXComponents } from '../MDXProvider';\nimport { SafeContent } from '../safeContent/SafeContent';\nimport { createSourceCache, type SourceReader } from '../sourceCache';\nimport { RenderExportedComponentContext } from './includeContexts';\nimport { defaultErrorComponent, defaultLoadingComponent } from './defaults';\n\n// `<Include mode=\"interpreted\">` — the same tag, the NON-EXECUTABLE renderer. (R3-263)\n//\n// WHY THIS EXISTS. `<Include>` resolves a file through the module cache and *evaluates* it,\n// which is right for an app's own source and wrong for content. An interpreter app\n// (TRUST_MODES_SPEC §5) had no way to say \"include this file, but as data\": it could render\n// its own bodies through `<SafeContent>` while any file it pulled in with `<Include>` still\n// executed. Grove hit exactly that — a wiki declaring `render: safe` still ran author\n// JavaScript out of its `_layout.mdx`, because the layout chain went through `<Include>`.\n//\n// It is also what makes such a file renderable AT ALL when it does not live in the app: the\n// compiled path evaluates an app-source module, which a file resident in a content mount is\n// not. That is the `AGENT_AUTHORING §10` MDX-from-mount gate, which `TRUST_MODES §5.1` says\n// MUST terminate in the safe renderer and never in compiled MDX.\n//\n// The component map comes from `useMDXComponents` — the SAME provider map `boot({\n// mdxComponents })` establishes for the compiled path — so a document resolves the identical\n// vocabulary under either renderer and an app wires nothing extra to get it.\n\n/** Strip a leading YAML frontmatter block (and an optional BOM). The compiled path never\n *  renders frontmatter — the MDX loader consumes it — so the safe path must not either, or\n *  the same file gains a wall of raw YAML when the renderer changes. */\nexport function stripFrontmatter(source: string): string {\n  return source.replace(/^\\uFEFF?---\\r?\\n[\\s\\S]*?\\r?\\n---[ \\t]*\\r?\\n?/, '');\n}\n\n/** `/app/content/x.mdx` → `content/x.mdx`. {@link openAppFs} is anchored at the app mount,\n *  so an absolute module path has to be made mount-relative before it is read. A path that\n *  is already relative is passed through untouched. */\nexport function appMountRelative(filename: string): string {\n  const root = getAppMountPath().replace(/\\/+$/, '');\n  const abs = filename.startsWith(root + '/') ? filename.slice(root.length) : filename;\n  return abs.replace(/^\\/+/, '');\n}\n\n/** Is this an absolute path that lies OUTSIDE this app's own repo mount — i.e. a file\n *  resident in a content mount rather than in the app? */\nexport function isForeignMountPath(filename: string): boolean {\n  if (!filename.startsWith('/')) return false;\n  const root = getAppMountPath().replace(/\\/+$/, '');\n  return !filename.startsWith(`${root}/`) && filename !== root;\n}\n\n/**\n * Read an interpreted include's bytes.\n *\n * The reason this is not just `openAppFs()`: **the whole point of the interpreted include\n * is files the app did not author**, and the two consumers named in this file's header —\n * a dispatched wiki's `_layout.mdx`, a whiteboard object body — live in a MOUNT. An\n * app-anchored read cannot reach them, and it does not fail loudly either: the absolute\n * path is stripped to a relative one and looked up *inside the app*, so\n * `/task/<slot>/dir/_layout.mdx` becomes a miss at `task/<slot>/dir/_layout.mdx` in the\n * app's own tree. A silent wrong-file lookup, in the component whose job is rendering\n * other people's content.\n *\n * So: a path under the app mount reads exactly as before, and an absolute path outside it\n * — which could only ever have failed — reads from the unified sandbox namespace, where\n * every mount is addressable. This widens what resolves and changes nothing that resolved.\n */\nfunction readInterpretedSource(filename: string): Promise<string> {\n  if (isForeignMountPath(filename)) {\n    // Anchored at the namespace root: mounts are addressable by their absolute paths, and\n    // this component has no way to know (and no need to know) which mount a path belongs\n    // to. It confers nothing — the ZenFS port is already chroot/`ro`-enforced host-side.\n    return openFs({ path: '/', type: 'mount' } as never).readFile(\n      filename.replace(/^\\/+/, ''),\n      'utf8',\n    ) as Promise<string>;\n  }\n  return openAppFs().readFile(appMountRelative(filename), 'utf8') as Promise<string>;\n}\n\n// One cache for every interpreted include in the app: a layout file is included on every\n// page, so a per-component cache would re-read it per navigation. See `../sourceCache` for\n// why a REJECTED read must not be memoised.\nconst defaultSources = createSourceCache(readInterpretedSource);\n\nfunction InterpretedBody({\n  filename,\n  components,\n  readSource,\n}: {\n  filename: string;\n  components?: Record<string, unknown>;\n  readSource?: SourceReader;\n}) {\n  // A caller-supplied reader gets its own cache; the shared one is used otherwise. Memoised\n  // on the reader identity so `use()` still sees a stable promise across renders.\n  const sources = useMemo(\n    () => (readSource ? createSourceCache(readSource) : defaultSources),\n    [readSource],\n  );\n  const raw = use(sources.read(filename));\n  const provided = useMDXComponents(components) as Record<string, unknown>;\n  const body = stripFrontmatter(raw);\n  return (\n    // Publishing the included file's path is what lets the WikiLink resolver know which file\n    // a relative `[[target]]` (and its `#sec-…` fragment) is relative TO — the same context\n    // the compiled path publishes from the module's evaluation.\n    <RenderExportedComponentContext\n      value={{ evaluationContext: { evaluation: { module: { filepath: filename } } } } as never}\n    >\n      <SafeContent source={body} components={provided as never} />\n    </RenderExportedComponentContext>\n  );\n}\n\n/** Render another file's Markdown/MDX **as data** — no author JavaScript executes. Reached\n *  via `<Include mode=\"interpreted\">` or `<IncludeModeContext value=\"interpreted\">`. */\nexport const SafeInclude = ({\n  filename,\n  components,\n  readSource,\n  LoadingComponent = defaultLoadingComponent,\n  ErrorComponent = defaultErrorComponent,\n}: {\n  filename: string;\n  /** Extra/override components, merged OVER the surrounding MDXProvider map. */\n  components?: Record<string, unknown>;\n  /** Read the raw bytes yourself — e.g. from a content mount rather than the app repo. */\n  readSource?: SourceReader;\n  LoadingComponent?: typeof defaultLoadingComponent;\n  ErrorComponent?: typeof defaultErrorComponent;\n}) => (\n  // Same boundary shape as the compiled path: a file that fails to read renders the error\n  // component rather than taking down the tree that included it.\n  <ErrorBoundary fallbackRender={ErrorComponent}>\n    <Suspense fallback={<LoadingComponent />}>\n      <InterpretedBody filename={filename} components={components} readSource={readSource} />\n    </Suspense>\n  </ErrorBoundary>\n);\n"],"mappings":";AAgHM;AAhHN,SAAS,UAAU,KAAK,eAAe;AACvC,SAAS,qBAAqB;AAE9B,SAAS,WAAW,cAAc;AAClC,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,mBAAmB;AAC5B,SAAS,yBAA4C;AACrD,SAAS,sCAAsC;AAC/C,SAAS,uBAAuB,+BAA+B;AAuBxD,SAAS,iBAAiB,QAAwB;AACvD,SAAO,OAAO,QAAQ,gDAAgD,EAAE;AAC1E;AAKO,SAAS,iBAAiB,UAA0B;AACzD,QAAM,OAAO,gBAAgB,EAAE,QAAQ,QAAQ,EAAE;AACjD,QAAM,MAAM,SAAS,WAAW,OAAO,GAAG,IAAI,SAAS,MAAM,KAAK,MAAM,IAAI;AAC5E,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAIO,SAAS,mBAAmB,UAA2B;AAC5D,MAAI,CAAC,SAAS,WAAW,GAAG,EAAG,QAAO;AACtC,QAAM,OAAO,gBAAgB,EAAE,QAAQ,QAAQ,EAAE;AACjD,SAAO,CAAC,SAAS,WAAW,GAAG,IAAI,GAAG,KAAK,aAAa;AAC1D;AAkBA,SAAS,sBAAsB,UAAmC;AAChE,MAAI,mBAAmB,QAAQ,GAAG;AAIhC,WAAO,OAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,CAAU,EAAE;AAAA,MACnD,SAAS,QAAQ,QAAQ,EAAE;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO,UAAU,EAAE,SAAS,iBAAiB,QAAQ,GAAG,MAAM;AAChE;AAKA,MAAM,iBAAiB,kBAAkB,qBAAqB;AAE9D,SAAS,gBAAgB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AACF,GAIG;AAGD,QAAM,UAAU;AAAA,IACd,MAAO,aAAa,kBAAkB,UAAU,IAAI;AAAA,IACpD,CAAC,UAAU;AAAA,EACb;AACA,QAAM,MAAM,IAAI,QAAQ,KAAK,QAAQ,CAAC;AACtC,QAAM,WAAW,iBAAiB,UAAU;AAC5C,QAAM,OAAO,iBAAiB,GAAG;AACjC;AAAA;AAAA;AAAA;AAAA,IAIE;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,SAAS,EAAE,EAAE,EAAE;AAAA,QAE/E,8BAAC,eAAY,QAAQ,MAAM,YAAY,UAAmB;AAAA;AAAA,IAC5D;AAAA;AAEJ;AAIO,MAAM,cAAc,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB,iBAAiB;AACnB;AAAA;AAAA;AAAA,EAWE,oBAAC,iBAAc,gBAAgB,gBAC7B,8BAAC,YAAS,UAAU,oBAAC,oBAAiB,GACpC,8BAAC,mBAAgB,UAAoB,YAAwB,YAAwB,GACvF,GACF;AAAA;","names":[]}

package/dist/components/includeContexts.cjs

@@ -0,0 +1,33 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var includeContexts_exports = {};
+__export(includeContexts_exports, {
+  IncludeModeContext: () => IncludeModeContext,
+  RenderExportedComponentContext: () => RenderExportedComponentContext
+});
+module.exports = __toCommonJS(includeContexts_exports);
+var import_react = require("react");
+const RenderExportedComponentContext = (0, import_react.createContext)(null);
+const IncludeModeContext = (0, import_react.createContext)("compiled");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IncludeModeContext,
+  RenderExportedComponentContext
+});
+//# sourceMappingURL=includeContexts.cjs.map

package/dist/components/includeContexts.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/includeContexts.ts"],"sourcesContent":["import { createContext } from 'react';\n\nimport { EvaluationContext } from '../sandboxTypes';\n\n// The contexts `<Include>` publishes and reads, in their own module so that `Include` and\n// `SafeInclude` can each import them without importing each other. `Include` branches to\n// `SafeInclude` and `SafeInclude` publishes `RenderExportedComponentContext`, which would be\n// a cycle if either owned the contexts — and `check:circular` is a CI gate, because a\n// circular SDK import once made the bundler infinite-loop.\n//\n// Both are re-exported from `./Include`, which is the public entry point; nothing outside\n// needs to know this module exists.\n\n/** The value exposed on {@link RenderExportedComponentContext}: the evaluation\n *  context of the module `Include` resolved. */\nexport type RenderFileContextType = {\n  evaluationContext: EvaluationContext;\n};\n\n/** Context carrying the included module's {@link EvaluationContext} to its subtree. */\nexport const RenderExportedComponentContext = createContext<RenderFileContextType | null>(null);\n\n/** Which renderer `Include` uses: `compiled` evaluates the module (the default, unchanged\n *  behaviour); `interpreted` renders the file's Markdown/MDX **as data** through the safe\n *  renderer, so no author JavaScript executes. */\nexport type IncludeMode = 'compiled' | 'interpreted';\n\n/** Declare the renderer for every `Include` in a subtree. An **interpreter** app\n *  (TRUST_MODES_SPEC §5) sets this once at its root instead of remembering to pass `mode` at\n *  each call site — the failure mode being silent (one forgotten `<Include>` executes author\n *  code while the app believes it renders nothing but data). Defaults to `compiled`, so every\n *  existing consumer is unaffected. */\nexport const IncludeModeContext = createContext<IncludeMode>('compiled');\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAA8B;AAoBvB,MAAM,qCAAiC,4BAA4C,IAAI;AAYvF,MAAM,yBAAqB,4BAA2B,UAAU;","names":[]}

package/dist/components/includeContexts.d.cts

@@ -0,0 +1,22 @@
+import * as react from 'react';
+import { EvaluationContext } from '../sandboxTypes.cjs';
+
+/** The value exposed on {@link RenderExportedComponentContext}: the evaluation
+ *  context of the module `Include` resolved. */
+type RenderFileContextType = {
+    evaluationContext: EvaluationContext;
+};
+/** Context carrying the included module's {@link EvaluationContext} to its subtree. */
+declare const RenderExportedComponentContext: react.Context<RenderFileContextType | null>;
+/** Which renderer `Include` uses: `compiled` evaluates the module (the default, unchanged
+ *  behaviour); `interpreted` renders the file's Markdown/MDX **as data** through the safe
+ *  renderer, so no author JavaScript executes. */
+type IncludeMode = 'compiled' | 'interpreted';
+/** Declare the renderer for every `Include` in a subtree. An **interpreter** app
+ *  (TRUST_MODES_SPEC §5) sets this once at its root instead of remembering to pass `mode` at
+ *  each call site — the failure mode being silent (one forgotten `<Include>` executes author
+ *  code while the app believes it renders nothing but data). Defaults to `compiled`, so every
+ *  existing consumer is unaffected. */
+declare const IncludeModeContext: react.Context<IncludeMode>;
+
+export { type IncludeMode, IncludeModeContext, RenderExportedComponentContext, type RenderFileContextType };

package/dist/components/includeContexts.d.ts

@@ -0,0 +1,22 @@
+import * as react from 'react';
+import { EvaluationContext } from '../sandboxTypes.js';
+
+/** The value exposed on {@link RenderExportedComponentContext}: the evaluation
+ *  context of the module `Include` resolved. */
+type RenderFileContextType = {
+    evaluationContext: EvaluationContext;
+};
+/** Context carrying the included module's {@link EvaluationContext} to its subtree. */
+declare const RenderExportedComponentContext: react.Context<RenderFileContextType | null>;
+/** Which renderer `Include` uses: `compiled` evaluates the module (the default, unchanged
+ *  behaviour); `interpreted` renders the file's Markdown/MDX **as data** through the safe
+ *  renderer, so no author JavaScript executes. */
+type IncludeMode = 'compiled' | 'interpreted';
+/** Declare the renderer for every `Include` in a subtree. An **interpreter** app
+ *  (TRUST_MODES_SPEC §5) sets this once at its root instead of remembering to pass `mode` at
+ *  each call site — the failure mode being silent (one forgotten `<Include>` executes author
+ *  code while the app believes it renders nothing but data). Defaults to `compiled`, so every
+ *  existing consumer is unaffected. */
+declare const IncludeModeContext: react.Context<IncludeMode>;
+
+export { type IncludeMode, IncludeModeContext, RenderExportedComponentContext, type RenderFileContextType };

package/dist/components/includeContexts.js

@@ -0,0 +1,9 @@
+import "../chunk-VHAA22YE.js";
+import { createContext } from "react";
+const RenderExportedComponentContext = createContext(null);
+const IncludeModeContext = createContext("compiled");
+export {
+  IncludeModeContext,
+  RenderExportedComponentContext
+};
+//# sourceMappingURL=includeContexts.js.map

package/dist/components/includeContexts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/components/includeContexts.ts"],"sourcesContent":["import { createContext } from 'react';\n\nimport { EvaluationContext } from '../sandboxTypes';\n\n// The contexts `<Include>` publishes and reads, in their own module so that `Include` and\n// `SafeInclude` can each import them without importing each other. `Include` branches to\n// `SafeInclude` and `SafeInclude` publishes `RenderExportedComponentContext`, which would be\n// a cycle if either owned the contexts — and `check:circular` is a CI gate, because a\n// circular SDK import once made the bundler infinite-loop.\n//\n// Both are re-exported from `./Include`, which is the public entry point; nothing outside\n// needs to know this module exists.\n\n/** The value exposed on {@link RenderExportedComponentContext}: the evaluation\n *  context of the module `Include` resolved. */\nexport type RenderFileContextType = {\n  evaluationContext: EvaluationContext;\n};\n\n/** Context carrying the included module's {@link EvaluationContext} to its subtree. */\nexport const RenderExportedComponentContext = createContext<RenderFileContextType | null>(null);\n\n/** Which renderer `Include` uses: `compiled` evaluates the module (the default, unchanged\n *  behaviour); `interpreted` renders the file's Markdown/MDX **as data** through the safe\n *  renderer, so no author JavaScript executes. */\nexport type IncludeMode = 'compiled' | 'interpreted';\n\n/** Declare the renderer for every `Include` in a subtree. An **interpreter** app\n *  (TRUST_MODES_SPEC §5) sets this once at its root instead of remembering to pass `mode` at\n *  each call site — the failure mode being silent (one forgotten `<Include>` executes author\n *  code while the app believes it renders nothing but data). Defaults to `compiled`, so every\n *  existing consumer is unaffected. */\nexport const IncludeModeContext = createContext<IncludeMode>('compiled');\n"],"mappings":";AAAA,SAAS,qBAAqB;AAoBvB,MAAM,iCAAiC,cAA4C,IAAI;AAYvF,MAAM,qBAAqB,cAA2B,UAAU;","names":[]}

package/dist/index.cjs

@@ -3,6 +3,10 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -14,11 +18,16 @@ var __copyProps = (to, from, except, desc) => {
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var index_exports = {};
+__export(index_exports, {
+  SafeInclude: () => import_SafeInclude.SafeInclude
+});
 module.exports = __toCommonJS(index_exports);
 __reExport(index_exports, require("./MDXProvider"), module.exports);
 __reExport(index_exports, require("./routing"), module.exports);
 __reExport(index_exports, require("./boot"), module.exports);
 __reExport(index_exports, require("./components/Include"), module.exports);
+var import_SafeInclude = require("./components/SafeInclude");
+__reExport(index_exports, require("./sourceCache"), module.exports);
 __reExport(index_exports, require("./components/MDXComponents"), module.exports);
 __reExport(index_exports, require("./components/MountImage"), module.exports);
 __reExport(index_exports, require("./components/Routes"), module.exports);
@@ -53,10 +62,12 @@ __reExport(index_exports, require("./sandboxTypes"), module.exports);
 __reExport(index_exports, require("./safeContent"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  SafeInclude,
   ...require("./MDXProvider"),
   ...require("./routing"),
   ...require("./boot"),
   ...require("./components/Include"),
+  ...require("./sourceCache"),
   ...require("./components/MDXComponents"),
   ...require("./components/MountImage"),
   ...require("./components/Routes"),

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\nexport * from './components/MDXComponents';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAIA,0BAAc,uCAJd;AAKA,0BAAc,oCALd;AAMA,0BAAc,gCANd;AAOA,0BAAc,oBAPd;AAQA,0BAAc,mBARd;AASA,0BAAc,oBATd;AAUA,0BAAc,4BAVd;AAWA,0BAAc,qBAXd;AAYA,0BAAc,yBAZd;AAaA,0BAAc,qBAbd;AAcA,0BAAc,qBAdd;AAeA,0BAAc,yBAfd;AAgBA,0BAAc,sBAhBd;AAiBA,0BAAc,kBAjBd;AAkBA,0BAAc,kBAlBd;AAmBA,0BAAc,uBAnBd;AAoBA,0BAAc,sBApBd;AAqBA,0BAAc,kBArBd;AAsBA,0BAAc,0BAtBd;AAuBA,0BAAc,kBAvBd;AAwBA,0BAAc,yBAxBd;AAyBA,0BAAc,iBAzBd;AA0BA,0BAAc,oBA1Bd;AA2BA,0BAAc,oBA3Bd;AA4BA,0BAAc,qBA5Bd;AA6BA,0BAAc,sBA7Bd;AA8BA,0BAAc,wBA9Bd;AA+BA,0BAAc,oBA/Bd;AAgCA,0BAAc,sBAhCd;AAiCA,0BAAc,6BAjCd;AAkCA,0BAAc,2BAlCd;AAmCA,0BAAc,0BAnCd;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,oCAXd;AAYA,0BAAc,gCAZd;AAaA,0BAAc,oBAbd;AAcA,0BAAc,mBAdd;AAeA,0BAAc,oBAfd;AAgBA,0BAAc,4BAhBd;AAiBA,0BAAc,qBAjBd;AAkBA,0BAAc,yBAlBd;AAmBA,0BAAc,qBAnBd;AAoBA,0BAAc,qBApBd;AAqBA,0BAAc,yBArBd;AAsBA,0BAAc,sBAtBd;AAuBA,0BAAc,kBAvBd;AAwBA,0BAAc,kBAxBd;AAyBA,0BAAc,uBAzBd;AA0BA,0BAAc,sBA1Bd;AA2BA,0BAAc,kBA3Bd;AA4BA,0BAAc,0BA5Bd;AA6BA,0BAAc,kBA7Bd;AA8BA,0BAAc,yBA9Bd;AA+BA,0BAAc,iBA/Bd;AAgCA,0BAAc,oBAhCd;AAiCA,0BAAc,oBAjCd;AAkCA,0BAAc,qBAlCd;AAmCA,0BAAc,sBAnCd;AAoCA,0BAAc,wBApCd;AAqCA,0BAAc,oBArCd;AAsCA,0BAAc,sBAtCd;AAuCA,0BAAc,6BAvCd;AAwCA,0BAAc,2BAxCd;AAyCA,0BAAc,0BAzCd;","names":[]}

package/dist/index.d.cts

@@ -1,7 +1,9 @@
 export { MDXProvider, useMDXComponents } from './MDXProvider.cjs';
 export { AppliedRoutingRule, Router, applyRoutingRule, navigate, renderRoute, useRoute, useRouteParams, useTinkerableLink } from './routing.cjs';
 export { BootProps, CATCH_ALL_ROUTING_SPEC, DEFAULT_ROUTING_SPEC, MdxComponents, TinkerableApp, boot, resolveMdxComponents } from './boot.cjs';
-export { Include, RenderExportedComponent, RenderExportedComponentContext, RenderFileContextType } from './components/Include.cjs';
+export { Include, RenderExportedComponent } from './components/Include.cjs';
+export { SafeInclude } from './components/SafeInclude.cjs';
+export { SourceCache, SourceReader, createSourceCache } from './sourceCache.cjs';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.cjs';
 export { MountImage, MountImageProps } from './components/MountImage.cjs';
 export { Route, RouteProps, Routes } from './components/Routes.cjs';
@@ -42,6 +44,7 @@ export { Admonition, AdmonitionType } from './components/Admonition.cjs';
 export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.cjs';
 export { HeadingAnchor } from './components/HeadingAnchor.cjs';
 export { ImmediatelyRunGlobal, getHostRuntime } from './hostRuntime.cjs';
+export { IncludeMode, IncludeModeContext, RenderExportedComponentContext, RenderFileContextType } from './components/includeContexts.cjs';
 export { InternalLink, Link } from './components/Link.cjs';
 export { SDK_VERSION } from './version.cjs';
 export { WikiLink } from './components/WikiLink.cjs';

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 export { MDXProvider, useMDXComponents } from './MDXProvider.js';
 export { AppliedRoutingRule, Router, applyRoutingRule, navigate, renderRoute, useRoute, useRouteParams, useTinkerableLink } from './routing.js';
 export { BootProps, CATCH_ALL_ROUTING_SPEC, DEFAULT_ROUTING_SPEC, MdxComponents, TinkerableApp, boot, resolveMdxComponents } from './boot.js';
-export { Include, RenderExportedComponent, RenderExportedComponentContext, RenderFileContextType } from './components/Include.js';
+export { Include, RenderExportedComponent } from './components/Include.js';
+export { SafeInclude } from './components/SafeInclude.js';
+export { SourceCache, SourceReader, createSourceCache } from './sourceCache.js';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.js';
 export { MountImage, MountImageProps } from './components/MountImage.js';
 export { Route, RouteProps, Routes } from './components/Routes.js';
@@ -42,6 +44,7 @@ export { Admonition, AdmonitionType } from './components/Admonition.js';
 export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.js';
 export { HeadingAnchor } from './components/HeadingAnchor.js';
 export { ImmediatelyRunGlobal, getHostRuntime } from './hostRuntime.js';
+export { IncludeMode, IncludeModeContext, RenderExportedComponentContext, RenderFileContextType } from './components/includeContexts.js';
 export { InternalLink, Link } from './components/Link.js';
 export { SDK_VERSION } from './version.js';
 export { WikiLink } from './components/WikiLink.js';

package/dist/index.js

@@ -1,7 +1,10 @@
+import "./chunk-VHAA22YE.js";
 export * from "./MDXProvider";
 export * from "./routing";
 export * from "./boot";
 export * from "./components/Include";
+import { SafeInclude } from "./components/SafeInclude";
+export * from "./sourceCache";
 export * from "./components/MDXComponents";
 export * from "./components/MountImage";
 export * from "./components/Routes";
@@ -34,4 +37,7 @@ export * from "./loading";
 export * from "./protocolStream";
 export * from "./sandboxTypes";
 export * from "./safeContent";
+export {
+  SafeInclude
+};
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\nexport * from './components/MDXComponents';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":"AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}

package/dist/sourceCache.cjs

@@ -0,0 +1,48 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sourceCache_exports = {};
+__export(sourceCache_exports, {
+  createSourceCache: () => createSourceCache
+});
+module.exports = __toCommonJS(sourceCache_exports);
+function createSourceCache(reader) {
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    read(path) {
+      const hit = cache.get(path);
+      if (hit) return hit;
+      const p = reader(path).catch((error) => {
+        if (cache.get(path) === p) cache.delete(path);
+        throw error;
+      });
+      cache.set(path, p);
+      return p;
+    },
+    invalidate(path) {
+      if (path === void 0) cache.clear();
+      else cache.delete(path);
+    },
+    size: () => cache.size
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createSourceCache
+});
+//# sourceMappingURL=sourceCache.cjs.map

package/dist/sourceCache.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sourceCache.ts"],"sourcesContent":["// A memoised raw-source reader for React `use()`. (R3-263)\n//\n// `use()` needs a STABLE promise across renders, so a component that reads a file must not\n// start a new read every time it renders. That much is obvious. The part that is not, and\n// the reason this lives in the SDK rather than being re-derived per app, is what happens\n// when a read FAILS:\n//\n//   a rejected promise left in the cache is returned to EVERY later render, so the file can\n//   never recover.\n//\n// That is not theoretical. The host↔sandbox RPC drops requests during a navigation\n// (\"Invalid RPC id\"), and a wiki entry whose read lost that race stayed **permanently blank\n// for the rest of the session** — no error, no retry, nothing short of a reload. Evicting on\n// rejection makes the next attempt a fresh read, so a transient failure costs a retry\n// instead of the page.\n//\n// Injectable reader, no `fs` import: the cache is pure and testable without a host, and the\n// same instance serves whatever mount the caller reads from.\n\nexport type SourceReader = (path: string) => Promise<string>;\n\nexport interface SourceCache {\n  /** The memoised read for `path` — the same promise identity until it settles-and-fails. */\n  read: (path: string) => Promise<string>;\n  /** Drop a memoised read (a live edit, or an explicit refresh); no argument clears all. */\n  invalidate: (path?: string) => void;\n  /** Testing/diagnostics: how many paths are memoised right now. */\n  size: () => number;\n}\n\nexport function createSourceCache(reader: SourceReader): SourceCache {\n  const cache = new Map<string, Promise<string>>();\n  return {\n    read(path) {\n      const hit = cache.get(path);\n      if (hit) return hit;\n      const p = reader(path).catch((error: unknown) => {\n        // Never let a failure become the permanent answer for this path. Guarded on\n        // identity so a newer read started after an invalidate is not evicted by an older\n        // one settling late.\n        if (cache.get(path) === p) cache.delete(path);\n        throw error;\n      });\n      cache.set(path, p);\n      return p;\n    },\n    invalidate(path) {\n      if (path === undefined) cache.clear();\n      else cache.delete(path);\n    },\n    size: () => cache.size,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BO,SAAS,kBAAkB,QAAmC;AACnE,QAAM,QAAQ,oBAAI,IAA6B;AAC/C,SAAO;AAAA,IACL,KAAK,MAAM;AACT,YAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,UAAI,IAAK,QAAO;AAChB,YAAM,IAAI,OAAO,IAAI,EAAE,MAAM,CAAC,UAAmB;AAI/C,YAAI,MAAM,IAAI,IAAI,MAAM,EAAG,OAAM,OAAO,IAAI;AAC5C,cAAM;AAAA,MACR,CAAC;AACD,YAAM,IAAI,MAAM,CAAC;AACjB,aAAO;AAAA,IACT;AAAA,IACA,WAAW,MAAM;AACf,UAAI,SAAS,OAAW,OAAM,MAAM;AAAA,UAC/B,OAAM,OAAO,IAAI;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,MAAM;AAAA,EACpB;AACF;","names":[]}

package/dist/sourceCache.d.cts

@@ -0,0 +1,12 @@
+type SourceReader = (path: string) => Promise<string>;
+interface SourceCache {
+    /** The memoised read for `path` — the same promise identity until it settles-and-fails. */
+    read: (path: string) => Promise<string>;
+    /** Drop a memoised read (a live edit, or an explicit refresh); no argument clears all. */
+    invalidate: (path?: string) => void;
+    /** Testing/diagnostics: how many paths are memoised right now. */
+    size: () => number;
+}
+declare function createSourceCache(reader: SourceReader): SourceCache;
+
+export { type SourceCache, type SourceReader, createSourceCache };

package/dist/sourceCache.d.ts

@@ -0,0 +1,12 @@
+type SourceReader = (path: string) => Promise<string>;
+interface SourceCache {
+    /** The memoised read for `path` — the same promise identity until it settles-and-fails. */
+    read: (path: string) => Promise<string>;
+    /** Drop a memoised read (a live edit, or an explicit refresh); no argument clears all. */
+    invalidate: (path?: string) => void;
+    /** Testing/diagnostics: how many paths are memoised right now. */
+    size: () => number;
+}
+declare function createSourceCache(reader: SourceReader): SourceCache;
+
+export { type SourceCache, type SourceReader, createSourceCache };

package/dist/sourceCache.js

@@ -0,0 +1,25 @@
+import "./chunk-VHAA22YE.js";
+function createSourceCache(reader) {
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    read(path) {
+      const hit = cache.get(path);
+      if (hit) return hit;
+      const p = reader(path).catch((error) => {
+        if (cache.get(path) === p) cache.delete(path);
+        throw error;
+      });
+      cache.set(path, p);
+      return p;
+    },
+    invalidate(path) {
+      if (path === void 0) cache.clear();
+      else cache.delete(path);
+    },
+    size: () => cache.size
+  };
+}
+export {
+  createSourceCache
+};
+//# sourceMappingURL=sourceCache.js.map

package/dist/sourceCache.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sourceCache.ts"],"sourcesContent":["// A memoised raw-source reader for React `use()`. (R3-263)\n//\n// `use()` needs a STABLE promise across renders, so a component that reads a file must not\n// start a new read every time it renders. That much is obvious. The part that is not, and\n// the reason this lives in the SDK rather than being re-derived per app, is what happens\n// when a read FAILS:\n//\n//   a rejected promise left in the cache is returned to EVERY later render, so the file can\n//   never recover.\n//\n// That is not theoretical. The host↔sandbox RPC drops requests during a navigation\n// (\"Invalid RPC id\"), and a wiki entry whose read lost that race stayed **permanently blank\n// for the rest of the session** — no error, no retry, nothing short of a reload. Evicting on\n// rejection makes the next attempt a fresh read, so a transient failure costs a retry\n// instead of the page.\n//\n// Injectable reader, no `fs` import: the cache is pure and testable without a host, and the\n// same instance serves whatever mount the caller reads from.\n\nexport type SourceReader = (path: string) => Promise<string>;\n\nexport interface SourceCache {\n  /** The memoised read for `path` — the same promise identity until it settles-and-fails. */\n  read: (path: string) => Promise<string>;\n  /** Drop a memoised read (a live edit, or an explicit refresh); no argument clears all. */\n  invalidate: (path?: string) => void;\n  /** Testing/diagnostics: how many paths are memoised right now. */\n  size: () => number;\n}\n\nexport function createSourceCache(reader: SourceReader): SourceCache {\n  const cache = new Map<string, Promise<string>>();\n  return {\n    read(path) {\n      const hit = cache.get(path);\n      if (hit) return hit;\n      const p = reader(path).catch((error: unknown) => {\n        // Never let a failure become the permanent answer for this path. Guarded on\n        // identity so a newer read started after an invalidate is not evicted by an older\n        // one settling late.\n        if (cache.get(path) === p) cache.delete(path);\n        throw error;\n      });\n      cache.set(path, p);\n      return p;\n    },\n    invalidate(path) {\n      if (path === undefined) cache.clear();\n      else cache.delete(path);\n    },\n    size: () => cache.size,\n  };\n}\n"],"mappings":";AA8BO,SAAS,kBAAkB,QAAmC;AACnE,QAAM,QAAQ,oBAAI,IAA6B;AAC/C,SAAO;AAAA,IACL,KAAK,MAAM;AACT,YAAM,MAAM,MAAM,IAAI,IAAI;AAC1B,UAAI,IAAK,QAAO;AAChB,YAAM,IAAI,OAAO,IAAI,EAAE,MAAM,CAAC,UAAmB;AAI/C,YAAI,MAAM,IAAI,IAAI,MAAM,EAAG,OAAM,OAAO,IAAI;AAC5C,cAAM;AAAA,MACR,CAAC;AACD,YAAM,IAAI,MAAM,CAAC;AACjB,aAAO;AAAA,IACT;AAAA,IACA,WAAW,MAAM;AACf,UAAI,SAAS,OAAW,OAAM,MAAM;AAAA,UAC/B,OAAM,OAAO,IAAI;AAAA,IACxB;AAAA,IACA,MAAM,MAAM,MAAM;AAAA,EACpB;AACF;","names":[]}

package/dist/version.cjs

@@ -21,7 +21,7 @@ __export(version_exports, {
   SDK_VERSION: () => SDK_VERSION
 });
 module.exports = __toCommonJS(version_exports);
-const SDK_VERSION = "0.39.0";
+const SDK_VERSION = "0.41.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SDK_VERSION

package/dist/version.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.39.0';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,MAAM,cAAc;","names":[]}
+{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.41.0';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,MAAM,cAAc;","names":[]}

package/dist/version.d.cts

@@ -1,4 +1,4 @@
 /** This SDK's package version, baked from package.json at build (SP2-6). */
-declare const SDK_VERSION = "0.39.0";
+declare const SDK_VERSION = "0.41.0";
 
 export { SDK_VERSION };

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 /** This SDK's package version, baked from package.json at build (SP2-6). */
-declare const SDK_VERSION = "0.39.0";
+declare const SDK_VERSION = "0.41.0";
 
 export { SDK_VERSION };

package/dist/version.js

@@ -1,5 +1,5 @@
 import "./chunk-VHAA22YE.js";
-const SDK_VERSION = "0.39.0";
+const SDK_VERSION = "0.41.0";
 export {
   SDK_VERSION
 };

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.39.0';\n"],"mappings":";AAIO,MAAM,cAAc;","names":[]}
+{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.41.0';\n"],"mappings":";AAIO,MAAM,cAAc;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immediately-run/sdk",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "description": "Runtime SDK for code executing inside an immediately.run sandbox.",
   "license": "MIT",
   "repository": "github:immediately-run/immediately-run-sdk",