@immediately-run/sdk 0.43.1 → 0.45.0

package/dist/hooks.d.ts

@@ -17,6 +17,16 @@ import './tasks.js';
  * returned array keeps its identity while the matches are unchanged, so it is safe
  * to use directly in downstream `useMemo`/`useEffect` dependency arrays.
  *
+ * A query may return RECORDS instead of bare paths (R3-276) — `{ path, ...extra }`
+ * — and the extra fields ride along on each entry, so something derived while
+ * selecting does not have to be recomputed downstream:
+ * ```ts
+ * const posts = useMetadataQuery<PostMeta, { year: string }>((files) =>
+ *   Object.entries(files).map(([path, m]) => ({ path, year: m.date.slice(0, 4) })),
+ * );
+ * ```
+ * The store it queries is the nearest {@link MetadataSource}, else the host's.
+ *
  * Pass a type parameter to get typed frontmatter throughout:
  * ```ts
  * interface PostMeta { title: string; date: string; draft?: boolean }
@@ -28,11 +38,23 @@ import './tasks.js';
  * );
  * ```
  */
-declare const useMetadataQuery: <T = Metadata>(queryFunction: MetadataQueryFunction<T>) => MetadataQueryResult<T>;
+declare const useMetadataQuery: <T = Metadata, E extends object = {}>(queryFunction: MetadataQueryFunction<T>) => MetadataQueryResult<T, E>;
 /**
- * Read one file's metadata (MDX frontmatter) by repo-relative path. Returns
- * `undefined` when the path has no metadata. Pass a type parameter for typed
- * field access.
+ * Read one file's metadata (MDX frontmatter) by path. Returns `undefined` when the
+ * path has no metadata. Pass a type parameter for typed field access.
+ *
+ * **The store is keyed by ABSOLUTE module path** — `/app/content/post.mdx`, the same
+ * identifier `fs`, `module.dynamicImport` and `<Include>` use — not by the
+ * repo-relative path this doc claimed until R3-276. Keeping metadata in the file
+ * space is what lets an app read a file's metadata and render that same file by the
+ * same path (`sandbox/src/bundler/metadataKey.test.ts` pins it).
+ *
+ * A repo-relative path (`/content/post.mdx`) is accepted as a fallback: if the path
+ * is not a key, it is retried under the app root via the shared
+ * `underAppRoot` helper (R3-275). That is additive — it only turns a previous
+ * `undefined` into a value — and it exists because the old doc told people to pass
+ * exactly that form. A path a {@link MetadataSource} provided in some other key
+ * space is looked up as given, unchanged.
  */
 declare const useFileMetadata: <T = Metadata>(path: string) => T | undefined;
 /**

package/dist/hooks.js

@@ -1,7 +1,8 @@
 import "./chunk-VHAA22YE.js";
-import { use, useEffect, useMemo, useRef, useState } from "react";
-import { TinkerableContext } from "./TinkerableContext";
+import { APP_ROOT, underAppRoot } from "@immediately-run/platform-constants";
+import { useEffect, useMemo, useRef, useState } from "react";
 import { openFs } from "./fs";
+import { useMetadataStore } from "./metadataSource";
 const entriesEqual = (a, b) => {
   if (a.length !== b.length) {
     return false;
@@ -10,17 +11,25 @@ const entriesEqual = (a, b) => {
     if (a[i].path !== b[i].path || a[i].meta !== b[i].meta) {
       return false;
     }
+    const ax = a[i];
+    const bx = b[i];
+    const keys = /* @__PURE__ */ new Set([...Object.keys(ax), ...Object.keys(bx)]);
+    for (const k of keys) {
+      if (k === "path" || k === "meta") continue;
+      if (ax[k] !== bx[k]) return false;
+    }
   }
   return true;
 };
 const useMetadataQuery = (queryFunction) => {
-  const { filesMetadata } = use(TinkerableContext);
+  const files = useMetadataStore();
   const previous = useRef([]);
   return useMemo(() => {
-    const files = filesMetadata ?? {};
     let entries;
     try {
-      entries = queryFunction(files).map((path) => ({ path, meta: files[path] }));
+      entries = queryFunction(files).map(
+        (selected) => typeof selected === "string" ? { path: selected, meta: files[selected] } : { ...selected, path: selected.path, meta: files[selected.path] }
+      );
     } catch (error) {
       return { error };
     }
@@ -29,19 +38,18 @@ const useMetadataQuery = (queryFunction) => {
     }
     previous.current = entries;
     return entries;
-  }, [filesMetadata, queryFunction]);
+  }, [files, queryFunction]);
 };
 const useFileMetadata = (path) => {
-  const { filesMetadata } = use(TinkerableContext);
-  return useMemo(
-    () => (filesMetadata ?? {})[path],
-    [path, filesMetadata]
-  );
-};
-const useAllMetadata = () => {
-  const { filesMetadata } = use(TinkerableContext);
-  return filesMetadata ?? {};
+  const files = useMetadataStore();
+  return useMemo(() => {
+    const direct = files[path];
+    if (direct !== void 0) return direct;
+    if (path === APP_ROOT || path.startsWith(`${APP_ROOT}/`)) return void 0;
+    return files[underAppRoot(path)];
+  }, [path, files]);
 };
+const useAllMetadata = () => useMetadataStore();
 const useObjectUrl = (mount, relPath, opts) => {
   const [state, setState] = useState({
     url: null,

package/dist/hooks.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/hooks.ts"],"sourcesContent":["import { use, useEffect, useMemo, useRef, useState } from 'react';\nimport { TinkerableContext } from './TinkerableContext';\nimport { openFs, type FsError } from './fs';\nimport type { SandboxMount } from './mounts';\nimport {\n  FilesMetadata,\n  Metadata,\n  MetadataQueryEntry,\n  MetadataQueryFunction,\n  MetadataQueryResult,\n} from './sandboxTypes';\n\nconst entriesEqual = <T>(a: MetadataQueryEntry<T>[], b: MetadataQueryEntry<T>[]): boolean => {\n  if (a.length !== b.length) {\n    return false;\n  }\n  for (let i = 0; i < a.length; i++) {\n    // Unchanged frontmatter keeps its object identity across `metadata-update`\n    // merges, so an identity check on `meta` is a sound \"did this match change?\".\n    if (a[i].path !== b[i].path || a[i].meta !== b[i].meta) {\n      return false;\n    }\n  }\n  return true;\n};\n\n/**\n * Query the file metadata store (MDX frontmatter) with a plain JS function.\n *\n * The query receives every file's frontmatter keyed by path and returns the paths\n * that match; the hook resolves each path back to its frontmatter and returns an\n * array of `{ path, meta }` entries — so a single call gives you everything you\n * filtered on, with no second lookup. A throwing query is reported as `{ error }`\n * rather than crashing the render.\n *\n * The query runs synchronously during render (no empty first frame), and the\n * returned array keeps its identity while the matches are unchanged, so it is safe\n * to use directly in downstream `useMemo`/`useEffect` dependency arrays.\n *\n * Pass a type parameter to get typed frontmatter throughout:\n * ```ts\n * interface PostMeta { title: string; date: string; draft?: boolean }\n * const posts = useMetadataQuery<PostMeta>((files) =>\n *   Object.entries(files)\n *     .filter(([, m]) => !m.draft)\n *     .sort(([, a], [, b]) => b.date.localeCompare(a.date))\n *     .map(([path]) => path),\n * );\n * ```\n */\nexport const useMetadataQuery = <T = Metadata>(\n  queryFunction: MetadataQueryFunction<T>,\n): MetadataQueryResult<T> => {\n  const { filesMetadata } = use(TinkerableContext);\n  const previous = useRef<MetadataQueryEntry<T>[]>([]);\n  return useMemo<MetadataQueryResult<T>>(() => {\n    const files = (filesMetadata ?? {}) as FilesMetadata<T>;\n    let entries: MetadataQueryEntry<T>[];\n    try {\n      entries = queryFunction(files).map((path) => ({ path, meta: files[path] }));\n    } catch (error) {\n      return { error };\n    }\n    // Preserve the prior array reference when nothing matched differently.\n    if (entriesEqual(entries, previous.current)) {\n      return previous.current;\n    }\n    previous.current = entries;\n    return entries;\n  }, [filesMetadata, queryFunction]);\n};\n\n/**\n * Read one file's metadata (MDX frontmatter) by repo-relative path. Returns\n * `undefined` when the path has no metadata. Pass a type parameter for typed\n * field access.\n */\nexport const useFileMetadata = <T = Metadata>(path: string): T | undefined => {\n  const { filesMetadata } = use(TinkerableContext);\n  return useMemo(\n    () => (filesMetadata ?? {})[path] as T | undefined,\n    [path, filesMetadata],\n  );\n};\n\n/**\n * The raw, reactive metadata store: a map from file path to frontmatter. The\n * escape hatch for apps that want to render their own index rather than express it\n * as a path-returning query. Pass a type parameter for typed frontmatter values.\n */\nexport const useAllMetadata = <T = Metadata>(): FilesMetadata<T> => {\n  const { filesMetadata } = use(TinkerableContext);\n  return (filesMetadata ?? {}) as FilesMetadata<T>;\n};\n\n/** The reactive state returned by {@link useObjectUrl}. */\nexport interface ObjectUrlState {\n  /** The object URL once the bytes have loaded; `null` while loading or on error. */\n  url: string | null;\n  /** True while the file is being read. */\n  loading: boolean;\n  /** The {@link FsError} if the read failed (`not-found`, `unavailable`, …), else `null`. */\n  error: FsError | null;\n}\n\n/**\n * Read a file from a mount into an **object URL** for `<img src>`, revoking it\n * automatically on unmount or when `mount`/`relPath` changes. This is the React\n * answer to \"an opaque-origin iframe can't fetch a mount path\": it reads the bytes\n * off the sandbox ZenFS ({@link openFs}) and hands you a URL to drop into an\n * `<img>`, and it owns the create/revoke lifecycle so you never leak a URL.\n *\n * Pass `null`/`undefined` for `mount` or `relPath` to mean \"nothing to load yet\"\n * (idle state, no read). For a ready-made element use `MountImage`.\n *\n * ```tsx\n * const { url, loading, error } = useObjectUrl(mount, 'photos/cat.png');\n * if (loading) return <Spinner />;\n * if (error || !url) return <span>missing</span>;\n * return <img src={url} alt=\"cat\" />;\n * ```\n */\nexport const useObjectUrl = (\n  mount: SandboxMount | null | undefined,\n  relPath: string | null | undefined,\n  opts?: { type?: string },\n): ObjectUrlState => {\n  const [state, setState] = useState<ObjectUrlState>({\n    url: null,\n    loading: Boolean(mount && relPath),\n    error: null,\n  });\n  const type = opts?.type;\n  // Key the effect on the mount's stable `path` (its object identity churns as the\n  // mount set re-announces) plus the relPath and the optional type override.\n  const mountPath = mount?.path;\n  useEffect(() => {\n    if (!mount || !relPath) {\n      setState({ url: null, loading: false, error: null });\n      return;\n    }\n    let alive = true;\n    let revoke: (() => void) | null = null;\n    setState({ url: null, loading: true, error: null });\n    openFs(mount)\n      .readObjectUrl(relPath, type ? { type } : undefined)\n      .then((res) => {\n        // Lost the race (unmounted / prop changed): revoke immediately, don't set.\n        if (!alive) {\n          res.revoke();\n          return;\n        }\n        revoke = res.revoke;\n        setState({ url: res.url, loading: false, error: null });\n      })\n      .catch((e) => {\n        if (alive) setState({ url: null, loading: false, error: e as FsError });\n      });\n    return () => {\n      alive = false;\n      if (revoke) revoke();\n    };\n    // `mount` is intentionally tracked via its stable `mountPath`.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [mountPath, relPath, type]);\n  return state;\n};\n"],"mappings":";AAAA,SAAS,KAAK,WAAW,SAAS,QAAQ,gBAAgB;AAC1D,SAAS,yBAAyB;AAClC,SAAS,cAA4B;AAUrC,MAAM,eAAe,CAAI,GAA4B,MAAwC;AAC3F,MAAI,EAAE,WAAW,EAAE,QAAQ;AACzB,WAAO;AAAA,EACT;AACA,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AAGjC,QAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM;AACtD,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AA0BO,MAAM,mBAAmB,CAC9B,kBAC2B;AAC3B,QAAM,EAAE,cAAc,IAAI,IAAI,iBAAiB;AAC/C,QAAM,WAAW,OAAgC,CAAC,CAAC;AACnD,SAAO,QAAgC,MAAM;AAC3C,UAAM,QAAS,iBAAiB,CAAC;AACjC,QAAI;AACJ,QAAI;AACF,gBAAU,cAAc,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,MAAM,MAAM,IAAI,EAAE,EAAE;AAAA,IAC5E,SAAS,OAAO;AACd,aAAO,EAAE,MAAM;AAAA,IACjB;AAEA,QAAI,aAAa,SAAS,SAAS,OAAO,GAAG;AAC3C,aAAO,SAAS;AAAA,IAClB;AACA,aAAS,UAAU;AACnB,WAAO;AAAA,EACT,GAAG,CAAC,eAAe,aAAa,CAAC;AACnC;AAOO,MAAM,kBAAkB,CAAe,SAAgC;AAC5E,QAAM,EAAE,cAAc,IAAI,IAAI,iBAAiB;AAC/C,SAAO;AAAA,IACL,OAAO,iBAAiB,CAAC,GAAG,IAAI;AAAA,IAChC,CAAC,MAAM,aAAa;AAAA,EACtB;AACF;AAOO,MAAM,iBAAiB,MAAsC;AAClE,QAAM,EAAE,cAAc,IAAI,IAAI,iBAAiB;AAC/C,SAAQ,iBAAiB,CAAC;AAC5B;AA6BO,MAAM,eAAe,CAC1B,OACA,SACA,SACmB;AACnB,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAyB;AAAA,IACjD,KAAK;AAAA,IACL,SAAS,QAAQ,SAAS,OAAO;AAAA,IACjC,OAAO;AAAA,EACT,CAAC;AACD,QAAM,OAAO,MAAM;AAGnB,QAAM,YAAY,OAAO;AACzB,YAAU,MAAM;AACd,QAAI,CAAC,SAAS,CAAC,SAAS;AACtB,eAAS,EAAE,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,CAAC;AACnD;AAAA,IACF;AACA,QAAI,QAAQ;AACZ,QAAI,SAA8B;AAClC,aAAS,EAAE,KAAK,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC;AAClD,WAAO,KAAK,EACT,cAAc,SAAS,OAAO,EAAE,KAAK,IAAI,MAAS,EAClD,KAAK,CAAC,QAAQ;AAEb,UAAI,CAAC,OAAO;AACV,YAAI,OAAO;AACX;AAAA,MACF;AACA,eAAS,IAAI;AACb,eAAS,EAAE,KAAK,IAAI,KAAK,SAAS,OAAO,OAAO,KAAK,CAAC;AAAA,IACxD,CAAC,EACA,MAAM,CAAC,MAAM;AACZ,UAAI,MAAO,UAAS,EAAE,KAAK,MAAM,SAAS,OAAO,OAAO,EAAa,CAAC;AAAA,IACxE,CAAC;AACH,WAAO,MAAM;AACX,cAAQ;AACR,UAAI,OAAQ,QAAO;AAAA,IACrB;AAAA,EAGF,GAAG,CAAC,WAAW,SAAS,IAAI,CAAC;AAC7B,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/hooks.ts"],"sourcesContent":["import { APP_ROOT, underAppRoot } from '@immediately-run/platform-constants';\nimport { useEffect, useMemo, useRef, useState } from 'react';\nimport { openFs, type FsError } from './fs';\nimport { useMetadataStore } from './metadataSource';\nimport type { SandboxMount } from './mounts';\nimport {\n  FilesMetadata,\n  Metadata,\n  MetadataQueryEntry,\n  MetadataQueryFunction,\n  MetadataQueryResult,\n} from './sandboxTypes';\n\nconst entriesEqual = <T>(\n  a: MetadataQueryEntry<T, Record<string, unknown>>[],\n  b: MetadataQueryEntry<T, Record<string, unknown>>[],\n): boolean => {\n  if (a.length !== b.length) {\n    return false;\n  }\n  for (let i = 0; i < a.length; i++) {\n    // Unchanged frontmatter keeps its object identity across `metadata-update`\n    // merges, so an identity check on `meta` is a sound \"did this match change?\".\n    if (a[i].path !== b[i].path || a[i].meta !== b[i].meta) {\n      return false;\n    }\n    // Extra fields a record-returning query computed (R3-276) are part of the\n    // result, so a change in them is a change in the result — compared by value,\n    // one level, because they are derived scalars, not the store's shared objects.\n    const ax = a[i] as Record<string, unknown>;\n    const bx = b[i] as Record<string, unknown>;\n    const keys = new Set([...Object.keys(ax), ...Object.keys(bx)]);\n    for (const k of keys) {\n      if (k === 'path' || k === 'meta') continue;\n      if (ax[k] !== bx[k]) return false;\n    }\n  }\n  return true;\n};\n\n/**\n * Query the file metadata store (MDX frontmatter) with a plain JS function.\n *\n * The query receives every file's frontmatter keyed by path and returns the paths\n * that match; the hook resolves each path back to its frontmatter and returns an\n * array of `{ path, meta }` entries — so a single call gives you everything you\n * filtered on, with no second lookup. A throwing query is reported as `{ error }`\n * rather than crashing the render.\n *\n * The query runs synchronously during render (no empty first frame), and the\n * returned array keeps its identity while the matches are unchanged, so it is safe\n * to use directly in downstream `useMemo`/`useEffect` dependency arrays.\n *\n * A query may return RECORDS instead of bare paths (R3-276) — `{ path, ...extra }`\n * — and the extra fields ride along on each entry, so something derived while\n * selecting does not have to be recomputed downstream:\n * ```ts\n * const posts = useMetadataQuery<PostMeta, { year: string }>((files) =>\n *   Object.entries(files).map(([path, m]) => ({ path, year: m.date.slice(0, 4) })),\n * );\n * ```\n * The store it queries is the nearest {@link MetadataSource}, else the host's.\n *\n * Pass a type parameter to get typed frontmatter throughout:\n * ```ts\n * interface PostMeta { title: string; date: string; draft?: boolean }\n * const posts = useMetadataQuery<PostMeta>((files) =>\n *   Object.entries(files)\n *     .filter(([, m]) => !m.draft)\n *     .sort(([, a], [, b]) => b.date.localeCompare(a.date))\n *     .map(([path]) => path),\n * );\n * ```\n */\nexport const useMetadataQuery = <T = Metadata, E extends object = {}>(\n  queryFunction: MetadataQueryFunction<T>,\n): MetadataQueryResult<T, E> => {\n  const files = useMetadataStore<T>();\n  const previous = useRef<MetadataQueryEntry<T, Record<string, unknown>>[]>([]);\n  return useMemo<MetadataQueryResult<T, E>>(() => {\n    let entries: MetadataQueryEntry<T, Record<string, unknown>>[];\n    try {\n      // `path` and `meta` are applied AFTER the record's own fields: a query cannot\n      // shadow the two the hook is responsible for, whatever it happened to name.\n      entries = queryFunction(files).map((selected) =>\n        typeof selected === 'string'\n          ? { path: selected, meta: files[selected] }\n          : { ...selected, path: selected.path, meta: files[selected.path] },\n      );\n    } catch (error) {\n      return { error };\n    }\n    // Preserve the prior array reference when nothing matched differently.\n    if (entriesEqual(entries, previous.current)) {\n      return previous.current as MetadataQueryEntry<T, E>[];\n    }\n    previous.current = entries;\n    return entries as MetadataQueryEntry<T, E>[];\n  }, [files, queryFunction]);\n};\n\n/**\n * Read one file's metadata (MDX frontmatter) by path. Returns `undefined` when the\n * path has no metadata. Pass a type parameter for typed field access.\n *\n * **The store is keyed by ABSOLUTE module path** — `/app/content/post.mdx`, the same\n * identifier `fs`, `module.dynamicImport` and `<Include>` use — not by the\n * repo-relative path this doc claimed until R3-276. Keeping metadata in the file\n * space is what lets an app read a file's metadata and render that same file by the\n * same path (`sandbox/src/bundler/metadataKey.test.ts` pins it).\n *\n * A repo-relative path (`/content/post.mdx`) is accepted as a fallback: if the path\n * is not a key, it is retried under the app root via the shared\n * `underAppRoot` helper (R3-275). That is additive — it only turns a previous\n * `undefined` into a value — and it exists because the old doc told people to pass\n * exactly that form. A path a {@link MetadataSource} provided in some other key\n * space is looked up as given, unchanged.\n */\nexport const useFileMetadata = <T = Metadata>(path: string): T | undefined => {\n  const files = useMetadataStore<T>();\n  return useMemo(() => {\n    const direct = files[path];\n    if (direct !== undefined) return direct;\n    // The fallback is for a path in the REPO-RELATIVE space. An already-app-rooted\n    // path that missed is simply a miss: retrying it would consult `/app/app/…`,\n    // which is not a key space anything writes — it would only ever hit by accident.\n    if (path === APP_ROOT || path.startsWith(`${APP_ROOT}/`)) return undefined;\n    return files[underAppRoot(path)];\n  }, [path, files]);\n};\n\n/**\n * The raw, reactive metadata store: a map from file path to frontmatter. The\n * escape hatch for apps that want to render their own index rather than express it\n * as a path-returning query. Pass a type parameter for typed frontmatter values.\n */\nexport const useAllMetadata = <T = Metadata>(): FilesMetadata<T> => useMetadataStore<T>();\n\n/** The reactive state returned by {@link useObjectUrl}. */\nexport interface ObjectUrlState {\n  /** The object URL once the bytes have loaded; `null` while loading or on error. */\n  url: string | null;\n  /** True while the file is being read. */\n  loading: boolean;\n  /** The {@link FsError} if the read failed (`not-found`, `unavailable`, …), else `null`. */\n  error: FsError | null;\n}\n\n/**\n * Read a file from a mount into an **object URL** for `<img src>`, revoking it\n * automatically on unmount or when `mount`/`relPath` changes. This is the React\n * answer to \"an opaque-origin iframe can't fetch a mount path\": it reads the bytes\n * off the sandbox ZenFS ({@link openFs}) and hands you a URL to drop into an\n * `<img>`, and it owns the create/revoke lifecycle so you never leak a URL.\n *\n * Pass `null`/`undefined` for `mount` or `relPath` to mean \"nothing to load yet\"\n * (idle state, no read). For a ready-made element use `MountImage`.\n *\n * ```tsx\n * const { url, loading, error } = useObjectUrl(mount, 'photos/cat.png');\n * if (loading) return <Spinner />;\n * if (error || !url) return <span>missing</span>;\n * return <img src={url} alt=\"cat\" />;\n * ```\n */\nexport const useObjectUrl = (\n  mount: SandboxMount | null | undefined,\n  relPath: string | null | undefined,\n  opts?: { type?: string },\n): ObjectUrlState => {\n  const [state, setState] = useState<ObjectUrlState>({\n    url: null,\n    loading: Boolean(mount && relPath),\n    error: null,\n  });\n  const type = opts?.type;\n  // Key the effect on the mount's stable `path` (its object identity churns as the\n  // mount set re-announces) plus the relPath and the optional type override.\n  const mountPath = mount?.path;\n  useEffect(() => {\n    if (!mount || !relPath) {\n      setState({ url: null, loading: false, error: null });\n      return;\n    }\n    let alive = true;\n    let revoke: (() => void) | null = null;\n    setState({ url: null, loading: true, error: null });\n    openFs(mount)\n      .readObjectUrl(relPath, type ? { type } : undefined)\n      .then((res) => {\n        // Lost the race (unmounted / prop changed): revoke immediately, don't set.\n        if (!alive) {\n          res.revoke();\n          return;\n        }\n        revoke = res.revoke;\n        setState({ url: res.url, loading: false, error: null });\n      })\n      .catch((e) => {\n        if (alive) setState({ url: null, loading: false, error: e as FsError });\n      });\n    return () => {\n      alive = false;\n      if (revoke) revoke();\n    };\n    // `mount` is intentionally tracked via its stable `mountPath`.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [mountPath, relPath, type]);\n  return state;\n};\n"],"mappings":";AAAA,SAAS,UAAU,oBAAoB;AACvC,SAAS,WAAW,SAAS,QAAQ,gBAAgB;AACrD,SAAS,cAA4B;AACrC,SAAS,wBAAwB;AAUjC,MAAM,eAAe,CACnB,GACA,MACY;AACZ,MAAI,EAAE,WAAW,EAAE,QAAQ;AACzB,WAAO;AAAA,EACT;AACA,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AAGjC,QAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM;AACtD,aAAO;AAAA,IACT;AAIA,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,KAAK,EAAE,CAAC;AACd,UAAM,OAAO,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,EAAE,GAAG,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC;AAC7D,eAAW,KAAK,MAAM;AACpB,UAAI,MAAM,UAAU,MAAM,OAAQ;AAClC,UAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAG,QAAO;AAAA,IAC9B;AAAA,EACF;AACA,SAAO;AACT;AAoCO,MAAM,mBAAmB,CAC9B,kBAC8B;AAC9B,QAAM,QAAQ,iBAAoB;AAClC,QAAM,WAAW,OAAyD,CAAC,CAAC;AAC5E,SAAO,QAAmC,MAAM;AAC9C,QAAI;AACJ,QAAI;AAGF,gBAAU,cAAc,KAAK,EAAE;AAAA,QAAI,CAAC,aAClC,OAAO,aAAa,WAChB,EAAE,MAAM,UAAU,MAAM,MAAM,QAAQ,EAAE,IACxC,EAAE,GAAG,UAAU,MAAM,SAAS,MAAM,MAAM,MAAM,SAAS,IAAI,EAAE;AAAA,MACrE;AAAA,IACF,SAAS,OAAO;AACd,aAAO,EAAE,MAAM;AAAA,IACjB;AAEA,QAAI,aAAa,SAAS,SAAS,OAAO,GAAG;AAC3C,aAAO,SAAS;AAAA,IAClB;AACA,aAAS,UAAU;AACnB,WAAO;AAAA,EACT,GAAG,CAAC,OAAO,aAAa,CAAC;AAC3B;AAmBO,MAAM,kBAAkB,CAAe,SAAgC;AAC5E,QAAM,QAAQ,iBAAoB;AAClC,SAAO,QAAQ,MAAM;AACnB,UAAM,SAAS,MAAM,IAAI;AACzB,QAAI,WAAW,OAAW,QAAO;AAIjC,QAAI,SAAS,YAAY,KAAK,WAAW,GAAG,QAAQ,GAAG,EAAG,QAAO;AACjE,WAAO,MAAM,aAAa,IAAI,CAAC;AAAA,EACjC,GAAG,CAAC,MAAM,KAAK,CAAC;AAClB;AAOO,MAAM,iBAAiB,MAAsC,iBAAoB;AA6BjF,MAAM,eAAe,CAC1B,OACA,SACA,SACmB;AACnB,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAyB;AAAA,IACjD,KAAK;AAAA,IACL,SAAS,QAAQ,SAAS,OAAO;AAAA,IACjC,OAAO;AAAA,EACT,CAAC;AACD,QAAM,OAAO,MAAM;AAGnB,QAAM,YAAY,OAAO;AACzB,YAAU,MAAM;AACd,QAAI,CAAC,SAAS,CAAC,SAAS;AACtB,eAAS,EAAE,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,CAAC;AACnD;AAAA,IACF;AACA,QAAI,QAAQ;AACZ,QAAI,SAA8B;AAClC,aAAS,EAAE,KAAK,MAAM,SAAS,MAAM,OAAO,KAAK,CAAC;AAClD,WAAO,KAAK,EACT,cAAc,SAAS,OAAO,EAAE,KAAK,IAAI,MAAS,EAClD,KAAK,CAAC,QAAQ;AAEb,UAAI,CAAC,OAAO;AACV,YAAI,OAAO;AACX;AAAA,MACF;AACA,eAAS,IAAI;AACb,eAAS,EAAE,KAAK,IAAI,KAAK,SAAS,OAAO,OAAO,KAAK,CAAC;AAAA,IACxD,CAAC,EACA,MAAM,CAAC,MAAM;AACZ,UAAI,MAAO,UAAS,EAAE,KAAK,MAAM,SAAS,OAAO,OAAO,EAAa,CAAC;AAAA,IACxE,CAAC;AACH,WAAO,MAAM;AACX,cAAQ;AACR,UAAI,OAAQ,QAAO;AAAA,IACrB;AAAA,EAGF,GAAG,CAAC,WAAW,SAAS,IAAI,CAAC;AAC7B,SAAO;AACT;","names":[]}

package/dist/index.cjs

@@ -29,9 +29,11 @@ __reExport(index_exports, require("./components/Include"), module.exports);
 var import_SafeInclude = require("./components/SafeInclude");
 __reExport(index_exports, require("./sourceCache"), module.exports);
 __reExport(index_exports, require("./components/MDXComponents"), module.exports);
+__reExport(index_exports, require("./linkSpace"), module.exports);
 __reExport(index_exports, require("./components/MountImage"), module.exports);
 __reExport(index_exports, require("./components/Routes"), module.exports);
 __reExport(index_exports, require("./hooks"), module.exports);
+__reExport(index_exports, require("./metadataSource"), module.exports);
 __reExport(index_exports, require("./auth"), module.exports);
 __reExport(index_exports, require("./theme"), module.exports);
 __reExport(index_exports, require("./editorContext"), module.exports);
@@ -69,9 +71,11 @@ __reExport(index_exports, require("./safeContent"), module.exports);
   ...require("./components/Include"),
   ...require("./sourceCache"),
   ...require("./components/MDXComponents"),
+  ...require("./linkSpace"),
   ...require("./components/MountImage"),
   ...require("./components/Routes"),
   ...require("./hooks"),
+  ...require("./metadataSource"),
   ...require("./auth"),
   ...require("./theme"),
   ...require("./editorContext"),

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,oCAXd;AAYA,0BAAc,gCAZd;AAaA,0BAAc,oBAbd;AAcA,0BAAc,mBAdd;AAeA,0BAAc,oBAfd;AAgBA,0BAAc,4BAhBd;AAiBA,0BAAc,qBAjBd;AAkBA,0BAAc,yBAlBd;AAmBA,0BAAc,qBAnBd;AAoBA,0BAAc,qBApBd;AAqBA,0BAAc,yBArBd;AAsBA,0BAAc,sBAtBd;AAuBA,0BAAc,kBAvBd;AAwBA,0BAAc,kBAxBd;AAyBA,0BAAc,uBAzBd;AA0BA,0BAAc,sBA1Bd;AA2BA,0BAAc,kBA3Bd;AA4BA,0BAAc,0BA5Bd;AA6BA,0BAAc,kBA7Bd;AA8BA,0BAAc,yBA9Bd;AA+BA,0BAAc,iBA/Bd;AAgCA,0BAAc,oBAhCd;AAiCA,0BAAc,oBAjCd;AAkCA,0BAAc,qBAlCd;AAmCA,0BAAc,sBAnCd;AAoCA,0BAAc,wBApCd;AAqCA,0BAAc,oBArCd;AAsCA,0BAAc,sBAtCd;AAuCA,0BAAc,6BAvCd;AAwCA,0BAAc,2BAxCd;AAyCA,0BAAc,0BAzCd;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,oCAZd;AAaA,0BAAc,gCAbd;AAcA,0BAAc,oBAdd;AAiBA,0BAAc,6BAjBd;AAkBA,0BAAc,mBAlBd;AAmBA,0BAAc,oBAnBd;AAoBA,0BAAc,4BApBd;AAqBA,0BAAc,qBArBd;AAsBA,0BAAc,yBAtBd;AAuBA,0BAAc,qBAvBd;AAwBA,0BAAc,qBAxBd;AAyBA,0BAAc,yBAzBd;AA0BA,0BAAc,sBA1Bd;AA2BA,0BAAc,kBA3Bd;AA4BA,0BAAc,kBA5Bd;AA6BA,0BAAc,uBA7Bd;AA8BA,0BAAc,sBA9Bd;AA+BA,0BAAc,kBA/Bd;AAgCA,0BAAc,0BAhCd;AAiCA,0BAAc,kBAjCd;AAkCA,0BAAc,yBAlCd;AAmCA,0BAAc,iBAnCd;AAoCA,0BAAc,oBApCd;AAqCA,0BAAc,oBArCd;AAsCA,0BAAc,qBAtCd;AAuCA,0BAAc,sBAvCd;AAwCA,0BAAc,wBAxCd;AAyCA,0BAAc,oBAzCd;AA0CA,0BAAc,sBA1Cd;AA2CA,0BAAc,6BA3Cd;AA4CA,0BAAc,2BA5Cd;AA6CA,0BAAc,0BA7Cd;","names":[]}

package/dist/index.d.cts

@@ -5,9 +5,11 @@ export { Include, RenderExportedComponent } from './components/Include.cjs';
 export { SafeInclude } from './components/SafeInclude.cjs';
 export { SourceCache, SourceReader, createSourceCache } from './sourceCache.cjs';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.cjs';
+export { FS_PREFIX, LinkSpace, LinkSpaceContext, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from './linkSpace.cjs';
 export { MountImage, MountImageProps } from './components/MountImage.cjs';
 export { Route, RouteProps, Routes } from './components/Routes.cjs';
 export { ObjectUrlState, useAllMetadata, useFileMetadata, useMetadataQuery, useObjectUrl } from './hooks.cjs';
+export { MetadataSource, MetadataSourceMode, MetadataSourceProps, useMetadataStore } from './metadataSource.cjs';
 export { AuthState, AuthStatus, SandboxUser, getAuthState, onAuthChange, useAuth } from './auth.cjs';
 export { HostTheme, getHostTheme, onHostThemeChange, setHostTheme, useHostTheme } from './theme.cjs';
 export { EditorContext, getEditorContext, onEditorContextChange, useEditorContext } from './editorContext.cjs';
@@ -34,7 +36,7 @@ export { ForwardedMarker, IR_MARKERS, IrMarkerName, isAllowedMarkerName, isIrMar
 export { ReadyState, __resetReady, __setReadyDeps, getReadyState, onReady, reportReady } from './ready.cjs';
 export { LOADING_TIMINGS, LoadingRegion, Skeleton, SkeletonArchetype, SkeletonRow, Spinner } from './loading.cjs';
 export { StreamError, StreamFrame, StreamTransport, consumeStream, protocolStream } from './protocolStream.cjs';
-export { EvaluationContext, FileQueryResult, FilesMetadata, Metadata, MetadataQueryEntry, MetadataQueryFunction, MetadataQueryResult, ModuleExports } from './sandboxTypes.cjs';
+export { EvaluationContext, FileQueryResult, FilesMetadata, Metadata, MetadataQueryEntry, MetadataQueryFunction, MetadataQueryRecord, MetadataQueryResult, ModuleExports } from './sandboxTypes.cjs';
 export { SafeContent, SafeContentProps } from './safeContent/SafeContent.cjs';
 export { RenderMdastOptions, SafeContentComponents, renderMdast } from './safeContent/renderMdast.cjs';
 export { ParseSafeMdastOptions, SafeMdastNode, SafeMdxAttribute, parseSafeMdast } from './safeContent/parseSafeMdast.cjs';

package/dist/index.d.ts

@@ -5,9 +5,11 @@ export { Include, RenderExportedComponent } from './components/Include.js';
 export { SafeInclude } from './components/SafeInclude.js';
 export { SourceCache, SourceReader, createSourceCache } from './sourceCache.js';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.js';
+export { FS_PREFIX, LinkSpace, LinkSpaceContext, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from './linkSpace.js';
 export { MountImage, MountImageProps } from './components/MountImage.js';
 export { Route, RouteProps, Routes } from './components/Routes.js';
 export { ObjectUrlState, useAllMetadata, useFileMetadata, useMetadataQuery, useObjectUrl } from './hooks.js';
+export { MetadataSource, MetadataSourceMode, MetadataSourceProps, useMetadataStore } from './metadataSource.js';
 export { AuthState, AuthStatus, SandboxUser, getAuthState, onAuthChange, useAuth } from './auth.js';
 export { HostTheme, getHostTheme, onHostThemeChange, setHostTheme, useHostTheme } from './theme.js';
 export { EditorContext, getEditorContext, onEditorContextChange, useEditorContext } from './editorContext.js';
@@ -34,7 +36,7 @@ export { ForwardedMarker, IR_MARKERS, IrMarkerName, isAllowedMarkerName, isIrMar
 export { ReadyState, __resetReady, __setReadyDeps, getReadyState, onReady, reportReady } from './ready.js';
 export { LOADING_TIMINGS, LoadingRegion, Skeleton, SkeletonArchetype, SkeletonRow, Spinner } from './loading.js';
 export { StreamError, StreamFrame, StreamTransport, consumeStream, protocolStream } from './protocolStream.js';
-export { EvaluationContext, FileQueryResult, FilesMetadata, Metadata, MetadataQueryEntry, MetadataQueryFunction, MetadataQueryResult, ModuleExports } from './sandboxTypes.js';
+export { EvaluationContext, FileQueryResult, FilesMetadata, Metadata, MetadataQueryEntry, MetadataQueryFunction, MetadataQueryRecord, MetadataQueryResult, ModuleExports } from './sandboxTypes.js';
 export { SafeContent, SafeContentProps } from './safeContent/SafeContent.js';
 export { RenderMdastOptions, SafeContentComponents, renderMdast } from './safeContent/renderMdast.js';
 export { ParseSafeMdastOptions, SafeMdastNode, SafeMdxAttribute, parseSafeMdast } from './safeContent/parseSafeMdast.js';

package/dist/index.js

@@ -6,9 +6,11 @@ export * from "./components/Include";
 import { SafeInclude } from "./components/SafeInclude";
 export * from "./sourceCache";
 export * from "./components/MDXComponents";
+export * from "./linkSpace";
 export * from "./components/MountImage";
 export * from "./components/Routes";
 export * from "./hooks";
+export * from "./metadataSource";
 export * from "./auth";
 export * from "./theme";
 export * from "./editorContext";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from \"./MDXProvider\";\nexport * from \"./routing\";\nexport * from \"./boot\";\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks'\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}

package/dist/ipc.cjs

@@ -26,8 +26,10 @@ __export(ipc_exports, {
 module.exports = __toCommonJS(ipc_exports);
 var import_react = require("react");
 var import_sandboxUtils = require("./sandboxUtils");
+var import_protocol = require("./generated/protocol");
+var import_protocolSchemes = require("./protocolSchemes");
 const postToRegion = async (region, data) => {
-  const res = await (0, import_sandboxUtils.protocolRequest)("ipc", "post", [{ to: region, msg: data }]);
+  const res = await (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_IPC], "post", [{ to: region, msg: data }]);
   if (!res || res.ok !== true) {
     const err = new Error(res?.message ?? "ipc post failed");
     err.code = res?.code ?? "unknown";
@@ -35,7 +37,7 @@ const postToRegion = async (region, data) => {
   }
 };
 const revealRegion = async (region) => {
-  const res = await (0, import_sandboxUtils.protocolRequest)("ipc", "reveal", [{ to: region }]);
+  const res = await (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_IPC], "reveal", [{ to: region }]);
   if (!res || res.ok !== true) {
     const err = new Error(res?.message ?? "ipc reveal failed");
     err.code = res?.code ?? "unknown";
@@ -43,7 +45,7 @@ const revealRegion = async (region) => {
   }
 };
 const onRegionMessage = (listener) => (0, import_sandboxUtils.addListener)(
-  "region-message",
+  import_protocol.REGION_MESSAGE,
   (m) => listener({ from: m.from, data: m.data })
 );
 const useRegionMessage = () => {

package/dist/ipc.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/ipc.ts"],"sourcesContent":["// Inter-app messaging (UI_AS_APPS_SPEC §5.6) — L2: chrome panels/regions talk to\n// each other across an edge BOTH sides declared in their bindings (sender `ipc.to`\n// + the `ipc` capability; receiver `ipc.accepts`). The host enforces both halves\n// and attaches an unspoofable `from`; you still treat the payload as untrusted.\nimport { useEffect, useState } from 'react';\nimport { protocolRequest, addListener } from './sandboxUtils';\n\n/** A message delivered to this region. `from` is the SENDER's region, attached by\n *  the host (unspoofable, T19); `data` is the sender-provided payload. */\nexport interface RegionMessage {\n  from: string;\n  data: unknown;\n}\n\n/**\n * Send a message to another region. Resolves when delivered; rejects (`forbidden`)\n * if the edge isn't two-sided-consented, the target isn't mounted, or this app\n * lacks the `ipc` capability.\n */\nexport const postToRegion = async (region: string, data: unknown): Promise<void> => {\n  const res = (await protocolRequest('ipc', 'post', [{ to: region, msg: data }])) as\n    | { ok: true }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'ipc post failed') as Error & { code?: string };\n    err.code = res?.code ?? 'unknown';\n    throw err;\n  }\n};\n\n/**\n * Ask the host to bring the user to `region` — the `reveal`-class method of\n * UI_AS_APPS_SPEC §4.1's focus model (R3-243). On mobile that is the column\n * transition (the panel's carousel advances to the main pane); on desktop a focus\n * move. Use it when a tap in your panel produces something to look at in another\n * column, right after the `postToRegion` that sends it there:\n *\n * ```ts\n * onClick={() => {                                   // a REAL user gesture\n *   void postToRegion('stage.conversation', { type: 'select-conversation', id });\n *   void revealRegion('stage.conversation');\n * }}\n * ```\n *\n * **Call it synchronously inside a user-gesture handler.** The host reads its own\n * transient user activation and refuses without one — an app flipping columns on a\n * timer is the attention-steal primitive §4.1 is written against. It reaches only\n * regions you already have a two-sided IPC edge to, and only within the active\n * activity, so it can neither jump the user into an unrelated surface nor pull\n * focus back to the caller's own column.\n *\n * Resolves once the host has *considered* the request — deliberately NOT reporting\n * whether focus actually moved. Whether the user is moved is the host's call\n * (activation, rate limit, already-there), and an app that could observe the\n * refusal would be tempted to retry, which is the behaviour the gate exists to\n * stop. Rejects only on a genuine authorization failure (`forbidden`): no `ipc`\n * capability, or no declared edge to `region`.\n */\nexport const revealRegion = async (region: string): Promise<void> => {\n  const res = (await protocolRequest('ipc', 'reveal', [{ to: region }])) as\n    | { ok: true }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'ipc reveal failed') as Error & { code?: string };\n    err.code = res?.code ?? 'unknown';\n    throw err;\n  }\n};\n\n/** Subscribe to inbound region messages. Returns an unsubscribe fn. */\nexport const onRegionMessage = (listener: (msg: RegionMessage) => void): (() => void) =>\n  addListener('region-message', (m: { from: string; data: unknown }) =>\n    listener({ from: m.from, data: m.data }),\n  );\n\n/** React hook: the most recent inbound region message (or `null`). */\nexport const useRegionMessage = (): RegionMessage | null => {\n  const [msg, setMsg] = useState<RegionMessage | null>(null);\n  useEffect(() => onRegionMessage(setMsg), []);\n  return msg;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,mBAAoC;AACpC,0BAA6C;AActC,MAAM,eAAe,OAAO,QAAgB,SAAiC;AAClF,QAAM,MAAO,UAAM,qCAAgB,OAAO,QAAQ,CAAC,EAAE,IAAI,QAAQ,KAAK,KAAK,CAAC,CAAC;AAI7E,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,iBAAiB;AACvD,QAAI,OAAO,KAAK,QAAQ;AACxB,UAAM;AAAA,EACR;AACF;AA8BO,MAAM,eAAe,OAAO,WAAkC;AACnE,QAAM,MAAO,UAAM,qCAAgB,OAAO,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC;AAIpE,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,mBAAmB;AACzD,QAAI,OAAO,KAAK,QAAQ;AACxB,UAAM;AAAA,EACR;AACF;AAGO,MAAM,kBAAkB,CAAC,iBAC9B;AAAA,EAAY;AAAA,EAAkB,CAAC,MAC7B,SAAS,EAAE,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,CAAC;AACzC;AAGK,MAAM,mBAAmB,MAA4B;AAC1D,QAAM,CAAC,KAAK,MAAM,QAAI,uBAA+B,IAAI;AACzD,8BAAU,MAAM,gBAAgB,MAAM,GAAG,CAAC,CAAC;AAC3C,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/ipc.ts"],"sourcesContent":["// Inter-app messaging (UI_AS_APPS_SPEC §5.6) — L2: chrome panels/regions talk to\n// each other across an edge BOTH sides declared in their bindings (sender `ipc.to`\n// + the `ipc` capability; receiver `ipc.accepts`). The host enforces both halves\n// and attaches an unspoofable `from`; you still treat the payload as untrusted.\nimport { useEffect, useState } from 'react';\nimport { protocolRequest, addListener } from './sandboxUtils';\nimport { PROTOCOL_IPC, REGION_MESSAGE } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** A message delivered to this region. `from` is the SENDER's region, attached by\n *  the host (unspoofable, T19); `data` is the sender-provided payload. */\nexport interface RegionMessage {\n  from: string;\n  data: unknown;\n}\n\n/**\n * Send a message to another region. Resolves when delivered; rejects (`forbidden`)\n * if the edge isn't two-sided-consented, the target isn't mounted, or this app\n * lacks the `ipc` capability.\n */\nexport const postToRegion = async (region: string, data: unknown): Promise<void> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_IPC], 'post', [{ to: region, msg: data }])) as\n    | { ok: true }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'ipc post failed') as Error & { code?: string };\n    err.code = res?.code ?? 'unknown';\n    throw err;\n  }\n};\n\n/**\n * Ask the host to bring the user to `region` — the `reveal`-class method of\n * UI_AS_APPS_SPEC §4.1's focus model (R3-243). On mobile that is the column\n * transition (the panel's carousel advances to the main pane); on desktop a focus\n * move. Use it when a tap in your panel produces something to look at in another\n * column, right after the `postToRegion` that sends it there:\n *\n * ```ts\n * onClick={() => {                                   // a REAL user gesture\n *   void postToRegion('stage.conversation', { type: 'select-conversation', id });\n *   void revealRegion('stage.conversation');\n * }}\n * ```\n *\n * **Call it synchronously inside a user-gesture handler.** The host reads its own\n * transient user activation and refuses without one — an app flipping columns on a\n * timer is the attention-steal primitive §4.1 is written against. It reaches only\n * regions you already have a two-sided IPC edge to, and only within the active\n * activity, so it can neither jump the user into an unrelated surface nor pull\n * focus back to the caller's own column.\n *\n * Resolves once the host has *considered* the request — deliberately NOT reporting\n * whether focus actually moved. Whether the user is moved is the host's call\n * (activation, rate limit, already-there), and an app that could observe the\n * refusal would be tempted to retry, which is the behaviour the gate exists to\n * stop. Rejects only on a genuine authorization failure (`forbidden`): no `ipc`\n * capability, or no declared edge to `region`.\n */\nexport const revealRegion = async (region: string): Promise<void> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_IPC], 'reveal', [{ to: region }])) as\n    | { ok: true }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'ipc reveal failed') as Error & { code?: string };\n    err.code = res?.code ?? 'unknown';\n    throw err;\n  }\n};\n\n/** Subscribe to inbound region messages. Returns an unsubscribe fn. */\nexport const onRegionMessage = (listener: (msg: RegionMessage) => void): (() => void) =>\n  addListener(REGION_MESSAGE, (m: { from: string; data: unknown }) =>\n    listener({ from: m.from, data: m.data }),\n  );\n\n/** React hook: the most recent inbound region message (or `null`). */\nexport const useRegionMessage = (): RegionMessage | null => {\n  const [msg, setMsg] = useState<RegionMessage | null>(null);\n  useEffect(() => onRegionMessage(setMsg), []);\n  return msg;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,mBAAoC;AACpC,0BAA6C;AAC7C,sBAA6C;AAC7C,6BAAwB;AAcjB,MAAM,eAAe,OAAO,QAAgB,SAAiC;AAClF,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,4BAAY,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,KAAK,KAAK,CAAC,CAAC;AAI7F,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,iBAAiB;AACvD,QAAI,OAAO,KAAK,QAAQ;AACxB,UAAM;AAAA,EACR;AACF;AA8BO,MAAM,eAAe,OAAO,WAAkC;AACnE,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,4BAAY,GAAG,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC;AAIpF,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,mBAAmB;AACzD,QAAI,OAAO,KAAK,QAAQ;AACxB,UAAM;AAAA,EACR;AACF;AAGO,MAAM,kBAAkB,CAAC,iBAC9B;AAAA,EAAY;AAAA,EAAgB,CAAC,MAC3B,SAAS,EAAE,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,CAAC;AACzC;AAGK,MAAM,mBAAmB,MAA4B;AAC1D,QAAM,CAAC,KAAK,MAAM,QAAI,uBAA+B,IAAI;AACzD,8BAAU,MAAM,gBAAgB,MAAM,GAAG,CAAC,CAAC;AAC3C,SAAO;AACT;","names":[]}

package/dist/ipc.js

@@ -1,8 +1,10 @@
 import "./chunk-VHAA22YE.js";
 import { useEffect, useState } from "react";
 import { protocolRequest, addListener } from "./sandboxUtils";
+import { PROTOCOL_IPC, REGION_MESSAGE } from "./generated/protocol";
+import { SCHEMES } from "./protocolSchemes";
 const postToRegion = async (region, data) => {
-  const res = await protocolRequest("ipc", "post", [{ to: region, msg: data }]);
+  const res = await protocolRequest(SCHEMES[PROTOCOL_IPC], "post", [{ to: region, msg: data }]);
   if (!res || res.ok !== true) {
     const err = new Error(res?.message ?? "ipc post failed");
     err.code = res?.code ?? "unknown";
@@ -10,7 +12,7 @@ const postToRegion = async (region, data) => {
   }
 };
 const revealRegion = async (region) => {
-  const res = await protocolRequest("ipc", "reveal", [{ to: region }]);
+  const res = await protocolRequest(SCHEMES[PROTOCOL_IPC], "reveal", [{ to: region }]);
   if (!res || res.ok !== true) {
     const err = new Error(res?.message ?? "ipc reveal failed");
     err.code = res?.code ?? "unknown";
@@ -18,7 +20,7 @@ const revealRegion = async (region) => {
   }
 };
 const onRegionMessage = (listener) => addListener(
-  "region-message",
+  REGION_MESSAGE,
   (m) => listener({ from: m.from, data: m.data })
 );
 const useRegionMessage = () => {

package/dist/ipc.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/ipc.ts"],"sourcesContent":["// Inter-app messaging (UI_AS_APPS_SPEC §5.6) — L2: chrome panels/regions talk to\n// each other across an edge BOTH sides declared in their bindings (sender `ipc.to`\n// + the `ipc` capability; receiver `ipc.accepts`). The host enforces both halves\n// and attaches an unspoofable `from`; you still treat the payload as untrusted.\nimport { useEffect, useState } from 'react';\nimport { protocolRequest, addListener } from './sandboxUtils';\n\n/** A message delivered to this region. `from` is the SENDER's region, attached by\n *  the host (unspoofable, T19); `data` is the sender-provided payload. */\nexport interface RegionMessage {\n  from: string;\n  data: unknown;\n}\n\n/**\n * Send a message to another region. Resolves when delivered; rejects (`forbidden`)\n * if the edge isn't two-sided-consented, the target isn't mounted, or this app\n * lacks the `ipc` capability.\n */\nexport const postToRegion = async (region: string, data: unknown): Promise<void> => {\n  const res = (await protocolRequest('ipc', 'post', [{ to: region, msg: data }])) as\n    | { ok: true }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'ipc post failed') as Error & { code?: string };\n    err.code = res?.code ?? 'unknown';\n    throw err;\n  }\n};\n\n/**\n * Ask the host to bring the user to `region` — the `reveal`-class method of\n * UI_AS_APPS_SPEC §4.1's focus model (R3-243). On mobile that is the column\n * transition (the panel's carousel advances to the main pane); on desktop a focus\n * move. Use it when a tap in your panel produces something to look at in another\n * column, right after the `postToRegion` that sends it there:\n *\n * ```ts\n * onClick={() => {                                   // a REAL user gesture\n *   void postToRegion('stage.conversation', { type: 'select-conversation', id });\n *   void revealRegion('stage.conversation');\n * }}\n * ```\n *\n * **Call it synchronously inside a user-gesture handler.** The host reads its own\n * transient user activation and refuses without one — an app flipping columns on a\n * timer is the attention-steal primitive §4.1 is written against. It reaches only\n * regions you already have a two-sided IPC edge to, and only within the active\n * activity, so it can neither jump the user into an unrelated surface nor pull\n * focus back to the caller's own column.\n *\n * Resolves once the host has *considered* the request — deliberately NOT reporting\n * whether focus actually moved. Whether the user is moved is the host's call\n * (activation, rate limit, already-there), and an app that could observe the\n * refusal would be tempted to retry, which is the behaviour the gate exists to\n * stop. Rejects only on a genuine authorization failure (`forbidden`): no `ipc`\n * capability, or no declared edge to `region`.\n */\nexport const revealRegion = async (region: string): Promise<void> => {\n  const res = (await protocolRequest('ipc', 'reveal', [{ to: region }])) as\n    | { ok: true }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'ipc reveal failed') as Error & { code?: string };\n    err.code = res?.code ?? 'unknown';\n    throw err;\n  }\n};\n\n/** Subscribe to inbound region messages. Returns an unsubscribe fn. */\nexport const onRegionMessage = (listener: (msg: RegionMessage) => void): (() => void) =>\n  addListener('region-message', (m: { from: string; data: unknown }) =>\n    listener({ from: m.from, data: m.data }),\n  );\n\n/** React hook: the most recent inbound region message (or `null`). */\nexport const useRegionMessage = (): RegionMessage | null => {\n  const [msg, setMsg] = useState<RegionMessage | null>(null);\n  useEffect(() => onRegionMessage(setMsg), []);\n  return msg;\n};\n"],"mappings":";AAIA,SAAS,WAAW,gBAAgB;AACpC,SAAS,iBAAiB,mBAAmB;AActC,MAAM,eAAe,OAAO,QAAgB,SAAiC;AAClF,QAAM,MAAO,MAAM,gBAAgB,OAAO,QAAQ,CAAC,EAAE,IAAI,QAAQ,KAAK,KAAK,CAAC,CAAC;AAI7E,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,iBAAiB;AACvD,QAAI,OAAO,KAAK,QAAQ;AACxB,UAAM;AAAA,EACR;AACF;AA8BO,MAAM,eAAe,OAAO,WAAkC;AACnE,QAAM,MAAO,MAAM,gBAAgB,OAAO,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC;AAIpE,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,mBAAmB;AACzD,QAAI,OAAO,KAAK,QAAQ;AACxB,UAAM;AAAA,EACR;AACF;AAGO,MAAM,kBAAkB,CAAC,aAC9B;AAAA,EAAY;AAAA,EAAkB,CAAC,MAC7B,SAAS,EAAE,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,CAAC;AACzC;AAGK,MAAM,mBAAmB,MAA4B;AAC1D,QAAM,CAAC,KAAK,MAAM,IAAI,SAA+B,IAAI;AACzD,YAAU,MAAM,gBAAgB,MAAM,GAAG,CAAC,CAAC;AAC3C,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/ipc.ts"],"sourcesContent":["// Inter-app messaging (UI_AS_APPS_SPEC §5.6) — L2: chrome panels/regions talk to\n// each other across an edge BOTH sides declared in their bindings (sender `ipc.to`\n// + the `ipc` capability; receiver `ipc.accepts`). The host enforces both halves\n// and attaches an unspoofable `from`; you still treat the payload as untrusted.\nimport { useEffect, useState } from 'react';\nimport { protocolRequest, addListener } from './sandboxUtils';\nimport { PROTOCOL_IPC, REGION_MESSAGE } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** A message delivered to this region. `from` is the SENDER's region, attached by\n *  the host (unspoofable, T19); `data` is the sender-provided payload. */\nexport interface RegionMessage {\n  from: string;\n  data: unknown;\n}\n\n/**\n * Send a message to another region. Resolves when delivered; rejects (`forbidden`)\n * if the edge isn't two-sided-consented, the target isn't mounted, or this app\n * lacks the `ipc` capability.\n */\nexport const postToRegion = async (region: string, data: unknown): Promise<void> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_IPC], 'post', [{ to: region, msg: data }])) as\n    | { ok: true }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'ipc post failed') as Error & { code?: string };\n    err.code = res?.code ?? 'unknown';\n    throw err;\n  }\n};\n\n/**\n * Ask the host to bring the user to `region` — the `reveal`-class method of\n * UI_AS_APPS_SPEC §4.1's focus model (R3-243). On mobile that is the column\n * transition (the panel's carousel advances to the main pane); on desktop a focus\n * move. Use it when a tap in your panel produces something to look at in another\n * column, right after the `postToRegion` that sends it there:\n *\n * ```ts\n * onClick={() => {                                   // a REAL user gesture\n *   void postToRegion('stage.conversation', { type: 'select-conversation', id });\n *   void revealRegion('stage.conversation');\n * }}\n * ```\n *\n * **Call it synchronously inside a user-gesture handler.** The host reads its own\n * transient user activation and refuses without one — an app flipping columns on a\n * timer is the attention-steal primitive §4.1 is written against. It reaches only\n * regions you already have a two-sided IPC edge to, and only within the active\n * activity, so it can neither jump the user into an unrelated surface nor pull\n * focus back to the caller's own column.\n *\n * Resolves once the host has *considered* the request — deliberately NOT reporting\n * whether focus actually moved. Whether the user is moved is the host's call\n * (activation, rate limit, already-there), and an app that could observe the\n * refusal would be tempted to retry, which is the behaviour the gate exists to\n * stop. Rejects only on a genuine authorization failure (`forbidden`): no `ipc`\n * capability, or no declared edge to `region`.\n */\nexport const revealRegion = async (region: string): Promise<void> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_IPC], 'reveal', [{ to: region }])) as\n    | { ok: true }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'ipc reveal failed') as Error & { code?: string };\n    err.code = res?.code ?? 'unknown';\n    throw err;\n  }\n};\n\n/** Subscribe to inbound region messages. Returns an unsubscribe fn. */\nexport const onRegionMessage = (listener: (msg: RegionMessage) => void): (() => void) =>\n  addListener(REGION_MESSAGE, (m: { from: string; data: unknown }) =>\n    listener({ from: m.from, data: m.data }),\n  );\n\n/** React hook: the most recent inbound region message (or `null`). */\nexport const useRegionMessage = (): RegionMessage | null => {\n  const [msg, setMsg] = useState<RegionMessage | null>(null);\n  useEffect(() => onRegionMessage(setMsg), []);\n  return msg;\n};\n"],"mappings":";AAIA,SAAS,WAAW,gBAAgB;AACpC,SAAS,iBAAiB,mBAAmB;AAC7C,SAAS,cAAc,sBAAsB;AAC7C,SAAS,eAAe;AAcjB,MAAM,eAAe,OAAO,QAAgB,SAAiC;AAClF,QAAM,MAAO,MAAM,gBAAgB,QAAQ,YAAY,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,KAAK,KAAK,CAAC,CAAC;AAI7F,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,iBAAiB;AACvD,QAAI,OAAO,KAAK,QAAQ;AACxB,UAAM;AAAA,EACR;AACF;AA8BO,MAAM,eAAe,OAAO,WAAkC;AACnE,QAAM,MAAO,MAAM,gBAAgB,QAAQ,YAAY,GAAG,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC;AAIpF,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,mBAAmB;AACzD,QAAI,OAAO,KAAK,QAAQ;AACxB,UAAM;AAAA,EACR;AACF;AAGO,MAAM,kBAAkB,CAAC,aAC9B;AAAA,EAAY;AAAA,EAAgB,CAAC,MAC3B,SAAS,EAAE,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,CAAC;AACzC;AAGK,MAAM,mBAAmB,MAA4B;AAC1D,QAAM,CAAC,KAAK,MAAM,IAAI,SAA+B,IAAI;AACzD,YAAU,MAAM,gBAAgB,MAAM,GAAG,CAAC,CAAC;AAC3C,SAAO;AACT;","names":[]}

package/dist/launch.cjs

@@ -29,9 +29,11 @@ __export(launch_exports, {
 });
 module.exports = __toCommonJS(launch_exports);
 var import_sandboxUtils = require("./sandboxUtils");
+var import_protocol = require("./generated/protocol");
+var import_protocolSchemes = require("./protocolSchemes");
 var _status, _dismissListeners, _ended;
 const liveHandles = /* @__PURE__ */ new Map();
-(0, import_sandboxUtils.addListener)("launch-ended", (m) => {
+(0, import_sandboxUtils.addListener)(import_protocol.LAUNCH_ENDED, (m) => {
   const h = liveHandles.get(m.launchId);
   if (h) h._end(m.status);
 });
@@ -48,7 +50,7 @@ class LaunchHandleImpl {
   }
   dismiss() {
     if (__privateGet(this, _ended)) return;
-    (0, import_sandboxUtils.sendMessage)("launch-dismiss", { launchId: this.launchId });
+    (0, import_sandboxUtils.sendMessage)(import_protocol.LAUNCH_DISMISS, { launchId: this.launchId });
   }
   onDismiss(cb) {
     if (__privateGet(this, _ended)) {
@@ -81,7 +83,7 @@ _status = new WeakMap();
 _dismissListeners = new WeakMap();
 _ended = new WeakMap();
 const launch = async (target, opts) => {
-  const res = await (0, import_sandboxUtils.protocolRequest)("launch", "create", [{ target, opts }]);
+  const res = await (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_LAUNCH], "create", [{ target, opts }]);
   if (!res || res.ok !== true || !res.data?.launchId) {
     const code = res && res.ok === false ? res.code ?? "unknown" : "unknown";
     return { ok: false, code };

package/dist/launch.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/launch.ts"],"sourcesContent":["// Launch — the TO-RUN twin of `invokeTask` (STANDING_APP_LIFECYCLE_SPEC §1–§6).\n// Where `invokeTask` is FOR-RESULT (await one value, callee exits), `launch` is\n// TO-RUN (non-blocking, standing): it starts a bound program RUNNING in a region\n// and hands back a HANDLE, never a typed value (R-SAL-1). The launched app earns\n// its OWN grants — the only launcher→launched data path is the explicitly\n// delegated `capDir`/`capFile` in `input` (§5), attenuated + tainted + gated host-\n// side. The host owns the whole lifecycle (visibility, budget, revocation,\n// teardown); the launcher only OBSERVES via the handle.\n//\n// A caller that wants a typed value back uses `invokeTask` instead — the two are\n// siblings, not a replacement.\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\n\n/** Where a launched program runs (§6). `overlay` covers the caller's own region\n *  with opaque host chrome; `stage` replaces the focal app (the elevated into-\n *  stage surface, §7 — refused above the stage-principal ceiling). */\nexport type LaunchRegion = 'overlay' | 'stage';\n\n/**\n * What to launch (§3) — binding-resolved, NEVER a caller-named app. Exactly one of:\n *  - `entryPoint`: a sibling entry point of the caller's OWN repo (the mini-app\n *    case, `AGENT_AUTHORING §5`) — **rejected `forbidden` until program-identity\n *    `appKey` lands** (R-SAL-2a);\n *  - `task`: a task contract (`open-project`, …), resolved through the user-\n *    overridable `task.<name>` binding to whichever app the user bound (§3 kind 2).\n */\nexport interface LaunchTarget {\n  /** Kind 1 — a sibling entry point of the caller's own repo (mini-app overlay). */\n  entryPoint?: string;\n  /** Kind 2 — a task contract name (the host resolves the bound provider). */\n  task?: string;\n  /** Optional accepted contract version for a `task` target (semver, e.g. `^1`). */\n  version?: string;\n}\n\nexport interface LaunchOptions {\n  /** Where it runs (§6). */\n  region: LaunchRegion;\n  /**\n   * Delegations + plain data handed to the launched app. `$cap:'dir'|'file'`\n   * markers (`capDir`/`capFile`, exported from `./tasks`) are resolved against the\n   * launcher's OWN grants and minted as attenuated, `ro`-by-default chroots (§5) —\n   * you can only delegate what you already hold. Everything else is plain data.\n   */\n  input?: Record<string, unknown>;\n}\n\n/** The live state of a launch (§2). Terminal states (`dismissed`/`revoked`/\n *  `failed`) are reached identically for self-exit, user dismiss, and host revoke —\n *  the host debounces so the launcher gets no timing oracle (R-SAL-1 / §6.4). */\nexport type LaunchStatus = 'running' | 'dismissed' | 'revoked' | 'failed';\n\n/** Machine codes a refused `launch` resolves with (§8). */\nexport type LaunchErrorCode =\n  | 'forbidden' // undeclared target; sibling (pre-AA-01); self-resolving target; stage cap absent\n  | 'unsupported' // no provider bound / entry point absent / unknown contract version\n  | 'budget' // over an R-SAL-8 concurrency/rate limit\n  | 'revoked' // a delegated mount was revoked during the create-and-bind window\n  | 'cancelled' // the user dismissed the host launch affordance (into-stage only)\n  | 'invalid-params' // a malformed `capDir`/`capFile` (`..`/absolute/mode-escalation)\n  | 'unknown';\n\n/**\n * The control channel back to a launch — the ONLY thing a launcher gets (§2).\n * There is no typed return value (R-SAL-1); `status`/`onDismiss` are debounced so\n * they cannot time-distinguish a self-exit from a user dismiss.\n */\nexport interface LaunchHandle {\n  /** Host-assigned id for this launch. */\n  readonly launchId: string;\n  /** The current lifecycle state (§2). */\n  readonly status: LaunchStatus;\n  /** Ask the host to tear this launch down. Idempotent (double-dismiss is a no-op). */\n  dismiss(): void;\n  /**\n   * Observe the launch ending (self-exit / user dismiss / host revoke — fired\n   * identically, R-SAL-1). Returns an unsubscribe fn. Fires at most once; if the\n   * launch has already ended it fires on the next tick.\n   */\n  onDismiss(cb: () => void): () => void;\n}\n\ninterface LaunchEndedMessage {\n  launchId: string;\n  status: Exclude<LaunchStatus, 'running'>;\n}\n\n/** Live handles awaiting their terminal `launch-ended` message, keyed by launchId. */\nconst liveHandles = new Map<string, LaunchHandleImpl>();\n\n// The host delivers ONE `launch-ended` message per launch when it tears down —\n// the SAME message shape for self-exit, dismiss, and revoke (the host debounces\n// so the timing is not an oracle, §6.4). We fan it out to the matching handle.\naddListener('launch-ended', (m: LaunchEndedMessage) => {\n  const h = liveHandles.get(m.launchId);\n  if (h) h._end(m.status);\n});\n\nclass LaunchHandleImpl implements LaunchHandle {\n  #status: LaunchStatus = 'running';\n  #dismissListeners = new Set<() => void>();\n  #ended = false;\n\n  constructor(readonly launchId: string) {\n    liveHandles.set(launchId, this);\n  }\n\n  get status(): LaunchStatus {\n    return this.#status;\n  }\n\n  dismiss(): void {\n    if (this.#ended) return;\n    // Fire-and-forget: the host owns teardown and answers with `launch-ended`,\n    // which drives `_end` (so status/onDismiss are host-authoritative, never\n    // optimistically local — a dismiss the host refuses would otherwise desync).\n    sendMessage('launch-dismiss', { launchId: this.launchId });\n  }\n\n  onDismiss(cb: () => void): () => void {\n    if (this.#ended) {\n      // Already ended: fire on the next tick so the contract (\"returns an\n      // unsubscribe\") holds and the callback never runs synchronously mid-register.\n      queueMicrotask(cb);\n      return () => {};\n    }\n    this.#dismissListeners.add(cb);\n    return () => {\n      this.#dismissListeners.delete(cb);\n    };\n  }\n\n  /** Host-driven terminal transition — the only writer of `status`. Idempotent. */\n  _end(status: Exclude<LaunchStatus, 'running'>): void {\n    if (this.#ended) return;\n    this.#ended = true;\n    this.#status = status;\n    liveHandles.delete(this.launchId);\n    const listeners = [...this.#dismissListeners];\n    this.#dismissListeners.clear();\n    for (const l of listeners) {\n      try {\n        l();\n      } catch {\n        /* a launcher's own callback must never wedge teardown */\n      }\n    }\n  }\n}\n\n/**\n * Launch a bound program to RUN in a region (§2). Non-blocking: resolves once the\n * frame is created and bound, with a {@link LaunchHandle} — or a typed\n * `{ ok:false, code }` on refusal (§8), NEVER a throw for an ordinary refusal (so\n * a launcher branches on `code` without a try/catch). The launched app runs under\n * its OWN grants; the launcher's authority does not flow to it (R-SAL-4).\n *\n *   const h = await launch({ task: 'open-project' }, {\n *     region: 'stage',\n *     input: { dir: capDir({ mountId: 'space:abc', relPath: 'proj' }, { mode: 'ro' }) },\n *   });\n *   if ('ok' in h && h.ok === false) { ...handle h.code... }\n *   else { h.onDismiss(() => ...); }\n */\nexport const launch = async (\n  target: LaunchTarget,\n  opts: LaunchOptions,\n): Promise<LaunchHandle | { ok: false; code: LaunchErrorCode }> => {\n  // The host wraps a successful handler return as `{ ok:true, data }` (the same\n  // Recipe-B framing `invokeTask` uses); a refusal is `{ ok:false, code }`.\n  const res = (await protocolRequest('launch', 'create', [{ target, opts }])) as\n    | { ok: true; data: { launchId: string } }\n    | { ok: false; code?: LaunchErrorCode }\n    | undefined;\n  if (!res || res.ok !== true || !res.data?.launchId) {\n    const code = res && res.ok === false ? (res.code ?? 'unknown') : 'unknown';\n    return { ok: false, code };\n  }\n  return new LaunchHandleImpl(res.data.launchId);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,0BAA0D;AAX1D;AAwFA,MAAM,cAAc,oBAAI,IAA8B;AAAA,IAKtD,iCAAY,gBAAgB,CAAC,MAA0B;AACrD,QAAM,IAAI,YAAY,IAAI,EAAE,QAAQ;AACpC,MAAI,EAAG,GAAE,KAAK,EAAE,MAAM;AACxB,CAAC;AAED,MAAM,iBAAyC;AAAA,EAK7C,YAAqB,UAAkB;AAAlB;AAJrB,gCAAwB;AACxB,0CAAoB,oBAAI,IAAgB;AACxC,+BAAS;AAGP,gBAAY,IAAI,UAAU,IAAI;AAAA,EAChC;AAAA,EAEA,IAAI,SAAuB;AACzB,WAAO,mBAAK;AAAA,EACd;AAAA,EAEA,UAAgB;AACd,QAAI,mBAAK,QAAQ;AAIjB,yCAAY,kBAAkB,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EAC3D;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,mBAAK,SAAQ;AAGf,qBAAe,EAAE;AACjB,aAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AACA,uBAAK,mBAAkB,IAAI,EAAE;AAC7B,WAAO,MAAM;AACX,yBAAK,mBAAkB,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,KAAK,QAAgD;AACnD,QAAI,mBAAK,QAAQ;AACjB,uBAAK,QAAS;AACd,uBAAK,SAAU;AACf,gBAAY,OAAO,KAAK,QAAQ;AAChC,UAAM,YAAY,CAAC,GAAG,mBAAK,kBAAiB;AAC5C,uBAAK,mBAAkB,MAAM;AAC7B,eAAW,KAAK,WAAW;AACzB,UAAI;AACF,UAAE;AAAA,MACJ,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAjDE;AACA;AACA;AA+DK,MAAM,SAAS,OACpB,QACA,SACiE;AAGjE,QAAM,MAAO,UAAM,qCAAgB,UAAU,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC;AAIzE,MAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,IAAI,MAAM,UAAU;AAClD,UAAM,OAAO,OAAO,IAAI,OAAO,QAAS,IAAI,QAAQ,YAAa;AACjE,WAAO,EAAE,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,SAAO,IAAI,iBAAiB,IAAI,KAAK,QAAQ;AAC/C;","names":[]}
+{"version":3,"sources":["../src/launch.ts"],"sourcesContent":["// Launch — the TO-RUN twin of `invokeTask` (STANDING_APP_LIFECYCLE_SPEC §1–§6).\n// Where `invokeTask` is FOR-RESULT (await one value, callee exits), `launch` is\n// TO-RUN (non-blocking, standing): it starts a bound program RUNNING in a region\n// and hands back a HANDLE, never a typed value (R-SAL-1). The launched app earns\n// its OWN grants — the only launcher→launched data path is the explicitly\n// delegated `capDir`/`capFile` in `input` (§5), attenuated + tainted + gated host-\n// side. The host owns the whole lifecycle (visibility, budget, revocation,\n// teardown); the launcher only OBSERVES via the handle.\n//\n// A caller that wants a typed value back uses `invokeTask` instead — the two are\n// siblings, not a replacement.\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\nimport { LAUNCH_DISMISS, LAUNCH_ENDED, PROTOCOL_LAUNCH } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** Where a launched program runs (§6). `overlay` covers the caller's own region\n *  with opaque host chrome; `stage` replaces the focal app (the elevated into-\n *  stage surface, §7 — refused above the stage-principal ceiling). */\nexport type LaunchRegion = 'overlay' | 'stage';\n\n/**\n * What to launch (§3) — binding-resolved, NEVER a caller-named app. Exactly one of:\n *  - `entryPoint`: a sibling entry point of the caller's OWN repo (the mini-app\n *    case, `AGENT_AUTHORING §5`) — **rejected `forbidden` until program-identity\n *    `appKey` lands** (R-SAL-2a);\n *  - `task`: a task contract (`open-project`, …), resolved through the user-\n *    overridable `task.<name>` binding to whichever app the user bound (§3 kind 2).\n */\nexport interface LaunchTarget {\n  /** Kind 1 — a sibling entry point of the caller's own repo (mini-app overlay). */\n  entryPoint?: string;\n  /** Kind 2 — a task contract name (the host resolves the bound provider). */\n  task?: string;\n  /** Optional accepted contract version for a `task` target (semver, e.g. `^1`). */\n  version?: string;\n}\n\nexport interface LaunchOptions {\n  /** Where it runs (§6). */\n  region: LaunchRegion;\n  /**\n   * Delegations + plain data handed to the launched app. `$cap:'dir'|'file'`\n   * markers (`capDir`/`capFile`, exported from `./tasks`) are resolved against the\n   * launcher's OWN grants and minted as attenuated, `ro`-by-default chroots (§5) —\n   * you can only delegate what you already hold. Everything else is plain data.\n   */\n  input?: Record<string, unknown>;\n}\n\n/** The live state of a launch (§2). Terminal states (`dismissed`/`revoked`/\n *  `failed`) are reached identically for self-exit, user dismiss, and host revoke —\n *  the host debounces so the launcher gets no timing oracle (R-SAL-1 / §6.4). */\nexport type LaunchStatus = 'running' | 'dismissed' | 'revoked' | 'failed';\n\n/** Machine codes a refused `launch` resolves with (§8). */\nexport type LaunchErrorCode =\n  | 'forbidden' // undeclared target; sibling (pre-AA-01); self-resolving target; stage cap absent\n  | 'unsupported' // no provider bound / entry point absent / unknown contract version\n  | 'budget' // over an R-SAL-8 concurrency/rate limit\n  | 'revoked' // a delegated mount was revoked during the create-and-bind window\n  | 'cancelled' // the user dismissed the host launch affordance (into-stage only)\n  | 'invalid-params' // a malformed `capDir`/`capFile` (`..`/absolute/mode-escalation)\n  | 'unknown';\n\n/**\n * The control channel back to a launch — the ONLY thing a launcher gets (§2).\n * There is no typed return value (R-SAL-1); `status`/`onDismiss` are debounced so\n * they cannot time-distinguish a self-exit from a user dismiss.\n */\nexport interface LaunchHandle {\n  /** Host-assigned id for this launch. */\n  readonly launchId: string;\n  /** The current lifecycle state (§2). */\n  readonly status: LaunchStatus;\n  /** Ask the host to tear this launch down. Idempotent (double-dismiss is a no-op). */\n  dismiss(): void;\n  /**\n   * Observe the launch ending (self-exit / user dismiss / host revoke — fired\n   * identically, R-SAL-1). Returns an unsubscribe fn. Fires at most once; if the\n   * launch has already ended it fires on the next tick.\n   */\n  onDismiss(cb: () => void): () => void;\n}\n\ninterface LaunchEndedMessage {\n  launchId: string;\n  status: Exclude<LaunchStatus, 'running'>;\n}\n\n/** Live handles awaiting their terminal `launch-ended` message, keyed by launchId. */\nconst liveHandles = new Map<string, LaunchHandleImpl>();\n\n// The host delivers ONE `launch-ended` message per launch when it tears down —\n// the SAME message shape for self-exit, dismiss, and revoke (the host debounces\n// so the timing is not an oracle, §6.4). We fan it out to the matching handle.\naddListener(LAUNCH_ENDED, (m: LaunchEndedMessage) => {\n  const h = liveHandles.get(m.launchId);\n  if (h) h._end(m.status);\n});\n\nclass LaunchHandleImpl implements LaunchHandle {\n  #status: LaunchStatus = 'running';\n  #dismissListeners = new Set<() => void>();\n  #ended = false;\n\n  constructor(readonly launchId: string) {\n    liveHandles.set(launchId, this);\n  }\n\n  get status(): LaunchStatus {\n    return this.#status;\n  }\n\n  dismiss(): void {\n    if (this.#ended) return;\n    // Fire-and-forget: the host owns teardown and answers with `launch-ended`,\n    // which drives `_end` (so status/onDismiss are host-authoritative, never\n    // optimistically local — a dismiss the host refuses would otherwise desync).\n    sendMessage(LAUNCH_DISMISS, { launchId: this.launchId });\n  }\n\n  onDismiss(cb: () => void): () => void {\n    if (this.#ended) {\n      // Already ended: fire on the next tick so the contract (\"returns an\n      // unsubscribe\") holds and the callback never runs synchronously mid-register.\n      queueMicrotask(cb);\n      return () => {};\n    }\n    this.#dismissListeners.add(cb);\n    return () => {\n      this.#dismissListeners.delete(cb);\n    };\n  }\n\n  /** Host-driven terminal transition — the only writer of `status`. Idempotent. */\n  _end(status: Exclude<LaunchStatus, 'running'>): void {\n    if (this.#ended) return;\n    this.#ended = true;\n    this.#status = status;\n    liveHandles.delete(this.launchId);\n    const listeners = [...this.#dismissListeners];\n    this.#dismissListeners.clear();\n    for (const l of listeners) {\n      try {\n        l();\n      } catch {\n        /* a launcher's own callback must never wedge teardown */\n      }\n    }\n  }\n}\n\n/**\n * Launch a bound program to RUN in a region (§2). Non-blocking: resolves once the\n * frame is created and bound, with a {@link LaunchHandle} — or a typed\n * `{ ok:false, code }` on refusal (§8), NEVER a throw for an ordinary refusal (so\n * a launcher branches on `code` without a try/catch). The launched app runs under\n * its OWN grants; the launcher's authority does not flow to it (R-SAL-4).\n *\n *   const h = await launch({ task: 'open-project' }, {\n *     region: 'stage',\n *     input: { dir: capDir({ mountId: 'space:abc', relPath: 'proj' }, { mode: 'ro' }) },\n *   });\n *   if ('ok' in h && h.ok === false) { ...handle h.code... }\n *   else { h.onDismiss(() => ...); }\n */\nexport const launch = async (\n  target: LaunchTarget,\n  opts: LaunchOptions,\n): Promise<LaunchHandle | { ok: false; code: LaunchErrorCode }> => {\n  // The host wraps a successful handler return as `{ ok:true, data }` (the same\n  // Recipe-B framing `invokeTask` uses); a refusal is `{ ok:false, code }`.\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], 'create', [{ target, opts }])) as\n    | { ok: true; data: { launchId: string } }\n    | { ok: false; code?: LaunchErrorCode }\n    | undefined;\n  if (!res || res.ok !== true || !res.data?.launchId) {\n    const code = res && res.ok === false ? (res.code ?? 'unknown') : 'unknown';\n    return { ok: false, code };\n  }\n  return new LaunchHandleImpl(res.data.launchId);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,0BAA0D;AAC1D,sBAA8D;AAC9D,6BAAwB;AAbxB;AA0FA,MAAM,cAAc,oBAAI,IAA8B;AAAA,IAKtD,iCAAY,8BAAc,CAAC,MAA0B;AACnD,QAAM,IAAI,YAAY,IAAI,EAAE,QAAQ;AACpC,MAAI,EAAG,GAAE,KAAK,EAAE,MAAM;AACxB,CAAC;AAED,MAAM,iBAAyC;AAAA,EAK7C,YAAqB,UAAkB;AAAlB;AAJrB,gCAAwB;AACxB,0CAAoB,oBAAI,IAAgB;AACxC,+BAAS;AAGP,gBAAY,IAAI,UAAU,IAAI;AAAA,EAChC;AAAA,EAEA,IAAI,SAAuB;AACzB,WAAO,mBAAK;AAAA,EACd;AAAA,EAEA,UAAgB;AACd,QAAI,mBAAK,QAAQ;AAIjB,yCAAY,gCAAgB,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EACzD;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,mBAAK,SAAQ;AAGf,qBAAe,EAAE;AACjB,aAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AACA,uBAAK,mBAAkB,IAAI,EAAE;AAC7B,WAAO,MAAM;AACX,yBAAK,mBAAkB,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,KAAK,QAAgD;AACnD,QAAI,mBAAK,QAAQ;AACjB,uBAAK,QAAS;AACd,uBAAK,SAAU;AACf,gBAAY,OAAO,KAAK,QAAQ;AAChC,UAAM,YAAY,CAAC,GAAG,mBAAK,kBAAiB;AAC5C,uBAAK,mBAAkB,MAAM;AAC7B,eAAW,KAAK,WAAW;AACzB,UAAI;AACF,UAAE;AAAA,MACJ,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAjDE;AACA;AACA;AA+DK,MAAM,SAAS,OACpB,QACA,SACiE;AAGjE,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,+BAAe,GAAG,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC;AAIzF,MAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,IAAI,MAAM,UAAU;AAClD,UAAM,OAAO,OAAO,IAAI,OAAO,QAAS,IAAI,QAAQ,YAAa;AACjE,WAAO,EAAE,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,SAAO,IAAI,iBAAiB,IAAI,KAAK,QAAQ;AAC/C;","names":[]}

package/dist/launch.js

@@ -5,8 +5,10 @@ import {
 } from "./chunk-VHAA22YE.js";
 var _status, _dismissListeners, _ended;
 import { protocolRequest, sendMessage, addListener } from "./sandboxUtils";
+import { LAUNCH_DISMISS, LAUNCH_ENDED, PROTOCOL_LAUNCH } from "./generated/protocol";
+import { SCHEMES } from "./protocolSchemes";
 const liveHandles = /* @__PURE__ */ new Map();
-addListener("launch-ended", (m) => {
+addListener(LAUNCH_ENDED, (m) => {
   const h = liveHandles.get(m.launchId);
   if (h) h._end(m.status);
 });
@@ -23,7 +25,7 @@ class LaunchHandleImpl {
   }
   dismiss() {
     if (__privateGet(this, _ended)) return;
-    sendMessage("launch-dismiss", { launchId: this.launchId });
+    sendMessage(LAUNCH_DISMISS, { launchId: this.launchId });
   }
   onDismiss(cb) {
     if (__privateGet(this, _ended)) {
@@ -56,7 +58,7 @@ _status = new WeakMap();
 _dismissListeners = new WeakMap();
 _ended = new WeakMap();
 const launch = async (target, opts) => {
-  const res = await protocolRequest("launch", "create", [{ target, opts }]);
+  const res = await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], "create", [{ target, opts }]);
   if (!res || res.ok !== true || !res.data?.launchId) {
     const code = res && res.ok === false ? res.code ?? "unknown" : "unknown";
     return { ok: false, code };

package/dist/launch.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/launch.ts"],"sourcesContent":["// Launch — the TO-RUN twin of `invokeTask` (STANDING_APP_LIFECYCLE_SPEC §1–§6).\n// Where `invokeTask` is FOR-RESULT (await one value, callee exits), `launch` is\n// TO-RUN (non-blocking, standing): it starts a bound program RUNNING in a region\n// and hands back a HANDLE, never a typed value (R-SAL-1). The launched app earns\n// its OWN grants — the only launcher→launched data path is the explicitly\n// delegated `capDir`/`capFile` in `input` (§5), attenuated + tainted + gated host-\n// side. The host owns the whole lifecycle (visibility, budget, revocation,\n// teardown); the launcher only OBSERVES via the handle.\n//\n// A caller that wants a typed value back uses `invokeTask` instead — the two are\n// siblings, not a replacement.\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\n\n/** Where a launched program runs (§6). `overlay` covers the caller's own region\n *  with opaque host chrome; `stage` replaces the focal app (the elevated into-\n *  stage surface, §7 — refused above the stage-principal ceiling). */\nexport type LaunchRegion = 'overlay' | 'stage';\n\n/**\n * What to launch (§3) — binding-resolved, NEVER a caller-named app. Exactly one of:\n *  - `entryPoint`: a sibling entry point of the caller's OWN repo (the mini-app\n *    case, `AGENT_AUTHORING §5`) — **rejected `forbidden` until program-identity\n *    `appKey` lands** (R-SAL-2a);\n *  - `task`: a task contract (`open-project`, …), resolved through the user-\n *    overridable `task.<name>` binding to whichever app the user bound (§3 kind 2).\n */\nexport interface LaunchTarget {\n  /** Kind 1 — a sibling entry point of the caller's own repo (mini-app overlay). */\n  entryPoint?: string;\n  /** Kind 2 — a task contract name (the host resolves the bound provider). */\n  task?: string;\n  /** Optional accepted contract version for a `task` target (semver, e.g. `^1`). */\n  version?: string;\n}\n\nexport interface LaunchOptions {\n  /** Where it runs (§6). */\n  region: LaunchRegion;\n  /**\n   * Delegations + plain data handed to the launched app. `$cap:'dir'|'file'`\n   * markers (`capDir`/`capFile`, exported from `./tasks`) are resolved against the\n   * launcher's OWN grants and minted as attenuated, `ro`-by-default chroots (§5) —\n   * you can only delegate what you already hold. Everything else is plain data.\n   */\n  input?: Record<string, unknown>;\n}\n\n/** The live state of a launch (§2). Terminal states (`dismissed`/`revoked`/\n *  `failed`) are reached identically for self-exit, user dismiss, and host revoke —\n *  the host debounces so the launcher gets no timing oracle (R-SAL-1 / §6.4). */\nexport type LaunchStatus = 'running' | 'dismissed' | 'revoked' | 'failed';\n\n/** Machine codes a refused `launch` resolves with (§8). */\nexport type LaunchErrorCode =\n  | 'forbidden' // undeclared target; sibling (pre-AA-01); self-resolving target; stage cap absent\n  | 'unsupported' // no provider bound / entry point absent / unknown contract version\n  | 'budget' // over an R-SAL-8 concurrency/rate limit\n  | 'revoked' // a delegated mount was revoked during the create-and-bind window\n  | 'cancelled' // the user dismissed the host launch affordance (into-stage only)\n  | 'invalid-params' // a malformed `capDir`/`capFile` (`..`/absolute/mode-escalation)\n  | 'unknown';\n\n/**\n * The control channel back to a launch — the ONLY thing a launcher gets (§2).\n * There is no typed return value (R-SAL-1); `status`/`onDismiss` are debounced so\n * they cannot time-distinguish a self-exit from a user dismiss.\n */\nexport interface LaunchHandle {\n  /** Host-assigned id for this launch. */\n  readonly launchId: string;\n  /** The current lifecycle state (§2). */\n  readonly status: LaunchStatus;\n  /** Ask the host to tear this launch down. Idempotent (double-dismiss is a no-op). */\n  dismiss(): void;\n  /**\n   * Observe the launch ending (self-exit / user dismiss / host revoke — fired\n   * identically, R-SAL-1). Returns an unsubscribe fn. Fires at most once; if the\n   * launch has already ended it fires on the next tick.\n   */\n  onDismiss(cb: () => void): () => void;\n}\n\ninterface LaunchEndedMessage {\n  launchId: string;\n  status: Exclude<LaunchStatus, 'running'>;\n}\n\n/** Live handles awaiting their terminal `launch-ended` message, keyed by launchId. */\nconst liveHandles = new Map<string, LaunchHandleImpl>();\n\n// The host delivers ONE `launch-ended` message per launch when it tears down —\n// the SAME message shape for self-exit, dismiss, and revoke (the host debounces\n// so the timing is not an oracle, §6.4). We fan it out to the matching handle.\naddListener('launch-ended', (m: LaunchEndedMessage) => {\n  const h = liveHandles.get(m.launchId);\n  if (h) h._end(m.status);\n});\n\nclass LaunchHandleImpl implements LaunchHandle {\n  #status: LaunchStatus = 'running';\n  #dismissListeners = new Set<() => void>();\n  #ended = false;\n\n  constructor(readonly launchId: string) {\n    liveHandles.set(launchId, this);\n  }\n\n  get status(): LaunchStatus {\n    return this.#status;\n  }\n\n  dismiss(): void {\n    if (this.#ended) return;\n    // Fire-and-forget: the host owns teardown and answers with `launch-ended`,\n    // which drives `_end` (so status/onDismiss are host-authoritative, never\n    // optimistically local — a dismiss the host refuses would otherwise desync).\n    sendMessage('launch-dismiss', { launchId: this.launchId });\n  }\n\n  onDismiss(cb: () => void): () => void {\n    if (this.#ended) {\n      // Already ended: fire on the next tick so the contract (\"returns an\n      // unsubscribe\") holds and the callback never runs synchronously mid-register.\n      queueMicrotask(cb);\n      return () => {};\n    }\n    this.#dismissListeners.add(cb);\n    return () => {\n      this.#dismissListeners.delete(cb);\n    };\n  }\n\n  /** Host-driven terminal transition — the only writer of `status`. Idempotent. */\n  _end(status: Exclude<LaunchStatus, 'running'>): void {\n    if (this.#ended) return;\n    this.#ended = true;\n    this.#status = status;\n    liveHandles.delete(this.launchId);\n    const listeners = [...this.#dismissListeners];\n    this.#dismissListeners.clear();\n    for (const l of listeners) {\n      try {\n        l();\n      } catch {\n        /* a launcher's own callback must never wedge teardown */\n      }\n    }\n  }\n}\n\n/**\n * Launch a bound program to RUN in a region (§2). Non-blocking: resolves once the\n * frame is created and bound, with a {@link LaunchHandle} — or a typed\n * `{ ok:false, code }` on refusal (§8), NEVER a throw for an ordinary refusal (so\n * a launcher branches on `code` without a try/catch). The launched app runs under\n * its OWN grants; the launcher's authority does not flow to it (R-SAL-4).\n *\n *   const h = await launch({ task: 'open-project' }, {\n *     region: 'stage',\n *     input: { dir: capDir({ mountId: 'space:abc', relPath: 'proj' }, { mode: 'ro' }) },\n *   });\n *   if ('ok' in h && h.ok === false) { ...handle h.code... }\n *   else { h.onDismiss(() => ...); }\n */\nexport const launch = async (\n  target: LaunchTarget,\n  opts: LaunchOptions,\n): Promise<LaunchHandle | { ok: false; code: LaunchErrorCode }> => {\n  // The host wraps a successful handler return as `{ ok:true, data }` (the same\n  // Recipe-B framing `invokeTask` uses); a refusal is `{ ok:false, code }`.\n  const res = (await protocolRequest('launch', 'create', [{ target, opts }])) as\n    | { ok: true; data: { launchId: string } }\n    | { ok: false; code?: LaunchErrorCode }\n    | undefined;\n  if (!res || res.ok !== true || !res.data?.launchId) {\n    const code = res && res.ok === false ? (res.code ?? 'unknown') : 'unknown';\n    return { ok: false, code };\n  }\n  return new LaunchHandleImpl(res.data.launchId);\n};\n"],"mappings":";;;;;AAAA;AAWA,SAAS,iBAAiB,aAAa,mBAAmB;AA6E1D,MAAM,cAAc,oBAAI,IAA8B;AAKtD,YAAY,gBAAgB,CAAC,MAA0B;AACrD,QAAM,IAAI,YAAY,IAAI,EAAE,QAAQ;AACpC,MAAI,EAAG,GAAE,KAAK,EAAE,MAAM;AACxB,CAAC;AAED,MAAM,iBAAyC;AAAA,EAK7C,YAAqB,UAAkB;AAAlB;AAJrB,gCAAwB;AACxB,0CAAoB,oBAAI,IAAgB;AACxC,+BAAS;AAGP,gBAAY,IAAI,UAAU,IAAI;AAAA,EAChC;AAAA,EAEA,IAAI,SAAuB;AACzB,WAAO,mBAAK;AAAA,EACd;AAAA,EAEA,UAAgB;AACd,QAAI,mBAAK,QAAQ;AAIjB,gBAAY,kBAAkB,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EAC3D;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,mBAAK,SAAQ;AAGf,qBAAe,EAAE;AACjB,aAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AACA,uBAAK,mBAAkB,IAAI,EAAE;AAC7B,WAAO,MAAM;AACX,yBAAK,mBAAkB,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,KAAK,QAAgD;AACnD,QAAI,mBAAK,QAAQ;AACjB,uBAAK,QAAS;AACd,uBAAK,SAAU;AACf,gBAAY,OAAO,KAAK,QAAQ;AAChC,UAAM,YAAY,CAAC,GAAG,mBAAK,kBAAiB;AAC5C,uBAAK,mBAAkB,MAAM;AAC7B,eAAW,KAAK,WAAW;AACzB,UAAI;AACF,UAAE;AAAA,MACJ,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAjDE;AACA;AACA;AA+DK,MAAM,SAAS,OACpB,QACA,SACiE;AAGjE,QAAM,MAAO,MAAM,gBAAgB,UAAU,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC;AAIzE,MAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,IAAI,MAAM,UAAU;AAClD,UAAM,OAAO,OAAO,IAAI,OAAO,QAAS,IAAI,QAAQ,YAAa;AACjE,WAAO,EAAE,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,SAAO,IAAI,iBAAiB,IAAI,KAAK,QAAQ;AAC/C;","names":[]}
+{"version":3,"sources":["../src/launch.ts"],"sourcesContent":["// Launch — the TO-RUN twin of `invokeTask` (STANDING_APP_LIFECYCLE_SPEC §1–§6).\n// Where `invokeTask` is FOR-RESULT (await one value, callee exits), `launch` is\n// TO-RUN (non-blocking, standing): it starts a bound program RUNNING in a region\n// and hands back a HANDLE, never a typed value (R-SAL-1). The launched app earns\n// its OWN grants — the only launcher→launched data path is the explicitly\n// delegated `capDir`/`capFile` in `input` (§5), attenuated + tainted + gated host-\n// side. The host owns the whole lifecycle (visibility, budget, revocation,\n// teardown); the launcher only OBSERVES via the handle.\n//\n// A caller that wants a typed value back uses `invokeTask` instead — the two are\n// siblings, not a replacement.\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\nimport { LAUNCH_DISMISS, LAUNCH_ENDED, PROTOCOL_LAUNCH } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** Where a launched program runs (§6). `overlay` covers the caller's own region\n *  with opaque host chrome; `stage` replaces the focal app (the elevated into-\n *  stage surface, §7 — refused above the stage-principal ceiling). */\nexport type LaunchRegion = 'overlay' | 'stage';\n\n/**\n * What to launch (§3) — binding-resolved, NEVER a caller-named app. Exactly one of:\n *  - `entryPoint`: a sibling entry point of the caller's OWN repo (the mini-app\n *    case, `AGENT_AUTHORING §5`) — **rejected `forbidden` until program-identity\n *    `appKey` lands** (R-SAL-2a);\n *  - `task`: a task contract (`open-project`, …), resolved through the user-\n *    overridable `task.<name>` binding to whichever app the user bound (§3 kind 2).\n */\nexport interface LaunchTarget {\n  /** Kind 1 — a sibling entry point of the caller's own repo (mini-app overlay). */\n  entryPoint?: string;\n  /** Kind 2 — a task contract name (the host resolves the bound provider). */\n  task?: string;\n  /** Optional accepted contract version for a `task` target (semver, e.g. `^1`). */\n  version?: string;\n}\n\nexport interface LaunchOptions {\n  /** Where it runs (§6). */\n  region: LaunchRegion;\n  /**\n   * Delegations + plain data handed to the launched app. `$cap:'dir'|'file'`\n   * markers (`capDir`/`capFile`, exported from `./tasks`) are resolved against the\n   * launcher's OWN grants and minted as attenuated, `ro`-by-default chroots (§5) —\n   * you can only delegate what you already hold. Everything else is plain data.\n   */\n  input?: Record<string, unknown>;\n}\n\n/** The live state of a launch (§2). Terminal states (`dismissed`/`revoked`/\n *  `failed`) are reached identically for self-exit, user dismiss, and host revoke —\n *  the host debounces so the launcher gets no timing oracle (R-SAL-1 / §6.4). */\nexport type LaunchStatus = 'running' | 'dismissed' | 'revoked' | 'failed';\n\n/** Machine codes a refused `launch` resolves with (§8). */\nexport type LaunchErrorCode =\n  | 'forbidden' // undeclared target; sibling (pre-AA-01); self-resolving target; stage cap absent\n  | 'unsupported' // no provider bound / entry point absent / unknown contract version\n  | 'budget' // over an R-SAL-8 concurrency/rate limit\n  | 'revoked' // a delegated mount was revoked during the create-and-bind window\n  | 'cancelled' // the user dismissed the host launch affordance (into-stage only)\n  | 'invalid-params' // a malformed `capDir`/`capFile` (`..`/absolute/mode-escalation)\n  | 'unknown';\n\n/**\n * The control channel back to a launch — the ONLY thing a launcher gets (§2).\n * There is no typed return value (R-SAL-1); `status`/`onDismiss` are debounced so\n * they cannot time-distinguish a self-exit from a user dismiss.\n */\nexport interface LaunchHandle {\n  /** Host-assigned id for this launch. */\n  readonly launchId: string;\n  /** The current lifecycle state (§2). */\n  readonly status: LaunchStatus;\n  /** Ask the host to tear this launch down. Idempotent (double-dismiss is a no-op). */\n  dismiss(): void;\n  /**\n   * Observe the launch ending (self-exit / user dismiss / host revoke — fired\n   * identically, R-SAL-1). Returns an unsubscribe fn. Fires at most once; if the\n   * launch has already ended it fires on the next tick.\n   */\n  onDismiss(cb: () => void): () => void;\n}\n\ninterface LaunchEndedMessage {\n  launchId: string;\n  status: Exclude<LaunchStatus, 'running'>;\n}\n\n/** Live handles awaiting their terminal `launch-ended` message, keyed by launchId. */\nconst liveHandles = new Map<string, LaunchHandleImpl>();\n\n// The host delivers ONE `launch-ended` message per launch when it tears down —\n// the SAME message shape for self-exit, dismiss, and revoke (the host debounces\n// so the timing is not an oracle, §6.4). We fan it out to the matching handle.\naddListener(LAUNCH_ENDED, (m: LaunchEndedMessage) => {\n  const h = liveHandles.get(m.launchId);\n  if (h) h._end(m.status);\n});\n\nclass LaunchHandleImpl implements LaunchHandle {\n  #status: LaunchStatus = 'running';\n  #dismissListeners = new Set<() => void>();\n  #ended = false;\n\n  constructor(readonly launchId: string) {\n    liveHandles.set(launchId, this);\n  }\n\n  get status(): LaunchStatus {\n    return this.#status;\n  }\n\n  dismiss(): void {\n    if (this.#ended) return;\n    // Fire-and-forget: the host owns teardown and answers with `launch-ended`,\n    // which drives `_end` (so status/onDismiss are host-authoritative, never\n    // optimistically local — a dismiss the host refuses would otherwise desync).\n    sendMessage(LAUNCH_DISMISS, { launchId: this.launchId });\n  }\n\n  onDismiss(cb: () => void): () => void {\n    if (this.#ended) {\n      // Already ended: fire on the next tick so the contract (\"returns an\n      // unsubscribe\") holds and the callback never runs synchronously mid-register.\n      queueMicrotask(cb);\n      return () => {};\n    }\n    this.#dismissListeners.add(cb);\n    return () => {\n      this.#dismissListeners.delete(cb);\n    };\n  }\n\n  /** Host-driven terminal transition — the only writer of `status`. Idempotent. */\n  _end(status: Exclude<LaunchStatus, 'running'>): void {\n    if (this.#ended) return;\n    this.#ended = true;\n    this.#status = status;\n    liveHandles.delete(this.launchId);\n    const listeners = [...this.#dismissListeners];\n    this.#dismissListeners.clear();\n    for (const l of listeners) {\n      try {\n        l();\n      } catch {\n        /* a launcher's own callback must never wedge teardown */\n      }\n    }\n  }\n}\n\n/**\n * Launch a bound program to RUN in a region (§2). Non-blocking: resolves once the\n * frame is created and bound, with a {@link LaunchHandle} — or a typed\n * `{ ok:false, code }` on refusal (§8), NEVER a throw for an ordinary refusal (so\n * a launcher branches on `code` without a try/catch). The launched app runs under\n * its OWN grants; the launcher's authority does not flow to it (R-SAL-4).\n *\n *   const h = await launch({ task: 'open-project' }, {\n *     region: 'stage',\n *     input: { dir: capDir({ mountId: 'space:abc', relPath: 'proj' }, { mode: 'ro' }) },\n *   });\n *   if ('ok' in h && h.ok === false) { ...handle h.code... }\n *   else { h.onDismiss(() => ...); }\n */\nexport const launch = async (\n  target: LaunchTarget,\n  opts: LaunchOptions,\n): Promise<LaunchHandle | { ok: false; code: LaunchErrorCode }> => {\n  // The host wraps a successful handler return as `{ ok:true, data }` (the same\n  // Recipe-B framing `invokeTask` uses); a refusal is `{ ok:false, code }`.\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], 'create', [{ target, opts }])) as\n    | { ok: true; data: { launchId: string } }\n    | { ok: false; code?: LaunchErrorCode }\n    | undefined;\n  if (!res || res.ok !== true || !res.data?.launchId) {\n    const code = res && res.ok === false ? (res.code ?? 'unknown') : 'unknown';\n    return { ok: false, code };\n  }\n  return new LaunchHandleImpl(res.data.launchId);\n};\n"],"mappings":";;;;;AAAA;AAWA,SAAS,iBAAiB,aAAa,mBAAmB;AAC1D,SAAS,gBAAgB,cAAc,uBAAuB;AAC9D,SAAS,eAAe;AA6ExB,MAAM,cAAc,oBAAI,IAA8B;AAKtD,YAAY,cAAc,CAAC,MAA0B;AACnD,QAAM,IAAI,YAAY,IAAI,EAAE,QAAQ;AACpC,MAAI,EAAG,GAAE,KAAK,EAAE,MAAM;AACxB,CAAC;AAED,MAAM,iBAAyC;AAAA,EAK7C,YAAqB,UAAkB;AAAlB;AAJrB,gCAAwB;AACxB,0CAAoB,oBAAI,IAAgB;AACxC,+BAAS;AAGP,gBAAY,IAAI,UAAU,IAAI;AAAA,EAChC;AAAA,EAEA,IAAI,SAAuB;AACzB,WAAO,mBAAK;AAAA,EACd;AAAA,EAEA,UAAgB;AACd,QAAI,mBAAK,QAAQ;AAIjB,gBAAY,gBAAgB,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EACzD;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,mBAAK,SAAQ;AAGf,qBAAe,EAAE;AACjB,aAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AACA,uBAAK,mBAAkB,IAAI,EAAE;AAC7B,WAAO,MAAM;AACX,yBAAK,mBAAkB,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,KAAK,QAAgD;AACnD,QAAI,mBAAK,QAAQ;AACjB,uBAAK,QAAS;AACd,uBAAK,SAAU;AACf,gBAAY,OAAO,KAAK,QAAQ;AAChC,UAAM,YAAY,CAAC,GAAG,mBAAK,kBAAiB;AAC5C,uBAAK,mBAAkB,MAAM;AAC7B,eAAW,KAAK,WAAW;AACzB,UAAI;AACF,UAAE;AAAA,MACJ,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAjDE;AACA;AACA;AA+DK,MAAM,SAAS,OACpB,QACA,SACiE;AAGjE,QAAM,MAAO,MAAM,gBAAgB,QAAQ,eAAe,GAAG,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC;AAIzF,MAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,IAAI,MAAM,UAAU;AAClD,UAAM,OAAO,OAAO,IAAI,OAAO,QAAS,IAAI,QAAQ,YAAa;AACjE,WAAO,EAAE,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,SAAO,IAAI,iBAAiB,IAAI,KAAK,QAAQ;AAC/C;","names":[]}