@immediately-run/sdk 0.50.0 → 0.51.0

package/dist/generated/protocol.d.cts

@@ -1 +1,2 @@
 export * from '@immediately-run/sandbox-protocol/sdk';
+import '@immediately-run/safe-content';

package/dist/generated/protocol.d.ts

@@ -1 +1,2 @@
 export * from '@immediately-run/sandbox-protocol/sdk';
+import '@immediately-run/safe-content';

package/dist/index.d.cts

@@ -5,7 +5,7 @@ export { Include, RenderExportedComponent } from './components/Include.cjs';
 export { SafeInclude } from './components/SafeInclude.cjs';
 export { SourceCache, SourceReader, createSourceCache } from './sourceCache.cjs';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.cjs';
-export { FS_PREFIX, LinkSpace, LinkSpaceContext, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from './linkSpace.cjs';
+export { LinkSpaceContext } from './linkSpace.cjs';
 export { MountImage, MountImageProps } from './components/MountImage.cjs';
 export { Route, RouteProps, Routes } from './components/Routes.cjs';
 export { ObjectUrlState, useAllMetadata, useFileMetadata, useMetadataQuery, useObjectUrl } from './hooks.cjs';
@@ -40,12 +40,9 @@ export { LOADING_TIMINGS, LoadingRegion, Skeleton, SkeletonArchetype, SkeletonRo
 export { StreamError, StreamFrame, StreamTransport, consumeStream, protocolStream } from './protocolStream.cjs';
 export { ATTENDED_FIRST_FRAME_MS, ATTENDED_TIMEOUT_MS, Attendance, BoundedCallOptions, CallBounds, DeadlineBound, NETWORK_TIMEOUT_MS, PENDING_NOTICE_MS, PendingAttention, PendingState, ProtocolCancelledError, ProtocolTimeoutError, STREAM_IDLE_TIMEOUT_MS, SuspendableDeadline, UNATTENDED_TIMEOUT_MS, attendanceOf, attendanceReason, boundsFor, createSuspendableDeadline, firstFrameBoundsFor, firstFrameTimeoutFor, timeoutFor } from './protocolDeadline.cjs';
 export { EvaluationContext, FileQueryResult, FilesMetadata, Metadata, MetadataQueryEntry, MetadataQueryFunction, MetadataQueryRecord, MetadataQueryResult, ModuleExports } from './sandboxTypes.cjs';
-export { SafeContent, SafeContentProps } from './safeContent/SafeContent.cjs';
-export { RenderMdastOptions, SafeContentComponents, renderMdast } from './safeContent/renderMdast.cjs';
-export { ParseSafeMdastOptions, SafeMdastNode, SafeMdxAttribute, parseSafeMdast } from './safeContent/parseSafeMdast.cjs';
-export { sanitizeUrl } from './safeContent/sanitizeUrl.cjs';
-export { WikiLinkToken, WikiPart, parseWikiInner, splitWikiLinks } from './safeContent/wikilink.cjs';
+export * from '@immediately-run/safe-content';
 export { Admonition, AdmonitionType } from './components/Admonition.cjs';
+export { FS_PREFIX, LinkSpace, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';
 export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.cjs';
 export { HeadingAnchor } from './components/HeadingAnchor.cjs';
 export { ImmediatelyRunGlobal, getHostRuntime } from './hostRuntime.cjs';

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { Include, RenderExportedComponent } from './components/Include.js';
 export { SafeInclude } from './components/SafeInclude.js';
 export { SourceCache, SourceReader, createSourceCache } from './sourceCache.js';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.js';
-export { FS_PREFIX, LinkSpace, LinkSpaceContext, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from './linkSpace.js';
+export { LinkSpaceContext } from './linkSpace.js';
 export { MountImage, MountImageProps } from './components/MountImage.js';
 export { Route, RouteProps, Routes } from './components/Routes.js';
 export { ObjectUrlState, useAllMetadata, useFileMetadata, useMetadataQuery, useObjectUrl } from './hooks.js';
@@ -40,12 +40,9 @@ export { LOADING_TIMINGS, LoadingRegion, Skeleton, SkeletonArchetype, SkeletonRo
 export { StreamError, StreamFrame, StreamTransport, consumeStream, protocolStream } from './protocolStream.js';
 export { ATTENDED_FIRST_FRAME_MS, ATTENDED_TIMEOUT_MS, Attendance, BoundedCallOptions, CallBounds, DeadlineBound, NETWORK_TIMEOUT_MS, PENDING_NOTICE_MS, PendingAttention, PendingState, ProtocolCancelledError, ProtocolTimeoutError, STREAM_IDLE_TIMEOUT_MS, SuspendableDeadline, UNATTENDED_TIMEOUT_MS, attendanceOf, attendanceReason, boundsFor, createSuspendableDeadline, firstFrameBoundsFor, firstFrameTimeoutFor, timeoutFor } from './protocolDeadline.js';
 export { EvaluationContext, FileQueryResult, FilesMetadata, Metadata, MetadataQueryEntry, MetadataQueryFunction, MetadataQueryRecord, MetadataQueryResult, ModuleExports } from './sandboxTypes.js';
-export { SafeContent, SafeContentProps } from './safeContent/SafeContent.js';
-export { RenderMdastOptions, SafeContentComponents, renderMdast } from './safeContent/renderMdast.js';
-export { ParseSafeMdastOptions, SafeMdastNode, SafeMdxAttribute, parseSafeMdast } from './safeContent/parseSafeMdast.js';
-export { sanitizeUrl } from './safeContent/sanitizeUrl.js';
-export { WikiLinkToken, WikiPart, parseWikiInner, splitWikiLinks } from './safeContent/wikilink.js';
+export * from '@immediately-run/safe-content';
 export { Admonition, AdmonitionType } from './components/Admonition.js';
+export { FS_PREFIX, LinkSpace, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';
 export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.js';
 export { HeadingAnchor } from './components/HeadingAnchor.js';
 export { ImmediatelyRunGlobal, getHostRuntime } from './hostRuntime.js';

package/dist/linkSpace.cjs

@@ -18,50 +18,18 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var linkSpace_exports = {};
 __export(linkSpace_exports, {
-  FS_PREFIX: () => FS_PREFIX,
+  FS_PREFIX: () => import_mdx_plugins.FS_PREFIX,
   LinkSpaceContext: () => LinkSpaceContext,
-  normalizeAbsolute: () => normalizeAbsolute,
-  resolveLinkTarget: () => resolveLinkTarget
+  normalizeAbsolute: () => import_mdx_plugins.normalizeAbsolute,
+  resolveLinkTarget: () => import_mdx_plugins.resolveLinkTarget
 });
 module.exports = __toCommonJS(linkSpace_exports);
 var import_react = require("react");
-const FS_PREFIX = "$fs:";
+var import_mdx_plugins = require("@immediately-run/mdx-plugins");
 const LinkSpaceContext = (0, import_react.createContext)({
   corpusRoot: null,
   bundleChrooted: false
 });
-const normalizeAbsolute = (path) => {
-  const out = [];
-  for (const seg of path.split("/")) {
-    if (seg === "" || seg === ".") continue;
-    if (seg === "..") out.pop();
-    else out.push(seg);
-  }
-  return "/" + out.join("/");
-};
-function resolveCorpusAbsolute(path, corpusRoot) {
-  const inner = normalizeAbsolute(path);
-  if (corpusRoot === null || corpusRoot === "/") return { state: "resolved", path: inner };
-  return { state: "resolved", path: normalizeAbsolute(corpusRoot + inner) };
-}
-function resolveLinkTarget(raw, opts = {}) {
-  if (raw.startsWith(FS_PREFIX)) {
-    const rest = raw.slice(FS_PREFIX.length);
-    if (!rest.startsWith("/")) return { state: "invalid" };
-    if (opts.bundleChrooted) return resolveCorpusAbsolute(rest, opts.corpusRoot ?? null);
-    return { state: "resolved", path: normalizeAbsolute(rest) };
-  }
-  if (raw.startsWith("/")) {
-    const corpusRoot = opts.corpusRoot ?? null;
-    if (corpusRoot !== null) {
-      return resolveCorpusAbsolute(raw, corpusRoot);
-    }
-    return { state: "resolved", path: normalizeAbsolute(raw) };
-  }
-  if (!opts.currentFile) return { state: "unresolvable" };
-  const dir = opts.currentFile.slice(0, opts.currentFile.lastIndexOf("/"));
-  return { state: "resolved", path: normalizeAbsolute(`${dir}/${raw}`) };
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   FS_PREFIX,

package/dist/linkSpace.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/linkSpace.ts"],"sourcesContent":["// Link path spaces (R3-273; REPO_CONTENT_DISPATCH_SPEC §9 decision, 2026-08-17).\n//\n// A document link's target resolves in one of two spaces:\n//\n// - DEFAULT — the enclosing corpus's virtual filesystem. RELATIVE targets resolve\n//   against the authoring file (identical in both spaces); ABSOLUTE targets\n//   (`/x/y.mdx`) resolve from the corpus root when an enclosing `LinkSpaceContext`\n//   declares one, else from the filesystem root. A non-corpus app declares nothing\n//   and keeps today's behavior bit-for-bit (its fs root IS its only root).\n//\n// - `$fs:` — the explicit filesystem space: `$fs:/content/x.mdx` resolves from the\n//   root of the filesystem the app reads, escaping corpus-relative addressing.\n//\n// `$fs:` changes ADDRESSING, never REACH: resolution is pure path arithmetic and\n// existence is checked against the same in-mount metadata the default space uses —\n// nothing is fetched, and a link can never name what the app cannot already read.\n// A malformed `$fs:` target (anything not mount-absolute — which also catches\n// scheme smuggling like `$fs:javascript:…`) is INVALID and must render as a broken\n// link, never an anchor.\n//\n// Corpus nesting: `LinkSpaceContext` providers nest, and the NEAREST one wins —\n// which is exactly the innermost-enclosing-corpus rule (bundle encapsulation): a\n// document rendered inside a nested corpus resolves against the nested corpus.\n\nimport { createContext } from 'react';\n\nexport const FS_PREFIX = '$fs:';\n\nexport interface LinkSpace {\n  /** Absolute filesystem path of the enclosing corpus's root (e.g. `/app/content`),\n   *  or `null` when the document is not corpus-hosted (default). */\n  corpusRoot: string | null;\n  /**\n   * True when the filesystem this document resolves against is **chroot'd to the\n   * bundle** — i.e. the port the app holds was scoped to the bundle's subtree, so\n   * the mount root and the bundle root are the same directory\n   * (`BUNDLE_LAYERS_SPEC §9`; the `T2`/`T4` wrapper, R3-319 / BL-2).\n   *\n   * Under that grant `$fs:` **collapses to the scoped root**: `$fs:/p` and `/p`\n   * name the same byte, because there is no longer any \"mount-absolute\" space\n   * outside the bundle for `$fs:` to reach into. Without this flag the resolver\n   * would hand back a mount-absolute path that the chroot then re-roots anyway —\n   * a link that renders as valid and resolves somewhere the author did not mean.\n   *\n   * **This is an invariant to CREATE, not one to inherit** (`BUNDLE_LAYERS_SPEC\n   * §11`): the shipped resolver reads `{currentFile, corpusRoot}` and nothing\n   * else, so `$fs:` is bundle-anchored only if something says so. It lives here,\n   * in the resolver, rather than as a rule each caller applies by passing\n   * `corpusRoot: '/'` — an invariant the arithmetic carries cannot be forgotten\n   * at one call site out of five.\n   */\n  bundleChrooted?: boolean;\n}\n\n/** Ambient link space. A corpus-rendering app wraps its document tree in\n *  `<LinkSpaceContext value={{ corpusRoot }}>`; nesting a second provider inside a\n *  rendered sub-corpus makes the innermost root win. */\nexport const LinkSpaceContext = createContext<LinkSpace>({\n  corpusRoot: null,\n  bundleChrooted: false,\n});\n\n/** Collapse `.`/`..`/empty segments into a clean absolute path. `..` can never\n *  climb above the root — a (virtual) root's parent is itself, which is what keeps\n *  both the mount space and the corpus space closed under traversal. */\nexport const normalizeAbsolute = (path: string): string => {\n  const out: string[] = [];\n  for (const seg of path.split('/')) {\n    if (seg === '' || seg === '.') continue;\n    if (seg === '..') out.pop();\n    else out.push(seg);\n  }\n  return '/' + out.join('/');\n};\n\nexport type ResolvedLinkTarget =\n  /** Resolved to an absolute filesystem path (existence NOT checked here). */\n  | { state: 'resolved'; path: string }\n  /** A relative target with no known authoring file — the caller may route\n   *  optimistically (it cannot check existence or self-ness generically). */\n  | { state: 'unresolvable' }\n  /** A malformed `$fs:` target (not mount-absolute; includes scheme smuggling).\n   *  Callers MUST render this broken/inert — never as an anchor. */\n  | { state: 'invalid' };\n\n/** Anchor a corpus-absolute path at `corpusRoot`, clamping the corpus-relative\n *  half FIRST so the virtual corpus space stays closed under traversal. Shared by\n *  the `/p` branch and — under a bundle chroot — the `$fs:/p` branch, so the two\n *  spellings cannot drift into resolving differently. */\nfunction resolveCorpusAbsolute(path: string, corpusRoot: string | null): ResolvedLinkTarget {\n  const inner = normalizeAbsolute(path);\n  if (corpusRoot === null || corpusRoot === '/') return { state: 'resolved', path: inner };\n  return { state: 'resolved', path: normalizeAbsolute(corpusRoot + inner) };\n}\n\n/**\n * Resolve a raw link target (a wikilink target or an in-app href's path half —\n * fragment already split off) to an absolute filesystem path. THE shared resolver:\n * the default `WikiLink`, the markdown `a` override, and safe-content consumers\n * all route through this one function so the two render pipelines cannot drift.\n */\nexport function resolveLinkTarget(\n  raw: string,\n  opts: {\n    currentFile?: string;\n    corpusRoot?: string | null;\n    /** See `LinkSpace.bundleChrooted`. Under a bundle-chroot'd grant `$fs:`\n     *  resolves in the corpus space, because they are the same space. */\n    bundleChrooted?: boolean;\n  } = {},\n): ResolvedLinkTarget {\n  if (raw.startsWith(FS_PREFIX)) {\n    const rest = raw.slice(FS_PREFIX.length);\n    // Must be mount-absolute. This single rule also fails `$fs:javascript:…`,\n    // `$fs:https://…`, and every other smuggled scheme closed.\n    if (!rest.startsWith('/')) return { state: 'invalid' };\n    // Under a bundle chroot the mount root IS the bundle root, so `$fs:` has\n    // nowhere outside to name: it takes the corpus-absolute branch below and the\n    // two spellings collapse. `normalizeAbsolute` clamps `..` at the root either\n    // way, so neither spelling can climb out — the collapse changes WHERE a\n    // `$fs:` link points, never whether it can escape.\n    if (opts.bundleChrooted) return resolveCorpusAbsolute(rest, opts.corpusRoot ?? null);\n    return { state: 'resolved', path: normalizeAbsolute(rest) };\n  }\n  if (raw.startsWith('/')) {\n    const corpusRoot = opts.corpusRoot ?? null;\n    if (corpusRoot !== null) {\n      // Clamp the corpus-relative half FIRST (the virtual FS is closed — `/../x`\n      // stays inside the corpus), THEN anchor it at the corpus root.\n      return resolveCorpusAbsolute(raw, corpusRoot);\n    }\n    return { state: 'resolved', path: normalizeAbsolute(raw) };\n  }\n  // Relative: against the authoring file's directory — the same in both spaces.\n  if (!opts.currentFile) return { state: 'unresolvable' };\n  const dir = opts.currentFile.slice(0, opts.currentFile.lastIndexOf('/'));\n  return { state: 'resolved', path: normalizeAbsolute(`${dir}/${raw}`) };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBA,mBAA8B;AAEvB,MAAM,YAAY;AA+BlB,MAAM,uBAAmB,4BAAyB;AAAA,EACvD,YAAY;AAAA,EACZ,gBAAgB;AAClB,CAAC;AAKM,MAAM,oBAAoB,CAAC,SAAyB;AACzD,QAAM,MAAgB,CAAC;AACvB,aAAW,OAAO,KAAK,MAAM,GAAG,GAAG;AACjC,QAAI,QAAQ,MAAM,QAAQ,IAAK;AAC/B,QAAI,QAAQ,KAAM,KAAI,IAAI;AAAA,QACrB,KAAI,KAAK,GAAG;AAAA,EACnB;AACA,SAAO,MAAM,IAAI,KAAK,GAAG;AAC3B;AAgBA,SAAS,sBAAsB,MAAc,YAA+C;AAC1F,QAAM,QAAQ,kBAAkB,IAAI;AACpC,MAAI,eAAe,QAAQ,eAAe,IAAK,QAAO,EAAE,OAAO,YAAY,MAAM,MAAM;AACvF,SAAO,EAAE,OAAO,YAAY,MAAM,kBAAkB,aAAa,KAAK,EAAE;AAC1E;AAQO,SAAS,kBACd,KACA,OAMI,CAAC,GACe;AACpB,MAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,UAAM,OAAO,IAAI,MAAM,UAAU,MAAM;AAGvC,QAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO,EAAE,OAAO,UAAU;AAMrD,QAAI,KAAK,eAAgB,QAAO,sBAAsB,MAAM,KAAK,cAAc,IAAI;AACnF,WAAO,EAAE,OAAO,YAAY,MAAM,kBAAkB,IAAI,EAAE;AAAA,EAC5D;AACA,MAAI,IAAI,WAAW,GAAG,GAAG;AACvB,UAAM,aAAa,KAAK,cAAc;AACtC,QAAI,eAAe,MAAM;AAGvB,aAAO,sBAAsB,KAAK,UAAU;AAAA,IAC9C;AACA,WAAO,EAAE,OAAO,YAAY,MAAM,kBAAkB,GAAG,EAAE;AAAA,EAC3D;AAEA,MAAI,CAAC,KAAK,YAAa,QAAO,EAAE,OAAO,eAAe;AACtD,QAAM,MAAM,KAAK,YAAY,MAAM,GAAG,KAAK,YAAY,YAAY,GAAG,CAAC;AACvE,SAAO,EAAE,OAAO,YAAY,MAAM,kBAAkB,GAAG,GAAG,IAAI,GAAG,EAAE,EAAE;AACvE;","names":[]}
+{"version":3,"sources":["../src/linkSpace.ts"],"sourcesContent":["// Link path spaces (R3-273; REPO_CONTENT_DISPATCH_SPEC §9 decision, 2026-08-17).\n// R3-279: the RESOLVER CORE (resolveLinkTarget / normalizeAbsolute / FS_PREFIX /\n// ResolvedLinkTarget) moved to `@immediately-run/mdx-plugins` — beside its parity\n// fixture — and is re-exported here unchanged (API-stable). This module keeps the\n// REACT surface (LinkSpaceContext): the provider a corpus-rendering app wraps its\n// document tree in. Consumers importing from '@immediately-run/sdk/linkSpace' see\n// exactly the same names.\n//\n// A document link's target resolves in one of two spaces:\n//\n// - DEFAULT — the enclosing corpus's virtual filesystem. RELATIVE targets resolve\n//   against the authoring file (identical in both spaces); ABSOLUTE targets\n//   (`/x/y.mdx`) resolve from the corpus root when an enclosing `LinkSpaceContext`\n//   declares one, else from the filesystem root. A non-corpus app declares nothing\n//   and keeps today's behavior bit-for-bit (its fs root IS its only root).\n//\n// - `$fs:` — the explicit filesystem space: `$fs:/content/x.mdx` resolves from the\n//   root of the filesystem the app reads, escaping corpus-relative addressing.\n//\n// `$fs:` changes ADDRESSING, never REACH: resolution is pure path arithmetic and\n// existence is checked against the same in-mount metadata the default space uses —\n// nothing is fetched, and a link can never name what the app cannot already read.\n// A malformed `$fs:` target (anything not mount-absolute — which also catches\n// scheme smuggling like `$fs:javascript:…`) is INVALID and must render as a broken\n// link, never an anchor.\n//\n// Corpus nesting: `LinkSpaceContext` providers nest, and the NEAREST one wins —\n// which is exactly the innermost-enclosing-corpus rule (bundle encapsulation): a\n// document rendered inside a nested corpus resolves against the nested corpus.\n\nimport { createContext } from 'react';\n\nexport { FS_PREFIX, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';\nexport type { ResolvedLinkTarget, LinkSpace } from '@immediately-run/mdx-plugins';\nimport type { LinkSpace as LinkSpaceShape } from '@immediately-run/mdx-plugins';\n\n/** Ambient link space. A corpus-rendering app wraps its document tree in\n *  `<LinkSpaceContext value={{ corpusRoot }}>`; nesting a second provider inside a\n *  rendered sub-corpus makes the innermost root win. */\nexport const LinkSpaceContext = createContext<LinkSpaceShape>({\n  corpusRoot: null,\n  bundleChrooted: false,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BA,mBAA8B;AAE9B,yBAAgE;AAOzD,MAAM,uBAAmB,4BAA8B;AAAA,EAC5D,YAAY;AAAA,EACZ,gBAAgB;AAClB,CAAC;","names":[]}

package/dist/linkSpace.d.cts

@@ -1,67 +1,10 @@
 import * as react from 'react';
+import { LinkSpace } from '@immediately-run/mdx-plugins';
+export { FS_PREFIX, LinkSpace, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';
 
-declare const FS_PREFIX = "$fs:";
-interface LinkSpace {
-    /** Absolute filesystem path of the enclosing corpus's root (e.g. `/app/content`),
-     *  or `null` when the document is not corpus-hosted (default). */
-    corpusRoot: string | null;
-    /**
-     * True when the filesystem this document resolves against is **chroot'd to the
-     * bundle** — i.e. the port the app holds was scoped to the bundle's subtree, so
-     * the mount root and the bundle root are the same directory
-     * (`BUNDLE_LAYERS_SPEC §9`; the `T2`/`T4` wrapper, R3-319 / BL-2).
-     *
-     * Under that grant `$fs:` **collapses to the scoped root**: `$fs:/p` and `/p`
-     * name the same byte, because there is no longer any "mount-absolute" space
-     * outside the bundle for `$fs:` to reach into. Without this flag the resolver
-     * would hand back a mount-absolute path that the chroot then re-roots anyway —
-     * a link that renders as valid and resolves somewhere the author did not mean.
-     *
-     * **This is an invariant to CREATE, not one to inherit** (`BUNDLE_LAYERS_SPEC
-     * §11`): the shipped resolver reads `{currentFile, corpusRoot}` and nothing
-     * else, so `$fs:` is bundle-anchored only if something says so. It lives here,
-     * in the resolver, rather than as a rule each caller applies by passing
-     * `corpusRoot: '/'` — an invariant the arithmetic carries cannot be forgotten
-     * at one call site out of five.
-     */
-    bundleChrooted?: boolean;
-}
 /** Ambient link space. A corpus-rendering app wraps its document tree in
  *  `<LinkSpaceContext value={{ corpusRoot }}>`; nesting a second provider inside a
  *  rendered sub-corpus makes the innermost root win. */
 declare const LinkSpaceContext: react.Context<LinkSpace>;
-/** Collapse `.`/`..`/empty segments into a clean absolute path. `..` can never
- *  climb above the root — a (virtual) root's parent is itself, which is what keeps
- *  both the mount space and the corpus space closed under traversal. */
-declare const normalizeAbsolute: (path: string) => string;
-type ResolvedLinkTarget = 
-/** Resolved to an absolute filesystem path (existence NOT checked here). */
-{
-    state: 'resolved';
-    path: string;
-}
-/** A relative target with no known authoring file — the caller may route
- *  optimistically (it cannot check existence or self-ness generically). */
- | {
-    state: 'unresolvable';
-}
-/** A malformed `$fs:` target (not mount-absolute; includes scheme smuggling).
- *  Callers MUST render this broken/inert — never as an anchor. */
- | {
-    state: 'invalid';
-};
-/**
- * Resolve a raw link target (a wikilink target or an in-app href's path half —
- * fragment already split off) to an absolute filesystem path. THE shared resolver:
- * the default `WikiLink`, the markdown `a` override, and safe-content consumers
- * all route through this one function so the two render pipelines cannot drift.
- */
-declare function resolveLinkTarget(raw: string, opts?: {
-    currentFile?: string;
-    corpusRoot?: string | null;
-    /** See `LinkSpace.bundleChrooted`. Under a bundle-chroot'd grant `$fs:`
-     *  resolves in the corpus space, because they are the same space. */
-    bundleChrooted?: boolean;
-}): ResolvedLinkTarget;
 
-export { FS_PREFIX, type LinkSpace, LinkSpaceContext, type ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget };
+export { LinkSpaceContext };

package/dist/linkSpace.d.ts

@@ -1,67 +1,10 @@
 import * as react from 'react';
+import { LinkSpace } from '@immediately-run/mdx-plugins';
+export { FS_PREFIX, LinkSpace, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';
 
-declare const FS_PREFIX = "$fs:";
-interface LinkSpace {
-    /** Absolute filesystem path of the enclosing corpus's root (e.g. `/app/content`),
-     *  or `null` when the document is not corpus-hosted (default). */
-    corpusRoot: string | null;
-    /**
-     * True when the filesystem this document resolves against is **chroot'd to the
-     * bundle** — i.e. the port the app holds was scoped to the bundle's subtree, so
-     * the mount root and the bundle root are the same directory
-     * (`BUNDLE_LAYERS_SPEC §9`; the `T2`/`T4` wrapper, R3-319 / BL-2).
-     *
-     * Under that grant `$fs:` **collapses to the scoped root**: `$fs:/p` and `/p`
-     * name the same byte, because there is no longer any "mount-absolute" space
-     * outside the bundle for `$fs:` to reach into. Without this flag the resolver
-     * would hand back a mount-absolute path that the chroot then re-roots anyway —
-     * a link that renders as valid and resolves somewhere the author did not mean.
-     *
-     * **This is an invariant to CREATE, not one to inherit** (`BUNDLE_LAYERS_SPEC
-     * §11`): the shipped resolver reads `{currentFile, corpusRoot}` and nothing
-     * else, so `$fs:` is bundle-anchored only if something says so. It lives here,
-     * in the resolver, rather than as a rule each caller applies by passing
-     * `corpusRoot: '/'` — an invariant the arithmetic carries cannot be forgotten
-     * at one call site out of five.
-     */
-    bundleChrooted?: boolean;
-}
 /** Ambient link space. A corpus-rendering app wraps its document tree in
  *  `<LinkSpaceContext value={{ corpusRoot }}>`; nesting a second provider inside a
  *  rendered sub-corpus makes the innermost root win. */
 declare const LinkSpaceContext: react.Context<LinkSpace>;
-/** Collapse `.`/`..`/empty segments into a clean absolute path. `..` can never
- *  climb above the root — a (virtual) root's parent is itself, which is what keeps
- *  both the mount space and the corpus space closed under traversal. */
-declare const normalizeAbsolute: (path: string) => string;
-type ResolvedLinkTarget = 
-/** Resolved to an absolute filesystem path (existence NOT checked here). */
-{
-    state: 'resolved';
-    path: string;
-}
-/** A relative target with no known authoring file — the caller may route
- *  optimistically (it cannot check existence or self-ness generically). */
- | {
-    state: 'unresolvable';
-}
-/** A malformed `$fs:` target (not mount-absolute; includes scheme smuggling).
- *  Callers MUST render this broken/inert — never as an anchor. */
- | {
-    state: 'invalid';
-};
-/**
- * Resolve a raw link target (a wikilink target or an in-app href's path half —
- * fragment already split off) to an absolute filesystem path. THE shared resolver:
- * the default `WikiLink`, the markdown `a` override, and safe-content consumers
- * all route through this one function so the two render pipelines cannot drift.
- */
-declare function resolveLinkTarget(raw: string, opts?: {
-    currentFile?: string;
-    corpusRoot?: string | null;
-    /** See `LinkSpace.bundleChrooted`. Under a bundle-chroot'd grant `$fs:`
-     *  resolves in the corpus space, because they are the same space. */
-    bundleChrooted?: boolean;
-}): ResolvedLinkTarget;
 
-export { FS_PREFIX, type LinkSpace, LinkSpaceContext, type ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget };
+export { LinkSpaceContext };

package/dist/linkSpace.js

@@ -1,42 +1,10 @@
 import "./chunk-VHAA22YE.js";
 import { createContext } from "react";
-const FS_PREFIX = "$fs:";
+import { FS_PREFIX, normalizeAbsolute, resolveLinkTarget } from "@immediately-run/mdx-plugins";
 const LinkSpaceContext = createContext({
   corpusRoot: null,
   bundleChrooted: false
 });
-const normalizeAbsolute = (path) => {
-  const out = [];
-  for (const seg of path.split("/")) {
-    if (seg === "" || seg === ".") continue;
-    if (seg === "..") out.pop();
-    else out.push(seg);
-  }
-  return "/" + out.join("/");
-};
-function resolveCorpusAbsolute(path, corpusRoot) {
-  const inner = normalizeAbsolute(path);
-  if (corpusRoot === null || corpusRoot === "/") return { state: "resolved", path: inner };
-  return { state: "resolved", path: normalizeAbsolute(corpusRoot + inner) };
-}
-function resolveLinkTarget(raw, opts = {}) {
-  if (raw.startsWith(FS_PREFIX)) {
-    const rest = raw.slice(FS_PREFIX.length);
-    if (!rest.startsWith("/")) return { state: "invalid" };
-    if (opts.bundleChrooted) return resolveCorpusAbsolute(rest, opts.corpusRoot ?? null);
-    return { state: "resolved", path: normalizeAbsolute(rest) };
-  }
-  if (raw.startsWith("/")) {
-    const corpusRoot = opts.corpusRoot ?? null;
-    if (corpusRoot !== null) {
-      return resolveCorpusAbsolute(raw, corpusRoot);
-    }
-    return { state: "resolved", path: normalizeAbsolute(raw) };
-  }
-  if (!opts.currentFile) return { state: "unresolvable" };
-  const dir = opts.currentFile.slice(0, opts.currentFile.lastIndexOf("/"));
-  return { state: "resolved", path: normalizeAbsolute(`${dir}/${raw}`) };
-}
 export {
   FS_PREFIX,
   LinkSpaceContext,

package/dist/linkSpace.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/linkSpace.ts"],"sourcesContent":["// Link path spaces (R3-273; REPO_CONTENT_DISPATCH_SPEC §9 decision, 2026-08-17).\n//\n// A document link's target resolves in one of two spaces:\n//\n// - DEFAULT — the enclosing corpus's virtual filesystem. RELATIVE targets resolve\n//   against the authoring file (identical in both spaces); ABSOLUTE targets\n//   (`/x/y.mdx`) resolve from the corpus root when an enclosing `LinkSpaceContext`\n//   declares one, else from the filesystem root. A non-corpus app declares nothing\n//   and keeps today's behavior bit-for-bit (its fs root IS its only root).\n//\n// - `$fs:` — the explicit filesystem space: `$fs:/content/x.mdx` resolves from the\n//   root of the filesystem the app reads, escaping corpus-relative addressing.\n//\n// `$fs:` changes ADDRESSING, never REACH: resolution is pure path arithmetic and\n// existence is checked against the same in-mount metadata the default space uses —\n// nothing is fetched, and a link can never name what the app cannot already read.\n// A malformed `$fs:` target (anything not mount-absolute — which also catches\n// scheme smuggling like `$fs:javascript:…`) is INVALID and must render as a broken\n// link, never an anchor.\n//\n// Corpus nesting: `LinkSpaceContext` providers nest, and the NEAREST one wins —\n// which is exactly the innermost-enclosing-corpus rule (bundle encapsulation): a\n// document rendered inside a nested corpus resolves against the nested corpus.\n\nimport { createContext } from 'react';\n\nexport const FS_PREFIX = '$fs:';\n\nexport interface LinkSpace {\n  /** Absolute filesystem path of the enclosing corpus's root (e.g. `/app/content`),\n   *  or `null` when the document is not corpus-hosted (default). */\n  corpusRoot: string | null;\n  /**\n   * True when the filesystem this document resolves against is **chroot'd to the\n   * bundle** — i.e. the port the app holds was scoped to the bundle's subtree, so\n   * the mount root and the bundle root are the same directory\n   * (`BUNDLE_LAYERS_SPEC §9`; the `T2`/`T4` wrapper, R3-319 / BL-2).\n   *\n   * Under that grant `$fs:` **collapses to the scoped root**: `$fs:/p` and `/p`\n   * name the same byte, because there is no longer any \"mount-absolute\" space\n   * outside the bundle for `$fs:` to reach into. Without this flag the resolver\n   * would hand back a mount-absolute path that the chroot then re-roots anyway —\n   * a link that renders as valid and resolves somewhere the author did not mean.\n   *\n   * **This is an invariant to CREATE, not one to inherit** (`BUNDLE_LAYERS_SPEC\n   * §11`): the shipped resolver reads `{currentFile, corpusRoot}` and nothing\n   * else, so `$fs:` is bundle-anchored only if something says so. It lives here,\n   * in the resolver, rather than as a rule each caller applies by passing\n   * `corpusRoot: '/'` — an invariant the arithmetic carries cannot be forgotten\n   * at one call site out of five.\n   */\n  bundleChrooted?: boolean;\n}\n\n/** Ambient link space. A corpus-rendering app wraps its document tree in\n *  `<LinkSpaceContext value={{ corpusRoot }}>`; nesting a second provider inside a\n *  rendered sub-corpus makes the innermost root win. */\nexport const LinkSpaceContext = createContext<LinkSpace>({\n  corpusRoot: null,\n  bundleChrooted: false,\n});\n\n/** Collapse `.`/`..`/empty segments into a clean absolute path. `..` can never\n *  climb above the root — a (virtual) root's parent is itself, which is what keeps\n *  both the mount space and the corpus space closed under traversal. */\nexport const normalizeAbsolute = (path: string): string => {\n  const out: string[] = [];\n  for (const seg of path.split('/')) {\n    if (seg === '' || seg === '.') continue;\n    if (seg === '..') out.pop();\n    else out.push(seg);\n  }\n  return '/' + out.join('/');\n};\n\nexport type ResolvedLinkTarget =\n  /** Resolved to an absolute filesystem path (existence NOT checked here). */\n  | { state: 'resolved'; path: string }\n  /** A relative target with no known authoring file — the caller may route\n   *  optimistically (it cannot check existence or self-ness generically). */\n  | { state: 'unresolvable' }\n  /** A malformed `$fs:` target (not mount-absolute; includes scheme smuggling).\n   *  Callers MUST render this broken/inert — never as an anchor. */\n  | { state: 'invalid' };\n\n/** Anchor a corpus-absolute path at `corpusRoot`, clamping the corpus-relative\n *  half FIRST so the virtual corpus space stays closed under traversal. Shared by\n *  the `/p` branch and — under a bundle chroot — the `$fs:/p` branch, so the two\n *  spellings cannot drift into resolving differently. */\nfunction resolveCorpusAbsolute(path: string, corpusRoot: string | null): ResolvedLinkTarget {\n  const inner = normalizeAbsolute(path);\n  if (corpusRoot === null || corpusRoot === '/') return { state: 'resolved', path: inner };\n  return { state: 'resolved', path: normalizeAbsolute(corpusRoot + inner) };\n}\n\n/**\n * Resolve a raw link target (a wikilink target or an in-app href's path half —\n * fragment already split off) to an absolute filesystem path. THE shared resolver:\n * the default `WikiLink`, the markdown `a` override, and safe-content consumers\n * all route through this one function so the two render pipelines cannot drift.\n */\nexport function resolveLinkTarget(\n  raw: string,\n  opts: {\n    currentFile?: string;\n    corpusRoot?: string | null;\n    /** See `LinkSpace.bundleChrooted`. Under a bundle-chroot'd grant `$fs:`\n     *  resolves in the corpus space, because they are the same space. */\n    bundleChrooted?: boolean;\n  } = {},\n): ResolvedLinkTarget {\n  if (raw.startsWith(FS_PREFIX)) {\n    const rest = raw.slice(FS_PREFIX.length);\n    // Must be mount-absolute. This single rule also fails `$fs:javascript:…`,\n    // `$fs:https://…`, and every other smuggled scheme closed.\n    if (!rest.startsWith('/')) return { state: 'invalid' };\n    // Under a bundle chroot the mount root IS the bundle root, so `$fs:` has\n    // nowhere outside to name: it takes the corpus-absolute branch below and the\n    // two spellings collapse. `normalizeAbsolute` clamps `..` at the root either\n    // way, so neither spelling can climb out — the collapse changes WHERE a\n    // `$fs:` link points, never whether it can escape.\n    if (opts.bundleChrooted) return resolveCorpusAbsolute(rest, opts.corpusRoot ?? null);\n    return { state: 'resolved', path: normalizeAbsolute(rest) };\n  }\n  if (raw.startsWith('/')) {\n    const corpusRoot = opts.corpusRoot ?? null;\n    if (corpusRoot !== null) {\n      // Clamp the corpus-relative half FIRST (the virtual FS is closed — `/../x`\n      // stays inside the corpus), THEN anchor it at the corpus root.\n      return resolveCorpusAbsolute(raw, corpusRoot);\n    }\n    return { state: 'resolved', path: normalizeAbsolute(raw) };\n  }\n  // Relative: against the authoring file's directory — the same in both spaces.\n  if (!opts.currentFile) return { state: 'unresolvable' };\n  const dir = opts.currentFile.slice(0, opts.currentFile.lastIndexOf('/'));\n  return { state: 'resolved', path: normalizeAbsolute(`${dir}/${raw}`) };\n}\n"],"mappings":";AAwBA,SAAS,qBAAqB;AAEvB,MAAM,YAAY;AA+BlB,MAAM,mBAAmB,cAAyB;AAAA,EACvD,YAAY;AAAA,EACZ,gBAAgB;AAClB,CAAC;AAKM,MAAM,oBAAoB,CAAC,SAAyB;AACzD,QAAM,MAAgB,CAAC;AACvB,aAAW,OAAO,KAAK,MAAM,GAAG,GAAG;AACjC,QAAI,QAAQ,MAAM,QAAQ,IAAK;AAC/B,QAAI,QAAQ,KAAM,KAAI,IAAI;AAAA,QACrB,KAAI,KAAK,GAAG;AAAA,EACnB;AACA,SAAO,MAAM,IAAI,KAAK,GAAG;AAC3B;AAgBA,SAAS,sBAAsB,MAAc,YAA+C;AAC1F,QAAM,QAAQ,kBAAkB,IAAI;AACpC,MAAI,eAAe,QAAQ,eAAe,IAAK,QAAO,EAAE,OAAO,YAAY,MAAM,MAAM;AACvF,SAAO,EAAE,OAAO,YAAY,MAAM,kBAAkB,aAAa,KAAK,EAAE;AAC1E;AAQO,SAAS,kBACd,KACA,OAMI,CAAC,GACe;AACpB,MAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,UAAM,OAAO,IAAI,MAAM,UAAU,MAAM;AAGvC,QAAI,CAAC,KAAK,WAAW,GAAG,EAAG,QAAO,EAAE,OAAO,UAAU;AAMrD,QAAI,KAAK,eAAgB,QAAO,sBAAsB,MAAM,KAAK,cAAc,IAAI;AACnF,WAAO,EAAE,OAAO,YAAY,MAAM,kBAAkB,IAAI,EAAE;AAAA,EAC5D;AACA,MAAI,IAAI,WAAW,GAAG,GAAG;AACvB,UAAM,aAAa,KAAK,cAAc;AACtC,QAAI,eAAe,MAAM;AAGvB,aAAO,sBAAsB,KAAK,UAAU;AAAA,IAC9C;AACA,WAAO,EAAE,OAAO,YAAY,MAAM,kBAAkB,GAAG,EAAE;AAAA,EAC3D;AAEA,MAAI,CAAC,KAAK,YAAa,QAAO,EAAE,OAAO,eAAe;AACtD,QAAM,MAAM,KAAK,YAAY,MAAM,GAAG,KAAK,YAAY,YAAY,GAAG,CAAC;AACvE,SAAO,EAAE,OAAO,YAAY,MAAM,kBAAkB,GAAG,GAAG,IAAI,GAAG,EAAE,EAAE;AACvE;","names":[]}
+{"version":3,"sources":["../src/linkSpace.ts"],"sourcesContent":["// Link path spaces (R3-273; REPO_CONTENT_DISPATCH_SPEC §9 decision, 2026-08-17).\n// R3-279: the RESOLVER CORE (resolveLinkTarget / normalizeAbsolute / FS_PREFIX /\n// ResolvedLinkTarget) moved to `@immediately-run/mdx-plugins` — beside its parity\n// fixture — and is re-exported here unchanged (API-stable). This module keeps the\n// REACT surface (LinkSpaceContext): the provider a corpus-rendering app wraps its\n// document tree in. Consumers importing from '@immediately-run/sdk/linkSpace' see\n// exactly the same names.\n//\n// A document link's target resolves in one of two spaces:\n//\n// - DEFAULT — the enclosing corpus's virtual filesystem. RELATIVE targets resolve\n//   against the authoring file (identical in both spaces); ABSOLUTE targets\n//   (`/x/y.mdx`) resolve from the corpus root when an enclosing `LinkSpaceContext`\n//   declares one, else from the filesystem root. A non-corpus app declares nothing\n//   and keeps today's behavior bit-for-bit (its fs root IS its only root).\n//\n// - `$fs:` — the explicit filesystem space: `$fs:/content/x.mdx` resolves from the\n//   root of the filesystem the app reads, escaping corpus-relative addressing.\n//\n// `$fs:` changes ADDRESSING, never REACH: resolution is pure path arithmetic and\n// existence is checked against the same in-mount metadata the default space uses —\n// nothing is fetched, and a link can never name what the app cannot already read.\n// A malformed `$fs:` target (anything not mount-absolute — which also catches\n// scheme smuggling like `$fs:javascript:…`) is INVALID and must render as a broken\n// link, never an anchor.\n//\n// Corpus nesting: `LinkSpaceContext` providers nest, and the NEAREST one wins —\n// which is exactly the innermost-enclosing-corpus rule (bundle encapsulation): a\n// document rendered inside a nested corpus resolves against the nested corpus.\n\nimport { createContext } from 'react';\n\nexport { FS_PREFIX, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';\nexport type { ResolvedLinkTarget, LinkSpace } from '@immediately-run/mdx-plugins';\nimport type { LinkSpace as LinkSpaceShape } from '@immediately-run/mdx-plugins';\n\n/** Ambient link space. A corpus-rendering app wraps its document tree in\n *  `<LinkSpaceContext value={{ corpusRoot }}>`; nesting a second provider inside a\n *  rendered sub-corpus makes the innermost root win. */\nexport const LinkSpaceContext = createContext<LinkSpaceShape>({\n  corpusRoot: null,\n  bundleChrooted: false,\n});\n"],"mappings":";AA8BA,SAAS,qBAAqB;AAE9B,SAAS,WAAW,mBAAmB,yBAAyB;AAOzD,MAAM,mBAAmB,cAA8B;AAAA,EAC5D,YAAY;AAAA,EACZ,gBAAgB;AAClB,CAAC;","names":[]}

package/dist/safeContent/SafeContent.cjs

@@ -18,35 +18,10 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var SafeContent_exports = {};
 __export(SafeContent_exports, {
-  SafeContent: () => SafeContent
+  SafeContent: () => import_safe_content.SafeContent
 });
 module.exports = __toCommonJS(SafeContent_exports);
-var import_react = require("react");
-var import_parseSafeMdast = require("./parseSafeMdast");
-var import_renderMdast = require("./renderMdast");
-function SafeContent({ source, fallback = null, ...options }) {
-  const [tree, setTree] = (0, import_react.useState)(null);
-  const runId = (0, import_react.useRef)(0);
-  (0, import_react.useEffect)(() => {
-    const id = ++runId.current;
-    setTree(null);
-    let cancelled = false;
-    (0, import_parseSafeMdast.parseSafeMdast)(source).then((parsed) => {
-      if (!cancelled && runId.current === id) setTree(parsed);
-    }).catch(() => {
-      if (!cancelled && runId.current === id) setTree(null);
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [source]);
-  const rendered = (0, import_react.useMemo)(
-    () => tree ? (0, import_renderMdast.renderMdast)(tree, options) : null,
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [tree, options.components, options.resolveWikiLink]
-  );
-  return tree ? rendered : fallback;
-}
+var import_safe_content = require("@immediately-run/safe-content");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SafeContent

package/dist/safeContent/SafeContent.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/safeContent/SafeContent.tsx"],"sourcesContent":["import { useEffect, useMemo, useRef, useState, type ReactNode } from 'react';\nimport { parseSafeMdast } from './parseSafeMdast';\nimport { renderMdast, type RenderMdastOptions } from './renderMdast';\n\n// R3-213 — sharing the component map: `parseSafeMdast` runs the SAME kernel remark\n// plugins the compiled path uses, so it emits `<Admonition>` / `<WikiLink>` /\n// `<HeadingAnchor>` element nodes. To render them identically to the compiled path (and\n// so pick up the R3-212 fragment resolver + scroll), an interpreter app passes the SAME\n// `DEFAULT_MDX_COMPONENTS` it hands `boot({ mdxComponents })` as this component's\n// `components` — that shared map IS the uniformity (no forked second component set). We\n// deliberately do NOT import DEFAULT_MDX_COMPONENTS here: the safe renderer is a lean,\n// dep-light security primitive (render-as-data, no evaluator, ESM-clean for the e2e\n// bundle), and must not pull the full component library into its module graph.\n\n// `<SafeContent>` — the host/SDK-owned safe renderer (TRUST_MODES_SPEC §5.1,\n// AGENT_AUTHORING §10). An interpreter app renders untrusted Markdown/MDX-syntax\n// content — a shared board's body, a multi-writer wiki entry — through THIS component\n// so **no author JavaScript ever executes** while `<Component/>` syntax still reaches\n// the app's own safe components. It is the mandatory terminal for the MDX-from-mount\n// gate: a shared board is a multi-writer (M3) source, and compiled/executable MDX\n// would run board-author code with the app's authority (the WHITEBOARD §8 blast\n// radius this gate bounds).\n//\n// The parse (no-acorn, ESM-only deps) is async, so this renders a small placeholder\n// until the tree is ready, then the pure synchronous `renderMdast`. Parsing is keyed\n// on the source string; a changed source re-parses, and a stale async result is\n// discarded (the ref guard) so a fast source swap can't paint the wrong content.\n\nexport interface SafeContentProps extends RenderMdastOptions {\n  /** The untrusted Markdown/MDX-syntax source to render as data. */\n  source: string;\n  /** Rendered while the async parse is in flight (default: nothing). */\n  fallback?: ReactNode;\n}\n\nexport function SafeContent({ source, fallback = null, ...options }: SafeContentProps): ReactNode {\n  const [tree, setTree] = useState<Awaited<ReturnType<typeof parseSafeMdast>> | null>(null);\n  const runId = useRef(0);\n\n  useEffect(() => {\n    const id = ++runId.current;\n    setTree(null);\n    let cancelled = false;\n    parseSafeMdast(source)\n      .then((parsed) => {\n        // Discard a stale result (source changed / unmounted) so we never paint the\n        // wrong tree — the render-as-data guarantee also needs the RIGHT data shown.\n        if (!cancelled && runId.current === id) setTree(parsed);\n      })\n      .catch(() => {\n        if (!cancelled && runId.current === id) setTree(null);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [source]);\n\n  // `renderMdast` is pure; memoise on the tree + the option identities the caller\n  // passes. (Callers should memoise `components`/`resolveWikiLink` themselves for a\n  // stable identity; changing them re-renders, which is correct.)\n  const rendered = useMemo(\n    () => (tree ? renderMdast(tree, options) : null),\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n    [tree, options.components, options.resolveWikiLink],\n  );\n\n  return tree ? rendered : fallback;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAAqE;AACrE,4BAA+B;AAC/B,yBAAqD;AAiC9C,SAAS,YAAY,EAAE,QAAQ,WAAW,MAAM,GAAG,QAAQ,GAAgC;AAChG,QAAM,CAAC,MAAM,OAAO,QAAI,uBAA4D,IAAI;AACxF,QAAM,YAAQ,qBAAO,CAAC;AAEtB,8BAAU,MAAM;AACd,UAAM,KAAK,EAAE,MAAM;AACnB,YAAQ,IAAI;AACZ,QAAI,YAAY;AAChB,8CAAe,MAAM,EAClB,KAAK,CAAC,WAAW;AAGhB,UAAI,CAAC,aAAa,MAAM,YAAY,GAAI,SAAQ,MAAM;AAAA,IACxD,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,aAAa,MAAM,YAAY,GAAI,SAAQ,IAAI;AAAA,IACtD,CAAC;AACH,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAKX,QAAM,eAAW;AAAA,IACf,MAAO,WAAO,gCAAY,MAAM,OAAO,IAAI;AAAA;AAAA,IAE3C,CAAC,MAAM,QAAQ,YAAY,QAAQ,eAAe;AAAA,EACpD;AAEA,SAAO,OAAO,WAAW;AAC3B;","names":[]}
+{"version":3,"sources":["../../src/safeContent/SafeContent.tsx"],"sourcesContent":["// R3-279 (phase 3): re-export shim — the implementation lives in\n// `@immediately-run/safe-content`; this subpath keeps working byte-compatibly.\nexport { SafeContent } from '@immediately-run/safe-content';\nexport type { SafeContentProps } from '@immediately-run/safe-content';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,0BAA4B;","names":[]}

package/dist/safeContent/SafeContent.d.cts

@@ -1,13 +1 @@
-import { ReactNode } from 'react';
-import { RenderMdastOptions } from './renderMdast.cjs';
-import './parseSafeMdast.cjs';
-
-interface SafeContentProps extends RenderMdastOptions {
-    /** The untrusted Markdown/MDX-syntax source to render as data. */
-    source: string;
-    /** Rendered while the async parse is in flight (default: nothing). */
-    fallback?: ReactNode;
-}
-declare function SafeContent({ source, fallback, ...options }: SafeContentProps): ReactNode;
-
-export { SafeContent, type SafeContentProps };
+export { SafeContent, SafeContentProps } from '@immediately-run/safe-content';

package/dist/safeContent/SafeContent.d.ts

@@ -1,13 +1 @@
-import { ReactNode } from 'react';
-import { RenderMdastOptions } from './renderMdast.js';
-import './parseSafeMdast.js';
-
-interface SafeContentProps extends RenderMdastOptions {
-    /** The untrusted Markdown/MDX-syntax source to render as data. */
-    source: string;
-    /** Rendered while the async parse is in flight (default: nothing). */
-    fallback?: ReactNode;
-}
-declare function SafeContent({ source, fallback, ...options }: SafeContentProps): ReactNode;
-
-export { SafeContent, type SafeContentProps };
+export { SafeContent, SafeContentProps } from '@immediately-run/safe-content';

package/dist/safeContent/SafeContent.js

@@ -1,30 +1,5 @@
 import "../chunk-VHAA22YE.js";
-import { useEffect, useMemo, useRef, useState } from "react";
-import { parseSafeMdast } from "./parseSafeMdast";
-import { renderMdast } from "./renderMdast";
-function SafeContent({ source, fallback = null, ...options }) {
-  const [tree, setTree] = useState(null);
-  const runId = useRef(0);
-  useEffect(() => {
-    const id = ++runId.current;
-    setTree(null);
-    let cancelled = false;
-    parseSafeMdast(source).then((parsed) => {
-      if (!cancelled && runId.current === id) setTree(parsed);
-    }).catch(() => {
-      if (!cancelled && runId.current === id) setTree(null);
-    });
-    return () => {
-      cancelled = true;
-    };
-  }, [source]);
-  const rendered = useMemo(
-    () => tree ? renderMdast(tree, options) : null,
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-    [tree, options.components, options.resolveWikiLink]
-  );
-  return tree ? rendered : fallback;
-}
+import { SafeContent } from "@immediately-run/safe-content";
 export {
   SafeContent
 };

package/dist/safeContent/SafeContent.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/safeContent/SafeContent.tsx"],"sourcesContent":["import { useEffect, useMemo, useRef, useState, type ReactNode } from 'react';\nimport { parseSafeMdast } from './parseSafeMdast';\nimport { renderMdast, type RenderMdastOptions } from './renderMdast';\n\n// R3-213 — sharing the component map: `parseSafeMdast` runs the SAME kernel remark\n// plugins the compiled path uses, so it emits `<Admonition>` / `<WikiLink>` /\n// `<HeadingAnchor>` element nodes. To render them identically to the compiled path (and\n// so pick up the R3-212 fragment resolver + scroll), an interpreter app passes the SAME\n// `DEFAULT_MDX_COMPONENTS` it hands `boot({ mdxComponents })` as this component's\n// `components` — that shared map IS the uniformity (no forked second component set). We\n// deliberately do NOT import DEFAULT_MDX_COMPONENTS here: the safe renderer is a lean,\n// dep-light security primitive (render-as-data, no evaluator, ESM-clean for the e2e\n// bundle), and must not pull the full component library into its module graph.\n\n// `<SafeContent>` — the host/SDK-owned safe renderer (TRUST_MODES_SPEC §5.1,\n// AGENT_AUTHORING §10). An interpreter app renders untrusted Markdown/MDX-syntax\n// content — a shared board's body, a multi-writer wiki entry — through THIS component\n// so **no author JavaScript ever executes** while `<Component/>` syntax still reaches\n// the app's own safe components. It is the mandatory terminal for the MDX-from-mount\n// gate: a shared board is a multi-writer (M3) source, and compiled/executable MDX\n// would run board-author code with the app's authority (the WHITEBOARD §8 blast\n// radius this gate bounds).\n//\n// The parse (no-acorn, ESM-only deps) is async, so this renders a small placeholder\n// until the tree is ready, then the pure synchronous `renderMdast`. Parsing is keyed\n// on the source string; a changed source re-parses, and a stale async result is\n// discarded (the ref guard) so a fast source swap can't paint the wrong content.\n\nexport interface SafeContentProps extends RenderMdastOptions {\n  /** The untrusted Markdown/MDX-syntax source to render as data. */\n  source: string;\n  /** Rendered while the async parse is in flight (default: nothing). */\n  fallback?: ReactNode;\n}\n\nexport function SafeContent({ source, fallback = null, ...options }: SafeContentProps): ReactNode {\n  const [tree, setTree] = useState<Awaited<ReturnType<typeof parseSafeMdast>> | null>(null);\n  const runId = useRef(0);\n\n  useEffect(() => {\n    const id = ++runId.current;\n    setTree(null);\n    let cancelled = false;\n    parseSafeMdast(source)\n      .then((parsed) => {\n        // Discard a stale result (source changed / unmounted) so we never paint the\n        // wrong tree — the render-as-data guarantee also needs the RIGHT data shown.\n        if (!cancelled && runId.current === id) setTree(parsed);\n      })\n      .catch(() => {\n        if (!cancelled && runId.current === id) setTree(null);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [source]);\n\n  // `renderMdast` is pure; memoise on the tree + the option identities the caller\n  // passes. (Callers should memoise `components`/`resolveWikiLink` themselves for a\n  // stable identity; changing them re-renders, which is correct.)\n  const rendered = useMemo(\n    () => (tree ? renderMdast(tree, options) : null),\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n    [tree, options.components, options.resolveWikiLink],\n  );\n\n  return tree ? rendered : fallback;\n}\n"],"mappings":";AAAA,SAAS,WAAW,SAAS,QAAQ,gBAAgC;AACrE,SAAS,sBAAsB;AAC/B,SAAS,mBAA4C;AAiC9C,SAAS,YAAY,EAAE,QAAQ,WAAW,MAAM,GAAG,QAAQ,GAAgC;AAChG,QAAM,CAAC,MAAM,OAAO,IAAI,SAA4D,IAAI;AACxF,QAAM,QAAQ,OAAO,CAAC;AAEtB,YAAU,MAAM;AACd,UAAM,KAAK,EAAE,MAAM;AACnB,YAAQ,IAAI;AACZ,QAAI,YAAY;AAChB,mBAAe,MAAM,EAClB,KAAK,CAAC,WAAW;AAGhB,UAAI,CAAC,aAAa,MAAM,YAAY,GAAI,SAAQ,MAAM;AAAA,IACxD,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,aAAa,MAAM,YAAY,GAAI,SAAQ,IAAI;AAAA,IACtD,CAAC;AACH,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAKX,QAAM,WAAW;AAAA,IACf,MAAO,OAAO,YAAY,MAAM,OAAO,IAAI;AAAA;AAAA,IAE3C,CAAC,MAAM,QAAQ,YAAY,QAAQ,eAAe;AAAA,EACpD;AAEA,SAAO,OAAO,WAAW;AAC3B;","names":[]}
+{"version":3,"sources":["../../src/safeContent/SafeContent.tsx"],"sourcesContent":["// R3-279 (phase 3): re-export shim — the implementation lives in\n// `@immediately-run/safe-content`; this subpath keeps working byte-compatibly.\nexport { SafeContent } from '@immediately-run/safe-content';\nexport type { SafeContentProps } from '@immediately-run/safe-content';\n"],"mappings":";AAEA,SAAS,mBAAmB;","names":[]}

package/dist/safeContent/index.cjs

@@ -3,10 +3,6 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -15,29 +11,13 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var safeContent_exports = {};
-__export(safeContent_exports, {
-  SafeContent: () => import_SafeContent.SafeContent,
-  parseSafeMdast: () => import_parseSafeMdast.parseSafeMdast,
-  parseWikiInner: () => import_wikilink.parseWikiInner,
-  renderMdast: () => import_renderMdast.renderMdast,
-  sanitizeUrl: () => import_sanitizeUrl.sanitizeUrl,
-  splitWikiLinks: () => import_wikilink.splitWikiLinks
-});
 module.exports = __toCommonJS(safeContent_exports);
-var import_SafeContent = require("./SafeContent");
-var import_renderMdast = require("./renderMdast");
-var import_parseSafeMdast = require("./parseSafeMdast");
-var import_sanitizeUrl = require("./sanitizeUrl");
-var import_wikilink = require("./wikilink");
+__reExport(safeContent_exports, require("@immediately-run/safe-content"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  SafeContent,
-  parseSafeMdast,
-  parseWikiInner,
-  renderMdast,
-  sanitizeUrl,
-  splitWikiLinks
+  ...require("@immediately-run/safe-content")
 });
 //# sourceMappingURL=index.cjs.map

package/dist/safeContent/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/safeContent/index.ts"],"sourcesContent":["// Safe content rendering — non-executable MDX (TRUST_MODES_SPEC §5.1, AGENT_AUTHORING\n// §10). The host/SDK-owned renderer an INTERPRETER app uses to render untrusted\n// Markdown/MDX-syntax content as data, with **no evaluator anywhere in the pipeline**.\n// This is the mandatory terminal for the MDX-from-mount gate (§10 delta 1) — a shared\n// (multi-writer / M3) board or wiki entry MUST render through here, never compiled MDX.\n//\n// It is a **T2 tool, not a platform gate**: it stops content executing as code; it does\n// not certify anything to the host, and CO-4 data-fencing is still required for anything\n// that *reads* the content (the agent case).\n\nexport { SafeContent } from './SafeContent';\nexport type { SafeContentProps } from './SafeContent';\nexport { renderMdast } from './renderMdast';\nexport type { RenderMdastOptions, SafeContentComponents } from './renderMdast';\nexport { parseSafeMdast } from './parseSafeMdast';\nexport type { SafeMdastNode, SafeMdxAttribute, ParseSafeMdastOptions } from './parseSafeMdast';\nexport { sanitizeUrl } from './sanitizeUrl';\nexport { splitWikiLinks, parseWikiInner } from './wikilink';\nexport type { WikiLinkToken, WikiPart } from './wikilink';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,yBAA4B;AAE5B,yBAA4B;AAE5B,4BAA+B;AAE/B,yBAA4B;AAC5B,sBAA+C;","names":[]}
+{"version":3,"sources":["../../src/safeContent/index.ts"],"sourcesContent":["// Safe content rendering — non-executable MDX (TRUST_MODES_SPEC §5.1, AGENT_AUTHORING\n// §10). The host/SDK-owned renderer an INTERPRETER app uses to render untrusted\n// Markdown/MDX-syntax content as data, with **no evaluator anywhere in the pipeline**.\n// This is the mandatory terminal for the MDX-from-mount gate (§10 delta 1) — a shared\n// (multi-writer / M3) board or wiki entry MUST render through here, never compiled MDX.\n//\n// It is a **T2 tool, not a platform gate**: it stops content executing as code; it does\n// not certify anything to the host, and CO-4 data-fencing is still required for anything\n// that *reads* the content (the agent case).\n//\n// R3-279 (phase 3): the implementation now lives in `@immediately-run/safe-content`\n// (the S3 content-framework tier's first extraction). This module — and every sibling\n// subpath below — is a byte-compat RE-EXPORT: `api-snapshot.json` is unchanged, every\n// existing `@immediately-run/sdk/safeContent/*` import keeps working, and no consumer\n// changes anywhere.\nexport * from '@immediately-run/safe-content';\n"],"mappings":";;;;;;;;;;;;;;;AAAA;AAAA;AAeA,gCAAc,0CAfd;","names":[]}

package/dist/safeContent/index.d.cts

@@ -1,6 +1 @@
-export { SafeContent, SafeContentProps } from './SafeContent.cjs';
-export { RenderMdastOptions, SafeContentComponents, renderMdast } from './renderMdast.cjs';
-export { ParseSafeMdastOptions, SafeMdastNode, SafeMdxAttribute, parseSafeMdast } from './parseSafeMdast.cjs';
-export { sanitizeUrl } from './sanitizeUrl.cjs';
-export { WikiLinkToken, WikiPart, parseWikiInner, splitWikiLinks } from './wikilink.cjs';
-import 'react';
+export * from '@immediately-run/safe-content';

package/dist/safeContent/index.d.ts

@@ -1,6 +1 @@
-export { SafeContent, SafeContentProps } from './SafeContent.js';
-export { RenderMdastOptions, SafeContentComponents, renderMdast } from './renderMdast.js';
-export { ParseSafeMdastOptions, SafeMdastNode, SafeMdxAttribute, parseSafeMdast } from './parseSafeMdast.js';
-export { sanitizeUrl } from './sanitizeUrl.js';
-export { WikiLinkToken, WikiPart, parseWikiInner, splitWikiLinks } from './wikilink.js';
-import 'react';
+export * from '@immediately-run/safe-content';

package/dist/safeContent/index.js

@@ -1,15 +1,2 @@
-import "../chunk-VHAA22YE.js";
-import { SafeContent } from "./SafeContent";
-import { renderMdast } from "./renderMdast";
-import { parseSafeMdast } from "./parseSafeMdast";
-import { sanitizeUrl } from "./sanitizeUrl";
-import { splitWikiLinks, parseWikiInner } from "./wikilink";
-export {
-  SafeContent,
-  parseSafeMdast,
-  parseWikiInner,
-  renderMdast,
-  sanitizeUrl,
-  splitWikiLinks
-};
+export * from "@immediately-run/safe-content";
 //# sourceMappingURL=index.js.map

package/dist/safeContent/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/safeContent/index.ts"],"sourcesContent":["// Safe content rendering — non-executable MDX (TRUST_MODES_SPEC §5.1, AGENT_AUTHORING\n// §10). The host/SDK-owned renderer an INTERPRETER app uses to render untrusted\n// Markdown/MDX-syntax content as data, with **no evaluator anywhere in the pipeline**.\n// This is the mandatory terminal for the MDX-from-mount gate (§10 delta 1) — a shared\n// (multi-writer / M3) board or wiki entry MUST render through here, never compiled MDX.\n//\n// It is a **T2 tool, not a platform gate**: it stops content executing as code; it does\n// not certify anything to the host, and CO-4 data-fencing is still required for anything\n// that *reads* the content (the agent case).\n\nexport { SafeContent } from './SafeContent';\nexport type { SafeContentProps } from './SafeContent';\nexport { renderMdast } from './renderMdast';\nexport type { RenderMdastOptions, SafeContentComponents } from './renderMdast';\nexport { parseSafeMdast } from './parseSafeMdast';\nexport type { SafeMdastNode, SafeMdxAttribute, ParseSafeMdastOptions } from './parseSafeMdast';\nexport { sanitizeUrl } from './sanitizeUrl';\nexport { splitWikiLinks, parseWikiInner } from './wikilink';\nexport type { WikiLinkToken, WikiPart } from './wikilink';\n"],"mappings":";AAUA,SAAS,mBAAmB;AAE5B,SAAS,mBAAmB;AAE5B,SAAS,sBAAsB;AAE/B,SAAS,mBAAmB;AAC5B,SAAS,gBAAgB,sBAAsB;","names":[]}
+{"version":3,"sources":["../../src/safeContent/index.ts"],"sourcesContent":["// Safe content rendering — non-executable MDX (TRUST_MODES_SPEC §5.1, AGENT_AUTHORING\n// §10). The host/SDK-owned renderer an INTERPRETER app uses to render untrusted\n// Markdown/MDX-syntax content as data, with **no evaluator anywhere in the pipeline**.\n// This is the mandatory terminal for the MDX-from-mount gate (§10 delta 1) — a shared\n// (multi-writer / M3) board or wiki entry MUST render through here, never compiled MDX.\n//\n// It is a **T2 tool, not a platform gate**: it stops content executing as code; it does\n// not certify anything to the host, and CO-4 data-fencing is still required for anything\n// that *reads* the content (the agent case).\n//\n// R3-279 (phase 3): the implementation now lives in `@immediately-run/safe-content`\n// (the S3 content-framework tier's first extraction). This module — and every sibling\n// subpath below — is a byte-compat RE-EXPORT: `api-snapshot.json` is unchanged, every\n// existing `@immediately-run/sdk/safeContent/*` import keeps working, and no consumer\n// changes anywhere.\nexport * from '@immediately-run/safe-content';\n"],"mappings":"AAeA,cAAc;","names":[]}