@immediately-run/sdk 0.51.0 → 0.52.0

package/dist/analytics.cjs

@@ -0,0 +1,47 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var analytics_exports = {};
+__export(analytics_exports, {
+  emitAnalyticsEvent: () => emitAnalyticsEvent,
+  recordRoute: () => recordRoute,
+  track: () => track,
+  trackRoute: () => trackRoute
+});
+module.exports = __toCommonJS(analytics_exports);
+var import_sandboxUtils = require("./sandboxUtils");
+var import_protocolSchemes = require("./protocolSchemes");
+var import_protocol = require("./generated/protocol");
+const emitAnalyticsEvent = (name, props) => (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_ANALYTICS], "emit", [{ name, ...props ? { props } : {} }]);
+const recordRoute = (path) => (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_ANALYTICS], "route", [{ path }]);
+const track = (name, props) => {
+  void emitAnalyticsEvent(name, props).catch(() => {
+  });
+};
+const trackRoute = (path) => {
+  void recordRoute(path).catch(() => {
+  });
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  emitAnalyticsEvent,
+  recordRoute,
+  track,
+  trackRoute
+});
+//# sourceMappingURL=analytics.cjs.map

package/dist/analytics.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/analytics.ts"],"sourcesContent":["// App analytics — the app-facing surface for `analytics:emit`\n// (APP_ANALYTICS_SPEC §2/§3/§5, roadmap R3-350).\n//\n// ─────────────────────────────────────────────────────────────────────────────\n// WHAT THIS IS FOR, STATED HONESTLY\n// ─────────────────────────────────────────────────────────────────────────────\n//\n// An app runs in an opaque-origin sandboxed iframe where even touching\n// `localStorage` throws. It has no storage and no identity of its own, so **a\n// publisher has no way to learn how their app is used.**\n//\n// The honest argument for this capability is *not* that it displaces `net:fetch` —\n// it does not displace anything, and nothing here narrows or discourages\n// `net:fetch`. The argument is a **comparison of bargains**: publishers have a real\n// need; absent a fitted capability they will request `net:fetch` to satisfy it; and\n// a `net:fetch` grant obtained for analytics is a worse bargain for the user than an\n// analytics grant — broader reach, arbitrary bodies, and a consent line that says\n// \"network access\" rather than \"usage statistics\". An app holding BOTH is displayed\n// as such at consent, because the analytics grant then bounds nothing.\n//\n// ─────────────────────────────────────────────────────────────────────────────\n// WRITE-ONLY. THERE IS NO READ METHOD HERE, AND NONE IS COMING.\n// ─────────────────────────────────────────────────────────────────────────────\n//\n// T-AN-6. An app that could read its own aggregates would learn about the USER —\n// which is the party the architecture assumes is being protected from unaccountable\n// publishers. §13 records the read path as rejected: *\"a plausible feature that\n// converts a write-only channel into a two-way one, and would need its own threat\n// pass.\"* The wire family declares no push channel and no poll, so there is nothing\n// for a read method to ride on.\n//\n// The reply is a bare acknowledgement. It carries no count, no remaining budget, and\n// no \"was that route recognised\" — each of those would be a read channel by another\n// name, and an app that could probe which paths are accepted has one.\n//\n// ─────────────────────────────────────────────────────────────────────────────\n// WHAT YOU MUST DECLARE, AND WHY IT IS THE SHAPE IT IS\n// ─────────────────────────────────────────────────────────────────────────────\n//\n// Everything an app may emit is declared in its manifest and consented to by the\n// user. **The hash of that declaration is bound into the grant** (§2.1): change the\n// vocabulary and the grant is invalid until the user re-consents with the new one\n// shown. `appKey` carries no ref, so without that binding a publisher could observe\n// their aggregates and then ship an alphabet tuned to encode what they now want to\n// read, under a grant given for something else.\n//\n//   \"capabilities\": [{\n//     \"name\": \"analytics:emit\",\n//     \"params\": {\n//       \"events\": {\n//         \"clinic.view\":   { \"props\": { \"tab\": { \"type\": \"enum\", \"values\": [\"summary\", \"meds\"] } } },\n//         \"clinic.export\": { \"props\": { \"format\": { \"type\": \"enum\", \"values\": [\"pdf\", \"csv\"] } } }\n//       },\n//       \"routes\": [\"/patients/:id\", \"/patients\"]\n//     }\n//   }]\n//\n// - **String properties must be bounded ENUMERATIONS**, never free strings; numeric\n//   ones declare an INTEGRAL range. This is the difference between a bound that is\n//   computed and one that is hoped for: analytics is a covert channel with a\n//   capacity, and a free string carries the file, the key, the row. It will be the\n//   first thing you want relaxed; §12 says so in advance.\n// - **The total declared vocabulary is capped** at 2^12 distinct emit-shapes. Eight\n//   properties of sixteen values each looks modest written out and is 4.3 billion.\n// - **Routes are patterns, never paths.** `/patients/12345` is not a page name. You\n//   pass the concrete path to {@link recordRoute} and the platform records\n//   `/patients/:id`; the variable segment is discarded at the boundary and never\n//   transmitted. If you need per-item counts, declare a bounded enumeration of\n//   items — there is no unbounded per-item cardinality by design.\n// - **There is a per-user daily cap**, published in the consent line's detail.\n//\n// ─────────────────────────────────────────────────────────────────────────────\n// WHEN THIS WILL REFUSE\n// ─────────────────────────────────────────────────────────────────────────────\n//\n// Every refusal is a typed error, and none of them is retryable by trying harder:\n//\n// - `forbidden` — no grant; or the grant is bound to a DIFFERENT vocabulary than the\n//   one currently declared (re-consent needed); or the app is running under the M3\n//   stranger stance, which refuses `analytics:*` outright; or the caller is a task\n//   app invoked by a holder — the capability is not delegable.\n// - `invalid-params` — the event is not in the declared vocabulary: an undeclared\n//   name or key, a string outside its enumeration, a number outside its range.\n//   Rejected, never silently stripped.\n// - `budget` — the per-(app, user) daily cap is spent.\n//\n// **Emits never throw into your app by default.** {@link track} swallows refusals,\n// because an analytics call failing is not a reason for a feature to fail. Use\n// {@link emitAnalyticsEvent} when you want the error.\n\nimport { protocolRequest } from './sandboxUtils';\nimport { SCHEMES } from './protocolSchemes';\nimport { PROTOCOL_ANALYTICS } from './generated/protocol';\n\n/** Property values a declared event may carry. Scalars only — an object or an array\n *  has no bound, and the bound is the point. */\nexport type AnalyticsPropValue = string | number | boolean;\n\n/** The acknowledgement. Deliberately carries nothing but the fact of acceptance —\n *  anything else would be a read channel back into the app (T-AN-6). */\nexport interface AnalyticsAck {\n  accepted: boolean;\n}\n\n/**\n * Emit one declared analytics event, surfacing refusals as typed errors.\n *\n * @param name a declared, app-namespaced event name (`myapp.somethingHappened`).\n *             It may not collide with the host vocabulary.\n * @param props declared properties only. An undeclared key REJECTS the event —\n *              nothing is stripped, because a silently dropped key turns a leak into\n *              a green test.\n *\n * @throws `forbidden` | `invalid-params` | `budget` — see the module header.\n */\nexport const emitAnalyticsEvent = (name: string, props?: Record<string, AnalyticsPropValue>): Promise<AnalyticsAck> =>\n  protocolRequest(SCHEMES[PROTOCOL_ANALYTICS], 'emit', [{ name, ...(props ? { props } : {}) }]);\n\n/**\n * Record a navigation, as a declared route PATTERN.\n *\n * Pass the concrete path your router produced. The platform matches it against your\n * declared patterns and records the **pattern**: `/patients/12345` becomes\n * `/patients/:id`, and the id is discarded at the boundary rather than filtered\n * later. A path matching no declared pattern records nothing — and reports success\n * either way, because telling you which paths are accepted would be a read channel.\n *\n * @throws the same typed errors as {@link emitAnalyticsEvent}.\n */\nexport const recordRoute = (path: string): Promise<AnalyticsAck> =>\n  protocolRequest(SCHEMES[PROTOCOL_ANALYTICS], 'route', [{ path }]);\n\n/**\n * Fire-and-forget {@link emitAnalyticsEvent}.\n *\n * Swallows every refusal, because an analytics call failing is not a reason for a\n * feature to fail — and because the alternative is every call site wrapping this in\n * a `try` that does nothing, which is the same behaviour with more places to get it\n * wrong. Use {@link emitAnalyticsEvent} while you are getting your vocabulary right;\n * use this in the code you ship.\n */\nexport const track = (name: string, props?: Record<string, AnalyticsPropValue>): void => {\n  void emitAnalyticsEvent(name, props).catch(() => {});\n};\n\n/** Fire-and-forget {@link recordRoute}, on the same reasoning as {@link track}. */\nexport const trackRoute = (path: string): void => {\n  void recordRoute(path).catch(() => {});\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0FA,0BAAgC;AAChC,6BAAwB;AACxB,sBAAmC;AAuB5B,MAAM,qBAAqB,CAAC,MAAc,cAC/C,qCAAgB,+BAAQ,kCAAkB,GAAG,QAAQ,CAAC,EAAE,MAAM,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC,CAAC;AAavF,MAAM,cAAc,CAAC,aAC1B,qCAAgB,+BAAQ,kCAAkB,GAAG,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AAW3D,MAAM,QAAQ,CAAC,MAAc,UAAqD;AACvF,OAAK,mBAAmB,MAAM,KAAK,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACrD;AAGO,MAAM,aAAa,CAAC,SAAuB;AAChD,OAAK,YAAY,IAAI,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACvC;","names":[]}

package/dist/analytics.d.cts

@@ -0,0 +1,46 @@
+/** Property values a declared event may carry. Scalars only — an object or an array
+ *  has no bound, and the bound is the point. */
+type AnalyticsPropValue = string | number | boolean;
+/** The acknowledgement. Deliberately carries nothing but the fact of acceptance —
+ *  anything else would be a read channel back into the app (T-AN-6). */
+interface AnalyticsAck {
+    accepted: boolean;
+}
+/**
+ * Emit one declared analytics event, surfacing refusals as typed errors.
+ *
+ * @param name a declared, app-namespaced event name (`myapp.somethingHappened`).
+ *             It may not collide with the host vocabulary.
+ * @param props declared properties only. An undeclared key REJECTS the event —
+ *              nothing is stripped, because a silently dropped key turns a leak into
+ *              a green test.
+ *
+ * @throws `forbidden` | `invalid-params` | `budget` — see the module header.
+ */
+declare const emitAnalyticsEvent: (name: string, props?: Record<string, AnalyticsPropValue>) => Promise<AnalyticsAck>;
+/**
+ * Record a navigation, as a declared route PATTERN.
+ *
+ * Pass the concrete path your router produced. The platform matches it against your
+ * declared patterns and records the **pattern**: `/patients/12345` becomes
+ * `/patients/:id`, and the id is discarded at the boundary rather than filtered
+ * later. A path matching no declared pattern records nothing — and reports success
+ * either way, because telling you which paths are accepted would be a read channel.
+ *
+ * @throws the same typed errors as {@link emitAnalyticsEvent}.
+ */
+declare const recordRoute: (path: string) => Promise<AnalyticsAck>;
+/**
+ * Fire-and-forget {@link emitAnalyticsEvent}.
+ *
+ * Swallows every refusal, because an analytics call failing is not a reason for a
+ * feature to fail — and because the alternative is every call site wrapping this in
+ * a `try` that does nothing, which is the same behaviour with more places to get it
+ * wrong. Use {@link emitAnalyticsEvent} while you are getting your vocabulary right;
+ * use this in the code you ship.
+ */
+declare const track: (name: string, props?: Record<string, AnalyticsPropValue>) => void;
+/** Fire-and-forget {@link recordRoute}, on the same reasoning as {@link track}. */
+declare const trackRoute: (path: string) => void;
+
+export { type AnalyticsAck, type AnalyticsPropValue, emitAnalyticsEvent, recordRoute, track, trackRoute };

package/dist/analytics.d.ts

@@ -0,0 +1,46 @@
+/** Property values a declared event may carry. Scalars only — an object or an array
+ *  has no bound, and the bound is the point. */
+type AnalyticsPropValue = string | number | boolean;
+/** The acknowledgement. Deliberately carries nothing but the fact of acceptance —
+ *  anything else would be a read channel back into the app (T-AN-6). */
+interface AnalyticsAck {
+    accepted: boolean;
+}
+/**
+ * Emit one declared analytics event, surfacing refusals as typed errors.
+ *
+ * @param name a declared, app-namespaced event name (`myapp.somethingHappened`).
+ *             It may not collide with the host vocabulary.
+ * @param props declared properties only. An undeclared key REJECTS the event —
+ *              nothing is stripped, because a silently dropped key turns a leak into
+ *              a green test.
+ *
+ * @throws `forbidden` | `invalid-params` | `budget` — see the module header.
+ */
+declare const emitAnalyticsEvent: (name: string, props?: Record<string, AnalyticsPropValue>) => Promise<AnalyticsAck>;
+/**
+ * Record a navigation, as a declared route PATTERN.
+ *
+ * Pass the concrete path your router produced. The platform matches it against your
+ * declared patterns and records the **pattern**: `/patients/12345` becomes
+ * `/patients/:id`, and the id is discarded at the boundary rather than filtered
+ * later. A path matching no declared pattern records nothing — and reports success
+ * either way, because telling you which paths are accepted would be a read channel.
+ *
+ * @throws the same typed errors as {@link emitAnalyticsEvent}.
+ */
+declare const recordRoute: (path: string) => Promise<AnalyticsAck>;
+/**
+ * Fire-and-forget {@link emitAnalyticsEvent}.
+ *
+ * Swallows every refusal, because an analytics call failing is not a reason for a
+ * feature to fail — and because the alternative is every call site wrapping this in
+ * a `try` that does nothing, which is the same behaviour with more places to get it
+ * wrong. Use {@link emitAnalyticsEvent} while you are getting your vocabulary right;
+ * use this in the code you ship.
+ */
+declare const track: (name: string, props?: Record<string, AnalyticsPropValue>) => void;
+/** Fire-and-forget {@link recordRoute}, on the same reasoning as {@link track}. */
+declare const trackRoute: (path: string) => void;
+
+export { type AnalyticsAck, type AnalyticsPropValue, emitAnalyticsEvent, recordRoute, track, trackRoute };

package/dist/analytics.js

@@ -0,0 +1,21 @@
+import "./chunk-VHAA22YE.js";
+import { protocolRequest } from "./sandboxUtils";
+import { SCHEMES } from "./protocolSchemes";
+import { PROTOCOL_ANALYTICS } from "./generated/protocol";
+const emitAnalyticsEvent = (name, props) => protocolRequest(SCHEMES[PROTOCOL_ANALYTICS], "emit", [{ name, ...props ? { props } : {} }]);
+const recordRoute = (path) => protocolRequest(SCHEMES[PROTOCOL_ANALYTICS], "route", [{ path }]);
+const track = (name, props) => {
+  void emitAnalyticsEvent(name, props).catch(() => {
+  });
+};
+const trackRoute = (path) => {
+  void recordRoute(path).catch(() => {
+  });
+};
+export {
+  emitAnalyticsEvent,
+  recordRoute,
+  track,
+  trackRoute
+};
+//# sourceMappingURL=analytics.js.map

package/dist/analytics.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/analytics.ts"],"sourcesContent":["// App analytics — the app-facing surface for `analytics:emit`\n// (APP_ANALYTICS_SPEC §2/§3/§5, roadmap R3-350).\n//\n// ─────────────────────────────────────────────────────────────────────────────\n// WHAT THIS IS FOR, STATED HONESTLY\n// ─────────────────────────────────────────────────────────────────────────────\n//\n// An app runs in an opaque-origin sandboxed iframe where even touching\n// `localStorage` throws. It has no storage and no identity of its own, so **a\n// publisher has no way to learn how their app is used.**\n//\n// The honest argument for this capability is *not* that it displaces `net:fetch` —\n// it does not displace anything, and nothing here narrows or discourages\n// `net:fetch`. The argument is a **comparison of bargains**: publishers have a real\n// need; absent a fitted capability they will request `net:fetch` to satisfy it; and\n// a `net:fetch` grant obtained for analytics is a worse bargain for the user than an\n// analytics grant — broader reach, arbitrary bodies, and a consent line that says\n// \"network access\" rather than \"usage statistics\". An app holding BOTH is displayed\n// as such at consent, because the analytics grant then bounds nothing.\n//\n// ─────────────────────────────────────────────────────────────────────────────\n// WRITE-ONLY. THERE IS NO READ METHOD HERE, AND NONE IS COMING.\n// ─────────────────────────────────────────────────────────────────────────────\n//\n// T-AN-6. An app that could read its own aggregates would learn about the USER —\n// which is the party the architecture assumes is being protected from unaccountable\n// publishers. §13 records the read path as rejected: *\"a plausible feature that\n// converts a write-only channel into a two-way one, and would need its own threat\n// pass.\"* The wire family declares no push channel and no poll, so there is nothing\n// for a read method to ride on.\n//\n// The reply is a bare acknowledgement. It carries no count, no remaining budget, and\n// no \"was that route recognised\" — each of those would be a read channel by another\n// name, and an app that could probe which paths are accepted has one.\n//\n// ─────────────────────────────────────────────────────────────────────────────\n// WHAT YOU MUST DECLARE, AND WHY IT IS THE SHAPE IT IS\n// ─────────────────────────────────────────────────────────────────────────────\n//\n// Everything an app may emit is declared in its manifest and consented to by the\n// user. **The hash of that declaration is bound into the grant** (§2.1): change the\n// vocabulary and the grant is invalid until the user re-consents with the new one\n// shown. `appKey` carries no ref, so without that binding a publisher could observe\n// their aggregates and then ship an alphabet tuned to encode what they now want to\n// read, under a grant given for something else.\n//\n//   \"capabilities\": [{\n//     \"name\": \"analytics:emit\",\n//     \"params\": {\n//       \"events\": {\n//         \"clinic.view\":   { \"props\": { \"tab\": { \"type\": \"enum\", \"values\": [\"summary\", \"meds\"] } } },\n//         \"clinic.export\": { \"props\": { \"format\": { \"type\": \"enum\", \"values\": [\"pdf\", \"csv\"] } } }\n//       },\n//       \"routes\": [\"/patients/:id\", \"/patients\"]\n//     }\n//   }]\n//\n// - **String properties must be bounded ENUMERATIONS**, never free strings; numeric\n//   ones declare an INTEGRAL range. This is the difference between a bound that is\n//   computed and one that is hoped for: analytics is a covert channel with a\n//   capacity, and a free string carries the file, the key, the row. It will be the\n//   first thing you want relaxed; §12 says so in advance.\n// - **The total declared vocabulary is capped** at 2^12 distinct emit-shapes. Eight\n//   properties of sixteen values each looks modest written out and is 4.3 billion.\n// - **Routes are patterns, never paths.** `/patients/12345` is not a page name. You\n//   pass the concrete path to {@link recordRoute} and the platform records\n//   `/patients/:id`; the variable segment is discarded at the boundary and never\n//   transmitted. If you need per-item counts, declare a bounded enumeration of\n//   items — there is no unbounded per-item cardinality by design.\n// - **There is a per-user daily cap**, published in the consent line's detail.\n//\n// ─────────────────────────────────────────────────────────────────────────────\n// WHEN THIS WILL REFUSE\n// ─────────────────────────────────────────────────────────────────────────────\n//\n// Every refusal is a typed error, and none of them is retryable by trying harder:\n//\n// - `forbidden` — no grant; or the grant is bound to a DIFFERENT vocabulary than the\n//   one currently declared (re-consent needed); or the app is running under the M3\n//   stranger stance, which refuses `analytics:*` outright; or the caller is a task\n//   app invoked by a holder — the capability is not delegable.\n// - `invalid-params` — the event is not in the declared vocabulary: an undeclared\n//   name or key, a string outside its enumeration, a number outside its range.\n//   Rejected, never silently stripped.\n// - `budget` — the per-(app, user) daily cap is spent.\n//\n// **Emits never throw into your app by default.** {@link track} swallows refusals,\n// because an analytics call failing is not a reason for a feature to fail. Use\n// {@link emitAnalyticsEvent} when you want the error.\n\nimport { protocolRequest } from './sandboxUtils';\nimport { SCHEMES } from './protocolSchemes';\nimport { PROTOCOL_ANALYTICS } from './generated/protocol';\n\n/** Property values a declared event may carry. Scalars only — an object or an array\n *  has no bound, and the bound is the point. */\nexport type AnalyticsPropValue = string | number | boolean;\n\n/** The acknowledgement. Deliberately carries nothing but the fact of acceptance —\n *  anything else would be a read channel back into the app (T-AN-6). */\nexport interface AnalyticsAck {\n  accepted: boolean;\n}\n\n/**\n * Emit one declared analytics event, surfacing refusals as typed errors.\n *\n * @param name a declared, app-namespaced event name (`myapp.somethingHappened`).\n *             It may not collide with the host vocabulary.\n * @param props declared properties only. An undeclared key REJECTS the event —\n *              nothing is stripped, because a silently dropped key turns a leak into\n *              a green test.\n *\n * @throws `forbidden` | `invalid-params` | `budget` — see the module header.\n */\nexport const emitAnalyticsEvent = (name: string, props?: Record<string, AnalyticsPropValue>): Promise<AnalyticsAck> =>\n  protocolRequest(SCHEMES[PROTOCOL_ANALYTICS], 'emit', [{ name, ...(props ? { props } : {}) }]);\n\n/**\n * Record a navigation, as a declared route PATTERN.\n *\n * Pass the concrete path your router produced. The platform matches it against your\n * declared patterns and records the **pattern**: `/patients/12345` becomes\n * `/patients/:id`, and the id is discarded at the boundary rather than filtered\n * later. A path matching no declared pattern records nothing — and reports success\n * either way, because telling you which paths are accepted would be a read channel.\n *\n * @throws the same typed errors as {@link emitAnalyticsEvent}.\n */\nexport const recordRoute = (path: string): Promise<AnalyticsAck> =>\n  protocolRequest(SCHEMES[PROTOCOL_ANALYTICS], 'route', [{ path }]);\n\n/**\n * Fire-and-forget {@link emitAnalyticsEvent}.\n *\n * Swallows every refusal, because an analytics call failing is not a reason for a\n * feature to fail — and because the alternative is every call site wrapping this in\n * a `try` that does nothing, which is the same behaviour with more places to get it\n * wrong. Use {@link emitAnalyticsEvent} while you are getting your vocabulary right;\n * use this in the code you ship.\n */\nexport const track = (name: string, props?: Record<string, AnalyticsPropValue>): void => {\n  void emitAnalyticsEvent(name, props).catch(() => {});\n};\n\n/** Fire-and-forget {@link recordRoute}, on the same reasoning as {@link track}. */\nexport const trackRoute = (path: string): void => {\n  void recordRoute(path).catch(() => {});\n};\n"],"mappings":";AA0FA,SAAS,uBAAuB;AAChC,SAAS,eAAe;AACxB,SAAS,0BAA0B;AAuB5B,MAAM,qBAAqB,CAAC,MAAc,UAC/C,gBAAgB,QAAQ,kBAAkB,GAAG,QAAQ,CAAC,EAAE,MAAM,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC,CAAC;AAavF,MAAM,cAAc,CAAC,SAC1B,gBAAgB,QAAQ,kBAAkB,GAAG,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AAW3D,MAAM,QAAQ,CAAC,MAAc,UAAqD;AACvF,OAAK,mBAAmB,MAAM,KAAK,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACrD;AAGO,MAAM,aAAa,CAAC,SAAuB;AAChD,OAAK,YAAY,IAAI,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACvC;","names":[]}

package/dist/corpus.cjs

@@ -0,0 +1,91 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var corpus_exports = {};
+__export(corpus_exports, {
+  CorpusContext: () => CorpusContext,
+  fromCorpusPath: () => fromCorpusPath,
+  toCorpusPath: () => toCorpusPath,
+  useCorpus: () => useCorpus,
+  useCorpusEntries: () => useCorpusEntries,
+  useCorpusEntry: () => useCorpusEntry,
+  useCurrentEntry: () => useCurrentEntry
+});
+module.exports = __toCommonJS(corpus_exports);
+var import_react = require("react");
+var import_metadataSource = require("./metadataSource");
+const EMPTY_SCOPE = { root: null, entry: null, toHref: (p) => p };
+const CorpusContext = (0, import_react.createContext)(EMPTY_SCOPE);
+const useCorpus = () => (0, import_react.use)(CorpusContext);
+const toCorpusPath = (absolute, root) => {
+  if (root === null) return null;
+  const base = root.replace(/\/+$/, "");
+  if (base === "") return absolute;
+  if (!absolute.startsWith(`${base}/`)) return null;
+  return absolute.slice(base.length);
+};
+const fromCorpusPath = (corpusPath, root) => {
+  if (root === null) return null;
+  const base = root.replace(/\/+$/, "");
+  return `${base}${corpusPath.startsWith("/") ? "" : "/"}${corpusPath}`;
+};
+const useCorpusEntries = () => {
+  const files = (0, import_metadataSource.useMetadataStore)();
+  const { root, toHref } = useCorpus();
+  return (0, import_react.useMemo)(() => {
+    if (root === null) return [];
+    const out = [];
+    for (const [absolute, meta] of Object.entries(files)) {
+      const path = toCorpusPath(absolute, root);
+      if (path === null) continue;
+      out.push({ path, href: toHref(path), meta });
+    }
+    out.sort((a, b) => a.path.localeCompare(b.path));
+    return out;
+  }, [files, root, toHref]);
+};
+const useCorpusEntry = (corpusPath) => {
+  const files = (0, import_metadataSource.useMetadataStore)();
+  const { root } = useCorpus();
+  return (0, import_react.useMemo)(() => {
+    const absolute = fromCorpusPath(corpusPath, root);
+    return absolute === null ? void 0 : files[absolute];
+  }, [corpusPath, files, root]);
+};
+const useCurrentEntry = () => {
+  const files = (0, import_metadataSource.useMetadataStore)();
+  const { root, entry, toHref } = useCorpus();
+  return (0, import_react.useMemo)(() => {
+    if (root === null || entry === null) return null;
+    const absolute = fromCorpusPath(entry, root);
+    const meta = absolute === null ? void 0 : files[absolute];
+    if (meta === void 0) return null;
+    return { path: entry, href: toHref(entry), meta };
+  }, [files, root, entry, toHref]);
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CorpusContext,
+  fromCorpusPath,
+  toCorpusPath,
+  useCorpus,
+  useCorpusEntries,
+  useCorpusEntry,
+  useCurrentEntry
+});
+//# sourceMappingURL=corpus.cjs.map

package/dist/corpus.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/corpus.ts"],"sourcesContent":["// The corpus scope — what a component rendered INSIDE a corpus may know about it\n// (R3-174; MDX_FROM_MOUNT_SPEC §2, §7 1a).\n//\n// A corpus viewer can register components the corpus itself ships, so an entry writes\n// `<ProjectIndex/>` and the viewer resolves it — no engine fork, no import line\n// (`MDX_FROM_MOUNT_SPEC` §2's \"provider composition is consumer policy\"). Those components\n// live in the CONTENT filesystem and the viewer lives in its own, and the seam between\n// them is this package: a content component cannot import the viewer (it would resolve a\n// second copy from the registry, with its own module state, and read the wrong corpus), so\n// anything the viewer must tell it has to arrive through a surface both sides already\n// share. This is that surface.\n//\n// **Why paths here are corpus-absolute, not filesystem-absolute.** The metadata store is\n// keyed by absolute module path, which under dispatch means `/mnt/<hash>/roadmap/x.mdx` —\n// the host-minted chroot. That prefix is host knowledge a viewer may read THROUGH but must\n// never publish (the property `grove/src/components/DirectoryList.test.tsx` pins with\n// `expect(el.innerHTML).not.toContain('mnt')`), and it is not stable across loads. A\n// content component that saw it would embed it in hrefs and keys. So the corpus scope\n// rebases every path it hands out to the corpus root (`/roadmap/x.mdx`), which is the same\n// address under fork, library and dispatch composition — `PLATFORM_LAYERING_SPEC` §1.1's\n// mode-invariance rule, applied to metadata rather than to links.\n//\n// **Why the href mapping is injected rather than derived.** Corpus path → in-app URL is\n// VIEWER policy, and the two packagings genuinely disagree (a fork's URLs are anchored at\n// its app root and are already published and cited; a dispatched viewer's are corpus-\n// relative). A content component must not have to know which it is in, and the SDK must\n// not guess — so the viewer supplies `toHref` and content never computes a URL itself.\n\nimport { createContext, use, useMemo } from 'react';\nimport { useMetadataStore } from './metadataSource';\nimport type { Metadata } from './sandboxTypes';\n\n/** What a corpus viewer declares about the corpus it is rendering. */\nexport interface CorpusScope {\n  /**\n   * Absolute filesystem path of the corpus root, WITHOUT a trailing slash\n   * (`/app/content` in a fork, `/mnt/<hash>` under dispatch), or `null` when the\n   * surrounding app is not rendering a corpus — the default, which leaves every hook here\n   * returning the empty result rather than guessing a root.\n   */\n  root: string | null;\n  /** Corpus-absolute path of the entry currently being read (`/roadmap/R3-174.mdx`), or\n   *  `null` when nothing is. This is the entry, NOT the file being rendered: a component\n   *  in a `_layout.mdx` wrapping that entry sees the entry, which is what makes furniture\n   *  in the layout chain (a status line, a dependency rail) able to describe the page. */\n  entry: string | null;\n  /** Corpus-absolute path → the href to navigate to it. Supplied by the viewer; the\n   *  identity function by default, which is correct for a viewer whose URL space IS the\n   *  corpus space. */\n  toHref: (corpusPath: string) => string;\n}\n\nconst EMPTY_SCOPE: CorpusScope = { root: null, entry: null, toHref: (p) => p };\n\n/** Ambient corpus scope. A corpus-rendering app wraps its content tree in\n *  `<CorpusContext value={{ root, entry, toHref }}>`; nesting a second provider inside a\n *  rendered sub-corpus makes the innermost win, as with {@link LinkSpaceContext}. */\nexport const CorpusContext = createContext<CorpusScope>(EMPTY_SCOPE);\n\n/** Read the ambient corpus scope. Every hook below is a convenience over this. */\nexport const useCorpus = (): CorpusScope => use(CorpusContext);\n\n/**\n * Filesystem-absolute path → corpus-absolute, or `null` when the path is not inside the\n * corpus. Exact-root and separator-boundary aware, so `/mnt/hash2/x` is not treated as\n * living under `/mnt/hash`.\n */\nexport const toCorpusPath = (absolute: string, root: string | null): string | null => {\n  if (root === null) return null;\n  const base = root.replace(/\\/+$/, '');\n  if (base === '') return absolute;\n  if (!absolute.startsWith(`${base}/`)) return null;\n  return absolute.slice(base.length);\n};\n\n/** Corpus-absolute path → filesystem-absolute, or `null` without a root. The inverse of\n *  {@link toCorpusPath}, for the rare content component that must read raw bytes. */\nexport const fromCorpusPath = (corpusPath: string, root: string | null): string | null => {\n  if (root === null) return null;\n  const base = root.replace(/\\/+$/, '');\n  return `${base}${corpusPath.startsWith('/') ? '' : '/'}${corpusPath}`;\n};\n\n/** One entry as content sees it: where it is, where it links, and its frontmatter. */\nexport interface CorpusEntry<T = Metadata> {\n  /** Corpus-absolute path (`/roadmap/R3-174.mdx`). */\n  path: string;\n  /** The href that navigates to it, per the viewer's mapping. */\n  href: string;\n  meta: T;\n}\n\n/**\n * Every entry in the surrounding corpus, with corpus-absolute paths and viewer-supplied\n * hrefs — the surface a content component queries instead of {@link useMetadataQuery},\n * whose keys are filesystem-absolute and therefore carry the mount prefix.\n *\n * Returns an empty array outside a corpus, so a component written for a corpus renders\n * nothing rather than throwing when someone drops it elsewhere. The array keeps its\n * identity while the store and root are unchanged, so it is safe in dependency arrays.\n */\nexport const useCorpusEntries = <T = Metadata>(): CorpusEntry<T>[] => {\n  const files = useMetadataStore<T>();\n  const { root, toHref } = useCorpus();\n  return useMemo(() => {\n    if (root === null) return [];\n    const out: CorpusEntry<T>[] = [];\n    for (const [absolute, meta] of Object.entries(files)) {\n      const path = toCorpusPath(absolute, root);\n      if (path === null) continue;\n      out.push({ path, href: toHref(path), meta: meta as T });\n    }\n    // Path order, so a consumer that does not sort still renders deterministically\n    // (object key order is insertion order, which is scan order, which is not stable).\n    out.sort((a, b) => a.path.localeCompare(b.path));\n    return out;\n  }, [files, root, toHref]);\n};\n\n/** One entry's frontmatter by corpus-absolute path, or `undefined`. */\nexport const useCorpusEntry = <T = Metadata>(corpusPath: string): T | undefined => {\n  const files = useMetadataStore<T>();\n  const { root } = useCorpus();\n  return useMemo(() => {\n    const absolute = fromCorpusPath(corpusPath, root);\n    return absolute === null ? undefined : files[absolute];\n  }, [corpusPath, files, root]);\n};\n\n/** The entry currently being read — `null` outside a corpus, or when the viewer declares\n *  no entry (a directory listing, a 404). See {@link CorpusScope.entry} for why this is\n *  the entry rather than the file the component happens to be written in. */\nexport const useCurrentEntry = <T = Metadata>(): CorpusEntry<T> | null => {\n  const files = useMetadataStore<T>();\n  const { root, entry, toHref } = useCorpus();\n  return useMemo(() => {\n    if (root === null || entry === null) return null;\n    const absolute = fromCorpusPath(entry, root);\n    const meta = absolute === null ? undefined : files[absolute];\n    if (meta === undefined) return null;\n    return { path: entry, href: toHref(entry), meta: meta as T };\n  }, [files, root, entry, toHref]);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4BA,mBAA4C;AAC5C,4BAAiC;AAuBjC,MAAM,cAA2B,EAAE,MAAM,MAAM,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE;AAKtE,MAAM,oBAAgB,4BAA2B,WAAW;AAG5D,MAAM,YAAY,UAAmB,kBAAI,aAAa;AAOtD,MAAM,eAAe,CAAC,UAAkB,SAAuC;AACpF,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;AACpC,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,CAAC,SAAS,WAAW,GAAG,IAAI,GAAG,EAAG,QAAO;AAC7C,SAAO,SAAS,MAAM,KAAK,MAAM;AACnC;AAIO,MAAM,iBAAiB,CAAC,YAAoB,SAAuC;AACxF,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;AACpC,SAAO,GAAG,IAAI,GAAG,WAAW,WAAW,GAAG,IAAI,KAAK,GAAG,GAAG,UAAU;AACrE;AAoBO,MAAM,mBAAmB,MAAsC;AACpE,QAAM,YAAQ,wCAAoB;AAClC,QAAM,EAAE,MAAM,OAAO,IAAI,UAAU;AACnC,aAAO,sBAAQ,MAAM;AACnB,QAAI,SAAS,KAAM,QAAO,CAAC;AAC3B,UAAM,MAAwB,CAAC;AAC/B,eAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,YAAM,OAAO,aAAa,UAAU,IAAI;AACxC,UAAI,SAAS,KAAM;AACnB,UAAI,KAAK,EAAE,MAAM,MAAM,OAAO,IAAI,GAAG,KAAgB,CAAC;AAAA,IACxD;AAGA,QAAI,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC/C,WAAO;AAAA,EACT,GAAG,CAAC,OAAO,MAAM,MAAM,CAAC;AAC1B;AAGO,MAAM,iBAAiB,CAAe,eAAsC;AACjF,QAAM,YAAQ,wCAAoB;AAClC,QAAM,EAAE,KAAK,IAAI,UAAU;AAC3B,aAAO,sBAAQ,MAAM;AACnB,UAAM,WAAW,eAAe,YAAY,IAAI;AAChD,WAAO,aAAa,OAAO,SAAY,MAAM,QAAQ;AAAA,EACvD,GAAG,CAAC,YAAY,OAAO,IAAI,CAAC;AAC9B;AAKO,MAAM,kBAAkB,MAA2C;AACxE,QAAM,YAAQ,wCAAoB;AAClC,QAAM,EAAE,MAAM,OAAO,OAAO,IAAI,UAAU;AAC1C,aAAO,sBAAQ,MAAM;AACnB,QAAI,SAAS,QAAQ,UAAU,KAAM,QAAO;AAC5C,UAAM,WAAW,eAAe,OAAO,IAAI;AAC3C,UAAM,OAAO,aAAa,OAAO,SAAY,MAAM,QAAQ;AAC3D,QAAI,SAAS,OAAW,QAAO;AAC/B,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,KAAK,GAAG,KAAgB;AAAA,EAC7D,GAAG,CAAC,OAAO,MAAM,OAAO,MAAM,CAAC;AACjC;","names":[]}

package/dist/corpus.d.cts

@@ -0,0 +1,63 @@
+import * as react from 'react';
+import { Metadata } from './sandboxTypes.cjs';
+
+/** What a corpus viewer declares about the corpus it is rendering. */
+interface CorpusScope {
+    /**
+     * Absolute filesystem path of the corpus root, WITHOUT a trailing slash
+     * (`/app/content` in a fork, `/mnt/<hash>` under dispatch), or `null` when the
+     * surrounding app is not rendering a corpus — the default, which leaves every hook here
+     * returning the empty result rather than guessing a root.
+     */
+    root: string | null;
+    /** Corpus-absolute path of the entry currently being read (`/roadmap/R3-174.mdx`), or
+     *  `null` when nothing is. This is the entry, NOT the file being rendered: a component
+     *  in a `_layout.mdx` wrapping that entry sees the entry, which is what makes furniture
+     *  in the layout chain (a status line, a dependency rail) able to describe the page. */
+    entry: string | null;
+    /** Corpus-absolute path → the href to navigate to it. Supplied by the viewer; the
+     *  identity function by default, which is correct for a viewer whose URL space IS the
+     *  corpus space. */
+    toHref: (corpusPath: string) => string;
+}
+/** Ambient corpus scope. A corpus-rendering app wraps its content tree in
+ *  `<CorpusContext value={{ root, entry, toHref }}>`; nesting a second provider inside a
+ *  rendered sub-corpus makes the innermost win, as with {@link LinkSpaceContext}. */
+declare const CorpusContext: react.Context<CorpusScope>;
+/** Read the ambient corpus scope. Every hook below is a convenience over this. */
+declare const useCorpus: () => CorpusScope;
+/**
+ * Filesystem-absolute path → corpus-absolute, or `null` when the path is not inside the
+ * corpus. Exact-root and separator-boundary aware, so `/mnt/hash2/x` is not treated as
+ * living under `/mnt/hash`.
+ */
+declare const toCorpusPath: (absolute: string, root: string | null) => string | null;
+/** Corpus-absolute path → filesystem-absolute, or `null` without a root. The inverse of
+ *  {@link toCorpusPath}, for the rare content component that must read raw bytes. */
+declare const fromCorpusPath: (corpusPath: string, root: string | null) => string | null;
+/** One entry as content sees it: where it is, where it links, and its frontmatter. */
+interface CorpusEntry<T = Metadata> {
+    /** Corpus-absolute path (`/roadmap/R3-174.mdx`). */
+    path: string;
+    /** The href that navigates to it, per the viewer's mapping. */
+    href: string;
+    meta: T;
+}
+/**
+ * Every entry in the surrounding corpus, with corpus-absolute paths and viewer-supplied
+ * hrefs — the surface a content component queries instead of {@link useMetadataQuery},
+ * whose keys are filesystem-absolute and therefore carry the mount prefix.
+ *
+ * Returns an empty array outside a corpus, so a component written for a corpus renders
+ * nothing rather than throwing when someone drops it elsewhere. The array keeps its
+ * identity while the store and root are unchanged, so it is safe in dependency arrays.
+ */
+declare const useCorpusEntries: <T = Metadata>() => CorpusEntry<T>[];
+/** One entry's frontmatter by corpus-absolute path, or `undefined`. */
+declare const useCorpusEntry: <T = Metadata>(corpusPath: string) => T | undefined;
+/** The entry currently being read — `null` outside a corpus, or when the viewer declares
+ *  no entry (a directory listing, a 404). See {@link CorpusScope.entry} for why this is
+ *  the entry rather than the file the component happens to be written in. */
+declare const useCurrentEntry: <T = Metadata>() => CorpusEntry<T> | null;
+
+export { CorpusContext, type CorpusEntry, type CorpusScope, fromCorpusPath, toCorpusPath, useCorpus, useCorpusEntries, useCorpusEntry, useCurrentEntry };

package/dist/corpus.d.ts

@@ -0,0 +1,63 @@
+import * as react from 'react';
+import { Metadata } from './sandboxTypes.js';
+
+/** What a corpus viewer declares about the corpus it is rendering. */
+interface CorpusScope {
+    /**
+     * Absolute filesystem path of the corpus root, WITHOUT a trailing slash
+     * (`/app/content` in a fork, `/mnt/<hash>` under dispatch), or `null` when the
+     * surrounding app is not rendering a corpus — the default, which leaves every hook here
+     * returning the empty result rather than guessing a root.
+     */
+    root: string | null;
+    /** Corpus-absolute path of the entry currently being read (`/roadmap/R3-174.mdx`), or
+     *  `null` when nothing is. This is the entry, NOT the file being rendered: a component
+     *  in a `_layout.mdx` wrapping that entry sees the entry, which is what makes furniture
+     *  in the layout chain (a status line, a dependency rail) able to describe the page. */
+    entry: string | null;
+    /** Corpus-absolute path → the href to navigate to it. Supplied by the viewer; the
+     *  identity function by default, which is correct for a viewer whose URL space IS the
+     *  corpus space. */
+    toHref: (corpusPath: string) => string;
+}
+/** Ambient corpus scope. A corpus-rendering app wraps its content tree in
+ *  `<CorpusContext value={{ root, entry, toHref }}>`; nesting a second provider inside a
+ *  rendered sub-corpus makes the innermost win, as with {@link LinkSpaceContext}. */
+declare const CorpusContext: react.Context<CorpusScope>;
+/** Read the ambient corpus scope. Every hook below is a convenience over this. */
+declare const useCorpus: () => CorpusScope;
+/**
+ * Filesystem-absolute path → corpus-absolute, or `null` when the path is not inside the
+ * corpus. Exact-root and separator-boundary aware, so `/mnt/hash2/x` is not treated as
+ * living under `/mnt/hash`.
+ */
+declare const toCorpusPath: (absolute: string, root: string | null) => string | null;
+/** Corpus-absolute path → filesystem-absolute, or `null` without a root. The inverse of
+ *  {@link toCorpusPath}, for the rare content component that must read raw bytes. */
+declare const fromCorpusPath: (corpusPath: string, root: string | null) => string | null;
+/** One entry as content sees it: where it is, where it links, and its frontmatter. */
+interface CorpusEntry<T = Metadata> {
+    /** Corpus-absolute path (`/roadmap/R3-174.mdx`). */
+    path: string;
+    /** The href that navigates to it, per the viewer's mapping. */
+    href: string;
+    meta: T;
+}
+/**
+ * Every entry in the surrounding corpus, with corpus-absolute paths and viewer-supplied
+ * hrefs — the surface a content component queries instead of {@link useMetadataQuery},
+ * whose keys are filesystem-absolute and therefore carry the mount prefix.
+ *
+ * Returns an empty array outside a corpus, so a component written for a corpus renders
+ * nothing rather than throwing when someone drops it elsewhere. The array keeps its
+ * identity while the store and root are unchanged, so it is safe in dependency arrays.
+ */
+declare const useCorpusEntries: <T = Metadata>() => CorpusEntry<T>[];
+/** One entry's frontmatter by corpus-absolute path, or `undefined`. */
+declare const useCorpusEntry: <T = Metadata>(corpusPath: string) => T | undefined;
+/** The entry currently being read — `null` outside a corpus, or when the viewer declares
+ *  no entry (a directory listing, a 404). See {@link CorpusScope.entry} for why this is
+ *  the entry rather than the file the component happens to be written in. */
+declare const useCurrentEntry: <T = Metadata>() => CorpusEntry<T> | null;
+
+export { CorpusContext, type CorpusEntry, type CorpusScope, fromCorpusPath, toCorpusPath, useCorpus, useCorpusEntries, useCorpusEntry, useCurrentEntry };

package/dist/corpus.js

@@ -0,0 +1,62 @@
+import "./chunk-VHAA22YE.js";
+import { createContext, use, useMemo } from "react";
+import { useMetadataStore } from "./metadataSource";
+const EMPTY_SCOPE = { root: null, entry: null, toHref: (p) => p };
+const CorpusContext = createContext(EMPTY_SCOPE);
+const useCorpus = () => use(CorpusContext);
+const toCorpusPath = (absolute, root) => {
+  if (root === null) return null;
+  const base = root.replace(/\/+$/, "");
+  if (base === "") return absolute;
+  if (!absolute.startsWith(`${base}/`)) return null;
+  return absolute.slice(base.length);
+};
+const fromCorpusPath = (corpusPath, root) => {
+  if (root === null) return null;
+  const base = root.replace(/\/+$/, "");
+  return `${base}${corpusPath.startsWith("/") ? "" : "/"}${corpusPath}`;
+};
+const useCorpusEntries = () => {
+  const files = useMetadataStore();
+  const { root, toHref } = useCorpus();
+  return useMemo(() => {
+    if (root === null) return [];
+    const out = [];
+    for (const [absolute, meta] of Object.entries(files)) {
+      const path = toCorpusPath(absolute, root);
+      if (path === null) continue;
+      out.push({ path, href: toHref(path), meta });
+    }
+    out.sort((a, b) => a.path.localeCompare(b.path));
+    return out;
+  }, [files, root, toHref]);
+};
+const useCorpusEntry = (corpusPath) => {
+  const files = useMetadataStore();
+  const { root } = useCorpus();
+  return useMemo(() => {
+    const absolute = fromCorpusPath(corpusPath, root);
+    return absolute === null ? void 0 : files[absolute];
+  }, [corpusPath, files, root]);
+};
+const useCurrentEntry = () => {
+  const files = useMetadataStore();
+  const { root, entry, toHref } = useCorpus();
+  return useMemo(() => {
+    if (root === null || entry === null) return null;
+    const absolute = fromCorpusPath(entry, root);
+    const meta = absolute === null ? void 0 : files[absolute];
+    if (meta === void 0) return null;
+    return { path: entry, href: toHref(entry), meta };
+  }, [files, root, entry, toHref]);
+};
+export {
+  CorpusContext,
+  fromCorpusPath,
+  toCorpusPath,
+  useCorpus,
+  useCorpusEntries,
+  useCorpusEntry,
+  useCurrentEntry
+};
+//# sourceMappingURL=corpus.js.map

package/dist/corpus.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/corpus.ts"],"sourcesContent":["// The corpus scope — what a component rendered INSIDE a corpus may know about it\n// (R3-174; MDX_FROM_MOUNT_SPEC §2, §7 1a).\n//\n// A corpus viewer can register components the corpus itself ships, so an entry writes\n// `<ProjectIndex/>` and the viewer resolves it — no engine fork, no import line\n// (`MDX_FROM_MOUNT_SPEC` §2's \"provider composition is consumer policy\"). Those components\n// live in the CONTENT filesystem and the viewer lives in its own, and the seam between\n// them is this package: a content component cannot import the viewer (it would resolve a\n// second copy from the registry, with its own module state, and read the wrong corpus), so\n// anything the viewer must tell it has to arrive through a surface both sides already\n// share. This is that surface.\n//\n// **Why paths here are corpus-absolute, not filesystem-absolute.** The metadata store is\n// keyed by absolute module path, which under dispatch means `/mnt/<hash>/roadmap/x.mdx` —\n// the host-minted chroot. That prefix is host knowledge a viewer may read THROUGH but must\n// never publish (the property `grove/src/components/DirectoryList.test.tsx` pins with\n// `expect(el.innerHTML).not.toContain('mnt')`), and it is not stable across loads. A\n// content component that saw it would embed it in hrefs and keys. So the corpus scope\n// rebases every path it hands out to the corpus root (`/roadmap/x.mdx`), which is the same\n// address under fork, library and dispatch composition — `PLATFORM_LAYERING_SPEC` §1.1's\n// mode-invariance rule, applied to metadata rather than to links.\n//\n// **Why the href mapping is injected rather than derived.** Corpus path → in-app URL is\n// VIEWER policy, and the two packagings genuinely disagree (a fork's URLs are anchored at\n// its app root and are already published and cited; a dispatched viewer's are corpus-\n// relative). A content component must not have to know which it is in, and the SDK must\n// not guess — so the viewer supplies `toHref` and content never computes a URL itself.\n\nimport { createContext, use, useMemo } from 'react';\nimport { useMetadataStore } from './metadataSource';\nimport type { Metadata } from './sandboxTypes';\n\n/** What a corpus viewer declares about the corpus it is rendering. */\nexport interface CorpusScope {\n  /**\n   * Absolute filesystem path of the corpus root, WITHOUT a trailing slash\n   * (`/app/content` in a fork, `/mnt/<hash>` under dispatch), or `null` when the\n   * surrounding app is not rendering a corpus — the default, which leaves every hook here\n   * returning the empty result rather than guessing a root.\n   */\n  root: string | null;\n  /** Corpus-absolute path of the entry currently being read (`/roadmap/R3-174.mdx`), or\n   *  `null` when nothing is. This is the entry, NOT the file being rendered: a component\n   *  in a `_layout.mdx` wrapping that entry sees the entry, which is what makes furniture\n   *  in the layout chain (a status line, a dependency rail) able to describe the page. */\n  entry: string | null;\n  /** Corpus-absolute path → the href to navigate to it. Supplied by the viewer; the\n   *  identity function by default, which is correct for a viewer whose URL space IS the\n   *  corpus space. */\n  toHref: (corpusPath: string) => string;\n}\n\nconst EMPTY_SCOPE: CorpusScope = { root: null, entry: null, toHref: (p) => p };\n\n/** Ambient corpus scope. A corpus-rendering app wraps its content tree in\n *  `<CorpusContext value={{ root, entry, toHref }}>`; nesting a second provider inside a\n *  rendered sub-corpus makes the innermost win, as with {@link LinkSpaceContext}. */\nexport const CorpusContext = createContext<CorpusScope>(EMPTY_SCOPE);\n\n/** Read the ambient corpus scope. Every hook below is a convenience over this. */\nexport const useCorpus = (): CorpusScope => use(CorpusContext);\n\n/**\n * Filesystem-absolute path → corpus-absolute, or `null` when the path is not inside the\n * corpus. Exact-root and separator-boundary aware, so `/mnt/hash2/x` is not treated as\n * living under `/mnt/hash`.\n */\nexport const toCorpusPath = (absolute: string, root: string | null): string | null => {\n  if (root === null) return null;\n  const base = root.replace(/\\/+$/, '');\n  if (base === '') return absolute;\n  if (!absolute.startsWith(`${base}/`)) return null;\n  return absolute.slice(base.length);\n};\n\n/** Corpus-absolute path → filesystem-absolute, or `null` without a root. The inverse of\n *  {@link toCorpusPath}, for the rare content component that must read raw bytes. */\nexport const fromCorpusPath = (corpusPath: string, root: string | null): string | null => {\n  if (root === null) return null;\n  const base = root.replace(/\\/+$/, '');\n  return `${base}${corpusPath.startsWith('/') ? '' : '/'}${corpusPath}`;\n};\n\n/** One entry as content sees it: where it is, where it links, and its frontmatter. */\nexport interface CorpusEntry<T = Metadata> {\n  /** Corpus-absolute path (`/roadmap/R3-174.mdx`). */\n  path: string;\n  /** The href that navigates to it, per the viewer's mapping. */\n  href: string;\n  meta: T;\n}\n\n/**\n * Every entry in the surrounding corpus, with corpus-absolute paths and viewer-supplied\n * hrefs — the surface a content component queries instead of {@link useMetadataQuery},\n * whose keys are filesystem-absolute and therefore carry the mount prefix.\n *\n * Returns an empty array outside a corpus, so a component written for a corpus renders\n * nothing rather than throwing when someone drops it elsewhere. The array keeps its\n * identity while the store and root are unchanged, so it is safe in dependency arrays.\n */\nexport const useCorpusEntries = <T = Metadata>(): CorpusEntry<T>[] => {\n  const files = useMetadataStore<T>();\n  const { root, toHref } = useCorpus();\n  return useMemo(() => {\n    if (root === null) return [];\n    const out: CorpusEntry<T>[] = [];\n    for (const [absolute, meta] of Object.entries(files)) {\n      const path = toCorpusPath(absolute, root);\n      if (path === null) continue;\n      out.push({ path, href: toHref(path), meta: meta as T });\n    }\n    // Path order, so a consumer that does not sort still renders deterministically\n    // (object key order is insertion order, which is scan order, which is not stable).\n    out.sort((a, b) => a.path.localeCompare(b.path));\n    return out;\n  }, [files, root, toHref]);\n};\n\n/** One entry's frontmatter by corpus-absolute path, or `undefined`. */\nexport const useCorpusEntry = <T = Metadata>(corpusPath: string): T | undefined => {\n  const files = useMetadataStore<T>();\n  const { root } = useCorpus();\n  return useMemo(() => {\n    const absolute = fromCorpusPath(corpusPath, root);\n    return absolute === null ? undefined : files[absolute];\n  }, [corpusPath, files, root]);\n};\n\n/** The entry currently being read — `null` outside a corpus, or when the viewer declares\n *  no entry (a directory listing, a 404). See {@link CorpusScope.entry} for why this is\n *  the entry rather than the file the component happens to be written in. */\nexport const useCurrentEntry = <T = Metadata>(): CorpusEntry<T> | null => {\n  const files = useMetadataStore<T>();\n  const { root, entry, toHref } = useCorpus();\n  return useMemo(() => {\n    if (root === null || entry === null) return null;\n    const absolute = fromCorpusPath(entry, root);\n    const meta = absolute === null ? undefined : files[absolute];\n    if (meta === undefined) return null;\n    return { path: entry, href: toHref(entry), meta: meta as T };\n  }, [files, root, entry, toHref]);\n};\n"],"mappings":";AA4BA,SAAS,eAAe,KAAK,eAAe;AAC5C,SAAS,wBAAwB;AAuBjC,MAAM,cAA2B,EAAE,MAAM,MAAM,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE;AAKtE,MAAM,gBAAgB,cAA2B,WAAW;AAG5D,MAAM,YAAY,MAAmB,IAAI,aAAa;AAOtD,MAAM,eAAe,CAAC,UAAkB,SAAuC;AACpF,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;AACpC,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,CAAC,SAAS,WAAW,GAAG,IAAI,GAAG,EAAG,QAAO;AAC7C,SAAO,SAAS,MAAM,KAAK,MAAM;AACnC;AAIO,MAAM,iBAAiB,CAAC,YAAoB,SAAuC;AACxF,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;AACpC,SAAO,GAAG,IAAI,GAAG,WAAW,WAAW,GAAG,IAAI,KAAK,GAAG,GAAG,UAAU;AACrE;AAoBO,MAAM,mBAAmB,MAAsC;AACpE,QAAM,QAAQ,iBAAoB;AAClC,QAAM,EAAE,MAAM,OAAO,IAAI,UAAU;AACnC,SAAO,QAAQ,MAAM;AACnB,QAAI,SAAS,KAAM,QAAO,CAAC;AAC3B,UAAM,MAAwB,CAAC;AAC/B,eAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AACpD,YAAM,OAAO,aAAa,UAAU,IAAI;AACxC,UAAI,SAAS,KAAM;AACnB,UAAI,KAAK,EAAE,MAAM,MAAM,OAAO,IAAI,GAAG,KAAgB,CAAC;AAAA,IACxD;AAGA,QAAI,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC/C,WAAO;AAAA,EACT,GAAG,CAAC,OAAO,MAAM,MAAM,CAAC;AAC1B;AAGO,MAAM,iBAAiB,CAAe,eAAsC;AACjF,QAAM,QAAQ,iBAAoB;AAClC,QAAM,EAAE,KAAK,IAAI,UAAU;AAC3B,SAAO,QAAQ,MAAM;AACnB,UAAM,WAAW,eAAe,YAAY,IAAI;AAChD,WAAO,aAAa,OAAO,SAAY,MAAM,QAAQ;AAAA,EACvD,GAAG,CAAC,YAAY,OAAO,IAAI,CAAC;AAC9B;AAKO,MAAM,kBAAkB,MAA2C;AACxE,QAAM,QAAQ,iBAAoB;AAClC,QAAM,EAAE,MAAM,OAAO,OAAO,IAAI,UAAU;AAC1C,SAAO,QAAQ,MAAM;AACnB,QAAI,SAAS,QAAQ,UAAU,KAAM,QAAO;AAC5C,UAAM,WAAW,eAAe,OAAO,IAAI;AAC3C,UAAM,OAAO,aAAa,OAAO,SAAY,MAAM,QAAQ;AAC3D,QAAI,SAAS,OAAW,QAAO;AAC/B,WAAO,EAAE,MAAM,OAAO,MAAM,OAAO,KAAK,GAAG,KAAgB;AAAA,EAC7D,GAAG,CAAC,OAAO,MAAM,OAAO,MAAM,CAAC;AACjC;","names":[]}

package/dist/index.cjs

@@ -32,6 +32,7 @@ var import_SafeInclude = require("./components/SafeInclude");
 __reExport(index_exports, require("./sourceCache"), module.exports);
 __reExport(index_exports, require("./components/MDXComponents"), module.exports);
 __reExport(index_exports, require("./linkSpace"), module.exports);
+__reExport(index_exports, require("./corpus"), module.exports);
 __reExport(index_exports, require("./components/MountImage"), module.exports);
 __reExport(index_exports, require("./components/Routes"), module.exports);
 __reExport(index_exports, require("./hooks"), module.exports);
@@ -45,6 +46,7 @@ __reExport(index_exports, require("./formFactor"), module.exports);
 __reExport(index_exports, require("./hostAttention"), module.exports);
 __reExport(index_exports, require("./region"), module.exports);
 __reExport(index_exports, require("./mounts"), module.exports);
+__reExport(index_exports, require("./analytics"), module.exports);
 __reExport(index_exports, require("./contribute"), module.exports);
 __reExport(index_exports, require("./catalog"), module.exports);
 __reExport(index_exports, require("./ipc"), module.exports);
@@ -79,6 +81,7 @@ __reExport(index_exports, require("./safeContent"), module.exports);
   ...require("./sourceCache"),
   ...require("./components/MDXComponents"),
   ...require("./linkSpace"),
+  ...require("./corpus"),
   ...require("./components/MountImage"),
   ...require("./components/Routes"),
   ...require("./hooks"),
@@ -91,6 +94,7 @@ __reExport(index_exports, require("./safeContent"), module.exports);
   ...require("./hostAttention"),
   ...require("./region"),
   ...require("./mounts"),
+  ...require("./analytics"),
   ...require("./contribute"),
   ...require("./catalog"),
   ...require("./ipc"),

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,oCAZd;AAaA,0BAAc,gCAbd;AAcA,0BAAc,oBAdd;AAiBA,0BAAc,6BAjBd;AAoBA,6BAAwE;AACxE,0BAAc,mBArBd;AAsBA,0BAAc,oBAtBd;AAuBA,0BAAc,4BAvBd;AAwBA,0BAAc,qBAxBd;AAyBA,0BAAc,yBAzBd;AA0BA,0BAAc,4BA1Bd;AA2BA,0BAAc,qBA3Bd;AA4BA,0BAAc,qBA5Bd;AA6BA,0BAAc,yBA7Bd;AA8BA,0BAAc,sBA9Bd;AA+BA,0BAAc,kBA/Bd;AAgCA,0BAAc,kBAhCd;AAiCA,0BAAc,uBAjCd;AAkCA,0BAAc,sBAlCd;AAmCA,0BAAc,kBAnCd;AAoCA,0BAAc,0BApCd;AAqCA,0BAAc,kBArCd;AAsCA,0BAAc,yBAtCd;AAuCA,0BAAc,iBAvCd;AAwCA,0BAAc,oBAxCd;AAyCA,0BAAc,oBAzCd;AA0CA,0BAAc,qBA1Cd;AA2CA,0BAAc,sBA3Cd;AA4CA,0BAAc,wBA5Cd;AA6CA,0BAAc,oBA7Cd;AA8CA,0BAAc,sBA9Cd;AA+CA,0BAAc,6BA/Cd;AAgDA,0BAAc,+BAhDd;AAiDA,0BAAc,2BAjDd;AAkDA,0BAAc,0BAlDd;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,qBAZd;AAaA,0BAAc,oCAbd;AAcA,0BAAc,gCAdd;AAeA,0BAAc,oBAfd;AAkBA,0BAAc,6BAlBd;AAqBA,6BAAwE;AACxE,0BAAc,mBAtBd;AAuBA,0BAAc,oBAvBd;AAwBA,0BAAc,4BAxBd;AAyBA,0BAAc,qBAzBd;AA0BA,0BAAc,yBA1Bd;AA2BA,0BAAc,4BA3Bd;AA4BA,0BAAc,qBA5Bd;AA6BA,0BAAc,qBA7Bd;AA8BA,0BAAc,wBA9Bd;AA+BA,0BAAc,yBA/Bd;AAgCA,0BAAc,sBAhCd;AAiCA,0BAAc,kBAjCd;AAkCA,0BAAc,kBAlCd;AAmCA,0BAAc,uBAnCd;AAoCA,0BAAc,sBApCd;AAqCA,0BAAc,kBArCd;AAsCA,0BAAc,0BAtCd;AAuCA,0BAAc,kBAvCd;AAwCA,0BAAc,yBAxCd;AAyCA,0BAAc,iBAzCd;AA0CA,0BAAc,oBA1Cd;AA2CA,0BAAc,oBA3Cd;AA4CA,0BAAc,qBA5Cd;AA6CA,0BAAc,sBA7Cd;AA8CA,0BAAc,wBA9Cd;AA+CA,0BAAc,oBA/Cd;AAgDA,0BAAc,sBAhDd;AAiDA,0BAAc,6BAjDd;AAkDA,0BAAc,+BAlDd;AAmDA,0BAAc,2BAnDd;AAoDA,0BAAc,0BApDd;","names":[]}

package/dist/index.d.cts

@@ -6,6 +6,7 @@ export { SafeInclude } from './components/SafeInclude.cjs';
 export { SourceCache, SourceReader, createSourceCache } from './sourceCache.cjs';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.cjs';
 export { LinkSpaceContext } from './linkSpace.cjs';
+export { CorpusContext, CorpusEntry, CorpusScope, fromCorpusPath, toCorpusPath, useCorpus, useCorpusEntries, useCorpusEntry, useCurrentEntry } from './corpus.cjs';
 export { MountImage, MountImageProps } from './components/MountImage.cjs';
 export { Route, RouteProps, Routes } from './components/Routes.cjs';
 export { ObjectUrlState, useAllMetadata, useFileMetadata, useMetadataQuery, useObjectUrl } from './hooks.cjs';
@@ -19,6 +20,7 @@ export { FormFactor, FormFactorClass, Orientation, getFormFactor, onFormFactorCh
 export { HostAttention, HostAttentionKind, NO_HOST_ATTENTION, getHostAttention, onHostAttentionChange, useHostAttention } from './hostAttention.cjs';
 export { getRegion, useRegion } from './region.cjs';
 export { Invite, MountQuery, MountRemoveReason, MountRule, RemovedMount, SandboxMount, SessionMount, SpaceError, acceptInvite, awaitMatchingMount, createSpace, declineInvite, findMount, getAppMountPath, getInvites, getMounts, getSessionMounts, importSettingsFromParent, listMyInvites, listPendingInvites, listSettingsApps, makeContentRef, mount, mountSpace, onInvitesChange, onMountsChange, onSessionMountsChange, openSettings, openSettingsOf, requestMount, requestSpace, resolveContentRef, resolveContentRefs, revokeInvite, unmountSpace, useInvites, useMounts, useSessionMounts, waitForMount } from './mounts.cjs';
+export { AnalyticsAck, AnalyticsPropValue, emitAnalyticsEvent, recordRoute, track, trackRoute } from './analytics.cjs';
 export { ContributeMode, ContributeOptions, ContributionEvent, ContributionResult, contribute } from './contribute.cjs';
 export { ApiMethod, getCatalog, invoke, invokeStream, onCatalogChange, useCatalog } from './catalog.cjs';
 export { RegionMessage, onRegionMessage, postToRegion, revealRegion, useRegionMessage } from './ipc.cjs';

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export { SafeInclude } from './components/SafeInclude.js';
 export { SourceCache, SourceReader, createSourceCache } from './sourceCache.js';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.js';
 export { LinkSpaceContext } from './linkSpace.js';
+export { CorpusContext, CorpusEntry, CorpusScope, fromCorpusPath, toCorpusPath, useCorpus, useCorpusEntries, useCorpusEntry, useCurrentEntry } from './corpus.js';
 export { MountImage, MountImageProps } from './components/MountImage.js';
 export { Route, RouteProps, Routes } from './components/Routes.js';
 export { ObjectUrlState, useAllMetadata, useFileMetadata, useMetadataQuery, useObjectUrl } from './hooks.js';
@@ -19,6 +20,7 @@ export { FormFactor, FormFactorClass, Orientation, getFormFactor, onFormFactorCh
 export { HostAttention, HostAttentionKind, NO_HOST_ATTENTION, getHostAttention, onHostAttentionChange, useHostAttention } from './hostAttention.js';
 export { getRegion, useRegion } from './region.js';
 export { Invite, MountQuery, MountRemoveReason, MountRule, RemovedMount, SandboxMount, SessionMount, SpaceError, acceptInvite, awaitMatchingMount, createSpace, declineInvite, findMount, getAppMountPath, getInvites, getMounts, getSessionMounts, importSettingsFromParent, listMyInvites, listPendingInvites, listSettingsApps, makeContentRef, mount, mountSpace, onInvitesChange, onMountsChange, onSessionMountsChange, openSettings, openSettingsOf, requestMount, requestSpace, resolveContentRef, resolveContentRefs, revokeInvite, unmountSpace, useInvites, useMounts, useSessionMounts, waitForMount } from './mounts.js';
+export { AnalyticsAck, AnalyticsPropValue, emitAnalyticsEvent, recordRoute, track, trackRoute } from './analytics.js';
 export { ContributeMode, ContributeOptions, ContributionEvent, ContributionResult, contribute } from './contribute.js';
 export { ApiMethod, getCatalog, invoke, invokeStream, onCatalogChange, useCatalog } from './catalog.js';
 export { RegionMessage, onRegionMessage, postToRegion, revealRegion, useRegionMessage } from './ipc.js';

package/dist/index.js

@@ -7,6 +7,7 @@ import { SafeInclude } from "./components/SafeInclude";
 export * from "./sourceCache";
 export * from "./components/MDXComponents";
 export * from "./linkSpace";
+export * from "./corpus";
 export * from "./components/MountImage";
 export * from "./components/Routes";
 export * from "./hooks";
@@ -20,6 +21,7 @@ export * from "./formFactor";
 export * from "./hostAttention";
 export * from "./region";
 export * from "./mounts";
+export * from "./analytics";
 export * from "./contribute";
 export * from "./catalog";
 export * from "./ipc";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AAGd,SAAS,4BAA4B,mCAAmC;AACxE,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AAGd,SAAS,4BAA4B,mCAAmC;AACxE,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}

package/dist/protocolSchemes.cjs

@@ -25,6 +25,7 @@ var import_protocol = require("./generated/protocol");
 const PREFIX = "protocol-";
 const schemeOf = (name) => name.slice(PREFIX.length);
 const SCHEMES = {
+  [import_protocol.PROTOCOL_ANALYTICS]: schemeOf(import_protocol.PROTOCOL_ANALYTICS),
   [import_protocol.PROTOCOL_CONTRIBUTE]: schemeOf(import_protocol.PROTOCOL_CONTRIBUTE),
   [import_protocol.PROTOCOL_DND]: schemeOf(import_protocol.PROTOCOL_DND),
   [import_protocol.PROTOCOL_EDITOR]: schemeOf(import_protocol.PROTOCOL_EDITOR),

package/dist/protocolSchemes.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA2BA,sBAcO;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,mCAAmB,GAAG,SAAS,mCAAmB;AAAA,EACnD,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,gCAAgB,GAAG,SAAS,gCAAgB;AAAA,EAC7C,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AACvC;","names":[]}
+{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_ANALYTICS,\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA2BA,sBAeO;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,kCAAkB,GAAG,SAAS,kCAAkB;AAAA,EACjD,CAAC,mCAAmB,GAAG,SAAS,mCAAmB;AAAA,EACnD,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,gCAAgB,GAAG,SAAS,gCAAgB;AAAA,EAC7C,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AACvC;","names":[]}

package/dist/protocolSchemes.d.cts

@@ -1,5 +1,6 @@
 /** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */
 declare const SCHEMES: {
+    readonly "protocol-analytics": "analytics";
     readonly "protocol-contribute": "contribute";
     readonly "protocol-dnd": "dnd";
     readonly "protocol-editor": "editor";

package/dist/protocolSchemes.d.ts

@@ -1,5 +1,6 @@
 /** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */
 declare const SCHEMES: {
+    readonly "protocol-analytics": "analytics";
     readonly "protocol-contribute": "contribute";
     readonly "protocol-dnd": "dnd";
     readonly "protocol-editor": "editor";

package/dist/protocolSchemes.js

@@ -1,5 +1,6 @@
 import "./chunk-VHAA22YE.js";
 import {
+  PROTOCOL_ANALYTICS,
   PROTOCOL_CONTRIBUTE,
   PROTOCOL_DND,
   PROTOCOL_EDITOR,
@@ -17,6 +18,7 @@ import {
 const PREFIX = "protocol-";
 const schemeOf = (name) => name.slice(PREFIX.length);
 const SCHEMES = {
+  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),
   [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),
   [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),
   [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),

package/dist/protocolSchemes.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";AA2BA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,mBAAmB,GAAG,SAAS,mBAAmB;AAAA,EACnD,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,cAAc,GAAG,SAAS,cAAc;AAAA,EACzC,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,gBAAgB,GAAG,SAAS,gBAAgB;AAAA,EAC7C,CAAC,iBAAiB,GAAG,SAAS,iBAAiB;AAAA,EAC/C,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,aAAa,GAAG,SAAS,aAAa;AAAA,EACvC,CAAC,cAAc,GAAG,SAAS,cAAc;AAAA,EACzC,CAAC,YAAY,GAAG,SAAS,YAAY;AACvC;","names":[]}
+{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_ANALYTICS,\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";AA2BA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,kBAAkB,GAAG,SAAS,kBAAkB;AAAA,EACjD,CAAC,mBAAmB,GAAG,SAAS,mBAAmB;AAAA,EACnD,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,cAAc,GAAG,SAAS,cAAc;AAAA,EACzC,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,gBAAgB,GAAG,SAAS,gBAAgB;AAAA,EAC7C,CAAC,iBAAiB,GAAG,SAAS,iBAAiB;AAAA,EAC/C,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,aAAa,GAAG,SAAS,aAAa;AAAA,EACvC,CAAC,cAAc,GAAG,SAAS,cAAc;AAAA,EACzC,CAAC,YAAY,GAAG,SAAS,YAAY;AACvC;","names":[]}

package/dist/version.cjs

@@ -21,7 +21,7 @@ __export(version_exports, {
   SDK_VERSION: () => SDK_VERSION
 });
 module.exports = __toCommonJS(version_exports);
-const SDK_VERSION = "0.51.0";
+const SDK_VERSION = "0.52.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SDK_VERSION

package/dist/version.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.51.0';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,MAAM,cAAc;","names":[]}
+{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.52.0';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,MAAM,cAAc;","names":[]}

package/dist/version.d.cts

@@ -1,4 +1,4 @@
 /** This SDK's package version, baked from package.json at build (SP2-6). */
-declare const SDK_VERSION = "0.51.0";
+declare const SDK_VERSION = "0.52.0";
 
 export { SDK_VERSION };

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 /** This SDK's package version, baked from package.json at build (SP2-6). */
-declare const SDK_VERSION = "0.51.0";
+declare const SDK_VERSION = "0.52.0";
 
 export { SDK_VERSION };

package/dist/version.js

@@ -1,5 +1,5 @@
 import "./chunk-VHAA22YE.js";
-const SDK_VERSION = "0.51.0";
+const SDK_VERSION = "0.52.0";
 export {
   SDK_VERSION
 };

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.51.0';\n"],"mappings":";AAIO,MAAM,cAAc;","names":[]}
+{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.52.0';\n"],"mappings":";AAIO,MAAM,cAAc;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immediately-run/sdk",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "Runtime SDK for code executing inside an immediately.run sandbox.",
   "license": "MIT",
   "repository": "github:immediately-run/immediately-run-sdk",
@@ -58,7 +58,7 @@
   },
   "dependencies": {
     "@immediately-run/platform-constants": "0.2.0",
-    "@immediately-run/sandbox-protocol": "0.4.0",
+    "@immediately-run/sandbox-protocol": "0.5.0",
     "react-error-boundary": "^6.0.0",
     "@immediately-run/safe-content": "0.1.0",
     "@immediately-run/mdx-plugins": "0.5.0"