@immediately-run/sdk 0.52.0 → 0.54.0

package/README.md

@@ -73,6 +73,36 @@ check against the committed snapshot). Run it before pushing; it is the same set
 checks CI enforces, so a local green equals a green CI. (Ways of working §4: the local
 verify gate must equal the deploy gate — one `npm run verify` per repo.)
 
+### The API-stability gate (`api:check`)
+
+A pinned or forked app rides one SDK version forever, so the public API is
+**additive-only** (SDK_PACKAGING_SPEC §9). `api-snapshot.json` records the **shape**
+of every export — not just its name — and `npm run api:check` fails when that shape
+shrinks:
+
+| Recorded as | Example |
+|---|---|
+| `interface(a, b?, c(1..2))` | members, sorted; `?` = optional; `(required..total)` = a callable member's arity |
+| `object(…)` / `class(…)` / `enum(…)` | same member vocabulary |
+| `union(a\|b\|c)` | a type alias's union members, normalised + sorted |
+| `fn(1..2)` | a function's `required..total` parameter arity |
+| `const(T)` / `alias(T)` | the normalised type text |
+
+So removing an export, dropping an interface field, flipping a field's optionality,
+dropping a union member, or dropping a function parameter all fail — each of them
+breaks a pinned consumer at compile time, and each of them passed the pre-R3-261
+names-only check. Member and parameter **types** are deliberately not compared; see
+the "Deliberate limit" note in [`scripts/lib/dts-shape.mjs`](./scripts/lib/dts-shape.mjs).
+
+- **Additive change** (a new export, a new optional field): run `npm run api:update`
+  and commit the snapshot, so every API change lands in a reviewed diff.
+- **Deliberate removal**: add an entry to [`api-removals.json`](./api-removals.json)
+  with a **reason**, then `npm run api:update`. Without an entry the updater refuses
+  to write, so re-running it is not a way past the gate.
+- `npm run api:selftest` proves the gate can fail — it drives the real extractor over
+  crafted `.d.ts` fixtures for each break above, checks that additive changes are
+  *not* reported as breaking, and pins the two documented blind spots.
+
 ## License
 
 [MIT](./LICENSE)

package/dist/chromeState.cjs

@@ -0,0 +1,48 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var chromeState_exports = {};
+__export(chromeState_exports, {
+  getChromeState: () => getChromeState,
+  onChromeStateChange: () => onChromeStateChange,
+  useChromeState: () => useChromeState
+});
+module.exports = __toCommonJS(chromeState_exports);
+var import_pushChannel = require("./pushChannel");
+var import_protocol = require("./generated/protocol");
+const DEFAULT_CHROME_STATE = { overlay: "none", tab: { edge: "top-right" } };
+const isChromeState = (v) => {
+  const c = v;
+  return !!c && (c.overlay === "none" || c.overlay === "menu") && !!c.tab && typeof c.tab === "object" && c.tab.edge === "top-right";
+};
+const channel = (0, import_pushChannel.createPushChannel)({
+  pushType: import_protocol.CHROME_STATE,
+  requestType: import_protocol.REQUEST_CHROME_STATE,
+  initial: DEFAULT_CHROME_STATE,
+  parse: (msg) => isChromeState(msg.chromeState) ? msg.chromeState : void 0
+});
+const getChromeState = () => channel.get();
+const onChromeStateChange = (listener) => channel.onChange(listener);
+const useChromeState = () => channel.use();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getChromeState,
+  onChromeStateChange,
+  useChromeState
+});
+//# sourceMappingURL=chromeState.cjs.map

package/dist/chromeState.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/chromeState.ts"],"sourcesContent":["import { createPushChannel } from './pushChannel';\nimport { CHROME_STATE, REQUEST_CHROME_STATE } from './generated/protocol';\n\n/**\n * What the immediately.run host's own chrome is currently doing over your app\n * (PRESENT_MODE_CHROME_SPEC §6). In run (\"present\") mode the platform shows a\n * single pull-down tab in one corner; activating it opens the platform menu —\n * an anchored panel on desktop, a bottom sheet on mobile — and the host dims\n * and slightly insets your app behind it.\n *\n * Reading this is **entirely optional**. No platform behavior depends on your\n * app consuming it, and an app that never reads it behaves identically\n * (R-PMC-18) — the platform never requires immediately.run knowledge of an app\n * (product value 3). It exists for the two things a cooperative app can do\n * better with it than without:\n *\n * - **Pause while dimmed.** `overlay === 'menu'` means the user is looking at\n *   platform chrome, not at you: a good moment to pause a video, an animation,\n *   or a polling loop.\n * - **Keep the corner clear.** `tab.edge` says where the platform's tab sits, so\n *   a floating control of your own can avoid overlapping it.\n *\n * Baseline capability `chrome:read` — every app may read it. It is a read of the\n * host's own UI state and discloses nothing app-foreign; there is deliberately no\n * counterpart that lets an app *operate* platform chrome.\n *\n * ```ts\n * import { onChromeStateChange } from '@immediately-run/sdk';\n *\n * onChromeStateChange(({ overlay }) => {\n *   if (overlay === 'menu') video.pause();\n * });\n * ```\n */\nexport interface ChromeState {\n  /**\n   * `'menu'` while the platform menu / bottom sheet (and its scrim) is open over\n   * your app; `'none'` at rest. Edit mode reports `'none'` — the workbench chrome\n   * is beside your app, not over it.\n   */\n  overlay: 'none' | 'menu';\n  /** Where the platform's pull-down tab sits. Only one edge exists today. */\n  tab: { edge: 'top-right' };\n}\n\n/**\n * Assumed before the host reports — and the value that stands forever on a host\n * that never pushes this channel (an older host, or one that does not paint\n * present-mode chrome at all). \"Nothing is over you\" is the safe default: an app\n * that gates a pause on it simply never pauses.\n */\nconst DEFAULT_CHROME_STATE: ChromeState = { overlay: 'none', tab: { edge: 'top-right' } };\n\nconst isChromeState = (v: unknown): v is ChromeState => {\n  const c = v as Partial<ChromeState> | null;\n  return (\n    !!c &&\n    (c.overlay === 'none' || c.overlay === 'menu') &&\n    !!c.tab &&\n    typeof c.tab === 'object' &&\n    (c.tab as ChromeState['tab']).edge === 'top-right'\n  );\n};\n\n// Read over the transport (SDK_PACKAGING_SPEC §4): the host pushes `chrome-state`\n// and answers `request-chrome-state` (wire format: site-main channelBridge.ts).\nconst channel = createPushChannel<ChromeState>({\n  pushType: CHROME_STATE,\n  requestType: REQUEST_CHROME_STATE,\n  initial: DEFAULT_CHROME_STATE,\n  parse: (msg) => (isChromeState(msg.chromeState) ? (msg.chromeState as ChromeState) : undefined),\n});\n\n/** Returns the current chrome state. Poll for a one-off read. */\nexport const getChromeState = (): ChromeState => channel.get();\n\n/**\n * Subscribe to chrome-state changes. The listener is invoked immediately with the\n * current value, then again on every change. Returns an unsubscribe fn.\n */\nexport const onChromeStateChange = (listener: (chromeState: ChromeState) => void): (() => void) =>\n  channel.onChange(listener);\n\n/** React hook returning the current chrome state, re-rendering on change. */\nexport const useChromeState = (): ChromeState => channel.use();\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAAkC;AAClC,sBAAmD;AAkDnD,MAAM,uBAAoC,EAAE,SAAS,QAAQ,KAAK,EAAE,MAAM,YAAY,EAAE;AAExF,MAAM,gBAAgB,CAAC,MAAiC;AACtD,QAAM,IAAI;AACV,SACE,CAAC,CAAC,MACD,EAAE,YAAY,UAAU,EAAE,YAAY,WACvC,CAAC,CAAC,EAAE,OACJ,OAAO,EAAE,QAAQ,YAChB,EAAE,IAA2B,SAAS;AAE3C;AAIA,MAAM,cAAU,sCAA+B;AAAA,EAC7C,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS;AAAA,EACT,OAAO,CAAC,QAAS,cAAc,IAAI,WAAW,IAAK,IAAI,cAA8B;AACvF,CAAC;AAGM,MAAM,iBAAiB,MAAmB,QAAQ,IAAI;AAMtD,MAAM,sBAAsB,CAAC,aAClC,QAAQ,SAAS,QAAQ;AAGpB,MAAM,iBAAiB,MAAmB,QAAQ,IAAI;","names":[]}

package/dist/chromeState.d.cts

@@ -0,0 +1,54 @@
+/**
+ * What the immediately.run host's own chrome is currently doing over your app
+ * (PRESENT_MODE_CHROME_SPEC §6). In run ("present") mode the platform shows a
+ * single pull-down tab in one corner; activating it opens the platform menu —
+ * an anchored panel on desktop, a bottom sheet on mobile — and the host dims
+ * and slightly insets your app behind it.
+ *
+ * Reading this is **entirely optional**. No platform behavior depends on your
+ * app consuming it, and an app that never reads it behaves identically
+ * (R-PMC-18) — the platform never requires immediately.run knowledge of an app
+ * (product value 3). It exists for the two things a cooperative app can do
+ * better with it than without:
+ *
+ * - **Pause while dimmed.** `overlay === 'menu'` means the user is looking at
+ *   platform chrome, not at you: a good moment to pause a video, an animation,
+ *   or a polling loop.
+ * - **Keep the corner clear.** `tab.edge` says where the platform's tab sits, so
+ *   a floating control of your own can avoid overlapping it.
+ *
+ * Baseline capability `chrome:read` — every app may read it. It is a read of the
+ * host's own UI state and discloses nothing app-foreign; there is deliberately no
+ * counterpart that lets an app *operate* platform chrome.
+ *
+ * ```ts
+ * import { onChromeStateChange } from '@immediately-run/sdk';
+ *
+ * onChromeStateChange(({ overlay }) => {
+ *   if (overlay === 'menu') video.pause();
+ * });
+ * ```
+ */
+interface ChromeState {
+    /**
+     * `'menu'` while the platform menu / bottom sheet (and its scrim) is open over
+     * your app; `'none'` at rest. Edit mode reports `'none'` — the workbench chrome
+     * is beside your app, not over it.
+     */
+    overlay: 'none' | 'menu';
+    /** Where the platform's pull-down tab sits. Only one edge exists today. */
+    tab: {
+        edge: 'top-right';
+    };
+}
+/** Returns the current chrome state. Poll for a one-off read. */
+declare const getChromeState: () => ChromeState;
+/**
+ * Subscribe to chrome-state changes. The listener is invoked immediately with the
+ * current value, then again on every change. Returns an unsubscribe fn.
+ */
+declare const onChromeStateChange: (listener: (chromeState: ChromeState) => void) => (() => void);
+/** React hook returning the current chrome state, re-rendering on change. */
+declare const useChromeState: () => ChromeState;
+
+export { type ChromeState, getChromeState, onChromeStateChange, useChromeState };

package/dist/chromeState.d.ts

@@ -0,0 +1,54 @@
+/**
+ * What the immediately.run host's own chrome is currently doing over your app
+ * (PRESENT_MODE_CHROME_SPEC §6). In run ("present") mode the platform shows a
+ * single pull-down tab in one corner; activating it opens the platform menu —
+ * an anchored panel on desktop, a bottom sheet on mobile — and the host dims
+ * and slightly insets your app behind it.
+ *
+ * Reading this is **entirely optional**. No platform behavior depends on your
+ * app consuming it, and an app that never reads it behaves identically
+ * (R-PMC-18) — the platform never requires immediately.run knowledge of an app
+ * (product value 3). It exists for the two things a cooperative app can do
+ * better with it than without:
+ *
+ * - **Pause while dimmed.** `overlay === 'menu'` means the user is looking at
+ *   platform chrome, not at you: a good moment to pause a video, an animation,
+ *   or a polling loop.
+ * - **Keep the corner clear.** `tab.edge` says where the platform's tab sits, so
+ *   a floating control of your own can avoid overlapping it.
+ *
+ * Baseline capability `chrome:read` — every app may read it. It is a read of the
+ * host's own UI state and discloses nothing app-foreign; there is deliberately no
+ * counterpart that lets an app *operate* platform chrome.
+ *
+ * ```ts
+ * import { onChromeStateChange } from '@immediately-run/sdk';
+ *
+ * onChromeStateChange(({ overlay }) => {
+ *   if (overlay === 'menu') video.pause();
+ * });
+ * ```
+ */
+interface ChromeState {
+    /**
+     * `'menu'` while the platform menu / bottom sheet (and its scrim) is open over
+     * your app; `'none'` at rest. Edit mode reports `'none'` — the workbench chrome
+     * is beside your app, not over it.
+     */
+    overlay: 'none' | 'menu';
+    /** Where the platform's pull-down tab sits. Only one edge exists today. */
+    tab: {
+        edge: 'top-right';
+    };
+}
+/** Returns the current chrome state. Poll for a one-off read. */
+declare const getChromeState: () => ChromeState;
+/**
+ * Subscribe to chrome-state changes. The listener is invoked immediately with the
+ * current value, then again on every change. Returns an unsubscribe fn.
+ */
+declare const onChromeStateChange: (listener: (chromeState: ChromeState) => void) => (() => void);
+/** React hook returning the current chrome state, re-rendering on change. */
+declare const useChromeState: () => ChromeState;
+
+export { type ChromeState, getChromeState, onChromeStateChange, useChromeState };

package/dist/chromeState.js

@@ -0,0 +1,23 @@
+import "./chunk-VHAA22YE.js";
+import { createPushChannel } from "./pushChannel";
+import { CHROME_STATE, REQUEST_CHROME_STATE } from "./generated/protocol";
+const DEFAULT_CHROME_STATE = { overlay: "none", tab: { edge: "top-right" } };
+const isChromeState = (v) => {
+  const c = v;
+  return !!c && (c.overlay === "none" || c.overlay === "menu") && !!c.tab && typeof c.tab === "object" && c.tab.edge === "top-right";
+};
+const channel = createPushChannel({
+  pushType: CHROME_STATE,
+  requestType: REQUEST_CHROME_STATE,
+  initial: DEFAULT_CHROME_STATE,
+  parse: (msg) => isChromeState(msg.chromeState) ? msg.chromeState : void 0
+});
+const getChromeState = () => channel.get();
+const onChromeStateChange = (listener) => channel.onChange(listener);
+const useChromeState = () => channel.use();
+export {
+  getChromeState,
+  onChromeStateChange,
+  useChromeState
+};
+//# sourceMappingURL=chromeState.js.map

package/dist/chromeState.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/chromeState.ts"],"sourcesContent":["import { createPushChannel } from './pushChannel';\nimport { CHROME_STATE, REQUEST_CHROME_STATE } from './generated/protocol';\n\n/**\n * What the immediately.run host's own chrome is currently doing over your app\n * (PRESENT_MODE_CHROME_SPEC §6). In run (\"present\") mode the platform shows a\n * single pull-down tab in one corner; activating it opens the platform menu —\n * an anchored panel on desktop, a bottom sheet on mobile — and the host dims\n * and slightly insets your app behind it.\n *\n * Reading this is **entirely optional**. No platform behavior depends on your\n * app consuming it, and an app that never reads it behaves identically\n * (R-PMC-18) — the platform never requires immediately.run knowledge of an app\n * (product value 3). It exists for the two things a cooperative app can do\n * better with it than without:\n *\n * - **Pause while dimmed.** `overlay === 'menu'` means the user is looking at\n *   platform chrome, not at you: a good moment to pause a video, an animation,\n *   or a polling loop.\n * - **Keep the corner clear.** `tab.edge` says where the platform's tab sits, so\n *   a floating control of your own can avoid overlapping it.\n *\n * Baseline capability `chrome:read` — every app may read it. It is a read of the\n * host's own UI state and discloses nothing app-foreign; there is deliberately no\n * counterpart that lets an app *operate* platform chrome.\n *\n * ```ts\n * import { onChromeStateChange } from '@immediately-run/sdk';\n *\n * onChromeStateChange(({ overlay }) => {\n *   if (overlay === 'menu') video.pause();\n * });\n * ```\n */\nexport interface ChromeState {\n  /**\n   * `'menu'` while the platform menu / bottom sheet (and its scrim) is open over\n   * your app; `'none'` at rest. Edit mode reports `'none'` — the workbench chrome\n   * is beside your app, not over it.\n   */\n  overlay: 'none' | 'menu';\n  /** Where the platform's pull-down tab sits. Only one edge exists today. */\n  tab: { edge: 'top-right' };\n}\n\n/**\n * Assumed before the host reports — and the value that stands forever on a host\n * that never pushes this channel (an older host, or one that does not paint\n * present-mode chrome at all). \"Nothing is over you\" is the safe default: an app\n * that gates a pause on it simply never pauses.\n */\nconst DEFAULT_CHROME_STATE: ChromeState = { overlay: 'none', tab: { edge: 'top-right' } };\n\nconst isChromeState = (v: unknown): v is ChromeState => {\n  const c = v as Partial<ChromeState> | null;\n  return (\n    !!c &&\n    (c.overlay === 'none' || c.overlay === 'menu') &&\n    !!c.tab &&\n    typeof c.tab === 'object' &&\n    (c.tab as ChromeState['tab']).edge === 'top-right'\n  );\n};\n\n// Read over the transport (SDK_PACKAGING_SPEC §4): the host pushes `chrome-state`\n// and answers `request-chrome-state` (wire format: site-main channelBridge.ts).\nconst channel = createPushChannel<ChromeState>({\n  pushType: CHROME_STATE,\n  requestType: REQUEST_CHROME_STATE,\n  initial: DEFAULT_CHROME_STATE,\n  parse: (msg) => (isChromeState(msg.chromeState) ? (msg.chromeState as ChromeState) : undefined),\n});\n\n/** Returns the current chrome state. Poll for a one-off read. */\nexport const getChromeState = (): ChromeState => channel.get();\n\n/**\n * Subscribe to chrome-state changes. The listener is invoked immediately with the\n * current value, then again on every change. Returns an unsubscribe fn.\n */\nexport const onChromeStateChange = (listener: (chromeState: ChromeState) => void): (() => void) =>\n  channel.onChange(listener);\n\n/** React hook returning the current chrome state, re-rendering on change. */\nexport const useChromeState = (): ChromeState => channel.use();\n"],"mappings":";AAAA,SAAS,yBAAyB;AAClC,SAAS,cAAc,4BAA4B;AAkDnD,MAAM,uBAAoC,EAAE,SAAS,QAAQ,KAAK,EAAE,MAAM,YAAY,EAAE;AAExF,MAAM,gBAAgB,CAAC,MAAiC;AACtD,QAAM,IAAI;AACV,SACE,CAAC,CAAC,MACD,EAAE,YAAY,UAAU,EAAE,YAAY,WACvC,CAAC,CAAC,EAAE,OACJ,OAAO,EAAE,QAAQ,YAChB,EAAE,IAA2B,SAAS;AAE3C;AAIA,MAAM,UAAU,kBAA+B;AAAA,EAC7C,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS;AAAA,EACT,OAAO,CAAC,QAAS,cAAc,IAAI,WAAW,IAAK,IAAI,cAA8B;AACvF,CAAC;AAGM,MAAM,iBAAiB,MAAmB,QAAQ,IAAI;AAMtD,MAAM,sBAAsB,CAAC,aAClC,QAAQ,SAAS,QAAQ;AAGpB,MAAM,iBAAiB,MAAmB,QAAQ,IAAI;","names":[]}

package/dist/feed.cjs

@@ -0,0 +1,40 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var feed_exports = {};
+__export(feed_exports, {
+  feedFetch: () => feedFetch
+});
+module.exports = __toCommonJS(feed_exports);
+var import_sandboxUtils = require("./sandboxUtils");
+var import_protocolSchemes = require("./protocolSchemes");
+var import_protocol = require("./generated/protocol");
+const feedFetch = async (instanceId, params = {}) => {
+  const res = await (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_FEED], "fetch", [{ instanceId, params }]);
+  if (!res || res.ok !== true) {
+    const err = new Error(res?.message ?? "feedFetch failed");
+    err.code = (res && "code" in res ? res.code : void 0) ?? "unknown";
+    throw err;
+  }
+  return res.data;
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  feedFetch
+});
+//# sourceMappingURL=feed.cjs.map

package/dist/feed.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/feed.ts"],"sourcesContent":["// feedFetch — the connector's egress, and the difference between it and `hostFetch`\n// is the whole of D2 (`reckoner/docs/specs/CONNECTOR_EGRESS_FIXING_SPEC.md` §2).\n//\n// `hostFetch(url, init)` takes a URL. The host checks it against your effective\n// allowlist, but *within* that allowlist your app picks which host, which path and\n// what body, on every call. That is fine for an app whose logic you control.\n//\n// It is not fine for a **connector** — an app whose job is to pump bytes from a feed\n// into a document, where the bytes it fetched are, in effect, a program steering it\n// (`REPORTING_SPREADSHEET §3.2` RB-1). An allowlist bounds the host *set*; it does\n// nothing about per-call choice inside that set, and nothing at all about the body.\n//\n// So `feedFetch` does not take a URL. It takes a **feed-instance id** and a typed\n// **param object**, and the host constructs the request from a template it compiled,\n// at grant time, from your app's trusted feed configuration. Your code cannot name a\n// target, so content your code just read cannot name one either.\n//\n// What that means in practice when you write a connector:\n//\n//   • the origin, path and method come from your manifest's `feed:fetch` config —\n//     not from this call, and not from anything you fetched;\n//   • `params` fill only the slots the template declared, and each is typed\n//     (an ISO-8601 instant, a bounded integer, or one of a declared enum). A value\n//     that is not what the slot declared is rejected — including, incidentally,\n//     anything URL-shaped;\n//   • **pagination is not yours.** The host mints the cursor, keeps it, and spends it;\n//     you neither supply nor receive one. A cursor you round-tripped would be either\n//     bytes you authored or a function of bytes you fetched, and both are exactly what\n//     this surface exists to prevent;\n//   • a `POST`/body feed's body comes from the template too. There is no parameter\n//     that carries body bytes.\n//\n// Hold `feed:fetch` **instead of** `net:fetch`, not alongside it. An app holding\n// `net:fetch` has the URL surface back regardless of any template it was also given,\n// which is why they are two capabilities and not one with a flag.\n\nimport { protocolRequest } from './sandboxUtils';\nimport { SCHEMES } from './protocolSchemes';\nimport { PROTOCOL_FEED } from './generated/protocol';\n\n/** Values a feed template's declared slots accept. The host validates each against\n *  the slot's declared type; anything else is `invalid-params`. */\nexport type FeedParams = Record<string, string | number>;\n\n/** The serialized response from {@link feedFetch} — the same shape `hostFetch`\n *  returns, because reading a feed should feel like reading a fetch. The difference\n *  is entirely in what you may ASK for. */\nexport interface FeedFetchResponse {\n  status: number;\n  statusText: string;\n  headers: Record<string, string>;\n  body: string;\n  /** True if the body hit the host's size cap and was truncated. */\n  truncated: boolean;\n}\n\n/**\n * Fire one of your app's configured feeds through the host.\n *\n * ```ts\n * // `instanceId` comes from the host when the feed is launched — it is opaque,\n * // host-minted, and bound to your app; you never construct one.\n * const res = await feedFetch(instanceId, { since: '2026-08-01T00:00:00Z' });\n * const rows = JSON.parse(res.body);\n * ```\n *\n * A reachable server's reply — including a non-2xx status — RESOLVES; inspect\n * `.status`. Everything else REJECTS with an {@link Error} carrying a machine `.code`:\n *\n * - `forbidden` — you do not hold `feed:fetch`, or `instanceId` is not one of yours.\n *   **The two are deliberately indistinguishable**, so this is not an oracle for which\n *   feeds exist.\n * - `invalid-params` — a param the template does not declare, a value that is not what\n *   its slot declared, or a body that would exceed the template's cap. Naming a cursor\n *   slot lands here too: the cursor is the host's, not a parameter.\n * - `budget` — this instance's request budget is spent. It bounds runaway loops; it is\n *   a tripwire, not containment.\n * - `unsupported` — the host's pinned egress path is unavailable. `feedFetch`\n *   deliberately has **no fallback**: the alternative path does no DNS resolution and no\n *   socket pinning, and silently downgrading a credentialed feed onto it is the hazard\n *   this whole mechanism removes. A connector that cannot use the pinned path does not\n *   fetch.\n * - `blocked` / `redirect` / `too-large` / `network` — the same server-side SSRF,\n *   per-hop redirect and size guards every proxied fetch meets.\n */\n// The parameter is spelled structurally rather than as `FeedParams`, deliberately: the\n// wire descriptor in `@immediately-run/sandbox-protocol` records the type that actually\n// crosses the boundary, and an SDK-local alias name in a CROSS-REPO wire contract would\n// describe this package rather than the protocol. `FeedParams` stays exported as the\n// name callers write.\nexport const feedFetch = async (\n  instanceId: string,\n  params: Record<string, string | number> = {},\n): Promise<FeedFetchResponse> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_FEED], 'fetch', [{ instanceId, params }])) as\n    | { ok: true; data: FeedFetchResponse }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'feedFetch failed') as Error & { code?: string };\n    err.code = (res && 'code' in res ? res.code : undefined) ?? 'unknown';\n    throw err;\n  }\n  return res.data;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAoCA,0BAAgC;AAChC,6BAAwB;AACxB,sBAA8B;AAoDvB,MAAM,YAAY,OACvB,YACA,SAA0C,CAAC,MACZ;AAC/B,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,6BAAa,GAAG,SAAS,CAAC,EAAE,YAAY,OAAO,CAAC,CAAC;AAI5F,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,kBAAkB;AACxD,QAAI,QAAQ,OAAO,UAAU,MAAM,IAAI,OAAO,WAAc;AAC5D,UAAM;AAAA,EACR;AACA,SAAO,IAAI;AACb;","names":[]}

package/dist/feed.d.cts

@@ -0,0 +1,46 @@
+/** Values a feed template's declared slots accept. The host validates each against
+ *  the slot's declared type; anything else is `invalid-params`. */
+type FeedParams = Record<string, string | number>;
+/** The serialized response from {@link feedFetch} — the same shape `hostFetch`
+ *  returns, because reading a feed should feel like reading a fetch. The difference
+ *  is entirely in what you may ASK for. */
+interface FeedFetchResponse {
+    status: number;
+    statusText: string;
+    headers: Record<string, string>;
+    body: string;
+    /** True if the body hit the host's size cap and was truncated. */
+    truncated: boolean;
+}
+/**
+ * Fire one of your app's configured feeds through the host.
+ *
+ * ```ts
+ * // `instanceId` comes from the host when the feed is launched — it is opaque,
+ * // host-minted, and bound to your app; you never construct one.
+ * const res = await feedFetch(instanceId, { since: '2026-08-01T00:00:00Z' });
+ * const rows = JSON.parse(res.body);
+ * ```
+ *
+ * A reachable server's reply — including a non-2xx status — RESOLVES; inspect
+ * `.status`. Everything else REJECTS with an {@link Error} carrying a machine `.code`:
+ *
+ * - `forbidden` — you do not hold `feed:fetch`, or `instanceId` is not one of yours.
+ *   **The two are deliberately indistinguishable**, so this is not an oracle for which
+ *   feeds exist.
+ * - `invalid-params` — a param the template does not declare, a value that is not what
+ *   its slot declared, or a body that would exceed the template's cap. Naming a cursor
+ *   slot lands here too: the cursor is the host's, not a parameter.
+ * - `budget` — this instance's request budget is spent. It bounds runaway loops; it is
+ *   a tripwire, not containment.
+ * - `unsupported` — the host's pinned egress path is unavailable. `feedFetch`
+ *   deliberately has **no fallback**: the alternative path does no DNS resolution and no
+ *   socket pinning, and silently downgrading a credentialed feed onto it is the hazard
+ *   this whole mechanism removes. A connector that cannot use the pinned path does not
+ *   fetch.
+ * - `blocked` / `redirect` / `too-large` / `network` — the same server-side SSRF,
+ *   per-hop redirect and size guards every proxied fetch meets.
+ */
+declare const feedFetch: (instanceId: string, params?: Record<string, string | number>) => Promise<FeedFetchResponse>;
+
+export { type FeedFetchResponse, type FeedParams, feedFetch };

package/dist/feed.d.ts

@@ -0,0 +1,46 @@
+/** Values a feed template's declared slots accept. The host validates each against
+ *  the slot's declared type; anything else is `invalid-params`. */
+type FeedParams = Record<string, string | number>;
+/** The serialized response from {@link feedFetch} — the same shape `hostFetch`
+ *  returns, because reading a feed should feel like reading a fetch. The difference
+ *  is entirely in what you may ASK for. */
+interface FeedFetchResponse {
+    status: number;
+    statusText: string;
+    headers: Record<string, string>;
+    body: string;
+    /** True if the body hit the host's size cap and was truncated. */
+    truncated: boolean;
+}
+/**
+ * Fire one of your app's configured feeds through the host.
+ *
+ * ```ts
+ * // `instanceId` comes from the host when the feed is launched — it is opaque,
+ * // host-minted, and bound to your app; you never construct one.
+ * const res = await feedFetch(instanceId, { since: '2026-08-01T00:00:00Z' });
+ * const rows = JSON.parse(res.body);
+ * ```
+ *
+ * A reachable server's reply — including a non-2xx status — RESOLVES; inspect
+ * `.status`. Everything else REJECTS with an {@link Error} carrying a machine `.code`:
+ *
+ * - `forbidden` — you do not hold `feed:fetch`, or `instanceId` is not one of yours.
+ *   **The two are deliberately indistinguishable**, so this is not an oracle for which
+ *   feeds exist.
+ * - `invalid-params` — a param the template does not declare, a value that is not what
+ *   its slot declared, or a body that would exceed the template's cap. Naming a cursor
+ *   slot lands here too: the cursor is the host's, not a parameter.
+ * - `budget` — this instance's request budget is spent. It bounds runaway loops; it is
+ *   a tripwire, not containment.
+ * - `unsupported` — the host's pinned egress path is unavailable. `feedFetch`
+ *   deliberately has **no fallback**: the alternative path does no DNS resolution and no
+ *   socket pinning, and silently downgrading a credentialed feed onto it is the hazard
+ *   this whole mechanism removes. A connector that cannot use the pinned path does not
+ *   fetch.
+ * - `blocked` / `redirect` / `too-large` / `network` — the same server-side SSRF,
+ *   per-hop redirect and size guards every proxied fetch meets.
+ */
+declare const feedFetch: (instanceId: string, params?: Record<string, string | number>) => Promise<FeedFetchResponse>;
+
+export { type FeedFetchResponse, type FeedParams, feedFetch };

package/dist/feed.js

@@ -0,0 +1,17 @@
+import "./chunk-VHAA22YE.js";
+import { protocolRequest } from "./sandboxUtils";
+import { SCHEMES } from "./protocolSchemes";
+import { PROTOCOL_FEED } from "./generated/protocol";
+const feedFetch = async (instanceId, params = {}) => {
+  const res = await protocolRequest(SCHEMES[PROTOCOL_FEED], "fetch", [{ instanceId, params }]);
+  if (!res || res.ok !== true) {
+    const err = new Error(res?.message ?? "feedFetch failed");
+    err.code = (res && "code" in res ? res.code : void 0) ?? "unknown";
+    throw err;
+  }
+  return res.data;
+};
+export {
+  feedFetch
+};
+//# sourceMappingURL=feed.js.map

package/dist/feed.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/feed.ts"],"sourcesContent":["// feedFetch — the connector's egress, and the difference between it and `hostFetch`\n// is the whole of D2 (`reckoner/docs/specs/CONNECTOR_EGRESS_FIXING_SPEC.md` §2).\n//\n// `hostFetch(url, init)` takes a URL. The host checks it against your effective\n// allowlist, but *within* that allowlist your app picks which host, which path and\n// what body, on every call. That is fine for an app whose logic you control.\n//\n// It is not fine for a **connector** — an app whose job is to pump bytes from a feed\n// into a document, where the bytes it fetched are, in effect, a program steering it\n// (`REPORTING_SPREADSHEET §3.2` RB-1). An allowlist bounds the host *set*; it does\n// nothing about per-call choice inside that set, and nothing at all about the body.\n//\n// So `feedFetch` does not take a URL. It takes a **feed-instance id** and a typed\n// **param object**, and the host constructs the request from a template it compiled,\n// at grant time, from your app's trusted feed configuration. Your code cannot name a\n// target, so content your code just read cannot name one either.\n//\n// What that means in practice when you write a connector:\n//\n//   • the origin, path and method come from your manifest's `feed:fetch` config —\n//     not from this call, and not from anything you fetched;\n//   • `params` fill only the slots the template declared, and each is typed\n//     (an ISO-8601 instant, a bounded integer, or one of a declared enum). A value\n//     that is not what the slot declared is rejected — including, incidentally,\n//     anything URL-shaped;\n//   • **pagination is not yours.** The host mints the cursor, keeps it, and spends it;\n//     you neither supply nor receive one. A cursor you round-tripped would be either\n//     bytes you authored or a function of bytes you fetched, and both are exactly what\n//     this surface exists to prevent;\n//   • a `POST`/body feed's body comes from the template too. There is no parameter\n//     that carries body bytes.\n//\n// Hold `feed:fetch` **instead of** `net:fetch`, not alongside it. An app holding\n// `net:fetch` has the URL surface back regardless of any template it was also given,\n// which is why they are two capabilities and not one with a flag.\n\nimport { protocolRequest } from './sandboxUtils';\nimport { SCHEMES } from './protocolSchemes';\nimport { PROTOCOL_FEED } from './generated/protocol';\n\n/** Values a feed template's declared slots accept. The host validates each against\n *  the slot's declared type; anything else is `invalid-params`. */\nexport type FeedParams = Record<string, string | number>;\n\n/** The serialized response from {@link feedFetch} — the same shape `hostFetch`\n *  returns, because reading a feed should feel like reading a fetch. The difference\n *  is entirely in what you may ASK for. */\nexport interface FeedFetchResponse {\n  status: number;\n  statusText: string;\n  headers: Record<string, string>;\n  body: string;\n  /** True if the body hit the host's size cap and was truncated. */\n  truncated: boolean;\n}\n\n/**\n * Fire one of your app's configured feeds through the host.\n *\n * ```ts\n * // `instanceId` comes from the host when the feed is launched — it is opaque,\n * // host-minted, and bound to your app; you never construct one.\n * const res = await feedFetch(instanceId, { since: '2026-08-01T00:00:00Z' });\n * const rows = JSON.parse(res.body);\n * ```\n *\n * A reachable server's reply — including a non-2xx status — RESOLVES; inspect\n * `.status`. Everything else REJECTS with an {@link Error} carrying a machine `.code`:\n *\n * - `forbidden` — you do not hold `feed:fetch`, or `instanceId` is not one of yours.\n *   **The two are deliberately indistinguishable**, so this is not an oracle for which\n *   feeds exist.\n * - `invalid-params` — a param the template does not declare, a value that is not what\n *   its slot declared, or a body that would exceed the template's cap. Naming a cursor\n *   slot lands here too: the cursor is the host's, not a parameter.\n * - `budget` — this instance's request budget is spent. It bounds runaway loops; it is\n *   a tripwire, not containment.\n * - `unsupported` — the host's pinned egress path is unavailable. `feedFetch`\n *   deliberately has **no fallback**: the alternative path does no DNS resolution and no\n *   socket pinning, and silently downgrading a credentialed feed onto it is the hazard\n *   this whole mechanism removes. A connector that cannot use the pinned path does not\n *   fetch.\n * - `blocked` / `redirect` / `too-large` / `network` — the same server-side SSRF,\n *   per-hop redirect and size guards every proxied fetch meets.\n */\n// The parameter is spelled structurally rather than as `FeedParams`, deliberately: the\n// wire descriptor in `@immediately-run/sandbox-protocol` records the type that actually\n// crosses the boundary, and an SDK-local alias name in a CROSS-REPO wire contract would\n// describe this package rather than the protocol. `FeedParams` stays exported as the\n// name callers write.\nexport const feedFetch = async (\n  instanceId: string,\n  params: Record<string, string | number> = {},\n): Promise<FeedFetchResponse> => {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_FEED], 'fetch', [{ instanceId, params }])) as\n    | { ok: true; data: FeedFetchResponse }\n    | { ok: false; code?: string; message?: string }\n    | undefined;\n  if (!res || res.ok !== true) {\n    const err = new Error(res?.message ?? 'feedFetch failed') as Error & { code?: string };\n    err.code = (res && 'code' in res ? res.code : undefined) ?? 'unknown';\n    throw err;\n  }\n  return res.data;\n};\n"],"mappings":";AAoCA,SAAS,uBAAuB;AAChC,SAAS,eAAe;AACxB,SAAS,qBAAqB;AAoDvB,MAAM,YAAY,OACvB,YACA,SAA0C,CAAC,MACZ;AAC/B,QAAM,MAAO,MAAM,gBAAgB,QAAQ,aAAa,GAAG,SAAS,CAAC,EAAE,YAAY,OAAO,CAAC,CAAC;AAI5F,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI,MAAM,KAAK,WAAW,kBAAkB;AACxD,QAAI,QAAQ,OAAO,UAAU,MAAM,IAAI,OAAO,WAAc;AAC5D,UAAM;AAAA,EACR;AACA,SAAO,IAAI;AACb;","names":[]}

package/dist/index.cjs

@@ -43,6 +43,7 @@ __reExport(index_exports, require("./theme"), module.exports);
 __reExport(index_exports, require("./editorContext"), module.exports);
 __reExport(index_exports, require("./editor"), module.exports);
 __reExport(index_exports, require("./formFactor"), module.exports);
+__reExport(index_exports, require("./chromeState"), module.exports);
 __reExport(index_exports, require("./hostAttention"), module.exports);
 __reExport(index_exports, require("./region"), module.exports);
 __reExport(index_exports, require("./mounts"), module.exports);
@@ -52,6 +53,7 @@ __reExport(index_exports, require("./catalog"), module.exports);
 __reExport(index_exports, require("./ipc"), module.exports);
 __reExport(index_exports, require("./dnd"), module.exports);
 __reExport(index_exports, require("./netFetch"), module.exports);
+__reExport(index_exports, require("./feed"), module.exports);
 __reExport(index_exports, require("./secrets"), module.exports);
 __reExport(index_exports, require("./llm"), module.exports);
 __reExport(index_exports, require("./diagnostics"), module.exports);
@@ -91,6 +93,7 @@ __reExport(index_exports, require("./safeContent"), module.exports);
   ...require("./editorContext"),
   ...require("./editor"),
   ...require("./formFactor"),
+  ...require("./chromeState"),
   ...require("./hostAttention"),
   ...require("./region"),
   ...require("./mounts"),
@@ -100,6 +103,7 @@ __reExport(index_exports, require("./safeContent"), module.exports);
   ...require("./ipc"),
   ...require("./dnd"),
   ...require("./netFetch"),
+  ...require("./feed"),
   ...require("./secrets"),
   ...require("./llm"),
   ...require("./diagnostics"),

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,qBAZd;AAaA,0BAAc,oCAbd;AAcA,0BAAc,gCAdd;AAeA,0BAAc,oBAfd;AAkBA,0BAAc,6BAlBd;AAqBA,6BAAwE;AACxE,0BAAc,mBAtBd;AAuBA,0BAAc,oBAvBd;AAwBA,0BAAc,4BAxBd;AAyBA,0BAAc,qBAzBd;AA0BA,0BAAc,yBA1Bd;AA2BA,0BAAc,4BA3Bd;AA4BA,0BAAc,qBA5Bd;AA6BA,0BAAc,qBA7Bd;AA8BA,0BAAc,wBA9Bd;AA+BA,0BAAc,yBA/Bd;AAgCA,0BAAc,sBAhCd;AAiCA,0BAAc,kBAjCd;AAkCA,0BAAc,kBAlCd;AAmCA,0BAAc,uBAnCd;AAoCA,0BAAc,sBApCd;AAqCA,0BAAc,kBArCd;AAsCA,0BAAc,0BAtCd;AAuCA,0BAAc,kBAvCd;AAwCA,0BAAc,yBAxCd;AAyCA,0BAAc,iBAzCd;AA0CA,0BAAc,oBA1Cd;AA2CA,0BAAc,oBA3Cd;AA4CA,0BAAc,qBA5Cd;AA6CA,0BAAc,sBA7Cd;AA8CA,0BAAc,wBA9Cd;AA+CA,0BAAc,oBA/Cd;AAgDA,0BAAc,sBAhDd;AAiDA,0BAAc,6BAjDd;AAkDA,0BAAc,+BAlDd;AAmDA,0BAAc,2BAnDd;AAoDA,0BAAc,0BApDd;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,qBAZd;AAaA,0BAAc,oCAbd;AAcA,0BAAc,gCAdd;AAeA,0BAAc,oBAfd;AAkBA,0BAAc,6BAlBd;AAqBA,6BAAwE;AACxE,0BAAc,mBAtBd;AAuBA,0BAAc,oBAvBd;AAwBA,0BAAc,4BAxBd;AAyBA,0BAAc,qBAzBd;AA0BA,0BAAc,yBA1Bd;AA2BA,0BAAc,0BA3Bd;AA4BA,0BAAc,4BA5Bd;AA6BA,0BAAc,qBA7Bd;AA8BA,0BAAc,qBA9Bd;AA+BA,0BAAc,wBA/Bd;AAgCA,0BAAc,yBAhCd;AAiCA,0BAAc,sBAjCd;AAkCA,0BAAc,kBAlCd;AAmCA,0BAAc,kBAnCd;AAoCA,0BAAc,uBApCd;AAqCA,0BAAc,mBArCd;AAsCA,0BAAc,sBAtCd;AAuCA,0BAAc,kBAvCd;AAwCA,0BAAc,0BAxCd;AAyCA,0BAAc,kBAzCd;AA0CA,0BAAc,yBA1Cd;AA2CA,0BAAc,iBA3Cd;AA4CA,0BAAc,oBA5Cd;AA6CA,0BAAc,oBA7Cd;AA8CA,0BAAc,qBA9Cd;AA+CA,0BAAc,sBA/Cd;AAgDA,0BAAc,wBAhDd;AAiDA,0BAAc,oBAjDd;AAkDA,0BAAc,sBAlDd;AAmDA,0BAAc,6BAnDd;AAoDA,0BAAc,+BApDd;AAqDA,0BAAc,2BArDd;AAsDA,0BAAc,0BAtDd;","names":[]}

package/dist/index.d.cts

@@ -17,6 +17,7 @@ export { HostTheme, getHostTheme, onHostThemeChange, setHostTheme, useHostTheme
 export { EditorContext, getEditorContext, onEditorContextChange, useEditorContext } from './editorContext.cjs';
 export { EditTarget, EditorOpenError, EditorSessionError, EditorWriteError, RequestEditError, closeFile, createFile, createFolder, deleteEntry, openInEditor, renameEntry, requestEdit, setActiveFile, uploadFile } from './editor.cjs';
 export { FormFactor, FormFactorClass, Orientation, getFormFactor, onFormFactorChange, useFormFactor } from './formFactor.cjs';
+export { ChromeState, getChromeState, onChromeStateChange, useChromeState } from './chromeState.cjs';
 export { HostAttention, HostAttentionKind, NO_HOST_ATTENTION, getHostAttention, onHostAttentionChange, useHostAttention } from './hostAttention.cjs';
 export { getRegion, useRegion } from './region.cjs';
 export { Invite, MountQuery, MountRemoveReason, MountRule, RemovedMount, SandboxMount, SessionMount, SpaceError, acceptInvite, awaitMatchingMount, createSpace, declineInvite, findMount, getAppMountPath, getInvites, getMounts, getSessionMounts, importSettingsFromParent, listMyInvites, listPendingInvites, listSettingsApps, makeContentRef, mount, mountSpace, onInvitesChange, onMountsChange, onSessionMountsChange, openSettings, openSettingsOf, requestMount, requestSpace, resolveContentRef, resolveContentRefs, revokeInvite, unmountSpace, useInvites, useMounts, useSessionMounts, waitForMount } from './mounts.cjs';
@@ -26,6 +27,7 @@ export { ApiMethod, getCatalog, invoke, invokeStream, onCatalogChange, useCatalo
 export { RegionMessage, onRegionMessage, postToRegion, revealRegion, useRegionMessage } from './ipc.cjs';
 export { DraggableItem, DroppedItem, ItemDragError, cancelItemDrag, onItemDrop, startItemDrag, useDroppedItem } from './dnd.cjs';
 export { HostFetchInit, HostFetchResponse, HostFetchStreamEvent, HostFetchStreamResult, hostFetch, hostFetchStream } from './netFetch.cjs';
+export { FeedFetchResponse, FeedParams, feedFetch } from './feed.cjs';
 export { SecretError, SecretGrant, SecretHints, SecretQuery, SecretType, SecretView, getSecrets, onSecretsChange, requestAddSecret, requestSecret, revokeSecret, useSecrets } from './secrets.cjs';
 export { ChatDelta, ChatFeatures, ChatMessage, ChatProviderInfo, ChatProviderState, ChatRequest, ChatResult, ChatRole, ChatStopReason, ContentPart, ToolDef, chat, describeChat, describeChatState, normalizeProviderInfo, onChatProviderChange, onChatProviderStateChange, useChatProvider, useChatProviderState } from './llm.cjs';
 export { BuildError, ConsoleEntry, ConsoleLevel, Diagnostics, DiagnosticsProvenance, getDiagnostics, onDiagnosticsChange, useDiagnostics } from './diagnostics.cjs';

package/dist/index.d.ts

@@ -17,6 +17,7 @@ export { HostTheme, getHostTheme, onHostThemeChange, setHostTheme, useHostTheme
 export { EditorContext, getEditorContext, onEditorContextChange, useEditorContext } from './editorContext.js';
 export { EditTarget, EditorOpenError, EditorSessionError, EditorWriteError, RequestEditError, closeFile, createFile, createFolder, deleteEntry, openInEditor, renameEntry, requestEdit, setActiveFile, uploadFile } from './editor.js';
 export { FormFactor, FormFactorClass, Orientation, getFormFactor, onFormFactorChange, useFormFactor } from './formFactor.js';
+export { ChromeState, getChromeState, onChromeStateChange, useChromeState } from './chromeState.js';
 export { HostAttention, HostAttentionKind, NO_HOST_ATTENTION, getHostAttention, onHostAttentionChange, useHostAttention } from './hostAttention.js';
 export { getRegion, useRegion } from './region.js';
 export { Invite, MountQuery, MountRemoveReason, MountRule, RemovedMount, SandboxMount, SessionMount, SpaceError, acceptInvite, awaitMatchingMount, createSpace, declineInvite, findMount, getAppMountPath, getInvites, getMounts, getSessionMounts, importSettingsFromParent, listMyInvites, listPendingInvites, listSettingsApps, makeContentRef, mount, mountSpace, onInvitesChange, onMountsChange, onSessionMountsChange, openSettings, openSettingsOf, requestMount, requestSpace, resolveContentRef, resolveContentRefs, revokeInvite, unmountSpace, useInvites, useMounts, useSessionMounts, waitForMount } from './mounts.js';
@@ -26,6 +27,7 @@ export { ApiMethod, getCatalog, invoke, invokeStream, onCatalogChange, useCatalo
 export { RegionMessage, onRegionMessage, postToRegion, revealRegion, useRegionMessage } from './ipc.js';
 export { DraggableItem, DroppedItem, ItemDragError, cancelItemDrag, onItemDrop, startItemDrag, useDroppedItem } from './dnd.js';
 export { HostFetchInit, HostFetchResponse, HostFetchStreamEvent, HostFetchStreamResult, hostFetch, hostFetchStream } from './netFetch.js';
+export { FeedFetchResponse, FeedParams, feedFetch } from './feed.js';
 export { SecretError, SecretGrant, SecretHints, SecretQuery, SecretType, SecretView, getSecrets, onSecretsChange, requestAddSecret, requestSecret, revokeSecret, useSecrets } from './secrets.js';
 export { ChatDelta, ChatFeatures, ChatMessage, ChatProviderInfo, ChatProviderState, ChatRequest, ChatResult, ChatRole, ChatStopReason, ContentPart, ToolDef, chat, describeChat, describeChatState, normalizeProviderInfo, onChatProviderChange, onChatProviderStateChange, useChatProvider, useChatProviderState } from './llm.js';
 export { BuildError, ConsoleEntry, ConsoleLevel, Diagnostics, DiagnosticsProvenance, getDiagnostics, onDiagnosticsChange, useDiagnostics } from './diagnostics.js';

package/dist/index.js

@@ -18,6 +18,7 @@ export * from "./theme";
 export * from "./editorContext";
 export * from "./editor";
 export * from "./formFactor";
+export * from "./chromeState";
 export * from "./hostAttention";
 export * from "./region";
 export * from "./mounts";
@@ -27,6 +28,7 @@ export * from "./catalog";
 export * from "./ipc";
 export * from "./dnd";
 export * from "./netFetch";
+export * from "./feed";
 export * from "./secrets";
 export * from "./llm";
 export * from "./diagnostics";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AAGd,SAAS,4BAA4B,mCAAmC;AACxE,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AAGd,SAAS,4BAA4B,mCAAmC;AACxE,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}

package/dist/protocolSchemes.cjs

@@ -29,6 +29,7 @@ const SCHEMES = {
   [import_protocol.PROTOCOL_CONTRIBUTE]: schemeOf(import_protocol.PROTOCOL_CONTRIBUTE),
   [import_protocol.PROTOCOL_DND]: schemeOf(import_protocol.PROTOCOL_DND),
   [import_protocol.PROTOCOL_EDITOR]: schemeOf(import_protocol.PROTOCOL_EDITOR),
+  [import_protocol.PROTOCOL_FEED]: schemeOf(import_protocol.PROTOCOL_FEED),
   [import_protocol.PROTOCOL_FETCH]: schemeOf(import_protocol.PROTOCOL_FETCH),
   [import_protocol.PROTOCOL_IPC]: schemeOf(import_protocol.PROTOCOL_IPC),
   [import_protocol.PROTOCOL_LAUNCH]: schemeOf(import_protocol.PROTOCOL_LAUNCH),

package/dist/protocolSchemes.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_ANALYTICS,\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA2BA,sBAeO;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,kCAAkB,GAAG,SAAS,kCAAkB;AAAA,EACjD,CAAC,mCAAmB,GAAG,SAAS,mCAAmB;AAAA,EACnD,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,gCAAgB,GAAG,SAAS,gCAAgB;AAAA,EAC7C,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AACvC;","names":[]}
+{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_ANALYTICS,\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FEED,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FEED]: schemeOf(PROTOCOL_FEED),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA2BA,sBAgBO;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,kCAAkB,GAAG,SAAS,kCAAkB;AAAA,EACjD,CAAC,mCAAmB,GAAG,SAAS,mCAAmB;AAAA,EACnD,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,gCAAgB,GAAG,SAAS,gCAAgB;AAAA,EAC7C,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AACvC;","names":[]}

package/dist/protocolSchemes.d.cts

@@ -4,6 +4,7 @@ declare const SCHEMES: {
     readonly "protocol-contribute": "contribute";
     readonly "protocol-dnd": "dnd";
     readonly "protocol-editor": "editor";
+    readonly "protocol-feed": "feed";
     readonly "protocol-fetch": "fetch";
     readonly "protocol-ipc": "ipc";
     readonly "protocol-launch": "launch";

package/dist/protocolSchemes.d.ts

@@ -4,6 +4,7 @@ declare const SCHEMES: {
     readonly "protocol-contribute": "contribute";
     readonly "protocol-dnd": "dnd";
     readonly "protocol-editor": "editor";
+    readonly "protocol-feed": "feed";
     readonly "protocol-fetch": "fetch";
     readonly "protocol-ipc": "ipc";
     readonly "protocol-launch": "launch";

package/dist/protocolSchemes.js

@@ -4,6 +4,7 @@ import {
   PROTOCOL_CONTRIBUTE,
   PROTOCOL_DND,
   PROTOCOL_EDITOR,
+  PROTOCOL_FEED,
   PROTOCOL_FETCH,
   PROTOCOL_IPC,
   PROTOCOL_LAUNCH,
@@ -22,6 +23,7 @@ const SCHEMES = {
   [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),
   [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),
   [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),
+  [PROTOCOL_FEED]: schemeOf(PROTOCOL_FEED),
   [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),
   [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),
   [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),

package/dist/protocolSchemes.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_ANALYTICS,\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";AA2BA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,kBAAkB,GAAG,SAAS,kBAAkB;AAAA,EACjD,CAAC,mBAAmB,GAAG,SAAS,mBAAmB;AAAA,EACnD,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,cAAc,GAAG,SAAS,cAAc;AAAA,EACzC,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,gBAAgB,GAAG,SAAS,gBAAgB;AAAA,EAC7C,CAAC,iBAAiB,GAAG,SAAS,iBAAiB;AAAA,EAC/C,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,aAAa,GAAG,SAAS,aAAa;AAAA,EACvC,CAAC,cAAc,GAAG,SAAS,cAAc;AAAA,EACzC,CAAC,YAAY,GAAG,SAAS,YAAY;AACvC;","names":[]}
+{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_ANALYTICS,\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FEED,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FEED]: schemeOf(PROTOCOL_FEED),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";AA2BA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,kBAAkB,GAAG,SAAS,kBAAkB;AAAA,EACjD,CAAC,mBAAmB,GAAG,SAAS,mBAAmB;AAAA,EACnD,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,aAAa,GAAG,SAAS,aAAa;AAAA,EACvC,CAAC,cAAc,GAAG,SAAS,cAAc;AAAA,EACzC,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,YAAY,GAAG,SAAS,YAAY;AAAA,EACrC,CAAC,gBAAgB,GAAG,SAAS,gBAAgB;AAAA,EAC7C,CAAC,iBAAiB,GAAG,SAAS,iBAAiB;AAAA,EAC/C,CAAC,eAAe,GAAG,SAAS,eAAe;AAAA,EAC3C,CAAC,aAAa,GAAG,SAAS,aAAa;AAAA,EACvC,CAAC,cAAc,GAAG,SAAS,cAAc;AAAA,EACzC,CAAC,YAAY,GAAG,SAAS,YAAY;AACvC;","names":[]}

package/dist/version.cjs

@@ -21,7 +21,7 @@ __export(version_exports, {
   SDK_VERSION: () => SDK_VERSION
 });
 module.exports = __toCommonJS(version_exports);
-const SDK_VERSION = "0.52.0";
+const SDK_VERSION = "0.54.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SDK_VERSION

package/dist/version.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.52.0';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,MAAM,cAAc;","names":[]}
+{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.54.0';\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAIO,MAAM,cAAc;","names":[]}

package/dist/version.d.cts

@@ -1,4 +1,4 @@
 /** This SDK's package version, baked from package.json at build (SP2-6). */
-declare const SDK_VERSION = "0.52.0";
+declare const SDK_VERSION = "0.54.0";
 
 export { SDK_VERSION };

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 /** This SDK's package version, baked from package.json at build (SP2-6). */
-declare const SDK_VERSION = "0.52.0";
+declare const SDK_VERSION = "0.54.0";
 
 export { SDK_VERSION };

package/dist/version.js

@@ -1,5 +1,5 @@
 import "./chunk-VHAA22YE.js";
-const SDK_VERSION = "0.52.0";
+const SDK_VERSION = "0.54.0";
 export {
   SDK_VERSION
 };

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.52.0';\n"],"mappings":";AAIO,MAAM,cAAc;","names":[]}
+{"version":3,"sources":["../src/version.ts"],"sourcesContent":["// GENERATED by scripts/gen-version.mjs from package.json — do not edit by hand.\n// Regenerated on every build (prebuild); kept honest by version.test.ts.\n\n/** This SDK's package version, baked from package.json at build (SP2-6). */\nexport const SDK_VERSION = '0.54.0';\n"],"mappings":";AAIO,MAAM,cAAc;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@immediately-run/sdk",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "description": "Runtime SDK for code executing inside an immediately.run sandbox.",
   "license": "MIT",
   "repository": "github:immediately-run/immediately-run-sdk",
@@ -33,12 +33,15 @@
     "format:check": "prettier --check \"src/**/*.{ts,tsx,js,mjs,json}\" \"test/**/*.{ts,mjs}\" \"scripts/**/*.mjs\"",
     "check:circular": "node scripts/check-circular.mjs",
     "api:check": "node scripts/check-api-stability.mjs",
+    "api:selftest": "node scripts/check-api-stability.mjs --self-test",
     "protocol:check": "node scripts/check-protocol-snapshot.mjs",
     "verify:codegen-parity": "node scripts/codegen-prototype/verify-drift.mjs --self-test && node scripts/codegen-prototype/verify-drift.mjs && node scripts/codegen-prototype/verify.streams.mjs --self-test && node scripts/codegen-prototype/verify.streams.mjs",
     "api:update": "node scripts/check-api-stability.mjs --update",
-    "verify": "npm run format:check && npm run check:circular && npm run check:bundler:selftest && npm run check:bundler && npm run build && npm test && npm run test:safe-content && npm run test:metadata-e2e && npm run api:check && npm run compat:selftest && npm run compat:previous && npm run protocol:check && npm run protocol:selftest && npm run check:ambient:selftest && npm run check:ambient && npm run check:selfhost:selftest && npm run check:selfhost && npm run verify:codegen-parity",
+    "check:pins": "node scripts/check-dependency-pins.mjs --self-test && node scripts/check-dependency-pins.mjs",
+    "check:publish-version": "node scripts/check-publish-version.mjs --self-test && node scripts/check-publish-version.mjs",
+    "verify": "npm run check:pins && npm run check:publish-version && npm run format:check && npm run check:circular && npm run check:bundler:selftest && npm run check:bundler && npm run build && npm test && npm run test:safe-content && npm run test:metadata-e2e && npm run api:selftest && npm run api:check && npm run compat:selftest && npm run compat:previous && npm run protocol:check && npm run protocol:selftest && npm run check:ambient:selftest && npm run check:ambient && npm run check:selfhost:selftest && npm run check:selfhost && npm run verify:codegen-parity",
     "docs": "typedoc --json docs/api.json && node scripts/gen-llms.mjs",
-    "prepublishOnly": "npm run check:circular && npm run build && npm run api:check",
+    "prepublishOnly": "npm run check:circular && npm run build && npm run api:selftest && npm run api:check",
     "test:safe-content": "node scripts/build-safecontent-e2e.mjs && node --test test/safeContent.e2e.mjs",
     "test:metadata-e2e": "node --test test/metadataHooks.e2e.mjs",
     "protocol:selftest": "node scripts/check-protocol-snapshot.mjs --self-test",
@@ -58,7 +61,7 @@
   },
   "dependencies": {
     "@immediately-run/platform-constants": "0.2.0",
-    "@immediately-run/sandbox-protocol": "0.5.0",
+    "@immediately-run/sandbox-protocol": "0.7.1",
     "react-error-boundary": "^6.0.0",
     "@immediately-run/safe-content": "0.1.0",
     "@immediately-run/mdx-plugins": "0.5.0"