@immediately-run/sdk 0.57.1 → 0.58.0

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,qBAZd;AAaA,0BAAc,oCAbd;AAcA,0BAAc,gCAdd;AAeA,0BAAc,oBAfd;AAkBA,0BAAc,6BAlBd;AAqBA,6BAAwE;AACxE,0BAAc,mBAtBd;AAuBA,0BAAc,oBAvBd;AAwBA,0BAAc,4BAxBd;AAyBA,0BAAc,qBAzBd;AA0BA,0BAAc,yBA1Bd;AA2BA,0BAAc,0BA3Bd;AA4BA,0BAAc,4BA5Bd;AA6BA,0BAAc,qBA7Bd;AA8BA,0BAAc,qBA9Bd;AA+BA,0BAAc,wBA/Bd;AAgCA,0BAAc,yBAhCd;AAiCA,0BAAc,sBAjCd;AAkCA,0BAAc,kBAlCd;AAmCA,0BAAc,kBAnCd;AAoCA,0BAAc,uBApCd;AAqCA,0BAAc,mBArCd;AAsCA,0BAAc,sBAtCd;AAuCA,0BAAc,kBAvCd;AAwCA,0BAAc,0BAxCd;AAyCA,0BAAc,kBAzCd;AA0CA,0BAAc,yBA1Cd;AA2CA,0BAAc,iBA3Cd;AA4CA,0BAAc,oBA5Cd;AA6CA,0BAAc,oBA7Cd;AA8CA,0BAAc,qBA9Cd;AA+CA,0BAAc,sBA/Cd;AAgDA,0BAAc,wBAhDd;AAiDA,0BAAc,oBAjDd;AAkDA,0BAAc,sBAlDd;AAmDA,0BAAc,6BAnDd;AAoDA,0BAAc,+BApDd;AAqDA,0BAAc,2BArDd;AAsDA,0BAAc,0BAtDd;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './bundle';\n// Deprecated `Corpus*` spellings of the above (R3-482); see `src/corpus.ts`.\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './workspace';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './recents'; // R3-485: the gated recent-projects read (page.home)\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n// R3-489 (GROVE_AGENT_SPEC): the embedded-agent seam every app shares — the tool-use\n// loop ported from agent-demo (`runAgent` over the host chat slot), the MDX metadata\n// query tool, the headings index collector, the deixis context block, and the fence\n// for corpus-derived bytes entering a loop.\nexport * from './agentLoop';\nexport * from './agentSteering';\nexport * from './agentChatClient';\nexport * from './metadataQueryTool';\nexport * from './collectHeadings';\nexport * from './agentContext';\nexport * from './fence';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,qBAZd;AAcA,0BAAc,qBAdd;AAeA,0BAAc,oCAfd;AAgBA,0BAAc,gCAhBd;AAiBA,0BAAc,oBAjBd;AAoBA,0BAAc,6BApBd;AAuBA,6BAAwE;AACxE,0BAAc,mBAxBd;AAyBA,0BAAc,oBAzBd;AA0BA,0BAAc,4BA1Bd;AA2BA,0BAAc,qBA3Bd;AA4BA,0BAAc,yBA5Bd;AA6BA,0BAAc,0BA7Bd;AA8BA,0BAAc,wBA9Bd;AA+BA,0BAAc,4BA/Bd;AAgCA,0BAAc,qBAhCd;AAiCA,0BAAc,qBAjCd;AAkCA,0BAAc,wBAlCd;AAmCA,0BAAc,yBAnCd;AAoCA,0BAAc,sBApCd;AAqCA,0BAAc,kBArCd;AAsCA,0BAAc,kBAtCd;AAuCA,0BAAc,uBAvCd;AAwCA,0BAAc,mBAxCd;AAyCA,0BAAc,sBAzCd;AA0CA,0BAAc,sBA1Cd;AA2CA,0BAAc,kBA3Cd;AA4CA,0BAAc,0BA5Cd;AA6CA,0BAAc,kBA7Cd;AA8CA,0BAAc,yBA9Cd;AA+CA,0BAAc,iBA/Cd;AAgDA,0BAAc,oBAhDd;AAiDA,0BAAc,oBAjDd;AAkDA,0BAAc,qBAlDd;AAmDA,0BAAc,sBAnDd;AAoDA,0BAAc,wBApDd;AAqDA,0BAAc,oBArDd;AAsDA,0BAAc,sBAtDd;AAuDA,0BAAc,6BAvDd;AAwDA,0BAAc,+BAxDd;AAyDA,0BAAc,2BAzDd;AA0DA,0BAAc,0BA1Dd;AA+DA,0BAAc,wBA/Dd;AAgEA,0BAAc,4BAhEd;AAiEA,0BAAc,8BAjEd;AAkEA,0BAAc,gCAlEd;AAmEA,0BAAc,8BAnEd;AAoEA,0BAAc,2BApEd;AAqEA,0BAAc,oBArEd;","names":[]}

package/dist/index.d.cts

@@ -6,7 +6,7 @@ export { SafeInclude } from './components/SafeInclude.cjs';
 export { SourceCache, SourceReader, createSourceCache } from './sourceCache.cjs';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.cjs';
 export { LinkSpaceContext } from './linkSpace.cjs';
-export { CorpusContext, CorpusEntry, CorpusScope, fromCorpusPath, toCorpusPath, useCorpus, useCorpusEntries, useCorpusEntry, useCurrentEntry } from './corpus.cjs';
+export { BundleContext, BundleEntry, BundleScope, BundleContext as CorpusContext, BundleEntry as CorpusEntry, BundleScope as CorpusScope, fromBundlePath, fromBundlePath as fromCorpusPath, toBundlePath, toBundlePath as toCorpusPath, useBundle, useBundleEntries, useBundleEntry, useBundle as useCorpus, useBundleEntries as useCorpusEntries, useBundleEntry as useCorpusEntry, useCurrentEntry } from './bundle.cjs';
 export { MountImage, MountImageProps } from './components/MountImage.cjs';
 export { Route, RouteProps, Routes } from './components/Routes.cjs';
 export { ObjectUrlState, useAllMetadata, useFileMetadata, useMetadataQuery, useObjectUrl } from './hooks.cjs';
@@ -18,6 +18,7 @@ export { EditorContext, getEditorContext, onEditorContextChange, useEditorContex
 export { EditTarget, EditorOpenError, EditorOpenOptions, EditorSelection, EditorSessionError, EditorWriteError, RequestEditError, closeFile, createFile, createFolder, deleteEntry, openInEditor, renameEntry, requestEdit, setActiveFile, uploadFile } from './editor.cjs';
 export { FormFactor, FormFactorClass, Orientation, getFormFactor, onFormFactorChange, useFormFactor } from './formFactor.cjs';
 export { ChromeState, getChromeState, onChromeStateChange, useChromeState } from './chromeState.cjs';
+export { Workspace, getWorkspace, onWorkspaceChange, useWorkspace } from './workspace.cjs';
 export { HostAttention, HostAttentionKind, NO_HOST_ATTENTION, getHostAttention, onHostAttentionChange, useHostAttention } from './hostAttention.cjs';
 export { getRegion, useRegion } from './region.cjs';
 export { Invite, MountQuery, MountRemoveReason, MountRule, RemovedMount, SandboxMount, SessionMount, SpaceError, acceptInvite, awaitMatchingMount, createSpace, declineInvite, findMount, getAppMountPath, getInvites, getMounts, getSessionMounts, importSettingsFromParent, listMyInvites, listPendingInvites, listSettingsApps, makeContentRef, mount, mountSpace, onInvitesChange, onMountsChange, onSessionMountsChange, openSettings, openSettingsOf, requestMount, requestSpace, resolveContentRef, resolveContentRefs, revokeInvite, unmountSpace, useInvites, useMounts, useSessionMounts, waitForMount } from './mounts.cjs';
@@ -29,13 +30,14 @@ export { DraggableItem, DroppedItem, ItemDragError, cancelItemDrag, onItemDrop,
 export { HostFetchInit, HostFetchResponse, HostFetchStreamEvent, HostFetchStreamResult, hostFetch, hostFetchStream } from './netFetch.cjs';
 export { FeedFetchResponse, FeedParams, feedFetch } from './feed.cjs';
 export { SecretError, SecretGrant, SecretHints, SecretQuery, SecretType, SecretView, getSecrets, onSecretsChange, requestAddSecret, requestSecret, revokeSecret, useSecrets } from './secrets.cjs';
+export { RecentProject, clearRecentProjects, listRecentProjects } from './recents.cjs';
 export { ChatDelta, ChatFeatures, ChatMessage, ChatProviderInfo, ChatProviderState, ChatRequest, ChatResult, ChatRole, ChatStopReason, ContentPart, ToolDef, chat, describeChat, describeChatState, normalizeProviderInfo, onChatProviderChange, onChatProviderStateChange, useChatProvider, useChatProviderState } from './llm.cjs';
 export { BuildError, ConsoleEntry, ConsoleLevel, Diagnostics, DiagnosticsProvenance, getDiagnostics, onDiagnosticsChange, useDiagnostics } from './diagnostics.cjs';
 export { VcsActionError, VcsBranch, VcsChange, VcsPR, VcsState, getVcsState, onVcsStateChange, refreshDiff, refreshPRs, resetWorkingTree, useVcsState } from './vcs.cjs';
-export { FsChange, getFsChange, onFsChange, useFsChange } from './onFsChange.cjs';
+export { FsChange, MountChange, getFsChange, onFsChange, useFsChange } from './onFsChange.cjs';
 export { DirEntry, FileStat, FsError, MountFs, SandboxFsPort, fsAvailable, mimeTypeFor, openAppFs, openFs, sandboxFs } from './fs.cjs';
 export { DebugLevel, debug, isDebugEnabled, log, useDebugEnabled } from './debug.cjs';
-export { DirCap, FileCap, TaskInput, cancelTask, capDir, capFile, completeTask, getTaskInput, invokeTask, useTaskInput } from './tasks.cjs';
+export { CaptureOptions, CaptureResult, DirCap, FileCap, TaskInput, cancelTask, capDir, capFile, captureAudio, capturePhoto, completeTask, getTaskInput, invokeTask, useTaskInput } from './tasks.cjs';
 export { LaunchErrorCode, LaunchHandle, LaunchOptions, LaunchRegion, LaunchStatus, LaunchTarget, launch } from './launch.cjs';
 export { SDK_PROTOCOL_VERSION, SdkHandshake, announceHandshake, sdkHandshake } from './runtime.cjs';
 export { ForwardedMarker, IR_MARKERS, IrMarkerName, isAllowedMarkerName, isIrMarkerName, resolveInteractive, validateMarker } from './irMarkers.cjs';
@@ -45,6 +47,13 @@ export { StreamError, StreamFrame, StreamTransport, consumeStream, protocolStrea
 export { ATTENDED_FIRST_FRAME_MS, ATTENDED_TIMEOUT_MS, Attendance, BoundedCallOptions, CallBounds, DeadlineBound, NETWORK_TIMEOUT_MS, PENDING_NOTICE_MS, PendingAttention, PendingState, ProtocolCancelledError, ProtocolTimeoutError, STREAM_IDLE_TIMEOUT_MS, SuspendableDeadline, UNATTENDED_TIMEOUT_MS, attendanceOf, attendanceReason, boundsFor, createSuspendableDeadline, firstFrameBoundsFor, firstFrameTimeoutFor, timeoutFor } from './protocolDeadline.cjs';
 export { EvaluationContext, FileQueryResult, FilesMetadata, Metadata, MetadataQueryEntry, MetadataQueryFunction, MetadataQueryRecord, MetadataQueryResult, ModuleExports } from './sandboxTypes.cjs';
 export * from '@immediately-run/safe-content';
+export { AgentEvents, AgentMessage, AgentRole, AgentTool, COMPACTION_MARKER, ContentBlock, ImageBlock, ModelClient, ModelResponse, NUDGE_TEXT, ReasoningBlock, RunAgentOptions, StallReason, TextBlock, TokenUsage, ToolExecutor, ToolOutcome, ToolResultBlock, ToolUseBlock, compactTranscript, detectStall, estimateTokens, isContextOverflow, runAgent, shouldCompact } from './agentLoop.cjs';
+export { INTERRUPTED_TURN_TEXT, STEER_INTERRUPT_MARKER, STEER_MARKER, SteerController, SteerMessage, SteerMode, SteerSource, anySignal, parseSteer, steerWireText } from './agentSteering.cjs';
+export { createChatModelClient } from './agentChatClient.cjs';
+export { HeadingSummary, METADATA_HEADINGS_KEY, METADATA_QUERY_TOOL_DESCRIPTOR, METADATA_QUERY_TOOL_NAME, MetadataQueryError, MetadataQueryInput, MetadataQueryRow, createMetadataQueryTool, executeMetadataQuery, globToRegExp, runMetadataQuery } from './metadataQueryTool.cjs';
+export { collectHeadings } from './collectHeadings.cjs';
+export { AgentContextAppFields, AgentContextBlock, renderAgentContext, useAgentContext } from './agentContext.cjs';
+export { fenceUntrusted } from './fence.cjs';
 export { Admonition, AdmonitionType } from './components/Admonition.cjs';
 export { FS_PREFIX, LinkSpace, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';
 export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.cjs';

package/dist/index.d.ts

@@ -6,7 +6,7 @@ export { SafeInclude } from './components/SafeInclude.js';
 export { SourceCache, SourceReader, createSourceCache } from './sourceCache.js';
 export { DEFAULT_MDX_COMPONENTS } from './components/MDXComponents.js';
 export { LinkSpaceContext } from './linkSpace.js';
-export { CorpusContext, CorpusEntry, CorpusScope, fromCorpusPath, toCorpusPath, useCorpus, useCorpusEntries, useCorpusEntry, useCurrentEntry } from './corpus.js';
+export { BundleContext, BundleEntry, BundleScope, BundleContext as CorpusContext, BundleEntry as CorpusEntry, BundleScope as CorpusScope, fromBundlePath, fromBundlePath as fromCorpusPath, toBundlePath, toBundlePath as toCorpusPath, useBundle, useBundleEntries, useBundleEntry, useBundle as useCorpus, useBundleEntries as useCorpusEntries, useBundleEntry as useCorpusEntry, useCurrentEntry } from './bundle.js';
 export { MountImage, MountImageProps } from './components/MountImage.js';
 export { Route, RouteProps, Routes } from './components/Routes.js';
 export { ObjectUrlState, useAllMetadata, useFileMetadata, useMetadataQuery, useObjectUrl } from './hooks.js';
@@ -18,6 +18,7 @@ export { EditorContext, getEditorContext, onEditorContextChange, useEditorContex
 export { EditTarget, EditorOpenError, EditorOpenOptions, EditorSelection, EditorSessionError, EditorWriteError, RequestEditError, closeFile, createFile, createFolder, deleteEntry, openInEditor, renameEntry, requestEdit, setActiveFile, uploadFile } from './editor.js';
 export { FormFactor, FormFactorClass, Orientation, getFormFactor, onFormFactorChange, useFormFactor } from './formFactor.js';
 export { ChromeState, getChromeState, onChromeStateChange, useChromeState } from './chromeState.js';
+export { Workspace, getWorkspace, onWorkspaceChange, useWorkspace } from './workspace.js';
 export { HostAttention, HostAttentionKind, NO_HOST_ATTENTION, getHostAttention, onHostAttentionChange, useHostAttention } from './hostAttention.js';
 export { getRegion, useRegion } from './region.js';
 export { Invite, MountQuery, MountRemoveReason, MountRule, RemovedMount, SandboxMount, SessionMount, SpaceError, acceptInvite, awaitMatchingMount, createSpace, declineInvite, findMount, getAppMountPath, getInvites, getMounts, getSessionMounts, importSettingsFromParent, listMyInvites, listPendingInvites, listSettingsApps, makeContentRef, mount, mountSpace, onInvitesChange, onMountsChange, onSessionMountsChange, openSettings, openSettingsOf, requestMount, requestSpace, resolveContentRef, resolveContentRefs, revokeInvite, unmountSpace, useInvites, useMounts, useSessionMounts, waitForMount } from './mounts.js';
@@ -29,13 +30,14 @@ export { DraggableItem, DroppedItem, ItemDragError, cancelItemDrag, onItemDrop,
 export { HostFetchInit, HostFetchResponse, HostFetchStreamEvent, HostFetchStreamResult, hostFetch, hostFetchStream } from './netFetch.js';
 export { FeedFetchResponse, FeedParams, feedFetch } from './feed.js';
 export { SecretError, SecretGrant, SecretHints, SecretQuery, SecretType, SecretView, getSecrets, onSecretsChange, requestAddSecret, requestSecret, revokeSecret, useSecrets } from './secrets.js';
+export { RecentProject, clearRecentProjects, listRecentProjects } from './recents.js';
 export { ChatDelta, ChatFeatures, ChatMessage, ChatProviderInfo, ChatProviderState, ChatRequest, ChatResult, ChatRole, ChatStopReason, ContentPart, ToolDef, chat, describeChat, describeChatState, normalizeProviderInfo, onChatProviderChange, onChatProviderStateChange, useChatProvider, useChatProviderState } from './llm.js';
 export { BuildError, ConsoleEntry, ConsoleLevel, Diagnostics, DiagnosticsProvenance, getDiagnostics, onDiagnosticsChange, useDiagnostics } from './diagnostics.js';
 export { VcsActionError, VcsBranch, VcsChange, VcsPR, VcsState, getVcsState, onVcsStateChange, refreshDiff, refreshPRs, resetWorkingTree, useVcsState } from './vcs.js';
-export { FsChange, getFsChange, onFsChange, useFsChange } from './onFsChange.js';
+export { FsChange, MountChange, getFsChange, onFsChange, useFsChange } from './onFsChange.js';
 export { DirEntry, FileStat, FsError, MountFs, SandboxFsPort, fsAvailable, mimeTypeFor, openAppFs, openFs, sandboxFs } from './fs.js';
 export { DebugLevel, debug, isDebugEnabled, log, useDebugEnabled } from './debug.js';
-export { DirCap, FileCap, TaskInput, cancelTask, capDir, capFile, completeTask, getTaskInput, invokeTask, useTaskInput } from './tasks.js';
+export { CaptureOptions, CaptureResult, DirCap, FileCap, TaskInput, cancelTask, capDir, capFile, captureAudio, capturePhoto, completeTask, getTaskInput, invokeTask, useTaskInput } from './tasks.js';
 export { LaunchErrorCode, LaunchHandle, LaunchOptions, LaunchRegion, LaunchStatus, LaunchTarget, launch } from './launch.js';
 export { SDK_PROTOCOL_VERSION, SdkHandshake, announceHandshake, sdkHandshake } from './runtime.js';
 export { ForwardedMarker, IR_MARKERS, IrMarkerName, isAllowedMarkerName, isIrMarkerName, resolveInteractive, validateMarker } from './irMarkers.js';
@@ -45,6 +47,13 @@ export { StreamError, StreamFrame, StreamTransport, consumeStream, protocolStrea
 export { ATTENDED_FIRST_FRAME_MS, ATTENDED_TIMEOUT_MS, Attendance, BoundedCallOptions, CallBounds, DeadlineBound, NETWORK_TIMEOUT_MS, PENDING_NOTICE_MS, PendingAttention, PendingState, ProtocolCancelledError, ProtocolTimeoutError, STREAM_IDLE_TIMEOUT_MS, SuspendableDeadline, UNATTENDED_TIMEOUT_MS, attendanceOf, attendanceReason, boundsFor, createSuspendableDeadline, firstFrameBoundsFor, firstFrameTimeoutFor, timeoutFor } from './protocolDeadline.js';
 export { EvaluationContext, FileQueryResult, FilesMetadata, Metadata, MetadataQueryEntry, MetadataQueryFunction, MetadataQueryRecord, MetadataQueryResult, ModuleExports } from './sandboxTypes.js';
 export * from '@immediately-run/safe-content';
+export { AgentEvents, AgentMessage, AgentRole, AgentTool, COMPACTION_MARKER, ContentBlock, ImageBlock, ModelClient, ModelResponse, NUDGE_TEXT, ReasoningBlock, RunAgentOptions, StallReason, TextBlock, TokenUsage, ToolExecutor, ToolOutcome, ToolResultBlock, ToolUseBlock, compactTranscript, detectStall, estimateTokens, isContextOverflow, runAgent, shouldCompact } from './agentLoop.js';
+export { INTERRUPTED_TURN_TEXT, STEER_INTERRUPT_MARKER, STEER_MARKER, SteerController, SteerMessage, SteerMode, SteerSource, anySignal, parseSteer, steerWireText } from './agentSteering.js';
+export { createChatModelClient } from './agentChatClient.js';
+export { HeadingSummary, METADATA_HEADINGS_KEY, METADATA_QUERY_TOOL_DESCRIPTOR, METADATA_QUERY_TOOL_NAME, MetadataQueryError, MetadataQueryInput, MetadataQueryRow, createMetadataQueryTool, executeMetadataQuery, globToRegExp, runMetadataQuery } from './metadataQueryTool.js';
+export { collectHeadings } from './collectHeadings.js';
+export { AgentContextAppFields, AgentContextBlock, renderAgentContext, useAgentContext } from './agentContext.js';
+export { fenceUntrusted } from './fence.js';
 export { Admonition, AdmonitionType } from './components/Admonition.js';
 export { FS_PREFIX, LinkSpace, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';
 export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.js';

package/dist/index.js

@@ -7,6 +7,7 @@ import { SafeInclude } from "./components/SafeInclude";
 export * from "./sourceCache";
 export * from "./components/MDXComponents";
 export * from "./linkSpace";
+export * from "./bundle";
 export * from "./corpus";
 export * from "./components/MountImage";
 export * from "./components/Routes";
@@ -19,6 +20,7 @@ export * from "./editorContext";
 export * from "./editor";
 export * from "./formFactor";
 export * from "./chromeState";
+export * from "./workspace";
 export * from "./hostAttention";
 export * from "./region";
 export * from "./mounts";
@@ -30,6 +32,7 @@ export * from "./dnd";
 export * from "./netFetch";
 export * from "./feed";
 export * from "./secrets";
+export * from "./recents";
 export * from "./llm";
 export * from "./diagnostics";
 export * from "./vcs";
@@ -46,6 +49,13 @@ export * from "./protocolStream";
 export * from "./protocolDeadline";
 export * from "./sandboxTypes";
 export * from "./safeContent";
+export * from "./agentLoop";
+export * from "./agentSteering";
+export * from "./agentChatClient";
+export * from "./metadataQueryTool";
+export * from "./collectHeadings";
+export * from "./agentContext";
+export * from "./fence";
 export {
   SafeInclude,
   getInjectedMetadataEmitter,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AAGd,SAAS,4BAA4B,mCAAmC;AACxE,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './bundle';\n// Deprecated `Corpus*` spellings of the above (R3-482); see `src/corpus.ts`.\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './workspace';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './recents'; // R3-485: the gated recent-projects read (page.home)\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n// R3-489 (GROVE_AGENT_SPEC): the embedded-agent seam every app shares — the tool-use\n// loop ported from agent-demo (`runAgent` over the host chat slot), the MDX metadata\n// query tool, the headings index collector, the deixis context block, and the fence\n// for corpus-derived bytes entering a loop.\nexport * from './agentLoop';\nexport * from './agentSteering';\nexport * from './agentChatClient';\nexport * from './metadataQueryTool';\nexport * from './collectHeadings';\nexport * from './agentContext';\nexport * from './fence';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAEd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AAGd,SAAS,4BAA4B,mCAAmC;AACxE,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}

package/dist/launch.cjs

@@ -33,10 +33,31 @@ var import_protocol = require("./generated/protocol");
 var import_protocolSchemes = require("./protocolSchemes");
 var _status, _dismissListeners, _ended;
 const liveHandles = /* @__PURE__ */ new Map();
-(0, import_sandboxUtils.addListener)(import_protocol.LAUNCH_ENDED, (m) => {
-  const h = liveHandles.get(m.launchId);
-  if (h) h._end(m.status);
-});
+const pendingEnded = /* @__PURE__ */ new Map();
+const MAX_PENDING_ENDED = 16;
+let createsInFlight = 0;
+let endedListenerRegistered = false;
+const ensureEndedListener = () => {
+  if (endedListenerRegistered) return;
+  try {
+    (0, import_sandboxUtils.addListener)(import_protocol.LAUNCH_ENDED, (m) => {
+      const h = liveHandles.get(m.launchId);
+      if (h) {
+        h._end(m.status);
+        return;
+      }
+      if (createsInFlight === 0) return;
+      if (pendingEnded.size >= MAX_PENDING_ENDED) {
+        const oldest = pendingEnded.keys().next();
+        if (!oldest.done) pendingEnded.delete(oldest.value);
+      }
+      pendingEnded.set(m.launchId, m.status);
+    });
+  } catch {
+    return;
+  }
+  endedListenerRegistered = true;
+};
 class LaunchHandleImpl {
   constructor(launchId) {
     this.launchId = launchId;
@@ -44,6 +65,11 @@ class LaunchHandleImpl {
     __privateAdd(this, _dismissListeners, /* @__PURE__ */ new Set());
     __privateAdd(this, _ended, false);
     liveHandles.set(launchId, this);
+    const early = pendingEnded.get(launchId);
+    if (early !== void 0) {
+      pendingEnded.delete(launchId);
+      this._end(early);
+    }
   }
   get status() {
     return __privateGet(this, _status);
@@ -83,12 +109,25 @@ _status = new WeakMap();
 _dismissListeners = new WeakMap();
 _ended = new WeakMap();
 const launch = async (target, opts) => {
-  const res = await (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_LAUNCH], "create", [{ target, opts }]);
+  ensureEndedListener();
+  createsInFlight += 1;
+  let res;
+  try {
+    res = await (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_LAUNCH], "create", [{ target, opts }]);
+  } finally {
+    createsInFlight -= 1;
+  }
+  const sweep = () => {
+    if (createsInFlight === 0) pendingEnded.clear();
+  };
   if (!res || res.ok !== true || !res.data?.launchId) {
+    sweep();
     const code = res && res.ok === false ? res.code ?? "unknown" : "unknown";
     return { ok: false, code };
   }
-  return new LaunchHandleImpl(res.data.launchId);
+  const handle = new LaunchHandleImpl(res.data.launchId);
+  sweep();
+  return handle;
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/launch.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/launch.ts"],"sourcesContent":["// Launch — the TO-RUN twin of `invokeTask` (STANDING_APP_LIFECYCLE_SPEC §1–§6).\n// Where `invokeTask` is FOR-RESULT (await one value, callee exits), `launch` is\n// TO-RUN (non-blocking, standing): it starts a bound program RUNNING in a region\n// and hands back a HANDLE, never a typed value (R-SAL-1). The launched app earns\n// its OWN grants — the only launcher→launched data path is the explicitly\n// delegated `capDir`/`capFile` in `input` (§5), attenuated + tainted + gated host-\n// side. The host owns the whole lifecycle (visibility, budget, revocation,\n// teardown); the launcher only OBSERVES via the handle.\n//\n// A caller that wants a typed value back uses `invokeTask` instead — the two are\n// siblings, not a replacement.\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\nimport { LAUNCH_DISMISS, LAUNCH_ENDED, PROTOCOL_LAUNCH } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** Where a launched program runs (§6). `overlay` covers the caller's own region\n *  with opaque host chrome; `stage` replaces the focal app (the elevated into-\n *  stage surface, §7 — refused above the stage-principal ceiling). */\nexport type LaunchRegion = 'overlay' | 'stage';\n\n/**\n * What to launch (§3) — binding-resolved, NEVER a caller-named app. Exactly one of:\n *  - `entryPoint`: a sibling entry point of the caller's OWN repo (the mini-app\n *    case, `AGENT_AUTHORING §5`) — **rejected `forbidden` until program-identity\n *    `appKey` lands** (R-SAL-2a);\n *  - `task`: a task contract (`open-project`, …), resolved through the user-\n *    overridable `task.<name>` binding to whichever app the user bound (§3 kind 2).\n */\nexport interface LaunchTarget {\n  /** Kind 1 — a sibling entry point of the caller's own repo (mini-app overlay). */\n  entryPoint?: string;\n  /** Kind 2 — a task contract name (the host resolves the bound provider). */\n  task?: string;\n  /** Optional accepted contract version for a `task` target (semver, e.g. `^1`). */\n  version?: string;\n}\n\nexport interface LaunchOptions {\n  /** Where it runs (§6). */\n  region: LaunchRegion;\n  /**\n   * Delegations + plain data handed to the launched app. `$cap:'dir'|'file'`\n   * markers (`capDir`/`capFile`, exported from `./tasks`) are resolved against the\n   * launcher's OWN grants and minted as attenuated, `ro`-by-default chroots (§5) —\n   * you can only delegate what you already hold. Everything else is plain data.\n   */\n  input?: Record<string, unknown>;\n}\n\n/** The live state of a launch (§2). Terminal states (`dismissed`/`revoked`/\n *  `failed`) are reached identically for self-exit, user dismiss, and host revoke —\n *  the host debounces so the launcher gets no timing oracle (R-SAL-1 / §6.4). */\nexport type LaunchStatus = 'running' | 'dismissed' | 'revoked' | 'failed';\n\n/** Machine codes a refused `launch` resolves with (§8). */\nexport type LaunchErrorCode =\n  | 'forbidden' // undeclared target; sibling (pre-AA-01); self-resolving target; stage cap absent\n  | 'unsupported' // no provider bound / entry point absent / unknown contract version\n  | 'budget' // over an R-SAL-8 concurrency/rate limit\n  | 'revoked' // a delegated mount was revoked during the create-and-bind window\n  | 'cancelled' // the user dismissed the host launch affordance (into-stage only)\n  | 'invalid-params' // a malformed `capDir`/`capFile` (`..`/absolute/mode-escalation)\n  | 'unknown';\n\n/**\n * The control channel back to a launch — the ONLY thing a launcher gets (§2).\n * There is no typed return value (R-SAL-1); `status`/`onDismiss` are debounced so\n * they cannot time-distinguish a self-exit from a user dismiss.\n */\nexport interface LaunchHandle {\n  /** Host-assigned id for this launch. */\n  readonly launchId: string;\n  /** The current lifecycle state (§2). */\n  readonly status: LaunchStatus;\n  /** Ask the host to tear this launch down. Idempotent (double-dismiss is a no-op). */\n  dismiss(): void;\n  /**\n   * Observe the launch ending (self-exit / user dismiss / host revoke — fired\n   * identically, R-SAL-1). Returns an unsubscribe fn. Fires at most once; if the\n   * launch has already ended it fires on the next tick.\n   */\n  onDismiss(cb: () => void): () => void;\n}\n\ninterface LaunchEndedMessage {\n  launchId: string;\n  status: Exclude<LaunchStatus, 'running'>;\n}\n\n/** Live handles awaiting their terminal `launch-ended` message, keyed by launchId. */\nconst liveHandles = new Map<string, LaunchHandleImpl>();\n\n// The host delivers ONE `launch-ended` message per launch when it tears down —\n// the SAME message shape for self-exit, dismiss, and revoke (the host debounces\n// so the timing is not an oracle, §6.4). We fan it out to the matching handle.\naddListener(LAUNCH_ENDED, (m: LaunchEndedMessage) => {\n  const h = liveHandles.get(m.launchId);\n  if (h) h._end(m.status);\n});\n\nclass LaunchHandleImpl implements LaunchHandle {\n  #status: LaunchStatus = 'running';\n  #dismissListeners = new Set<() => void>();\n  #ended = false;\n\n  constructor(readonly launchId: string) {\n    liveHandles.set(launchId, this);\n  }\n\n  get status(): LaunchStatus {\n    return this.#status;\n  }\n\n  dismiss(): void {\n    if (this.#ended) return;\n    // Fire-and-forget: the host owns teardown and answers with `launch-ended`,\n    // which drives `_end` (so status/onDismiss are host-authoritative, never\n    // optimistically local — a dismiss the host refuses would otherwise desync).\n    sendMessage(LAUNCH_DISMISS, { launchId: this.launchId });\n  }\n\n  onDismiss(cb: () => void): () => void {\n    if (this.#ended) {\n      // Already ended: fire on the next tick so the contract (\"returns an\n      // unsubscribe\") holds and the callback never runs synchronously mid-register.\n      queueMicrotask(cb);\n      return () => {};\n    }\n    this.#dismissListeners.add(cb);\n    return () => {\n      this.#dismissListeners.delete(cb);\n    };\n  }\n\n  /** Host-driven terminal transition — the only writer of `status`. Idempotent. */\n  _end(status: Exclude<LaunchStatus, 'running'>): void {\n    if (this.#ended) return;\n    this.#ended = true;\n    this.#status = status;\n    liveHandles.delete(this.launchId);\n    const listeners = [...this.#dismissListeners];\n    this.#dismissListeners.clear();\n    for (const l of listeners) {\n      try {\n        l();\n      } catch {\n        /* a launcher's own callback must never wedge teardown */\n      }\n    }\n  }\n}\n\n/**\n * Launch a bound program to RUN in a region (§2). Non-blocking: resolves once the\n * frame is created and bound, with a {@link LaunchHandle} — or a typed\n * `{ ok:false, code }` on refusal (§8), NEVER a throw for an ordinary refusal (so\n * a launcher branches on `code` without a try/catch). The launched app runs under\n * its OWN grants; the launcher's authority does not flow to it (R-SAL-4).\n *\n *   const h = await launch({ task: 'open-project' }, {\n *     region: 'stage',\n *     input: { dir: capDir({ mountId: 'space:abc', relPath: 'proj' }, { mode: 'ro' }) },\n *   });\n *   if ('ok' in h && h.ok === false) { ...handle h.code... }\n *   else { h.onDismiss(() => ...); }\n */\nexport const launch = async (\n  target: LaunchTarget,\n  opts: LaunchOptions,\n): Promise<LaunchHandle | { ok: false; code: LaunchErrorCode }> => {\n  // The host wraps a successful handler return as `{ ok:true, data }` (the same\n  // Recipe-B framing `invokeTask` uses); a refusal is `{ ok:false, code }`.\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], 'create', [{ target, opts }])) as\n    | { ok: true; data: { launchId: string } }\n    | { ok: false; code?: LaunchErrorCode }\n    | undefined;\n  if (!res || res.ok !== true || !res.data?.launchId) {\n    const code = res && res.ok === false ? res.code ?? 'unknown' : 'unknown';\n    return { ok: false, code };\n  }\n  return new LaunchHandleImpl(res.data.launchId);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,0BAA0D;AAC1D,sBAA8D;AAC9D,6BAAwB;AAbxB;AA0FA,MAAM,cAAc,oBAAI,IAA8B;AAAA,IAKtD,iCAAY,8BAAc,CAAC,MAA0B;AACnD,QAAM,IAAI,YAAY,IAAI,EAAE,QAAQ;AACpC,MAAI,EAAG,GAAE,KAAK,EAAE,MAAM;AACxB,CAAC;AAED,MAAM,iBAAyC;AAAA,EAK7C,YAAqB,UAAkB;AAAlB;AAJrB,gCAAwB;AACxB,0CAAoB,oBAAI,IAAgB;AACxC,+BAAS;AAGP,gBAAY,IAAI,UAAU,IAAI;AAAA,EAChC;AAAA,EAEA,IAAI,SAAuB;AACzB,WAAO,mBAAK;AAAA,EACd;AAAA,EAEA,UAAgB;AACd,QAAI,mBAAK,QAAQ;AAIjB,yCAAY,gCAAgB,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EACzD;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,mBAAK,SAAQ;AAGf,qBAAe,EAAE;AACjB,aAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AACA,uBAAK,mBAAkB,IAAI,EAAE;AAC7B,WAAO,MAAM;AACX,yBAAK,mBAAkB,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,KAAK,QAAgD;AACnD,QAAI,mBAAK,QAAQ;AACjB,uBAAK,QAAS;AACd,uBAAK,SAAU;AACf,gBAAY,OAAO,KAAK,QAAQ;AAChC,UAAM,YAAY,CAAC,GAAG,mBAAK,kBAAiB;AAC5C,uBAAK,mBAAkB,MAAM;AAC7B,eAAW,KAAK,WAAW;AACzB,UAAI;AACF,UAAE;AAAA,MACJ,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAjDE;AACA;AACA;AA+DK,MAAM,SAAS,OACpB,QACA,SACiE;AAGjE,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,+BAAe,GAAG,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC;AAIzF,MAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,IAAI,MAAM,UAAU;AAClD,UAAM,OAAO,OAAO,IAAI,OAAO,QAAQ,IAAI,QAAQ,YAAY;AAC/D,WAAO,EAAE,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,SAAO,IAAI,iBAAiB,IAAI,KAAK,QAAQ;AAC/C;","names":[]}
+{"version":3,"sources":["../src/launch.ts"],"sourcesContent":["// Launch — the TO-RUN twin of `invokeTask` (STANDING_APP_LIFECYCLE_SPEC §1–§6).\n// Where `invokeTask` is FOR-RESULT (await one value, callee exits), `launch` is\n// TO-RUN (non-blocking, standing): it starts a bound program RUNNING in a region\n// and hands back a HANDLE, never a typed value (R-SAL-1). The launched app earns\n// its OWN grants — the only launcher→launched data path is the explicitly\n// delegated `capDir`/`capFile` in `input` (§5), attenuated + tainted + gated host-\n// side. The host owns the whole lifecycle (visibility, budget, revocation,\n// teardown); the launcher only OBSERVES via the handle.\n//\n// A caller that wants a typed value back uses `invokeTask` instead — the two are\n// siblings, not a replacement.\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\nimport { LAUNCH_DISMISS, LAUNCH_ENDED, PROTOCOL_LAUNCH } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** Where a launched program runs (§6). `overlay` covers the caller's own region\n *  with opaque host chrome; `stage` replaces the focal app (the elevated into-\n *  stage surface, §7 — refused above the stage-principal ceiling). */\nexport type LaunchRegion = 'overlay' | 'stage';\n\n/**\n * What to launch (§3) — binding-resolved, NEVER a caller-named app. Exactly one of:\n *  - `entryPoint`: a sibling entry point of the caller's OWN repo (the mini-app\n *    case, `AGENT_AUTHORING §5`) — **rejected `forbidden` until program-identity\n *    `appKey` lands** (R-SAL-2a);\n *  - `task`: a task contract (`open-project`, …), resolved through the user-\n *    overridable `task.<name>` binding to whichever app the user bound (§3 kind 2).\n */\nexport interface LaunchTarget {\n  /** Kind 1 — a sibling entry point of the caller's own repo (mini-app overlay). */\n  entryPoint?: string;\n  /** Kind 2 — a task contract name (the host resolves the bound provider). */\n  task?: string;\n  /** Optional accepted contract version for a `task` target (semver, e.g. `^1`). */\n  version?: string;\n}\n\nexport interface LaunchOptions {\n  /** Where it runs (§6). */\n  region: LaunchRegion;\n  /**\n   * Delegations + plain data handed to the launched app. `$cap:'dir'|'file'`\n   * markers (`capDir`/`capFile`, exported from `./tasks`) are resolved against the\n   * launcher's OWN grants and minted as attenuated, `ro`-by-default chroots (§5) —\n   * you can only delegate what you already hold. Everything else is plain data.\n   */\n  input?: Record<string, unknown>;\n}\n\n/** The live state of a launch (§2). Terminal states (`dismissed`/`revoked`/\n *  `failed`) are reached identically for self-exit, user dismiss, and host revoke —\n *  the host debounces so the launcher gets no timing oracle (R-SAL-1 / §6.4). */\nexport type LaunchStatus = 'running' | 'dismissed' | 'revoked' | 'failed';\n\n/** Machine codes a refused `launch` resolves with (§8). */\nexport type LaunchErrorCode =\n  | 'forbidden' // undeclared target; sibling (pre-AA-01); self-resolving target; stage cap absent\n  | 'unsupported' // no provider bound / entry point absent / unknown contract version\n  | 'budget' // over an R-SAL-8 concurrency/rate limit\n  | 'revoked' // a delegated mount was revoked during the create-and-bind window\n  | 'cancelled' // the user dismissed the host launch affordance (into-stage only)\n  | 'invalid-params' // a malformed `capDir`/`capFile` (`..`/absolute/mode-escalation)\n  | 'unknown';\n\n/**\n * The control channel back to a launch — the ONLY thing a launcher gets (§2).\n * There is no typed return value (R-SAL-1); `status`/`onDismiss` are debounced so\n * they cannot time-distinguish a self-exit from a user dismiss.\n */\nexport interface LaunchHandle {\n  /** Host-assigned id for this launch. */\n  readonly launchId: string;\n  /** The current lifecycle state (§2). */\n  readonly status: LaunchStatus;\n  /** Ask the host to tear this launch down. Idempotent (double-dismiss is a no-op). */\n  dismiss(): void;\n  /**\n   * Observe the launch ending (self-exit / user dismiss / host revoke — fired\n   * identically, R-SAL-1). Returns an unsubscribe fn. Fires at most once; if the\n   * launch has already ended it fires on the next tick.\n   */\n  onDismiss(cb: () => void): () => void;\n}\n\ninterface LaunchEndedMessage {\n  launchId: string;\n  status: Exclude<LaunchStatus, 'running'>;\n}\n\n/** Live handles awaiting their terminal `launch-ended` message, keyed by launchId. */\nconst liveHandles = new Map<string, LaunchHandleImpl>();\n\n/**\n * Terminal statuses that arrived BEFORE their handle existed, keyed by launchId.\n *\n * The window is real: `launch()` registers the listener before it sends `create`,\n * but the handle only enters `liveHandles` once the create RESPONSE resolves. A\n * short-lived launch (or a revoke during binding) can end inside that gap, and a\n * dropped terminal message leaves the handle `running` for ever with `onDismiss`\n * never firing — the one failure a launcher cannot detect or recover from. So the\n * message is BUFFERED and applied when the handle lands.\n *\n * Bounded, because the host is not this module's to trust: entries are only kept\n * while a create is actually in flight, and no more than {@link MAX_PENDING_ENDED}\n * of them (oldest evicted). A `launch-ended` for an id we never created is still\n * ignored, exactly as before.\n */\nconst pendingEnded = new Map<string, Exclude<LaunchStatus, 'running'>>();\nconst MAX_PENDING_ENDED = 16;\n/** How many `launch()` calls are between their create request and its response. */\nlet createsInFlight = 0;\n\n// The host delivers ONE `launch-ended` message per launch when it tears down —\n// the SAME message shape for self-exit, dismiss, and revoke (the host debounces\n// so the timing is not an oracle, §6.4). We fan it out to the matching handle, or\n// buffer it for a handle that has not landed yet (above).\n//\n// Registered LAZILY, on the first `launch()` call, not at module evaluation\n// (R3-421 — no subpath may throw at import time off-host). Unlike `task-input`\n// (tasks.ts), first-use registration loses nothing here: a `launch-ended` can only\n// ever follow a launch THIS module created, and `launch()` registers the listener\n// before it sends the create request — so the listener always exists before any\n// launchId it must match. That is a claim about the LISTENER only; the handle it\n// must reach can still be a response away, which is what `pendingEnded` covers.\nlet endedListenerRegistered = false;\nconst ensureEndedListener = (): void => {\n  if (endedListenerRegistered) return;\n  try {\n    addListener(LAUNCH_ENDED, (m: LaunchEndedMessage) => {\n      const h = liveHandles.get(m.launchId);\n      if (h) {\n        h._end(m.status);\n        return;\n      }\n      // No handle yet. Buffer only while a create could still produce one; anything\n      // else is a stale or unknown id and is ignored.\n      if (createsInFlight === 0) return;\n      if (pendingEnded.size >= MAX_PENDING_ENDED) {\n        const oldest = pendingEnded.keys().next();\n        if (!oldest.done) pendingEnded.delete(oldest.value);\n      }\n      pendingEnded.set(m.launchId, m.status);\n    });\n  } catch {\n    return; // off-host: no transport — the create request below will fail anyway\n  }\n  endedListenerRegistered = true;\n};\n\nclass LaunchHandleImpl implements LaunchHandle {\n  #status: LaunchStatus = 'running';\n  #dismissListeners = new Set<() => void>();\n  #ended = false;\n\n  constructor(readonly launchId: string) {\n    liveHandles.set(launchId, this);\n    // A terminal message that beat this handle into existence (see `pendingEnded`):\n    // apply it now, so the handle is born ended rather than stuck `running`.\n    const early = pendingEnded.get(launchId);\n    if (early !== undefined) {\n      pendingEnded.delete(launchId);\n      this._end(early);\n    }\n  }\n\n  get status(): LaunchStatus {\n    return this.#status;\n  }\n\n  dismiss(): void {\n    if (this.#ended) return;\n    // Fire-and-forget: the host owns teardown and answers with `launch-ended`,\n    // which drives `_end` (so status/onDismiss are host-authoritative, never\n    // optimistically local — a dismiss the host refuses would otherwise desync).\n    sendMessage(LAUNCH_DISMISS, { launchId: this.launchId });\n  }\n\n  onDismiss(cb: () => void): () => void {\n    if (this.#ended) {\n      // Already ended: fire on the next tick so the contract (\"returns an\n      // unsubscribe\") holds and the callback never runs synchronously mid-register.\n      queueMicrotask(cb);\n      return () => {};\n    }\n    this.#dismissListeners.add(cb);\n    return () => {\n      this.#dismissListeners.delete(cb);\n    };\n  }\n\n  /** Host-driven terminal transition — the only writer of `status`. Idempotent. */\n  _end(status: Exclude<LaunchStatus, 'running'>): void {\n    if (this.#ended) return;\n    this.#ended = true;\n    this.#status = status;\n    liveHandles.delete(this.launchId);\n    const listeners = [...this.#dismissListeners];\n    this.#dismissListeners.clear();\n    for (const l of listeners) {\n      try {\n        l();\n      } catch {\n        /* a launcher's own callback must never wedge teardown */\n      }\n    }\n  }\n}\n\n/**\n * Launch a bound program to RUN in a region (§2). Non-blocking: resolves once the\n * frame is created and bound, with a {@link LaunchHandle} — or a typed\n * `{ ok:false, code }` on refusal (§8), NEVER a throw for an ordinary refusal (so\n * a launcher branches on `code` without a try/catch). The launched app runs under\n * its OWN grants; the launcher's authority does not flow to it (R-SAL-4).\n *\n *   const h = await launch({ task: 'open-project' }, {\n *     region: 'stage',\n *     input: { dir: capDir({ mountId: 'space:abc', relPath: 'proj' }, { mode: 'ro' }) },\n *   });\n *   if ('ok' in h && h.ok === false) { ...handle h.code... }\n *   else { h.onDismiss(() => ...); }\n *\n * Off-host (plain `vite dev` — no host transport) it rejects with a plain\n * \"no host transport\" error: there is no host to run a launch in.\n */\nexport const launch = async (\n  target: LaunchTarget,\n  opts: LaunchOptions,\n): Promise<LaunchHandle | { ok: false; code: LaunchErrorCode }> => {\n  // Before the create request, so the terminal message can never beat the listener.\n  ensureEndedListener();\n  // The host wraps a successful handler return as `{ ok:true, data }` (the same\n  // Recipe-B framing `invokeTask` uses); a refusal is `{ ok:false, code }`.\n  createsInFlight += 1;\n  let res: { ok: true; data: { launchId: string } } | { ok: false; code?: LaunchErrorCode } | undefined;\n  try {\n    res = (await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], 'create', [{ target, opts }])) as typeof res;\n  } finally {\n    createsInFlight -= 1;\n  }\n  // Once nothing is in flight, anything still buffered belongs to a launch that will\n  // never produce a handle — drop it rather than keep it for ever. Done AFTER the\n  // handle below is constructed (its constructor drains its own entry first), so the\n  // sweep can never eat the message this very call was waiting for.\n  const sweep = (): void => {\n    if (createsInFlight === 0) pendingEnded.clear();\n  };\n  if (!res || res.ok !== true || !res.data?.launchId) {\n    sweep();\n    const code = res && res.ok === false ? res.code ?? 'unknown' : 'unknown';\n    return { ok: false, code };\n  }\n  // The constructor drains a terminal message that arrived while `create` was in\n  // flight, so this handle can be returned already-ended rather than stuck `running`.\n  const handle = new LaunchHandleImpl(res.data.launchId);\n  sweep();\n  return handle;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,0BAA0D;AAC1D,sBAA8D;AAC9D,6BAAwB;AAbxB;AA0FA,MAAM,cAAc,oBAAI,IAA8B;AAiBtD,MAAM,eAAe,oBAAI,IAA8C;AACvE,MAAM,oBAAoB;AAE1B,IAAI,kBAAkB;AActB,IAAI,0BAA0B;AAC9B,MAAM,sBAAsB,MAAY;AACtC,MAAI,wBAAyB;AAC7B,MAAI;AACF,yCAAY,8BAAc,CAAC,MAA0B;AACnD,YAAM,IAAI,YAAY,IAAI,EAAE,QAAQ;AACpC,UAAI,GAAG;AACL,UAAE,KAAK,EAAE,MAAM;AACf;AAAA,MACF;AAGA,UAAI,oBAAoB,EAAG;AAC3B,UAAI,aAAa,QAAQ,mBAAmB;AAC1C,cAAM,SAAS,aAAa,KAAK,EAAE,KAAK;AACxC,YAAI,CAAC,OAAO,KAAM,cAAa,OAAO,OAAO,KAAK;AAAA,MACpD;AACA,mBAAa,IAAI,EAAE,UAAU,EAAE,MAAM;AAAA,IACvC,CAAC;AAAA,EACH,QAAQ;AACN;AAAA,EACF;AACA,4BAA0B;AAC5B;AAEA,MAAM,iBAAyC;AAAA,EAK7C,YAAqB,UAAkB;AAAlB;AAJrB,gCAAwB;AACxB,0CAAoB,oBAAI,IAAgB;AACxC,+BAAS;AAGP,gBAAY,IAAI,UAAU,IAAI;AAG9B,UAAM,QAAQ,aAAa,IAAI,QAAQ;AACvC,QAAI,UAAU,QAAW;AACvB,mBAAa,OAAO,QAAQ;AAC5B,WAAK,KAAK,KAAK;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,IAAI,SAAuB;AACzB,WAAO,mBAAK;AAAA,EACd;AAAA,EAEA,UAAgB;AACd,QAAI,mBAAK,QAAQ;AAIjB,yCAAY,gCAAgB,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EACzD;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,mBAAK,SAAQ;AAGf,qBAAe,EAAE;AACjB,aAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AACA,uBAAK,mBAAkB,IAAI,EAAE;AAC7B,WAAO,MAAM;AACX,yBAAK,mBAAkB,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,KAAK,QAAgD;AACnD,QAAI,mBAAK,QAAQ;AACjB,uBAAK,QAAS;AACd,uBAAK,SAAU;AACf,gBAAY,OAAO,KAAK,QAAQ;AAChC,UAAM,YAAY,CAAC,GAAG,mBAAK,kBAAiB;AAC5C,uBAAK,mBAAkB,MAAM;AAC7B,eAAW,KAAK,WAAW;AACzB,UAAI;AACF,UAAE;AAAA,MACJ,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAxDE;AACA;AACA;AAyEK,MAAM,SAAS,OACpB,QACA,SACiE;AAEjE,sBAAoB;AAGpB,qBAAmB;AACnB,MAAI;AACJ,MAAI;AACF,UAAO,UAAM,qCAAgB,+BAAQ,+BAAe,GAAG,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,EACrF,UAAE;AACA,uBAAmB;AAAA,EACrB;AAKA,QAAM,QAAQ,MAAY;AACxB,QAAI,oBAAoB,EAAG,cAAa,MAAM;AAAA,EAChD;AACA,MAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,IAAI,MAAM,UAAU;AAClD,UAAM;AACN,UAAM,OAAO,OAAO,IAAI,OAAO,QAAQ,IAAI,QAAQ,YAAY;AAC/D,WAAO,EAAE,IAAI,OAAO,KAAK;AAAA,EAC3B;AAGA,QAAM,SAAS,IAAI,iBAAiB,IAAI,KAAK,QAAQ;AACrD,QAAM;AACN,SAAO;AACT;","names":[]}

package/dist/launch.d.cts

@@ -67,6 +67,9 @@ interface LaunchHandle {
  *   });
  *   if ('ok' in h && h.ok === false) { ...handle h.code... }
  *   else { h.onDismiss(() => ...); }
+ *
+ * Off-host (plain `vite dev` — no host transport) it rejects with a plain
+ * "no host transport" error: there is no host to run a launch in.
  */
 declare const launch: (target: LaunchTarget, opts: LaunchOptions) => Promise<LaunchHandle | {
     ok: false;

package/dist/launch.d.ts

@@ -67,6 +67,9 @@ interface LaunchHandle {
  *   });
  *   if ('ok' in h && h.ok === false) { ...handle h.code... }
  *   else { h.onDismiss(() => ...); }
+ *
+ * Off-host (plain `vite dev` — no host transport) it rejects with a plain
+ * "no host transport" error: there is no host to run a launch in.
  */
 declare const launch: (target: LaunchTarget, opts: LaunchOptions) => Promise<LaunchHandle | {
     ok: false;

package/dist/launch.js

@@ -8,10 +8,31 @@ import { protocolRequest, sendMessage, addListener } from "./sandboxUtils";
 import { LAUNCH_DISMISS, LAUNCH_ENDED, PROTOCOL_LAUNCH } from "./generated/protocol";
 import { SCHEMES } from "./protocolSchemes";
 const liveHandles = /* @__PURE__ */ new Map();
-addListener(LAUNCH_ENDED, (m) => {
-  const h = liveHandles.get(m.launchId);
-  if (h) h._end(m.status);
-});
+const pendingEnded = /* @__PURE__ */ new Map();
+const MAX_PENDING_ENDED = 16;
+let createsInFlight = 0;
+let endedListenerRegistered = false;
+const ensureEndedListener = () => {
+  if (endedListenerRegistered) return;
+  try {
+    addListener(LAUNCH_ENDED, (m) => {
+      const h = liveHandles.get(m.launchId);
+      if (h) {
+        h._end(m.status);
+        return;
+      }
+      if (createsInFlight === 0) return;
+      if (pendingEnded.size >= MAX_PENDING_ENDED) {
+        const oldest = pendingEnded.keys().next();
+        if (!oldest.done) pendingEnded.delete(oldest.value);
+      }
+      pendingEnded.set(m.launchId, m.status);
+    });
+  } catch {
+    return;
+  }
+  endedListenerRegistered = true;
+};
 class LaunchHandleImpl {
   constructor(launchId) {
     this.launchId = launchId;
@@ -19,6 +40,11 @@ class LaunchHandleImpl {
     __privateAdd(this, _dismissListeners, /* @__PURE__ */ new Set());
     __privateAdd(this, _ended, false);
     liveHandles.set(launchId, this);
+    const early = pendingEnded.get(launchId);
+    if (early !== void 0) {
+      pendingEnded.delete(launchId);
+      this._end(early);
+    }
   }
   get status() {
     return __privateGet(this, _status);
@@ -58,12 +84,25 @@ _status = new WeakMap();
 _dismissListeners = new WeakMap();
 _ended = new WeakMap();
 const launch = async (target, opts) => {
-  const res = await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], "create", [{ target, opts }]);
+  ensureEndedListener();
+  createsInFlight += 1;
+  let res;
+  try {
+    res = await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], "create", [{ target, opts }]);
+  } finally {
+    createsInFlight -= 1;
+  }
+  const sweep = () => {
+    if (createsInFlight === 0) pendingEnded.clear();
+  };
   if (!res || res.ok !== true || !res.data?.launchId) {
+    sweep();
     const code = res && res.ok === false ? res.code ?? "unknown" : "unknown";
     return { ok: false, code };
   }
-  return new LaunchHandleImpl(res.data.launchId);
+  const handle = new LaunchHandleImpl(res.data.launchId);
+  sweep();
+  return handle;
 };
 export {
   launch

package/dist/launch.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/launch.ts"],"sourcesContent":["// Launch — the TO-RUN twin of `invokeTask` (STANDING_APP_LIFECYCLE_SPEC §1–§6).\n// Where `invokeTask` is FOR-RESULT (await one value, callee exits), `launch` is\n// TO-RUN (non-blocking, standing): it starts a bound program RUNNING in a region\n// and hands back a HANDLE, never a typed value (R-SAL-1). The launched app earns\n// its OWN grants — the only launcher→launched data path is the explicitly\n// delegated `capDir`/`capFile` in `input` (§5), attenuated + tainted + gated host-\n// side. The host owns the whole lifecycle (visibility, budget, revocation,\n// teardown); the launcher only OBSERVES via the handle.\n//\n// A caller that wants a typed value back uses `invokeTask` instead — the two are\n// siblings, not a replacement.\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\nimport { LAUNCH_DISMISS, LAUNCH_ENDED, PROTOCOL_LAUNCH } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** Where a launched program runs (§6). `overlay` covers the caller's own region\n *  with opaque host chrome; `stage` replaces the focal app (the elevated into-\n *  stage surface, §7 — refused above the stage-principal ceiling). */\nexport type LaunchRegion = 'overlay' | 'stage';\n\n/**\n * What to launch (§3) — binding-resolved, NEVER a caller-named app. Exactly one of:\n *  - `entryPoint`: a sibling entry point of the caller's OWN repo (the mini-app\n *    case, `AGENT_AUTHORING §5`) — **rejected `forbidden` until program-identity\n *    `appKey` lands** (R-SAL-2a);\n *  - `task`: a task contract (`open-project`, …), resolved through the user-\n *    overridable `task.<name>` binding to whichever app the user bound (§3 kind 2).\n */\nexport interface LaunchTarget {\n  /** Kind 1 — a sibling entry point of the caller's own repo (mini-app overlay). */\n  entryPoint?: string;\n  /** Kind 2 — a task contract name (the host resolves the bound provider). */\n  task?: string;\n  /** Optional accepted contract version for a `task` target (semver, e.g. `^1`). */\n  version?: string;\n}\n\nexport interface LaunchOptions {\n  /** Where it runs (§6). */\n  region: LaunchRegion;\n  /**\n   * Delegations + plain data handed to the launched app. `$cap:'dir'|'file'`\n   * markers (`capDir`/`capFile`, exported from `./tasks`) are resolved against the\n   * launcher's OWN grants and minted as attenuated, `ro`-by-default chroots (§5) —\n   * you can only delegate what you already hold. Everything else is plain data.\n   */\n  input?: Record<string, unknown>;\n}\n\n/** The live state of a launch (§2). Terminal states (`dismissed`/`revoked`/\n *  `failed`) are reached identically for self-exit, user dismiss, and host revoke —\n *  the host debounces so the launcher gets no timing oracle (R-SAL-1 / §6.4). */\nexport type LaunchStatus = 'running' | 'dismissed' | 'revoked' | 'failed';\n\n/** Machine codes a refused `launch` resolves with (§8). */\nexport type LaunchErrorCode =\n  | 'forbidden' // undeclared target; sibling (pre-AA-01); self-resolving target; stage cap absent\n  | 'unsupported' // no provider bound / entry point absent / unknown contract version\n  | 'budget' // over an R-SAL-8 concurrency/rate limit\n  | 'revoked' // a delegated mount was revoked during the create-and-bind window\n  | 'cancelled' // the user dismissed the host launch affordance (into-stage only)\n  | 'invalid-params' // a malformed `capDir`/`capFile` (`..`/absolute/mode-escalation)\n  | 'unknown';\n\n/**\n * The control channel back to a launch — the ONLY thing a launcher gets (§2).\n * There is no typed return value (R-SAL-1); `status`/`onDismiss` are debounced so\n * they cannot time-distinguish a self-exit from a user dismiss.\n */\nexport interface LaunchHandle {\n  /** Host-assigned id for this launch. */\n  readonly launchId: string;\n  /** The current lifecycle state (§2). */\n  readonly status: LaunchStatus;\n  /** Ask the host to tear this launch down. Idempotent (double-dismiss is a no-op). */\n  dismiss(): void;\n  /**\n   * Observe the launch ending (self-exit / user dismiss / host revoke — fired\n   * identically, R-SAL-1). Returns an unsubscribe fn. Fires at most once; if the\n   * launch has already ended it fires on the next tick.\n   */\n  onDismiss(cb: () => void): () => void;\n}\n\ninterface LaunchEndedMessage {\n  launchId: string;\n  status: Exclude<LaunchStatus, 'running'>;\n}\n\n/** Live handles awaiting their terminal `launch-ended` message, keyed by launchId. */\nconst liveHandles = new Map<string, LaunchHandleImpl>();\n\n// The host delivers ONE `launch-ended` message per launch when it tears down —\n// the SAME message shape for self-exit, dismiss, and revoke (the host debounces\n// so the timing is not an oracle, §6.4). We fan it out to the matching handle.\naddListener(LAUNCH_ENDED, (m: LaunchEndedMessage) => {\n  const h = liveHandles.get(m.launchId);\n  if (h) h._end(m.status);\n});\n\nclass LaunchHandleImpl implements LaunchHandle {\n  #status: LaunchStatus = 'running';\n  #dismissListeners = new Set<() => void>();\n  #ended = false;\n\n  constructor(readonly launchId: string) {\n    liveHandles.set(launchId, this);\n  }\n\n  get status(): LaunchStatus {\n    return this.#status;\n  }\n\n  dismiss(): void {\n    if (this.#ended) return;\n    // Fire-and-forget: the host owns teardown and answers with `launch-ended`,\n    // which drives `_end` (so status/onDismiss are host-authoritative, never\n    // optimistically local — a dismiss the host refuses would otherwise desync).\n    sendMessage(LAUNCH_DISMISS, { launchId: this.launchId });\n  }\n\n  onDismiss(cb: () => void): () => void {\n    if (this.#ended) {\n      // Already ended: fire on the next tick so the contract (\"returns an\n      // unsubscribe\") holds and the callback never runs synchronously mid-register.\n      queueMicrotask(cb);\n      return () => {};\n    }\n    this.#dismissListeners.add(cb);\n    return () => {\n      this.#dismissListeners.delete(cb);\n    };\n  }\n\n  /** Host-driven terminal transition — the only writer of `status`. Idempotent. */\n  _end(status: Exclude<LaunchStatus, 'running'>): void {\n    if (this.#ended) return;\n    this.#ended = true;\n    this.#status = status;\n    liveHandles.delete(this.launchId);\n    const listeners = [...this.#dismissListeners];\n    this.#dismissListeners.clear();\n    for (const l of listeners) {\n      try {\n        l();\n      } catch {\n        /* a launcher's own callback must never wedge teardown */\n      }\n    }\n  }\n}\n\n/**\n * Launch a bound program to RUN in a region (§2). Non-blocking: resolves once the\n * frame is created and bound, with a {@link LaunchHandle} — or a typed\n * `{ ok:false, code }` on refusal (§8), NEVER a throw for an ordinary refusal (so\n * a launcher branches on `code` without a try/catch). The launched app runs under\n * its OWN grants; the launcher's authority does not flow to it (R-SAL-4).\n *\n *   const h = await launch({ task: 'open-project' }, {\n *     region: 'stage',\n *     input: { dir: capDir({ mountId: 'space:abc', relPath: 'proj' }, { mode: 'ro' }) },\n *   });\n *   if ('ok' in h && h.ok === false) { ...handle h.code... }\n *   else { h.onDismiss(() => ...); }\n */\nexport const launch = async (\n  target: LaunchTarget,\n  opts: LaunchOptions,\n): Promise<LaunchHandle | { ok: false; code: LaunchErrorCode }> => {\n  // The host wraps a successful handler return as `{ ok:true, data }` (the same\n  // Recipe-B framing `invokeTask` uses); a refusal is `{ ok:false, code }`.\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], 'create', [{ target, opts }])) as\n    | { ok: true; data: { launchId: string } }\n    | { ok: false; code?: LaunchErrorCode }\n    | undefined;\n  if (!res || res.ok !== true || !res.data?.launchId) {\n    const code = res && res.ok === false ? res.code ?? 'unknown' : 'unknown';\n    return { ok: false, code };\n  }\n  return new LaunchHandleImpl(res.data.launchId);\n};\n"],"mappings":";;;;;AAAA;AAWA,SAAS,iBAAiB,aAAa,mBAAmB;AAC1D,SAAS,gBAAgB,cAAc,uBAAuB;AAC9D,SAAS,eAAe;AA6ExB,MAAM,cAAc,oBAAI,IAA8B;AAKtD,YAAY,cAAc,CAAC,MAA0B;AACnD,QAAM,IAAI,YAAY,IAAI,EAAE,QAAQ;AACpC,MAAI,EAAG,GAAE,KAAK,EAAE,MAAM;AACxB,CAAC;AAED,MAAM,iBAAyC;AAAA,EAK7C,YAAqB,UAAkB;AAAlB;AAJrB,gCAAwB;AACxB,0CAAoB,oBAAI,IAAgB;AACxC,+BAAS;AAGP,gBAAY,IAAI,UAAU,IAAI;AAAA,EAChC;AAAA,EAEA,IAAI,SAAuB;AACzB,WAAO,mBAAK;AAAA,EACd;AAAA,EAEA,UAAgB;AACd,QAAI,mBAAK,QAAQ;AAIjB,gBAAY,gBAAgB,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EACzD;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,mBAAK,SAAQ;AAGf,qBAAe,EAAE;AACjB,aAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AACA,uBAAK,mBAAkB,IAAI,EAAE;AAC7B,WAAO,MAAM;AACX,yBAAK,mBAAkB,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,KAAK,QAAgD;AACnD,QAAI,mBAAK,QAAQ;AACjB,uBAAK,QAAS;AACd,uBAAK,SAAU;AACf,gBAAY,OAAO,KAAK,QAAQ;AAChC,UAAM,YAAY,CAAC,GAAG,mBAAK,kBAAiB;AAC5C,uBAAK,mBAAkB,MAAM;AAC7B,eAAW,KAAK,WAAW;AACzB,UAAI;AACF,UAAE;AAAA,MACJ,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAjDE;AACA;AACA;AA+DK,MAAM,SAAS,OACpB,QACA,SACiE;AAGjE,QAAM,MAAO,MAAM,gBAAgB,QAAQ,eAAe,GAAG,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC;AAIzF,MAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,IAAI,MAAM,UAAU;AAClD,UAAM,OAAO,OAAO,IAAI,OAAO,QAAQ,IAAI,QAAQ,YAAY;AAC/D,WAAO,EAAE,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,SAAO,IAAI,iBAAiB,IAAI,KAAK,QAAQ;AAC/C;","names":[]}
+{"version":3,"sources":["../src/launch.ts"],"sourcesContent":["// Launch — the TO-RUN twin of `invokeTask` (STANDING_APP_LIFECYCLE_SPEC §1–§6).\n// Where `invokeTask` is FOR-RESULT (await one value, callee exits), `launch` is\n// TO-RUN (non-blocking, standing): it starts a bound program RUNNING in a region\n// and hands back a HANDLE, never a typed value (R-SAL-1). The launched app earns\n// its OWN grants — the only launcher→launched data path is the explicitly\n// delegated `capDir`/`capFile` in `input` (§5), attenuated + tainted + gated host-\n// side. The host owns the whole lifecycle (visibility, budget, revocation,\n// teardown); the launcher only OBSERVES via the handle.\n//\n// A caller that wants a typed value back uses `invokeTask` instead — the two are\n// siblings, not a replacement.\nimport { protocolRequest, sendMessage, addListener } from './sandboxUtils';\nimport { LAUNCH_DISMISS, LAUNCH_ENDED, PROTOCOL_LAUNCH } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** Where a launched program runs (§6). `overlay` covers the caller's own region\n *  with opaque host chrome; `stage` replaces the focal app (the elevated into-\n *  stage surface, §7 — refused above the stage-principal ceiling). */\nexport type LaunchRegion = 'overlay' | 'stage';\n\n/**\n * What to launch (§3) — binding-resolved, NEVER a caller-named app. Exactly one of:\n *  - `entryPoint`: a sibling entry point of the caller's OWN repo (the mini-app\n *    case, `AGENT_AUTHORING §5`) — **rejected `forbidden` until program-identity\n *    `appKey` lands** (R-SAL-2a);\n *  - `task`: a task contract (`open-project`, …), resolved through the user-\n *    overridable `task.<name>` binding to whichever app the user bound (§3 kind 2).\n */\nexport interface LaunchTarget {\n  /** Kind 1 — a sibling entry point of the caller's own repo (mini-app overlay). */\n  entryPoint?: string;\n  /** Kind 2 — a task contract name (the host resolves the bound provider). */\n  task?: string;\n  /** Optional accepted contract version for a `task` target (semver, e.g. `^1`). */\n  version?: string;\n}\n\nexport interface LaunchOptions {\n  /** Where it runs (§6). */\n  region: LaunchRegion;\n  /**\n   * Delegations + plain data handed to the launched app. `$cap:'dir'|'file'`\n   * markers (`capDir`/`capFile`, exported from `./tasks`) are resolved against the\n   * launcher's OWN grants and minted as attenuated, `ro`-by-default chroots (§5) —\n   * you can only delegate what you already hold. Everything else is plain data.\n   */\n  input?: Record<string, unknown>;\n}\n\n/** The live state of a launch (§2). Terminal states (`dismissed`/`revoked`/\n *  `failed`) are reached identically for self-exit, user dismiss, and host revoke —\n *  the host debounces so the launcher gets no timing oracle (R-SAL-1 / §6.4). */\nexport type LaunchStatus = 'running' | 'dismissed' | 'revoked' | 'failed';\n\n/** Machine codes a refused `launch` resolves with (§8). */\nexport type LaunchErrorCode =\n  | 'forbidden' // undeclared target; sibling (pre-AA-01); self-resolving target; stage cap absent\n  | 'unsupported' // no provider bound / entry point absent / unknown contract version\n  | 'budget' // over an R-SAL-8 concurrency/rate limit\n  | 'revoked' // a delegated mount was revoked during the create-and-bind window\n  | 'cancelled' // the user dismissed the host launch affordance (into-stage only)\n  | 'invalid-params' // a malformed `capDir`/`capFile` (`..`/absolute/mode-escalation)\n  | 'unknown';\n\n/**\n * The control channel back to a launch — the ONLY thing a launcher gets (§2).\n * There is no typed return value (R-SAL-1); `status`/`onDismiss` are debounced so\n * they cannot time-distinguish a self-exit from a user dismiss.\n */\nexport interface LaunchHandle {\n  /** Host-assigned id for this launch. */\n  readonly launchId: string;\n  /** The current lifecycle state (§2). */\n  readonly status: LaunchStatus;\n  /** Ask the host to tear this launch down. Idempotent (double-dismiss is a no-op). */\n  dismiss(): void;\n  /**\n   * Observe the launch ending (self-exit / user dismiss / host revoke — fired\n   * identically, R-SAL-1). Returns an unsubscribe fn. Fires at most once; if the\n   * launch has already ended it fires on the next tick.\n   */\n  onDismiss(cb: () => void): () => void;\n}\n\ninterface LaunchEndedMessage {\n  launchId: string;\n  status: Exclude<LaunchStatus, 'running'>;\n}\n\n/** Live handles awaiting their terminal `launch-ended` message, keyed by launchId. */\nconst liveHandles = new Map<string, LaunchHandleImpl>();\n\n/**\n * Terminal statuses that arrived BEFORE their handle existed, keyed by launchId.\n *\n * The window is real: `launch()` registers the listener before it sends `create`,\n * but the handle only enters `liveHandles` once the create RESPONSE resolves. A\n * short-lived launch (or a revoke during binding) can end inside that gap, and a\n * dropped terminal message leaves the handle `running` for ever with `onDismiss`\n * never firing — the one failure a launcher cannot detect or recover from. So the\n * message is BUFFERED and applied when the handle lands.\n *\n * Bounded, because the host is not this module's to trust: entries are only kept\n * while a create is actually in flight, and no more than {@link MAX_PENDING_ENDED}\n * of them (oldest evicted). A `launch-ended` for an id we never created is still\n * ignored, exactly as before.\n */\nconst pendingEnded = new Map<string, Exclude<LaunchStatus, 'running'>>();\nconst MAX_PENDING_ENDED = 16;\n/** How many `launch()` calls are between their create request and its response. */\nlet createsInFlight = 0;\n\n// The host delivers ONE `launch-ended` message per launch when it tears down —\n// the SAME message shape for self-exit, dismiss, and revoke (the host debounces\n// so the timing is not an oracle, §6.4). We fan it out to the matching handle, or\n// buffer it for a handle that has not landed yet (above).\n//\n// Registered LAZILY, on the first `launch()` call, not at module evaluation\n// (R3-421 — no subpath may throw at import time off-host). Unlike `task-input`\n// (tasks.ts), first-use registration loses nothing here: a `launch-ended` can only\n// ever follow a launch THIS module created, and `launch()` registers the listener\n// before it sends the create request — so the listener always exists before any\n// launchId it must match. That is a claim about the LISTENER only; the handle it\n// must reach can still be a response away, which is what `pendingEnded` covers.\nlet endedListenerRegistered = false;\nconst ensureEndedListener = (): void => {\n  if (endedListenerRegistered) return;\n  try {\n    addListener(LAUNCH_ENDED, (m: LaunchEndedMessage) => {\n      const h = liveHandles.get(m.launchId);\n      if (h) {\n        h._end(m.status);\n        return;\n      }\n      // No handle yet. Buffer only while a create could still produce one; anything\n      // else is a stale or unknown id and is ignored.\n      if (createsInFlight === 0) return;\n      if (pendingEnded.size >= MAX_PENDING_ENDED) {\n        const oldest = pendingEnded.keys().next();\n        if (!oldest.done) pendingEnded.delete(oldest.value);\n      }\n      pendingEnded.set(m.launchId, m.status);\n    });\n  } catch {\n    return; // off-host: no transport — the create request below will fail anyway\n  }\n  endedListenerRegistered = true;\n};\n\nclass LaunchHandleImpl implements LaunchHandle {\n  #status: LaunchStatus = 'running';\n  #dismissListeners = new Set<() => void>();\n  #ended = false;\n\n  constructor(readonly launchId: string) {\n    liveHandles.set(launchId, this);\n    // A terminal message that beat this handle into existence (see `pendingEnded`):\n    // apply it now, so the handle is born ended rather than stuck `running`.\n    const early = pendingEnded.get(launchId);\n    if (early !== undefined) {\n      pendingEnded.delete(launchId);\n      this._end(early);\n    }\n  }\n\n  get status(): LaunchStatus {\n    return this.#status;\n  }\n\n  dismiss(): void {\n    if (this.#ended) return;\n    // Fire-and-forget: the host owns teardown and answers with `launch-ended`,\n    // which drives `_end` (so status/onDismiss are host-authoritative, never\n    // optimistically local — a dismiss the host refuses would otherwise desync).\n    sendMessage(LAUNCH_DISMISS, { launchId: this.launchId });\n  }\n\n  onDismiss(cb: () => void): () => void {\n    if (this.#ended) {\n      // Already ended: fire on the next tick so the contract (\"returns an\n      // unsubscribe\") holds and the callback never runs synchronously mid-register.\n      queueMicrotask(cb);\n      return () => {};\n    }\n    this.#dismissListeners.add(cb);\n    return () => {\n      this.#dismissListeners.delete(cb);\n    };\n  }\n\n  /** Host-driven terminal transition — the only writer of `status`. Idempotent. */\n  _end(status: Exclude<LaunchStatus, 'running'>): void {\n    if (this.#ended) return;\n    this.#ended = true;\n    this.#status = status;\n    liveHandles.delete(this.launchId);\n    const listeners = [...this.#dismissListeners];\n    this.#dismissListeners.clear();\n    for (const l of listeners) {\n      try {\n        l();\n      } catch {\n        /* a launcher's own callback must never wedge teardown */\n      }\n    }\n  }\n}\n\n/**\n * Launch a bound program to RUN in a region (§2). Non-blocking: resolves once the\n * frame is created and bound, with a {@link LaunchHandle} — or a typed\n * `{ ok:false, code }` on refusal (§8), NEVER a throw for an ordinary refusal (so\n * a launcher branches on `code` without a try/catch). The launched app runs under\n * its OWN grants; the launcher's authority does not flow to it (R-SAL-4).\n *\n *   const h = await launch({ task: 'open-project' }, {\n *     region: 'stage',\n *     input: { dir: capDir({ mountId: 'space:abc', relPath: 'proj' }, { mode: 'ro' }) },\n *   });\n *   if ('ok' in h && h.ok === false) { ...handle h.code... }\n *   else { h.onDismiss(() => ...); }\n *\n * Off-host (plain `vite dev` — no host transport) it rejects with a plain\n * \"no host transport\" error: there is no host to run a launch in.\n */\nexport const launch = async (\n  target: LaunchTarget,\n  opts: LaunchOptions,\n): Promise<LaunchHandle | { ok: false; code: LaunchErrorCode }> => {\n  // Before the create request, so the terminal message can never beat the listener.\n  ensureEndedListener();\n  // The host wraps a successful handler return as `{ ok:true, data }` (the same\n  // Recipe-B framing `invokeTask` uses); a refusal is `{ ok:false, code }`.\n  createsInFlight += 1;\n  let res: { ok: true; data: { launchId: string } } | { ok: false; code?: LaunchErrorCode } | undefined;\n  try {\n    res = (await protocolRequest(SCHEMES[PROTOCOL_LAUNCH], 'create', [{ target, opts }])) as typeof res;\n  } finally {\n    createsInFlight -= 1;\n  }\n  // Once nothing is in flight, anything still buffered belongs to a launch that will\n  // never produce a handle — drop it rather than keep it for ever. Done AFTER the\n  // handle below is constructed (its constructor drains its own entry first), so the\n  // sweep can never eat the message this very call was waiting for.\n  const sweep = (): void => {\n    if (createsInFlight === 0) pendingEnded.clear();\n  };\n  if (!res || res.ok !== true || !res.data?.launchId) {\n    sweep();\n    const code = res && res.ok === false ? res.code ?? 'unknown' : 'unknown';\n    return { ok: false, code };\n  }\n  // The constructor drains a terminal message that arrived while `create` was in\n  // flight, so this handle can be returned already-ended rather than stuck `running`.\n  const handle = new LaunchHandleImpl(res.data.launchId);\n  sweep();\n  return handle;\n};\n"],"mappings":";;;;;AAAA;AAWA,SAAS,iBAAiB,aAAa,mBAAmB;AAC1D,SAAS,gBAAgB,cAAc,uBAAuB;AAC9D,SAAS,eAAe;AA6ExB,MAAM,cAAc,oBAAI,IAA8B;AAiBtD,MAAM,eAAe,oBAAI,IAA8C;AACvE,MAAM,oBAAoB;AAE1B,IAAI,kBAAkB;AActB,IAAI,0BAA0B;AAC9B,MAAM,sBAAsB,MAAY;AACtC,MAAI,wBAAyB;AAC7B,MAAI;AACF,gBAAY,cAAc,CAAC,MAA0B;AACnD,YAAM,IAAI,YAAY,IAAI,EAAE,QAAQ;AACpC,UAAI,GAAG;AACL,UAAE,KAAK,EAAE,MAAM;AACf;AAAA,MACF;AAGA,UAAI,oBAAoB,EAAG;AAC3B,UAAI,aAAa,QAAQ,mBAAmB;AAC1C,cAAM,SAAS,aAAa,KAAK,EAAE,KAAK;AACxC,YAAI,CAAC,OAAO,KAAM,cAAa,OAAO,OAAO,KAAK;AAAA,MACpD;AACA,mBAAa,IAAI,EAAE,UAAU,EAAE,MAAM;AAAA,IACvC,CAAC;AAAA,EACH,QAAQ;AACN;AAAA,EACF;AACA,4BAA0B;AAC5B;AAEA,MAAM,iBAAyC;AAAA,EAK7C,YAAqB,UAAkB;AAAlB;AAJrB,gCAAwB;AACxB,0CAAoB,oBAAI,IAAgB;AACxC,+BAAS;AAGP,gBAAY,IAAI,UAAU,IAAI;AAG9B,UAAM,QAAQ,aAAa,IAAI,QAAQ;AACvC,QAAI,UAAU,QAAW;AACvB,mBAAa,OAAO,QAAQ;AAC5B,WAAK,KAAK,KAAK;AAAA,IACjB;AAAA,EACF;AAAA,EAEA,IAAI,SAAuB;AACzB,WAAO,mBAAK;AAAA,EACd;AAAA,EAEA,UAAgB;AACd,QAAI,mBAAK,QAAQ;AAIjB,gBAAY,gBAAgB,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,EACzD;AAAA,EAEA,UAAU,IAA4B;AACpC,QAAI,mBAAK,SAAQ;AAGf,qBAAe,EAAE;AACjB,aAAO,MAAM;AAAA,MAAC;AAAA,IAChB;AACA,uBAAK,mBAAkB,IAAI,EAAE;AAC7B,WAAO,MAAM;AACX,yBAAK,mBAAkB,OAAO,EAAE;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,KAAK,QAAgD;AACnD,QAAI,mBAAK,QAAQ;AACjB,uBAAK,QAAS;AACd,uBAAK,SAAU;AACf,gBAAY,OAAO,KAAK,QAAQ;AAChC,UAAM,YAAY,CAAC,GAAG,mBAAK,kBAAiB;AAC5C,uBAAK,mBAAkB,MAAM;AAC7B,eAAW,KAAK,WAAW;AACzB,UAAI;AACF,UAAE;AAAA,MACJ,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;AAxDE;AACA;AACA;AAyEK,MAAM,SAAS,OACpB,QACA,SACiE;AAEjE,sBAAoB;AAGpB,qBAAmB;AACnB,MAAI;AACJ,MAAI;AACF,UAAO,MAAM,gBAAgB,QAAQ,eAAe,GAAG,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,CAAC;AAAA,EACrF,UAAE;AACA,uBAAmB;AAAA,EACrB;AAKA,QAAM,QAAQ,MAAY;AACxB,QAAI,oBAAoB,EAAG,cAAa,MAAM;AAAA,EAChD;AACA,MAAI,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,IAAI,MAAM,UAAU;AAClD,UAAM;AACN,UAAM,OAAO,OAAO,IAAI,OAAO,QAAQ,IAAI,QAAQ,YAAY;AAC/D,WAAO,EAAE,IAAI,OAAO,KAAK;AAAA,EAC3B;AAGA,QAAM,SAAS,IAAI,iBAAiB,IAAI,KAAK,QAAQ;AACrD,QAAM;AACN,SAAO;AACT;","names":[]}

package/dist/llm.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/llm.ts"],"sourcesContent":["// Provider-agnostic LLM chat — the `llm.chat@1` slot (SERVICE_PROVIDERS_SPEC;\n// LLM_AND_AGENTS_SPEC §8 D5).\n//\n// An app calls ONE chat slot and never worries about which provider the user has a\n// key for: the HOST resolves which vendor answers from the key the user holds\n// (`SecretView.boundOrigin`) plus their `preferredImplementation` choice, normalizes\n// the wire format, injects the key host-side at the §6 net:fetch point (the\n// look-at-nothing proxy), and streams normalized deltas back. The app never names a\n// vendor, never sees the key, and needs NO `net:fetch`/`secrets` grant of its own —\n// only the `llm:chat` capability (elevated, app-scoped: a fork earns it by consent).\n//\n// Inert until the host implements `protocol-llm` (the `chat` stream) + the\n// `llm-provider` describe channel; the contract ships here so apps (the file-explorer\n// summarize fork) can be written against it — exactly how `secrets.ts` shipped ahead\n// of `protocol-secrets`.\nimport { invokeStream } from './catalog';\nimport { createPushChannel } from './pushChannel';\nimport { LLM_PROVIDER, REQUEST_LLM_PROVIDER } from './generated/protocol';\n\n/** Who authored a {@link ChatMessage}. */\nexport type ChatRole = 'system' | 'user' | 'assistant' | 'tool';\n\n/** A part of a message. `image` is only honored when the resolved provider\n *  advertises `features.vision` (§2.5); `tool-use`/`tool-result` only when it\n *  advertises `features.tools` — branch on {@link describeChat} first. */\nexport type ContentPart =\n  | { type: 'text'; text: string }\n  | { type: 'image'; mimeType: string; data: string } // data: base64, no data: URL prefix\n  // A tool call the model emitted on a prior `assistant` turn — replay it in the\n  // conversation so a follow-up request carries the agentic history. Pairs with the\n  // streamed `tool-call` {@link ChatDelta} that first surfaced it.\n  | { type: 'tool-use'; id: string; name: string; input: Record<string, unknown> }\n  // A block of the model's own REASONING from a prior `assistant` turn (R3-335).\n  // Honored only when the resolved provider advertises `features.reasoning`.\n  //\n  // Echo these back. On some providers a reasoning block must be replayed — with its\n  // `signature` intact and BEFORE the turn's text/tool-use — for the following turn to\n  // be accepted at all; a loop that drops them is quietly lossy across turns in a way\n  // that shows up as degraded output rather than an error. Pairs with the streamed\n  // `reasoning` {@link ChatDelta}.\n  | { type: 'reasoning'; text: string; signature?: string }\n  // Reasoning the provider REDACTED: opaque bytes with no readable text, which still\n  // have to be echoed back in place to keep the chain valid. Never render it.\n  | { type: 'reasoning-redacted'; data: string }\n  // The result of executing a `tool-use`, fed back so the model can continue. Carried\n  // on a `user`/`tool`-role message; `toolCallId` matches the `tool-use` `id`.\n  | { type: 'tool-result'; toolCallId: string; content: string; isError?: boolean };\n\n/** One message in a {@link ChatRequest}: a role plus its content parts. */\nexport interface ChatMessage {\n  role: ChatRole;\n  content: ContentPart[];\n}\n\n/** A tool the model may call — honored only when `features.tools`. */\nexport interface ToolDef {\n  name: string;\n  description?: string;\n  /** JSON-Schema for the tool's arguments. */\n  inputSchema: Record<string, unknown>;\n}\n\n/** A host-brokered chat completion request: the messages plus optional tools,\n *  response format, and model hint (each honored per the provider's features). */\nexport interface ChatRequest {\n  messages: ChatMessage[];\n  /** Honored only when the resolved provider advertises `features.tools`. */\n  tools?: ToolDef[];\n  /** `'json'` honored only when `features.jsonMode`. Defaults to `'text'`. */\n  responseFormat?: 'text' | 'json';\n  maxTokens?: number;\n  /** An ABSTRACT tier hint, never a vendor model id — the host maps it to a concrete\n   *  model on the resolved provider. Omit to take the provider's default. */\n  modelHint?: 'fast' | 'smart';\n  /** Abort the completion mid-stream. When it fires, the SDK sends the host a cancel\n   *  frame so the host aborts the upstream provider request and STOPS BILLING the\n   *  user's key — not merely stops the app-side iterator (LLM_AND_AGENTS_SPEC §3.3\n   *  \"abort the in-flight LLM request\", R3-224). Not sent over the wire (an\n   *  `AbortSignal` isn't serializable); handled SDK-side. */\n  signal?: AbortSignal;\n}\n\n/** One streamed chunk. Consumers typically accumulate `text-delta`s. */\nexport type ChatDelta =\n  | { type: 'text-delta'; text: string }\n  | { type: 'tool-call'; id: string; name: string; input: unknown }\n  // R3-335 — the model's reasoning as it streams. `reasoning-delta` carries the text\n  // incrementally (render it live); the terminal `reasoning` carries the WHOLE block\n  // plus the `signature` the provider may require on the echo, and is what a caller\n  // should put back into the conversation. A provider without reasoning emits neither.\n  | { type: 'reasoning-delta'; text: string }\n  | { type: 'reasoning'; text: string; signature?: string }\n  | { type: 'reasoning-redacted'; data: string }\n  // Token accounting for the turn. `cacheReadTokens`/`cacheWriteTokens` are present\n  // only on providers that report prompt caching (R3-336) — they are what makes a\n  // caching claim verifiable rather than believed, and their ABSENCE is meaningful:\n  // it says this provider reports nothing, not that nothing was cached.\n  | {\n      type: 'usage';\n      inputTokens: number;\n      outputTokens: number;\n      cacheReadTokens?: number;\n      cacheWriteTokens?: number;\n    };\n\n/** Why generation stopped: natural `end`, `length` cap, a `tool` call, or content `filtered`. */\nexport type ChatStopReason = 'end' | 'length' | 'tool' | 'filtered';\n\n/** The terminal value of the {@link chat} stream. */\nexport interface ChatResult {\n  stopReason: ChatStopReason;\n}\n\n/**\n * Stream a chat completion from whichever provider the user has configured.\n *\n * ```ts\n * let summary = '';\n * for await (const d of chat({ messages: [{ role: 'user', content: [{ type: 'text', text }] }] })) {\n *   if (d.type === 'text-delta') summary += d.text;\n * }\n * ```\n *\n * Requires the `llm:chat` capability. If no provider is bound the host fails the\n * stream into the SP-7 connect-me prompt (the user adds a key) — the generator\n * throws with `code: 'auth-required'`; an un-granted call throws `forbidden`.\n */\nexport function chat(req: ChatRequest): AsyncGenerator<ChatDelta, ChatResult, void> {\n  // Peel `signal` out of the request before it becomes wire params — an AbortSignal\n  // can't cross the postMessage boundary as data; it drives the SDK-side cancel frame.\n  const { signal, ...params } = req;\n  return invokeStream<ChatDelta, ChatResult>('llm:chat', params as unknown as Record<string, unknown>, signal);\n}\n\n/** The resolved provider's advertised abilities (SERVICE_PROVIDERS_SPEC §2.5) — read\n *  to branch/degrade (offer image upload only when `vision`). */\nexport interface ChatFeatures {\n  vision: boolean;\n  tools: boolean;\n  jsonMode: boolean;\n  /** R3-335: the provider emits reasoning blocks. Read it to decide whether to render\n   *  a thinking surface at all — an empty affordance on a provider that never thinks\n   *  is worse than none. Normalized to `false` by the channel when a host predating\n   *  R3-335 omits it, so this is never `undefined` in practice. */\n  reasoning: boolean;\n  maxContextTokens: number;\n}\n\n/** Info about the provider the host resolved for this app. `null` when no provider\n *  is bound (SP-7: prompt the user to add a key before calling {@link chat}). */\nexport interface ChatProviderInfo {\n  /** Opaque provider id, e.g. `llm.chat.anthropic` — never a vendor secret or model id. */\n  providerId: string;\n  /** True for Host-proxied providers (host-vouched, SP-9); false for app-level ones,\n   *  whose `features` are an untrusted claim. */\n  hostVouched: boolean;\n  features: ChatFeatures;\n  // NOTE (R3-300): `displayName`, `executor` and the resolved per-tier `models` belong\n  // here — an app rendering provider state wants all three. They are NOT added yet,\n  // deliberately: this interface IS the `llm-provider` channel's declared value, so\n  // adding a field is a WIRE change, and the wire is owned by\n  // `@immediately-run/sandbox-protocol` (descriptor edit → publish → pin bump on both\n  // sides). The protocol snapshot gate enforces exactly that, and it is right to. The\n  // enrichment rides R3-307's publish, which already has to touch those descriptors —\n  // one publish for two additions rather than two.\n}\n\n/**\n * Whether the host has told us about a provider yet, and if so whether one is bound.\n *\n * THREE states, because two is the bug (R3-300). `describeChat()` returns `null` both\n * when no provider is configured AND when the channel has not answered — so an app\n * cannot tell \"you need a key\" from \"ask again in a moment\", and consuming apps\n * rendered a misleading \"connect a key\" banner at users who had one. `unknown` is the\n * state before the host answers; it is not an error and not a prompt to act.\n */\nexport type ChatProviderState =\n  | { status: 'unknown' }\n  | { status: 'not-configured' }\n  | { status: 'configured'; provider: ChatProviderInfo };\n\n// The `llm-provider` describe channel (Recipe A): the host pushes the resolved\n// provider info on change and replays it on register-frame, gated by `llm:chat`.\n// A message with no `provider` key is ignored; an explicit `null` means \"no provider\n// bound\", which is now REPRESENTABLE as distinct from \"not yet answered\".\n// The channel's VALUE stays exactly what the wire carries — `ChatProviderInfo | null` —\n// because the wire did not change here and the protocol snapshot gate reads this type as\n// the channel's shape. The three-state lives BESIDE it: `answered` records whether the host\n// has ever spoken on this channel, which is the one bit `null` cannot carry. Deriving the\n// state rather than widening the channel keeps the wire contract byte-identical, which it\n// is (SDK_PACKAGING_SPEC §9: the wire is additive-only, and this is not a wire change).\n/**\n * Fill in feature flags a host older than the field does not send (R3-335).\n *\n * `features.reasoning` arrived after `ChatFeatures` shipped, so a host predating it\n * omits the key. `undefined` reads as falsy everywhere EXCEPT a `'reasoning' in\n * features` check, which is exactly the kind of difference that produces one wrong\n * branch a year later — so it is normalized here, once, rather than left to every\n * caller. Absent means \"does not reason\": the fail-closed reading.\n *\n * Exported for its own test; not part of the public surface (`index.ts` re-exports\n * this module wholesale, so it is reachable — it is documented as internal rather\n * than hidden behind a lie).\n * @internal\n */\nexport function normalizeProviderInfo(provider: ChatProviderInfo | null): ChatProviderInfo | null {\n  if (!provider) return null;\n  // The wire value is whatever the host sent, which may predate `reasoning` — so read\n  // it as partial rather than trusting the declared type, and decide the flag explicitly.\n  const wire = provider.features as Partial<ChatFeatures>;\n  return { ...provider, features: { ...wire, reasoning: wire.reasoning === true } as ChatFeatures };\n}\n\nlet answered = false;\nconst channel = createPushChannel<ChatProviderInfo | null>({\n  pushType: LLM_PROVIDER,\n  requestType: REQUEST_LLM_PROVIDER,\n  initial: null,\n  parse: (msg) => {\n    if (!('provider' in msg)) return undefined;\n    answered = true;\n    return normalizeProviderInfo((msg.provider as ChatProviderInfo | null) ?? null);\n  },\n});\n\n/** Derive the three-state from the wire value plus whether the host has answered. */\nconst stateOf = (provider: ChatProviderInfo | null): ChatProviderState =>\n  !answered ? { status: 'unknown' } : provider ? { status: 'configured', provider } : { status: 'not-configured' };\n\n/**\n * The provider the host resolved for this app, or `null`.\n *\n * Kept for compatibility (`ways_of_working §6`, additive-only): it collapses `unknown`\n * and `not-configured` to `null`. Prefer {@link describeChatState} when the difference\n * matters — which is any time you would render \"connect a key\", because doing that in\n * the `unknown` state is exactly the false banner R3-300 fixes.\n */\nexport const describeChat = (): ChatProviderInfo | null => channel.get();\n\n/** The three-state read: `unknown` before the host answers, then configured or not. */\nexport const describeChatState = (): ChatProviderState => stateOf(channel.get());\n\n/** Subscribe to provider changes (key added/revoked, preference changed). Invoked\n *  immediately with the current value, then on every change. Returns unsubscribe. */\nexport const onChatProviderChange = (listener: (provider: ChatProviderInfo | null) => void): (() => void) =>\n  channel.onChange(listener);\n\n/** Subscribe to the three-state provider description. */\nexport const onChatProviderStateChange = (listener: (state: ChatProviderState) => void): (() => void) =>\n  channel.onChange((p) => listener(stateOf(p)));\n\n/** React hook returning the resolved chat provider (or `null`), re-rendering on\n *  change — gate the summarize affordance on `provider !== null`. */\nexport const useChatProvider = (): ChatProviderInfo | null => channel.use();\n\n/**\n * React hook returning the three-state description.\n *\n * Use this to render provider state honestly: show nothing (or a neutral placeholder)\n * while `unknown`, the connect affordance only on `not-configured`, and the provider's\n * name on `configured`.\n */\nexport const useChatProviderState = (): ChatProviderState => stateOf(channel.use());\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,qBAA6B;AAC7B,yBAAkC;AAClC,sBAAmD;AA8G5C,SAAS,KAAK,KAA+D;AAGlF,QAAM,EAAE,QAAQ,GAAG,OAAO,IAAI;AAC9B,aAAO,6BAAoC,YAAY,QAA8C,MAAM;AAC7G;AAyEO,SAAS,sBAAsB,UAA4D;AAChG,MAAI,CAAC,SAAU,QAAO;AAGtB,QAAM,OAAO,SAAS;AACtB,SAAO,EAAE,GAAG,UAAU,UAAU,EAAE,GAAG,MAAM,WAAW,KAAK,cAAc,KAAK,EAAkB;AAClG;AAEA,IAAI,WAAW;AACf,MAAM,cAAU,sCAA2C;AAAA,EACzD,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS;AAAA,EACT,OAAO,CAAC,QAAQ;AACd,QAAI,EAAE,cAAc,KAAM,QAAO;AACjC,eAAW;AACX,WAAO,sBAAuB,IAAI,YAAwC,IAAI;AAAA,EAChF;AACF,CAAC;AAGD,MAAM,UAAU,CAAC,aACf,CAAC,WAAW,EAAE,QAAQ,UAAU,IAAI,WAAW,EAAE,QAAQ,cAAc,SAAS,IAAI,EAAE,QAAQ,iBAAiB;AAU1G,MAAM,eAAe,MAA+B,QAAQ,IAAI;AAGhE,MAAM,oBAAoB,MAAyB,QAAQ,QAAQ,IAAI,CAAC;AAIxE,MAAM,uBAAuB,CAAC,aACnC,QAAQ,SAAS,QAAQ;AAGpB,MAAM,4BAA4B,CAAC,aACxC,QAAQ,SAAS,CAAC,MAAM,SAAS,QAAQ,CAAC,CAAC,CAAC;AAIvC,MAAM,kBAAkB,MAA+B,QAAQ,IAAI;AASnE,MAAM,uBAAuB,MAAyB,QAAQ,QAAQ,IAAI,CAAC;","names":[]}
+{"version":3,"sources":["../src/llm.ts"],"sourcesContent":["// Provider-agnostic LLM chat — the `llm.chat@1` slot (SERVICE_PROVIDERS_SPEC;\n// LLM_AND_AGENTS_SPEC §8 D5).\n//\n// An app calls ONE chat slot and never worries about which provider the user has a\n// key for: the HOST resolves which vendor answers from the key the user holds\n// (`SecretView.boundOrigin`) plus their `preferredImplementation` choice, normalizes\n// the wire format, injects the key host-side at the §6 net:fetch point (the\n// look-at-nothing proxy), and streams normalized deltas back. The app never names a\n// vendor, never sees the key, and needs NO `net:fetch`/`secrets` grant of its own —\n// only the `llm:chat` capability (elevated, app-scoped: a fork earns it by consent).\n//\n// Inert until the host implements `protocol-llm` (the `chat` stream) + the\n// `llm-provider` describe channel; the contract ships here so apps (the file-explorer\n// summarize fork) can be written against it — exactly how `secrets.ts` shipped ahead\n// of `protocol-secrets`.\nimport { invokeStream } from './catalog';\nimport { createPushChannel } from './pushChannel';\nimport { LLM_PROVIDER, REQUEST_LLM_PROVIDER } from './generated/protocol';\n\n/** Who authored a {@link ChatMessage}. */\nexport type ChatRole = 'system' | 'user' | 'assistant' | 'tool';\n\n/** A part of a message. `image` is only honored when the resolved provider\n *  advertises `features.vision` (§2.5); `tool-use`/`tool-result` only when it\n *  advertises `features.tools` — branch on {@link describeChat} first. */\nexport type ContentPart =\n  | { type: 'text'; text: string }\n  | { type: 'image'; mimeType: string; data: string } // data: base64, no data: URL prefix\n  // A tool call the model emitted on a prior `assistant` turn — replay it in the\n  // conversation so a follow-up request carries the agentic history. Pairs with the\n  // streamed `tool-call` {@link ChatDelta} that first surfaced it.\n  | { type: 'tool-use'; id: string; name: string; input: Record<string, unknown> }\n  // A block of the model's own REASONING from a prior `assistant` turn (R3-335).\n  // Honored only when the resolved provider advertises `features.reasoning`.\n  //\n  // Echo these back. On some providers a reasoning block must be replayed — with its\n  // `signature` intact and BEFORE the turn's text/tool-use — for the following turn to\n  // be accepted at all; a loop that drops them is quietly lossy across turns in a way\n  // that shows up as degraded output rather than an error. Pairs with the streamed\n  // `reasoning` {@link ChatDelta}.\n  | { type: 'reasoning'; text: string; signature?: string }\n  // Reasoning the provider REDACTED: opaque bytes with no readable text, which still\n  // have to be echoed back in place to keep the chain valid. Never render it.\n  | { type: 'reasoning-redacted'; data: string }\n  // The result of executing a `tool-use`, fed back so the model can continue. Carried\n  // on a `user`/`tool`-role message; `toolCallId` matches the `tool-use` `id`.\n  | { type: 'tool-result'; toolCallId: string; content: string; isError?: boolean };\n\n/** One message in a {@link ChatRequest}: a role plus its content parts. */\nexport interface ChatMessage {\n  role: ChatRole;\n  content: ContentPart[];\n}\n\n/** A tool the model may call — honored only when `features.tools`. */\nexport interface ToolDef {\n  name: string;\n  description?: string;\n  /** JSON-Schema for the tool's arguments. */\n  inputSchema: Record<string, unknown>;\n}\n\n/** A host-brokered chat completion request: the messages plus optional tools,\n *  response format, and model hint (each honored per the provider's features). */\nexport interface ChatRequest {\n  messages: ChatMessage[];\n  /** Honored only when the resolved provider advertises `features.tools`. */\n  tools?: ToolDef[];\n  /** `'json'` honored only when `features.jsonMode`. Defaults to `'text'`. */\n  responseFormat?: 'text' | 'json';\n  maxTokens?: number;\n  /** An ABSTRACT tier hint, never a vendor model id — the host maps it to a concrete\n   *  model on the resolved provider. Omit to take the provider's default. */\n  modelHint?: 'fast' | 'smart';\n  /** Abort the completion mid-stream. When it fires, the SDK sends the host a cancel\n   *  frame so the host aborts the upstream provider request and STOPS BILLING the\n   *  user's key — not merely stops the app-side iterator (LLM_AND_AGENTS_SPEC §3.3\n   *  \"abort the in-flight LLM request\", R3-224). Not sent over the wire (an\n   *  `AbortSignal` isn't serializable); handled SDK-side. */\n  signal?: AbortSignal;\n}\n\n/** One streamed chunk. Consumers typically accumulate `text-delta`s. */\nexport type ChatDelta =\n  | { type: 'text-delta'; text: string }\n  | { type: 'tool-call'; id: string; name: string; input: unknown }\n  // R3-335 — the model's reasoning as it streams. `reasoning-delta` carries the text\n  // incrementally (render it live); the terminal `reasoning` carries the WHOLE block\n  // plus the `signature` the provider may require on the echo, and is what a caller\n  // should put back into the conversation. A provider without reasoning emits neither.\n  | { type: 'reasoning-delta'; text: string }\n  | { type: 'reasoning'; text: string; signature?: string }\n  | { type: 'reasoning-redacted'; data: string }\n  // Token accounting for the turn. `cacheReadTokens`/`cacheWriteTokens` are present\n  // only on providers that report prompt caching (R3-336) — they are what makes a\n  // caching claim verifiable rather than believed, and their ABSENCE is meaningful:\n  // it says this provider reports nothing, not that nothing was cached.\n  | {\n      type: 'usage';\n      inputTokens: number;\n      outputTokens: number;\n      cacheReadTokens?: number;\n      cacheWriteTokens?: number;\n    };\n\n/** Why generation stopped: natural `end`, `length` cap, a `tool` call, or content `filtered`. */\nexport type ChatStopReason = 'end' | 'length' | 'tool' | 'filtered';\n\n/** The terminal value of the {@link chat} stream. */\nexport interface ChatResult {\n  stopReason: ChatStopReason;\n}\n\n/**\n * Stream a chat completion from whichever provider the user has configured.\n *\n * ```ts\n * let summary = '';\n * for await (const d of chat({ messages: [{ role: 'user', content: [{ type: 'text', text }] }] })) {\n *   if (d.type === 'text-delta') summary += d.text;\n * }\n * ```\n *\n * Requires the `llm:chat` capability. If no provider is bound, the host first\n * draws the SP-7 connect-me gate itself (R3-456: the app never draws a\n * credential prompt — that is host chrome, SECRETS_SPEC S3):\n * - the user connects a key → the call retries once and streams normally;\n * - the user declines → the generator throws `code: 'cancelled'` (the same code\n *   a declined powerbox produces — a working degraded state: catch it and\n *   degrade, e.g. skip the AI feature);\n * - an older host without the gate throws `code: 'provider-not-configured'`.\n * A signed-out user throws `code: 'auth-required'`; an un-granted call throws\n * `forbidden`.\n */\nexport function chat(req: ChatRequest): AsyncGenerator<ChatDelta, ChatResult, void> {\n  // Peel `signal` out of the request before it becomes wire params — an AbortSignal\n  // can't cross the postMessage boundary as data; it drives the SDK-side cancel frame.\n  const { signal, ...params } = req;\n  return invokeStream<ChatDelta, ChatResult>('llm:chat', params as unknown as Record<string, unknown>, signal);\n}\n\n/** The resolved provider's advertised abilities (SERVICE_PROVIDERS_SPEC §2.5) — read\n *  to branch/degrade (offer image upload only when `vision`). */\nexport interface ChatFeatures {\n  vision: boolean;\n  tools: boolean;\n  jsonMode: boolean;\n  /** R3-335: the provider emits reasoning blocks. Read it to decide whether to render\n   *  a thinking surface at all — an empty affordance on a provider that never thinks\n   *  is worse than none. Normalized to `false` by the channel when a host predating\n   *  R3-335 omits it, so this is never `undefined` in practice. */\n  reasoning: boolean;\n  maxContextTokens: number;\n}\n\n/** Info about the provider the host resolved for this app. `null` when no provider\n *  is bound (SP-7: prompt the user to add a key before calling {@link chat}). */\nexport interface ChatProviderInfo {\n  /** Opaque provider id, e.g. `llm.chat.anthropic` — never a vendor secret or model id. */\n  providerId: string;\n  /** True for Host-proxied providers (host-vouched, SP-9); false for app-level ones,\n   *  whose `features` are an untrusted claim. */\n  hostVouched: boolean;\n  features: ChatFeatures;\n  // NOTE (R3-300): `displayName`, `executor` and the resolved per-tier `models` belong\n  // here — an app rendering provider state wants all three. They are NOT added yet,\n  // deliberately: this interface IS the `llm-provider` channel's declared value, so\n  // adding a field is a WIRE change, and the wire is owned by\n  // `@immediately-run/sandbox-protocol` (descriptor edit → publish → pin bump on both\n  // sides). The protocol snapshot gate enforces exactly that, and it is right to. The\n  // enrichment rides R3-307's publish, which already has to touch those descriptors —\n  // one publish for two additions rather than two.\n}\n\n/**\n * Whether the host has told us about a provider yet, and if so whether one is bound.\n *\n * THREE states, because two is the bug (R3-300). `describeChat()` returns `null` both\n * when no provider is configured AND when the channel has not answered — so an app\n * cannot tell \"you need a key\" from \"ask again in a moment\", and consuming apps\n * rendered a misleading \"connect a key\" banner at users who had one. `unknown` is the\n * state before the host answers; it is not an error and not a prompt to act.\n *\n * **`unknown` is TRANSIENT — the host answers every frame** (R3-419;\n * `LLM_AND_AGENTS_SPEC §4.1` R-LLM-1..3). An app that does not hold `llm:chat` is not\n * met with silence: it is answered `not-configured`, the same terminal state as a user\n * with no key, because from the app's side those are the same fact — do not render a\n * provider, do offer the connect path. So it is correct to treat a `unknown` that\n * persists as a host bug rather than as a state to design around, and WRONG to render a\n * spinner with no timeout on it. (Before R3-419 the host withheld the channel entirely\n * from an ungranted frame, and `unknown` stood forever — that is the failure this note\n * exists to keep from being re-created on the app side.)\n */\nexport type ChatProviderState =\n  | { status: 'unknown' }\n  | { status: 'not-configured' }\n  | { status: 'configured'; provider: ChatProviderInfo };\n\n// The `llm-provider` describe channel (Recipe A): the host pushes the resolved\n// provider info on change and replays it on register-frame, gated by `llm:chat`.\n// A message with no `provider` key is ignored; an explicit `null` means \"no provider\n// bound\", which is now REPRESENTABLE as distinct from \"not yet answered\".\n// The channel's VALUE stays exactly what the wire carries — `ChatProviderInfo | null` —\n// because the wire did not change here and the protocol snapshot gate reads this type as\n// the channel's shape. The three-state lives BESIDE it: `answered` records whether the host\n// has ever spoken on this channel, which is the one bit `null` cannot carry. Deriving the\n// state rather than widening the channel keeps the wire contract byte-identical, which it\n// is (SDK_PACKAGING_SPEC §9: the wire is additive-only, and this is not a wire change).\n/**\n * Fill in feature flags a host older than the field does not send (R3-335).\n *\n * `features.reasoning` arrived after `ChatFeatures` shipped, so a host predating it\n * omits the key. `undefined` reads as falsy everywhere EXCEPT a `'reasoning' in\n * features` check, which is exactly the kind of difference that produces one wrong\n * branch a year later — so it is normalized here, once, rather than left to every\n * caller. Absent means \"does not reason\": the fail-closed reading.\n *\n * Exported for its own test; not part of the public surface (`index.ts` re-exports\n * this module wholesale, so it is reachable — it is documented as internal rather\n * than hidden behind a lie).\n * @internal\n */\nexport function normalizeProviderInfo(provider: ChatProviderInfo | null): ChatProviderInfo | null {\n  if (!provider) return null;\n  // The wire value is whatever the host sent, which may predate `reasoning` — so read\n  // it as partial rather than trusting the declared type, and decide the flag explicitly.\n  const wire = provider.features as Partial<ChatFeatures>;\n  return { ...provider, features: { ...wire, reasoning: wire.reasoning === true } as ChatFeatures };\n}\n\nlet answered = false;\nconst channel = createPushChannel<ChatProviderInfo | null>({\n  pushType: LLM_PROVIDER,\n  requestType: REQUEST_LLM_PROVIDER,\n  initial: null,\n  parse: (msg) => {\n    if (!('provider' in msg)) return undefined;\n    answered = true;\n    return normalizeProviderInfo((msg.provider as ChatProviderInfo | null) ?? null);\n  },\n});\n\n/** Derive the three-state from the wire value plus whether the host has answered. */\nconst stateOf = (provider: ChatProviderInfo | null): ChatProviderState =>\n  !answered ? { status: 'unknown' } : provider ? { status: 'configured', provider } : { status: 'not-configured' };\n\n/**\n * The provider the host resolved for this app, or `null`.\n *\n * Kept for compatibility (`ways_of_working §6`, additive-only): it collapses `unknown`\n * and `not-configured` to `null`. Prefer {@link describeChatState} when the difference\n * matters — which is any time you would render \"connect a key\", because doing that in\n * the `unknown` state is exactly the false banner R3-300 fixes.\n */\nexport const describeChat = (): ChatProviderInfo | null => channel.get();\n\n/** The three-state read: `unknown` before the host answers, then configured or not. */\nexport const describeChatState = (): ChatProviderState => stateOf(channel.get());\n\n/** Subscribe to provider changes (key added/revoked, preference changed). Invoked\n *  immediately with the current value, then on every change. Returns unsubscribe. */\nexport const onChatProviderChange = (listener: (provider: ChatProviderInfo | null) => void): (() => void) =>\n  channel.onChange(listener);\n\n/** Subscribe to the three-state provider description. */\nexport const onChatProviderStateChange = (listener: (state: ChatProviderState) => void): (() => void) =>\n  channel.onChange((p) => listener(stateOf(p)));\n\n/** React hook returning the resolved chat provider (or `null`), re-rendering on\n *  change — gate the summarize affordance on `provider !== null`. */\nexport const useChatProvider = (): ChatProviderInfo | null => channel.use();\n\n/**\n * React hook returning the three-state description.\n *\n * Use this to render provider state honestly: show nothing (or a neutral placeholder)\n * while `unknown`, the connect affordance only on `not-configured`, and the provider's\n * name on `configured`.\n */\nexport const useChatProviderState = (): ChatProviderState => stateOf(channel.use());\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeA,qBAA6B;AAC7B,yBAAkC;AAClC,sBAAmD;AAqH5C,SAAS,KAAK,KAA+D;AAGlF,QAAM,EAAE,QAAQ,GAAG,OAAO,IAAI;AAC9B,aAAO,6BAAoC,YAAY,QAA8C,MAAM;AAC7G;AAmFO,SAAS,sBAAsB,UAA4D;AAChG,MAAI,CAAC,SAAU,QAAO;AAGtB,QAAM,OAAO,SAAS;AACtB,SAAO,EAAE,GAAG,UAAU,UAAU,EAAE,GAAG,MAAM,WAAW,KAAK,cAAc,KAAK,EAAkB;AAClG;AAEA,IAAI,WAAW;AACf,MAAM,cAAU,sCAA2C;AAAA,EACzD,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS;AAAA,EACT,OAAO,CAAC,QAAQ;AACd,QAAI,EAAE,cAAc,KAAM,QAAO;AACjC,eAAW;AACX,WAAO,sBAAuB,IAAI,YAAwC,IAAI;AAAA,EAChF;AACF,CAAC;AAGD,MAAM,UAAU,CAAC,aACf,CAAC,WAAW,EAAE,QAAQ,UAAU,IAAI,WAAW,EAAE,QAAQ,cAAc,SAAS,IAAI,EAAE,QAAQ,iBAAiB;AAU1G,MAAM,eAAe,MAA+B,QAAQ,IAAI;AAGhE,MAAM,oBAAoB,MAAyB,QAAQ,QAAQ,IAAI,CAAC;AAIxE,MAAM,uBAAuB,CAAC,aACnC,QAAQ,SAAS,QAAQ;AAGpB,MAAM,4BAA4B,CAAC,aACxC,QAAQ,SAAS,CAAC,MAAM,SAAS,QAAQ,CAAC,CAAC,CAAC;AAIvC,MAAM,kBAAkB,MAA+B,QAAQ,IAAI;AASnE,MAAM,uBAAuB,MAAyB,QAAQ,QAAQ,IAAI,CAAC;","names":[]}

package/dist/llm.d.cts

@@ -101,9 +101,16 @@ interface ChatResult {
  * }
  * ```
  *
- * Requires the `llm:chat` capability. If no provider is bound the host fails the
- * stream into the SP-7 connect-me prompt (the user adds a key) — the generator
- * throws with `code: 'auth-required'`; an un-granted call throws `forbidden`.
+ * Requires the `llm:chat` capability. If no provider is bound, the host first
+ * draws the SP-7 connect-me gate itself (R3-456: the app never draws a
+ * credential prompt — that is host chrome, SECRETS_SPEC S3):
+ * - the user connects a key → the call retries once and streams normally;
+ * - the user declines → the generator throws `code: 'cancelled'` (the same code
+ *   a declined powerbox produces — a working degraded state: catch it and
+ *   degrade, e.g. skip the AI feature);
+ * - an older host without the gate throws `code: 'provider-not-configured'`.
+ * A signed-out user throws `code: 'auth-required'`; an un-granted call throws
+ * `forbidden`.
  */
 declare function chat(req: ChatRequest): AsyncGenerator<ChatDelta, ChatResult, void>;
 /** The resolved provider's advertised abilities (SERVICE_PROVIDERS_SPEC §2.5) — read
@@ -137,6 +144,16 @@ interface ChatProviderInfo {
  * cannot tell "you need a key" from "ask again in a moment", and consuming apps
  * rendered a misleading "connect a key" banner at users who had one. `unknown` is the
  * state before the host answers; it is not an error and not a prompt to act.
+ *
+ * **`unknown` is TRANSIENT — the host answers every frame** (R3-419;
+ * `LLM_AND_AGENTS_SPEC §4.1` R-LLM-1..3). An app that does not hold `llm:chat` is not
+ * met with silence: it is answered `not-configured`, the same terminal state as a user
+ * with no key, because from the app's side those are the same fact — do not render a
+ * provider, do offer the connect path. So it is correct to treat a `unknown` that
+ * persists as a host bug rather than as a state to design around, and WRONG to render a
+ * spinner with no timeout on it. (Before R3-419 the host withheld the channel entirely
+ * from an ungranted frame, and `unknown` stood forever — that is the failure this note
+ * exists to keep from being re-created on the app side.)
  */
 type ChatProviderState = {
     status: 'unknown';