@immediately-run/sdk 0.64.1 → 0.66.0

package/dist/entryState.d.ts

@@ -0,0 +1,42 @@
+/** How the browser reached the current entry. `push` is an ordinary forward
+ *  navigation; `back`/`forward` are traversals, and only a traversal restores. */
+type NavigationDirection = 'push' | 'back' | 'forward';
+/** Serialized cap for the whole scratch. Past this the scratch is dropped with a
+ *  dev-time warning rather than silently truncated: a half-written bookmark that
+ *  restores to the wrong place is worse than no bookmark. */
+declare const ENTRY_STATE_MAX_BYTES = 4096;
+interface ArrivedNavigation {
+    /** The scratch the leaving app left on this entry, if any. */
+    readonly state: Readonly<Record<string, unknown>> | undefined;
+    /** How this entry was reached. */
+    readonly direction: NavigationDirection;
+}
+type Collector = () => unknown;
+/**
+ * Queue a value for the entry being left. The last call before a navigation wins.
+ * Prefer {@link registerEntryStateCollector} for values that are only knowable at the
+ * instant of navigating (a scroll offset is the motivating case).
+ */
+declare const saveEntryState: (key: string, value: unknown) => void;
+/** Register a callback asked for its value at navigation time. Returns its remover.
+ *  A second registration for the same key replaces the first — one owner per key. */
+declare const registerEntryStateCollector: (key: string, collect: Collector) => (() => void);
+/**
+ * Gather the scratch for the entry being left and clear the queue. Called by
+ * `navigate()` — not part of the app-facing surface.
+ *
+ * A collector that throws is skipped: a bookmark is a convenience, and it must never
+ * be able to break a navigation.
+ */
+declare const takeQueuedEntryState: () => Record<string, unknown> | undefined;
+/** Record what the host said about the entry just arrived at. Called by the boot
+ *  shell's `urlchange` listener — not part of the app-facing surface. */
+declare const receiveNavigation: (next: ArrivedNavigation) => void;
+/** The current arrival, as one stable object so `useSyncExternalStore` can compare
+ *  by identity. */
+declare const getArrivedNavigation: () => ArrivedNavigation;
+declare const subscribeNavigation: (listener: () => void) => (() => void);
+/** Test seam: forget every collector, queued value and arrival. */
+declare const resetEntryState: () => void;
+
+export { type ArrivedNavigation, ENTRY_STATE_MAX_BYTES, type NavigationDirection, getArrivedNavigation, receiveNavigation, registerEntryStateCollector, resetEntryState, saveEntryState, subscribeNavigation, takeQueuedEntryState };

package/dist/entryState.js

@@ -0,0 +1,69 @@
+import "./chunk-VHAA22YE.js";
+const ENTRY_STATE_MAX_BYTES = 4096;
+const collectors = /* @__PURE__ */ new Map();
+let queued = {};
+let arrived = { state: void 0, direction: "push" };
+const listeners = /* @__PURE__ */ new Set();
+const notify = () => {
+  for (const l of [...listeners]) l();
+};
+const saveEntryState = (key, value) => {
+  queued[key] = value;
+};
+const registerEntryStateCollector = (key, collect) => {
+  collectors.set(key, collect);
+  return () => {
+    if (collectors.get(key) === collect) collectors.delete(key);
+  };
+};
+const takeQueuedEntryState = () => {
+  const out = { ...queued };
+  queued = {};
+  for (const [key, collect] of collectors) {
+    try {
+      const value = collect();
+      if (value !== void 0) out[key] = value;
+    } catch {
+    }
+  }
+  if (Object.keys(out).length === 0) return void 0;
+  let size = 0;
+  try {
+    size = JSON.stringify(out).length;
+  } catch {
+    return void 0;
+  }
+  if (size > ENTRY_STATE_MAX_BYTES) {
+    console.warn(
+      `[Sandbox] entry state is ${size} bytes, over the ${ENTRY_STATE_MAX_BYTES}-byte cap \u2014 dropped. Keep per-entry scratch small (a scroll offset, a few ids), not a cache.`
+    );
+    return void 0;
+  }
+  return out;
+};
+const receiveNavigation = (next) => {
+  arrived = next;
+  notify();
+};
+const getArrivedNavigation = () => arrived;
+const subscribeNavigation = (listener) => {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+};
+const resetEntryState = () => {
+  collectors.clear();
+  queued = {};
+  arrived = { state: void 0, direction: "push" };
+  listeners.clear();
+};
+export {
+  ENTRY_STATE_MAX_BYTES,
+  getArrivedNavigation,
+  receiveNavigation,
+  registerEntryStateCollector,
+  resetEntryState,
+  saveEntryState,
+  subscribeNavigation,
+  takeQueuedEntryState
+};
+//# sourceMappingURL=entryState.js.map

package/dist/entryState.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/entryState.ts"],"sourcesContent":["// Per-history-entry scratch (R3-627): a small opaque value an app attaches to the\n// history entry it is LEAVING, and reads back when the browser returns to that entry.\n//\n// Why this exists. The app frame's realm is replaced by an in-app navigation, so\n// nothing in app memory survives it; the host owns the history stack but is at an\n// opaque origin and cannot look inside the frame. So the only way an app can leave\n// itself a bookmark is to hand the host a value to hold against the entry. The host\n// never parses it — it is the app's own value coming back to the app, which is why\n// this does not weaken `EDITOR_AS_APP_SPEC §2` (\"view state … never crosses the\n// boundary\"): the host is a courier, not a reader.\n//\n// Collected at navigation time, not continuously. The app is the one calling\n// `navigate()`, so the scratch is gathered synchronously inside that call — no scroll\n// reporting channel, no throttling, no traffic for a value needed at one instant.\n\n/** How the browser reached the current entry. `push` is an ordinary forward\n *  navigation; `back`/`forward` are traversals, and only a traversal restores. */\nexport type NavigationDirection = 'push' | 'back' | 'forward';\n\n/** Serialized cap for the whole scratch. Past this the scratch is dropped with a\n *  dev-time warning rather than silently truncated: a half-written bookmark that\n *  restores to the wrong place is worse than no bookmark. */\nexport const ENTRY_STATE_MAX_BYTES = 4096;\n\nexport interface ArrivedNavigation {\n  /** The scratch the leaving app left on this entry, if any. */\n  readonly state: Readonly<Record<string, unknown>> | undefined;\n  /** How this entry was reached. */\n  readonly direction: NavigationDirection;\n}\n\ntype Collector = () => unknown;\n\nconst collectors = new Map<string, Collector>();\nlet queued: Record<string, unknown> = {};\nlet arrived: ArrivedNavigation = { state: undefined, direction: 'push' };\nconst listeners = new Set<() => void>();\n\nconst notify = (): void => {\n  for (const l of [...listeners]) l();\n};\n\n/**\n * Queue a value for the entry being left. The last call before a navigation wins.\n * Prefer {@link registerEntryStateCollector} for values that are only knowable at the\n * instant of navigating (a scroll offset is the motivating case).\n */\nexport const saveEntryState = (key: string, value: unknown): void => {\n  queued[key] = value;\n};\n\n/** Register a callback asked for its value at navigation time. Returns its remover.\n *  A second registration for the same key replaces the first — one owner per key. */\nexport const registerEntryStateCollector = (key: string, collect: Collector): (() => void) => {\n  collectors.set(key, collect);\n  return () => {\n    if (collectors.get(key) === collect) collectors.delete(key);\n  };\n};\n\n/**\n * Gather the scratch for the entry being left and clear the queue. Called by\n * `navigate()` — not part of the app-facing surface.\n *\n * A collector that throws is skipped: a bookmark is a convenience, and it must never\n * be able to break a navigation.\n */\nexport const takeQueuedEntryState = (): Record<string, unknown> | undefined => {\n  const out: Record<string, unknown> = { ...queued };\n  queued = {};\n  for (const [key, collect] of collectors) {\n    try {\n      const value = collect();\n      if (value !== undefined) out[key] = value;\n    } catch {\n      /* a collector must not break navigation */\n    }\n  }\n  if (Object.keys(out).length === 0) return undefined;\n  let size = 0;\n  try {\n    size = JSON.stringify(out).length;\n  } catch {\n    return undefined; // not serializable → nothing to hand the host\n  }\n  if (size > ENTRY_STATE_MAX_BYTES) {\n    console.warn(\n      `[Sandbox] entry state is ${size} bytes, over the ${ENTRY_STATE_MAX_BYTES}-byte cap — dropped. ` +\n        `Keep per-entry scratch small (a scroll offset, a few ids), not a cache.`,\n    );\n    return undefined;\n  }\n  return out;\n};\n\n/** Record what the host said about the entry just arrived at. Called by the boot\n *  shell's `urlchange` listener — not part of the app-facing surface. */\nexport const receiveNavigation = (next: ArrivedNavigation): void => {\n  arrived = next;\n  notify();\n};\n\n/** The current arrival, as one stable object so `useSyncExternalStore` can compare\n *  by identity. */\nexport const getArrivedNavigation = (): ArrivedNavigation => arrived;\n\nexport const subscribeNavigation = (listener: () => void): (() => void) => {\n  listeners.add(listener);\n  return () => listeners.delete(listener);\n};\n\n/** Test seam: forget every collector, queued value and arrival. */\nexport const resetEntryState = (): void => {\n  collectors.clear();\n  queued = {};\n  arrived = { state: undefined, direction: 'push' };\n  listeners.clear();\n};\n"],"mappings":";AAsBO,MAAM,wBAAwB;AAWrC,MAAM,aAAa,oBAAI,IAAuB;AAC9C,IAAI,SAAkC,CAAC;AACvC,IAAI,UAA6B,EAAE,OAAO,QAAW,WAAW,OAAO;AACvE,MAAM,YAAY,oBAAI,IAAgB;AAEtC,MAAM,SAAS,MAAY;AACzB,aAAW,KAAK,CAAC,GAAG,SAAS,EAAG,GAAE;AACpC;AAOO,MAAM,iBAAiB,CAAC,KAAa,UAAyB;AACnE,SAAO,GAAG,IAAI;AAChB;AAIO,MAAM,8BAA8B,CAAC,KAAa,YAAqC;AAC5F,aAAW,IAAI,KAAK,OAAO;AAC3B,SAAO,MAAM;AACX,QAAI,WAAW,IAAI,GAAG,MAAM,QAAS,YAAW,OAAO,GAAG;AAAA,EAC5D;AACF;AASO,MAAM,uBAAuB,MAA2C;AAC7E,QAAM,MAA+B,EAAE,GAAG,OAAO;AACjD,WAAS,CAAC;AACV,aAAW,CAAC,KAAK,OAAO,KAAK,YAAY;AACvC,QAAI;AACF,YAAM,QAAQ,QAAQ;AACtB,UAAI,UAAU,OAAW,KAAI,GAAG,IAAI;AAAA,IACtC,QAAQ;AAAA,IAER;AAAA,EACF;AACA,MAAI,OAAO,KAAK,GAAG,EAAE,WAAW,EAAG,QAAO;AAC1C,MAAI,OAAO;AACX,MAAI;AACF,WAAO,KAAK,UAAU,GAAG,EAAE;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,uBAAuB;AAChC,YAAQ;AAAA,MACN,4BAA4B,IAAI,oBAAoB,qBAAqB;AAAA,IAE3E;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAIO,MAAM,oBAAoB,CAAC,SAAkC;AAClE,YAAU;AACV,SAAO;AACT;AAIO,MAAM,uBAAuB,MAAyB;AAEtD,MAAM,sBAAsB,CAAC,aAAuC;AACzE,YAAU,IAAI,QAAQ;AACtB,SAAO,MAAM,UAAU,OAAO,QAAQ;AACxC;AAGO,MAAM,kBAAkB,MAAY;AACzC,aAAW,MAAM;AACjB,WAAS,CAAC;AACV,YAAU,EAAE,OAAO,QAAW,WAAW,OAAO;AAChD,YAAU,MAAM;AAClB;","names":[]}

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   SafeInclude: () => import_SafeInclude.SafeInclude,
+  ScrollRestoration: () => import_ScrollRestoration.ScrollRestoration,
   getInjectedMetadataEmitter: () => import_injectedBundler.getInjectedMetadataEmitter,
   getInjectedMetadataSnapshot: () => import_injectedBundler.getInjectedMetadataSnapshot
 });
@@ -59,6 +60,7 @@ __reExport(index_exports, require("./feed"), module.exports);
 __reExport(index_exports, require("./secrets"), module.exports);
 __reExport(index_exports, require("./recents"), module.exports);
 __reExport(index_exports, require("./openRepository"), module.exports);
+__reExport(index_exports, require("./openExternal"), module.exports);
 __reExport(index_exports, require("./llm"), module.exports);
 __reExport(index_exports, require("./diagnostics"), module.exports);
 __reExport(index_exports, require("./vcs"), module.exports);
@@ -84,9 +86,14 @@ __reExport(index_exports, require("./collectHeadings"), module.exports);
 __reExport(index_exports, require("./agentContext"), module.exports);
 __reExport(index_exports, require("./fence"), module.exports);
 __reExport(index_exports, require("./platformLink"), module.exports);
+__reExport(index_exports, require("./entryState"), module.exports);
+__reExport(index_exports, require("./useEntryState"), module.exports);
+__reExport(index_exports, require("./scrollRestore"), module.exports);
+var import_ScrollRestoration = require("./components/ScrollRestoration");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SafeInclude,
+  ScrollRestoration,
   getInjectedMetadataEmitter,
   getInjectedMetadataSnapshot,
   ...require("./MDXProvider"),
@@ -122,6 +129,7 @@ __reExport(index_exports, require("./platformLink"), module.exports);
   ...require("./secrets"),
   ...require("./recents"),
   ...require("./openRepository"),
+  ...require("./openExternal"),
   ...require("./llm"),
   ...require("./diagnostics"),
   ...require("./vcs"),
@@ -146,6 +154,9 @@ __reExport(index_exports, require("./platformLink"), module.exports);
   ...require("./collectHeadings"),
   ...require("./agentContext"),
   ...require("./fence"),
-  ...require("./platformLink")
+  ...require("./platformLink"),
+  ...require("./entryState"),
+  ...require("./useEntryState"),
+  ...require("./scrollRestore")
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './bundle';\n// Deprecated `Corpus*` spellings of the above (R3-482); see `src/corpus.ts`.\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './workspace';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './recents'; // R3-485: the gated recent-projects read (page.home)\nexport * from './openRepository'; // R3-476: host-mediated open-in-a-new-tab (route:read)\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n// R3-489 (GROVE_AGENT_SPEC): the embedded-agent seam every app shares — the tool-use\n// loop ported from agent-demo (`runAgent` over the host chat slot), the MDX metadata\n// query tool, the headings index collector, the deixis context block, and the fence\n// for corpus-derived bytes entering a loop.\nexport * from './agentLoop';\nexport * from './agentSteering';\nexport * from './agentPause';\nexport * from './agentChatClient';\nexport * from './metadataQueryTool';\nexport * from './collectHeadings';\nexport * from './agentContext';\nexport * from './fence';\nexport * from './platformLink';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,qBAZd;AAcA,0BAAc,qBAdd;AAeA,0BAAc,oCAfd;AAgBA,0BAAc,gCAhBd;AAiBA,0BAAc,oBAjBd;AAoBA,0BAAc,6BApBd;AAuBA,6BAAwE;AACxE,0BAAc,mBAxBd;AAyBA,0BAAc,oBAzBd;AA0BA,0BAAc,4BA1Bd;AA2BA,0BAAc,qBA3Bd;AA4BA,0BAAc,yBA5Bd;AA6BA,0BAAc,0BA7Bd;AA8BA,0BAAc,wBA9Bd;AA+BA,0BAAc,4BA/Bd;AAgCA,0BAAc,qBAhCd;AAiCA,0BAAc,qBAjCd;AAkCA,0BAAc,wBAlCd;AAmCA,0BAAc,yBAnCd;AAoCA,0BAAc,sBApCd;AAqCA,0BAAc,kBArCd;AAsCA,0BAAc,kBAtCd;AAuCA,0BAAc,uBAvCd;AAwCA,0BAAc,mBAxCd;AAyCA,0BAAc,sBAzCd;AA0CA,0BAAc,sBA1Cd;AA2CA,0BAAc,6BA3Cd;AA4CA,0BAAc,kBA5Cd;AA6CA,0BAAc,0BA7Cd;AA8CA,0BAAc,kBA9Cd;AA+CA,0BAAc,yBA/Cd;AAgDA,0BAAc,iBAhDd;AAiDA,0BAAc,oBAjDd;AAkDA,0BAAc,oBAlDd;AAmDA,0BAAc,qBAnDd;AAoDA,0BAAc,sBApDd;AAqDA,0BAAc,wBArDd;AAsDA,0BAAc,oBAtDd;AAuDA,0BAAc,sBAvDd;AAwDA,0BAAc,6BAxDd;AAyDA,0BAAc,+BAzDd;AA0DA,0BAAc,2BA1Dd;AA2DA,0BAAc,0BA3Dd;AAgEA,0BAAc,wBAhEd;AAiEA,0BAAc,4BAjEd;AAkEA,0BAAc,yBAlEd;AAmEA,0BAAc,8BAnEd;AAoEA,0BAAc,gCApEd;AAqEA,0BAAc,8BArEd;AAsEA,0BAAc,2BAtEd;AAuEA,0BAAc,oBAvEd;AAwEA,0BAAc,2BAxEd;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './bundle';\n// Deprecated `Corpus*` spellings of the above (R3-482); see `src/corpus.ts`.\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './workspace';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './recents'; // R3-485: the gated recent-projects read (page.home)\nexport * from './openRepository'; // R3-476: host-mediated open-in-a-new-tab (route:read)\nexport * from './openExternal'; // R3-619: host-brokered outward-link open (link:open)\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n// R3-489 (GROVE_AGENT_SPEC): the embedded-agent seam every app shares — the tool-use\n// loop ported from agent-demo (`runAgent` over the host chat slot), the MDX metadata\n// query tool, the headings index collector, the deixis context block, and the fence\n// for corpus-derived bytes entering a loop.\nexport * from './agentLoop';\nexport * from './agentSteering';\nexport * from './agentPause';\nexport * from './agentChatClient';\nexport * from './metadataQueryTool';\nexport * from './collectHeadings';\nexport * from './agentContext';\nexport * from './fence';\nexport * from './platformLink';\n// R3-627: the per-history-entry scratch, and the scroll restoration built on it —\n// Back lands where the reader left, for however many entries deep they go.\nexport * from './entryState';\nexport * from './useEntryState';\nexport * from './scrollRestore';\nexport { ScrollRestoration, type ScrollRestorationProps } from './components/ScrollRestoration';\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAc,0BAAd;AACA,0BAAc,sBADd;AAEA,0BAAc,mBAFd;AAGA,0BAAc,iCAHd;AAQA,yBAA4B;AAC5B,0BAAc,0BATd;AAUA,0BAAc,uCAVd;AAWA,0BAAc,wBAXd;AAYA,0BAAc,qBAZd;AAcA,0BAAc,qBAdd;AAeA,0BAAc,oCAfd;AAgBA,0BAAc,gCAhBd;AAiBA,0BAAc,oBAjBd;AAoBA,0BAAc,6BApBd;AAuBA,6BAAwE;AACxE,0BAAc,mBAxBd;AAyBA,0BAAc,oBAzBd;AA0BA,0BAAc,4BA1Bd;AA2BA,0BAAc,qBA3Bd;AA4BA,0BAAc,yBA5Bd;AA6BA,0BAAc,0BA7Bd;AA8BA,0BAAc,wBA9Bd;AA+BA,0BAAc,4BA/Bd;AAgCA,0BAAc,qBAhCd;AAiCA,0BAAc,qBAjCd;AAkCA,0BAAc,wBAlCd;AAmCA,0BAAc,yBAnCd;AAoCA,0BAAc,sBApCd;AAqCA,0BAAc,kBArCd;AAsCA,0BAAc,kBAtCd;AAuCA,0BAAc,uBAvCd;AAwCA,0BAAc,mBAxCd;AAyCA,0BAAc,sBAzCd;AA0CA,0BAAc,sBA1Cd;AA2CA,0BAAc,6BA3Cd;AA4CA,0BAAc,2BA5Cd;AA6CA,0BAAc,kBA7Cd;AA8CA,0BAAc,0BA9Cd;AA+CA,0BAAc,kBA/Cd;AAgDA,0BAAc,yBAhDd;AAiDA,0BAAc,iBAjDd;AAkDA,0BAAc,oBAlDd;AAmDA,0BAAc,oBAnDd;AAoDA,0BAAc,qBApDd;AAqDA,0BAAc,sBArDd;AAsDA,0BAAc,wBAtDd;AAuDA,0BAAc,oBAvDd;AAwDA,0BAAc,sBAxDd;AAyDA,0BAAc,6BAzDd;AA0DA,0BAAc,+BA1Dd;AA2DA,0BAAc,2BA3Dd;AA4DA,0BAAc,0BA5Dd;AAiEA,0BAAc,wBAjEd;AAkEA,0BAAc,4BAlEd;AAmEA,0BAAc,yBAnEd;AAoEA,0BAAc,8BApEd;AAqEA,0BAAc,gCArEd;AAsEA,0BAAc,8BAtEd;AAuEA,0BAAc,2BAvEd;AAwEA,0BAAc,oBAxEd;AAyEA,0BAAc,2BAzEd;AA4EA,0BAAc,yBA5Ed;AA6EA,0BAAc,4BA7Ed;AA8EA,0BAAc,4BA9Ed;AA+EA,+BAA+D;","names":[]}

package/dist/index.d.cts

@@ -32,6 +32,7 @@ export { FeedFetchResponse, FeedParams, feedFetch } from './feed.cjs';
 export { SecretError, SecretGrant, SecretHints, SecretQuery, SecretType, SecretView, getSecrets, onSecretsChange, requestAddSecret, requestSecret, revokeSecret, useSecrets } from './secrets.cjs';
 export { RecentProject, clearRecentProjects, listRecentProjects } from './recents.cjs';
 export { OpenRepositoryError, OpenRepositoryErrorCode, RepositoryCoordinates, openRepository } from './openRepository.cjs';
+export { OpenExternalError, OpenExternalErrorCode, openExternal } from './openExternal.cjs';
 export { ChatDelta, ChatExecutor, ChatFeatures, ChatMessage, ChatProviderInfo, ChatProviderState, ChatRequest, ChatResult, ChatRole, ChatStopReason, ChatTierModels, ContentPart, ToolDef, chat, describeChat, describeChatState, normalizeProviderInfo, onChatProviderChange, onChatProviderStateChange, useChatProvider, useChatProviderState } from './llm.cjs';
 export { BuildError, ConsoleEntry, ConsoleLevel, Diagnostics, DiagnosticsProvenance, getDiagnostics, onDiagnosticsChange, useDiagnostics } from './diagnostics.cjs';
 export { VcsActionError, VcsBranch, VcsChange, VcsPR, VcsState, getVcsState, onVcsStateChange, refreshDiff, refreshPRs, resetWorkingTree, useVcsState } from './vcs.cjs';
@@ -57,6 +58,10 @@ export { collectHeadings } from './collectHeadings.cjs';
 export { AgentContextAppFields, AgentContextBlock, renderAgentContext, useAgentContext } from './agentContext.cjs';
 export { fenceUntrusted } from './fence.cjs';
 export { PlatformLink, PlatformLinkProps, usePlatformHref } from './platformLink.cjs';
+export { ArrivedNavigation, ENTRY_STATE_MAX_BYTES, NavigationDirection, getArrivedNavigation, receiveNavigation, registerEntryStateCollector, resetEntryState, saveEntryState, subscribeNavigation, takeQueuedEntryState } from './entryState.cjs';
+export { useEntryState, useNavigationDirection } from './useEntryState.cjs';
+export { RESTORE_DEADLINE_MS, RESTORE_EPSILON_PX, RestoreAction, RestoreSample, nextRestoreAction } from './scrollRestore.cjs';
+export { ScrollRestoration, ScrollRestorationProps } from './components/ScrollRestoration.cjs';
 export { Admonition, AdmonitionType } from './components/Admonition.cjs';
 export { FS_PREFIX, LinkSpace, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';
 export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.cjs';

package/dist/index.d.ts

@@ -32,6 +32,7 @@ export { FeedFetchResponse, FeedParams, feedFetch } from './feed.js';
 export { SecretError, SecretGrant, SecretHints, SecretQuery, SecretType, SecretView, getSecrets, onSecretsChange, requestAddSecret, requestSecret, revokeSecret, useSecrets } from './secrets.js';
 export { RecentProject, clearRecentProjects, listRecentProjects } from './recents.js';
 export { OpenRepositoryError, OpenRepositoryErrorCode, RepositoryCoordinates, openRepository } from './openRepository.js';
+export { OpenExternalError, OpenExternalErrorCode, openExternal } from './openExternal.js';
 export { ChatDelta, ChatExecutor, ChatFeatures, ChatMessage, ChatProviderInfo, ChatProviderState, ChatRequest, ChatResult, ChatRole, ChatStopReason, ChatTierModels, ContentPart, ToolDef, chat, describeChat, describeChatState, normalizeProviderInfo, onChatProviderChange, onChatProviderStateChange, useChatProvider, useChatProviderState } from './llm.js';
 export { BuildError, ConsoleEntry, ConsoleLevel, Diagnostics, DiagnosticsProvenance, getDiagnostics, onDiagnosticsChange, useDiagnostics } from './diagnostics.js';
 export { VcsActionError, VcsBranch, VcsChange, VcsPR, VcsState, getVcsState, onVcsStateChange, refreshDiff, refreshPRs, resetWorkingTree, useVcsState } from './vcs.js';
@@ -57,6 +58,10 @@ export { collectHeadings } from './collectHeadings.js';
 export { AgentContextAppFields, AgentContextBlock, renderAgentContext, useAgentContext } from './agentContext.js';
 export { fenceUntrusted } from './fence.js';
 export { PlatformLink, PlatformLinkProps, usePlatformHref } from './platformLink.js';
+export { ArrivedNavigation, ENTRY_STATE_MAX_BYTES, NavigationDirection, getArrivedNavigation, receiveNavigation, registerEntryStateCollector, resetEntryState, saveEntryState, subscribeNavigation, takeQueuedEntryState } from './entryState.js';
+export { useEntryState, useNavigationDirection } from './useEntryState.js';
+export { RESTORE_DEADLINE_MS, RESTORE_EPSILON_PX, RestoreAction, RestoreSample, nextRestoreAction } from './scrollRestore.js';
+export { ScrollRestoration, ScrollRestorationProps } from './components/ScrollRestoration.js';
 export { Admonition, AdmonitionType } from './components/Admonition.js';
 export { FS_PREFIX, LinkSpace, ResolvedLinkTarget, normalizeAbsolute, resolveLinkTarget } from '@immediately-run/mdx-plugins';
 export { GrantRecord, Member, ResolvedUser, Role, SpaceInfo, getSpaceMembers, inviteToSpace, listAllSpaces, listGrants, listSpaces, lookupUser, revokeGrant, setSpaceRole, unshareSpace } from './generated/spaces.js';

package/dist/index.js

@@ -34,6 +34,7 @@ export * from "./feed";
 export * from "./secrets";
 export * from "./recents";
 export * from "./openRepository";
+export * from "./openExternal";
 export * from "./llm";
 export * from "./diagnostics";
 export * from "./vcs";
@@ -59,8 +60,13 @@ export * from "./collectHeadings";
 export * from "./agentContext";
 export * from "./fence";
 export * from "./platformLink";
+export * from "./entryState";
+export * from "./useEntryState";
+export * from "./scrollRestore";
+import { ScrollRestoration } from "./components/ScrollRestoration";
 export {
   SafeInclude,
+  ScrollRestoration,
   getInjectedMetadataEmitter,
   getInjectedMetadataSnapshot
 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './bundle';\n// Deprecated `Corpus*` spellings of the above (R3-482); see `src/corpus.ts`.\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './workspace';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './recents'; // R3-485: the gated recent-projects read (page.home)\nexport * from './openRepository'; // R3-476: host-mediated open-in-a-new-tab (route:read)\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n// R3-489 (GROVE_AGENT_SPEC): the embedded-agent seam every app shares — the tool-use\n// loop ported from agent-demo (`runAgent` over the host chat slot), the MDX metadata\n// query tool, the headings index collector, the deixis context block, and the fence\n// for corpus-derived bytes entering a loop.\nexport * from './agentLoop';\nexport * from './agentSteering';\nexport * from './agentPause';\nexport * from './agentChatClient';\nexport * from './metadataQueryTool';\nexport * from './collectHeadings';\nexport * from './agentContext';\nexport * from './fence';\nexport * from './platformLink';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAEd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AAGd,SAAS,4BAA4B,mCAAmC;AACxE,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './MDXProvider';\nexport * from './routing';\nexport * from './boot';\nexport * from './components/Include';\n// Only the component is public. `stripFrontmatter`/`appMountRelative` are module-level\n// exports so they can be unit-tested directly, NOT public API — the SDK's surface is\n// backwards-compatible forever, so an internal helper exported for a test's convenience is a\n// permanent commitment made for the wrong reason.\nexport { SafeInclude } from './components/SafeInclude';\nexport * from './sourceCache';\nexport * from './components/MDXComponents';\nexport * from './linkSpace';\nexport * from './bundle';\n// Deprecated `Corpus*` spellings of the above (R3-482); see `src/corpus.ts`.\nexport * from './corpus';\nexport * from './components/MountImage';\nexport * from './components/Routes';\nexport * from './hooks';\n// R3-276: the supported way for a viewer app to provide its own metadata store,\n// replacing a wholesale re-provision of `TinkerableContext` in app code.\nexport * from './metadataSource';\n// The deprecated injected-bundler adapters, re-exported so their deprecation notices\n// are visible in the published docs (R3-278; the window only narrows).\nexport { getInjectedMetadataEmitter, getInjectedMetadataSnapshot } from './injectedBundler';\nexport * from './auth';\nexport * from './theme';\nexport * from './editorContext';\nexport * from './editor';\nexport * from './formFactor';\nexport * from './chromeState';\nexport * from './workspace';\nexport * from './hostAttention';\nexport * from './region';\nexport * from './mounts';\nexport * from './analytics';\nexport * from './contribute';\nexport * from './catalog';\nexport * from './ipc';\nexport * from './dnd';\nexport * from './netFetch';\nexport * from './feed';\nexport * from './secrets';\nexport * from './recents'; // R3-485: the gated recent-projects read (page.home)\nexport * from './openRepository'; // R3-476: host-mediated open-in-a-new-tab (route:read)\nexport * from './openExternal'; // R3-619: host-brokered outward-link open (link:open)\nexport * from './llm';\nexport * from './diagnostics';\nexport * from './vcs';\nexport * from './onFsChange';\nexport * from './fs';\nexport * from './debug';\nexport * from './tasks';\nexport * from './launch';\nexport * from './runtime';\nexport * from './irMarkers';\nexport * from './ready';\nexport * from './loading';\nexport * from './protocolStream';\nexport * from './protocolDeadline';\nexport * from './sandboxTypes';\nexport * from './safeContent';\n// R3-489 (GROVE_AGENT_SPEC): the embedded-agent seam every app shares — the tool-use\n// loop ported from agent-demo (`runAgent` over the host chat slot), the MDX metadata\n// query tool, the headings index collector, the deixis context block, and the fence\n// for corpus-derived bytes entering a loop.\nexport * from './agentLoop';\nexport * from './agentSteering';\nexport * from './agentPause';\nexport * from './agentChatClient';\nexport * from './metadataQueryTool';\nexport * from './collectHeadings';\nexport * from './agentContext';\nexport * from './fence';\nexport * from './platformLink';\n// R3-627: the per-history-entry scratch, and the scroll restoration built on it —\n// Back lands where the reader left, for however many entries deep they go.\nexport * from './entryState';\nexport * from './useEntryState';\nexport * from './scrollRestore';\nexport { ScrollRestoration, type ScrollRestorationProps } from './components/ScrollRestoration';\n"],"mappings":";AAAA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,SAAS,mBAAmB;AAC5B,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAEd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AAGd,SAAS,4BAA4B,mCAAmC;AACxE,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAKd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AAGd,cAAc;AACd,cAAc;AACd,cAAc;AACd,SAAS,yBAAsD;","names":[]}

package/dist/openExternal.cjs

@@ -0,0 +1,41 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var openExternal_exports = {};
+__export(openExternal_exports, {
+  openExternal: () => openExternal
+});
+module.exports = __toCommonJS(openExternal_exports);
+var import_sandboxUtils = require("./sandboxUtils");
+var import_protocol = require("./generated/protocol");
+var import_protocolSchemes = require("./protocolSchemes");
+async function openExternal(url) {
+  const res = await (0, import_sandboxUtils.protocolRequest)(import_protocolSchemes.SCHEMES[import_protocol.PROTOCOL_OPENLINK], "open", [{ url }]);
+  if (!res || res.ok !== true) {
+    const err = new Error(
+      (res && "message" in res ? res.message : void 0) ?? "external link open refused"
+    );
+    err.code = (res && "code" in res ? res.code : void 0) ?? "unknown";
+    throw err;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  openExternal
+});
+//# sourceMappingURL=openExternal.cjs.map

package/dist/openExternal.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/openExternal.ts"],"sourcesContent":["// Host-mediated \"open this external link in a new tab\" (R3-619).\n//\n// An app frame cannot open an ordinary top-level tab itself for a destination that has to\n// act as itself: a `window.open` or `<a target=\"_blank\">` from inside the sandboxed frame\n// inherits the sandbox (`allow-popups` without `allow-popups-to-escape-sandbox`), so the\n// opened tab runs at the same opaque origin and anything that signs in or posts fails.\n//\n// Unlike `openRepository`, the app here names a URL, not coordinates — the destination is\n// arbitrary, not a platform route. So the host validates the URL and confirms every call\n// (the full destination in its own chrome, opened only on the user's click). The app never\n// receives a `Window` handle; it asks, and the host decides whether and how to open.\n//\n// The same two host-side conditions as `openRepository` hold, and neither is something this\n// call can assert for itself: the confirmation needs the HOST document's live transient\n// user activation (a real click, which the host samples rather than believes), and the\n// confirmation must not consume that activation before the open. Both surface here as\n// ordinary coded refusals.\nimport { protocolRequest } from './sandboxUtils';\nimport { PROTOCOL_OPENLINK } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** Why the host refused to open the link.\n *\n *  - `invalid` — the URL is not a clean `https:` external destination (scheme, credentials,\n *    length, or the host's own origin).\n *  - `no-activation` — no live user gesture on the host document. Call this from a click\n *    handler; a timer or a boot path will always get this.\n *  - `declined` — the host showed the confirmation and the user did not confirm.\n *  - `forbidden` — the app does not hold the baseline `link:open` capability.\n *  - `unsupported` — this host has no outward-link surface wired (an older host).\n *  - `unknown` — the host refused without naming a code. */\nexport type OpenExternalErrorCode = 'invalid' | 'no-activation' | 'declined' | 'forbidden' | 'unsupported' | 'unknown';\n\nexport interface OpenExternalError extends Error {\n  code: OpenExternalErrorCode;\n}\n\n/** The host's reply: the envelope resolves inside the promise, so a refusal is a resolved\n *  `{ ok: false }` rather than a rejection at the transport layer. */\ntype OpenExternalReply = { ok: true; url?: string } | { ok: false; code?: string; message?: string };\n\n/**\n * Ask the host to open an external link in a new browser tab.\n *\n * Resolves once the host has performed the open; it does not wait for — and cannot observe —\n * the opened tab loading. Rejects with a typed {@link OpenExternalError} carrying `code` when\n * the host refuses.\n *\n * Call it directly from a user gesture. The host samples its own transient activation when\n * the request arrives, so anything that defers the call past the gesture (an `await` before\n * it, a `setTimeout`, a retry) will be refused `no-activation`. None of the refusals are\n * worth retrying: each names a condition a retry cannot change.\n */\nexport async function openExternal(url: string): Promise<void> {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_OPENLINK], 'open', [{ url }])) as OpenExternalReply;\n  // The refusal resolves inside the reply, so `res.ok !== true` is the only failure test\n  // there is — a bare-promise shape here would swallow every coded refusal as a success.\n  if (!res || res.ok !== true) {\n    const err = new Error(\n      (res && 'message' in res ? res.message : undefined) ?? 'external link open refused',\n    ) as OpenExternalError;\n    err.code = ((res && 'code' in res ? res.code : undefined) as OpenExternalErrorCode) ?? 'unknown';\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBA,0BAAgC;AAChC,sBAAkC;AAClC,6BAAwB;AAkCxB,eAAsB,aAAa,KAA4B;AAC7D,QAAM,MAAO,UAAM,qCAAgB,+BAAQ,iCAAiB,GAAG,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AAGhF,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI;AAAA,OACb,OAAO,aAAa,MAAM,IAAI,UAAU,WAAc;AAAA,IACzD;AACA,QAAI,QAAS,OAAO,UAAU,MAAM,IAAI,OAAO,WAAwC;AACvF,UAAM;AAAA,EACR;AACF;","names":[]}

package/dist/openExternal.d.cts

@@ -0,0 +1,29 @@
+/** Why the host refused to open the link.
+ *
+ *  - `invalid` — the URL is not a clean `https:` external destination (scheme, credentials,
+ *    length, or the host's own origin).
+ *  - `no-activation` — no live user gesture on the host document. Call this from a click
+ *    handler; a timer or a boot path will always get this.
+ *  - `declined` — the host showed the confirmation and the user did not confirm.
+ *  - `forbidden` — the app does not hold the baseline `link:open` capability.
+ *  - `unsupported` — this host has no outward-link surface wired (an older host).
+ *  - `unknown` — the host refused without naming a code. */
+type OpenExternalErrorCode = 'invalid' | 'no-activation' | 'declined' | 'forbidden' | 'unsupported' | 'unknown';
+interface OpenExternalError extends Error {
+    code: OpenExternalErrorCode;
+}
+/**
+ * Ask the host to open an external link in a new browser tab.
+ *
+ * Resolves once the host has performed the open; it does not wait for — and cannot observe —
+ * the opened tab loading. Rejects with a typed {@link OpenExternalError} carrying `code` when
+ * the host refuses.
+ *
+ * Call it directly from a user gesture. The host samples its own transient activation when
+ * the request arrives, so anything that defers the call past the gesture (an `await` before
+ * it, a `setTimeout`, a retry) will be refused `no-activation`. None of the refusals are
+ * worth retrying: each names a condition a retry cannot change.
+ */
+declare function openExternal(url: string): Promise<void>;
+
+export { type OpenExternalError, type OpenExternalErrorCode, openExternal };

package/dist/openExternal.d.ts

@@ -0,0 +1,29 @@
+/** Why the host refused to open the link.
+ *
+ *  - `invalid` — the URL is not a clean `https:` external destination (scheme, credentials,
+ *    length, or the host's own origin).
+ *  - `no-activation` — no live user gesture on the host document. Call this from a click
+ *    handler; a timer or a boot path will always get this.
+ *  - `declined` — the host showed the confirmation and the user did not confirm.
+ *  - `forbidden` — the app does not hold the baseline `link:open` capability.
+ *  - `unsupported` — this host has no outward-link surface wired (an older host).
+ *  - `unknown` — the host refused without naming a code. */
+type OpenExternalErrorCode = 'invalid' | 'no-activation' | 'declined' | 'forbidden' | 'unsupported' | 'unknown';
+interface OpenExternalError extends Error {
+    code: OpenExternalErrorCode;
+}
+/**
+ * Ask the host to open an external link in a new browser tab.
+ *
+ * Resolves once the host has performed the open; it does not wait for — and cannot observe —
+ * the opened tab loading. Rejects with a typed {@link OpenExternalError} carrying `code` when
+ * the host refuses.
+ *
+ * Call it directly from a user gesture. The host samples its own transient activation when
+ * the request arrives, so anything that defers the call past the gesture (an `await` before
+ * it, a `setTimeout`, a retry) will be refused `no-activation`. None of the refusals are
+ * worth retrying: each names a condition a retry cannot change.
+ */
+declare function openExternal(url: string): Promise<void>;
+
+export { type OpenExternalError, type OpenExternalErrorCode, openExternal };

package/dist/openExternal.js

@@ -0,0 +1,18 @@
+import "./chunk-VHAA22YE.js";
+import { protocolRequest } from "./sandboxUtils";
+import { PROTOCOL_OPENLINK } from "./generated/protocol";
+import { SCHEMES } from "./protocolSchemes";
+async function openExternal(url) {
+  const res = await protocolRequest(SCHEMES[PROTOCOL_OPENLINK], "open", [{ url }]);
+  if (!res || res.ok !== true) {
+    const err = new Error(
+      (res && "message" in res ? res.message : void 0) ?? "external link open refused"
+    );
+    err.code = (res && "code" in res ? res.code : void 0) ?? "unknown";
+    throw err;
+  }
+}
+export {
+  openExternal
+};
+//# sourceMappingURL=openExternal.js.map

package/dist/openExternal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/openExternal.ts"],"sourcesContent":["// Host-mediated \"open this external link in a new tab\" (R3-619).\n//\n// An app frame cannot open an ordinary top-level tab itself for a destination that has to\n// act as itself: a `window.open` or `<a target=\"_blank\">` from inside the sandboxed frame\n// inherits the sandbox (`allow-popups` without `allow-popups-to-escape-sandbox`), so the\n// opened tab runs at the same opaque origin and anything that signs in or posts fails.\n//\n// Unlike `openRepository`, the app here names a URL, not coordinates — the destination is\n// arbitrary, not a platform route. So the host validates the URL and confirms every call\n// (the full destination in its own chrome, opened only on the user's click). The app never\n// receives a `Window` handle; it asks, and the host decides whether and how to open.\n//\n// The same two host-side conditions as `openRepository` hold, and neither is something this\n// call can assert for itself: the confirmation needs the HOST document's live transient\n// user activation (a real click, which the host samples rather than believes), and the\n// confirmation must not consume that activation before the open. Both surface here as\n// ordinary coded refusals.\nimport { protocolRequest } from './sandboxUtils';\nimport { PROTOCOL_OPENLINK } from './generated/protocol';\nimport { SCHEMES } from './protocolSchemes';\n\n/** Why the host refused to open the link.\n *\n *  - `invalid` — the URL is not a clean `https:` external destination (scheme, credentials,\n *    length, or the host's own origin).\n *  - `no-activation` — no live user gesture on the host document. Call this from a click\n *    handler; a timer or a boot path will always get this.\n *  - `declined` — the host showed the confirmation and the user did not confirm.\n *  - `forbidden` — the app does not hold the baseline `link:open` capability.\n *  - `unsupported` — this host has no outward-link surface wired (an older host).\n *  - `unknown` — the host refused without naming a code. */\nexport type OpenExternalErrorCode = 'invalid' | 'no-activation' | 'declined' | 'forbidden' | 'unsupported' | 'unknown';\n\nexport interface OpenExternalError extends Error {\n  code: OpenExternalErrorCode;\n}\n\n/** The host's reply: the envelope resolves inside the promise, so a refusal is a resolved\n *  `{ ok: false }` rather than a rejection at the transport layer. */\ntype OpenExternalReply = { ok: true; url?: string } | { ok: false; code?: string; message?: string };\n\n/**\n * Ask the host to open an external link in a new browser tab.\n *\n * Resolves once the host has performed the open; it does not wait for — and cannot observe —\n * the opened tab loading. Rejects with a typed {@link OpenExternalError} carrying `code` when\n * the host refuses.\n *\n * Call it directly from a user gesture. The host samples its own transient activation when\n * the request arrives, so anything that defers the call past the gesture (an `await` before\n * it, a `setTimeout`, a retry) will be refused `no-activation`. None of the refusals are\n * worth retrying: each names a condition a retry cannot change.\n */\nexport async function openExternal(url: string): Promise<void> {\n  const res = (await protocolRequest(SCHEMES[PROTOCOL_OPENLINK], 'open', [{ url }])) as OpenExternalReply;\n  // The refusal resolves inside the reply, so `res.ok !== true` is the only failure test\n  // there is — a bare-promise shape here would swallow every coded refusal as a success.\n  if (!res || res.ok !== true) {\n    const err = new Error(\n      (res && 'message' in res ? res.message : undefined) ?? 'external link open refused',\n    ) as OpenExternalError;\n    err.code = ((res && 'code' in res ? res.code : undefined) as OpenExternalErrorCode) ?? 'unknown';\n    throw err;\n  }\n}\n"],"mappings":";AAiBA,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,eAAe;AAkCxB,eAAsB,aAAa,KAA4B;AAC7D,QAAM,MAAO,MAAM,gBAAgB,QAAQ,iBAAiB,GAAG,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AAGhF,MAAI,CAAC,OAAO,IAAI,OAAO,MAAM;AAC3B,UAAM,MAAM,IAAI;AAAA,OACb,OAAO,aAAa,MAAM,IAAI,UAAU,WAAc;AAAA,IACzD;AACA,QAAI,QAAS,OAAO,UAAU,MAAM,IAAI,OAAO,WAAwC;AACvF,UAAM;AAAA,EACR;AACF;","names":[]}

package/dist/platformLink.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/platformLink.tsx"],"sourcesContent":["import type { AnchorHTMLAttributes, ReactNode } from 'react';\nimport { use } from 'react';\n\nimport { isBrowserGestureClick, useComposedAnchorClick } from './anchorClick';\nimport { navigate } from './routing';\nimport { TinkerableContext } from './TinkerableContext';\nimport { platformHref } from './urlUtils';\n\n/**\n * Build a PLATFORM-space href (`/present/…`, `/edit/github/…`, `/home`) in the host's URL\n * space, reading `outerHref` from {@link TinkerableContext} the way `useTinkerableLink` does.\n * The returned closure is fresh each render (its output is pure, so identity churn is\n * harmless); an empty context (no host, `vite dev`) yields the path unchanged.\n *\n * Prefer {@link PlatformLink} over calling this directly. An href alone does not reach a\n * platform route from inside the app frame (see that component), so a consumer that renders\n * its own anchor from this string must ask the host itself — otherwise it ships a link that\n * copies and opens-in-new-tab correctly and does nothing at all on a plain click. It is kept\n * exported because the wire and the module surface are additive-only\n * (`SDK_PACKAGING_SPEC` §9): an app pinned to an older SDK may already import it.\n */\nexport const usePlatformHref = (): ((path: string) => string) => {\n  const { outerHref } = use(TinkerableContext);\n  return (path: string) => platformHref(outerHref, path);\n};\n\n/**\n * Targets that reuse an existing browsing context. All three are unreachable from inside the\n * sandboxed app frame by the anchor alone — `_top`/`_parent` are refused outright, `_self`\n * merely moves the frame — so all three are asked of the host instead. Anything else opens a\n * new context, which the sandbox allows.\n */\nconst SAME_CONTEXT_TARGETS = new Set(['_top', '_self', '_parent']);\n\nexport interface PlatformLinkProps extends Omit<AnchorHTMLAttributes<HTMLAnchorElement>, 'href'> {\n  /** A root-relative platform path, e.g. `/present/github/acme/todo`. */\n  path: string;\n  children?: ReactNode;\n}\n\n/**\n * The ONE way to render an anchor to a PLATFORM route.\n *\n * It builds the href with {@link platformHref} (resolving against the host's outer origin)\n * and, on a plain left-click, asks the HOST to perform the navigation.\n *\n * **Why the anchor alone does not work (R3-568).** Until R3-568 this component relied solely\n * on `target=\"_top\"`. The app frame's sandbox omits `allow-top-navigation-by-user-activation`\n * deliberately — an app that can move the top-level window on its own schedule is a phishing\n * primitive — so the browser refuses outright and logs *\"Unsafe attempt to initiate\n * navigation…\"*. Every platform link in every app was inert on the host: measured on\n * production, no Open, no Fork, no Run, and no way to sign in.\n *\n * The host is therefore the only thing that can perform this navigation, and it is asked the\n * same way in-app routing asks — {@link navigate}. The host decides: it accepts a target\n * outside the app's own path prefix only when the target is same-origin, is a recognised\n * platform route, and the HOST's own `navigator.userActivation` says a person just acted.\n * Nothing the app asserts substitutes for that gesture, and a refusal is the host's to report.\n *\n * **The `href` and `target` stay.** They are what make copy-link, middle-click and\n * open-in-new-tab produce something that resolves for another reader — gestures the sandbox\n * does allow (`allow-popups`), which the handler below deliberately declines to intercept.\n * The href is also the correct behaviour with no host at all (`vite dev`), where there is\n * nobody to ask.\n *\n * External URLs (`https://…`) are not platform routes and should stay plain\n * `<a target=\"_blank\">` anchors.\n */\nexport function PlatformLink({ path, children, onClick, target = '_top', ...rest }: PlatformLinkProps) {\n  const { outerHref } = use(TinkerableContext);\n  const href = platformHref(outerHref, path);\n\n  const clickHandler = useComposedAnchorClick(\n    onClick,\n    (event) => {\n      // Open-in-new-tab gestures are the browser's — the sandbox allows those.\n      if (isBrowserGestureClick(event)) return;\n      // Intercept every target that stays in an EXISTING browsing context, not just the\n      // default. `_top` and `_parent` both address the host document from inside the app\n      // frame and are refused by the same missing sandbox flag; `_self` would navigate the\n      // app frame itself to a host URL, framing the host inside its own sandbox — the\n      // regression `components/Link.tsx` documents. Only a NEW context (`_blank`, a named\n      // window) is genuinely the browser's, because that is what `allow-popups` permits.\n      if (!SAME_CONTEXT_TARGETS.has(target)) return;\n      // No host (`vite dev`): there is nobody to ask, and the anchor's own href is right.\n      if (!outerHref) return;\n      event.preventDefault();\n      navigate(href);\n    },\n    [href, outerHref, target],\n  );\n\n  return (\n    <a {...rest} href={href} target={target} onClick={clickHandler}>\n      {children}\n    </a>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA6FI;AA5FJ,mBAAoB;AAEpB,yBAA8D;AAC9D,qBAAyB;AACzB,+BAAkC;AAClC,sBAA6B;AAetB,MAAM,kBAAkB,MAAkC;AAC/D,QAAM,EAAE,UAAU,QAAI,kBAAI,0CAAiB;AAC3C,SAAO,CAAC,aAAiB,8BAAa,WAAW,IAAI;AACvD;AAQA,MAAM,uBAAuB,oBAAI,IAAI,CAAC,QAAQ,SAAS,SAAS,CAAC;AAoC1D,SAAS,aAAa,EAAE,MAAM,UAAU,SAAS,SAAS,QAAQ,GAAG,KAAK,GAAsB;AACrG,QAAM,EAAE,UAAU,QAAI,kBAAI,0CAAiB;AAC3C,QAAM,WAAO,8BAAa,WAAW,IAAI;AAEzC,QAAM,mBAAe;AAAA,IACnB;AAAA,IACA,CAAC,UAAU;AAET,cAAI,0CAAsB,KAAK,EAAG;AAOlC,UAAI,CAAC,qBAAqB,IAAI,MAAM,EAAG;AAEvC,UAAI,CAAC,UAAW;AAChB,YAAM,eAAe;AACrB,mCAAS,IAAI;AAAA,IACf;AAAA,IACA,CAAC,MAAM,WAAW,MAAM;AAAA,EAC1B;AAEA,SACE,4CAAC,OAAG,GAAG,MAAM,MAAY,QAAgB,SAAS,cAC/C,UACH;AAEJ;","names":[]}
+{"version":3,"sources":["../src/platformLink.tsx"],"sourcesContent":["import type { AnchorHTMLAttributes, ReactNode } from 'react';\nimport { use } from 'react';\n\nimport { isBrowserGestureClick, useComposedAnchorClick } from './anchorClick';\nimport { navigate } from './routing';\nimport { TinkerableContext } from './TinkerableContext';\nimport { platformHref } from './urlUtils';\n\n/**\n * Build a PLATFORM-space href (`/present/…`, `/edit/github/…`, `/home`) in the host's URL\n * space, reading `outerHref` from {@link TinkerableContext} the way `useTinkerableLink` does.\n * The returned closure is fresh each render (its output is pure, so identity churn is\n * harmless); an empty context (no host, `vite dev`) yields the path unchanged.\n *\n * Prefer {@link PlatformLink} over calling this directly. An href alone does not reach a\n * platform route from inside the app frame (see that component), so a consumer that renders\n * its own anchor from this string must ask the host itself — otherwise it ships a link that\n * copies and opens-in-new-tab correctly and does nothing at all on a plain click. It is kept\n * exported because the wire and the module surface are additive-only\n * (`SDK_PACKAGING_SPEC` §9): an app pinned to an older SDK may already import it.\n */\nexport const usePlatformHref = (): ((path: string) => string) => {\n  const { outerHref } = use(TinkerableContext);\n  return (path: string) => platformHref(outerHref, path);\n};\n\n/**\n * Targets that reuse an existing browsing context. All three are unreachable from inside the\n * sandboxed app frame by the anchor alone — `_top`/`_parent` are refused outright, `_self`\n * merely moves the frame — so all three are asked of the host instead. Anything else opens a\n * new context, which the sandbox allows.\n */\nconst SAME_CONTEXT_TARGETS = new Set(['_top', '_self', '_parent']);\n\nexport interface PlatformLinkProps extends Omit<AnchorHTMLAttributes<HTMLAnchorElement>, 'href'> {\n  /** A root-relative platform path, e.g. `/present/github/acme/todo`. */\n  path: string;\n  children?: ReactNode;\n}\n\n/**\n * The ONE way to render an anchor to a PLATFORM route.\n *\n * It builds the href with {@link platformHref} (resolving against the host's outer origin)\n * and, on a plain left-click, asks the HOST to perform the navigation.\n *\n * **Why the anchor alone does not work (R3-568).** Until R3-568 this component relied solely\n * on `target=\"_top\"`. The app frame's sandbox omits `allow-top-navigation-by-user-activation`\n * deliberately — an app that can move the top-level window on its own schedule is a phishing\n * primitive — so the browser refuses outright and logs *\"Unsafe attempt to initiate\n * navigation…\"*. Every platform link in every app was inert on the host: measured on\n * production, no Open, no Fork, no Run, and no way to sign in.\n *\n * The host is therefore the only thing that can perform this navigation, and it is asked the\n * same way in-app routing asks — {@link navigate}. The host decides: it accepts a target\n * outside the app's own path prefix only when the target is same-origin, is a recognised\n * platform route, and the HOST's own `navigator.userActivation` says a person just acted.\n * Nothing the app asserts substitutes for that gesture, and a refusal is the host's to report.\n *\n * **The `href` and `target` stay.** They are what make copy-link, middle-click and\n * open-in-new-tab produce something that resolves for another reader — gestures the sandbox\n * does allow (`allow-popups`), which the handler below deliberately declines to intercept.\n * The href is also the correct behaviour with no host at all (`vite dev`), where there is\n * nobody to ask.\n *\n * External URLs (`https://…`) are not platform routes. On a host they should be opened\n * through {@link openExternal} — the app asks the host, which validates the URL, confirms\n * the destination, and opens the tab (a plain `<a target=\"_blank\">` from inside the\n * sandboxed frame opens a tab with no origin of its own, so anything that signs in or\n * posts fails). The plain `<a target=\"_blank\">` anchor is kept only as the no-host\n * fallback (`vite dev`), where there is nobody to ask.\n */\nexport function PlatformLink({ path, children, onClick, target = '_top', ...rest }: PlatformLinkProps) {\n  const { outerHref } = use(TinkerableContext);\n  const href = platformHref(outerHref, path);\n\n  const clickHandler = useComposedAnchorClick(\n    onClick,\n    (event) => {\n      // Open-in-new-tab gestures are the browser's — the sandbox allows those.\n      if (isBrowserGestureClick(event)) return;\n      // Intercept every target that stays in an EXISTING browsing context, not just the\n      // default. `_top` and `_parent` both address the host document from inside the app\n      // frame and are refused by the same missing sandbox flag; `_self` would navigate the\n      // app frame itself to a host URL, framing the host inside its own sandbox — the\n      // regression `components/Link.tsx` documents. Only a NEW context (`_blank`, a named\n      // window) is genuinely the browser's, because that is what `allow-popups` permits.\n      if (!SAME_CONTEXT_TARGETS.has(target)) return;\n      // No host (`vite dev`): there is nobody to ask, and the anchor's own href is right.\n      if (!outerHref) return;\n      event.preventDefault();\n      navigate(href);\n    },\n    [href, outerHref, target],\n  );\n\n  return (\n    <a {...rest} href={href} target={target} onClick={clickHandler}>\n      {children}\n    </a>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiGI;AAhGJ,mBAAoB;AAEpB,yBAA8D;AAC9D,qBAAyB;AACzB,+BAAkC;AAClC,sBAA6B;AAetB,MAAM,kBAAkB,MAAkC;AAC/D,QAAM,EAAE,UAAU,QAAI,kBAAI,0CAAiB;AAC3C,SAAO,CAAC,aAAiB,8BAAa,WAAW,IAAI;AACvD;AAQA,MAAM,uBAAuB,oBAAI,IAAI,CAAC,QAAQ,SAAS,SAAS,CAAC;AAwC1D,SAAS,aAAa,EAAE,MAAM,UAAU,SAAS,SAAS,QAAQ,GAAG,KAAK,GAAsB;AACrG,QAAM,EAAE,UAAU,QAAI,kBAAI,0CAAiB;AAC3C,QAAM,WAAO,8BAAa,WAAW,IAAI;AAEzC,QAAM,mBAAe;AAAA,IACnB;AAAA,IACA,CAAC,UAAU;AAET,cAAI,0CAAsB,KAAK,EAAG;AAOlC,UAAI,CAAC,qBAAqB,IAAI,MAAM,EAAG;AAEvC,UAAI,CAAC,UAAW;AAChB,YAAM,eAAe;AACrB,mCAAS,IAAI;AAAA,IACf;AAAA,IACA,CAAC,MAAM,WAAW,MAAM;AAAA,EAC1B;AAEA,SACE,4CAAC,OAAG,GAAG,MAAM,MAAY,QAAgB,SAAS,cAC/C,UACH;AAEJ;","names":[]}

package/dist/platformLink.d.cts

@@ -45,8 +45,12 @@ interface PlatformLinkProps extends Omit<AnchorHTMLAttributes<HTMLAnchorElement>
  * The href is also the correct behaviour with no host at all (`vite dev`), where there is
  * nobody to ask.
  *
- * External URLs (`https://…`) are not platform routes and should stay plain
- * `<a target="_blank">` anchors.
+ * External URLs (`https://…`) are not platform routes. On a host they should be opened
+ * through {@link openExternal} — the app asks the host, which validates the URL, confirms
+ * the destination, and opens the tab (a plain `<a target="_blank">` from inside the
+ * sandboxed frame opens a tab with no origin of its own, so anything that signs in or
+ * posts fails). The plain `<a target="_blank">` anchor is kept only as the no-host
+ * fallback (`vite dev`), where there is nobody to ask.
  */
 declare function PlatformLink({ path, children, onClick, target, ...rest }: PlatformLinkProps): react.JSX.Element;
 

package/dist/platformLink.d.ts

@@ -45,8 +45,12 @@ interface PlatformLinkProps extends Omit<AnchorHTMLAttributes<HTMLAnchorElement>
  * The href is also the correct behaviour with no host at all (`vite dev`), where there is
  * nobody to ask.
  *
- * External URLs (`https://…`) are not platform routes and should stay plain
- * `<a target="_blank">` anchors.
+ * External URLs (`https://…`) are not platform routes. On a host they should be opened
+ * through {@link openExternal} — the app asks the host, which validates the URL, confirms
+ * the destination, and opens the tab (a plain `<a target="_blank">` from inside the
+ * sandboxed frame opens a tab with no origin of its own, so anything that signs in or
+ * posts fails). The plain `<a target="_blank">` anchor is kept only as the no-host
+ * fallback (`vite dev`), where there is nobody to ask.
  */
 declare function PlatformLink({ path, children, onClick, target, ...rest }: PlatformLinkProps): react.JSX.Element;
 

package/dist/platformLink.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/platformLink.tsx"],"sourcesContent":["import type { AnchorHTMLAttributes, ReactNode } from 'react';\nimport { use } from 'react';\n\nimport { isBrowserGestureClick, useComposedAnchorClick } from './anchorClick';\nimport { navigate } from './routing';\nimport { TinkerableContext } from './TinkerableContext';\nimport { platformHref } from './urlUtils';\n\n/**\n * Build a PLATFORM-space href (`/present/…`, `/edit/github/…`, `/home`) in the host's URL\n * space, reading `outerHref` from {@link TinkerableContext} the way `useTinkerableLink` does.\n * The returned closure is fresh each render (its output is pure, so identity churn is\n * harmless); an empty context (no host, `vite dev`) yields the path unchanged.\n *\n * Prefer {@link PlatformLink} over calling this directly. An href alone does not reach a\n * platform route from inside the app frame (see that component), so a consumer that renders\n * its own anchor from this string must ask the host itself — otherwise it ships a link that\n * copies and opens-in-new-tab correctly and does nothing at all on a plain click. It is kept\n * exported because the wire and the module surface are additive-only\n * (`SDK_PACKAGING_SPEC` §9): an app pinned to an older SDK may already import it.\n */\nexport const usePlatformHref = (): ((path: string) => string) => {\n  const { outerHref } = use(TinkerableContext);\n  return (path: string) => platformHref(outerHref, path);\n};\n\n/**\n * Targets that reuse an existing browsing context. All three are unreachable from inside the\n * sandboxed app frame by the anchor alone — `_top`/`_parent` are refused outright, `_self`\n * merely moves the frame — so all three are asked of the host instead. Anything else opens a\n * new context, which the sandbox allows.\n */\nconst SAME_CONTEXT_TARGETS = new Set(['_top', '_self', '_parent']);\n\nexport interface PlatformLinkProps extends Omit<AnchorHTMLAttributes<HTMLAnchorElement>, 'href'> {\n  /** A root-relative platform path, e.g. `/present/github/acme/todo`. */\n  path: string;\n  children?: ReactNode;\n}\n\n/**\n * The ONE way to render an anchor to a PLATFORM route.\n *\n * It builds the href with {@link platformHref} (resolving against the host's outer origin)\n * and, on a plain left-click, asks the HOST to perform the navigation.\n *\n * **Why the anchor alone does not work (R3-568).** Until R3-568 this component relied solely\n * on `target=\"_top\"`. The app frame's sandbox omits `allow-top-navigation-by-user-activation`\n * deliberately — an app that can move the top-level window on its own schedule is a phishing\n * primitive — so the browser refuses outright and logs *\"Unsafe attempt to initiate\n * navigation…\"*. Every platform link in every app was inert on the host: measured on\n * production, no Open, no Fork, no Run, and no way to sign in.\n *\n * The host is therefore the only thing that can perform this navigation, and it is asked the\n * same way in-app routing asks — {@link navigate}. The host decides: it accepts a target\n * outside the app's own path prefix only when the target is same-origin, is a recognised\n * platform route, and the HOST's own `navigator.userActivation` says a person just acted.\n * Nothing the app asserts substitutes for that gesture, and a refusal is the host's to report.\n *\n * **The `href` and `target` stay.** They are what make copy-link, middle-click and\n * open-in-new-tab produce something that resolves for another reader — gestures the sandbox\n * does allow (`allow-popups`), which the handler below deliberately declines to intercept.\n * The href is also the correct behaviour with no host at all (`vite dev`), where there is\n * nobody to ask.\n *\n * External URLs (`https://…`) are not platform routes and should stay plain\n * `<a target=\"_blank\">` anchors.\n */\nexport function PlatformLink({ path, children, onClick, target = '_top', ...rest }: PlatformLinkProps) {\n  const { outerHref } = use(TinkerableContext);\n  const href = platformHref(outerHref, path);\n\n  const clickHandler = useComposedAnchorClick(\n    onClick,\n    (event) => {\n      // Open-in-new-tab gestures are the browser's — the sandbox allows those.\n      if (isBrowserGestureClick(event)) return;\n      // Intercept every target that stays in an EXISTING browsing context, not just the\n      // default. `_top` and `_parent` both address the host document from inside the app\n      // frame and are refused by the same missing sandbox flag; `_self` would navigate the\n      // app frame itself to a host URL, framing the host inside its own sandbox — the\n      // regression `components/Link.tsx` documents. Only a NEW context (`_blank`, a named\n      // window) is genuinely the browser's, because that is what `allow-popups` permits.\n      if (!SAME_CONTEXT_TARGETS.has(target)) return;\n      // No host (`vite dev`): there is nobody to ask, and the anchor's own href is right.\n      if (!outerHref) return;\n      event.preventDefault();\n      navigate(href);\n    },\n    [href, outerHref, target],\n  );\n\n  return (\n    <a {...rest} href={href} target={target} onClick={clickHandler}>\n      {children}\n    </a>\n  );\n}\n"],"mappings":";AA6FI;AA5FJ,SAAS,WAAW;AAEpB,SAAS,uBAAuB,8BAA8B;AAC9D,SAAS,gBAAgB;AACzB,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAetB,MAAM,kBAAkB,MAAkC;AAC/D,QAAM,EAAE,UAAU,IAAI,IAAI,iBAAiB;AAC3C,SAAO,CAAC,SAAiB,aAAa,WAAW,IAAI;AACvD;AAQA,MAAM,uBAAuB,oBAAI,IAAI,CAAC,QAAQ,SAAS,SAAS,CAAC;AAoC1D,SAAS,aAAa,EAAE,MAAM,UAAU,SAAS,SAAS,QAAQ,GAAG,KAAK,GAAsB;AACrG,QAAM,EAAE,UAAU,IAAI,IAAI,iBAAiB;AAC3C,QAAM,OAAO,aAAa,WAAW,IAAI;AAEzC,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,CAAC,UAAU;AAET,UAAI,sBAAsB,KAAK,EAAG;AAOlC,UAAI,CAAC,qBAAqB,IAAI,MAAM,EAAG;AAEvC,UAAI,CAAC,UAAW;AAChB,YAAM,eAAe;AACrB,eAAS,IAAI;AAAA,IACf;AAAA,IACA,CAAC,MAAM,WAAW,MAAM;AAAA,EAC1B;AAEA,SACE,oBAAC,OAAG,GAAG,MAAM,MAAY,QAAgB,SAAS,cAC/C,UACH;AAEJ;","names":[]}
+{"version":3,"sources":["../src/platformLink.tsx"],"sourcesContent":["import type { AnchorHTMLAttributes, ReactNode } from 'react';\nimport { use } from 'react';\n\nimport { isBrowserGestureClick, useComposedAnchorClick } from './anchorClick';\nimport { navigate } from './routing';\nimport { TinkerableContext } from './TinkerableContext';\nimport { platformHref } from './urlUtils';\n\n/**\n * Build a PLATFORM-space href (`/present/…`, `/edit/github/…`, `/home`) in the host's URL\n * space, reading `outerHref` from {@link TinkerableContext} the way `useTinkerableLink` does.\n * The returned closure is fresh each render (its output is pure, so identity churn is\n * harmless); an empty context (no host, `vite dev`) yields the path unchanged.\n *\n * Prefer {@link PlatformLink} over calling this directly. An href alone does not reach a\n * platform route from inside the app frame (see that component), so a consumer that renders\n * its own anchor from this string must ask the host itself — otherwise it ships a link that\n * copies and opens-in-new-tab correctly and does nothing at all on a plain click. It is kept\n * exported because the wire and the module surface are additive-only\n * (`SDK_PACKAGING_SPEC` §9): an app pinned to an older SDK may already import it.\n */\nexport const usePlatformHref = (): ((path: string) => string) => {\n  const { outerHref } = use(TinkerableContext);\n  return (path: string) => platformHref(outerHref, path);\n};\n\n/**\n * Targets that reuse an existing browsing context. All three are unreachable from inside the\n * sandboxed app frame by the anchor alone — `_top`/`_parent` are refused outright, `_self`\n * merely moves the frame — so all three are asked of the host instead. Anything else opens a\n * new context, which the sandbox allows.\n */\nconst SAME_CONTEXT_TARGETS = new Set(['_top', '_self', '_parent']);\n\nexport interface PlatformLinkProps extends Omit<AnchorHTMLAttributes<HTMLAnchorElement>, 'href'> {\n  /** A root-relative platform path, e.g. `/present/github/acme/todo`. */\n  path: string;\n  children?: ReactNode;\n}\n\n/**\n * The ONE way to render an anchor to a PLATFORM route.\n *\n * It builds the href with {@link platformHref} (resolving against the host's outer origin)\n * and, on a plain left-click, asks the HOST to perform the navigation.\n *\n * **Why the anchor alone does not work (R3-568).** Until R3-568 this component relied solely\n * on `target=\"_top\"`. The app frame's sandbox omits `allow-top-navigation-by-user-activation`\n * deliberately — an app that can move the top-level window on its own schedule is a phishing\n * primitive — so the browser refuses outright and logs *\"Unsafe attempt to initiate\n * navigation…\"*. Every platform link in every app was inert on the host: measured on\n * production, no Open, no Fork, no Run, and no way to sign in.\n *\n * The host is therefore the only thing that can perform this navigation, and it is asked the\n * same way in-app routing asks — {@link navigate}. The host decides: it accepts a target\n * outside the app's own path prefix only when the target is same-origin, is a recognised\n * platform route, and the HOST's own `navigator.userActivation` says a person just acted.\n * Nothing the app asserts substitutes for that gesture, and a refusal is the host's to report.\n *\n * **The `href` and `target` stay.** They are what make copy-link, middle-click and\n * open-in-new-tab produce something that resolves for another reader — gestures the sandbox\n * does allow (`allow-popups`), which the handler below deliberately declines to intercept.\n * The href is also the correct behaviour with no host at all (`vite dev`), where there is\n * nobody to ask.\n *\n * External URLs (`https://…`) are not platform routes. On a host they should be opened\n * through {@link openExternal} — the app asks the host, which validates the URL, confirms\n * the destination, and opens the tab (a plain `<a target=\"_blank\">` from inside the\n * sandboxed frame opens a tab with no origin of its own, so anything that signs in or\n * posts fails). The plain `<a target=\"_blank\">` anchor is kept only as the no-host\n * fallback (`vite dev`), where there is nobody to ask.\n */\nexport function PlatformLink({ path, children, onClick, target = '_top', ...rest }: PlatformLinkProps) {\n  const { outerHref } = use(TinkerableContext);\n  const href = platformHref(outerHref, path);\n\n  const clickHandler = useComposedAnchorClick(\n    onClick,\n    (event) => {\n      // Open-in-new-tab gestures are the browser's — the sandbox allows those.\n      if (isBrowserGestureClick(event)) return;\n      // Intercept every target that stays in an EXISTING browsing context, not just the\n      // default. `_top` and `_parent` both address the host document from inside the app\n      // frame and are refused by the same missing sandbox flag; `_self` would navigate the\n      // app frame itself to a host URL, framing the host inside its own sandbox — the\n      // regression `components/Link.tsx` documents. Only a NEW context (`_blank`, a named\n      // window) is genuinely the browser's, because that is what `allow-popups` permits.\n      if (!SAME_CONTEXT_TARGETS.has(target)) return;\n      // No host (`vite dev`): there is nobody to ask, and the anchor's own href is right.\n      if (!outerHref) return;\n      event.preventDefault();\n      navigate(href);\n    },\n    [href, outerHref, target],\n  );\n\n  return (\n    <a {...rest} href={href} target={target} onClick={clickHandler}>\n      {children}\n    </a>\n  );\n}\n"],"mappings":";AAiGI;AAhGJ,SAAS,WAAW;AAEpB,SAAS,uBAAuB,8BAA8B;AAC9D,SAAS,gBAAgB;AACzB,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAetB,MAAM,kBAAkB,MAAkC;AAC/D,QAAM,EAAE,UAAU,IAAI,IAAI,iBAAiB;AAC3C,SAAO,CAAC,SAAiB,aAAa,WAAW,IAAI;AACvD;AAQA,MAAM,uBAAuB,oBAAI,IAAI,CAAC,QAAQ,SAAS,SAAS,CAAC;AAwC1D,SAAS,aAAa,EAAE,MAAM,UAAU,SAAS,SAAS,QAAQ,GAAG,KAAK,GAAsB;AACrG,QAAM,EAAE,UAAU,IAAI,IAAI,iBAAiB;AAC3C,QAAM,OAAO,aAAa,WAAW,IAAI;AAEzC,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,CAAC,UAAU;AAET,UAAI,sBAAsB,KAAK,EAAG;AAOlC,UAAI,CAAC,qBAAqB,IAAI,MAAM,EAAG;AAEvC,UAAI,CAAC,UAAW;AAChB,YAAM,eAAe;AACrB,eAAS,IAAI;AAAA,IACf;AAAA,IACA,CAAC,MAAM,WAAW,MAAM;AAAA,EAC1B;AAEA,SACE,oBAAC,OAAG,GAAG,MAAM,MAAY,QAAgB,SAAS,cAC/C,UACH;AAEJ;","names":[]}

package/dist/protocolSchemes.cjs

@@ -35,6 +35,7 @@ const SCHEMES = {
   [import_protocol.PROTOCOL_LAUNCH]: schemeOf(import_protocol.PROTOCOL_LAUNCH),
   [import_protocol.PROTOCOL_LLM]: schemeOf(import_protocol.PROTOCOL_LLM),
   [import_protocol.PROTOCOL_LOCALSTORE]: schemeOf(import_protocol.PROTOCOL_LOCALSTORE),
+  [import_protocol.PROTOCOL_OPENLINK]: schemeOf(import_protocol.PROTOCOL_OPENLINK),
   [import_protocol.PROTOCOL_OPENREPO]: schemeOf(import_protocol.PROTOCOL_OPENREPO),
   [import_protocol.PROTOCOL_RECENTS]: schemeOf(import_protocol.PROTOCOL_RECENTS),
   [import_protocol.PROTOCOL_SECRETS]: schemeOf(import_protocol.PROTOCOL_SECRETS),

package/dist/protocolSchemes.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_ANALYTICS,\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FEED,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_LOCALSTORE,\n  PROTOCOL_OPENREPO,\n  PROTOCOL_RECENTS,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FEED]: schemeOf(PROTOCOL_FEED),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_LOCALSTORE]: schemeOf(PROTOCOL_LOCALSTORE),\n  [PROTOCOL_OPENREPO]: schemeOf(PROTOCOL_OPENREPO),\n  [PROTOCOL_RECENTS]: schemeOf(PROTOCOL_RECENTS),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA2BA,sBAmBO;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,kCAAkB,GAAG,SAAS,kCAAkB;AAAA,EACjD,CAAC,mCAAmB,GAAG,SAAS,mCAAmB;AAAA,EACnD,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,mCAAmB,GAAG,SAAS,mCAAmB;AAAA,EACnD,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,gCAAgB,GAAG,SAAS,gCAAgB;AAAA,EAC7C,CAAC,gCAAgB,GAAG,SAAS,gCAAgB;AAAA,EAC7C,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AACvC;","names":[]}
+{"version":3,"sources":["../src/protocolSchemes.ts"],"sourcesContent":["// The `protocol-<scheme>` SCHEMES, derived from the wire names.\n//\n// `protocolRequest(scheme, method, params)` takes the scheme — `'theme'` — while the\n// wire name the frame dispatches on is `'protocol-theme'`; the frame adds the prefix.\n// So the typed service wrappers cannot pass the published `PROTOCOL_*` constant\n// directly, and spelling the scheme inline would put a second, unguarded copy of the\n// name back in the tree — exactly what R3-274c removes.\n//\n// Instead the schemes are *derived* from the wire names, keyed BY the wire name:\n//\n//   protocolRequest(SCHEMES[PROTOCOL_THEME], 'set', [{ theme }])\n//\n// Keying by the constant is what makes the derivation unfalsifiable — there is no\n// second place to name the family, so there is no pair to get wrong. `schemeOf`\n// returns a template-literal conditional, so each value has a literal type (`'theme'`),\n// which buys two more things:\n//\n//   - a wire name that stops matching `protocol-*` stops compiling here, rather than\n//     silently producing an empty scheme at runtime;\n//   - `check-protocol-snapshot.mjs` resolves `SCHEMES[PROTOCOL_THEME]` through the type\n//     checker exactly like a plain literal, so the call sites stay visible to the gate.\n//\n// One export, deliberately: `./*` is a public subpath, so every name added here is\n// public API forever (ways_of_working §6, additive-only).\n//\n// This module is NOT generated — the derivation is the content — so it lives outside\n// `src/generated/`.\nimport {\n  PROTOCOL_ANALYTICS,\n  PROTOCOL_CONTRIBUTE,\n  PROTOCOL_DND,\n  PROTOCOL_EDITOR,\n  PROTOCOL_FEED,\n  PROTOCOL_FETCH,\n  PROTOCOL_IPC,\n  PROTOCOL_LAUNCH,\n  PROTOCOL_LLM,\n  PROTOCOL_LOCALSTORE,\n  PROTOCOL_OPENLINK,\n  PROTOCOL_OPENREPO,\n  PROTOCOL_RECENTS,\n  PROTOCOL_SECRETS,\n  PROTOCOL_SETTINGS,\n  PROTOCOL_SPACES,\n  PROTOCOL_TASK,\n  PROTOCOL_THEME,\n  PROTOCOL_VCS,\n} from './generated/protocol';\n\nconst PREFIX = 'protocol-';\n\n/** The scheme half of a `protocol-<scheme>` wire name. */\ntype SchemeOf<N extends string> = N extends `${typeof PREFIX}${infer S}` ? S : never;\n\n/**\n * `'protocol-theme'` → `'theme'`, as a literal type.\n *\n * The cast is the only place the derivation is asserted rather than computed; the\n * `N extends \\`protocol-${string}\\`` bound is what makes it sound — a wire name that is\n * not scheme-shaped is a compile error at the call, not a `never` at runtime.\n */\nconst schemeOf = <N extends `${typeof PREFIX}${string}`>(name: N): SchemeOf<N> =>\n  name.slice(PREFIX.length) as SchemeOf<N>;\n\n/** Every `protocol-*` scheme the SDK speaks, keyed by its wire name. */\nexport const SCHEMES = {\n  [PROTOCOL_ANALYTICS]: schemeOf(PROTOCOL_ANALYTICS),\n  [PROTOCOL_CONTRIBUTE]: schemeOf(PROTOCOL_CONTRIBUTE),\n  [PROTOCOL_DND]: schemeOf(PROTOCOL_DND),\n  [PROTOCOL_EDITOR]: schemeOf(PROTOCOL_EDITOR),\n  [PROTOCOL_FEED]: schemeOf(PROTOCOL_FEED),\n  [PROTOCOL_FETCH]: schemeOf(PROTOCOL_FETCH),\n  [PROTOCOL_IPC]: schemeOf(PROTOCOL_IPC),\n  [PROTOCOL_LAUNCH]: schemeOf(PROTOCOL_LAUNCH),\n  [PROTOCOL_LLM]: schemeOf(PROTOCOL_LLM),\n  [PROTOCOL_LOCALSTORE]: schemeOf(PROTOCOL_LOCALSTORE),\n  [PROTOCOL_OPENLINK]: schemeOf(PROTOCOL_OPENLINK),\n  [PROTOCOL_OPENREPO]: schemeOf(PROTOCOL_OPENREPO),\n  [PROTOCOL_RECENTS]: schemeOf(PROTOCOL_RECENTS),\n  [PROTOCOL_SECRETS]: schemeOf(PROTOCOL_SECRETS),\n  [PROTOCOL_SETTINGS]: schemeOf(PROTOCOL_SETTINGS),\n  [PROTOCOL_SPACES]: schemeOf(PROTOCOL_SPACES),\n  [PROTOCOL_TASK]: schemeOf(PROTOCOL_TASK),\n  [PROTOCOL_THEME]: schemeOf(PROTOCOL_THEME),\n  [PROTOCOL_VCS]: schemeOf(PROTOCOL_VCS),\n} as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA2BA,sBAoBO;AAEP,MAAM,SAAS;AAYf,MAAM,WAAW,CAAwC,SACvD,KAAK,MAAM,OAAO,MAAM;AAGnB,MAAM,UAAU;AAAA,EACrB,CAAC,kCAAkB,GAAG,SAAS,kCAAkB;AAAA,EACjD,CAAC,mCAAmB,GAAG,SAAS,mCAAmB;AAAA,EACnD,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,4BAAY,GAAG,SAAS,4BAAY;AAAA,EACrC,CAAC,mCAAmB,GAAG,SAAS,mCAAmB;AAAA,EACnD,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,gCAAgB,GAAG,SAAS,gCAAgB;AAAA,EAC7C,CAAC,gCAAgB,GAAG,SAAS,gCAAgB;AAAA,EAC7C,CAAC,iCAAiB,GAAG,SAAS,iCAAiB;AAAA,EAC/C,CAAC,+BAAe,GAAG,SAAS,+BAAe;AAAA,EAC3C,CAAC,6BAAa,GAAG,SAAS,6BAAa;AAAA,EACvC,CAAC,8BAAc,GAAG,SAAS,8BAAc;AAAA,EACzC,CAAC,4BAAY,GAAG,SAAS,4BAAY;AACvC;","names":[]}

package/dist/protocolSchemes.d.cts

@@ -10,6 +10,7 @@ declare const SCHEMES: {
     readonly "protocol-launch": "launch";
     readonly "protocol-llm": "llm";
     readonly "protocol-localstore": "localstore";
+    readonly "protocol-openlink": "openlink";
     readonly "protocol-openrepo": "openrepo";
     readonly "protocol-recents": "recents";
     readonly "protocol-secrets": "secrets";

package/dist/protocolSchemes.d.ts

@@ -10,6 +10,7 @@ declare const SCHEMES: {
     readonly "protocol-launch": "launch";
     readonly "protocol-llm": "llm";
     readonly "protocol-localstore": "localstore";
+    readonly "protocol-openlink": "openlink";
     readonly "protocol-openrepo": "openrepo";
     readonly "protocol-recents": "recents";
     readonly "protocol-secrets": "secrets";