@immediately-run/sdk 0.8.1 → 0.10.0

package/dist/injectedBundler.js

@@ -0,0 +1,24 @@
+const injectedBundler = () => {
+  try {
+    return module?.evaluation?.module?.bundler ?? null;
+  } catch {
+    return null;
+  }
+};
+const getInjectedMetadataEmitter = () => {
+  const b = injectedBundler();
+  if (b && typeof b.onMetadataChange === "function" && b.onMetadataChangeEmitter) {
+    return {
+      onMetadataChange: b.onMetadataChange,
+      enable: () => b.onMetadataChangeEmitter.enable()
+    };
+  }
+  return null;
+};
+const resolveMetadataSource = (injected) => injected ? { event: injected.onMetadataChange, enable: () => injected.enable() } : { event: void 0, enable: () => {
+} };
+export {
+  getInjectedMetadataEmitter,
+  resolveMetadataSource
+};
+//# sourceMappingURL=injectedBundler.js.map

package/dist/injectedBundler.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/injectedBundler.ts"],"sourcesContent":["// Injected sandbox-bundler access (SDK_PACKAGING_SPEC §4/§8, Phase 5). The SDK was\n// historically wired straight to the injected bundler service objects\n// (`module.evaluation.module.bundler.<x>`). Phase 5 makes the SDK transport-agnostic\n// so those services can eventually be retired: every reader PREFERS the injection\n// (so the current, live path stays byte-for-byte unchanged) and FALLS BACK to the\n// §4 transport when the SDK is fetched from npm with no injection present.\n//\n// This module centralizes the `module.evaluation.module.bundler.*` reads (the same\n// philosophy as `sandboxUtils`' transport resolver) and exposes a PURE resolver for\n// the metadata-update subscription so the dual-mode decision is unit-tested without\n// a live bundler. The ambient reads themselves are thin (untestable without the\n// sandbox realm, exactly like `sandboxUtils.transport()`).\n\n/** vscode-style Event source: subscribe with a listener, get a disposable back. */\nexport type EventSource = (listener: (msg: any) => void) => { dispose(): void };\n\n/** The injected bundler's metadata emitter — fires `{type:'metadata-update', update}`\n *  as files (re)compile. Absent when the SDK is npm-fetched (no injection). */\nexport interface InjectedMetadataEmitter {\n  onMetadataChange: EventSource;\n  /** Start the DelayedEmitter once a subscriber is attached (injected path only). */\n  enable(): void;\n}\n\n/** The injected bundler object, or null when there is no injection (npm-fetched). */\nconst injectedBundler = (): any | null => {\n  try {\n    // @ts-ignore - `module.evaluation` is injected by the sandbox runtime\n    return module?.evaluation?.module?.bundler ?? null;\n  } catch {\n    return null;\n  }\n};\n\n/** The injected bundler's metadata emitter, or null when npm-fetched. */\nexport const getInjectedMetadataEmitter = (): InjectedMetadataEmitter | null => {\n  const b = injectedBundler();\n  if (b && typeof b.onMetadataChange === 'function' && b.onMetadataChangeEmitter) {\n    return {\n      onMetadataChange: b.onMetadataChange,\n      enable: () => b.onMetadataChangeEmitter.enable(),\n    };\n  }\n  return null;\n};\n\n/** What `boot` needs to subscribe to metadata updates: the `event` source to hand\n *  `addListener` (the injected emitter, or `undefined` → listen over the transport)\n *  and an `enable` to start the injected DelayedEmitter (a no-op off-injection). */\nexport interface MetadataSource {\n  event?: EventSource;\n  enable(): void;\n}\n\n/**\n * Resolve the metadata-update subscription source (PURE — the dual-mode decision).\n * With the injected emitter: use it and arm it, so the live path is byte-identical.\n * Without it (npm-fetched): return no `event`, so the caller's `addListener` falls\n * back to the §4 transport's `onMessage`, and `enable` is a no-op.\n */\nexport const resolveMetadataSource = (\n  injected: InjectedMetadataEmitter | null,\n): MetadataSource =>\n  injected\n    ? { event: injected.onMetadataChange, enable: () => injected.enable() }\n    : { event: undefined, enable: () => {} };\n"],"mappings":"AAyBA,MAAM,kBAAkB,MAAkB;AACxC,MAAI;AAEF,WAAO,QAAQ,YAAY,QAAQ,WAAW;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,MAAM,6BAA6B,MAAsC;AAC9E,QAAM,IAAI,gBAAgB;AAC1B,MAAI,KAAK,OAAO,EAAE,qBAAqB,cAAc,EAAE,yBAAyB;AAC9E,WAAO;AAAA,MACL,kBAAkB,EAAE;AAAA,MACpB,QAAQ,MAAM,EAAE,wBAAwB,OAAO;AAAA,IACjD;AAAA,EACF;AACA,SAAO;AACT;AAgBO,MAAM,wBAAwB,CACnC,aAEA,WACI,EAAE,OAAO,SAAS,kBAAkB,QAAQ,MAAM,SAAS,OAAO,EAAE,IACpE,EAAE,OAAO,QAAW,QAAQ,MAAM;AAAC,EAAE;","names":[]}

package/dist/irMarkers.cjs

@@ -0,0 +1,72 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var irMarkers_exports = {};
+__export(irMarkers_exports, {
+  IR_MARKERS: () => IR_MARKERS,
+  isAllowedMarkerName: () => isAllowedMarkerName,
+  isIrMarkerName: () => isIrMarkerName,
+  resolveInteractive: () => resolveInteractive,
+  validateMarker: () => validateMarker
+});
+module.exports = __toCommonJS(irMarkers_exports);
+const IR_MARKERS = {
+  "ir.open": ["url", "provider", "ns", "repo", "ref", "refKind"],
+  "ir.fetch": ["source", "bytes", "requestCount", "cacheHit", "httpStatus"],
+  "ir.mount": ["phantomCount", "writablePrimed"],
+  "ir.sandbox.boot": [],
+  "ir.transpile": ["moduleCount", "cacheHit", "bytesIn", "bytesOut"],
+  "ir.deps": ["depCount", "bytes", "requestCount", "cacheHit", "cdn"],
+  "ir.eval": ["moduleCount"],
+  "ir.fmp": [],
+  "ir.interactive": ["cold"],
+  "ir.verify": ["result", "blocking"],
+  "ir.refresh": ["bytes"]
+};
+const SUBMARK_RE = /^(ir\.transpile\.mod|ir\.deps\.pkg)\[[^\]]+\]$/;
+const submarkAggregate = (name) => name.startsWith("ir.transpile.mod") ? "ir.transpile" : name.startsWith("ir.deps.pkg") ? "ir.deps" : null;
+const isIrMarkerName = (name) => Object.prototype.hasOwnProperty.call(IR_MARKERS, name);
+const isAllowedMarkerName = (name) => isIrMarkerName(name) || SUBMARK_RE.test(name);
+function validateMarker(m) {
+  if (!m || typeof m.name !== "string") return null;
+  if (typeof m.at !== "number" || !Number.isFinite(m.at)) return null;
+  if (!isAllowedMarkerName(m.name)) return null;
+  const base = isIrMarkerName(m.name) ? m.name : submarkAggregate(m.name);
+  const allowed = IR_MARKERS[base];
+  const attrs = m.attrs;
+  if (attrs !== void 0) {
+    if (typeof attrs !== "object" || attrs === null) return null;
+    for (const key of Object.keys(attrs)) {
+      if (!allowed.includes(key)) return null;
+    }
+  }
+  return { name: m.name, at: m.at, ...attrs !== void 0 ? { attrs } : {} };
+}
+function resolveInteractive(rootRenderCommitAt, reportReadyAt) {
+  if (reportReadyAt === void 0) return rootRenderCommitAt;
+  return Math.max(rootRenderCommitAt, reportReadyAt);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IR_MARKERS,
+  isAllowedMarkerName,
+  isIrMarkerName,
+  resolveInteractive,
+  validateMarker
+});
+//# sourceMappingURL=irMarkers.cjs.map

package/dist/irMarkers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/irMarkers.ts"],"sourcesContent":["// The `ir.*` load-profiling marker vocabulary + the host-side allowlist + the\n// `ir.interactive` precedence rule (LOAD_PROFILING_SPEC §3/§3.1, R3-46).\n//\n// This module is PURE and dependency-free on purpose: the spec (§3.1) requires the\n// host's vocabulary allowlist to be MIRRORED from this same definition (\"additions\n// to the vocabulary are spec amendments, mirrored in the host allowlist in the same\n// change\"). Keeping the table + validator here, with no transport/React imports,\n// lets the sandbox side (this SDK) and the host (site-main, its own mirrored copy)\n// share an identical contract that is unit-tested in both places.\n\n/**\n * Each `ir.*` marker name → the attribute keys its payload may carry (the §3\n * table). A forwarded marker is accepted only if BOTH its name is defined here AND\n * every attribute key it carries is in that marker's allowed set (LP-5). An empty\n * array means \"no attributes\" (a bare mark).\n */\nexport const IR_MARKERS = {\n  \"ir.open\": [\"url\", \"provider\", \"ns\", \"repo\", \"ref\", \"refKind\"],\n  \"ir.fetch\": [\"source\", \"bytes\", \"requestCount\", \"cacheHit\", \"httpStatus\"],\n  \"ir.mount\": [\"phantomCount\", \"writablePrimed\"],\n  \"ir.sandbox.boot\": [],\n  \"ir.transpile\": [\"moduleCount\", \"cacheHit\", \"bytesIn\", \"bytesOut\"],\n  \"ir.deps\": [\"depCount\", \"bytes\", \"requestCount\", \"cacheHit\", \"cdn\"],\n  \"ir.eval\": [\"moduleCount\"],\n  \"ir.fmp\": [],\n  \"ir.interactive\": [\"cold\"],\n  \"ir.verify\": [\"result\", \"blocking\"],\n  \"ir.refresh\": [\"bytes\"],\n} as const;\n\nexport type IrMarkerName = keyof typeof IR_MARKERS;\n\n// Per-module / per-dep sub-marks (§3): a defined aggregate plus a `[…]` selector,\n// e.g. `ir.transpile.mod[/src/App.tsx]` or `ir.deps.pkg[react@18.2.0]`. A sub-mark\n// inherits its aggregate's attribute schema.\nconst SUBMARK_RE = /^(ir\\.transpile\\.mod|ir\\.deps\\.pkg)\\[[^\\]]+\\]$/;\nconst submarkAggregate = (name: string): IrMarkerName | null =>\n  name.startsWith(\"ir.transpile.mod\") ? \"ir.transpile\" : name.startsWith(\"ir.deps.pkg\") ? \"ir.deps\" : null;\n\n/** Is `name` a defined top-level `ir.*` marker (not a sub-mark)? */\nexport const isIrMarkerName = (name: string): name is IrMarkerName =>\n  Object.prototype.hasOwnProperty.call(IR_MARKERS, name);\n\n/** Is `name` an accepted marker name — a defined top-level marker OR a recognized\n *  per-module/per-dep sub-mark? */\nexport const isAllowedMarkerName = (name: string): boolean =>\n  isIrMarkerName(name) || SUBMARK_RE.test(name);\n\n/** A marker forwarded across the origin boundary (§3.2): a name, the sandbox-side\n *  `performance.now()` timestamp, and the optional attribute payload. */\nexport interface ForwardedMarker {\n  name: string;\n  /** Sandbox-relative timestamp (`performance.now()`) at emission (§3.2). */\n  at: number;\n  attrs?: Record<string, unknown>;\n}\n\n/**\n * The LP-5 vocabulary allowlist (pure). Accept a forwarded marker ONLY if its name\n * is in the vocabulary AND every attribute key is in that marker's schema. An\n * unknown name — or a defined name carrying an out-of-schema attribute key — is\n * DROPPED (returns `null`), never recorded. This is the gate against an untrusted\n * sandbox minting arbitrary names/values into the host timeline (an injection\n * surface for dashboards / the deferred RUM endpoint). Sub-marks inherit their\n * aggregate's schema.\n */\nexport function validateMarker(m: ForwardedMarker | null | undefined): ForwardedMarker | null {\n  if (!m || typeof m.name !== \"string\") return null;\n  if (typeof m.at !== \"number\" || !Number.isFinite(m.at)) return null;\n  if (!isAllowedMarkerName(m.name)) return null;\n  const base: IrMarkerName = isIrMarkerName(m.name) ? m.name : submarkAggregate(m.name)!;\n  const allowed: readonly string[] = IR_MARKERS[base];\n  const attrs = m.attrs;\n  if (attrs !== undefined) {\n    if (typeof attrs !== \"object\" || attrs === null) return null;\n    for (const key of Object.keys(attrs)) {\n      if (!allowed.includes(key)) return null; // out-of-schema attribute → drop the whole marker\n    }\n  }\n  return { name: m.name, at: m.at, ...(attrs !== undefined ? { attrs } : {}) };\n}\n\n/**\n * `ir.interactive = max(rootRenderCommit, reportReady)` (LP2-3). An app-called\n * `reportReady()` may only DELAY interactive — never advance it before the root\n * render commits. A `reportReady()` that fires early is recorded but takes effect\n * at the commit; if the app never reports, the commit alone stands. Budgets bind to\n * the later of the two, so an app can't game its budget by declaring itself ready\n * before it has rendered anything. PURE.\n */\nexport function resolveInteractive(rootRenderCommitAt: number, reportReadyAt?: number): number {\n  if (reportReadyAt === undefined) return rootRenderCommitAt;\n  return Math.max(rootRenderCommitAt, reportReadyAt);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBO,MAAM,aAAa;AAAA,EACxB,WAAW,CAAC,OAAO,YAAY,MAAM,QAAQ,OAAO,SAAS;AAAA,EAC7D,YAAY,CAAC,UAAU,SAAS,gBAAgB,YAAY,YAAY;AAAA,EACxE,YAAY,CAAC,gBAAgB,gBAAgB;AAAA,EAC7C,mBAAmB,CAAC;AAAA,EACpB,gBAAgB,CAAC,eAAe,YAAY,WAAW,UAAU;AAAA,EACjE,WAAW,CAAC,YAAY,SAAS,gBAAgB,YAAY,KAAK;AAAA,EAClE,WAAW,CAAC,aAAa;AAAA,EACzB,UAAU,CAAC;AAAA,EACX,kBAAkB,CAAC,MAAM;AAAA,EACzB,aAAa,CAAC,UAAU,UAAU;AAAA,EAClC,cAAc,CAAC,OAAO;AACxB;AAOA,MAAM,aAAa;AACnB,MAAM,mBAAmB,CAAC,SACxB,KAAK,WAAW,kBAAkB,IAAI,iBAAiB,KAAK,WAAW,aAAa,IAAI,YAAY;AAG/F,MAAM,iBAAiB,CAAC,SAC7B,OAAO,UAAU,eAAe,KAAK,YAAY,IAAI;AAIhD,MAAM,sBAAsB,CAAC,SAClC,eAAe,IAAI,KAAK,WAAW,KAAK,IAAI;AAoBvC,SAAS,eAAe,GAA+D;AAC5F,MAAI,CAAC,KAAK,OAAO,EAAE,SAAS,SAAU,QAAO;AAC7C,MAAI,OAAO,EAAE,OAAO,YAAY,CAAC,OAAO,SAAS,EAAE,EAAE,EAAG,QAAO;AAC/D,MAAI,CAAC,oBAAoB,EAAE,IAAI,EAAG,QAAO;AACzC,QAAM,OAAqB,eAAe,EAAE,IAAI,IAAI,EAAE,OAAO,iBAAiB,EAAE,IAAI;AACpF,QAAM,UAA6B,WAAW,IAAI;AAClD,QAAM,QAAQ,EAAE;AAChB,MAAI,UAAU,QAAW;AACvB,QAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,CAAC,QAAQ,SAAS,GAAG,EAAG,QAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,IAAI,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC,EAAG;AAC7E;AAUO,SAAS,mBAAmB,oBAA4B,eAAgC;AAC7F,MAAI,kBAAkB,OAAW,QAAO;AACxC,SAAO,KAAK,IAAI,oBAAoB,aAAa;AACnD;","names":[]}

package/dist/irMarkers.d.cts

@@ -0,0 +1,54 @@
+/**
+ * Each `ir.*` marker name → the attribute keys its payload may carry (the §3
+ * table). A forwarded marker is accepted only if BOTH its name is defined here AND
+ * every attribute key it carries is in that marker's allowed set (LP-5). An empty
+ * array means "no attributes" (a bare mark).
+ */
+declare const IR_MARKERS: {
+    readonly "ir.open": readonly ["url", "provider", "ns", "repo", "ref", "refKind"];
+    readonly "ir.fetch": readonly ["source", "bytes", "requestCount", "cacheHit", "httpStatus"];
+    readonly "ir.mount": readonly ["phantomCount", "writablePrimed"];
+    readonly "ir.sandbox.boot": readonly [];
+    readonly "ir.transpile": readonly ["moduleCount", "cacheHit", "bytesIn", "bytesOut"];
+    readonly "ir.deps": readonly ["depCount", "bytes", "requestCount", "cacheHit", "cdn"];
+    readonly "ir.eval": readonly ["moduleCount"];
+    readonly "ir.fmp": readonly [];
+    readonly "ir.interactive": readonly ["cold"];
+    readonly "ir.verify": readonly ["result", "blocking"];
+    readonly "ir.refresh": readonly ["bytes"];
+};
+type IrMarkerName = keyof typeof IR_MARKERS;
+/** Is `name` a defined top-level `ir.*` marker (not a sub-mark)? */
+declare const isIrMarkerName: (name: string) => name is IrMarkerName;
+/** Is `name` an accepted marker name — a defined top-level marker OR a recognized
+ *  per-module/per-dep sub-mark? */
+declare const isAllowedMarkerName: (name: string) => boolean;
+/** A marker forwarded across the origin boundary (§3.2): a name, the sandbox-side
+ *  `performance.now()` timestamp, and the optional attribute payload. */
+interface ForwardedMarker {
+    name: string;
+    /** Sandbox-relative timestamp (`performance.now()`) at emission (§3.2). */
+    at: number;
+    attrs?: Record<string, unknown>;
+}
+/**
+ * The LP-5 vocabulary allowlist (pure). Accept a forwarded marker ONLY if its name
+ * is in the vocabulary AND every attribute key is in that marker's schema. An
+ * unknown name — or a defined name carrying an out-of-schema attribute key — is
+ * DROPPED (returns `null`), never recorded. This is the gate against an untrusted
+ * sandbox minting arbitrary names/values into the host timeline (an injection
+ * surface for dashboards / the deferred RUM endpoint). Sub-marks inherit their
+ * aggregate's schema.
+ */
+declare function validateMarker(m: ForwardedMarker | null | undefined): ForwardedMarker | null;
+/**
+ * `ir.interactive = max(rootRenderCommit, reportReady)` (LP2-3). An app-called
+ * `reportReady()` may only DELAY interactive — never advance it before the root
+ * render commits. A `reportReady()` that fires early is recorded but takes effect
+ * at the commit; if the app never reports, the commit alone stands. Budgets bind to
+ * the later of the two, so an app can't game its budget by declaring itself ready
+ * before it has rendered anything. PURE.
+ */
+declare function resolveInteractive(rootRenderCommitAt: number, reportReadyAt?: number): number;
+
+export { type ForwardedMarker, IR_MARKERS, type IrMarkerName, isAllowedMarkerName, isIrMarkerName, resolveInteractive, validateMarker };

package/dist/irMarkers.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Each `ir.*` marker name → the attribute keys its payload may carry (the §3
+ * table). A forwarded marker is accepted only if BOTH its name is defined here AND
+ * every attribute key it carries is in that marker's allowed set (LP-5). An empty
+ * array means "no attributes" (a bare mark).
+ */
+declare const IR_MARKERS: {
+    readonly "ir.open": readonly ["url", "provider", "ns", "repo", "ref", "refKind"];
+    readonly "ir.fetch": readonly ["source", "bytes", "requestCount", "cacheHit", "httpStatus"];
+    readonly "ir.mount": readonly ["phantomCount", "writablePrimed"];
+    readonly "ir.sandbox.boot": readonly [];
+    readonly "ir.transpile": readonly ["moduleCount", "cacheHit", "bytesIn", "bytesOut"];
+    readonly "ir.deps": readonly ["depCount", "bytes", "requestCount", "cacheHit", "cdn"];
+    readonly "ir.eval": readonly ["moduleCount"];
+    readonly "ir.fmp": readonly [];
+    readonly "ir.interactive": readonly ["cold"];
+    readonly "ir.verify": readonly ["result", "blocking"];
+    readonly "ir.refresh": readonly ["bytes"];
+};
+type IrMarkerName = keyof typeof IR_MARKERS;
+/** Is `name` a defined top-level `ir.*` marker (not a sub-mark)? */
+declare const isIrMarkerName: (name: string) => name is IrMarkerName;
+/** Is `name` an accepted marker name — a defined top-level marker OR a recognized
+ *  per-module/per-dep sub-mark? */
+declare const isAllowedMarkerName: (name: string) => boolean;
+/** A marker forwarded across the origin boundary (§3.2): a name, the sandbox-side
+ *  `performance.now()` timestamp, and the optional attribute payload. */
+interface ForwardedMarker {
+    name: string;
+    /** Sandbox-relative timestamp (`performance.now()`) at emission (§3.2). */
+    at: number;
+    attrs?: Record<string, unknown>;
+}
+/**
+ * The LP-5 vocabulary allowlist (pure). Accept a forwarded marker ONLY if its name
+ * is in the vocabulary AND every attribute key is in that marker's schema. An
+ * unknown name — or a defined name carrying an out-of-schema attribute key — is
+ * DROPPED (returns `null`), never recorded. This is the gate against an untrusted
+ * sandbox minting arbitrary names/values into the host timeline (an injection
+ * surface for dashboards / the deferred RUM endpoint). Sub-marks inherit their
+ * aggregate's schema.
+ */
+declare function validateMarker(m: ForwardedMarker | null | undefined): ForwardedMarker | null;
+/**
+ * `ir.interactive = max(rootRenderCommit, reportReady)` (LP2-3). An app-called
+ * `reportReady()` may only DELAY interactive — never advance it before the root
+ * render commits. A `reportReady()` that fires early is recorded but takes effect
+ * at the commit; if the app never reports, the commit alone stands. Budgets bind to
+ * the later of the two, so an app can't game its budget by declaring itself ready
+ * before it has rendered anything. PURE.
+ */
+declare function resolveInteractive(rootRenderCommitAt: number, reportReadyAt?: number): number;
+
+export { type ForwardedMarker, IR_MARKERS, type IrMarkerName, isAllowedMarkerName, isIrMarkerName, resolveInteractive, validateMarker };

package/dist/irMarkers.js

@@ -0,0 +1,44 @@
+const IR_MARKERS = {
+  "ir.open": ["url", "provider", "ns", "repo", "ref", "refKind"],
+  "ir.fetch": ["source", "bytes", "requestCount", "cacheHit", "httpStatus"],
+  "ir.mount": ["phantomCount", "writablePrimed"],
+  "ir.sandbox.boot": [],
+  "ir.transpile": ["moduleCount", "cacheHit", "bytesIn", "bytesOut"],
+  "ir.deps": ["depCount", "bytes", "requestCount", "cacheHit", "cdn"],
+  "ir.eval": ["moduleCount"],
+  "ir.fmp": [],
+  "ir.interactive": ["cold"],
+  "ir.verify": ["result", "blocking"],
+  "ir.refresh": ["bytes"]
+};
+const SUBMARK_RE = /^(ir\.transpile\.mod|ir\.deps\.pkg)\[[^\]]+\]$/;
+const submarkAggregate = (name) => name.startsWith("ir.transpile.mod") ? "ir.transpile" : name.startsWith("ir.deps.pkg") ? "ir.deps" : null;
+const isIrMarkerName = (name) => Object.prototype.hasOwnProperty.call(IR_MARKERS, name);
+const isAllowedMarkerName = (name) => isIrMarkerName(name) || SUBMARK_RE.test(name);
+function validateMarker(m) {
+  if (!m || typeof m.name !== "string") return null;
+  if (typeof m.at !== "number" || !Number.isFinite(m.at)) return null;
+  if (!isAllowedMarkerName(m.name)) return null;
+  const base = isIrMarkerName(m.name) ? m.name : submarkAggregate(m.name);
+  const allowed = IR_MARKERS[base];
+  const attrs = m.attrs;
+  if (attrs !== void 0) {
+    if (typeof attrs !== "object" || attrs === null) return null;
+    for (const key of Object.keys(attrs)) {
+      if (!allowed.includes(key)) return null;
+    }
+  }
+  return { name: m.name, at: m.at, ...attrs !== void 0 ? { attrs } : {} };
+}
+function resolveInteractive(rootRenderCommitAt, reportReadyAt) {
+  if (reportReadyAt === void 0) return rootRenderCommitAt;
+  return Math.max(rootRenderCommitAt, reportReadyAt);
+}
+export {
+  IR_MARKERS,
+  isAllowedMarkerName,
+  isIrMarkerName,
+  resolveInteractive,
+  validateMarker
+};
+//# sourceMappingURL=irMarkers.js.map

package/dist/irMarkers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/irMarkers.ts"],"sourcesContent":["// The `ir.*` load-profiling marker vocabulary + the host-side allowlist + the\n// `ir.interactive` precedence rule (LOAD_PROFILING_SPEC §3/§3.1, R3-46).\n//\n// This module is PURE and dependency-free on purpose: the spec (§3.1) requires the\n// host's vocabulary allowlist to be MIRRORED from this same definition (\"additions\n// to the vocabulary are spec amendments, mirrored in the host allowlist in the same\n// change\"). Keeping the table + validator here, with no transport/React imports,\n// lets the sandbox side (this SDK) and the host (site-main, its own mirrored copy)\n// share an identical contract that is unit-tested in both places.\n\n/**\n * Each `ir.*` marker name → the attribute keys its payload may carry (the §3\n * table). A forwarded marker is accepted only if BOTH its name is defined here AND\n * every attribute key it carries is in that marker's allowed set (LP-5). An empty\n * array means \"no attributes\" (a bare mark).\n */\nexport const IR_MARKERS = {\n  \"ir.open\": [\"url\", \"provider\", \"ns\", \"repo\", \"ref\", \"refKind\"],\n  \"ir.fetch\": [\"source\", \"bytes\", \"requestCount\", \"cacheHit\", \"httpStatus\"],\n  \"ir.mount\": [\"phantomCount\", \"writablePrimed\"],\n  \"ir.sandbox.boot\": [],\n  \"ir.transpile\": [\"moduleCount\", \"cacheHit\", \"bytesIn\", \"bytesOut\"],\n  \"ir.deps\": [\"depCount\", \"bytes\", \"requestCount\", \"cacheHit\", \"cdn\"],\n  \"ir.eval\": [\"moduleCount\"],\n  \"ir.fmp\": [],\n  \"ir.interactive\": [\"cold\"],\n  \"ir.verify\": [\"result\", \"blocking\"],\n  \"ir.refresh\": [\"bytes\"],\n} as const;\n\nexport type IrMarkerName = keyof typeof IR_MARKERS;\n\n// Per-module / per-dep sub-marks (§3): a defined aggregate plus a `[…]` selector,\n// e.g. `ir.transpile.mod[/src/App.tsx]` or `ir.deps.pkg[react@18.2.0]`. A sub-mark\n// inherits its aggregate's attribute schema.\nconst SUBMARK_RE = /^(ir\\.transpile\\.mod|ir\\.deps\\.pkg)\\[[^\\]]+\\]$/;\nconst submarkAggregate = (name: string): IrMarkerName | null =>\n  name.startsWith(\"ir.transpile.mod\") ? \"ir.transpile\" : name.startsWith(\"ir.deps.pkg\") ? \"ir.deps\" : null;\n\n/** Is `name` a defined top-level `ir.*` marker (not a sub-mark)? */\nexport const isIrMarkerName = (name: string): name is IrMarkerName =>\n  Object.prototype.hasOwnProperty.call(IR_MARKERS, name);\n\n/** Is `name` an accepted marker name — a defined top-level marker OR a recognized\n *  per-module/per-dep sub-mark? */\nexport const isAllowedMarkerName = (name: string): boolean =>\n  isIrMarkerName(name) || SUBMARK_RE.test(name);\n\n/** A marker forwarded across the origin boundary (§3.2): a name, the sandbox-side\n *  `performance.now()` timestamp, and the optional attribute payload. */\nexport interface ForwardedMarker {\n  name: string;\n  /** Sandbox-relative timestamp (`performance.now()`) at emission (§3.2). */\n  at: number;\n  attrs?: Record<string, unknown>;\n}\n\n/**\n * The LP-5 vocabulary allowlist (pure). Accept a forwarded marker ONLY if its name\n * is in the vocabulary AND every attribute key is in that marker's schema. An\n * unknown name — or a defined name carrying an out-of-schema attribute key — is\n * DROPPED (returns `null`), never recorded. This is the gate against an untrusted\n * sandbox minting arbitrary names/values into the host timeline (an injection\n * surface for dashboards / the deferred RUM endpoint). Sub-marks inherit their\n * aggregate's schema.\n */\nexport function validateMarker(m: ForwardedMarker | null | undefined): ForwardedMarker | null {\n  if (!m || typeof m.name !== \"string\") return null;\n  if (typeof m.at !== \"number\" || !Number.isFinite(m.at)) return null;\n  if (!isAllowedMarkerName(m.name)) return null;\n  const base: IrMarkerName = isIrMarkerName(m.name) ? m.name : submarkAggregate(m.name)!;\n  const allowed: readonly string[] = IR_MARKERS[base];\n  const attrs = m.attrs;\n  if (attrs !== undefined) {\n    if (typeof attrs !== \"object\" || attrs === null) return null;\n    for (const key of Object.keys(attrs)) {\n      if (!allowed.includes(key)) return null; // out-of-schema attribute → drop the whole marker\n    }\n  }\n  return { name: m.name, at: m.at, ...(attrs !== undefined ? { attrs } : {}) };\n}\n\n/**\n * `ir.interactive = max(rootRenderCommit, reportReady)` (LP2-3). An app-called\n * `reportReady()` may only DELAY interactive — never advance it before the root\n * render commits. A `reportReady()` that fires early is recorded but takes effect\n * at the commit; if the app never reports, the commit alone stands. Budgets bind to\n * the later of the two, so an app can't game its budget by declaring itself ready\n * before it has rendered anything. PURE.\n */\nexport function resolveInteractive(rootRenderCommitAt: number, reportReadyAt?: number): number {\n  if (reportReadyAt === undefined) return rootRenderCommitAt;\n  return Math.max(rootRenderCommitAt, reportReadyAt);\n}\n"],"mappings":"AAgBO,MAAM,aAAa;AAAA,EACxB,WAAW,CAAC,OAAO,YAAY,MAAM,QAAQ,OAAO,SAAS;AAAA,EAC7D,YAAY,CAAC,UAAU,SAAS,gBAAgB,YAAY,YAAY;AAAA,EACxE,YAAY,CAAC,gBAAgB,gBAAgB;AAAA,EAC7C,mBAAmB,CAAC;AAAA,EACpB,gBAAgB,CAAC,eAAe,YAAY,WAAW,UAAU;AAAA,EACjE,WAAW,CAAC,YAAY,SAAS,gBAAgB,YAAY,KAAK;AAAA,EAClE,WAAW,CAAC,aAAa;AAAA,EACzB,UAAU,CAAC;AAAA,EACX,kBAAkB,CAAC,MAAM;AAAA,EACzB,aAAa,CAAC,UAAU,UAAU;AAAA,EAClC,cAAc,CAAC,OAAO;AACxB;AAOA,MAAM,aAAa;AACnB,MAAM,mBAAmB,CAAC,SACxB,KAAK,WAAW,kBAAkB,IAAI,iBAAiB,KAAK,WAAW,aAAa,IAAI,YAAY;AAG/F,MAAM,iBAAiB,CAAC,SAC7B,OAAO,UAAU,eAAe,KAAK,YAAY,IAAI;AAIhD,MAAM,sBAAsB,CAAC,SAClC,eAAe,IAAI,KAAK,WAAW,KAAK,IAAI;AAoBvC,SAAS,eAAe,GAA+D;AAC5F,MAAI,CAAC,KAAK,OAAO,EAAE,SAAS,SAAU,QAAO;AAC7C,MAAI,OAAO,EAAE,OAAO,YAAY,CAAC,OAAO,SAAS,EAAE,EAAE,EAAG,QAAO;AAC/D,MAAI,CAAC,oBAAoB,EAAE,IAAI,EAAG,QAAO;AACzC,QAAM,OAAqB,eAAe,EAAE,IAAI,IAAI,EAAE,OAAO,iBAAiB,EAAE,IAAI;AACpF,QAAM,UAA6B,WAAW,IAAI;AAClD,QAAM,QAAQ,EAAE;AAChB,MAAI,UAAU,QAAW;AACvB,QAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,eAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,UAAI,CAAC,QAAQ,SAAS,GAAG,EAAG,QAAO;AAAA,IACrC;AAAA,EACF;AACA,SAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,IAAI,GAAI,UAAU,SAAY,EAAE,MAAM,IAAI,CAAC,EAAG;AAC7E;AAUO,SAAS,mBAAmB,oBAA4B,eAAgC;AAC7F,MAAI,kBAAkB,OAAW,QAAO;AACxC,SAAO,KAAK,IAAI,oBAAoB,aAAa;AACnD;","names":[]}

package/dist/mountMatch.cjs

@@ -0,0 +1,29 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var mountMatch_exports = {};
+__export(mountMatch_exports, {
+  mountMatches: () => mountMatches
+});
+module.exports = __toCommonJS(mountMatch_exports);
+const mountMatches = (mount, query) => (query.type === void 0 || mount.type === query.type) && (query.id === void 0 || mount.id === query.id) && (query.path === void 0 || mount.path === query.path) && (query.name === void 0 || mount.name === query.name);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  mountMatches
+});
+//# sourceMappingURL=mountMatch.cjs.map

package/dist/mountMatch.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mountMatch.ts"],"sourcesContent":["/**\n * Pure predicate behind {@link findMount} / {@link waitForMount}: does `mount`\n * satisfy every field present on `query`? An absent query field matches anything;\n * a present one must equal the mount's value. Kept framework-free and free of the\n * injected sandbox runtime so it is unit-testable in isolation (ways_of_working\n * §5 — separate pure logic from the effectful service).\n *\n * `name` (the human-readable mount label, R3-69) is matchable alongside the\n * `type`/`id`/`path` coordinates so an app/agent can locate a mount by the name a\n * user would recognise — e.g. `findMount({ name: 'Design notes' })` — rather than\n * an opaque `/mnt/{hash}` address or a non-unique space name guessed by hand.\n */\nexport interface MountMatchFields {\n  type?: string;\n  id?: string;\n  path?: string;\n  name?: string;\n}\n\nexport const mountMatches = (\n  mount: MountMatchFields,\n  query: MountMatchFields,\n): boolean =>\n  (query.type === undefined || mount.type === query.type) &&\n  (query.id === undefined || mount.id === query.id) &&\n  (query.path === undefined || mount.path === query.path) &&\n  (query.name === undefined || mount.name === query.name);\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAmBO,MAAM,eAAe,CAC1B,OACA,WAEC,MAAM,SAAS,UAAa,MAAM,SAAS,MAAM,UACjD,MAAM,OAAO,UAAa,MAAM,OAAO,MAAM,QAC7C,MAAM,SAAS,UAAa,MAAM,SAAS,MAAM,UACjD,MAAM,SAAS,UAAa,MAAM,SAAS,MAAM;","names":[]}

package/dist/mountMatch.d.cts

@@ -0,0 +1,21 @@
+/**
+ * Pure predicate behind {@link findMount} / {@link waitForMount}: does `mount`
+ * satisfy every field present on `query`? An absent query field matches anything;
+ * a present one must equal the mount's value. Kept framework-free and free of the
+ * injected sandbox runtime so it is unit-testable in isolation (ways_of_working
+ * §5 — separate pure logic from the effectful service).
+ *
+ * `name` (the human-readable mount label, R3-69) is matchable alongside the
+ * `type`/`id`/`path` coordinates so an app/agent can locate a mount by the name a
+ * user would recognise — e.g. `findMount({ name: 'Design notes' })` — rather than
+ * an opaque `/mnt/{hash}` address or a non-unique space name guessed by hand.
+ */
+interface MountMatchFields {
+    type?: string;
+    id?: string;
+    path?: string;
+    name?: string;
+}
+declare const mountMatches: (mount: MountMatchFields, query: MountMatchFields) => boolean;
+
+export { type MountMatchFields, mountMatches };

package/dist/mountMatch.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Pure predicate behind {@link findMount} / {@link waitForMount}: does `mount`
+ * satisfy every field present on `query`? An absent query field matches anything;
+ * a present one must equal the mount's value. Kept framework-free and free of the
+ * injected sandbox runtime so it is unit-testable in isolation (ways_of_working
+ * §5 — separate pure logic from the effectful service).
+ *
+ * `name` (the human-readable mount label, R3-69) is matchable alongside the
+ * `type`/`id`/`path` coordinates so an app/agent can locate a mount by the name a
+ * user would recognise — e.g. `findMount({ name: 'Design notes' })` — rather than
+ * an opaque `/mnt/{hash}` address or a non-unique space name guessed by hand.
+ */
+interface MountMatchFields {
+    type?: string;
+    id?: string;
+    path?: string;
+    name?: string;
+}
+declare const mountMatches: (mount: MountMatchFields, query: MountMatchFields) => boolean;
+
+export { type MountMatchFields, mountMatches };

package/dist/mountMatch.js

@@ -0,0 +1,5 @@
+const mountMatches = (mount, query) => (query.type === void 0 || mount.type === query.type) && (query.id === void 0 || mount.id === query.id) && (query.path === void 0 || mount.path === query.path) && (query.name === void 0 || mount.name === query.name);
+export {
+  mountMatches
+};
+//# sourceMappingURL=mountMatch.js.map

package/dist/mountMatch.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mountMatch.ts"],"sourcesContent":["/**\n * Pure predicate behind {@link findMount} / {@link waitForMount}: does `mount`\n * satisfy every field present on `query`? An absent query field matches anything;\n * a present one must equal the mount's value. Kept framework-free and free of the\n * injected sandbox runtime so it is unit-testable in isolation (ways_of_working\n * §5 — separate pure logic from the effectful service).\n *\n * `name` (the human-readable mount label, R3-69) is matchable alongside the\n * `type`/`id`/`path` coordinates so an app/agent can locate a mount by the name a\n * user would recognise — e.g. `findMount({ name: 'Design notes' })` — rather than\n * an opaque `/mnt/{hash}` address or a non-unique space name guessed by hand.\n */\nexport interface MountMatchFields {\n  type?: string;\n  id?: string;\n  path?: string;\n  name?: string;\n}\n\nexport const mountMatches = (\n  mount: MountMatchFields,\n  query: MountMatchFields,\n): boolean =>\n  (query.type === undefined || mount.type === query.type) &&\n  (query.id === undefined || mount.id === query.id) &&\n  (query.path === undefined || mount.path === query.path) &&\n  (query.name === undefined || mount.name === query.name);\n"],"mappings":"AAmBO,MAAM,eAAe,CAC1B,OACA,WAEC,MAAM,SAAS,UAAa,MAAM,SAAS,MAAM,UACjD,MAAM,OAAO,UAAa,MAAM,OAAO,MAAM,QAC7C,MAAM,SAAS,UAAa,MAAM,SAAS,MAAM,UACjD,MAAM,SAAS,UAAa,MAAM,SAAS,MAAM;","names":[]}

package/dist/mounts.cjs

@@ -23,16 +23,22 @@ __export(mounts_exports, {
   getAppMountPath: () => getAppMountPath,
   getMounts: () => getMounts,
   getSpaceMembers: () => getSpaceMembers,
+  importSettingsFromParent: () => importSettingsFromParent,
   listAllSpaces: () => listAllSpaces,
   listGrants: () => listGrants,
+  listSettingsApps: () => listSettingsApps,
   listSpaces: () => listSpaces,
   lookupUser: () => lookupUser,
+  makeContentRef: () => makeContentRef,
   mount: () => mount,
   mountSpace: () => mountSpace,
   onMountsChange: () => onMountsChange,
-  openAppSpace: () => openAppSpace,
+  openSettings: () => openSettings,
+  openSettingsOf: () => openSettingsOf,
   requestMount: () => requestMount,
   requestSpace: () => requestSpace,
+  resolveContentRef: () => resolveContentRef,
+  resolveContentRefs: () => resolveContentRefs,
   revokeGrant: () => revokeGrant,
   setSpaceRole: () => setSpaceRole,
   shareSpace: () => shareSpace,
@@ -45,11 +51,65 @@ module.exports = __toCommonJS(mounts_exports);
 var import_react = require("react");
 var import_sandboxUtils = require("./sandboxUtils");
 var import_hostRuntime = require("./hostRuntime");
+var import_mountMatch = require("./mountMatch");
 const getAppMountPath = () => (0, import_hostRuntime.getHostRuntime)()?.appMountPath ?? "/app";
-const mountService = () => {
-  return module.evaluation.module.bundler.mounts;
+const mountKey = (m) => m.id ?? m.path;
+const MOUNT_REMOVE_REASONS = /* @__PURE__ */ new Set([
+  "revoked",
+  "unshared",
+  "signed-out",
+  "unmounted",
+  "deleted"
+]);
+const asMountRemoveReason = (value) => typeof value === "string" && MOUNT_REMOVE_REASONS.has(value) ? value : "revoked";
+const injectedMountService = () => {
+  try {
+    const svc = module?.evaluation?.module?.bundler?.mounts;
+    return svc && typeof svc.getMounts === "function" ? svc : null;
+  } catch {
+    return null;
+  }
+};
+let transportSvc = null;
+const transportMountService = () => {
+  if (transportSvc) return transportSvc;
+  let mounts = [];
+  const listeners = /* @__PURE__ */ new Set();
+  const fire = (removed) => {
+    for (const l of [...listeners]) l(mounts, removed);
+  };
+  (0, import_sandboxUtils.addListener)("mount-add", (msg) => {
+    const mount2 = msg.mount;
+    if (!mount2) return;
+    const key = mountKey(mount2);
+    mounts = [...mounts.filter((m) => mountKey(m) !== key), mount2];
+    fire([]);
+  });
+  (0, import_sandboxUtils.addListener)("mount-remove", (msg) => {
+    const key = msg.id ?? msg.path;
+    if (key == null) return;
+    const reason = asMountRemoveReason(msg.reason);
+    const removed = mounts.filter((m) => mountKey(m) === key).map((m) => ({ ...m, reason }));
+    if (removed.length === 0) return;
+    mounts = mounts.filter((m) => mountKey(m) !== key);
+    fire(removed);
+  });
+  try {
+    (0, import_sandboxUtils.sendMessage)("request-mounts");
+  } catch {
+  }
+  transportSvc = {
+    getMounts: () => mounts,
+    onChange: (listener) => {
+      listeners.add(listener);
+      listener(mounts, []);
+      return { dispose: () => listeners.delete(listener) };
+    }
+  };
+  return transportSvc;
 };
-const matches = (mount2, query) => (query.type === void 0 || mount2.type === query.type) && (query.id === void 0 || mount2.id === query.id) && (query.path === void 0 || mount2.path === query.path);
+const mountService = () => injectedMountService() ?? transportMountService();
+const matches = (mount2, query) => (0, import_mountMatch.mountMatches)(mount2, query);
 const getMounts = () => mountService().getMounts();
 const findMount = (query) => getMounts().find((m) => matches(m, query));
 const onMountsChange = (listener) => {
@@ -83,11 +143,45 @@ const requestMountInternal = async (method, query) => {
   const mount2 = await request(method, query);
   return waitForMount({ id: mount2.id ?? mount2.path });
 };
-const openAppSpace = (slot = "default") => requestMountInternal("open", { slot });
 const mount = (mountId) => requestMountInternal("mount", { mount: mountId });
 const mountSpace = (query) => mount(`space:${query.spaceId}`);
 const requestMount = () => requestMountInternal("request", {});
 const requestSpace = requestMount;
+const makeContentRef = (ref, opts) => ({ $cap: "file", mountId: ref.mountId, relPath: ref.relPath, mode: opts.mode });
+const resolveContentRef = async (ref) => {
+  const path = await request("resolveRef", { ref });
+  return { path };
+};
+const resolveContentRefs = async (refs) => {
+  const paths = await request("resolveRefs", { refs });
+  return { paths };
+};
+const settingsRequest = async (method, query = {}) => {
+  const res = await (0, import_sandboxUtils.protocolRequest)("settings", method, [query]);
+  if (!res || res.ok !== true) {
+    const err = new Error(res?.message ?? "settings request failed");
+    err.code = res?.code ?? "unknown";
+    throw err;
+  }
+  return res.data;
+};
+const openSettings = async () => {
+  const mount2 = await settingsRequest("open");
+  return waitForMount({ id: mount2.id ?? mount2.path });
+};
+const importSettingsFromParent = async () => {
+  try {
+    const data = await settingsRequest("importFromParent");
+    return { ok: true, copied: data.copied };
+  } catch (e) {
+    return { ok: false, code: e.code ?? "unknown" };
+  }
+};
+const openSettingsOf = async (appKey) => {
+  const mount2 = await settingsRequest("openOf", { appKey });
+  return waitForMount({ id: mount2.id ?? mount2.path });
+};
+const listSettingsApps = () => settingsRequest("list");
 const createSpace = (opts = {}) => requestMountInternal("create", opts);
 const listSpaces = (opts = {}) => request("list", opts);
 const unmountSpace = async (query) => {
@@ -116,16 +210,22 @@ const revokeGrant = async (appKey, spaceId) => {
   getAppMountPath,
   getMounts,
   getSpaceMembers,
+  importSettingsFromParent,
   listAllSpaces,
   listGrants,
+  listSettingsApps,
   listSpaces,
   lookupUser,
+  makeContentRef,
   mount,
   mountSpace,
   onMountsChange,
-  openAppSpace,
+  openSettings,
+  openSettingsOf,
   requestMount,
   requestSpace,
+  resolveContentRef,
+  resolveContentRefs,
   revokeGrant,
   setSpaceRole,
   shareSpace,