@kortix/sdk 0.13.3 → 0.13.5

package/dist/core/session/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../src/core/session/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,MAAM,iBAAiB;AAC3B,+EAA+E;AAC7E,SAAS;AACX,mFAAmF;GACjF,QAAQ;AACV,uEAAuE;GACrE,YAAY;AACd,4EAA4E;GAC1E,MAAM;AACR,4EAA4E;GAC1E,aAAa,CAAC;AAElB;gFACgF;AAChF,MAAM,MAAM,gBAAgB;AAC1B;;;qBAGqB;AACnB,QAAQ,GACR,WAAW,GACX,cAAc,GACd,SAAS,GACT,SAAS,GACT,UAAU,GACV,QAAQ,GACR,WAAW,GACX,IAAI,CAAC;AAET,MAAM,WAAW,uBAAuB;IACtC,uEAAuE;IACvE,OAAO,EAAE,gBAAgB,CAAC;IAC1B,mDAAmD;IACnD,YAAY,EAAE,OAAO,CAAC;IACtB,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;0BAEsB;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,iBAAiB,CAwB1F;AAED;+DAC+D;AAC/D,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAE1E"}

package/dist/core/session/connection.js

@@ -0,0 +1,36 @@
+export function projectSessionConnection(input) {
+    // Content outranks every probe, including one that has given up: a runtime
+    // that is emitting parts is reachable by definition, whatever a health check
+    // on a different path concluded.
+    if (input.activityFresh)
+        return 'live';
+    if (input.runtimeReady)
+        return 'live';
+    if (input.unreachable || input.stalled)
+        return 'unreachable';
+    // Positive evidence, and the ONLY thing that earns the word "waking".
+    if (input.sandbox === 'stopped' || input.sandbox === 'archived')
+        return 'waking';
+    if (input.sandbox === 'provisioning' ||
+        input.sandbox === 'queued' ||
+        input.sandbox === 'branching') {
+        return 'waking';
+    }
+    // A finished session has no runtime to reach and nothing to wake. Nothing is
+    // wrong with it, so nothing is announced.
+    if (input.sandbox === 'completed')
+        return 'unknown';
+    if (input.sandbox === 'failed')
+        return 'unreachable';
+    // The box is up; we simply have not reached it yet. Not an alarm.
+    if (input.sandbox === 'running')
+        return 'connecting';
+    // The row has not loaded. We know nothing, and we say nothing.
+    return 'unknown';
+}
+/** Whether a surface may draw an alarm (a notice, a warning colour) from this
+ *  state. `unknown` and `connecting` are waits, not faults. */
+export function connectionIsFaulted(connection) {
+    return connection === 'unreachable';
+}
+//# sourceMappingURL=connection.js.map

package/dist/core/session/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/core/session/connection.ts"],"names":[],"mappings":"AAsEA,MAAM,UAAU,wBAAwB,CAAC,KAA8B;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,iCAAiC;IACjC,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,MAAM,CAAC;IACvC,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC;IAC7D,sEAAsE;IACtE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC;IACjF,IACE,KAAK,CAAC,OAAO,KAAK,cAAc;QAChC,KAAK,CAAC,OAAO,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,KAAK,WAAW,EAC7B,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,6EAA6E;IAC7E,0CAA0C;IAC1C,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC;IACrD,kEAAkE;IAClE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACrD,+DAA+D;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;+DAC+D;AAC/D,MAAM,UAAU,mBAAmB,CAAC,UAA6B;IAC/D,OAAO,UAAU,KAAK,aAAa,CAAC;AACtC,CAAC"}

package/dist/core/session/index.d.ts

@@ -19,6 +19,7 @@ export * from './preview.js';
 export * from './preview-auth.js';
 export * from './preview-probe.js';
 export * from './presentation.js';
+export * from './connection.js';
 export * from './working.js';
 export * from './compaction.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}

package/dist/core/session/index.js

@@ -19,6 +19,7 @@ export * from './preview.js';
 export * from './preview-auth.js';
 export * from './preview-probe.js';
 export * from './presentation.js';
+export * from './connection.js';
 export * from './working.js';
 export * from './compaction.js';
 //# sourceMappingURL=index.js.map

package/dist/core/session/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/session/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}

package/dist/core/session/preview-auth.d.ts

@@ -29,4 +29,29 @@
 export declare function ensurePreviewSessionCookie(previewUrl: string, options?: {
     serverUrl?: string;
 }): Promise<boolean>;
+/**
+ * The URL a caller should actually open for `previewUrl`, having given it a
+ * credential the destination will accept.
+ *
+ * The two preview forms take credentials in different ways, and using the wrong
+ * one fails silently — which is exactly what happened before this existed:
+ * `ensurePreviewSessionCookie` returns false for an ORIGIN URL (there is no
+ * `/v1/p/` path to derive an auth endpoint from), so "open in a new tab" opened
+ * the origin with no cookie and no token, and the person landed on the sign-in
+ * gate instead of their file.
+ *
+ *   - Preview ORIGIN (`{env}-p{port}-{sandbox}.{domain}`, or the localhost
+ *     form): the API's `__preview_session` cookie is host-scoped and can never
+ *     reach it, so the credential rides in the URL as a one-shot `?token`. The
+ *     proxy exchanges it for a host cookie and strips it from the address bar.
+ *   - Path proxy (`/v1/p/{sandbox}/{port}/…`): same origin as the API, so the
+ *     cookie works; mint it and return the URL untouched.
+ *
+ * Never throws. With no token, or for a URL that is not a preview at all, the
+ * input is returned unchanged — the destination then answers for itself, which
+ * is more honest than fabricating a URL that cannot work.
+ */
+export declare function authorizePreviewUrl(previewUrl: string, options?: {
+    serverUrl?: string;
+}): Promise<string>;
 //# sourceMappingURL=preview-auth.d.ts.map

package/dist/core/session/preview-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview-auth.d.ts","sourceRoot":"","sources":["../../../src/core/session/preview-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAAC,OAAO,CAAC,CAoBlB"}
+{"version":3,"file":"preview-auth.d.ts","sourceRoot":"","sources":["../../../src/core/session/preview-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAAC,MAAM,CAAC,CAOjB"}

package/dist/core/session/preview-auth.js

@@ -18,7 +18,7 @@
  * reloaded, bookmarked, or sent to anyone.
  */
 import { getAuthToken } from '../http/auth.js';
-import { buildPreviewAuthEndpoint } from './preview.js';
+import { appendPreviewToken, buildPreviewAuthEndpoint, isSubdomainPreviewUrl } from './preview.js';
 /**
  * Mint the `__preview_session` cookie for `previewUrl`'s proxy origin.
  *
@@ -50,4 +50,34 @@ export async function ensurePreviewSessionCookie(previewUrl, options = {}) {
         return false;
     }
 }
+/**
+ * The URL a caller should actually open for `previewUrl`, having given it a
+ * credential the destination will accept.
+ *
+ * The two preview forms take credentials in different ways, and using the wrong
+ * one fails silently — which is exactly what happened before this existed:
+ * `ensurePreviewSessionCookie` returns false for an ORIGIN URL (there is no
+ * `/v1/p/` path to derive an auth endpoint from), so "open in a new tab" opened
+ * the origin with no cookie and no token, and the person landed on the sign-in
+ * gate instead of their file.
+ *
+ *   - Preview ORIGIN (`{env}-p{port}-{sandbox}.{domain}`, or the localhost
+ *     form): the API's `__preview_session` cookie is host-scoped and can never
+ *     reach it, so the credential rides in the URL as a one-shot `?token`. The
+ *     proxy exchanges it for a host cookie and strips it from the address bar.
+ *   - Path proxy (`/v1/p/{sandbox}/{port}/…`): same origin as the API, so the
+ *     cookie works; mint it and return the URL untouched.
+ *
+ * Never throws. With no token, or for a URL that is not a preview at all, the
+ * input is returned unchanged — the destination then answers for itself, which
+ * is more honest than fabricating a URL that cannot work.
+ */
+export async function authorizePreviewUrl(previewUrl, options = {}) {
+    if (isSubdomainPreviewUrl(previewUrl)) {
+        const token = await getAuthToken();
+        return token ? appendPreviewToken(previewUrl, token) : previewUrl;
+    }
+    await ensurePreviewSessionCookie(previewUrl, options);
+    return previewUrl;
+}
 //# sourceMappingURL=preview-auth.js.map

package/dist/core/session/preview-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"preview-auth.js","sourceRoot":"","sources":["../../../src/core/session/preview-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"preview-auth.js","sourceRoot":"","sources":["../../../src/core/session/preview-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEhG;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAkB,EAClB,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;SACF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,UAAkC,EAAE;IAEpC,IAAI,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACpE,CAAC;IACD,MAAM,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/core/session/preview-config.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The cached template for a backend, or null when this deployment serves none —
+ * and also null before the first `load` resolves. Both mean "use the path form",
+ * which is why they need no distinction at the call site.
+ */
+export declare function cachedPreviewUrlTemplate(backendUrl: string): string | null;
+/**
+ * Whether this backend has ANSWERED yet — as opposed to "answered null", which
+ * is a real answer meaning "this deployment serves no preview domain".
+ *
+ * The two look identical through `cachedPreviewUrlTemplate`, and conflating them
+ * is how a session gets stuck: during a rolling deploy the first `ensureReady()`
+ * can hit a task that predates `/v1/p/config`, and without this the handle would
+ * keep building path-proxy URLs for the rest of its life even though every later
+ * request would have been answered by a new task.
+ */
+export declare function hasPreviewConfig(backendUrl: string): boolean;
+/**
+ * Fetch and cache the template. Concurrent callers share one request; a failed
+ * fetch caches nothing, so a deployment that was briefly unreachable is asked
+ * again rather than being remembered as having no preview domain.
+ */
+export declare function loadPreviewUrlTemplate(backendUrl: string): Promise<string | null>;
+/** Drop everything remembered — for tests and for a host re-pointing its API. */
+export declare function resetPreviewConfigCache(): void;
+//# sourceMappingURL=preview-config.d.ts.map

package/dist/core/session/preview-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-config.d.ts","sourceRoot":"","sources":["../../../src/core/session/preview-config.ts"],"names":[],"mappings":"AAiCA;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgCvF;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C"}

package/dist/core/session/preview-config.js

@@ -0,0 +1,95 @@
+/**
+ * How this deployment addresses previews, fetched once from `GET /v1/p/config`.
+ *
+ * The preview hostname shape (`{env}-p{port}-{sandbox}.{domain}`) is a property
+ * of the deployment, not of the client: it depends on the wildcard domain the
+ * operator serves and on which environment the API is. Re-deriving it here from
+ * `backendUrl` would mean two implementations of one rule, which is how they
+ * drift. So the API states it as a template and this caches the answer.
+ *
+ * `previewUrl()` is synchronous — a React render calls it — so the fetch cannot
+ * happen there. `ensureReady()` warms this first, and until it resolves callers
+ * get the path form, which still works for everything that is not a browser.
+ */
+import { backendApi } from '../http/api-client.js';
+const templates = new Map();
+const inFlight = new Map();
+/**
+ * Cache key: the backend URL without trailing slashes, stripped LINEARLY. The
+ * regex form (`/\/+$/`) backtracks quadratically on adversarial input (CodeQL
+ * js/polynomial-redos), and this runs on a host-supplied string.
+ */
+function key(backendUrl) {
+    let end = backendUrl.length;
+    while (end > 0 && backendUrl.charCodeAt(end - 1) === 47 /* '/' */)
+        end--;
+    return backendUrl.slice(0, end);
+}
+/**
+ * The cached template for a backend, or null when this deployment serves none —
+ * and also null before the first `load` resolves. Both mean "use the path form",
+ * which is why they need no distinction at the call site.
+ */
+export function cachedPreviewUrlTemplate(backendUrl) {
+    return templates.get(key(backendUrl)) ?? null;
+}
+/**
+ * Whether this backend has ANSWERED yet — as opposed to "answered null", which
+ * is a real answer meaning "this deployment serves no preview domain".
+ *
+ * The two look identical through `cachedPreviewUrlTemplate`, and conflating them
+ * is how a session gets stuck: during a rolling deploy the first `ensureReady()`
+ * can hit a task that predates `/v1/p/config`, and without this the handle would
+ * keep building path-proxy URLs for the rest of its life even though every later
+ * request would have been answered by a new task.
+ */
+export function hasPreviewConfig(backendUrl) {
+    return templates.has(key(backendUrl));
+}
+/**
+ * Fetch and cache the template. Concurrent callers share one request; a failed
+ * fetch caches nothing, so a deployment that was briefly unreachable is asked
+ * again rather than being remembered as having no preview domain.
+ */
+export async function loadPreviewUrlTemplate(backendUrl) {
+    const cacheKey = key(backendUrl);
+    const cached = templates.get(cacheKey);
+    if (cached !== undefined)
+        return cached;
+    const pending = inFlight.get(cacheKey);
+    if (pending)
+        return pending;
+    const request = (async () => {
+        try {
+            const response = await backendApi.get('/p/config', {
+                showErrors: false,
+                // A deployment without a preview domain, and an API too old to know the
+                // route, are both ordinary answers — not incidents to report.
+                errorContext: { operation: 'load preview config', silent: true },
+            });
+            if (!response.success)
+                return null;
+            const template = typeof response.data?.preview_url_template === 'string'
+                ? response.data.preview_url_template
+                : null;
+            templates.set(cacheKey, template);
+            return template;
+        }
+        catch {
+            // An older API has no such route, and a network blip is not an answer.
+            // Leave the cache empty so the next ensureReady() asks again.
+            return null;
+        }
+        finally {
+            inFlight.delete(cacheKey);
+        }
+    })();
+    inFlight.set(cacheKey, request);
+    return request;
+}
+/** Drop everything remembered — for tests and for a host re-pointing its API. */
+export function resetPreviewConfigCache() {
+    templates.clear();
+    inFlight.clear();
+}
+//# sourceMappingURL=preview-config.js.map

package/dist/core/session/preview-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-config.js","sourceRoot":"","sources":["../../../src/core/session/preview-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAMhD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;AACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;AAE3D;;;;GAIG;AACH,SAAS,GAAG,CAAC,UAAkB;IAC7B,IAAI,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,OAAO,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAC;IACzE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB;IAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAwB,WAAW,EAAE;gBACxE,UAAU,EAAE,KAAK;gBACjB,wEAAwE;gBACxE,8DAA8D;gBAC9D,YAAY,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE;aACjE,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,EAAE,oBAAoB,KAAK,QAAQ;gBACtE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB;gBACpC,CAAC,CAAC,IAAI,CAAC;YACT,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAClC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,8DAA8D;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,uBAAuB;IACrC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/core/session/preview-options.d.ts

@@ -0,0 +1,25 @@
+import type { SubdomainUrlOptions } from './url.js';
+/**
+ * A fully-resolved options bag. Every field required — including
+ * `previewUrlTemplate`, whose `null` means "this deployment serves no preview
+ * domain" and is a real answer, not an omission.
+ */
+export interface ResolvedPreviewOptions extends SubdomainUrlOptions {
+    previewUrlTemplate: string | null;
+}
+/**
+ * Resolve preview options for a sandbox against a backend.
+ *
+ * Reads the deployment's answer from the `GET /v1/p/config` cache, and asks
+ * again in the background when this backend has never answered — a rolling
+ * deploy can serve one request from a task that predates the route, and without
+ * the retry that single miss would pin the caller to the path proxy for its
+ * whole life. A backend that answered "no preview domain" HAS answered and is
+ * not re-asked.
+ */
+export declare function resolvePreviewOptions(input: {
+    sandboxId: string;
+    apiBaseUrl: string;
+    backendPort: number;
+}): ResolvedPreviewOptions;
+//# sourceMappingURL=preview-options.d.ts.map

package/dist/core/session/preview-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-options.d.ts","sourceRoot":"","sources":["../../../src/core/session/preview-options.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAEjD;;;;GAIG;AACH,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CASzB"}

package/dist/core/session/preview-options.js

@@ -0,0 +1,45 @@
+/**
+ * The ONE way to build the options a preview URL is derived from.
+ *
+ * `rewriteLocalhostUrl` and its siblings in `url.ts` are pure: they answer
+ * "which URL" from an options bag and never touch the network. That purity is
+ * worth keeping — it is why they are exhaustively testable — but it puts the
+ * burden of assembling a COMPLETE bag on whoever calls them, and an incomplete
+ * bag does not fail. It falls back to the path proxy, silently, forever.
+ *
+ * That is not hypothetical. There are two call paths — a session handle
+ * (`kortix.session(...).previewUrl()`) and the ambient runtime
+ * (`deriveSubdomainOpts`, which the web app's preview iframe, `useSandboxProxy`
+ * and `buildStaticFilePreviewUrl` all use) — and each assembled the bag itself.
+ * When `previewUrlTemplate` was added, only the first was updated, so every
+ * preview in the session panel kept rendering `/v1/p/{sandbox}/{port}` however
+ * loudly the deployment advertised an origin. Nothing failed; the wrong thing
+ * merely kept working.
+ *
+ * So: one producer, and a return type whose fields are all REQUIRED. A future
+ * call path that forgets a field does not compile, which is the only kind of
+ * guarantee worth having for a failure mode this quiet.
+ */
+import { cachedPreviewUrlTemplate, hasPreviewConfig, loadPreviewUrlTemplate } from './preview-config.js';
+/**
+ * Resolve preview options for a sandbox against a backend.
+ *
+ * Reads the deployment's answer from the `GET /v1/p/config` cache, and asks
+ * again in the background when this backend has never answered — a rolling
+ * deploy can serve one request from a task that predates the route, and without
+ * the retry that single miss would pin the caller to the path proxy for its
+ * whole life. A backend that answered "no preview domain" HAS answered and is
+ * not re-asked.
+ */
+export function resolvePreviewOptions(input) {
+    const { apiBaseUrl } = input;
+    if (!hasPreviewConfig(apiBaseUrl))
+        void loadPreviewUrlTemplate(apiBaseUrl).catch(() => { });
+    return {
+        sandboxId: input.sandboxId,
+        backendPort: input.backendPort,
+        apiBaseUrl,
+        previewUrlTemplate: cachedPreviewUrlTemplate(apiBaseUrl),
+    };
+}
+//# sourceMappingURL=preview-options.js.map

package/dist/core/session/preview-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-options.js","sourceRoot":"","sources":["../../../src/core/session/preview-options.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAYtG;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAIrC;IACC,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7B,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAAE,KAAK,sBAAsB,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3F,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU;QACV,kBAAkB,EAAE,wBAAwB,CAAC,UAAU,CAAC;KACzD,CAAC;AACJ,CAAC"}

package/dist/core/session/preview.d.ts

@@ -14,9 +14,14 @@
  */
 export declare function buildPreviewAuthEndpoint(previewUrl: string, serverUrl?: string): string | null;
 /**
- * Subdomain preview form: `p{port}-{sandbox}.{host}/…`. These can't use the
- * host-only `/v1/p/` session cookie (it never reaches the preview subdomain),
- * so they authenticate via a one-shot `?token` on the first request.
+ * Preview ORIGIN form: `p{port}-{sandbox}.{host}` locally, or the deployed
+ * `{env}-p{port}-{sandbox}.{domain}`.
+ *
+ * These can't use the host-only `/v1/p/` session cookie — it never reaches
+ * another hostname — so they authenticate the FIRST request with a one-shot
+ * `?token`, which the proxy exchanges for a cookie on the preview origin and
+ * then strips. Every later request (sub-resources, `fetch`, WebSockets) rides
+ * that cookie, which is the only credential an app's own code can carry.
  */
 export declare function isSubdomainPreviewUrl(candidateUrl: string): boolean;
 /** Append a one-shot `?token` to a (subdomain) preview URL. */

package/dist/core/session/preview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../../../src/core/session/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6CH;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAMf;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAMnE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ5E"}
+{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../../../src/core/session/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6CH;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAMf;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAUnE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ5E"}

package/dist/core/session/preview.js

@@ -59,13 +59,20 @@ export function buildPreviewAuthEndpoint(previewUrl, serverUrl) {
         derivePreviewAuthEndpoint(previewUrl));
 }
 /**
- * Subdomain preview form: `p{port}-{sandbox}.{host}/…`. These can't use the
- * host-only `/v1/p/` session cookie (it never reaches the preview subdomain),
- * so they authenticate via a one-shot `?token` on the first request.
+ * Preview ORIGIN form: `p{port}-{sandbox}.{host}` locally, or the deployed
+ * `{env}-p{port}-{sandbox}.{domain}`.
+ *
+ * These can't use the host-only `/v1/p/` session cookie — it never reaches
+ * another hostname — so they authenticate the FIRST request with a one-shot
+ * `?token`, which the proxy exchanges for a cookie on the preview origin and
+ * then strips. Every later request (sub-resources, `fetch`, WebSockets) rides
+ * that cookie, which is the only credential an app's own code can carry.
  */
 export function isSubdomainPreviewUrl(candidateUrl) {
     try {
-        return /^p\d+-[^.]+\./.test(new URL(candidateUrl).hostname);
+        const { hostname } = new URL(candidateUrl);
+        return (/^p\d+-[^.]+\./.test(hostname)
+            || /^(?:dev|staging|prod|preview)-p\d+-[a-z0-9-]+\./i.test(hostname));
     }
     catch {
         return false;

package/dist/core/session/preview.js.map

@@ -1 +1 @@
-{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../../src/core/session/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,SAAS,yBAAyB,CAAC,YAAoB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAElC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;YACxB,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC;QACtE,CAAC;QAED,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB,EAAE,SAAkB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,aAAa,GACjB,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,SAAkB;IAElB,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,CACL,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,yBAAyB,CAAC,UAAU,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,KAAa;IAClE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC"}
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../../src/core/session/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,SAAS,yBAAyB,CAAC,YAAoB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAElC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;YACxB,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC;QACtE,CAAC;QAED,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB,EAAE,SAAkB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,aAAa,GACjB,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,SAAkB;IAElB,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,CACL,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,yBAAyB,CAAC,UAAU,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;eAC3B,kDAAkD,CAAC,IAAI,CAAC,QAAQ,CAAC,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,KAAa;IAClE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/core/session/rewind.d.ts

@@ -9,16 +9,27 @@
  *   1. Which locally-known messages does a staged rewind hide?
  *   2. When is a message id inside the range a committed rewind must delete?
  *
- * `watermark` exists to fix a real bug: hiding used to be "everything at-or-
- * after the boundary id", recomputed on every render off the CURRENT message
- * list. A message minted AFTER staging — the user's replacement prompt, its
- * answer — sorts above the boundary by id exactly like every OTHER later
- * message, so it fell inside "everything after the boundary" too and never
- * rendered until an unrelated remount flooded the whole transcript back,
- * interleaved. `watermark` freezes the upper edge of the hide window at the
- * newest message id known AT STAGE TIME, so only messages that were already
- * part of the abandoned trajectory are ever hidden — anything newer always
- * renders.
+ * The window is a SET of message ids, captured at stage time. It used to be a
+ * lexical id RANGE — `id >= messageId && id <= watermark` — which assumed ids
+ * ascend with time. OpenCode 1.18.15 retired that invariant outright (turn
+ * exit now reads `lastAssistant.parentID === lastUser.id`, and
+ * `MessageV2.latest()` orders by `time.created` with the id only as a
+ * tie-break), and the range failed in both directions:
+ *
+ *   - **under-delete** — a reverted assistant message whose id happens to sort
+ *     BELOW the boundary falls outside the interval, survives the commit,
+ *     is orphaned, and reappears at the top of the chat;
+ *   - **over-delete** — `ascendingId` stubs sit ~2.8e13 above every real id, so
+ *     a single in-flight optimistic message pushed the watermark to
+ *     effectively infinity and the interval swallowed the user's replacement
+ *     prompt and its answer.
+ *
+ * Membership has neither failure. `hiddenIds` is the exact list of messages
+ * that were part of the abandoned trajectory at the moment the rewind was
+ * staged: nothing minted afterwards can enter it, and nothing inside it can
+ * escape on an id comparison. `watermark` is retained as a published field —
+ * it names the newest message known at stage time — and still answers
+ * {@link isWithinRewindWindow} for a legacy state that carries no `hiddenIds`.
  */
 export interface SessionRewindState {
     /** The message the rewind pointer sits at — hidden along with everything
@@ -26,10 +37,25 @@ export interface SessionRewindState {
     messageId: string;
     /**
      * The newest message id known locally at the moment this rewind was staged
-     * (or first observed). The upper bound of the hide window — fixed once,
-     * never recomputed against a later, larger message list.
+     * (or first observed) — see {@link newestMessageId}.
+     *
+     * No longer the upper bound of anything: {@link hiddenIds} is the window.
+     * Retained because it is a published field, and because it is the only
+     * bound available to a legacy state that carries no `hiddenIds`.
      */
     watermark: string;
+    /**
+     * The exact messages this rewind abandons — the boundary message and
+     * everything that followed it in the transcript, captured ONCE at stage
+     * time and never recomputed. Membership in this list is the whole of the
+     * hide/delete test; see the module comment for the two failures the lexical
+     * range it replaced produced.
+     *
+     * Optional only for backward compatibility: a `SessionRewindState` built by
+     * an older consumer (or restored from one) has none, and falls back to the
+     * legacy range. Everything in this SDK populates it.
+     */
+    hiddenIds?: readonly string[];
     /**
      * False once the replacement prompt has been sent (or a
      * `session.next.revert.committed` wire event says the server has). The
@@ -40,32 +66,49 @@ export interface SessionRewindState {
      */
     staged: boolean;
 }
-/** Whether `id` falls inside the [messageId, watermark] hide range — both
- *  bounds inclusive: the boundary message itself is part of what an edit
- *  replaces, and the watermark is the last message known at stage time. */
+/** Whether `id` is one of the messages this rewind abandons.
+ *
+ *  Membership in the set captured at stage time — never a comparison between
+ *  two id strings, which say nothing about which message came first. The
+ *  legacy `[messageId, watermark]` range answers only for a state that
+ *  carries no captured set. */
 export declare function isWithinRewindWindow(id: string, rewind: SessionRewindState): boolean;
 /**
- * The newest (highest sort-order) message id in `messages`, or `null` for an
- * empty list. Deliberately a max-scan, not "the last element" — most callers
- * pass an ascending-sorted list, but an optimistic entry appended out of
- * order must never win the max by position alone.
+ * The newest message in `messages`, by `time.created` with the id as the only
+ * tie-break — the same order the server's own `MessageV2.latest()` uses.
+ * `null` for an empty list.
+ *
+ * Deliberately a max-scan, not "the last element": most callers pass an
+ * ordered list, but an optimistic entry appended out of order must never win
+ * by position alone. A message with no `time` cannot be dated, so it competes
+ * on its id only.
  */
 export declare function newestMessageId<T extends {
     info: {
         id: string;
+        time?: {
+            created?: number;
+        };
     };
 }>(messages: T[]): string | null;
 /**
  * Build the state for a freshly staged (or freshly discovered) rewind.
- * `watermark` is captured HERE, from the message list at this exact moment —
- * never recomputed later. Falls back to `messageId` itself when nothing is
- * known locally yet (a cross-tab or reload discovery with no synced messages
- * for this session), which hides only the boundary message and nothing
- * else — the narrowest correct answer with no other information available.
+ *
+ * The window is captured HERE and never recomputed: `hiddenIds` is the
+ * boundary message plus every message that follows it in `messages`, taken in
+ * the order the caller holds them — which is the server's own
+ * `time.created` page order, not an id order. Falls back to `messageId`
+ * itself when the boundary is not in the list (a cross-tab or reload
+ * discovery with no synced messages for this session), which hides only the
+ * boundary message — the narrowest correct answer with no other information
+ * available.
  */
 export declare function stageSessionRewind<T extends {
     info: {
         id: string;
+        time?: {
+            created?: number;
+        };
     };
 }>(messages: T[], messageId: string): SessionRewindState;
 /** Hide the target message and every message up to the staged watermark.

package/dist/core/session/rewind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rewind.d.ts","sourceRoot":"","sources":["../../../src/core/session/rewind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,kBAAkB;IACjC;6BACyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;2EAE2E;AAC3E,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAEpF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAChE,QAAQ,EAAE,CAAC,EAAE,GACZ,MAAM,GAAG,IAAI,CAMf;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACnE,QAAQ,EAAE,CAAC,EAAE,EACb,SAAS,EAAE,MAAM,GAChB,kBAAkB,CAMpB;AAED;;4EAE4E;AAC5E,wBAAgB,oBAAoB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACrE,QAAQ,EAAE,CAAC,EAAE,EACb,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,CAAC,EAAE,CAIL;AAED;;;4EAG4E;AAC5E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,kBAAkB,GAAG,IAAI,CAE3B"}
+{"version":3,"file":"rewind.d.ts","sourceRoot":"","sources":["../../../src/core/session/rewind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,WAAW,kBAAkB;IACjC;6BACyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;+BAK+B;AAC/B,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAGpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,CAAC,EAAE,GAAG,MAAM,GAAG,IAAI,CA4B9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAUtD;AAED;;4EAE4E;AAC5E,wBAAgB,oBAAoB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACrE,QAAQ,EAAE,CAAC,EAAE,EACb,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,CAAC,EAAE,CAIL;AAED;;;4EAG4E;AAC5E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,kBAAkB,GAAG,IAAI,CAE3B"}