@kortix/sdk 0.13.4 → 0.13.7

package/dist/core/session/preview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../../../src/core/session/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6CH;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAMf;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAMnE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ5E"}
+{"version":3,"file":"preview.d.ts","sourceRoot":"","sources":["../../../src/core/session/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6CH;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAMf;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAUnE;AAED,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ5E"}

package/dist/core/session/preview.js

@@ -59,13 +59,20 @@ export function buildPreviewAuthEndpoint(previewUrl, serverUrl) {
         derivePreviewAuthEndpoint(previewUrl));
 }
 /**
- * Subdomain preview form: `p{port}-{sandbox}.{host}/…`. These can't use the
- * host-only `/v1/p/` session cookie (it never reaches the preview subdomain),
- * so they authenticate via a one-shot `?token` on the first request.
+ * Preview ORIGIN form: `p{port}-{sandbox}.{host}` locally, or the deployed
+ * `{env}-p{port}-{sandbox}.{domain}`.
+ *
+ * These can't use the host-only `/v1/p/` session cookie — it never reaches
+ * another hostname — so they authenticate the FIRST request with a one-shot
+ * `?token`, which the proxy exchanges for a cookie on the preview origin and
+ * then strips. Every later request (sub-resources, `fetch`, WebSockets) rides
+ * that cookie, which is the only credential an app's own code can carry.
  */
 export function isSubdomainPreviewUrl(candidateUrl) {
     try {
-        return /^p\d+-[^.]+\./.test(new URL(candidateUrl).hostname);
+        const { hostname } = new URL(candidateUrl);
+        return (/^p\d+-[^.]+\./.test(hostname)
+            || /^(?:dev|staging|prod|preview)-p\d+-[a-z0-9-]+\./i.test(hostname));
     }
     catch {
         return false;

package/dist/core/session/preview.js.map

@@ -1 +1 @@
-{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../../src/core/session/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,SAAS,yBAAyB,CAAC,YAAoB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAElC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;YACxB,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC;QACtE,CAAC;QAED,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB,EAAE,SAAkB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,aAAa,GACjB,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,SAAkB;IAElB,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,CACL,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,yBAAyB,CAAC,UAAU,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,KAAa;IAClE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC"}
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../../src/core/session/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,SAAS,yBAAyB,CAAC,YAAoB;IACrD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAElC,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC;QACnC,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;YACxB,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC;QACtE,CAAC;QAED,OAAO,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,YAAoB,EAAE,SAAkB;IACjE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,aAAa,GACjB,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEjC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,SAAkB;IAElB,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,CACL,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,yBAAyB,CAAC,UAAU,CAAC,CACtC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;eAC3B,kDAAkD,CAAC,IAAI,CAAC,QAAQ,CAAC,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,KAAa;IAClE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/core/session/rewind.d.ts

@@ -9,16 +9,27 @@
  *   1. Which locally-known messages does a staged rewind hide?
  *   2. When is a message id inside the range a committed rewind must delete?
  *
- * `watermark` exists to fix a real bug: hiding used to be "everything at-or-
- * after the boundary id", recomputed on every render off the CURRENT message
- * list. A message minted AFTER staging — the user's replacement prompt, its
- * answer — sorts above the boundary by id exactly like every OTHER later
- * message, so it fell inside "everything after the boundary" too and never
- * rendered until an unrelated remount flooded the whole transcript back,
- * interleaved. `watermark` freezes the upper edge of the hide window at the
- * newest message id known AT STAGE TIME, so only messages that were already
- * part of the abandoned trajectory are ever hidden — anything newer always
- * renders.
+ * The window is a SET of message ids, captured at stage time. It used to be a
+ * lexical id RANGE — `id >= messageId && id <= watermark` — which assumed ids
+ * ascend with time. OpenCode 1.18.15 retired that invariant outright (turn
+ * exit now reads `lastAssistant.parentID === lastUser.id`, and
+ * `MessageV2.latest()` orders by `time.created` with the id only as a
+ * tie-break), and the range failed in both directions:
+ *
+ *   - **under-delete** — a reverted assistant message whose id happens to sort
+ *     BELOW the boundary falls outside the interval, survives the commit,
+ *     is orphaned, and reappears at the top of the chat;
+ *   - **over-delete** — `ascendingId` stubs sit ~2.8e13 above every real id, so
+ *     a single in-flight optimistic message pushed the watermark to
+ *     effectively infinity and the interval swallowed the user's replacement
+ *     prompt and its answer.
+ *
+ * Membership has neither failure. `hiddenIds` is the exact list of messages
+ * that were part of the abandoned trajectory at the moment the rewind was
+ * staged: nothing minted afterwards can enter it, and nothing inside it can
+ * escape on an id comparison. `watermark` is retained as a published field —
+ * it names the newest message known at stage time — and still answers
+ * {@link isWithinRewindWindow} for a legacy state that carries no `hiddenIds`.
  */
 export interface SessionRewindState {
     /** The message the rewind pointer sits at — hidden along with everything
@@ -26,10 +37,25 @@ export interface SessionRewindState {
     messageId: string;
     /**
      * The newest message id known locally at the moment this rewind was staged
-     * (or first observed). The upper bound of the hide window — fixed once,
-     * never recomputed against a later, larger message list.
+     * (or first observed) — see {@link newestMessageId}.
+     *
+     * No longer the upper bound of anything: {@link hiddenIds} is the window.
+     * Retained because it is a published field, and because it is the only
+     * bound available to a legacy state that carries no `hiddenIds`.
      */
     watermark: string;
+    /**
+     * The exact messages this rewind abandons — the boundary message and
+     * everything that followed it in the transcript, captured ONCE at stage
+     * time and never recomputed. Membership in this list is the whole of the
+     * hide/delete test; see the module comment for the two failures the lexical
+     * range it replaced produced.
+     *
+     * Optional only for backward compatibility: a `SessionRewindState` built by
+     * an older consumer (or restored from one) has none, and falls back to the
+     * legacy range. Everything in this SDK populates it.
+     */
+    hiddenIds?: readonly string[];
     /**
      * False once the replacement prompt has been sent (or a
      * `session.next.revert.committed` wire event says the server has). The
@@ -40,32 +66,49 @@ export interface SessionRewindState {
      */
     staged: boolean;
 }
-/** Whether `id` falls inside the [messageId, watermark] hide range — both
- *  bounds inclusive: the boundary message itself is part of what an edit
- *  replaces, and the watermark is the last message known at stage time. */
+/** Whether `id` is one of the messages this rewind abandons.
+ *
+ *  Membership in the set captured at stage time — never a comparison between
+ *  two id strings, which say nothing about which message came first. The
+ *  legacy `[messageId, watermark]` range answers only for a state that
+ *  carries no captured set. */
 export declare function isWithinRewindWindow(id: string, rewind: SessionRewindState): boolean;
 /**
- * The newest (highest sort-order) message id in `messages`, or `null` for an
- * empty list. Deliberately a max-scan, not "the last element" — most callers
- * pass an ascending-sorted list, but an optimistic entry appended out of
- * order must never win the max by position alone.
+ * The newest message in `messages`, by `time.created` with the id as the only
+ * tie-break — the same order the server's own `MessageV2.latest()` uses.
+ * `null` for an empty list.
+ *
+ * Deliberately a max-scan, not "the last element": most callers pass an
+ * ordered list, but an optimistic entry appended out of order must never win
+ * by position alone. A message with no `time` cannot be dated, so it competes
+ * on its id only.
  */
 export declare function newestMessageId<T extends {
     info: {
         id: string;
+        time?: {
+            created?: number;
+        };
     };
 }>(messages: T[]): string | null;
 /**
  * Build the state for a freshly staged (or freshly discovered) rewind.
- * `watermark` is captured HERE, from the message list at this exact moment —
- * never recomputed later. Falls back to `messageId` itself when nothing is
- * known locally yet (a cross-tab or reload discovery with no synced messages
- * for this session), which hides only the boundary message and nothing
- * else — the narrowest correct answer with no other information available.
+ *
+ * The window is captured HERE and never recomputed: `hiddenIds` is the
+ * boundary message plus every message that follows it in `messages`, taken in
+ * the order the caller holds them — which is the server's own
+ * `time.created` page order, not an id order. Falls back to `messageId`
+ * itself when the boundary is not in the list (a cross-tab or reload
+ * discovery with no synced messages for this session), which hides only the
+ * boundary message — the narrowest correct answer with no other information
+ * available.
  */
 export declare function stageSessionRewind<T extends {
     info: {
         id: string;
+        time?: {
+            created?: number;
+        };
     };
 }>(messages: T[], messageId: string): SessionRewindState;
 /** Hide the target message and every message up to the staged watermark.

package/dist/core/session/rewind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rewind.d.ts","sourceRoot":"","sources":["../../../src/core/session/rewind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,kBAAkB;IACjC;6BACyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;2EAE2E;AAC3E,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAEpF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAChE,QAAQ,EAAE,CAAC,EAAE,GACZ,MAAM,GAAG,IAAI,CAMf;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACnE,QAAQ,EAAE,CAAC,EAAE,EACb,SAAS,EAAE,MAAM,GAChB,kBAAkB,CAMpB;AAED;;4EAE4E;AAC5E,wBAAgB,oBAAoB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACrE,QAAQ,EAAE,CAAC,EAAE,EACb,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,CAAC,EAAE,CAIL;AAED;;;4EAG4E;AAC5E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,kBAAkB,GAAG,IAAI,CAE3B"}
+{"version":3,"file":"rewind.d.ts","sourceRoot":"","sources":["../../../src/core/session/rewind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,WAAW,kBAAkB;IACjC;6BACyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;+BAK+B;AAC/B,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAGpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,CAAC,EAAE,GAAG,MAAM,GAAG,IAAI,CA4B9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAAE,EAC/D,QAAQ,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAUtD;AAED;;4EAE4E;AAC5E,wBAAgB,oBAAoB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACrE,QAAQ,EAAE,CAAC,EAAE,EACb,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,CAAC,EAAE,CAIL;AAED;;;4EAG4E;AAC5E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,kBAAkB,GAAG,IAAI,GAChC,kBAAkB,GAAG,IAAI,CAE3B"}

package/dist/core/session/rewind.js

@@ -9,49 +9,97 @@
  *   1. Which locally-known messages does a staged rewind hide?
  *   2. When is a message id inside the range a committed rewind must delete?
  *
- * `watermark` exists to fix a real bug: hiding used to be "everything at-or-
- * after the boundary id", recomputed on every render off the CURRENT message
- * list. A message minted AFTER staging — the user's replacement prompt, its
- * answer — sorts above the boundary by id exactly like every OTHER later
- * message, so it fell inside "everything after the boundary" too and never
- * rendered until an unrelated remount flooded the whole transcript back,
- * interleaved. `watermark` freezes the upper edge of the hide window at the
- * newest message id known AT STAGE TIME, so only messages that were already
- * part of the abandoned trajectory are ever hidden — anything newer always
- * renders.
+ * The window is a SET of message ids, captured at stage time. It used to be a
+ * lexical id RANGE — `id >= messageId && id <= watermark` — which assumed ids
+ * ascend with time. OpenCode 1.18.15 retired that invariant outright (turn
+ * exit now reads `lastAssistant.parentID === lastUser.id`, and
+ * `MessageV2.latest()` orders by `time.created` with the id only as a
+ * tie-break), and the range failed in both directions:
+ *
+ *   - **under-delete** — a reverted assistant message whose id happens to sort
+ *     BELOW the boundary falls outside the interval, survives the commit,
+ *     is orphaned, and reappears at the top of the chat;
+ *   - **over-delete** — `ascendingId` stubs sit ~2.8e13 above every real id, so
+ *     a single in-flight optimistic message pushed the watermark to
+ *     effectively infinity and the interval swallowed the user's replacement
+ *     prompt and its answer.
+ *
+ * Membership has neither failure. `hiddenIds` is the exact list of messages
+ * that were part of the abandoned trajectory at the moment the rewind was
+ * staged: nothing minted afterwards can enter it, and nothing inside it can
+ * escape on an id comparison. `watermark` is retained as a published field —
+ * it names the newest message known at stage time — and still answers
+ * {@link isWithinRewindWindow} for a legacy state that carries no `hiddenIds`.
  */
-/** Whether `id` falls inside the [messageId, watermark] hide range — both
- *  bounds inclusive: the boundary message itself is part of what an edit
- *  replaces, and the watermark is the last message known at stage time. */
+/** Whether `id` is one of the messages this rewind abandons.
+ *
+ *  Membership in the set captured at stage time — never a comparison between
+ *  two id strings, which say nothing about which message came first. The
+ *  legacy `[messageId, watermark]` range answers only for a state that
+ *  carries no captured set. */
 export function isWithinRewindWindow(id, rewind) {
+    if (rewind.hiddenIds)
+        return rewind.hiddenIds.includes(id);
     return id >= rewind.messageId && id <= rewind.watermark;
 }
 /**
- * The newest (highest sort-order) message id in `messages`, or `null` for an
- * empty list. Deliberately a max-scan, not "the last element" — most callers
- * pass an ascending-sorted list, but an optimistic entry appended out of
- * order must never win the max by position alone.
+ * The newest message in `messages`, by `time.created` with the id as the only
+ * tie-break — the same order the server's own `MessageV2.latest()` uses.
+ * `null` for an empty list.
+ *
+ * Deliberately a max-scan, not "the last element": most callers pass an
+ * ordered list, but an optimistic entry appended out of order must never win
+ * by position alone. A message with no `time` cannot be dated, so it competes
+ * on its id only.
  */
 export function newestMessageId(messages) {
-    let max = null;
+    let bestId = null;
+    let bestCreated;
     for (const message of messages) {
-        if (max === null || message.info.id > max)
-            max = message.info.id;
+        const { id } = message.info;
+        const created = message.info.time?.created;
+        if (bestId === null) {
+            bestId = id;
+            bestCreated = created;
+            continue;
+        }
+        if (created !== undefined && bestCreated !== undefined) {
+            if (created > bestCreated || (created === bestCreated && id > bestId)) {
+                bestId = id;
+                bestCreated = created;
+            }
+            continue;
+        }
+        if (created !== undefined && bestCreated === undefined) {
+            bestId = id;
+            bestCreated = created;
+            continue;
+        }
+        if (created === undefined && bestCreated === undefined && id > bestId) {
+            bestId = id;
+        }
     }
-    return max;
+    return bestId;
 }
 /**
  * Build the state for a freshly staged (or freshly discovered) rewind.
- * `watermark` is captured HERE, from the message list at this exact moment —
- * never recomputed later. Falls back to `messageId` itself when nothing is
- * known locally yet (a cross-tab or reload discovery with no synced messages
- * for this session), which hides only the boundary message and nothing
- * else — the narrowest correct answer with no other information available.
+ *
+ * The window is captured HERE and never recomputed: `hiddenIds` is the
+ * boundary message plus every message that follows it in `messages`, taken in
+ * the order the caller holds them — which is the server's own
+ * `time.created` page order, not an id order. Falls back to `messageId`
+ * itself when the boundary is not in the list (a cross-tab or reload
+ * discovery with no synced messages for this session), which hides only the
+ * boundary message — the narrowest correct answer with no other information
+ * available.
  */
 export function stageSessionRewind(messages, messageId) {
+    const boundary = messages.findIndex((message) => message.info.id === messageId);
+    const hiddenIds = boundary === -1 ? [messageId] : messages.slice(boundary).map((message) => message.info.id);
     return {
         messageId,
         watermark: newestMessageId(messages) ?? messageId,
+        hiddenIds,
         staged: true,
     };
 }

package/dist/core/session/rewind.js.map

@@ -1 +1 @@
-{"version":3,"file":"rewind.js","sourceRoot":"","sources":["../../../src/core/session/rewind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAuBH;;2EAE2E;AAC3E,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,MAA0B;IACzE,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAa;IAEb,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG;YAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAa,EACb,SAAiB;IAEjB,OAAO;QACL,SAAS;QACT,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,IAAI,SAAS;QACjD,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED;;4EAE4E;AAC5E,MAAM,UAAU,oBAAoB,CAClC,QAAa,EACb,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;4EAG4E;AAC5E,MAAM,UAAU,mBAAmB,CACjC,MAAiC;IAEjC,OAAO,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC"}
+{"version":3,"file":"rewind.js","sourceRoot":"","sources":["../../../src/core/session/rewind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAsCH;;;;;+BAK+B;AAC/B,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,MAA0B;IACzE,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAE7B,QAAa;IACb,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,WAA+B,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,GAAG,EAAE,CAAC;YACZ,WAAW,GAAG,OAAO,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,GAAG,WAAW,IAAI,CAAC,OAAO,KAAK,WAAW,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;gBACtE,MAAM,GAAG,EAAE,CAAC;gBACZ,WAAW,GAAG,OAAO,CAAC;YACxB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,GAAG,EAAE,CAAC;YACZ,WAAW,GAAG,OAAO,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;YACtE,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAEhC,QAAa,EAAE,SAAiB;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IAChF,MAAM,SAAS,GACb,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,SAAS;QACT,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC,IAAI,SAAS;QACjD,SAAS;QACT,MAAM,EAAE,IAAI;KACb,CAAC;AACJ,CAAC;AAED;;4EAE4E;AAC5E,MAAM,UAAU,oBAAoB,CAClC,QAAa,EACb,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1F,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;4EAG4E;AAC5E,MAAM,UAAU,mBAAmB,CACjC,MAAiC;IAEjC,OAAO,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAChE,CAAC"}

package/dist/core/session/server-store/active.d.ts

@@ -1,3 +1,4 @@
+import { type ResolvedPreviewOptions } from '../preview-options.js';
 /**
  * Active-runtime resolution, framework-free. These are the read helpers the
  * isomorphic core (`createKortix`, the opencode client factory) resolves the
@@ -32,18 +33,15 @@ export declare function getActiveDbSandboxId(): string | undefined;
  */
 export declare function getBackendPort(): number;
 /**
- * Subdomain URL options for the active runtime (pure-ish function).
+ * Preview URL options for the ACTIVE runtime — the ambient path, used where no
+ * session handle is in scope: `useSandboxProxy`, `proxySandboxUrl`,
+ * `buildStaticFilePreviewUrl`, the session panel's app-preview iframe.
  *
- * Always returns a valid options object — never undefined. Every provider routes
- * through the same backend preview proxy; the `apiBaseUrl` field lets
- * `rewriteLocalhostUrl` take the path-based branch on VPS/cloud deployments
- * where *.localhost DNS isn't available. The sandbox id comes from the active
- * runtime (no legacy 'kortix-sandbox' default — it masked the real cloud sandbox
- * and 403'd the preview proxy).
+ * A thin binding of the active sandbox id to `resolvePreviewOptions`, which is
+ * the single producer of a complete options bag. It deliberately assembles
+ * nothing itself: this function once did, and quietly omitted
+ * `previewUrlTemplate`, which made every ambient preview fall back to the path
+ * proxy. See preview-options.ts.
  */
-export declare function deriveSubdomainOpts(): {
-    sandboxId: string;
-    backendPort: number;
-    apiBaseUrl: string;
-};
+export declare function deriveSubdomainOpts(): ResolvedPreviewOptions;
 //# sourceMappingURL=active.d.ts.map

package/dist/core/session/server-store/active.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"active.d.ts","sourceRoot":"","sources":["../../../../src/core/session/server-store/active.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AAEH;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,CAMA"}
+{"version":3,"file":"active.d.ts","sourceRoot":"","sources":["../../../../src/core/session/server-store/active.ts"],"names":[],"mappings":"AAOA,OAAO,EAAyB,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAExF;;;;;GAKG;AAEH;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAQ7C;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,sBAAsB,CAM5D"}

package/dist/core/session/server-store/active.js

@@ -1,6 +1,7 @@
 import { platformConfig } from '../../http/config.js';
 import { getCurrentRuntimeDbSandboxId, getCurrentRuntimeSandboxId, getCurrentRuntimeUrl, } from '../current-runtime.js';
 import { getBackendUrl, getDefaultSandboxUrl } from './url-helpers.js';
+import { resolvePreviewOptions } from '../preview-options.js';
 /**
  * Active-runtime resolution, framework-free. These are the read helpers the
  * isomorphic core (`createKortix`, the opencode client factory) resolves the
@@ -57,20 +58,21 @@ export function getBackendPort() {
     }
 }
 /**
- * Subdomain URL options for the active runtime (pure-ish function).
+ * Preview URL options for the ACTIVE runtime — the ambient path, used where no
+ * session handle is in scope: `useSandboxProxy`, `proxySandboxUrl`,
+ * `buildStaticFilePreviewUrl`, the session panel's app-preview iframe.
  *
- * Always returns a valid options object — never undefined. Every provider routes
- * through the same backend preview proxy; the `apiBaseUrl` field lets
- * `rewriteLocalhostUrl` take the path-based branch on VPS/cloud deployments
- * where *.localhost DNS isn't available. The sandbox id comes from the active
- * runtime (no legacy 'kortix-sandbox' default — it masked the real cloud sandbox
- * and 403'd the preview proxy).
+ * A thin binding of the active sandbox id to `resolvePreviewOptions`, which is
+ * the single producer of a complete options bag. It deliberately assembles
+ * nothing itself: this function once did, and quietly omitted
+ * `previewUrlTemplate`, which made every ambient preview fall back to the path
+ * proxy. See preview-options.ts.
  */
 export function deriveSubdomainOpts() {
-    return {
+    return resolvePreviewOptions({
         sandboxId: getActiveSandboxId() || '',
         backendPort: getBackendPort(),
         apiBaseUrl: getBackendUrl(),
-    };
+    });
 }
 //# sourceMappingURL=active.js.map

package/dist/core/session/server-store/active.js.map

@@ -1 +1 @@
-{"version":3,"file":"active.js","sourceRoot":"","sources":["../../../../src/core/session/server-store/active.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAEpE;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,cAAc,EAAE,CAAC,cAAc,IAAI,KAAK;QAAE,OAAO,EAAE,CAAC;IACxD,gEAAgE;IAChE,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,0BAA0B,EAAE,IAAI,cAAc,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,4BAA4B,EAAE,IAAI,SAAS,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,yBAAyB;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IAKjC,OAAO;QACL,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE;QACrC,WAAW,EAAE,cAAc,EAAE;QAC7B,UAAU,EAAE,aAAa,EAAE;KAC5B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"active.js","sourceRoot":"","sources":["../../../../src/core/session/server-store/active.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAA+B,MAAM,oBAAoB,CAAC;AAExF;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,cAAc,EAAE,CAAC,cAAc,IAAI,KAAK;QAAE,OAAO,EAAE,CAAC;IACxD,gEAAgE;IAChE,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,0BAA0B,EAAE,IAAI,cAAc,EAAE,CAAC,SAAS,IAAI,SAAS,CAAC;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,4BAA4B,EAAE,IAAI,SAAS,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,yBAAyB;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,qBAAqB,CAAC;QAC3B,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE;QACrC,WAAW,EAAE,cAAc,EAAE;QAC7B,UAAU,EAAE,aAAa,EAAE;KAC5B,CAAC,CAAC;AACL,CAAC"}

package/dist/core/session/server-store/url-helpers.d.ts

@@ -1,6 +1,15 @@
 /**
- * The backend base URL. All sandbox traffic routes through the backend's
- * unified preview proxy: /v1/p/{sandboxId}/{port}/*
+ * The backend base URL.
+ *
+ * CONTROL traffic — the OpenCode/daemon REST channel on port 8000 — routes
+ * through the path proxy, `/v1/p/{sandboxId}/{port}/*`, and stays there: it is
+ * a programmatic transport with a per-request bearer token, not a browser
+ * surface, so a per-preview origin buys it nothing and would put turn delivery
+ * behind wildcard DNS, a certificate and an edge Worker.
+ *
+ * BROWSER traffic goes to the preview ORIGIN this deployment advertises via
+ * `GET /v1/p/config` — see core/session/preview-config.ts and `rewriteLocalhostUrl`.
+ * Those are the only two forms, and only those two functions choose between them.
  */
 export declare function getBackendUrl(): string;
 export declare function getDefaultSandboxUrl(): string;

package/dist/core/session/server-store/url-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/session/server-store/url-helpers.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAM7C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7E"}
+{"version":3,"file":"url-helpers.d.ts","sourceRoot":"","sources":["../../../../src/core/session/server-store/url-helpers.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,oBAAoB,IAAI,MAAM,CAM7C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7E"}

package/dist/core/session/server-store/url-helpers.js

@@ -8,8 +8,17 @@ function stripTrailingSlashes(s) {
     return s.slice(0, end);
 }
 /**
- * The backend base URL. All sandbox traffic routes through the backend's
- * unified preview proxy: /v1/p/{sandboxId}/{port}/*
+ * The backend base URL.
+ *
+ * CONTROL traffic — the OpenCode/daemon REST channel on port 8000 — routes
+ * through the path proxy, `/v1/p/{sandboxId}/{port}/*`, and stays there: it is
+ * a programmatic transport with a per-request bearer token, not a browser
+ * surface, so a per-preview origin buys it nothing and would put turn delivery
+ * behind wildcard DNS, a certificate and an edge Worker.
+ *
+ * BROWSER traffic goes to the preview ORIGIN this deployment advertises via
+ * `GET /v1/p/config` — see core/session/preview-config.ts and `rewriteLocalhostUrl`.
+ * Those are the only two forms, and only those two functions choose between them.
  */
 export function getBackendUrl() {
     return stripTrailingSlashes(platformConfig().backendUrl || 'http://localhost:8008/v1');

package/dist/core/session/server-store/url-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-helpers.js","sourceRoot":"","sources":["../../../../src/core/session/server-store/url-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,mEAAmE;AACnE,mEAAmE;AACnE,SAAS,oBAAoB,CAAC,CAAS;IACrC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAC;IAChE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,oBAAoB,CAAC,cAAc,EAAE,CAAC,UAAU,IAAI,0BAA0B,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,GAAG,aAAa,EAAE,MAAM,SAAS,OAAO,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,GAAG,aAAa,EAAE,MAAM,SAAS,OAAO,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,IAAY;IACnE,OAAO,GAAG,aAAa,EAAE,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"url-helpers.js","sourceRoot":"","sources":["../../../../src/core/session/server-store/url-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,mEAAmE;AACnE,mEAAmE;AACnE,SAAS,oBAAoB,CAAC,CAAS;IACrC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAC;IAChE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,oBAAoB,CAAC,cAAc,EAAE,CAAC,UAAU,IAAI,0BAA0B,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC,SAAS,CAAC;IAC7C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,GAAG,aAAa,EAAE,MAAM,SAAS,OAAO,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,GAAG,aAAa,EAAE,MAAM,SAAS,OAAO,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,IAAY;IACnE,OAAO,GAAG,aAAa,EAAE,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC;AAC9D,CAAC"}

package/dist/core/session/static-file-preview.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Framing a file from the sandbox's static file server.
+ *
+ * A host that wants to SHOW an HTML file has exactly one correct move: load it
+ * from the server that ships inside the sandbox (port 3211, `/open?path=…`) and
+ * frame that URL. The tempting shortcut — hand the file's text to an iframe as
+ * `srcDoc` — cannot work, and not for a reason a flag can fix: `srcDoc` gives
+ * the document no URL at all, so `./style.css`, `img/logo.png` and `app.js`
+ * have no base to resolve against. A page written as a page arrives unstyled.
+ *
+ * Two rules live here rather than in the hook, because both are decisions and
+ * neither needs a network to be reasoned about.
+ */
+import { type SubdomainUrlOptions } from './url.js';
+/** Where to frame from, and where to ask whether framing will work yet. */
+export interface StaticFilePreviewTargets {
+    /** The proxied `/open?path=…` URL for the file itself. */
+    previewUrl: string;
+    /** The same service's `/health`, used to wait out a still-booting sandbox. */
+    healthUrl: string;
+}
+/**
+ * Resolve both URLs for one file, or `null` when there is nothing to address.
+ *
+ * The `null` is the whole point. `buildStaticFilePreviewUrl` answers with the
+ * INTERNAL form — `http://localhost:3211/open?path=…` — when no sandbox is
+ * bound, which is honest for a link that will be re-resolved on click and
+ * actively wrong for anything that loads or probes it now: that port is on the
+ * viewer's own machine. Framing it shows whatever the user happens to be
+ * running; probing it can answer `200` and mark a preview "ready" that can
+ * never load. A sandbox binds asynchronously, so every caller passes through
+ * this state on the way to a working preview — it is the common case, not an
+ * edge one.
+ */
+export declare function staticFilePreviewTargets(path: string | undefined, options: SubdomainUrlOptions): StaticFilePreviewTargets | null;
+/** Gap between liveness probes, ms. */
+export declare const STATIC_FILE_HEALTH_RETRY_MS = 1500;
+/**
+ * How many probes before the wait becomes a reported failure.
+ *
+ * 20 × 1.5s ≈ 30s. The bound is not a guess about how long a sandbox takes to
+ * boot — it is the line past which silence stops being informative. Without it
+ * a surface spins "Starting preview server…" for the life of the tab; with it
+ * the user gets a sentence and a Retry.
+ */
+export declare const STATIC_FILE_HEALTH_MAX_ATTEMPTS = 20;
+/** Whether a caller that has made `attempts` probes should make another. */
+export declare function shouldRetryStaticFileHealth(attempts: number): boolean;
+export declare function authenticatedUrlAddresses(authenticatedUrl: string | null | undefined, previewUrl: string | undefined): boolean;
+//# sourceMappingURL=static-file-preview.d.ts.map

package/dist/core/session/static-file-preview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-file-preview.d.ts","sourceRoot":"","sources":["../../../src/core/session/static-file-preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,OAAO,CAAC;AAEf,2EAA2E;AAC3E,MAAM,WAAW,wBAAwB;IACvC,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,mBAAmB,GAC3B,wBAAwB,GAAG,IAAI,CAQjC;AAED,uCAAuC;AACvC,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAEjD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAElD,4EAA4E;AAC5E,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErE;AAiCD,wBAAgB,yBAAyB,CACvC,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAKT"}

package/dist/core/session/static-file-preview.js

@@ -0,0 +1,91 @@
+/**
+ * Framing a file from the sandbox's static file server.
+ *
+ * A host that wants to SHOW an HTML file has exactly one correct move: load it
+ * from the server that ships inside the sandbox (port 3211, `/open?path=…`) and
+ * frame that URL. The tempting shortcut — hand the file's text to an iframe as
+ * `srcDoc` — cannot work, and not for a reason a flag can fix: `srcDoc` gives
+ * the document no URL at all, so `./style.css`, `img/logo.png` and `app.js`
+ * have no base to resolve against. A page written as a page arrives unstyled.
+ *
+ * Two rules live here rather than in the hook, because both are decisions and
+ * neither needs a network to be reasoned about.
+ */
+import { buildStaticFileHealthPreviewUrl, buildStaticFilePreviewUrl, hasPreviewTarget, } from './url.js';
+/**
+ * Resolve both URLs for one file, or `null` when there is nothing to address.
+ *
+ * The `null` is the whole point. `buildStaticFilePreviewUrl` answers with the
+ * INTERNAL form — `http://localhost:3211/open?path=…` — when no sandbox is
+ * bound, which is honest for a link that will be re-resolved on click and
+ * actively wrong for anything that loads or probes it now: that port is on the
+ * viewer's own machine. Framing it shows whatever the user happens to be
+ * running; probing it can answer `200` and mark a preview "ready" that can
+ * never load. A sandbox binds asynchronously, so every caller passes through
+ * this state on the way to a working preview — it is the common case, not an
+ * edge one.
+ */
+export function staticFilePreviewTargets(path, options) {
+    if (!path)
+        return null;
+    if (!hasPreviewTarget(options))
+        return null;
+    const previewUrl = buildStaticFilePreviewUrl(path, options);
+    if (!previewUrl)
+        return null;
+    return { previewUrl, healthUrl: buildStaticFileHealthPreviewUrl(options) };
+}
+/** Gap between liveness probes, ms. */
+export const STATIC_FILE_HEALTH_RETRY_MS = 1_500;
+/**
+ * How many probes before the wait becomes a reported failure.
+ *
+ * 20 × 1.5s ≈ 30s. The bound is not a guess about how long a sandbox takes to
+ * boot — it is the line past which silence stops being informative. Without it
+ * a surface spins "Starting preview server…" for the life of the tab; with it
+ * the user gets a sentence and a Retry.
+ */
+export const STATIC_FILE_HEALTH_MAX_ATTEMPTS = 20;
+/** Whether a caller that has made `attempts` probes should make another. */
+export function shouldRetryStaticFileHealth(attempts) {
+    return attempts < STATIC_FILE_HEALTH_MAX_ATTEMPTS;
+}
+/**
+ * Does an authenticated preview URL address the file we are asking for?
+ *
+ * `useAuthenticatedPreviewUrl` resolves in an effect, so on the render where a
+ * viewer switches to a different file it still holds the PREVIOUS file's URL.
+ * Framing that shows the page the user just navigated away from.
+ *
+ * Compare NORMALIZED, never by prefix. The subdomain form authenticates with a
+ * one-shot `token` that `appendPreviewToken` adds through `URLSearchParams`,
+ * which re-serializes the WHOLE query — and the static file URL is the one
+ * preview URL that has a query, so `?path=/workspace/a.html` comes back as
+ * `?path=%2Fworkspace%2Fa.html`. No prefix of the original survives that, and a
+ * prefix test shipped a preview stuck on "Starting preview server…" forever:
+ * the server was up, the URL was authenticated, and the check said it belonged
+ * to a different file. A prefix is wrong in the other direction too —
+ * `a.html.bak` starts with the URL for `a.html`.
+ *
+ * Both sides go through the same `URL` round-trip, so both carry the same
+ * encoding; `token` is dropped because it is the credential, not the address.
+ */
+function normalizeAddress(candidate) {
+    try {
+        const url = new URL(candidate);
+        url.searchParams.delete('token');
+        url.searchParams.sort();
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+export function authenticatedUrlAddresses(authenticatedUrl, previewUrl) {
+    if (!authenticatedUrl || !previewUrl)
+        return false;
+    const authenticated = normalizeAddress(authenticatedUrl);
+    const wanted = normalizeAddress(previewUrl);
+    return authenticated !== null && authenticated === wanted;
+}
+//# sourceMappingURL=static-file-preview.js.map