@kortix/sdk 0.9.98

package/dist/platform/auth.js

@@ -0,0 +1,161 @@
+/**
+ * Shared auth token helpers.
+ *
+ * Every function below is a thin delegate to `platformConfig().getToken()` —
+ * the SDK holds no token state of its own. Token acquisition (Supabase
+ * getSession/refreshSession or any other provider), caching, deduplicating
+ * concurrent callers (SSE, health check, session fetch, etc. all racing for a
+ * token on page load), and the install/bootstrap seam are entirely the host
+ * app's responsibility, implemented inside the `getToken` it passes to
+ * `configureKortix`/`createKortix`. A host that wants the old 30s-TTL +
+ * inflight-dedup behavior re-implements it in its own `getToken`; the SDK
+ * itself does not cache, dedupe, or retry beyond calling `getToken()` again.
+ *
+ * `getAuthToken()` is the unified getter: returns whatever token the host's
+ * `getToken()` resolves. `getSupabaseAccessToken()` is kept as an alias for
+ * callers that historically asked for "the Supabase token" specifically —
+ * same delegate, same value.
+ *
+ * `invalidateTokenCache()` / `setCachedAuthToken()` / `setBootstrapAuthToken()`
+ * are no-ops here (there is no SDK-side cache to invalidate or seed); they're
+ * kept as exported names so existing call sites compile unchanged, and a host
+ * that layers its own caching on top of `getToken()` can wire these to that
+ * cache if it wants the "invalidate on 401" / "seed before hydration" hooks to
+ * do something.
+ */
+import { buildAuthHeaders, syntheticUnauthenticatedResponse, withDefaultTimeout, withTokenRetry, } from './auth-core.js';
+import { platformConfig } from './config.js';
+/**
+ * Get the current auth token. Delegates directly to `platformConfig().getToken()`
+ * — any caching/deduplication the host wants happens inside that function.
+ */
+export async function getSupabaseAccessToken() {
+    return platformConfig().getToken();
+}
+/**
+ * Retry variant — actually retries now. Previously accepted `attempts`/
+ * `baseDelayMs`/`invalidateBetweenAttempts` and silently ignored all three
+ * (always a single `getToken()` call), which quietly broke every caller that
+ * depended on retry semantics around a flaky/cold token provider (e.g. right
+ * after sign-in, before a host's own session has hydrated — see the retry
+ * call in `authenticatedFetch`'s 401 handler below).
+ *
+ * Retries up to `attempts` times (default 1 = no retry) until `getToken()`
+ * returns a truthy token, waiting `baseDelayMs` between attempts (default 0).
+ * When `invalidateBetweenAttempts` is set, calls `invalidateTokenCache()`
+ * before each retry — a no-op in this file (there's no SDK-side cache), but
+ * kept as a real call so a host that layers its own cache on `getToken()` (and
+ * wires `invalidateTokenCache`/`setCachedAuthToken` to it, per this file's
+ * top-of-file doc comment) gets invalidated between attempts as intended.
+ */
+export async function getSupabaseAccessTokenWithRetry(options) {
+    // The retry loop itself lives in `auth-core.ts` (pure, un-mockable in
+    // tests) — this delegate just binds it to the live platform config.
+    return withTokenRetry(() => platformConfig().getToken(), options, invalidateTokenCache);
+}
+/**
+ * Invalidate the cached token (e.g. after a 401 response).
+ * The next getSupabaseAccessToken() call will fetch fresh.
+ */
+export function invalidateTokenCache() {
+    setCachedAuthToken(null);
+}
+/**
+ * Sync the resolved auth token cache without affecting bootstrap mode.
+ */
+export function setCachedAuthToken(token) {
+    // Token caching/refresh is owned by the host via platformConfig().getToken().
+}
+/**
+ * Seed auth for setup/install flows that receive a JWT from server actions
+ * before the browser Supabase client has established local session state.
+ */
+export function setBootstrapAuthToken(token) {
+    // Token acquisition is owned by the host via platformConfig().getToken().
+}
+/**
+ * Unified auth token getter.
+ *
+ * Returns the Supabase JWT. All requests go through kortix-api which
+ * authenticates via Supabase JWT — no additional sandbox lock/key needed.
+ */
+export async function getAuthToken() {
+    return getSupabaseAccessToken();
+}
+export async function getAuthTokenWithRetry(options) {
+    return getSupabaseAccessTokenWithRetry(options);
+}
+// ── Shared auth-injecting fetch ──
+/**
+ * Execute fetch with auth headers, properly handling Request objects.
+ *
+ * When `input` is a Request (e.g. from the OpenCode SDK), we construct a new
+ * Request with the auth headers merged in, rather than passing headers via the
+ * second `init` argument. This avoids a production-only issue where
+ * `fetch(Request, { headers })` silently drops the init headers.
+ */
+function fetchWithAuth(input, init, headers, signal) {
+    if (input instanceof Request) {
+        // Clone the Request with our auth headers baked in.
+        // This guarantees Authorization is part of the Request itself,
+        // not relying on fetch's init-merge behavior.
+        const authedRequest = new Request(input, {
+            headers,
+            ...(signal ? { signal } : {}),
+        });
+        return fetch(authedRequest);
+    }
+    return fetch(input, { ...init, headers, ...(signal ? { signal } : {}) });
+}
+// Timeout composition, streaming exemption, and header building live in
+// `auth-core.ts` (pure + directly unit-tested there); this file wires them to
+// the live token seam.
+/**
+ * Shared authenticated fetch — injects auth tokens and handles 401 responses.
+ *
+ * Centralizes the pattern duplicated across opencode-sdk, use-sandbox-connection,
+ * and server-selector. All three auth injection points now go through this.
+ *
+ * Behavior:
+ *   1. Gets the current auth token (Supabase JWT)
+ *   2. Injects it as Bearer token on the request
+ *   3. On 401: invalidates the token cache, gets fresh, retries once
+ *
+ * Options:
+ *   - `retryOnAuthError`: if false, skips stale-token retry (default: true)
+ */
+export async function authenticatedFetch(input, init, options) {
+    const { retryOnAuthError = true } = options ?? {};
+    const token = await getAuthTokenWithRetry();
+    // Still no token — return a synthetic 401 response instead of sending a
+    // naked request. Safe for all callers including the OpenCode SDK which
+    // expects fetch() semantics (returns Response, never throws).
+    if (!token) {
+        return syntheticUnauthenticatedResponse();
+    }
+    const headers = buildAuthHeaders(input, init, token);
+    // 30s default timeout for everything EXCEPT the long-lived SSE event
+    // stream (see `withDefaultTimeout`) — a "Kortix as a Backend" wrapper must
+    // never have a hung sandbox/daemon request wedge its handler forever.
+    const signal = withDefaultTimeout(input, init);
+    // When the OpenCode SDK passes a Request object (single arg, no init),
+    // we must construct a new Request with the auth headers baked in.
+    // Relying on fetch(Request, { headers }) to override headers is unreliable
+    // in production builds — Next.js's patched fetch and certain browser
+    // implementations don't properly merge init.headers onto an existing
+    // Request, causing the Authorization header to be silently dropped.
+    const response = await fetchWithAuth(input, init, headers, signal);
+    if (response.status === 401) {
+        // The cached token is stale. Retry once with fresh token.
+        if (retryOnAuthError && token) {
+            invalidateTokenCache();
+            const newToken = await getAuthTokenWithRetry({ attempts: 2, baseDelayMs: 200 });
+            if (newToken && newToken !== token) {
+                const retryHeaders = buildAuthHeaders(input, init, newToken);
+                return fetchWithAuth(input, init, retryHeaders, signal);
+            }
+        }
+    }
+    return response;
+}
+//# sourceMappingURL=auth.js.map

package/dist/platform/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/platform/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACN,gBAAgB,EAChB,gCAAgC,EAChC,kBAAkB,EAClB,cAAc,GAEd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC3C,OAAO,cAAc,EAAE,CAAC,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,OAA2B;IAE3B,sEAAsE;IACtE,oEAAoE;IACpE,OAAO,cAAc,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IACnC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAoB;IACtD,8EAA8E;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACzD,0EAA0E;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAA2B;IAE3B,OAAO,+BAA+B,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,oCAAoC;AAEpC;;;;;;;GAOG;AACH,SAAS,aAAa,CACpB,KAAwB,EACxB,IAA6B,EAC7B,OAAgB,EAChB,MAAoB;IAEpB,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;QAC7B,oDAAoD;QACpD,+DAA+D;QAC/D,8CAA8C;QAC9C,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE;YACvC,OAAO;YACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,wEAAwE;AACxE,8EAA8E;AAC9E,uBAAuB;AAEvB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAwB,EACxB,IAAkB,EAClB,OAEC;IAED,MAAM,EAAE,gBAAgB,GAAG,IAAI,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;IAElD,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAE5C,wEAAwE;IACxE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,gCAAgC,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAE/C,uEAAuE;IACvE,kEAAkE;IAClE,2EAA2E;IAC3E,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,0DAA0D;QAC1D,IAAI,gBAAgB,IAAI,KAAK,EAAE,CAAC;YAC9B,oBAAoB,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAChF,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACnC,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAC7D,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/platform/config-node.d.ts

@@ -0,0 +1,33 @@
+import { type KortixPlatformConfig } from './config.js';
+/**
+ * Run `fn` (or any synchronous callback) with `config` as the platform config
+ * for its entire call tree — every `platformConfig()` read reached from
+ * inside it (facade calls, `backendApi`, `authenticatedFetch`, the files
+ * client, event streams, …) sees THIS config, including across `await`s,
+ * isolated from any other concurrent `runScoped`/`runWithKortix` call.
+ *
+ * Internal primitive: preserves whatever `fn` returns (sync value or Promise)
+ * without coercing it, so `@kortix/sdk/server`'s `createScopedKortix` can wrap
+ * both sync (`setModel`) and async (`ensureReady`) facade methods uniformly.
+ */
+export declare function runScoped<T>(config: KortixPlatformConfig, fn: () => T): T;
+/**
+ * Run `fn` with `config` as the platform config for its entire async call
+ * tree (see `runScoped`). This is the public primitive re-exported from
+ * `@kortix/sdk/server` — use it to wrap one incoming request's handler body
+ * when you're not using the `createScopedKortix` facade wrapper.
+ *
+ *   import { runWithKortix } from '@kortix/sdk/server';
+ *
+ *   app.use(async (req, res, next) => {
+ *     await runWithKortix({ backendUrl, getToken: () => resolveTokenFor(req) }, async () => {
+ *       // every Kortix call made anywhere in this request's async chain
+ *       // (including inside `next()`) sees THIS request's config.
+ *       await next();
+ *     });
+ *   });
+ */
+export declare function runWithKortix<T>(config: KortixPlatformConfig, fn: () => Promise<T>): Promise<T>;
+/** The config active on the current async context, if any (for diagnostics/tests). */
+export declare function getScopedConfig(): KortixPlatformConfig | undefined;
+//# sourceMappingURL=config-node.d.ts.map

package/dist/platform/config-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-node.d.ts","sourceRoot":"","sources":["../../src/platform/config-node.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAK1E;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,MAAM,EAAE,oBAAoB,EAC5B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,sFAAsF;AACtF,wBAAgB,eAAe,IAAI,oBAAoB,GAAG,SAAS,CAElE"}

package/dist/platform/config-node.js

@@ -0,0 +1,63 @@
+/**
+ * Node-only `AsyncLocalStorage` layer for per-request platform-config
+ * isolation. Reachable ONLY through the `@kortix/sdk/server` subpath — never
+ * imported by the root `@kortix/sdk` entry point, `@kortix/sdk/react`, or any
+ * other browser-safe subpath — so `node:async_hooks` never enters a browser
+ * bundle's module graph. If this file's static `import` ever gets pulled into
+ * an isomorphic/browser-facing subpath, that's a bug: keep it behind
+ * `@kortix/sdk/server`.
+ *
+ * This is the fix for the SDK's single biggest concurrency hazard: the
+ * `configureKortix()` seam (`./config.ts`) stores the platform config in a
+ * process-wide module-global. A "Kortix as a Backend" server — any Node/Bun
+ * process fronting Kortix on behalf of multiple end users/requests
+ * concurrently — can't safely call `configureKortix()` once per request: two
+ * in-flight requests with different tokens race on the same global and the
+ * second write wins for both. `runWithKortix` fixes that by threading the
+ * config through Node's `AsyncLocalStorage`, which — unlike a plain variable —
+ * stays correctly scoped to one call's entire async continuation (every
+ * `await` inside it) while remaining isolated from any other concurrent call
+ * in the same process.
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { __setConfigResolver } from './config.js';
+const als = new AsyncLocalStorage();
+__setConfigResolver(() => als.getStore());
+/**
+ * Run `fn` (or any synchronous callback) with `config` as the platform config
+ * for its entire call tree — every `platformConfig()` read reached from
+ * inside it (facade calls, `backendApi`, `authenticatedFetch`, the files
+ * client, event streams, …) sees THIS config, including across `await`s,
+ * isolated from any other concurrent `runScoped`/`runWithKortix` call.
+ *
+ * Internal primitive: preserves whatever `fn` returns (sync value or Promise)
+ * without coercing it, so `@kortix/sdk/server`'s `createScopedKortix` can wrap
+ * both sync (`setModel`) and async (`ensureReady`) facade methods uniformly.
+ */
+export function runScoped(config, fn) {
+    return als.run(config, fn);
+}
+/**
+ * Run `fn` with `config` as the platform config for its entire async call
+ * tree (see `runScoped`). This is the public primitive re-exported from
+ * `@kortix/sdk/server` — use it to wrap one incoming request's handler body
+ * when you're not using the `createScopedKortix` facade wrapper.
+ *
+ *   import { runWithKortix } from '@kortix/sdk/server';
+ *
+ *   app.use(async (req, res, next) => {
+ *     await runWithKortix({ backendUrl, getToken: () => resolveTokenFor(req) }, async () => {
+ *       // every Kortix call made anywhere in this request's async chain
+ *       // (including inside `next()`) sees THIS request's config.
+ *       await next();
+ *     });
+ *   });
+ */
+export async function runWithKortix(config, fn) {
+    return runScoped(config, fn);
+}
+/** The config active on the current async context, if any (for diagnostics/tests). */
+export function getScopedConfig() {
+    return als.getStore();
+}
+//# sourceMappingURL=config-node.js.map

package/dist/platform/config-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-node.js","sourceRoot":"","sources":["../../src/platform/config-node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAA6B,MAAM,UAAU,CAAC;AAE1E,MAAM,GAAG,GAAG,IAAI,iBAAiB,EAAwB,CAAC;AAC1D,mBAAmB,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAI,MAA4B,EAAE,EAAW;IACpE,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA4B,EAC5B,EAAoB;IAEpB,OAAO,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe;IAC7B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/platform/config.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Per-flag overrides for `@kortix/sdk/feature-flags`. A host that isn't Next.js
+ * (no `NEXT_PUBLIC_*` build-time env, e.g. React Native, a bare browser bundle,
+ * or a CLI) has no other way to flip these — `configureKortix({ featureFlags })`
+ * is the portable seam. Omitted flags fall back to the legacy `NEXT_PUBLIC_*`
+ * env var (so web keeps working unchanged), then to the flag's own default. See
+ * `feature-flags.ts` for what each flag does.
+ */
+export interface KortixFeatureFlagOverrides {
+    disableMobileAdvertising?: boolean;
+    enableDinoGame?: boolean;
+    enableProjects?: boolean;
+    enableAutoModel?: boolean;
+}
+/**
+ * The single app-specific seam. Everything else in the SDK is portable; this is
+ * the one place a host app injects its identity + backend. Web wires its
+ * Supabase token here; the demo/CLI wire a PAT. Call `configureKortix()` once at
+ * startup before any data-layer call.
+ */
+export interface KortixPlatformConfig {
+    /** Absolute backend base URL incl. version prefix, e.g. `http://localhost:8008/v1`. */
+    backendUrl: string;
+    /** Returns the current bearer (Supabase JWT, PAT, or API key) — or null if unauthenticated. */
+    getToken: () => Promise<string | null>;
+    /** Optional UI error sink (toast/log). No-op by default. */
+    onError?: (error: unknown, context?: unknown) => void;
+    /** Default sandbox id for local/single-sandbox hosts (was `getEnv().SANDBOX_ID`). */
+    sandboxId?: string | null;
+    /** Whether billing gates are active (was `isBillingEnabled()`). */
+    billingEnabled?: boolean;
+    /** Current user id, used to scope the offline message cache. */
+    getUserId?: () => Promise<string | null>;
+    /** Toast sink — the host renders it. */
+    onToast?: (level: 'info' | 'success' | 'error' | 'warning', message: string, options?: unknown) => void;
+    /** OS/web-notification sink — the host renders it. */
+    onNotify?: (event: {
+        kind: string;
+        sessionId: string;
+        [key: string]: unknown;
+    }) => void;
+    /** Explicit per-flag overrides for `@kortix/sdk/feature-flags` (portable path). */
+    featureFlags?: KortixFeatureFlagOverrides;
+}
+/** @internal Registration seam for `@kortix/sdk/server`. Not for host use. */
+export declare function __setConfigResolver(fn: (() => KortixPlatformConfig | undefined) | null): void;
+/** @internal Test-only introspection, so a test file that flips the resolver
+ *  (e.g. to exercise the no-resolver fallback path) can snapshot + restore
+ *  whatever was registered before it, instead of clobbering a resolver another
+ *  test file registered in the same process (bun runs all `src/**\/*.test.ts`
+ *  files in one process, sharing this module's state). */
+export declare function __getConfigResolver(): (() => KortixPlatformConfig | undefined) | null;
+/**
+ * Wire the platform seam. `current` is a process-wide singleton — safe for a
+ * host with exactly one config for its whole lifetime (a browser tab, a CLI,
+ * a single-tenant server), but UNSAFE for a server process that must serve
+ * concurrent requests carrying different tokens (see the warning on
+ * `ServerTokenOptions` in `projects-client/shared.ts`): the last caller to
+ * `configureKortix()`/`createKortix()` wins for every other in-flight request.
+ * For that "Kortix as a Backend" shape, use `runWithKortix`/`createScopedKortix`
+ * from `@kortix/sdk/server` instead — they isolate each call's config in a
+ * Node `AsyncLocalStorage` context instead of this shared global.
+ *
+ * `opts.global === false` (used internally by `createScopedKortix`) skips the
+ * global write entirely, so a scoped client never touches/clobbers `current`.
+ */
+export declare function configureKortix(config: KortixPlatformConfig, opts?: {
+    global?: boolean;
+}): void;
+/**
+ * The platform config in effect for THIS call: an active `runWithKortix`/
+ * `createScopedKortix` scope if one is on the current async context, else the
+ * process-global `current` set by `configureKortix()`, else the inert default.
+ */
+export declare function platformConfig(): KortixPlatformConfig;
+export declare function isConfigured(): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/platform/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/platform/config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvC,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACtD,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,wCAAwC;IACxC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACxG,sDAAsD;IACtD,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACxF,mFAAmF;IACnF,YAAY,CAAC,EAAE,0BAA0B,CAAC;CAC3C;AAwBD,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,IAAI,CAE7F;AAED;;;;0DAI0D;AAC1D,wBAAgB,mBAAmB,IAAI,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC,GAAG,IAAI,CAErF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAG/F;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,oBAAoB,CAErD;AAED,wBAAgB,YAAY,IAAI,OAAO,CAEtC"}

package/dist/platform/config.js

@@ -0,0 +1,62 @@
+/**
+ * Inert default so module-eval / SSR (which touch SDK modules before the host's
+ * provider runs) never crash. The host's `configureKortix` overrides it before
+ * any real data call — an unauthenticated default just yields no token / no URL.
+ */
+const DEFAULT = {
+    backendUrl: '',
+    getToken: async () => null,
+};
+let current = null;
+/**
+ * Per-request override hook, registered ONLY by `@kortix/sdk/server`'s
+ * Node-only `AsyncLocalStorage` layer (`config-node.ts`) — see `runWithKortix`/
+ * `createScopedKortix` there. A browser bundle never imports that subpath, so
+ * this stays `null` for it and `platformConfig()` behaves exactly as before
+ * (reads the process-global `current`). Not part of the public API — do not
+ * call `__setConfigResolver` directly; use `runWithKortix`/`createScopedKortix`.
+ */
+let configResolver = null;
+/** @internal Registration seam for `@kortix/sdk/server`. Not for host use. */
+export function __setConfigResolver(fn) {
+    configResolver = fn;
+}
+/** @internal Test-only introspection, so a test file that flips the resolver
+ *  (e.g. to exercise the no-resolver fallback path) can snapshot + restore
+ *  whatever was registered before it, instead of clobbering a resolver another
+ *  test file registered in the same process (bun runs all `src/**\/*.test.ts`
+ *  files in one process, sharing this module's state). */
+export function __getConfigResolver() {
+    return configResolver;
+}
+/**
+ * Wire the platform seam. `current` is a process-wide singleton — safe for a
+ * host with exactly one config for its whole lifetime (a browser tab, a CLI,
+ * a single-tenant server), but UNSAFE for a server process that must serve
+ * concurrent requests carrying different tokens (see the warning on
+ * `ServerTokenOptions` in `projects-client/shared.ts`): the last caller to
+ * `configureKortix()`/`createKortix()` wins for every other in-flight request.
+ * For that "Kortix as a Backend" shape, use `runWithKortix`/`createScopedKortix`
+ * from `@kortix/sdk/server` instead — they isolate each call's config in a
+ * Node `AsyncLocalStorage` context instead of this shared global.
+ *
+ * `opts.global === false` (used internally by `createScopedKortix`) skips the
+ * global write entirely, so a scoped client never touches/clobbers `current`.
+ */
+export function configureKortix(config, opts) {
+    if (opts?.global === false)
+        return;
+    current = config;
+}
+/**
+ * The platform config in effect for THIS call: an active `runWithKortix`/
+ * `createScopedKortix` scope if one is on the current async context, else the
+ * process-global `current` set by `configureKortix()`, else the inert default.
+ */
+export function platformConfig() {
+    return configResolver?.() ?? current ?? DEFAULT;
+}
+export function isConfigured() {
+    return current !== null || configResolver?.() !== undefined;
+}
+//# sourceMappingURL=config.js.map

package/dist/platform/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/platform/config.ts"],"names":[],"mappings":"AA0CA;;;;GAIG;AACH,MAAM,OAAO,GAAyB;IACpC,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;CAC3B,CAAC;AAEF,IAAI,OAAO,GAAgC,IAAI,CAAC;AAEhD;;;;;;;GAOG;AACH,IAAI,cAAc,GAAoD,IAAI,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,EAAmD;IACrF,cAAc,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;;0DAI0D;AAC1D,MAAM,UAAU,mBAAmB;IACjC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAAC,MAA4B,EAAE,IAA2B;IACvF,IAAI,IAAI,EAAE,MAAM,KAAK,KAAK;QAAE,OAAO;IACnC,OAAO,GAAG,MAAM,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,EAAE,EAAE,IAAI,OAAO,IAAI,OAAO,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,KAAK,IAAI,IAAI,cAAc,EAAE,EAAE,KAAK,SAAS,CAAC;AAC9D,CAAC"}

package/dist/platform/feature-flags.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Parse a raw env string into a flag override: recognized truthy/falsy values
+ * map to true/false, anything else (including unset) is `undefined` = "no
+ * opinion, fall through". Exported for hosts that wire literal
+ * `process.env.NEXT_PUBLIC_*` reads into `configureKortix({ featureFlags })` —
+ * required on Next.js, whose client bundles only inline LITERAL dotted
+ * `process.env.NEXT_PUBLIC_X` expressions; the dynamic `safeEnv(name)` lookup
+ * here can never be inlined and always yields undefined in the browser.
+ */
+export declare function parseFlagOverride(value: string | undefined): boolean | undefined;
+export interface FeatureFlags {
+    disableMobileAdvertising: boolean;
+    enableDinoGame: boolean;
+    enableProjects: boolean;
+    enableAutoModel: boolean;
+}
+/**
+ * Every property below is a getter, so it's resolved lazily on each read
+ * rather than frozen at module-eval time — a host's `configureKortix({
+ * featureFlags })` is honored immediately, even if it runs after this module
+ * was first imported (module eval on non-Next hosts has no guaranteed order
+ * relative to the host's own startup/provider code).
+ */
+export declare const featureFlags: FeatureFlags;
+//# sourceMappingURL=feature-flags.d.ts.map

package/dist/platform/feature-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-flags.d.ts","sourceRoot":"","sources":["../../src/platform/feature-flags.ts"],"names":[],"mappings":"AAyBA;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAMhF;AAaD,MAAM,WAAW,YAAY;IAC3B,wBAAwB,EAAE,OAAO,CAAC;IAClC,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,EAAE,YA8D1B,CAAC"}

package/dist/platform/feature-flags.js

@@ -0,0 +1,114 @@
+import { AUTO_MODEL_ENABLED } from '@kortix/llm-catalog';
+import { platformConfig } from './config.js';
+function parseEnvBoolean(value, defaultValue) {
+    if (value == null)
+        return defaultValue;
+    const normalized = value.trim().toLowerCase();
+    if (['1', 'true', 'yes', 'y', 'on'].includes(normalized))
+        return true;
+    if (['0', 'false', 'no', 'n', 'off'].includes(normalized))
+        return false;
+    return defaultValue;
+}
+/**
+ * Safe `process.env.<name>` read. Non-Next hosts (React Native, a bare browser
+ * bundle, a CLI) may not define a `process` global at all — touching
+ * `process.env` there throws a ReferenceError, not just returns `undefined`.
+ */
+function safeEnv(name) {
+    try {
+        return typeof process !== 'undefined' ? process.env?.[name] : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Parse a raw env string into a flag override: recognized truthy/falsy values
+ * map to true/false, anything else (including unset) is `undefined` = "no
+ * opinion, fall through". Exported for hosts that wire literal
+ * `process.env.NEXT_PUBLIC_*` reads into `configureKortix({ featureFlags })` —
+ * required on Next.js, whose client bundles only inline LITERAL dotted
+ * `process.env.NEXT_PUBLIC_X` expressions; the dynamic `safeEnv(name)` lookup
+ * here can never be inlined and always yields undefined in the browser.
+ */
+export function parseFlagOverride(value) {
+    if (value == null)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (['1', 'true', 'yes', 'y', 'on'].includes(normalized))
+        return true;
+    if (['0', 'false', 'no', 'n', 'off'].includes(normalized))
+        return false;
+    return undefined;
+}
+/**
+ * Resolve one flag: an explicit `configureKortix({ featureFlags })` override
+ * wins (the portable path — works on any host); otherwise fall back to the
+ * legacy `NEXT_PUBLIC_*` build-time env var (so web keeps working unchanged
+ * without calling `configureKortix` for this at all); otherwise the default.
+ */
+function resolveFlag(override, envName, defaultValue) {
+    if (override !== undefined)
+        return override;
+    return parseEnvBoolean(safeEnv(envName), defaultValue);
+}
+/**
+ * Every property below is a getter, so it's resolved lazily on each read
+ * rather than frozen at module-eval time — a host's `configureKortix({
+ * featureFlags })` is honored immediately, even if it runs after this module
+ * was first imported (module eval on non-Next hosts has no guaranteed order
+ * relative to the host's own startup/provider code).
+ */
+export const featureFlags = {
+    /**
+     * When true, hide any mobile app download / install advertising across the web app.
+     *
+     * Default: false (shown)
+     * Set NEXT_PUBLIC_DISABLE_MOBILE_ADVERTISING=true, or
+     * configureKortix({ featureFlags: { disableMobileAdvertising: true } }), to hide.
+     */
+    get disableMobileAdvertising() {
+        return resolveFlag(platformConfig().featureFlags?.disableMobileAdvertising, 'NEXT_PUBLIC_DISABLE_MOBILE_ADVERTISING', false);
+    },
+    /** When true, show the dino game easter egg during provisioning. Default: false. */
+    get enableDinoGame() {
+        return resolveFlag(platformConfig().featureFlags?.enableDinoGame, 'NEXT_PUBLIC_ENABLE_DINO_GAME', false);
+    },
+    /**
+     * Multi-project paradigm.
+     *
+     * Default: false. The product ships in single-workspace mode — no Projects
+     * section, no project picker, no /projects/[id] view, no project-scoped
+     * channel/trigger UI, no @project mentions, no `Add to board` triggers.
+     *
+     * When true (via NEXT_PUBLIC_ENABLE_PROJECTS=true or
+     * configureKortix({ featureFlags: { enableProjects: true } })), the legacy
+     * project UI (board, milestones, members, project agents/credentials/templates)
+     * is surfaced. The sandbox MUST also have KORTIX_PROJECTS_ENABLED=true for the
+     * LLM-side project/ticket tools to register; without that the UI exists but
+     * tool calls 503.
+     */
+    get enableProjects() {
+        return resolveFlag(platformConfig().featureFlags?.enableProjects, 'NEXT_PUBLIC_ENABLE_PROJECTS', false);
+    },
+    /**
+     * Expose the AUTO model (the gateway's smart router) in the model picker.
+     *
+     * Default: AUTO_MODEL_ENABLED (false). While off, the picker hides the "Auto"
+     * toggle entirely and every session opts into an explicit model — GLM 5.2 by
+     * default (see AUTO_DEFAULT_MODEL_ID in @kortix/llm-catalog). The gateway
+     * still resolves `auto` server-side, so this only controls the UI: flip it
+     * (via NEXT_PUBLIC_ENABLE_AUTO_MODEL=true or
+     * configureKortix({ featureFlags: { enableAutoModel: true } })) to bring the
+     * toggle back later.
+     */
+    get enableAutoModel() {
+        return resolveFlag(platformConfig().featureFlags?.enableAutoModel, 'NEXT_PUBLIC_ENABLE_AUTO_MODEL', AUTO_MODEL_ENABLED);
+    },
+};
+// Debug: uncomment to inspect feature flags during development
+// if (safeEnv('NODE_ENV') !== 'production') {
+//   console.log('[featureFlags]', { ...featureFlags });
+// }
+//# sourceMappingURL=feature-flags.js.map

package/dist/platform/feature-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature-flags.js","sourceRoot":"","sources":["../../src/platform/feature-flags.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C,SAAS,eAAe,CAAC,KAAyB,EAAE,YAAqB;IACvE,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,YAAY,CAAC;IACvC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,OAAO,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAA6B,EAAE,OAAe,EAAE,YAAqB;IACxF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC;AACzD,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAiB;IACxC;;;;;;OAMG;IACH,IAAI,wBAAwB;QAC1B,OAAO,WAAW,CAChB,cAAc,EAAE,CAAC,YAAY,EAAE,wBAAwB,EACvD,wCAAwC,EACxC,KAAK,CACN,CAAC;IACJ,CAAC;IACD,oFAAoF;IACpF,IAAI,cAAc;QAChB,OAAO,WAAW,CAChB,cAAc,EAAE,CAAC,YAAY,EAAE,cAAc,EAC7C,8BAA8B,EAC9B,KAAK,CACN,CAAC;IACJ,CAAC;IACD;;;;;;;;;;;;;OAaG;IACH,IAAI,cAAc;QAChB,OAAO,WAAW,CAChB,cAAc,EAAE,CAAC,YAAY,EAAE,cAAc,EAC7C,6BAA6B,EAC7B,KAAK,CACN,CAAC;IACJ,CAAC;IACD;;;;;;;;;;OAUG;IACH,IAAI,eAAe;QACjB,OAAO,WAAW,CAChB,cAAc,EAAE,CAAC,YAAY,EAAE,eAAe,EAC9C,+BAA+B,EAC/B,kBAAkB,CACnB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,+DAA+D;AAC/D,8CAA8C;AAC9C,wDAAwD;AACxD,IAAI"}

package/dist/platform/fresh-sessions.d.ts

@@ -0,0 +1,4 @@
+export declare function markSessionFresh(id: string | null | undefined): void;
+export declare function isSessionFresh(id: string | null | undefined): boolean;
+export declare function clearSessionFresh(id: string | null | undefined): void;
+//# sourceMappingURL=fresh-sessions.d.ts.map

package/dist/platform/fresh-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fresh-sessions.d.ts","sourceRoot":"","sources":["../../src/platform/fresh-sessions.ts"],"names":[],"mappings":"AAWA,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAEpE;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE;AAED,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAErE"}

package/dist/platform/fresh-sessions.js

@@ -0,0 +1,22 @@
+/**
+ * Tracks sessions that were just created in THIS browser session, so the session
+ * page can show the instant typeable shell (not the resume loader) for them.
+ *
+ * An in-memory Set — not sessionStorage — because creation and the subsequent
+ * navigation happen in the same JS context (SPA pushState / client nav), so this
+ * is immune to serialization, key-encoding, and write-ordering quirks. A hard
+ * reload clears it, which is correct: a reloaded session is a resume, not new.
+ */
+const freshSessions = new Set();
+export function markSessionFresh(id) {
+    if (id)
+        freshSessions.add(id);
+}
+export function isSessionFresh(id) {
+    return !!id && freshSessions.has(id);
+}
+export function clearSessionFresh(id) {
+    if (id)
+        freshSessions.delete(id);
+}
+//# sourceMappingURL=fresh-sessions.js.map

package/dist/platform/fresh-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fresh-sessions.js","sourceRoot":"","sources":["../../src/platform/fresh-sessions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC,MAAM,UAAU,gBAAgB,CAAC,EAA6B;IAC5D,IAAI,EAAE;QAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAA6B;IAC1D,OAAO,CAAC,CAAC,EAAE,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAA6B;IAC7D,IAAI,EAAE;QAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/platform/instance-routes.d.ts

@@ -0,0 +1,17 @@
+export declare const ACTIVE_INSTANCE_COOKIE = "kortix-active-instance";
+export declare const INSTANCE_SCOPED_ROUTES: readonly ["/dashboard", "/agents", "/p", "/workspace", "/settings", "/browser", "/desktop", "/services", "/sessions", "/terminal", "/files", "/scheduled-tasks", "/commands", "/tools", "/configuration", "/changelog", "/legacy", "/credits-explained"];
+export declare function isInstanceScopedAppPath(pathname: string): boolean;
+export declare function extractInstanceRoute(pathname: string): {
+    instanceId: string;
+    innerPath: string;
+} | null;
+export declare function isInstanceDetailPath(pathname: string): boolean;
+export declare function stripInstancePrefix(pathname: string): string;
+export declare function buildInstancePath(instanceId: string, pathname: string): string;
+export declare function getCurrentInstanceIdFromPathname(pathname: string | null | undefined): string | null;
+export declare function getCurrentInstanceIdFromWindow(): string | null;
+export declare function getActiveInstanceIdFromCookie(): string | null;
+export declare function setActiveInstanceCookie(instanceId?: string | null): void;
+export declare function toInstanceAwarePath(pathname: string, instanceId?: string | null): string;
+export declare function normalizeAppPathname(pathname: string): string;
+//# sourceMappingURL=instance-routes.d.ts.map

package/dist/platform/instance-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-routes.d.ts","sourceRoot":"","sources":["../../src/platform/instance-routes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,eAAO,MAAM,sBAAsB,0PAmBzB,CAAC;AAEX,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASvG;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAU9E;AAED,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGnG;AAED,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,IAAI,CAI9D;AAED,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CAI7D;AAED,wBAAgB,uBAAuB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAmBxE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAExF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI7D"}