@vibesdotdev/code-sessions 0.0.0-stage → 1.0.0-rc.0

package/dist/svelte/live-session.d.ts

@@ -0,0 +1,156 @@
+/**
+ * Liveness rules for a watched code session.
+ *
+ * A session view is a WATCH surface: the user opens it to see work happen, so
+ * state has to arrive without them reaching for reload. These are the pure
+ * decisions behind that — kept out of the component so they can be tested
+ * without a DOM, and out of the app so every surface watching a session
+ * (HQ today, others later) answers "should I still be watching?" the same way.
+ *
+ * The refresh mechanism itself is deliberately NOT here: surfaces re-run their
+ * own canonical loader (SvelteKit `invalidate`), so watching reuses the one
+ * data path a session already resolves through instead of a second client-side
+ * fetch that could drift from it.
+ */
+import { type PullRequestPlan, type PullRequestPlanSession } from '@vibesdotdev/code-sessions/pull-request-plan';
+/**
+ * Statuses from which a session will never change again on its own.
+ *
+ * Polling past one of these is pure cost: nothing upstream can move the record,
+ * so the surface would ask forever and learn nothing.
+ *
+ * These are the TERMINAL members of `PlatformCodeSessionStatus`
+ * (`initializing | active | error | ended` —
+ * `platform/src/api/platform.api-client.types.ts:88`, and the same
+ * enum the create route validates against). The first version of this file
+ * invented `stopped/failed/expired/deleted`, which the platform cannot emit —
+ * so the settled set never matched anything, `shouldWatchSession` was a
+ * constant `true`, and every session-detail tab polled forever, finished or
+ * not. Caught by independent review, not by the tests: they asserted the
+ * invented words against themselves.
+ *
+ * If a new terminal status is added to the platform enum, it belongs here — and
+ * the test below that walks the real enum will fail until it is.
+ */
+export declare const SETTLED_SESSION_STATUSES: readonly ["ended", "error"];
+/** Every status the platform can emit — mirrored so the tests can walk it. */
+export declare const PLATFORM_SESSION_STATUSES: readonly ["initializing", "active", "error", "ended"];
+export type SettledSessionStatus = (typeof SETTLED_SESSION_STATUSES)[number];
+/** True when the session has reached a state it cannot leave. */
+export declare function isSessionSettled(status: string | null | undefined): boolean;
+/**
+ * Whether a watching surface should keep refreshing.
+ *
+ * An unknown/absent status keeps polling ON PURPOSE: a session that has not
+ * reported yet is exactly the case the user is waiting on, and treating
+ * "unknown" as settled would leave a starting-up session frozen on screen —
+ * the failure this whole predicate exists to remove.
+ */
+export declare function shouldWatchSession(status: string | null | undefined): boolean;
+/**
+ * Poll interval for a watched session, in milliseconds.
+ *
+ * Short enough that "it is starting up now" resolves while the user is still
+ * looking, long enough that a forgotten open tab is not a load generator. The
+ * caller is expected to poll only while the document is visible.
+ */
+export declare const SESSION_WATCH_INTERVAL_MS = 5000;
+/** SvelteKit invalidation key a session-detail surface depends on. */
+export declare const SESSION_DETAIL_DEPENDENCY = "code-session:detail";
+/**
+ * Fully-specified PR offer a surface can render after publish.
+ *
+ * `plan` is the single planner output (`pullRequestPlanForSession` /
+ * `pullRequestPlanAfterPublish`). Title/description/head/repo always come from
+ * that plan — never reinvented here. `url` is a link into Forge's `pulls/new`
+ * with head (+ optional base) and plan title/body as query prefills; actual PR
+ * *creation* via `forge-pr-create-from-branch` is a follow-up that consumes the
+ * same plan fields.
+ */
+export type SessionPullRequestPresentation = {
+    ready: false;
+    reason: string;
+} | {
+    ready: true;
+    plan: Extract<PullRequestPlan, {
+        ready: true;
+    }>;
+    /** Repo ref for forge-pr-create-from-branch / Forge URL. */
+    repo: string;
+    /** Head branch (session work). */
+    head: string;
+    /** Optional merge target; omit so Forge uses the repo default. */
+    base?: string;
+    title: string;
+    /** PR body — plan description (session/branch/work-item lines). */
+    body: string;
+    /**
+     * Link into Forge pulls/new carrying head (+ base) and title/body
+     * prefills. `null` when the repository is not `owner/name` or the
+     * forge origin is missing — plan fields still render.
+     */
+    url: string | null;
+};
+/**
+ * Where a published branch becomes a pull request link.
+ *
+ * Deliberately a LINK into Forge rather than a second PR-creation path. Forge's
+ * `pulls/new` resolves the merge base and head SHA; plan title/body ride as
+ * query prefills so the form opens with session truth, not only base/head.
+ *
+ * Prefer {@link sessionPullRequestPresentation} at call sites that have a
+ * session — it routes through the single planner first. This helper remains
+ * for pure URL construction from already-planned fields.
+ *
+ * Returns `null` rather than a half-built URL when the repository ref or branch
+ * is missing. A dead "Open pull request" button is worse than no button: it
+ * claims a next step exists when nothing can happen.
+ */
+export declare function forgePullRequestUrl(input: {
+    /** Forge origin, e.g. `https://git.vibes.dev`. */
+    forgeOrigin: string | null | undefined;
+    /** `owner/name` as proven by the platform, not as typed by anyone. */
+    repository: string | null | undefined;
+    branch: string | null | undefined;
+    /** Target branch; Forge falls back to the repo default when omitted. */
+    base?: string | null;
+    /** Prefill for the new-PR form title (from the plan when known). */
+    title?: string | null;
+    /** Prefill for the new-PR form body (from the plan when known). */
+    body?: string | null;
+}): string | null;
+/**
+ * Single entry for "after publish, what PR do we show?".
+ *
+ * Routes through {@link pullRequestPlanAfterPublish} so HQ, CLI, and any future
+ * automation share one answer for readiness, title, body, head, and repo.
+ * Never pass `session.checkoutRef` as the merge *base* — that field is the
+ * session's work branch (head), and using it as base made base===head.
+ */
+export declare function sessionPullRequestPresentation(input: {
+    session: PullRequestPlanSession;
+    forgeOrigin: string | null | undefined;
+    /** Platform-proven publish result; preferred over create-time session fields. */
+    published?: {
+        repository?: string | null;
+        branch?: string | null;
+    };
+    /**
+     * Merge target when the surface knows one. Omit so Forge uses the repo
+     * default — do not pass the session checkout ref here.
+     */
+    base?: string | null;
+}): SessionPullRequestPresentation;
+/**
+ * Render the exact authority result returned by publish.
+ *
+ * Consumers must not feed the response back through the planner: doing so
+ * silently turns an absent published branch into the session's stale
+ * create-time checkout ref. This helper is deliberately presentation-only.
+ */
+export declare function pullRequestPresentationFromPlan(input: {
+    plan: PullRequestPlan;
+    forgeOrigin: string | null | undefined;
+    base?: string | null;
+}): SessionPullRequestPresentation;
+//# sourceMappingURL=live-session.d.ts.map

package/dist/svelte/live-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-session.d.ts","sourceRoot":"","sources":["../../src/svelte/live-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAEN,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,MAAM,8CAA8C,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,wBAAwB,6BAA8B,CAAC;AAEpE,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,uDAAwD,CAAC;AAE/F,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAG3E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,OAAQ,CAAC;AAE/C,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,MAAM,8BAA8B,GACvC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChC;IACA,KAAK,EAAE,IAAI,CAAC;IACZ,IAAI,EAAE,OAAO,CAAC,eAAe,EAAE;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAChD,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAClB,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IAC1C,kDAAkD;IAClD,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,GAAG,MAAM,GAAG,IAAI,CAmBhB;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE;IACrD,OAAO,EAAE,sBAAsB,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,iFAAiF;IACjF,SAAS,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACnE;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,GAAG,8BAA8B,CAOjC;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACtD,IAAI,EAAE,eAAe,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB,GAAG,8BAA8B,CAyBjC"}

package/dist/svelte/live-session.js

@@ -0,0 +1,152 @@
+/**
+ * Liveness rules for a watched code session.
+ *
+ * A session view is a WATCH surface: the user opens it to see work happen, so
+ * state has to arrive without them reaching for reload. These are the pure
+ * decisions behind that — kept out of the component so they can be tested
+ * without a DOM, and out of the app so every surface watching a session
+ * (HQ today, others later) answers "should I still be watching?" the same way.
+ *
+ * The refresh mechanism itself is deliberately NOT here: surfaces re-run their
+ * own canonical loader (SvelteKit `invalidate`), so watching reuses the one
+ * data path a session already resolves through instead of a second client-side
+ * fetch that could drift from it.
+ */
+import { pullRequestPlanAfterPublish } from '@vibesdotdev/code-sessions/pull-request-plan';
+/**
+ * Statuses from which a session will never change again on its own.
+ *
+ * Polling past one of these is pure cost: nothing upstream can move the record,
+ * so the surface would ask forever and learn nothing.
+ *
+ * These are the TERMINAL members of `PlatformCodeSessionStatus`
+ * (`initializing | active | error | ended` —
+ * `platform/src/api/platform.api-client.types.ts:88`, and the same
+ * enum the create route validates against). The first version of this file
+ * invented `stopped/failed/expired/deleted`, which the platform cannot emit —
+ * so the settled set never matched anything, `shouldWatchSession` was a
+ * constant `true`, and every session-detail tab polled forever, finished or
+ * not. Caught by independent review, not by the tests: they asserted the
+ * invented words against themselves.
+ *
+ * If a new terminal status is added to the platform enum, it belongs here — and
+ * the test below that walks the real enum will fail until it is.
+ */
+export const SETTLED_SESSION_STATUSES = ['ended', 'error'];
+/** Every status the platform can emit — mirrored so the tests can walk it. */
+export const PLATFORM_SESSION_STATUSES = ['initializing', 'active', 'error', 'ended'];
+/** True when the session has reached a state it cannot leave. */
+export function isSessionSettled(status) {
+    if (!status)
+        return false;
+    return SETTLED_SESSION_STATUSES.some((settled) => settled === status);
+}
+/**
+ * Whether a watching surface should keep refreshing.
+ *
+ * An unknown/absent status keeps polling ON PURPOSE: a session that has not
+ * reported yet is exactly the case the user is waiting on, and treating
+ * "unknown" as settled would leave a starting-up session frozen on screen —
+ * the failure this whole predicate exists to remove.
+ */
+export function shouldWatchSession(status) {
+    return !isSessionSettled(status);
+}
+/**
+ * Poll interval for a watched session, in milliseconds.
+ *
+ * Short enough that "it is starting up now" resolves while the user is still
+ * looking, long enough that a forgotten open tab is not a load generator. The
+ * caller is expected to poll only while the document is visible.
+ */
+export const SESSION_WATCH_INTERVAL_MS = 5_000;
+/** SvelteKit invalidation key a session-detail surface depends on. */
+export const SESSION_DETAIL_DEPENDENCY = 'code-session:detail';
+/**
+ * Where a published branch becomes a pull request link.
+ *
+ * Deliberately a LINK into Forge rather than a second PR-creation path. Forge's
+ * `pulls/new` resolves the merge base and head SHA; plan title/body ride as
+ * query prefills so the form opens with session truth, not only base/head.
+ *
+ * Prefer {@link sessionPullRequestPresentation} at call sites that have a
+ * session — it routes through the single planner first. This helper remains
+ * for pure URL construction from already-planned fields.
+ *
+ * Returns `null` rather than a half-built URL when the repository ref or branch
+ * is missing. A dead "Open pull request" button is worse than no button: it
+ * claims a next step exists when nothing can happen.
+ */
+export function forgePullRequestUrl(input) {
+    const origin = input.forgeOrigin?.trim().replace(/\/+$/, '');
+    const repository = input.repository?.trim();
+    const branch = input.branch?.trim();
+    if (!origin || !repository || !branch)
+        return null;
+    const [owner, ...rest] = repository.split('/');
+    const name = rest.join('/');
+    if (!owner || !name)
+        return null;
+    const url = new URL(`${origin}/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/pulls/new`);
+    url.searchParams.set('head', branch);
+    const base = input.base?.trim();
+    if (base)
+        url.searchParams.set('base', base);
+    const title = input.title?.trim();
+    if (title)
+        url.searchParams.set('title', title);
+    const body = input.body?.trim();
+    if (body)
+        url.searchParams.set('body', body);
+    return url.toString();
+}
+/**
+ * Single entry for "after publish, what PR do we show?".
+ *
+ * Routes through {@link pullRequestPlanAfterPublish} so HQ, CLI, and any future
+ * automation share one answer for readiness, title, body, head, and repo.
+ * Never pass `session.checkoutRef` as the merge *base* — that field is the
+ * session's work branch (head), and using it as base made base===head.
+ */
+export function sessionPullRequestPresentation(input) {
+    const plan = pullRequestPlanAfterPublish(input.session, input.published ?? {});
+    return pullRequestPresentationFromPlan({
+        plan,
+        forgeOrigin: input.forgeOrigin,
+        base: input.base
+    });
+}
+/**
+ * Render the exact authority result returned by publish.
+ *
+ * Consumers must not feed the response back through the planner: doing so
+ * silently turns an absent published branch into the session's stale
+ * create-time checkout ref. This helper is deliberately presentation-only.
+ */
+export function pullRequestPresentationFromPlan(input) {
+    const { plan } = input;
+    if (!plan.ready) {
+        return { ready: false, reason: plan.reason };
+    }
+    const base = input.base?.trim() || undefined;
+    const url = forgePullRequestUrl({
+        forgeOrigin: input.forgeOrigin,
+        repository: plan.repo,
+        branch: plan.sourceRef,
+        base,
+        title: plan.title,
+        body: plan.description
+    });
+    const presentation = {
+        ready: true,
+        plan,
+        repo: plan.repo,
+        head: plan.sourceRef,
+        title: plan.title,
+        body: plan.description,
+        url
+    };
+    if (base)
+        presentation.base = base;
+    return presentation;
+}

package/dist/svelte/loaders.d.ts

@@ -0,0 +1,74 @@
+/**
+ * SvelteKit `load` helpers for `@vibesdotdev/code-sessions/svelte`.
+ *
+ * Exported under the `./loaders` subpath so server routes can assemble
+ * code-session data without importing the Svelte component barrel.
+ *
+ * Code-session persistence is owned by platform-web. This loader resolves the
+ * canonical `CodeSessionsClient` (`runtime/client` id `code-sessions`) and
+ * forks it with request-scoped Bearer/fetch overrides for SSR.
+ */
+import type { ServerLoadEvent } from '@sveltejs/kit';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { CodeSessionCreateInput, CodeSessionListOptions, CodeSessionsClientOptions, RunCommandRequest, RunCommandResponse, SessionWithCapability } from '@vibesdotdev/code-sessions/api';
+/** SvelteKit event; `locals.runtime` is the request's handed runtime (D1). */
+export type CodeSessionsLoaderEvent = Pick<ServerLoadEvent, 'request' | 'fetch'> & {
+    locals: {
+        runtime: VibesRuntime;
+        sessionToken?: string;
+    };
+};
+export interface CodeSessionsLoaderClient {
+    ensureLoaded(): Promise<void>;
+    forRequest(overrides: Partial<CodeSessionsClientOptions>): CodeSessionsLoaderClient;
+    list(options?: CodeSessionListOptions): Promise<SessionWithCapability[]>;
+    get(sessionId: string): Promise<SessionWithCapability | null>;
+    create(input: CodeSessionCreateInput): Promise<SessionWithCapability>;
+    run(input: RunCommandRequest): Promise<RunCommandResponse>;
+    delete(sessionId: string): Promise<void>;
+}
+export interface CodeSessionsRequestClientOptions {
+    /** Test hook or already-resolved runtime client. Defaults to `getVibesClient('code-sessions', event.locals.runtime)`. */
+    client?: CodeSessionsLoaderClient;
+    /** Platform origin for SSR/cross-app calls, e.g. `PUBLIC_VIBES_PLATFORM_ORIGIN`. */
+    platformOrigin?: string;
+    /** Extra headers to send to platform-web. Bearer from `locals.sessionToken` is merged when absent. */
+    headers?: HeadersInit;
+}
+export interface LoadCodeSessionsLayoutOptions extends CodeSessionsRequestClientOptions {
+    listOptions?: CodeSessionListOptions;
+    /** Re-throw errors instead of degrading to an empty list. */
+    throwOnError?: boolean;
+}
+export interface CodeSessionsLayoutData {
+    sessions: SessionWithCapability[];
+    sessionsError: string | null;
+}
+export interface LoadCodeSessionDetailOptions extends CodeSessionsRequestClientOptions {
+    sessionId: string;
+    /** Re-throw errors instead of degrading to a null session. */
+    throwOnError?: boolean;
+}
+export interface CodeSessionDetailData {
+    session: SessionWithCapability | null;
+    sessionError: string | null;
+}
+/**
+ * Resolve a request-scoped code-sessions client for SvelteKit server loaders
+ * and actions. The base runtime client remains a singleton; `forRequest(...)`
+ * carries the incoming Bearer/fetch/origin for this SSR request only.
+ */
+export declare function resolveCodeSessionsRequestClient(event: CodeSessionsLoaderEvent, options?: CodeSessionsRequestClientOptions): Promise<CodeSessionsLoaderClient>;
+/**
+ * Compose the code-sessions list payload for a SvelteKit `+page.server.ts` or
+ * `+layout.server.ts`. Consuming apps may spread the returned fields into their
+ * own route data and keep app-specific actions/copy local.
+ */
+export declare function loadCodeSessionsLayoutData(event: CodeSessionsLoaderEvent, options?: LoadCodeSessionsLayoutOptions): Promise<CodeSessionsLayoutData>;
+/**
+ * Compose the single-session payload for detail pages. A missing or unauthorized
+ * session is represented as `session: null`; callers decide whether to redirect,
+ * render a not-found state, or preserve app-specific recovery UI.
+ */
+export declare function loadCodeSessionDetailData(event: CodeSessionsLoaderEvent, options: LoadCodeSessionDetailOptions): Promise<CodeSessionDetailData>;
+//# sourceMappingURL=loaders.d.ts.map

package/dist/svelte/loaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loaders.d.ts","sourceRoot":"","sources":["../../src/svelte/loaders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGzE,OAAO,KAAK,EACX,sBAAsB,EACtB,sBAAsB,EAEtB,yBAAyB,EACzB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,gCAAgC,CAAC;AAExC,8EAA8E;AAC9E,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG;IAClF,MAAM,EAAE;QAAE,OAAO,EAAE,YAAY,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACxC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,yBAAyB,CAAC,GAAG,wBAAwB,CAAC;IACpF,IAAI,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtE,GAAG,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC3D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gCAAgC;IAChD,yHAAyH;IACzH,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sGAAsG;IACtG,OAAO,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,6BAA8B,SAAQ,gCAAgC;IACtF,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,4BAA6B,SAAQ,gCAAgC;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA8DD;;;;GAIG;AACH,wBAAsB,gCAAgC,CACrD,KAAK,EAAE,uBAAuB,EAC9B,OAAO,GAAE,gCAAqC,GAC5C,OAAO,CAAC,wBAAwB,CAAC,CAsBnC;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC/C,KAAK,EAAE,uBAAuB,EAC9B,OAAO,GAAE,6BAAkC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAOjC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,4BAA4B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAWhC"}

package/dist/svelte/loaders.js

@@ -0,0 +1,124 @@
+/**
+ * SvelteKit `load` helpers for `@vibesdotdev/code-sessions/svelte`.
+ *
+ * Exported under the `./loaders` subpath so server routes can assemble
+ * code-session data without importing the Svelte component barrel.
+ *
+ * Code-session persistence is owned by platform-web. This loader resolves the
+ * canonical `CodeSessionsClient` (`runtime/client` id `code-sessions`) and
+ * forks it with request-scoped Bearer/fetch overrides for SSR.
+ */
+import { getLogger } from '@vibesdotdev/logging';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { attempt } from "./outcome.js";
+/** One plain record of the caller's headers, names as given (a `Headers` instance reads lower-cased). */
+function headersInitToRecord(headers) {
+    if (headers instanceof Headers)
+        return Object.fromEntries(headers);
+    if (Array.isArray(headers))
+        return Object.fromEntries(headers.map(([name, value]) => [name, value]));
+    return Object.fromEntries(Object.entries(headers ?? {}));
+}
+function hasHeader(record, name) {
+    const lower = name.toLowerCase();
+    return Object.keys(record).some((key) => key.toLowerCase() === lower);
+}
+/**
+ * Copy a person may see for a failed load. Route data is serialized to the
+ * browser, so the thrown error's own text (a credential resolution, a platform
+ * body, a transport message) never goes there: the failure is read as its typed
+ * `CapabilityError` code and the full cause goes to the request runtime's log.
+ */
+/**
+ * A failed load: rethrown for a strict route, otherwise reported once through
+ * the request runtime's logger and turned into safe copy for the route data.
+ */
+function reportLoadFailure(event, options, loaded, message) {
+    if (options.throwOnError)
+        throw loaded.failure;
+    const error = CapabilityError.from(loaded.failure);
+    const logger = getLogger('code-sessions:svelte-loaders', event.locals.runtime);
+    logger.warn(message, { error });
+    return loadFailureCopy(error);
+}
+function loadFailureCopy(err) {
+    switch (err.code) {
+        case 'AUTH_REQUIRED':
+            return 'Sign in to see your code sessions.';
+        case 'PERMISSION_DENIED':
+            return "You don't have access to these code sessions.";
+        case 'NOT_FOUND':
+            return "That code session wasn't found.";
+        case 'UNAVAILABLE':
+        case 'TIMEOUT':
+        case 'RATE_LIMITED':
+            return 'Code sessions are unavailable right now. Try again in a moment.';
+        default:
+            return 'Code sessions could not be loaded.';
+    }
+}
+async function getBaseClient(event, client) {
+    if (client)
+        return client;
+    return getVibesClient('code-sessions', event.locals.runtime);
+}
+/**
+ * Resolve a request-scoped code-sessions client for SvelteKit server loaders
+ * and actions. The base runtime client remains a singleton; `forRequest(...)`
+ * carries the incoming Bearer/fetch/origin for this SSR request only.
+ */
+export async function resolveCodeSessionsRequestClient(event, options = {}) {
+    const base = await getBaseClient(event, options.client);
+    await base.ensureLoaded();
+    const headers = headersInitToRecord(options.headers);
+    const token = event.locals.sessionToken;
+    const hasExplicitAuthorization = hasHeader(headers, 'authorization');
+    if (token && !hasExplicitAuthorization) {
+        headers.Authorization = `Bearer ${token}`;
+    }
+    const overrides = { fetch: event.fetch };
+    if (options.platformOrigin)
+        overrides.origin = options.platformOrigin;
+    if (token && !hasExplicitAuthorization)
+        overrides.token = token;
+    if (Object.keys(headers).length > 0)
+        overrides.headers = headers;
+    const requestClient = base.forRequest(overrides);
+    if (requestClient !== base) {
+        await requestClient.ensureLoaded();
+    }
+    return requestClient;
+}
+/**
+ * Compose the code-sessions list payload for a SvelteKit `+page.server.ts` or
+ * `+layout.server.ts`. Consuming apps may spread the returned fields into their
+ * own route data and keep app-specific actions/copy local.
+ */
+export async function loadCodeSessionsLayoutData(event, options = {}) {
+    const loaded = await attempt(async () => {
+        const client = await resolveCodeSessionsRequestClient(event, options);
+        return client.list(options.listOptions);
+    });
+    if (loaded.ok)
+        return { sessions: loaded.value, sessionsError: null };
+    return { sessions: [], sessionsError: reportLoadFailure(event, options, loaded, 'code-session list load failed') };
+}
+/**
+ * Compose the single-session payload for detail pages. A missing or unauthorized
+ * session is represented as `session: null`; callers decide whether to redirect,
+ * render a not-found state, or preserve app-specific recovery UI.
+ */
+export async function loadCodeSessionDetailData(event, options) {
+    const sessionId = options.sessionId.trim();
+    if (!sessionId) {
+        return { session: null, sessionError: 'sessionId is required' };
+    }
+    const loaded = await attempt(async () => {
+        const client = await resolveCodeSessionsRequestClient(event, options);
+        return client.get(sessionId);
+    });
+    if (loaded.ok)
+        return { session: loaded.value, sessionError: null };
+    return { session: null, sessionError: reportLoadFailure(event, options, loaded, 'code-session detail load failed') };
+}

package/dist/svelte/outcome.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The package's two failure-carrying primitives: {@link readUntrusted}, the one
+ * guard untrusted values are read through, and {@link attempt}, the outcome
+ * helper that captures a failure once as a value for the caller to handle.
+ *
+ * It lives beside the Svelte helpers because `svelte-package` compiles only
+ * `src/svelte`; the core modules import it from here so there is one copy.
+ *
+ * The one guard this package reads untrusted values through.
+ *
+ * `safeParse` reports a bad shape as a result, but a value whose own getter
+ * throws, or a Proxy that traps or is revoked, throws out of the parse itself.
+ * {@link readUntrusted} settles all three into one result: the parsed copy, the
+ * shape refusal, or the read that threw (carried as `cause`). Callers use the
+ * parsed copy and never read the original again.
+ *
+ * Package-internal: not part of any export map.
+ */
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+import type * as z from 'zod/v4';
+export type UntrustedRead<Output> = {
+    readonly outcome: 'parsed';
+    readonly data: Output;
+} | {
+    readonly outcome: 'invalid';
+    readonly error: z.ZodError;
+} | {
+    readonly outcome: 'threw';
+    readonly cause: CaughtFailure;
+};
+/** Anything a caller, a host or the network can hand over: what the guard reads exactly once. */
+export type UntrustedValue = {} | null | undefined;
+export declare function readUntrusted<Schema extends z.ZodType>(schema: Schema, value: UntrustedValue): UntrustedRead<z.output<Schema>>;
+/** A step's outcome: its value, or its failure captured once as a value. */
+export type Attempt<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly failure: CaughtFailure;
+};
+/** Run `work` and capture its value or its failure; the caller handles the failure (report, degrade or rethrow). */
+export declare function attempt<T>(work: () => T | PromiseLike<T>): Promise<Attempt<T>>;
+/** Run synchronous `work` and capture its value or its failure. */
+export declare function attemptSync<T>(work: () => T): Attempt<T>;
+//# sourceMappingURL=outcome.d.ts.map

package/dist/svelte/outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.d.ts","sourceRoot":"","sources":["../../src/svelte/outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,CAAC;AAEjC,MAAM,MAAM,aAAa,CAAC,MAAM,IAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAEhE,iGAAiG;AACjG,MAAM,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;AAEnD,wBAAgB,aAAa,CAAC,MAAM,SAAS,CAAC,CAAC,OAAO,EACrD,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,cAAc,GACnB,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAUjC;AAED,4EAA4E;AAC5E,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5H,oHAAoH;AACpH,wBAAsB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAMpF;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAMxD"}

package/dist/svelte/outcome.js

@@ -0,0 +1,49 @@
+/**
+ * The package's two failure-carrying primitives: {@link readUntrusted}, the one
+ * guard untrusted values are read through, and {@link attempt}, the outcome
+ * helper that captures a failure once as a value for the caller to handle.
+ *
+ * It lives beside the Svelte helpers because `svelte-package` compiles only
+ * `src/svelte`; the core modules import it from here so there is one copy.
+ *
+ * The one guard this package reads untrusted values through.
+ *
+ * `safeParse` reports a bad shape as a result, but a value whose own getter
+ * throws, or a Proxy that traps or is revoked, throws out of the parse itself.
+ * {@link readUntrusted} settles all three into one result: the parsed copy, the
+ * shape refusal, or the read that threw (carried as `cause`). Callers use the
+ * parsed copy and never read the original again.
+ *
+ * Package-internal: not part of any export map.
+ */
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+export function readUntrusted(schema, value) {
+    let result;
+    try {
+        result = schema.safeParse(value);
+    }
+    catch (thrown) {
+        return { outcome: 'threw', cause: CaughtFailureSchema.parse(thrown) };
+    }
+    return result.success
+        ? { outcome: 'parsed', data: result.data }
+        : { outcome: 'invalid', error: result.error };
+}
+/** Run `work` and capture its value or its failure; the caller handles the failure (report, degrade or rethrow). */
+export async function attempt(work) {
+    try {
+        return { ok: true, value: await work() };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}
+/** Run synchronous `work` and capture its value or its failure. */
+export function attemptSync(work) {
+    try {
+        return { ok: true, value: work() };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}

package/dist/svelte/relative-time.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Compact relative-age formatting for code-session surfaces.
+ *
+ * Pure on purpose: `nowMs` is a parameter, never `Date.now()` read inside. The
+ * previous inline `formatAge` read the clock during render, so the label froze
+ * at first paint — a list tab left open reported "just now" for hours. Taking
+ * the clock as an argument makes the function testable AND lets the caller
+ * drive it from a ticking source (`sharedNow()`).
+ *
+ * `@vibesdotdev/kit`'s `formatRelativeTime` is deliberately NOT reused here: it
+ * renders the verbose form ("2 minutes ago") where these dense session rows
+ * need the compact form ("2m"), and it reads the clock internally, so it
+ * carries the same freeze.
+ */
+/**
+ * Compact age label, e.g. `just now`, `12m ago`, `3h ago`, `5d ago`.
+ *
+ * An unparseable or future timestamp degrades to `just now` rather than
+ * rendering `NaNm ago` — a wrong-but-plausible label beats visible breakage in
+ * a metadata line, and the adjacent `<time datetime>` still carries the truth.
+ */
+export declare function formatRelativeAge(iso: string, nowMs?: number): string;
+/**
+ * Absolute, locale-formatted timestamp for the `title` attribute that sits
+ * beside every relative label. The relative form is the scannable one; this is
+ * the one a user checks when the relative form is not precise enough.
+ *
+ * Returns `null` for an unparseable timestamp so callers can omit the attribute
+ * entirely instead of rendering the string "Invalid Date" as a tooltip.
+ */
+export declare function formatAbsoluteTime(iso: string): string | null;
+//# sourceMappingURL=relative-time.d.ts.map

package/dist/svelte/relative-time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relative-time.d.ts","sourceRoot":"","sources":["../../src/svelte/relative-time.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,MAAmB,GAAG,MAAM,CASjF;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7D"}