@viceme-ai/sdk 0.1.2

package/dist/generated/public-contract.d.ts

@@ -0,0 +1,156 @@
+/**
+ * GENERATED FILE — DO NOT EDIT.
+ *
+ * Generated from contracts/public-capabilities.openapi.json
+ * (contractVersion 0.1.0, sha256 a9c5d56d90eb2654…)
+ * by scripts/generate-contracts.mjs. Regenerate with `pnpm contracts:generate`.
+ */
+/**
+ * This file was auto-generated by openapi-typescript.
+ * Do not make direct changes to the file.
+ */
+export interface paths {
+    "/public/v1/work-sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Establish a public visitor session for a Work
+         * @description Binds a short-lived capability token to the Work, the caller Origin, the enabled capability set, and an expiry. The workKey locates the Work; it is never an authorization credential. CORS: exact registered origins only, credentials disabled.
+         */
+        post: operations["createWorkSession"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+}
+export type webhooks = Record<string, never>;
+export interface components {
+    schemas: {
+        /** @description Public opaque work key. */
+        WorkKey: string;
+        /** @description Enabled capability name for the work. */
+        CapabilityName: string;
+        CreateWorkSessionRequest: {
+            workKey: components["schemas"]["WorkKey"];
+        };
+        WorkDescriptor: {
+            key: components["schemas"]["WorkKey"];
+            capabilities: components["schemas"]["CapabilityName"][];
+        } & {
+            [key: string]: unknown;
+        };
+        /** @description Unknown additional fields are allowed and ignored by the SDK (forward compatibility). */
+        WorkSession: {
+            work: components["schemas"]["WorkDescriptor"];
+            /** @description Short-lived capability token; memory-only in the SDK. */
+            token?: string;
+            /** @description Epoch milliseconds when the token expires. */
+            expiresAt?: number;
+        } & {
+            [key: string]: unknown;
+        };
+        ErrorBody: {
+            error: {
+                /** @enum {string} */
+                code: "CONFIG_INVALID" | "WORK_NOT_FOUND" | "ORIGIN_NOT_ALLOWED" | "CAPABILITY_DISABLED" | "SESSION_EXPIRED" | "RATE_LIMITED" | "NETWORK_TIMEOUT" | "CHECKOUT_UNAVAILABLE" | "INTERNAL_ERROR";
+                message?: string;
+                retryable?: boolean;
+                requestId?: string;
+            };
+        };
+    };
+    responses: {
+        /** @description Invalid configuration. */
+        ValidationError: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorBody"];
+            };
+        };
+        /** @description Origin not registered for this work (fail closed). */
+        OriginNotAllowed: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorBody"];
+            };
+        };
+        /** @description Unknown, private, or disabled work. */
+        WorkNotFound: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorBody"];
+            };
+        };
+        /** @description Rate limit exceeded (retryable). */
+        RateLimited: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorBody"];
+            };
+        };
+        /** @description Server error (retryable). */
+        InternalError: {
+            headers: {
+                [name: string]: unknown;
+            };
+            content: {
+                "application/json": components["schemas"]["ErrorBody"];
+            };
+        };
+    };
+    parameters: never;
+    requestBodies: never;
+    headers: never;
+    pathItems: never;
+}
+export type $defs = Record<string, never>;
+export interface operations {
+    createWorkSession: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["CreateWorkSessionRequest"];
+            };
+        };
+        responses: {
+            /** @description Session established. */
+            201: {
+                headers: {
+                    /** @description Server request id for support correlation. */
+                    "x-request-id"?: string;
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["WorkSession"];
+                };
+            };
+            400: components["responses"]["ValidationError"];
+            403: components["responses"]["OriginNotAllowed"];
+            404: components["responses"]["WorkNotFound"];
+            429: components["responses"]["RateLimited"];
+            "5xx": components["responses"]["InternalError"];
+        };
+    };
+}
+//# sourceMappingURL=public-contract.d.ts.map

package/dist/generated/public-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-contract.d.ts","sourceRoot":"","sources":["../../src/generated/public-contract.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAEH;;;GAGG;AAEH,MAAM,WAAW,KAAK;IAClB,0BAA0B,EAAE;QACxB,UAAU,EAAE;YACR,KAAK,CAAC,EAAE,KAAK,CAAC;YACd,MAAM,CAAC,EAAE,KAAK,CAAC;YACf,IAAI,CAAC,EAAE,KAAK,CAAC;YACb,MAAM,CAAC,EAAE,KAAK,CAAC;SAClB,CAAC;QACF,GAAG,CAAC,EAAE,KAAK,CAAC;QACZ,GAAG,CAAC,EAAE,KAAK,CAAC;QACZ;;;WAGG;QACH,IAAI,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,KAAK,CAAC;QACf,OAAO,CAAC,EAAE,KAAK,CAAC;QAChB,IAAI,CAAC,EAAE,KAAK,CAAC;QACb,KAAK,CAAC,EAAE,KAAK,CAAC;QACd,KAAK,CAAC,EAAE,KAAK,CAAC;KACjB,CAAC;CACL;AACD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC7C,MAAM,WAAW,UAAU;IACvB,OAAO,EAAE;QACL,2CAA2C;QAC3C,OAAO,EAAE,MAAM,CAAC;QAChB,yDAAyD;QACzD,cAAc,EAAE,MAAM,CAAC;QACvB,wBAAwB,EAAE;YACtB,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC;SAC7C,CAAC;QACF,cAAc,EAAE;YACZ,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC;YACtC,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC;SAC3D,GAAG;YACA,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;SAC1B,CAAC;QACF,yGAAyG;QACzG,WAAW,EAAE;YACT,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,gBAAgB,CAAC,CAAC;YAC9C,yEAAyE;YACzE,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,8DAA8D;YAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;SACtB,GAAG;YACA,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;SAC1B,CAAC;QACF,SAAS,EAAE;YACP,KAAK,EAAE;gBACH,qBAAqB;gBACrB,IAAI,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,qBAAqB,GAAG,iBAAiB,GAAG,cAAc,GAAG,iBAAiB,GAAG,sBAAsB,GAAG,gBAAgB,CAAC;gBAC9L,OAAO,CAAC,EAAE,MAAM,CAAC;gBACjB,SAAS,CAAC,EAAE,OAAO,CAAC;gBACpB,SAAS,CAAC,EAAE,MAAM,CAAC;aACtB,CAAC;SACL,CAAC;KACL,CAAC;IACF,SAAS,EAAE;QACP,0CAA0C;QAC1C,eAAe,EAAE;YACb,OAAO,EAAE;gBACL,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;aAC3B,CAAC;YACF,OAAO,EAAE;gBACL,kBAAkB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC;aAC1D,CAAC;SACL,CAAC;QACF,sEAAsE;QACtE,gBAAgB,EAAE;YACd,OAAO,EAAE;gBACL,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;aAC3B,CAAC;YACF,OAAO,EAAE;gBACL,kBAAkB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC;aAC1D,CAAC;SACL,CAAC;QACF,uDAAuD;QACvD,YAAY,EAAE;YACV,OAAO,EAAE;gBACL,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;aAC3B,CAAC;YACF,OAAO,EAAE;gBACL,kBAAkB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC;aAC1D,CAAC;SACL,CAAC;QACF,oDAAoD;QACpD,WAAW,EAAE;YACT,OAAO,EAAE;gBACL,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;aAC3B,CAAC;YACF,OAAO,EAAE;gBACL,kBAAkB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC;aAC1D,CAAC;SACL,CAAC;QACF,6CAA6C;QAC7C,aAAa,EAAE;YACX,OAAO,EAAE;gBACL,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;aAC3B,CAAC;YACF,OAAO,EAAE;gBACL,kBAAkB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,CAAC;aAC1D,CAAC;SACL,CAAC;KACL,CAAC;IACF,UAAU,EAAE,KAAK,CAAC;IAClB,aAAa,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;IACf,SAAS,EAAE,KAAK,CAAC;CACpB;AACD,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC1C,MAAM,WAAW,UAAU;IACvB,iBAAiB,EAAE;QACf,UAAU,EAAE;YACR,KAAK,CAAC,EAAE,KAAK,CAAC;YACd,MAAM,CAAC,EAAE,KAAK,CAAC;YACf,IAAI,CAAC,EAAE,KAAK,CAAC;YACb,MAAM,CAAC,EAAE,KAAK,CAAC;SAClB,CAAC;QACF,WAAW,EAAE;YACT,OAAO,EAAE;gBACL,kBAAkB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,0BAA0B,CAAC,CAAC;aACzE,CAAC;SACL,CAAC;QACF,SAAS,EAAE;YACP,wCAAwC;YACxC,GAAG,EAAE;gBACD,OAAO,EAAE;oBACL,8DAA8D;oBAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;oBACxB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;iBAC3B,CAAC;gBACF,OAAO,EAAE;oBACL,kBAAkB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,CAAC;iBAC5D,CAAC;aACL,CAAC;YACF,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAChD,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,kBAAkB,CAAC,CAAC;YACjD,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,cAAc,CAAC,CAAC;YAC7C,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,aAAa,CAAC,CAAC;YAC5C,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,eAAe,CAAC,CAAC;SACnD,CAAC;KACL,CAAC;CACL"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `@viceme-ai/sdk` public entry.
+ *
+ * Production consumers get exactly `createViceMe` plus types. Test injection
+ * lives under `@viceme-ai/sdk/testing`. Capability subpaths (danmaku, payment)
+ * are added only when the capability is real.
+ */
+import { resolveApiBaseUrl } from './core/config.ts';
+import { ViceMeError, isViceMeError, type ViceMeErrorCode } from './core/errors.ts';
+import type { ViceMeClient, ViceMeMountedInstance } from './core/client.ts';
+import type { ViceMeRegion, ViceMeConfig } from './core/config.ts';
+import type { ViceMeClientState } from './core/lifecycle.ts';
+import { SDK_VERSION, API_MAJOR } from './version.ts';
+export { ViceMeError, isViceMeError, SDK_VERSION, API_MAJOR, resolveApiBaseUrl };
+export type { ViceMeClient, ViceMeMountedInstance, ViceMeConfig, ViceMeRegion, ViceMeClientState, ViceMeErrorCode, };
+/**
+ * Create a headless ViceMe client for one Work.
+ *
+ * @example
+ * ```ts
+ * const client = createViceMe({ workKey: 'wrk_public_xxx', region: 'cn' });
+ * await client.ready();
+ * client.destroy();
+ * ```
+ */
+export declare function createViceMe(config: unknown): ViceMeClient;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,iBAAiB,EAAwB,MAAM,kBAAkB,CAAC;AAE3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;AACjF,YAAY,EACV,YAAY,EACZ,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,eAAe,GAChB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,CAM1D"}

package/dist/index.js

@@ -0,0 +1,126 @@
+import { V as i, v as b, a as O, r as p } from "./chunks/client-CGU3qeew.js";
+import { A as w, S as L, i as S } from "./chunks/client-CGU3qeew.js";
+const A = 1e4, h = /* @__PURE__ */ new Map([
+  [400, "CONFIG_INVALID"],
+  [401, "SESSION_EXPIRED"],
+  [403, "ORIGIN_NOT_ALLOWED"],
+  [404, "WORK_NOT_FOUND"],
+  [409, "CONFIG_INVALID"],
+  [422, "CONFIG_INVALID"],
+  [429, "RATE_LIMITED"]
+]), m = /* @__PURE__ */ new Set([
+  "CONFIG_INVALID",
+  "WORK_NOT_FOUND",
+  "ORIGIN_NOT_ALLOWED",
+  "CAPABILITY_DISABLED",
+  "SESSION_EXPIRED",
+  "RATE_LIMITED",
+  "NETWORK_TIMEOUT",
+  "CHECKOUT_UNAVAILABLE",
+  "INTERNAL_ERROR"
+]);
+function T(o) {
+  if (typeof o != "object" || o === null) return {};
+  const e = o.error;
+  if (typeof e != "object" || e === null) return {};
+  const t = e, s = {};
+  return typeof t.code == "string" && m.has(t.code) && (s.code = t.code), typeof t.message == "string" && (s.message = t.message.slice(0, 200)), typeof t.retryable == "boolean" && (s.retryable = t.retryable), typeof t.requestId == "string" && (s.requestId = t.requestId), s;
+}
+function N() {
+  return typeof crypto < "u" && typeof crypto.randomUUID == "function" ? crypto.randomUUID() : `req-${Math.random().toString(36).slice(2)}`;
+}
+class _ {
+  #e;
+  #t;
+  #r;
+  #o;
+  constructor(e) {
+    this.#e = e.apiBaseUrl.replace(/\/+$/, ""), this.#t = e.fetchImpl ?? globalThis.fetch.bind(globalThis), this.#r = e.defaultTimeoutMs ?? A, this.#o = e.generateRequestId ?? N;
+  }
+  async request(e) {
+    if (e.signal?.aborted)
+      throw this.#s(e.signal);
+    const t = e.timeoutMs ?? this.#r, s = new AbortController();
+    let c = !1;
+    const f = setTimeout(() => {
+      c = !0, s.abort(new I());
+    }, t), d = () => s.abort(new I(!1));
+    e.signal?.addEventListener("abort", d, { once: !0 });
+    const l = this.#o();
+    try {
+      const r = await this.#t(`${this.#e}${e.path}`, {
+        method: e.method,
+        // Public API is CORS-only; credentials must stay off so Shop session
+        // cookies can never attach to public SDK requests.
+        credentials: "omit",
+        mode: "cors",
+        headers: {
+          "content-type": "application/json",
+          "x-client-request-id": l
+        },
+        body: e.body !== void 0 ? JSON.stringify(e.body) : void 0,
+        signal: s.signal
+      });
+      let a;
+      try {
+        a = await r.json();
+      } catch (n) {
+        if (e.signal?.aborted || c)
+          throw n;
+        a = void 0;
+      }
+      const u = r.headers.get("x-request-id") ?? void 0;
+      if (!r.ok) {
+        const n = T(a), E = n.code ?? h.get(r.status) ?? "INTERNAL_ERROR";
+        throw new i({
+          code: E,
+          message: n.message ?? "Public API request failed.",
+          retryable: n.retryable,
+          requestId: n.requestId ?? u
+        });
+      }
+      return { status: r.status, body: a, requestId: u };
+    } catch (r) {
+      throw e.signal?.aborted ? this.#s(e.signal) : c ? new i({
+        code: "NETWORK_TIMEOUT",
+        message: "Public API request timed out.",
+        retryable: !0,
+        requestId: l
+      }) : r instanceof i ? r : r instanceof DOMException && r.name === "AbortError" ? new DOMException("ViceMe request aborted by caller.", "AbortError") : new i({
+        code: "INTERNAL_ERROR",
+        message: "Public API request failed.",
+        retryable: !0,
+        requestId: l
+      });
+    } finally {
+      clearTimeout(f), e.signal?.removeEventListener("abort", d);
+    }
+  }
+  /** Caller-abort error that preserves the caller's own abort reason. */
+  #s(e) {
+    return e.reason instanceof Error ? e.reason : new DOMException("ViceMe request aborted by caller.", "AbortError");
+  }
+}
+function g(o) {
+  return new _(o);
+}
+class I extends DOMException {
+  constructor(e = !0) {
+    super(e ? "ViceMe request timed out." : "ViceMe request aborted.", "AbortError");
+  }
+}
+function R(o) {
+  const e = b(o), t = g({
+    apiBaseUrl: p(e.region)
+  });
+  return new O({ config: e, transport: t });
+}
+export {
+  w as API_MAJOR,
+  L as SDK_VERSION,
+  i as ViceMeError,
+  R as createViceMe,
+  S as isViceMeError,
+  p as resolveApiBaseUrl
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../src/transport/transport.ts","../src/index.ts"],"sourcesContent":["/**\n * HTTP transport for the public API.\n *\n * Responsibilities: request execution with timeout, abort, client request ids,\n * and normalization of every failure into the public `ViceMeError` model.\n * Capabilities and the loader never build their own `fetch` calls — they go\n * through a Transport so tests can swap in `createMemoryTransport`.\n */\n\nimport { ViceMeError, type ViceMeErrorCode } from '../core/errors.ts';\n\nexport interface TransportRequest {\n  method: 'GET' | 'POST';\n  /** Absolute path under the public API base, e.g. `/public/v1/work-sessions`. */\n  path: string;\n  /** JSON-serializable request body. */\n  body?: unknown;\n  signal?: AbortSignal;\n  /** Per-request timeout; defaults to the transport default. */\n  timeoutMs?: number;\n}\n\nexport interface TransportResponse {\n  status: number;\n  body?: unknown;\n  /** Echoed server request id, when provided. */\n  requestId?: string;\n}\n\nexport interface Transport {\n  request(request: TransportRequest): Promise<TransportResponse>;\n}\n\nexport interface FetchTransportOptions {\n  apiBaseUrl: string;\n  /** Injectable for tests; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch;\n  defaultTimeoutMs?: number;\n  /** Injectable id generator (default: `crypto.randomUUID`). */\n  generateRequestId?: () => string;\n}\n\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\nconst STATUS_CODE_MAP: ReadonlyMap<number, ViceMeErrorCode> = new Map([\n  [400, 'CONFIG_INVALID'],\n  [401, 'SESSION_EXPIRED'],\n  [403, 'ORIGIN_NOT_ALLOWED'],\n  [404, 'WORK_NOT_FOUND'],\n  [409, 'CONFIG_INVALID'],\n  [422, 'CONFIG_INVALID'],\n  [429, 'RATE_LIMITED'],\n]);\n\nconst KNOWN_CODES: ReadonlySet<string> = new Set([\n  'CONFIG_INVALID',\n  'WORK_NOT_FOUND',\n  'ORIGIN_NOT_ALLOWED',\n  'CAPABILITY_DISABLED',\n  'SESSION_EXPIRED',\n  'RATE_LIMITED',\n  'NETWORK_TIMEOUT',\n  'CHECKOUT_UNAVAILABLE',\n  'INTERNAL_ERROR',\n]);\n\n/** Extract a stable error payload from a JSON error body, if well-formed. */\nfunction parseErrorBody(body: unknown): {\n  code?: ViceMeErrorCode;\n  message?: string;\n  retryable?: boolean;\n  requestId?: string;\n} {\n  if (typeof body !== 'object' || body === null) return {};\n  const error = (body as { error?: unknown }).error;\n  if (typeof error !== 'object' || error === null) return {};\n  const candidate = error as Record<string, unknown>;\n  const result: {\n    code?: ViceMeErrorCode;\n    message?: string;\n    retryable?: boolean;\n    requestId?: string;\n  } = {};\n  if (typeof candidate.code === 'string' && KNOWN_CODES.has(candidate.code)) {\n    result.code = candidate.code as ViceMeErrorCode;\n  }\n  if (typeof candidate.message === 'string') {\n    result.message = candidate.message.slice(0, 200);\n  }\n  if (typeof candidate.retryable === 'boolean') {\n    result.retryable = candidate.retryable;\n  }\n  if (typeof candidate.requestId === 'string') {\n    result.requestId = candidate.requestId;\n  }\n  return result;\n}\n\nfunction defaultRequestId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {\n    return crypto.randomUUID();\n  }\n  return `req-${Math.random().toString(36).slice(2)}`;\n}\n\nexport class FetchTransport implements Transport {\n  readonly #apiBaseUrl: string;\n  readonly #fetchImpl: typeof fetch;\n  readonly #defaultTimeoutMs: number;\n  readonly #generateRequestId: () => string;\n\n  constructor(options: FetchTransportOptions) {\n    this.#apiBaseUrl = options.apiBaseUrl.replace(/\\/+$/, '');\n    this.#fetchImpl = options.fetchImpl ?? globalThis.fetch.bind(globalThis);\n    this.#defaultTimeoutMs = options.defaultTimeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#generateRequestId = options.generateRequestId ?? defaultRequestId;\n  }\n\n  async request(request: TransportRequest): Promise<TransportResponse> {\n    // A pre-aborted signal must never reach the network. Preserve the\n    // caller's abort reason when one was set.\n    if (request.signal?.aborted) {\n      throw this.#callerAbortError(request.signal);\n    }\n    const timeoutMs = request.timeoutMs ?? this.#defaultTimeoutMs;\n    const controller = new AbortController();\n    // Engine notes: Chrome/Firefox reject fetch with the abort reason and\n    // WebKit may reject with a plain error — so timeout/abort classification\n    // keys off our own timer/signal state, never off the exception shape.\n    let timedOut = false;\n    const timer = setTimeout(() => {\n      timedOut = true;\n      controller.abort(new TimeoutAbort());\n    }, timeoutMs);\n    const onOuterAbort = () => controller.abort(new TimeoutAbort(false));\n    request.signal?.addEventListener('abort', onOuterAbort, { once: true });\n\n    const requestId = this.#generateRequestId();\n    try {\n      const response = await this.#fetchImpl(`${this.#apiBaseUrl}${request.path}`, {\n        method: request.method,\n        // Public API is CORS-only; credentials must stay off so Shop session\n        // cookies can never attach to public SDK requests.\n        credentials: 'omit',\n        mode: 'cors',\n        headers: {\n          'content-type': 'application/json',\n          'x-client-request-id': requestId,\n        },\n        body: request.body !== undefined ? JSON.stringify(request.body) : undefined,\n        signal: controller.signal,\n      });\n\n      // Body reading stays inside the same timeout/abort lifecycle: a server\n      // that returns headers and then stalls the body still hits\n      // NETWORK_TIMEOUT, caller abort still cancels the read, and a late\n      // body can never outlive a destroyed client/session.\n      let body: unknown;\n      try {\n        body = await response.json();\n      } catch (error) {\n        // A malformed/empty body is tolerated; a cancelled read must\n        // propagate so the outer handler can classify it.\n        if (request.signal?.aborted || timedOut) {\n          throw error;\n        }\n        body = undefined;\n      }\n\n      const serverRequestId = response.headers.get('x-request-id') ?? undefined;\n      if (!response.ok) {\n        const parsed = parseErrorBody(body);\n        const code = parsed.code ?? STATUS_CODE_MAP.get(response.status) ?? 'INTERNAL_ERROR';\n        throw new ViceMeError({\n          code,\n          message: parsed.message ?? 'Public API request failed.',\n          retryable: parsed.retryable,\n          requestId: parsed.requestId ?? serverRequestId,\n        });\n      }\n      return { status: response.status, body, requestId: serverRequestId };\n    } catch (cause) {\n      if (request.signal?.aborted) {\n        throw this.#callerAbortError(request.signal);\n      }\n      if (timedOut) {\n        throw new ViceMeError({\n          code: 'NETWORK_TIMEOUT',\n          message: 'Public API request timed out.',\n          retryable: true,\n          requestId,\n        });\n      }\n      // Non-OK statuses already carry a normalized error — pass it through.\n      if (cause instanceof ViceMeError) {\n        throw cause;\n      }\n      if (cause instanceof DOMException && cause.name === 'AbortError') {\n        throw new DOMException('ViceMe request aborted by caller.', 'AbortError');\n      }\n      throw new ViceMeError({\n        code: 'INTERNAL_ERROR',\n        message: 'Public API request failed.',\n        retryable: true,\n        requestId,\n      });\n    } finally {\n      clearTimeout(timer);\n      request.signal?.removeEventListener('abort', onOuterAbort);\n    }\n  }\n\n  /** Caller-abort error that preserves the caller's own abort reason. */\n  #callerAbortError(signal: AbortSignal): unknown {\n    return signal.reason instanceof Error\n      ? signal.reason\n      : new DOMException('ViceMe request aborted by caller.', 'AbortError');\n  }\n}\n\nexport function createFetchTransport(options: FetchTransportOptions): Transport {\n  return new FetchTransport(options);\n}\n\n/** Internal marker distinguishing timeout aborts from caller aborts. */\nclass TimeoutAbort extends DOMException {\n  constructor(timedOut = true) {\n    super(timedOut ? 'ViceMe request timed out.' : 'ViceMe request aborted.', 'AbortError');\n  }\n}\n","/**\n * `@viceme-ai/sdk` public entry.\n *\n * Production consumers get exactly `createViceMe` plus types. Test injection\n * lives under `@viceme-ai/sdk/testing`. Capability subpaths (danmaku, payment)\n * are added only when the capability is real.\n */\n\nimport { createFetchTransport } from './transport/transport.ts';\nimport { resolveApiBaseUrl, validatePublicConfig } from './core/config.ts';\nimport { ViceMeClientImpl } from './core/client.ts';\nimport { ViceMeError, isViceMeError, type ViceMeErrorCode } from './core/errors.ts';\nimport type { ViceMeClient, ViceMeMountedInstance } from './core/client.ts';\nimport type { ViceMeRegion, ViceMeConfig } from './core/config.ts';\nimport type { ViceMeClientState } from './core/lifecycle.ts';\nimport { SDK_VERSION, API_MAJOR } from './version.ts';\n\nexport { ViceMeError, isViceMeError, SDK_VERSION, API_MAJOR, resolveApiBaseUrl };\nexport type {\n  ViceMeClient,\n  ViceMeMountedInstance,\n  ViceMeConfig,\n  ViceMeRegion,\n  ViceMeClientState,\n  ViceMeErrorCode,\n};\n\n/**\n * Create a headless ViceMe client for one Work.\n *\n * @example\n * ```ts\n * const client = createViceMe({ workKey: 'wrk_public_xxx', region: 'cn' });\n * await client.ready();\n * client.destroy();\n * ```\n */\nexport function createViceMe(config: unknown): ViceMeClient {\n  const validated = validatePublicConfig(config);\n  const transport = createFetchTransport({\n    apiBaseUrl: resolveApiBaseUrl(validated.region),\n  });\n  return new ViceMeClientImpl({ config: validated, transport });\n}\n"],"names":["DEFAULT_TIMEOUT_MS","STATUS_CODE_MAP","KNOWN_CODES","parseErrorBody","body","error","candidate","result","defaultRequestId","FetchTransport","#apiBaseUrl","#fetchImpl","#defaultTimeoutMs","#generateRequestId","options","request","#callerAbortError","timeoutMs","controller","timedOut","timer","TimeoutAbort","onOuterAbort","requestId","response","serverRequestId","parsed","code","ViceMeError","cause","signal","createFetchTransport","createViceMe","config","validated","validatePublicConfig","transport","resolveApiBaseUrl","ViceMeClientImpl"],"mappings":";;AA0CA,MAAMA,IAAqB,KAErBC,wBAA4D,IAAI;AAAA,EACpE,CAAC,KAAK,gBAAgB;AAAA,EACtB,CAAC,KAAK,iBAAiB;AAAA,EACvB,CAAC,KAAK,oBAAoB;AAAA,EAC1B,CAAC,KAAK,gBAAgB;AAAA,EACtB,CAAC,KAAK,gBAAgB;AAAA,EACtB,CAAC,KAAK,gBAAgB;AAAA,EACtB,CAAC,KAAK,cAAc;AACtB,CAAC,GAEKC,wBAAuC,IAAI;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,SAASC,EAAeC,GAKtB;AACA,MAAI,OAAOA,KAAS,YAAYA,MAAS,aAAa,CAAA;AACtD,QAAMC,IAASD,EAA6B;AAC5C,MAAI,OAAOC,KAAU,YAAYA,MAAU,aAAa,CAAA;AACxD,QAAMC,IAAYD,GACZE,IAKF,CAAA;AACJ,SAAI,OAAOD,EAAU,QAAS,YAAYJ,EAAY,IAAII,EAAU,IAAI,MACtEC,EAAO,OAAOD,EAAU,OAEtB,OAAOA,EAAU,WAAY,aAC/BC,EAAO,UAAUD,EAAU,QAAQ,MAAM,GAAG,GAAG,IAE7C,OAAOA,EAAU,aAAc,cACjCC,EAAO,YAAYD,EAAU,YAE3B,OAAOA,EAAU,aAAc,aACjCC,EAAO,YAAYD,EAAU,YAExBC;AACT;AAEA,SAASC,IAA2B;AAClC,SAAI,OAAO,SAAW,OAAe,OAAO,OAAO,cAAe,aACzD,OAAO,WAAA,IAET,OAAO,KAAK,OAAA,EAAS,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACnD;AAEO,MAAMC,EAAoC;AAAA,EACtCC;AAAA,EACAC;AAAA,EACAC;AAAA,EACAC;AAAA,EAET,YAAYC,GAAgC;AAC1C,SAAKJ,KAAcI,EAAQ,WAAW,QAAQ,QAAQ,EAAE,GACxD,KAAKH,KAAaG,EAAQ,aAAa,WAAW,MAAM,KAAK,UAAU,GACvE,KAAKF,KAAoBE,EAAQ,oBAAoBd,GACrD,KAAKa,KAAqBC,EAAQ,qBAAqBN;AAAA,EACzD;AAAA,EAEA,MAAM,QAAQO,GAAuD;AAGnE,QAAIA,EAAQ,QAAQ;AAClB,YAAM,KAAKC,GAAkBD,EAAQ,MAAM;AAE7C,UAAME,IAAYF,EAAQ,aAAa,KAAKH,IACtCM,IAAa,IAAI,gBAAA;AAIvB,QAAIC,IAAW;AACf,UAAMC,IAAQ,WAAW,MAAM;AAC7B,MAAAD,IAAW,IACXD,EAAW,MAAM,IAAIG,GAAc;AAAA,IACrC,GAAGJ,CAAS,GACNK,IAAe,MAAMJ,EAAW,MAAM,IAAIG,EAAa,EAAK,CAAC;AACnE,IAAAN,EAAQ,QAAQ,iBAAiB,SAASO,GAAc,EAAE,MAAM,IAAM;AAEtE,UAAMC,IAAY,KAAKV,GAAA;AACvB,QAAI;AACF,YAAMW,IAAW,MAAM,KAAKb,GAAW,GAAG,KAAKD,EAAW,GAAGK,EAAQ,IAAI,IAAI;AAAA,QAC3E,QAAQA,EAAQ;AAAA;AAAA;AAAA,QAGhB,aAAa;AAAA,QACb,MAAM;AAAA,QACN,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,uBAAuBQ;AAAA,QAAA;AAAA,QAEzB,MAAMR,EAAQ,SAAS,SAAY,KAAK,UAAUA,EAAQ,IAAI,IAAI;AAAA,QAClE,QAAQG,EAAW;AAAA,MAAA,CACpB;AAMD,UAAId;AACJ,UAAI;AACF,QAAAA,IAAO,MAAMoB,EAAS,KAAA;AAAA,MACxB,SAASnB,GAAO;AAGd,YAAIU,EAAQ,QAAQ,WAAWI;AAC7B,gBAAMd;AAER,QAAAD,IAAO;AAAA,MACT;AAEA,YAAMqB,IAAkBD,EAAS,QAAQ,IAAI,cAAc,KAAK;AAChE,UAAI,CAACA,EAAS,IAAI;AAChB,cAAME,IAASvB,EAAeC,CAAI,GAC5BuB,IAAOD,EAAO,QAAQzB,EAAgB,IAAIuB,EAAS,MAAM,KAAK;AACpE,cAAM,IAAII,EAAY;AAAA,UACpB,MAAAD;AAAA,UACA,SAASD,EAAO,WAAW;AAAA,UAC3B,WAAWA,EAAO;AAAA,UAClB,WAAWA,EAAO,aAAaD;AAAA,QAAA,CAChC;AAAA,MACH;AACA,aAAO,EAAE,QAAQD,EAAS,QAAQ,MAAApB,GAAM,WAAWqB,EAAA;AAAA,IACrD,SAASI,GAAO;AACd,YAAId,EAAQ,QAAQ,UACZ,KAAKC,GAAkBD,EAAQ,MAAM,IAEzCI,IACI,IAAIS,EAAY;AAAA,QACpB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAAL;AAAA,MAAA,CACD,IAGCM,aAAiBD,IACbC,IAEJA,aAAiB,gBAAgBA,EAAM,SAAS,eAC5C,IAAI,aAAa,qCAAqC,YAAY,IAEpE,IAAID,EAAY;AAAA,QACpB,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAAL;AAAA,MAAA,CACD;AAAA,IACH,UAAA;AACE,mBAAaH,CAAK,GAClBL,EAAQ,QAAQ,oBAAoB,SAASO,CAAY;AAAA,IAC3D;AAAA,EACF;AAAA;AAAA,EAGAN,GAAkBc,GAA8B;AAC9C,WAAOA,EAAO,kBAAkB,QAC5BA,EAAO,SACP,IAAI,aAAa,qCAAqC,YAAY;AAAA,EACxE;AACF;AAEO,SAASC,EAAqBjB,GAA2C;AAC9E,SAAO,IAAIL,EAAeK,CAAO;AACnC;AAGA,MAAMO,UAAqB,aAAa;AAAA,EACtC,YAAYF,IAAW,IAAM;AAC3B,UAAMA,IAAW,8BAA8B,2BAA2B,YAAY;AAAA,EACxF;AACF;AChMO,SAASa,EAAaC,GAA+B;AAC1D,QAAMC,IAAYC,EAAqBF,CAAM,GACvCG,IAAYL,EAAqB;AAAA,IACrC,YAAYM,EAAkBH,EAAU,MAAM;AAAA,EAAA,CAC/C;AACD,SAAO,IAAII,EAAiB,EAAE,QAAQJ,GAAW,WAAAE,GAAW;AAC9D;"}

package/dist/loader/attributes.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `data-viceme-*` attribute parsing for the CDN auto-loader.
+ *
+ * The attribute set is fixed; unknown `data-viceme-*` attributes are rejected
+ * so pages can never smuggle endpoints, tokens, secrets, prices, or payment
+ * state through the loader. Parse failures never guess defaults for work,
+ * region, or target.
+ */
+import type { ViceMeRegion } from '../core/config.ts';
+export type ViceMeTheme = 'light' | 'dark' | 'auto';
+export interface LoaderAttributes {
+    workKey: string;
+    region: ViceMeRegion;
+    /** Deduplicated feature names in declared order. */
+    features: string[];
+    /** CSS selector; required whenever features are declared. */
+    target?: string;
+    theme: ViceMeTheme;
+}
+export declare function parseLoaderAttributes(element: Element): LoaderAttributes;
+//# sourceMappingURL=attributes.d.ts.map

package/dist/loader/attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attributes.d.ts","sourceRoot":"","sources":["../../src/loader/attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;CACpB;AAeD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,gBAAgB,CAyDxE"}

package/dist/loader/auto-loader.d.ts

@@ -0,0 +1,51 @@
+/**
+ * CDN auto-loader (`viceme.min.js`, IIFE).
+ *
+ * Deterministic algorithm (fixed baseline):
+ *
+ * 1. Read `document.currentScript`; when unavailable, accept exactly one
+ *    explicit `script[data-viceme-loader]`.
+ * 2. Parse and validate `data-viceme-*`; build `clientKey` and per-feature
+ *    `instanceKey`s.
+ * 3. Wait for DOM ready; a missing/ambiguous target emits `CONFIG_INVALID`
+ *    and never creates phantom nodes.
+ * 4. Read `manifest.json` from the loader's own directory (exact release
+ *    version; URLs are never assembled from page parameters).
+ * 5. Load the same-version core, then each declared feature chunk in order.
+ * 6. Create the client, then mount; handles land in an internal registry.
+ * 7. Re-running the same instance key returns the original handle — no
+ *    duplicate sessions, subscriptions, or DOM.
+ * 8. A failing capability destroys only its own partial state; the rest of
+ *    the page and other capabilities keep working.
+ * 9. `pagehide` never auto-destroys (bfcache); cleanup happens on explicit
+ *    `destroy()` only.
+ *
+ * The loader never writes localStorage, cookies, global CSS, or globals other
+ * than the fixed `window.ViceMe.versions.vN` namespace.
+ */
+import { type RegisteredInstance } from './registry.ts';
+import type { ViceMeClient, ViceMeMountedInstance } from '../core/client.ts';
+export interface ReleaseManifest {
+    version: string;
+    apiMajor: number;
+    loader: string;
+    features: Record<string, string>;
+}
+export interface ViceMeLoaderNamespaceV1 {
+    readonly version: string;
+    whenReady(clientKey: string): Promise<ViceMeClient>;
+    getInstance(instanceKey: string): ViceMeMountedInstance | undefined;
+    destroyInstance(instanceKey: string): void;
+    destroyClient(clientKey: string): void;
+}
+export interface ViceMeBrowserGlobal {
+    versions: {
+        [major: string]: ViceMeLoaderNamespaceV1 | undefined;
+    };
+}
+export declare function ensureNamespace(version: string): ViceMeLoaderNamespaceV1;
+export declare function runAutoLoader(script: HTMLScriptElement): Promise<void>;
+declare function bootstrap(): void;
+export declare const __bootstrapForTests: typeof bootstrap;
+export type { RegisteredInstance };
+//# sourceMappingURL=auto-loader.d.ts.map

package/dist/loader/auto-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-loader.d.ts","sourceRoot":"","sources":["../../src/loader/auto-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAA+B,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIrF,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAG7E,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAWD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAAC;IACpE,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE;QAER,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAAC;KACtD,CAAC;CACH;AA2ED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CA2CxE;AAuID,wBAAsB,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkJ5E;AAkBD,iBAAS,SAAS,IAAI,IAAI,CAYzB;AAKD,eAAO,MAAM,mBAAmB,kBAAY,CAAC;AAC7C,YAAY,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/loader/bootstrap.d.ts

@@ -0,0 +1 @@
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/loader/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/loader/bootstrap.ts"],"names":[],"mappings":""}

package/dist/loader/events.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Stable `viceme:*` DOM events.
+ *
+ * Dispatch target is the mount host element; configuration errors that happen
+ * before a host exists are dispatched on `document`. Event details carry an
+ * allowlisted field set only — never tokens, cookies, provider payloads, or
+ * internal stacks.
+ */
+import type { ViceMeErrorCode } from '../core/errors.ts';
+export interface VicemeReadyDetail {
+    clientKey: string;
+    workKey: string;
+    capabilities: string[];
+    version: string;
+}
+export interface VicemeCapabilityReadyDetail {
+    clientKey: string;
+    instanceKey: string;
+    capability: string;
+    version: string;
+}
+export interface VicemeErrorDetail {
+    clientKey?: string;
+    instanceKey?: string;
+    capability?: string;
+    code: ViceMeErrorCode;
+    retryable: boolean;
+    requestId?: string;
+}
+export interface VicemeDestroyedDetail {
+    clientKey: string;
+    instanceKey: string;
+    capability: string;
+}
+export type VicemeEventType = 'viceme:ready' | 'viceme:capability-ready' | 'viceme:error' | 'viceme:destroyed';
+export type VicemeEventDetailMap = {
+    'viceme:ready': VicemeReadyDetail;
+    'viceme:capability-ready': VicemeCapabilityReadyDetail;
+    'viceme:error': VicemeErrorDetail;
+    'viceme:destroyed': VicemeDestroyedDetail;
+};
+/** Strip anything outside the documented allowlist before dispatch. */
+export declare function sanitizeDetail(type: VicemeEventType, detail: VicemeEventDetailMap[VicemeEventType]): VicemeEventDetailMap[VicemeEventType];
+export declare function dispatchViceMeEvent<K extends VicemeEventType>(target: EventTarget, type: K, detail: VicemeEventDetailMap[K]): void;
+//# sourceMappingURL=events.d.ts.map

package/dist/loader/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/loader/events.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,eAAe,GACzB,cAAc,GAAG,yBAAyB,GAAG,cAAc,GAAG,kBAAkB,CAAC;AAEnF,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,iBAAiB,CAAC;IAClC,yBAAyB,EAAE,2BAA2B,CAAC;IACvD,cAAc,EAAE,iBAAiB,CAAC;IAClC,kBAAkB,EAAE,qBAAqB,CAAC;CAC3C,CAAC;AAYF,uEAAuE;AACvE,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,oBAAoB,CAAC,eAAe,CAAC,GAC5C,oBAAoB,CAAC,eAAe,CAAC,CAOvC;AAED,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,eAAe,EAC3D,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,CAAC,EACP,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAC9B,IAAI,CAQN"}

package/dist/loader/main.d.ts

@@ -0,0 +1,11 @@
+/**
+ * IIFE entry for the CDN auto-loader.
+ *
+ * Side-effect only: imports the loader (which bootstraps from
+ * `document.currentScript`) and exports nothing, so the built
+ * `viceme.min.js` never leaves a global binding behind — the fixed
+ * `window.ViceMe.versions.v1` namespace is installed non-enumerably by the
+ * loader itself.
+ */
+import './auto-loader.ts';
+//# sourceMappingURL=main.d.ts.map

package/dist/loader/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/loader/main.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,kBAAkB,CAAC"}

package/dist/loader/mount-handle.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The handle a capability `mount()` returns to the loader (headless, no
+ * registry/identity concerns). The loader wraps it into the public
+ * `ViceMeMountedInstance`, which carries the registry-assigned `instanceKey`
+ * and owns idempotent destroy + event dispatch.
+ */
+import type { ViceMeClient } from '../core/client.ts';
+import type { ViceMeTheme } from './attributes.ts';
+export interface CapabilityMountOptions {
+    /** Mount host element; the capability owns its Shadow DOM subtree. */
+    target: Element;
+    theme: ViceMeTheme;
+}
+/** A capability's own lifecycle handle — no `instanceKey`, no registry. */
+export interface CapabilityMountHandle {
+    readonly capability: string;
+    /** Remove listeners, observers, timers, portals, and Shadow DOM nodes. */
+    destroy(): void;
+}
+export type CapabilityMountFunction = (client: ViceMeClient, options: CapabilityMountOptions) => Promise<CapabilityMountHandle>;
+/** Convenience for ESM-direct capability entry points. */
+export interface ViceMeCapabilityModule {
+    mount: CapabilityMountFunction;
+}
+//# sourceMappingURL=mount-handle.d.ts.map

package/dist/loader/mount-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-handle.d.ts","sourceRoot":"","sources":["../../src/loader/mount-handle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,sBAAsB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,0DAA0D;AAC1D,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,uBAAuB,CAAC;CAChC"}

package/dist/loader/registry.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Loader registry.
+ *
+ * Only the CDN loader maintains this registry (explicit `createViceMe()`
+ * instances never register). Core clients are shared by
+ * `major + region + workKey`; capability mounts are deduplicated by
+ * `clientKey + capability + target Element identity`.
+ *
+ * The registry itself is never exposed on `window` — only the fixed
+ * `ViceMe.versions.v1` diagnostics/destroy namespace is. It stores raw
+ * capability handles; the loader wraps them into the public
+ * `ViceMeMountedInstance` and owns destroy/event deduplication.
+ */
+import type { ViceMeClient } from '../core/client.ts';
+import type { CapabilityMountHandle } from './mount-handle.ts';
+export interface RegisteredClient {
+    clientKey: string;
+    client: ViceMeClient;
+    ready: Promise<void>;
+}
+export interface RegisteredInstance {
+    instanceKey: string;
+    clientKey: string;
+    capability: string;
+    host: Element;
+    raw: CapabilityMountHandle;
+    destroyed: boolean;
+}
+export declare function clientKeyOf(majorVersion: number, region: string, workKey: string): string;
+export declare class LoaderRegistry {
+    #private;
+    getClient(clientKey: string): RegisteredClient | undefined;
+    registerClient(entry: RegisteredClient): void;
+    unregisterClient(clientKey: string): void;
+    getInstance(instanceKey: string): RegisteredInstance | undefined;
+    /** Existing mount for the same client+capability+element, if any. */
+    findInstance(clientKey: string, capability: string, element: Element): RegisteredInstance | undefined;
+    registerInstance(clientKey: string, capability: string, element: Element, raw: CapabilityMountHandle): RegisteredInstance;
+    removeInstance(instanceKey: string): RegisteredInstance | undefined;
+    instancesForClient(clientKey: string): RegisteredInstance[];
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/loader/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/loader/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,qBAAqB,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED,qBAAa,cAAc;;IAOzB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAI1D,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAI7C,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIzC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIhE,qEAAqE;IACrE,YAAY,CACV,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,GACf,kBAAkB,GAAG,SAAS;IAIjC,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,qBAAqB,GACzB,kBAAkB;IAwBrB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAQnE,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE;CAG5D"}

package/dist/manifest.json

@@ -0,0 +1,38 @@
+{
+  "version": "0.1.2",
+  "apiMajor": 1,
+  "loader": "viceme.min.js",
+  "features": {},
+  "files": {
+    "bootstrap.min.js": {
+      "sha256": "390e260c83f55a077485b14c93c6e40440d84d5419fd48e4246a3b82ef59f398",
+      "sri": "sha384-RC4TWyaPaXrOTKEXMGP/KrcvUkJ6JyQqtl+WcUPN1JEiNKSp4Uf4jFzY3mkpgDzt",
+      "bytes": 935,
+      "gzipBytes": 585
+    },
+    "chunks/client-CGU3qeew.js": {
+      "sha256": "aa0dd0d96548f5f2407eba9771bdfc9d308e18b8b82c1020317d4baf951ef75f",
+      "sri": "sha384-OKBbC9Ou25tdP3F7ENuDaMV43raPG5ueYAKp8EcuUf+SOaGw4DCiaxHrqP+ifUMx",
+      "bytes": 7537,
+      "gzipBytes": 2743
+    },
+    "index.js": {
+      "sha256": "1dbd5dd4c3cee405f09b110c5450428dfa953bff8cc0162d4c4eb04f83ee31c7",
+      "sri": "sha384-iPA3K29jZimRRPVxMV5Y6UIFQni3Fs0nY7mKt6PQE3BRndOwb2M0a4wOc8us+ER5",
+      "bytes": 4142,
+      "gzipBytes": 1717
+    },
+    "testing.js": {
+      "sha256": "488e6f414de1aa65a1217c154cdac38335544b7226994b8f0969ab061c58b758",
+      "sri": "sha384-PWwNV0b8O3H9U6fSzviAHZVTeEqLAAhn+0a2NzEPFuLlvD1StjVcxbBr2XYMb0WV",
+      "bytes": 2156,
+      "gzipBytes": 983
+    },
+    "viceme.min.js": {
+      "sha256": "ac038a50a71720e49602223d89dde0f09b51917fb013c8a59a82858fa407b51c",
+      "sri": "sha384-KMteTHDhwmb8Ob4OpHSUda+Cupi7ZEbQUWvtIHf+hqiMCpBkE0OCm7NhDjwEJdtP",
+      "bytes": 10125,
+      "gzipBytes": 3642
+    }
+  }
+}