snagset 0.0.1

package/dist/react.d.ts

@@ -0,0 +1,28 @@
+import { type InitOptions } from "./index.ts";
+/**
+ * `snagset/react` — D63, and the twenty-line wrapper D37 predicted.
+ *
+ * ```tsx
+ * import { Snagset } from "snagset/react";
+ *
+ * <Snagset host="https://review.example.com" site="prj_…" />
+ * ```
+ *
+ * It renders NOTHING. There is no element to place, no wrapper div, no portal
+ * — the widget owns its own root in the DOM (02 §3's shadow host) and this
+ * component's whole job is to run `init()` while it is on screen. Returning
+ * `null` is the honest expression of that, and it means the component can sit
+ * anywhere in a tree without affecting layout.
+ *
+ * `react` is an OPTIONAL peer dependency, so installing `snagset` in a Vue or
+ * vanilla project pulls in no React and warns about nothing.
+ *
+ * `.ts`, NOT `.tsx`, because there is no JSX in it — a component that renders
+ * nothing has nothing to render. The extension was `.tsx` out of habit, and it
+ * cost something real: Node's type stripping handles `.ts` and refuses `.tsx`
+ * (JSX needs a transform, not a strip), so the test that imports every subpath
+ * to check its default export could not load this one.
+ */
+export type SnagsetProps = InitOptions;
+export declare function Snagset(props: SnagsetProps): null;
+export default Snagset;

package/dist/react.js

@@ -0,0 +1,19 @@
+import { useEffect } from "react";
+import { init } from "./index.js";
+export function Snagset(props) {
+    // Every value is in the dependency list via JSON, not the object identity:
+    // a caller writing `<Snagset host={…} site={…} />` creates a new props object
+    // every render, so depending on the object would tear down and re-mount the
+    // widget on every parent render. This is the one place in twenty lines where
+    // the obvious version is wrong.
+    const key = JSON.stringify(props);
+    useEffect(() => {
+        // `init` returns its own teardown and is idempotent — which is what makes
+        // this safe under React 18 strict mode, where effects run twice in
+        // development and a naive implementation boots two widgets.
+        return init(JSON.parse(key));
+    }, [key]);
+    return null;
+}
+export default Snagset;
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAClC,OAAO,EAAE,IAAI,EAAoB,MAAM,YAAY,CAAC;AA6BpD,MAAM,UAAU,OAAO,CAAC,KAAmB;IACzC,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,gCAAgC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,SAAS,CAAC,GAAG,EAAE;QACb,0EAA0E;QAC1E,mEAAmE;QACnE,4DAA4D;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC,CAAC;IAC9C,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACV,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe,OAAO,CAAC"}

package/dist/vendor/types/index.d.ts

@@ -0,0 +1 @@
+export * from "./names.ts";

package/dist/vendor/types/index.js

@@ -0,0 +1,4 @@
+// @snagset/types — shared types and the executable Name Registry.
+// The names module is generated from registry.json (see scripts/gen-names.mjs);
+// domain types (specs §5) land here as the packages that own them are built.
+export * from "./names.js";

package/dist/vendor/types/names.d.ts

@@ -0,0 +1,207 @@
+/** The one place the product name exists. Everything else derives from this. */
+export declare const BRAND: {
+    readonly $comment: "The ONLY place the product name appears. `long` = display/global name. `short` = the terse prefix that goes on attributes, classes, params, storage keys and artefact filenames (a client's DOM should not carry a long word). `pkg` = the npm/lowercase form used for env vars, headers, metrics, DOM events and symbols.";
+    readonly long: "Snagset";
+    readonly short: "snag";
+    readonly pkg: "snagset";
+};
+export declare const PRODUCT: "Snagset";
+export declare const NPM_PACKAGE: "snagset";
+export declare const NPM_SCOPE: "@snagset";
+/** Frozen once v1 stores real data — stamped into exports, issue bodies and the MCP contract, so it must survive a rename (registry.frozen). */
+export declare const SCHEMA_VERSION: "snagset.v1";
+export declare const CSS_VAR_PREFIX: "--snag-";
+export declare const HTTP_HEADER_PREFIX: "x-snagset-";
+export declare const ENV_PREFIX: "SNAGSET_";
+export declare const PG_TYPE_PREFIX: "snag_";
+export declare const METRIC_PREFIX: "snagset_";
+export declare const DOM_EVENT_PREFIX: "snagset:";
+export declare const SYMBOL_PREFIX: "snagset.";
+export declare const MENTION_SCHEME: "snag:user/";
+export declare const SKIP_HEADER: "x-snagset-skip";
+export declare const THREAD_REF_PREFIX: "SN-";
+export declare const TERM_SET: "Snagset";
+export declare const TERM_SET_PLURAL: "Snagsets";
+export declare const TERM_ITEM: "Snag";
+export declare const TERM_ITEM_PLURAL: "Snags";
+export declare const RESERVED_CUSTOM_PREFIX: "cr.";
+/** @returns e.g. `x-snagset-idempotency-key` */
+export declare const header: (name: string) => string;
+/** @returns e.g. `SNAGSET_SESSION_TTL_S` */
+export declare const env: (name: string) => string;
+/** @returns e.g. `snag_attachment_kind` */
+export declare const pgType: (name: string) => string;
+/** @returns e.g. `snagset_http_requests_total` */
+export declare const metric: (name: string) => string;
+/** window.* names (§2.2). Dunders are internal/test affordances, not public API. */
+export declare const GLOBALS: {
+    readonly api: "Snagset";
+    readonly config: "SnagsetConfig";
+    readonly disabled: "__SNAGSET_DISABLED__";
+    readonly assetBase: "__SNAGSET_ASSET_BASE__";
+    readonly collisionFallback: "__snagset__";
+};
+/** data-*-attributes on the host <script> tag (§2.3). */
+export type ScriptAttr = "site" | "host" | "disabled" | "env" | "mode" | "badge" | "lang" | "theme" | "position" | "offset" | "assetBase" | "branch" | "build" | "storage" | "hotkey" | "allowAutomation" | "screenshots" | "maskSelectors" | "nonce" | "autoMount";
+export declare const scriptAttr: (name: ScriptAttr) => string;
+/** DOM the widget authors on itself (§2.3b). */
+export type WidgetAttr = "root";
+export declare const widgetAttr: (name: WidgetAttr) => string;
+/** Attributes the host application may author (§2.4). */
+export type HostAttr = "anchor" | "ignore" | "mask" | "nomask" | "src" | "component";
+export declare const hostAttr: (name: HostAttr) => string;
+/** Class-form masking hooks (§2.4). */
+export type CssClass = "mask" | "block";
+export declare const cssClass: (name: CssClass) => string;
+/** Custom properties (§2.1's prefix, enumerated). 06 §14 makes every one of these public SemVer surface, so they are registered rather than minted at the point of use. Values are NOT here — the registry governs names, never design. */
+export declare const CSS_VAR: {
+    readonly font: "--snag-font";
+    readonly accent: "--snag-accent";
+    readonly onAccent: "--snag-onAccent";
+    readonly bg: "--snag-bg";
+    readonly fg: "--snag-fg";
+    readonly muted: "--snag-muted";
+    readonly border: "--snag-border";
+    readonly radius: "--snag-radius";
+    readonly shadow: "--snag-shadow";
+    readonly z: "--snag-z";
+    readonly motion: "--snag-motion";
+    readonly surface: "--snag-surface";
+    readonly sunken: "--snag-sunken";
+    readonly hover: "--snag-hover";
+    readonly focus: "--snag-focus";
+    readonly disabled: "--snag-disabled";
+    readonly statusOpen: "--snag-status-open";
+    readonly statusProgress: "--snag-status-progress";
+    readonly statusReview: "--snag-status-review";
+    readonly statusResolved: "--snag-status-resolved";
+    readonly anchorOrphan: "--snag-anchor-orphan";
+    readonly tbH: "--snag-tb-h";
+    readonly dockW: "--snag-dock-w";
+    readonly kb: "--snag-kb";
+    readonly thumbX: "--snag-thumb-x";
+    readonly thumbW: "--snag-thumb-w";
+};
+/** Which tokens belong to which role — the dark block must override theme members only. */
+export declare const CSS_VAR_GROUPS: {
+    readonly theme: readonly ["font", "accent", "onAccent", "bg", "fg", "muted", "border", "radius", "shadow", "z", "motion"];
+    readonly derived: readonly ["surface", "sunken", "hover", "focus", "disabled"];
+    readonly status: readonly ["statusOpen", "statusProgress", "statusReview", "statusResolved"];
+    readonly anchor: readonly ["anchorOrphan"];
+    readonly geometry: readonly ["tbH", "dockW", "kb", "thumbX", "thumbW"];
+};
+export type CssVar = keyof typeof CSS_VAR;
+/** @returns e.g. `--snag-bg` */
+export declare const cssVar: (name: CssVar) => string;
+/** @returns e.g. `var(--snag-bg)` — what stylesheets actually interpolate. */
+export declare const cssRef: (name: CssVar) => string;
+export type QueryParam = "t" | "off" | "debug" | "theme";
+export type FragmentParam = "k";
+/** @returns e.g. `snag_t`. The review-link secret is a FRAGMENT param (§2.5). */
+export declare const param: (name: QueryParam | FragmentParam) => string;
+export declare const RESERVED_URL_PARAMS: {
+    readonly query: readonly ["snag_t", "snag_off", "snag_debug", "snag_theme"];
+    readonly fragment: readonly ["snag_k"];
+};
+/** Point consts for hot paths: a chunk needing ONE key imports it and
+ *  drops the whole table — object properties cannot tree-shake, and the
+ *  panels chunk was carrying ten keys to read two (M2-13). */
+export declare const DISCLOSURE_KEY = "snag:disclosure:v1";
+export declare const IDENTITY_KEY = "snag:identity";
+export declare const THEME_ATTR = "data-snag-theme";
+/** Web-storage keys (§2.6). Parameterised keys are functions. */
+export declare const storageKey: {
+    readonly session: (uid: string) => string;
+    readonly identity: "snag:identity";
+    readonly threads: (uid: string, env: string) => string;
+    readonly counts: (origin: string) => string;
+    readonly draft: (route: string, draftId: string) => string;
+    readonly outbox: (uid: string) => string;
+    readonly mode: "snag:mode";
+    readonly handoff: "snag:handoff";
+    readonly seenCoach: "snag:seen-coach";
+    readonly disclosure: "snag:disclosure:v1";
+};
+/** The v0.1 IndexedDB blob store (§2.6, 05 §10.1) — one database, one
+ *  object store, shared by screenshots, reviewer images and the v2 outbox. */
+export declare const IDB: {
+    readonly database: "snag:blobs";
+    readonly store: "blobs";
+};
+/** Anchored regex sources matching every registered key — AC-22's storage diff. */
+export declare const STORAGE_KEY_PATTERNS: readonly ["^snag:session:.+$", "^snag:identity$", "^snag:threads:.+:.+$", "^snag:counts:.+$", "^snag:draft:.+:.+$", "^snag:outbox:.+$", "^snag:mode$", "^snag:handoff$", "^snag:seen-coach$", "^snag:disclosure:v1$"];
+/** The WIDGET's two (§2.7). Neither carries a credential, and no cookie authenticates the widget API — it runs on somebody else's origin. */
+export declare const COOKIE: {
+    readonly off: "snag_off";
+    readonly on: "snag_on";
+};
+/** The dashboard's session + CSRF pair (05 §4.7) — first-party, on the server's own origin, owner audience. */
+export declare const DASHBOARD_COOKIE: {
+    readonly session: "snag_session";
+    readonly csrf: "snag_csrf";
+};
+/** 05 §4.7 names these two constants directly; both spellings resolve to the same string. */
+export declare const DASHBOARD_SESSION_COOKIE: "snag_session";
+export declare const DASHBOARD_CSRF_COOKIE: "snag_csrf";
+/** Built widget chunks (§2.8). Preact lives only in `panels`. */
+export declare const ARTIFACT: {
+    readonly stub: "snag.js";
+    readonly runtime: "snag.runtime.js";
+    readonly panels: "snag.panels.js";
+    readonly crumbs: "snag.crumbs.js";
+    readonly capture: "snag.capture.js";
+    readonly screenshot: "snag.screenshot.js";
+    readonly anchorExt: "snag.anchor-ext.js";
+    readonly anchorFuzzy: "snag.anchor-fuzzy.js";
+    readonly dock: "snag.dock.js";
+    readonly text: "snag.text.js";
+};
+/** Wire-form entity id prefixes (§2.10). Not brand-derived. */
+export declare const ID_PREFIX: {
+    readonly project: "prj_";
+    readonly thread: "thr_";
+    readonly comment: "cmt_";
+    readonly reviewer: "rev_";
+    readonly attachment: "att_";
+    readonly link: "lnk_";
+    readonly round: "rnd_";
+};
+/** Credential literals (07 §8.2). Brand-DERIVED, and deliberately not the three-letter row shape: the literal is what gets registered with secret scanning, so a token pasted into a public repo is reported. */
+export declare const CREDENTIAL_PREFIX: {
+    readonly mcp: "snagmcp_";
+};
+/** CustomEvents dispatched on document (§2.11). */
+export declare const DOM_EVENT: {
+    readonly ready: "snagset:ready";
+    readonly activate: "snagset:activate";
+    readonly deactivate: "snagset:deactivate";
+    readonly threadCreated: "snagset:thread-created";
+    readonly threadResolved: "snagset:thread-resolved";
+};
+/** Request/response header names inside §2.1's prefix (05 §2.3). */
+export declare const HTTP_HEADER: {
+    readonly client: "x-snagset-client";
+    readonly schema: "x-snagset-schema";
+    readonly idempotencyKey: "x-snagset-idempotency-key";
+    readonly identity: "x-snagset-identity";
+    readonly csrf: "x-snagset-csrf";
+    readonly attachmentKind: "x-snagset-attachment-kind";
+    readonly attachmentWidth: "x-snagset-attachment-width";
+    readonly attachmentHeight: "x-snagset-attachment-height";
+    readonly server: "x-snagset-server";
+    readonly minClient: "x-snagset-min-client";
+    readonly time: "x-snagset-time";
+    readonly configVersion: "x-snagset-config-version";
+    readonly idempotentReplay: "x-snagset-idempotent-replay";
+    readonly requestId: "x-snagset-request-id";
+};
+/** Host-authored `<meta name>` keys we READ and never mint (§2.11). 03 §5.3: `route` is the only one. */
+export declare const META_NAME: {
+    readonly route: "snagset:route";
+};
+/** Keys for Symbol.for() patch bookkeeping (§2.11). */
+export declare const SYMBOL_KEY: {
+    readonly original: "snagset.original";
+    readonly wrapped: "snagset.wrapped";
+    readonly instance: "snagset.instance";
+};

package/dist/vendor/types/names.js

@@ -0,0 +1,254 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// GENERATED FILE — DO NOT EDIT BY HAND.
+// Source of truth: packages/types/registry.json
+// Regenerate:      pnpm gen:names      (CI runs `pnpm gen:names:check`)
+//
+// The Name Registry (specs/00-foundations.md §2) made executable. Every token
+// below is DERIVED from registry.json's `brand` block — the product name lives
+// in exactly one place. test/rename.test.ts proves it: flip the brand, and no
+// token of the old one survives. SCHEMA_VERSION is the one deliberate literal.
+// ─────────────────────────────────────────────────────────────────────────────
+/** The one place the product name exists. Everything else derives from this. */
+export const BRAND = {
+    $comment: "The ONLY place the product name appears. `long` = display/global name. `short` = the terse prefix that goes on attributes, classes, params, storage keys and artefact filenames (a client's DOM should not carry a long word). `pkg` = the npm/lowercase form used for env vars, headers, metrics, DOM events and symbols.",
+    long: "Snagset",
+    short: "snag",
+    pkg: "snagset",
+};
+export const PRODUCT = "Snagset";
+export const NPM_PACKAGE = "snagset";
+export const NPM_SCOPE = "@snagset";
+/** Frozen once v1 stores real data — stamped into exports, issue bodies and the MCP contract, so it must survive a rename (registry.frozen). */
+export const SCHEMA_VERSION = "snagset.v1";
+export const CSS_VAR_PREFIX = "--snag-";
+export const HTTP_HEADER_PREFIX = "x-snagset-";
+export const ENV_PREFIX = "SNAGSET_";
+export const PG_TYPE_PREFIX = "snag_";
+export const METRIC_PREFIX = "snagset_";
+export const DOM_EVENT_PREFIX = "snagset:";
+export const SYMBOL_PREFIX = "snagset.";
+export const MENTION_SCHEME = "snag:user/";
+export const SKIP_HEADER = "x-snagset-skip";
+export const THREAD_REF_PREFIX = "SN-";
+export const TERM_SET = "Snagset";
+export const TERM_SET_PLURAL = "Snagsets";
+export const TERM_ITEM = "Snag";
+export const TERM_ITEM_PLURAL = "Snags";
+export const RESERVED_CUSTOM_PREFIX = "cr.";
+/** @returns e.g. `x-snagset-idempotency-key` */
+export const header = (name) => HTTP_HEADER_PREFIX + name;
+/** @returns e.g. `SNAGSET_SESSION_TTL_S` */
+export const env = (name) => ENV_PREFIX + name;
+/** @returns e.g. `snag_attachment_kind` */
+export const pgType = (name) => PG_TYPE_PREFIX + name;
+/** @returns e.g. `snagset_http_requests_total` */
+export const metric = (name) => METRIC_PREFIX + name;
+/** window.* names (§2.2). Dunders are internal/test affordances, not public API. */
+export const GLOBALS = {
+    api: "Snagset",
+    config: "SnagsetConfig",
+    disabled: "__SNAGSET_DISABLED__",
+    assetBase: "__SNAGSET_ASSET_BASE__",
+    collisionFallback: "__snagset__",
+};
+const scriptAttrToken = {
+    site: "data-snag-site",
+    host: "data-snag-host",
+    disabled: "data-snag-disabled",
+    env: "data-snag-env",
+    mode: "data-snag-mode",
+    badge: "data-snag-badge",
+    lang: "data-snag-lang",
+    theme: "data-snag-theme",
+    position: "data-snag-position",
+    offset: "data-snag-offset",
+    assetBase: "data-snag-asset-base",
+    branch: "data-snag-branch",
+    build: "data-snag-build",
+    storage: "data-snag-storage",
+    hotkey: "data-snag-hotkey",
+    allowAutomation: "data-snag-allow-automation",
+    screenshots: "data-snag-screenshots",
+    maskSelectors: "data-snag-mask-selectors",
+    nonce: "data-snag-nonce",
+    autoMount: "data-snag-auto-mount",
+};
+export const scriptAttr = (name) => scriptAttrToken[name];
+const widgetAttrToken = {
+    root: "data-snag-root",
+};
+export const widgetAttr = (name) => widgetAttrToken[name];
+const hostAttrToken = {
+    anchor: "data-snag-anchor",
+    ignore: "data-snag-ignore",
+    mask: "data-snag-mask",
+    nomask: "data-snag-nomask",
+    src: "data-snag-src",
+    component: "data-snag-component",
+};
+export const hostAttr = (name) => hostAttrToken[name];
+const cssClassToken = {
+    mask: "snag-mask",
+    block: "snag-block",
+};
+export const cssClass = (name) => cssClassToken[name];
+/** Custom properties (§2.1's prefix, enumerated). 06 §14 makes every one of these public SemVer surface, so they are registered rather than minted at the point of use. Values are NOT here — the registry governs names, never design. */
+export const CSS_VAR = {
+    font: "--snag-font",
+    accent: "--snag-accent",
+    onAccent: "--snag-onAccent",
+    bg: "--snag-bg",
+    fg: "--snag-fg",
+    muted: "--snag-muted",
+    border: "--snag-border",
+    radius: "--snag-radius",
+    shadow: "--snag-shadow",
+    z: "--snag-z",
+    motion: "--snag-motion",
+    surface: "--snag-surface",
+    sunken: "--snag-sunken",
+    hover: "--snag-hover",
+    focus: "--snag-focus",
+    disabled: "--snag-disabled",
+    statusOpen: "--snag-status-open",
+    statusProgress: "--snag-status-progress",
+    statusReview: "--snag-status-review",
+    statusResolved: "--snag-status-resolved",
+    anchorOrphan: "--snag-anchor-orphan",
+    tbH: "--snag-tb-h",
+    dockW: "--snag-dock-w",
+    kb: "--snag-kb",
+    thumbX: "--snag-thumb-x",
+    thumbW: "--snag-thumb-w",
+};
+/** Which tokens belong to which role — the dark block must override theme members only. */
+export const CSS_VAR_GROUPS = {
+    theme: ["font", "accent", "onAccent", "bg", "fg", "muted", "border", "radius", "shadow", "z", "motion"],
+    derived: ["surface", "sunken", "hover", "focus", "disabled"],
+    status: ["statusOpen", "statusProgress", "statusReview", "statusResolved"],
+    anchor: ["anchorOrphan"],
+    geometry: ["tbH", "dockW", "kb", "thumbX", "thumbW"],
+};
+/** @returns e.g. `--snag-bg` */
+export const cssVar = (name) => CSS_VAR[name];
+/** @returns e.g. `var(--snag-bg)` — what stylesheets actually interpolate. */
+export const cssRef = (name) => `var(${CSS_VAR[name]})`;
+/** @returns e.g. `snag_t`. The review-link secret is a FRAGMENT param (§2.5). */
+export const param = (name) => "snag_" + name;
+export const RESERVED_URL_PARAMS = {
+    query: ["snag_t", "snag_off", "snag_debug", "snag_theme"],
+    fragment: ["snag_k"],
+};
+/** Point consts for hot paths: a chunk needing ONE key imports it and
+ *  drops the whole table — object properties cannot tree-shake, and the
+ *  panels chunk was carrying ten keys to read two (M2-13). */
+export const DISCLOSURE_KEY = "snag:disclosure:v1";
+export const IDENTITY_KEY = "snag:identity";
+export const THEME_ATTR = "data-snag-theme";
+/** Web-storage keys (§2.6). Parameterised keys are functions. */
+export const storageKey = {
+    session: (uid) => `snag:session:${uid}`,
+    identity: IDENTITY_KEY,
+    threads: (uid, env) => `snag:threads:${uid}:${env}`,
+    counts: (origin) => `snag:counts:${origin}`,
+    draft: (route, draftId) => `snag:draft:${route}:${draftId}`,
+    outbox: (uid) => `snag:outbox:${uid}`,
+    mode: "snag:mode",
+    handoff: "snag:handoff",
+    seenCoach: "snag:seen-coach",
+    disclosure: DISCLOSURE_KEY,
+};
+/** The v0.1 IndexedDB blob store (§2.6, 05 §10.1) — one database, one
+ *  object store, shared by screenshots, reviewer images and the v2 outbox. */
+export const IDB = {
+    database: "snag:blobs",
+    store: "blobs",
+};
+/** Anchored regex sources matching every registered key — AC-22's storage diff. */
+export const STORAGE_KEY_PATTERNS = [
+    "^snag:session:.+$",
+    "^snag:identity$",
+    "^snag:threads:.+:.+$",
+    "^snag:counts:.+$",
+    "^snag:draft:.+:.+$",
+    "^snag:outbox:.+$",
+    "^snag:mode$",
+    "^snag:handoff$",
+    "^snag:seen-coach$",
+    "^snag:disclosure:v1$",
+];
+/** The WIDGET's two (§2.7). Neither carries a credential, and no cookie authenticates the widget API — it runs on somebody else's origin. */
+export const COOKIE = {
+    off: "snag_off",
+    on: "snag_on",
+};
+/** The dashboard's session + CSRF pair (05 §4.7) — first-party, on the server's own origin, owner audience. */
+export const DASHBOARD_COOKIE = {
+    session: "snag_session",
+    csrf: "snag_csrf",
+};
+/** 05 §4.7 names these two constants directly; both spellings resolve to the same string. */
+export const DASHBOARD_SESSION_COOKIE = DASHBOARD_COOKIE.session;
+export const DASHBOARD_CSRF_COOKIE = DASHBOARD_COOKIE.csrf;
+/** Built widget chunks (§2.8). Preact lives only in `panels`. */
+export const ARTIFACT = {
+    stub: "snag.js",
+    runtime: "snag.runtime.js",
+    panels: "snag.panels.js",
+    crumbs: "snag.crumbs.js",
+    capture: "snag.capture.js",
+    screenshot: "snag.screenshot.js",
+    anchorExt: "snag.anchor-ext.js",
+    anchorFuzzy: "snag.anchor-fuzzy.js",
+    dock: "snag.dock.js",
+    text: "snag.text.js",
+};
+/** Wire-form entity id prefixes (§2.10). Not brand-derived. */
+export const ID_PREFIX = {
+    project: "prj_",
+    thread: "thr_",
+    comment: "cmt_",
+    reviewer: "rev_",
+    attachment: "att_",
+    link: "lnk_",
+    round: "rnd_",
+};
+/** Credential literals (07 §8.2). Brand-DERIVED, and deliberately not the three-letter row shape: the literal is what gets registered with secret scanning, so a token pasted into a public repo is reported. */
+export const CREDENTIAL_PREFIX = {
+    mcp: "snagmcp_",
+};
+/** CustomEvents dispatched on document (§2.11). */
+export const DOM_EVENT = {
+    ready: "snagset:ready",
+    activate: "snagset:activate",
+    deactivate: "snagset:deactivate",
+    threadCreated: "snagset:thread-created",
+    threadResolved: "snagset:thread-resolved",
+};
+/** Request/response header names inside §2.1's prefix (05 §2.3). */
+export const HTTP_HEADER = {
+    client: "x-snagset-client",
+    schema: "x-snagset-schema",
+    idempotencyKey: "x-snagset-idempotency-key",
+    identity: "x-snagset-identity",
+    csrf: "x-snagset-csrf",
+    attachmentKind: "x-snagset-attachment-kind",
+    attachmentWidth: "x-snagset-attachment-width",
+    attachmentHeight: "x-snagset-attachment-height",
+    server: "x-snagset-server",
+    minClient: "x-snagset-min-client",
+    time: "x-snagset-time",
+    configVersion: "x-snagset-config-version",
+    idempotentReplay: "x-snagset-idempotent-replay",
+    requestId: "x-snagset-request-id",
+};
+/** Host-authored `<meta name>` keys we READ and never mint (§2.11). 03 §5.3: `route` is the only one. */
+export const META_NAME = {
+    route: "snagset:route",
+};
+/** Keys for Symbol.for() patch bookkeeping (§2.11). */
+export const SYMBOL_KEY = {
+    original: "snagset.original",
+    wrapped: "snagset.wrapped",
+    instance: "snagset.instance",
+};

package/dist/vite.d.ts

@@ -0,0 +1,51 @@
+import { type InitOptions } from "./index.ts";
+/**
+ * `snagset/vite` — D67, the config-level install.
+ *
+ * ```ts
+ * // vite.config.ts
+ * import { snagset } from "snagset/vite";
+ *
+ * export default defineConfig({
+ *   plugins: [snagset({ host: "https://review.example.com", site: "prj_…" })],
+ * });
+ * ```
+ *
+ * One line in a file the project already has, and no component in the tree at
+ * all. This is the piece of Vercel's install story worth taking (their
+ * SvelteKit path is `vercelToolbar()` in `vite.config`) — and because Nuxt,
+ * SvelteKit, Astro, SolidStart and Qwik all sit on Vite, this single plugin is
+ * the config-level answer for every one of them: put it under `vite.plugins`
+ * in `nuxt.config`, or beside `sveltekit()`.
+ *
+ * ── WHY THERE IS NO `vite` IMPORT IN THIS FILE ──
+ *
+ * The plugin is a plain object — a `name` and a `transformIndexHtml` hook —
+ * and Vite's contract for it is structural. Importing `vite` for its `Plugin`
+ * type would make a types-only package a peer dependency and pin us to its
+ * version churn, to say nothing this file's shape does not already say. The
+ * local types below are the subset we implement, and they assign cleanly to
+ * every Vite since the hook stabilized (v2).
+ *
+ * ── DEV AND BUILD BOTH, DELIBERATELY ──
+ *
+ * The tag is safe in a production build because who sees the toolbar is a
+ * DASHBOARD setting, checked by the stub on load (D66) — shipping the tag is
+ * not showing the toolbar. So the plugin does not carry an `enabled`/`dev`
+ * option that re-answers a question Vite already answers natively: a project
+ * that wants the tag only in dev writes the standard idiom
+ * `mode === "development" ? snagset({…}) : undefined` in its own config.
+ */
+/** The subset of Vite's `HtmlTagDescriptor` this plugin produces. */
+export interface SnagsetHtmlTag {
+    tag: string;
+    attrs: Record<string, string | boolean>;
+    injectTo: "body";
+}
+/** The subset of Vite's `Plugin` this plugin is. */
+export interface SnagsetVitePlugin {
+    name: string;
+    transformIndexHtml: () => SnagsetHtmlTag[];
+}
+export declare function snagset(options: InitOptions): SnagsetVitePlugin;
+export default snagset;

package/dist/vite.js

@@ -0,0 +1,20 @@
+import { tagFor } from "./index.js";
+export function snagset(options) {
+    // Fail in the factory, not in the hook: a config error should stop `vite`
+    // at startup with a sentence, never surface mid-build as a mangled page.
+    if (!options?.host)
+        throw new Error("snagset/vite: `host` is required — the URL of your Snagset instance.");
+    if (!options.site)
+        throw new Error("snagset/vite: `site` is required — the project uid, which looks like prj_….");
+    const { src, attrs } = tagFor(options);
+    return {
+        name: "snagset",
+        transformIndexHtml() {
+            // `injectTo: "body"` is the docs' own instruction — "immediately before
+            // the closing </body> tag" — expressed as the hook's vocabulary.
+            return [{ tag: "script", attrs: { src, defer: true, ...attrs }, injectTo: "body" }];
+        },
+    };
+}
+export default snagset;
+//# sourceMappingURL=vite.js.map

package/dist/vite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite.js","sourceRoot":"","sources":["../src/vite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAoB,MAAM,YAAY,CAAC;AAqDtD,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,CAAC,OAAO,EAAE,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC5G,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IAElH,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,kBAAkB;YAChB,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,eAAe,OAAO,CAAC"}

package/dist/vue.d.ts

@@ -0,0 +1,65 @@
+import { type PropType } from "vue";
+/**
+ * `snagset/vue` — D63.
+ *
+ * ```vue
+ * <script setup>
+ * import { Snagset } from "snagset/vue";
+ * </script>
+ *
+ * <template>
+ *   <Snagset host="https://review.example.com" site="prj_…" />
+ * </template>
+ * ```
+ *
+ * Same shape as the React one and for the same reason: renders nothing, mounts
+ * on mount, tears down on unmount. `vue` is an optional peer dependency.
+ *
+ * Written with `defineComponent` and a render function rather than as an SFC
+ * because an SFC needs `@vitejs/plugin-vue` at BUILD time — in this package's
+ * build, not the consumer's. A component that renders null does not need a
+ * template compiler, and adding one would make the Vue subpath the only part
+ * of this package that cannot be built by `tsc`.
+ */
+export declare const Snagset: import("vue").DefineComponent<import("vue").ExtractPropTypes<{
+    host: {
+        type: StringConstructor;
+        required: true;
+    };
+    site: {
+        type: StringConstructor;
+        required: true;
+    };
+    env: StringConstructor;
+    mode: StringConstructor;
+    theme: StringConstructor;
+    lang: StringConstructor;
+    position: StringConstructor;
+    hotkey: StringConstructor;
+    branch: StringConstructor;
+    build: StringConstructor;
+    storage: StringConstructor;
+    badge: PropType<string>;
+    autoMount: PropType<string>;
+}>, () => null, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {}, string, import("vue").PublicProps, Readonly<import("vue").ExtractPropTypes<{
+    host: {
+        type: StringConstructor;
+        required: true;
+    };
+    site: {
+        type: StringConstructor;
+        required: true;
+    };
+    env: StringConstructor;
+    mode: StringConstructor;
+    theme: StringConstructor;
+    lang: StringConstructor;
+    position: StringConstructor;
+    hotkey: StringConstructor;
+    branch: StringConstructor;
+    build: StringConstructor;
+    storage: StringConstructor;
+    badge: PropType<string>;
+    autoMount: PropType<string>;
+}>> & Readonly<{}>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, true, {}, any>;
+export default Snagset;