@ai-matrx/chat 0.4.10 → 0.4.14

package/dist/agents/utils/json-extraction.js

@@ -1,7 +1,7 @@
 import {
   extractFirstJson
-} from "@ai-matrx/kit/json-extract";
-import { findAllFencedBlocks } from "@ai-matrx/kit/json-extract";
+} from "@ai-matrx/content-ir/json-extract";
+import { findAllFencedBlocks } from "@ai-matrx/content-ir/json-extract";
 function extractJsonFromText(text) {
   if (!text || typeof text !== "string") {
     return { success: false, error: "No text provided", rawText: text || "" };

package/dist/canvas/workspace/ChatPanelTitleMenu.js

@@ -8,7 +8,7 @@ import { useAppSelector } from "../../store/hooks.js";
 import { selectConversationTitle } from "../../agents/redux/execution-system/conversations/conversations.selectors.js";
 import { selectConversationListItemById } from "../../agents/redux/conversation-list/conversation-list.selectors.js";
 import { conversationRenameOpener } from "../../agents/components/conversation-actions/rename/conversationRenameOpener.js";
-import { conversationTitleText } from "../../utils/content-ir/surfaces/kind-text-label.js";
+import { conversationTitleText } from "@ai-matrx/content-ir/surfaces";
 import { Button, Tile } from "@ai-matrx/design-system/controls";
 import { ConversationHistorySidebar } from "../../agents/components/conversation-history/ConversationHistorySidebar.js";
 const PANEL_HISTORY_SCOPE = "chat-panel-menu";

package/dist/canvas/workspace/useCanvasWorkspaceConversation.js

@@ -7,7 +7,7 @@ import { resumeConversation } from "../../agents/redux/execution-system/thunks/r
 import { useAppDispatch, useAppSelector } from "../../store/hooks.js";
 import { selectShouldPromptForOrganization } from "../../host/ui-slots.js";
 import { selectIsCacheOnly } from "../../agents/redux/execution-system/conversations/conversations.selectors.js";
-import { replaceAddressWithoutNavigating } from "../../ui/addressWithoutNavigating.js";
+import { replaceAddressWithoutNavigating } from "@ai-matrx/rich-content/utils/addressWithoutNavigating";
 import { describeLaunchError } from "./describe-launch-error.js";
 import { selectOrganizationId, ensureOrganizationContext, isOrganizationSelectionCancelled } from "../../host/org.js";
 function initialRequest(start) {

package/dist/cx-chat/components/SsrSidebarChats.js

@@ -37,7 +37,7 @@ const toSidebarItem = (c) => ({
   status: c.status
 });
 const selectSidebarConversations = (state) => selectGlobalConversationList(state);
-import { conversationTitleText } from "../../utils/content-ir/surfaces/kind-text-label.js";
+import { conversationTitleText } from "@ai-matrx/content-ir/surfaces";
 const GROUP_ORDER = ["Today", "Yesterday", "This Week", "This Month", "Older"];
 function groupByTime(items) {
   const now = /* @__PURE__ */ new Date();

package/dist/cx-chat/components/core/ChatConversationClient.js

@@ -24,7 +24,7 @@ import { useComposerMode } from "../../../agents/components/inputs/smart-input/c
 import { ProposedDirectivesZone } from "../../../host/ui-slots.js";
 import { ServerOperationBanner } from "../../../agents/runtime-reconnect/ServerOperationBanner.js";
 import { pushAppHref } from "../../../host/ui-slots.js";
-import { replaceAddressWithoutNavigating } from "../../../ui/addressWithoutNavigating.js";
+import { replaceAddressWithoutNavigating } from "@ai-matrx/rich-content/utils/addressWithoutNavigating";
 import { Button } from "@ai-matrx/design-system/controls";
 function ChatConversationClient({
   conversationId,

package/dist/cx-chat/components/messages/AssistantMessage.js

@@ -13,7 +13,7 @@ import {
   Save
 } from "lucide-react";
 import { Button } from "@ai-matrx/design-system/controls";
-import { MarkdownStream } from "../../../ui/markdown-stream/MarkdownStream.js";
+import MarkdownStream from "../../../ui/markdown-stream/MarkdownStream.js";
 import AudioOutputBlockSkeleton from "../../../ui/AudioOutputBlockSkeleton.js";
 import { useDomCapturePrint } from "../../../conversation/hooks/useDomCapturePrint.js";
 import { useAppSelector, useAppDispatch } from "../../../store/hooks.js";

package/dist/cx-chat/hooks/useInstanceBootstrap.js

@@ -12,7 +12,7 @@ import { toast } from "../../host/notify.js";
 import { isNotAuthenticatedError } from "../../host/identity.js";
 import { isOrganizationSelectionCancelled } from "../../host/org.js";
 import { DEFAULT_AGENT_ID } from "../components/agent/local-agents.js";
-import { replaceAddressWithoutNavigating } from "../../ui/addressWithoutNavigating.js";
+import { replaceAddressWithoutNavigating } from "@ai-matrx/rich-content/utils/addressWithoutNavigating";
 import { ensureAgentCatalog, isAgentCatalogStale } from "../../agents/identity/agent-identity.js";
 function parseChatUrl(pathname, searchParams) {
   const agentPathMatch = pathname.match(/\/demos\/chat\/a\/([^/?]+)/);

package/dist/cx-conversation/AssistantMessage.js

@@ -13,7 +13,7 @@ import {
   Save
 } from "lucide-react";
 import { Button } from "@ai-matrx/design-system/controls";
-import { MarkdownStream } from "../ui/markdown-stream/MarkdownStream.js";
+import MarkdownStream from "../ui/markdown-stream/MarkdownStream.js";
 import AudioOutputBlockSkeleton from "../ui/AudioOutputBlockSkeleton.js";
 import { useDomCapturePrint } from "../conversation/hooks/useDomCapturePrint.js";
 import { useAppSelector, useAppDispatch } from "../store/hooks.js";

package/dist/host/configure.js

@@ -7,7 +7,12 @@ import {
   createLogClientErrorDiagnostics,
   isChatSourceApp
 } from "./defaults/diagnostics.js";
-import { createDbIdentity } from "./defaults/identity.js";
+import {
+  createDbIdentity,
+  createTokenIdentity,
+  createUnreadableTokenIdentity,
+  isTokenOnlyClient
+} from "./defaults/identity.js";
 import { createStoredOrg } from "./defaults/org.js";
 import { createDefaultServer } from "./defaults/server.js";
 import { createDefaultServerApi } from "./defaults/server-api.js";
@@ -45,7 +50,8 @@ const PORTS = [
   "feedback",
   "routes",
   "canvas",
-  "routing"
+  "routing",
+  "deviceTools"
 ];
 const ANY_ROUTING = Object.freeze({ policy: () => "any" });
 const EMPTY_REGISTRATIONS = Object.freeze({});
@@ -55,7 +61,7 @@ function assertDb(host) {
     if (host?.source) return;
     throw new ChatHostInvalidError("`db` is missing (pass `db`, or a message `source`)");
   }
-  if (typeof db.rpc !== "function" || typeof db.from !== "function" || !db.auth) {
+  if (typeof db.rpc !== "function" || typeof db.from !== "function" || !isTokenOnlyClient(db) && !db.auth) {
     throw new ChatHostInvalidError(
       "`db` is not a Supabase client (no auth/rpc/from)"
     );
@@ -82,9 +88,12 @@ function resolveChatHost(host) {
     PORTS.filter((name) => host[name] !== void 0)
   );
   const ref = {};
-  const diagnostics = host.diagnostics ?? (hasDatabase ? createLogClientErrorDiagnostics(db, { sourceApp: host.sourceApp }) : createConsoleDiagnostics());
+  const diagnostics = host.diagnostics ?? (hasDatabase ? createLogClientErrorDiagnostics(db, {
+    sourceApp: host.sourceApp,
+    signedIn: async () => await ref.identity.getAccessToken() !== null
+  }) : createConsoleDiagnostics());
   const notify = host.notify ?? createDomNotifier();
-  const identity = host.identity ?? (hasDatabase ? createDbIdentity(db, () => ref.diagnostics) : SOURCE_ONLY_IDENTITY);
+  const identity = host.identity ?? (!hasDatabase ? SOURCE_ONLY_IDENTITY : host.accessToken ? createTokenIdentity(db, host.accessToken, () => ref.diagnostics) : isTokenOnlyClient(db) ? createUnreadableTokenIdentity((message) => announceOnce("identity:token-only-no-function", message)) : createDbIdentity(db, () => ref.diagnostics));
   const org = host.org ?? createStoredOrg(
     () => ref.notify,
     () => ref.diagnostics
@@ -130,6 +139,7 @@ function resolveChatHost(host) {
     routes: { ...DEFAULT_CHAT_ROUTES, ...host.routes },
     canvas: host.canvas ?? createUnhostedCanvas(() => ref.diagnostics),
     routing: host.routing ?? ANY_ROUTING,
+    deviceTools: host.deviceTools ?? null,
     overridden
   });
   return ref;

package/dist/host/contract.d.ts

@@ -738,6 +738,34 @@ export interface ChatAppIdentity {
  * `"local-only"` (confidential) conversation refuses every target but the Matrx Local engine on this
  * computer, loudly, before a byte leaves the machine. Default: `"any"` for every conversation.
  */
+/** What a device-tool run answered (the same shape the browser-extension bridge answers). */
+export type ChatDeviceToolInvocation = {
+    handled: false;
+    reason: string;
+} | {
+    handled: true;
+    ok: true;
+    output: Record<string, unknown>;
+} | {
+    handled: true;
+    ok: false;
+    error: string;
+};
+/**
+ * Tools that run ON THIS DEVICE for a cloud agent (lanes/agents-chat-proposal.md W0(c)): the
+ * browser tools when the chat runs inside Matrx Extend, local machine tools in a desktop host. The
+ * package owns the whole loop around them — the delegated call's lifecycle, the durable result
+ * submit with retry, and the resume (`surfaceDelegatedToolCall` → `submitToolResult`); the host
+ * only executes. `handled: false` = "not a tool this device owns" (the model is told, never a
+ * wedge). Absent: delegated device tools go to the installed browser extension through the server
+ * port (`invokeMatrxExtendTool`), as on the web.
+ */
+export interface ChatDeviceToolsPort {
+    invoke(toolName: string, args: Record<string, unknown>, context: {
+        conversationId: string;
+        callId: string;
+    }): Promise<ChatDeviceToolInvocation>;
+}
 export interface ChatRoutingPort {
     policy(conversationId: string): ChatRoutingPolicy;
 }
@@ -767,7 +795,16 @@ export interface ChatHost {
      * that is not matrx-frontend never labels its rows as the main app's.
      */
     app?: ChatAppIdentity;
-    /** Default: from db.auth (getSession + onAuthStateChange); admin level from admin.admins. */
+    /**
+     * The token function a token-only client was built with (supabase-js `accessToken` option, the
+     * matrx-local custodian shape): pass the SAME function here and the default identity reads who is
+     * signed in from it. A token-only `db` without it is signed out, announced once with this remedy.
+     */
+    accessToken?: () => Promise<string | null>;
+    /**
+     * Default: from db.auth (getSession + onAuthStateChange); for a token-only `db`, from
+     * `accessToken`. Admin level from admin.admins either way.
+     */
     identity?: ChatIdentityPort;
     /** Default: no active org; `require` refuses loudly (never auto-picks). */
     org?: ChatOrgPort;
@@ -803,8 +840,10 @@ export interface ChatHost {
     canvas?: ChatCanvasPort;
     /** Default: every conversation may go to any target (`"any"`). */
     routing?: ChatRoutingPort;
+    /** Default: none — delegated device tools go to the browser extension via the server port. */
+    deviceTools?: ChatDeviceToolsPort;
 }
-export type ChatPortName = "identity" | "org" | "server" | "notify" | "diagnostics" | "prefs" | "navigation" | "windows" | "catalog" | "registry" | "chrome" | "feedback" | "routes" | "canvas" | "routing";
+export type ChatPortName = "identity" | "org" | "server" | "notify" | "diagnostics" | "prefs" | "navigation" | "windows" | "catalog" | "registry" | "chrome" | "feedback" | "routes" | "canvas" | "routing" | "deviceTools";
 /** Every port present. `overridden` names the ports the host supplied itself. */
 export interface ResolvedChatHost {
     /** The host's client, or the no-database stand-in when it gave only a `source`. */
@@ -831,5 +870,7 @@ export interface ResolvedChatHost {
     routes: ChatRoutes;
     canvas: ChatCanvasPort;
     routing: ChatRoutingPort;
+    /** The host's on-device tool executor, or null. */
+    deviceTools: ChatDeviceToolsPort | null;
     overridden: ReadonlySet<ChatPortName>;
 }

package/dist/host/db.js

@@ -3,6 +3,7 @@ import {
   AuthSessionMissingError
 } from "@supabase/supabase-js";
 import { getChatHost } from "./configure.js";
+import { decodeTokenClaims, isTokenOnlyClient } from "./defaults/identity.js";
 function createClient() {
   return getChatHost().db;
 }
@@ -35,6 +36,11 @@ function userFromClaims(claims) {
   };
 }
 async function getClaimsUser(client, jwt) {
+  if (isTokenOnlyClient(client)) {
+    const token = jwt ?? await getChatHost().identity.getAccessToken().catch(() => null);
+    const claims = token ? decodeTokenClaims(token) : null;
+    return { data: { user: userFromClaims(claims ?? void 0) }, error: null };
+  }
   const { data, error } = await client.auth.getClaims(jwt);
   if (error) {
     if (isSignedOutError(error)) return { data: { user: null }, error: null };

package/dist/host/defaults/diagnostics.d.ts

@@ -27,6 +27,11 @@ export interface LogClientErrorDiagnosticsOptions {
     /** Default: `process.env.NODE_ENV === "production"`. */
     persist?: boolean;
     flushDelayMs?: number;
+    /**
+     * Is someone signed in? The resolver passes the identity port's answer, so a token-only client
+     * works. Default (a db with an auth-js session): `db.auth.getSession()`.
+     */
+    signedIn?: () => Promise<boolean>;
 }
 export declare function isChatSourceApp(value: unknown): value is ChatSourceApp;
 export declare function createLogClientErrorDiagnostics(db: ChatDb, options: LogClientErrorDiagnosticsOptions): ChatDiagnosticsPort;

package/dist/host/defaults/diagnostics.js

@@ -59,8 +59,7 @@ function createLogClientErrorDiagnostics(db, options) {
     if (queue.length === 0) return;
     let signedIn = false;
     try {
-      const { data } = await db.auth.getSession();
-      signedIn = Boolean(data.session?.user);
+      signedIn = options.signedIn ? await options.signedIn() : Boolean((await db.auth.getSession()).data.session?.user);
     } catch {
       signedIn = false;
     }

package/dist/host/defaults/identity.d.ts

@@ -3,6 +3,32 @@
  * admin level from `admin.admins` (RLS: a person reads their own row). Starts
  * on first use, never at import, so SSR and tests that never ask pay nothing.
  */
+import type { User } from "@supabase/supabase-js";
 import type { ChatDb, ChatDiagnosticsPort, ChatIdentity, ChatIdentityPort } from "../contract.js";
 export declare const SIGNED_OUT_IDENTITY: ChatIdentity;
 export declare function createDbIdentity(db: ChatDb, diagnostics: () => ChatDiagnosticsPort): ChatIdentityPort;
+/**
+ * Is this a supabase-js client built with the `accessToken` option? Such a client has no auth-js
+ * session: touching `db.auth` throws by construction (matrx-local's custodian client is one). The
+ * probe reads the property inside a try, so it never throws itself.
+ */
+export declare function isTokenOnlyClient(db: unknown): boolean;
+/** A JWT's payload as an object (no verification — routing metadata only). */
+export declare function decodeTokenClaims(token: string): Record<string, unknown> | null;
+/**
+ * The person a token names, read from its claims — routing metadata, not verification (the
+ * server and RLS verify every call that token makes). `null` when the token names nobody.
+ */
+export declare function userFromAccessToken(token: string | null): User | null;
+/**
+ * Identity for a token-only client: the host hands the same `accessToken` function it gave
+ * supabase-js, and the package reads who is signed in from it. Every `getAccessToken()` re-reads
+ * the token, so a refresh or an account switch reaches the snapshot (and its subscribers) the next
+ * time anything asks; admin level is read through `db` exactly like the session default.
+ */
+export declare function createTokenIdentity(db: ChatDb, getToken: () => Promise<string | null>, diagnostics: () => ChatDiagnosticsPort): ChatIdentityPort;
+/**
+ * A token-only client with no `accessToken` function: nobody can be read. Signed out and settled
+ * (never a forever-loading screen), announced once with the remedy.
+ */
+export declare function createUnreadableTokenIdentity(announce: (message: string) => void): ChatIdentityPort;

package/dist/host/defaults/identity.js

@@ -113,7 +113,139 @@ function createDbIdentity(db, diagnostics) {
     }
   };
 }
+function isTokenOnlyClient(db) {
+  if (db === null || typeof db !== "object") return false;
+  try {
+    const auth = db.auth;
+    if (!auth) return true;
+    void auth.getSession;
+    return false;
+  } catch {
+    return true;
+  }
+}
+function decodeTokenClaims(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+  try {
+    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+    const parsed = JSON.parse(
+      typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8")
+    );
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function userFromAccessToken(token) {
+  if (!token) return null;
+  const claims = decodeTokenClaims(token);
+  if (!claims || typeof claims.sub !== "string" || !claims.sub) return null;
+  const meta = claims.user_metadata;
+  const appMeta = claims.app_metadata;
+  return {
+    id: claims.sub,
+    email: typeof claims.email === "string" ? claims.email : void 0,
+    user_metadata: meta !== null && typeof meta === "object" ? meta : {},
+    app_metadata: appMeta !== null && typeof appMeta === "object" ? appMeta : {},
+    aud: typeof claims.aud === "string" ? claims.aud : "authenticated",
+    created_at: ""
+  };
+}
+function createTokenIdentity(db, getToken, diagnostics) {
+  let snapshot = SIGNED_OUT_IDENTITY;
+  let started = false;
+  let adminFor = null;
+  const listeners = /* @__PURE__ */ new Set();
+  function publish(next) {
+    if (snapshot.userId === next.userId && snapshot.accessToken === next.accessToken && snapshot.adminLevel === next.adminLevel && snapshot.authReady === next.authReady) {
+      return;
+    }
+    snapshot = next;
+    for (const listener of listeners) listener();
+  }
+  async function readAdminLevel(userId) {
+    try {
+      const { data, error } = await db.schema("admin").from("admins").select("level").eq("user_id", userId).maybeSingle();
+      if (error) throw error;
+      const level = data?.level;
+      return ADMIN_LEVELS.includes(level) ? level : null;
+    } catch (error) {
+      diagnostics().capture(error, { area: "identity", code: "admin-level-unreadable" });
+      return null;
+    }
+  }
+  async function refresh() {
+    let token;
+    try {
+      token = await getToken();
+    } catch (error) {
+      diagnostics().capture(error, { area: "identity", code: "access-token-unreadable" });
+      token = null;
+    }
+    const user = userFromAccessToken(token);
+    const level = user && user.id === snapshot.userId ? snapshot.adminLevel : null;
+    publish(identityFromUser(user, level, user ? token : null));
+    if (user && adminFor !== user.id) {
+      adminFor = user.id;
+      const read = await readAdminLevel(user.id);
+      if (snapshot.userId === user.id) publish(identityFromUser(user, read, snapshot.accessToken));
+    }
+    return user ? token : null;
+  }
+  function start() {
+    if (started) return;
+    started = true;
+    void refresh();
+  }
+  return {
+    current() {
+      start();
+      return snapshot;
+    },
+    subscribe(listener) {
+      start();
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    getAccessToken: refresh
+  };
+}
+function createUnreadableTokenIdentity(announce) {
+  const value = Object.freeze({ ...SIGNED_OUT_IDENTITY, authReady: true });
+  let said = false;
+  const say = () => {
+    if (said) return;
+    said = true;
+    announce(
+      "This chat's database client was built with an access-token function, so the chat cannot read who is signed in. Pass the same function to the chat host as `accessToken`."
+    );
+  };
+  return {
+    current() {
+      say();
+      return value;
+    },
+    subscribe() {
+      say();
+      return () => {
+      };
+    },
+    async getAccessToken() {
+      say();
+      return null;
+    }
+  };
+}
 export {
   SIGNED_OUT_IDENTITY,
-  createDbIdentity
+  createDbIdentity,
+  createTokenIdentity,
+  createUnreadableTokenIdentity,
+  decodeTokenClaims,
+  isTokenOnlyClient,
+  userFromAccessToken
 };

package/dist/host/identity.d.ts

@@ -50,8 +50,25 @@ export declare function isNotAuthenticatedError(error: unknown): error is NotAut
 /** The signed-in person's id; throws `NotAuthenticatedError` when nobody is. */
 export declare function requireUserId(): string;
 /**
- * Does this client carry a signed-in session? A local read of the host's
- * `db.auth` (no network). For skipping reads only a signed-in person can make;
+ * The signed-in person's access token, or null — THE one session read in the package. It goes
+ * through the host's identity port, so a session client (auth-js) and a token-only client
+ * (`ChatHost.accessToken`) answer the same way; nothing else in the package touches `db.auth`
+ * (guard: `host/__tests__/session-reads-go-through-the-identity-port.test.ts`).
+ */
+export declare function readSessionToken(): Promise<string | null>;
+/** `readSessionToken` in the structural shape `@ai-matrx/data`'s session retry reads. */
+export declare const hostSessionSource: {
+    getSession(): Promise<{
+        data: {
+            session: {
+                access_token: string;
+            } | null;
+        };
+        error: null;
+    }>;
+};
+/**
+ * Does this client carry a signed-in session? For skipping reads only a signed-in person can make;
  * "no session" means an empty result, never a way around a reader a guest needs.
  */
 export declare function hasBrowserSession(): Promise<boolean>;

package/dist/host/identity.js

@@ -40,11 +40,11 @@ function requireUserId() {
   if (!id) throw new NotAuthenticatedError();
   return id;
 }
-async function hasBrowserSession() {
-  if (!chatHostHasDatabase()) return false;
-  let db;
+async function readSessionToken() {
+  if (!chatHostHasDatabase()) return null;
+  let host;
   try {
-    db = getChatHost().db;
+    host = getChatHost();
   } catch (error) {
     announceOnce(
       "identity:no-host-session",
@@ -52,16 +52,22 @@ async function hasBrowserSession() {
         error?.message ?? error
       )}).`
     );
-    return false;
+    return null;
   }
   try {
-    const {
-      data: { session }
-    } = await db.auth.getSession();
-    return Boolean(session);
+    return await host.identity.getAccessToken();
   } catch {
-    return false;
+    return null;
+  }
+}
+const hostSessionSource = {
+  async getSession() {
+    const token = await readSessionToken();
+    return { data: { session: token ? { access_token: token } : null }, error: null };
   }
+};
+async function hasBrowserSession() {
+  return await readSessionToken() !== null;
 }
 async function isSignedOutVisitor() {
   return !getUserId() && !await hasBrowserSession();
@@ -70,8 +76,10 @@ export {
   NotAuthenticatedError,
   getUserId,
   hasBrowserSession,
+  hostSessionSource,
   isNotAuthenticatedError,
   isSignedOutVisitor,
+  readSessionToken,
   requireUserId,
   selectAccessToken,
   selectActiveUserName,

package/dist/host/session-retry.js

@@ -1,11 +1,11 @@
 import { createSessionRetry } from "@ai-matrx/data/db";
-import { supabase } from "./db.js";
+import { hostSessionSource } from "./identity.js";
 import {
   isMissingSessionError,
   SessionUnavailableError
 } from "@ai-matrx/data/db";
 const runWithSessionRetry = createSessionRetry({
-  auth: { getSession: () => supabase.auth.getSession() }
+  auth: hostSessionSource
 });
 export {
   SessionUnavailableError,

package/dist/mandates/llm-params.d.ts

@@ -5,6 +5,6 @@
  * keys the client run path honours. Field by field, no casts; unknown keys
  * are dropped LOUDLY (the server's apply_overrides stays the authority).
  */
-import type { JsonObject } from "../utils/json.js";
+import type { JsonObject } from "@ai-matrx/rich-content/utils/json";
 import type { FeLlmParams } from "../agents/types/agent-api-types.js";
 export declare function toLlmParams(obj: JsonObject): Partial<FeLlmParams>;

package/dist/mandates/output-contract.js

@@ -1,5 +1,5 @@
 import { createClient } from "../host/db.js";
-import { isJsonObject } from "../utils/json.js";
+import { isJsonObject } from "@ai-matrx/rich-content/utils/json";
 import { hasBrowserSession } from "../host/identity.js";
 function outputSchemaKeys(outputSchema) {
   if (!isJsonObject(outputSchema)) return /* @__PURE__ */ new Set();

package/dist/mandates/service.d.ts

@@ -1,7 +1,7 @@
 import type { FeLlmParams } from "../agents/types/agent-api-types.js";
 import { type OrganizationAdmission } from "../host/server/organization-admission.js";
 import { type MandateContract } from "@ai-matrx/agents/mandates";
-import type { JsonObject } from "../utils/json.js";
+import type { JsonObject } from "@ai-matrx/rich-content/utils/json";
 import type { AnyMandateKey } from "@ai-matrx/agents/mandates";
 import { type BindingPresentation } from "../ui/treatment-shape.js";
 export interface ResolvedMandate {

package/dist/mandates/service.js

@@ -1,7 +1,7 @@
 "use client";
 import { createClient } from "../host/db.js";
 import { getClaimsUser } from "../host/db.js";
-import { isJsonObject } from "../utils/json.js";
+import { isJsonObject } from "@ai-matrx/rich-content/utils/json";
 import { recordUnavailable } from "../host/diagnostics.js";
 import { apiGet, buildPath } from "../host/server/typed-client.js";
 import { BackendApiError } from "@ai-matrx/agents/matrx";

package/dist/mandates/test-run-core.js

@@ -1,5 +1,5 @@
 "use client";
-import { isJsonObject } from "../utils/json.js";
+import { isJsonObject } from "@ai-matrx/rich-content/utils/json";
 import { usableServerNotes } from "../ui/usable-server-notes.js";
 function readMandateRunHolder(result) {
   if (!isJsonObject(result)) {

package/dist/public-chat/components/PublicMessageOptionsMenu.js

@@ -26,7 +26,7 @@ import { useAppSelector as useSelector } from "../../store/hooks.js";
 import { selectIsAuthenticated } from "../../host/identity.js";
 import { useAppDispatch } from "../../store/hooks.js";
 import { openOverlay, CHAT_WINDOWS } from "../../host/windows.js";
-import { kindTextToMarkdown } from "../../utils/content-ir/surfaces/kind-text-to-markdown.js";
+import { kindTextToMarkdown } from "@ai-matrx/content-ir/surfaces";
 import { removeCodeSpans, replaceFences } from "@ai-matrx/content-ir/source";
 import { selectOrganizationId, ensureOrganizationContext, isOrganizationSelectionCancelled } from "../../host/org.js";
 import { downloadFile } from "@ai-matrx/kit/download";

package/dist/surfaces/services/bind-agent-to-surface.service.js

@@ -16,6 +16,7 @@ import { ensureOrgAvailability } from "../../host/ui-slots.js";
 import { assertMappingsAreAnswerable } from "../../ui/mandates-storage/provision-shapes.js";
 import { ensureOrgId } from "../../host/org.js";
 import { readProjectScopeOrganizationId } from "../../host/ui-slots.js";
+import { hasBrowserSession } from "../../host/identity.js";
 function tierFromScope(scope) {
   if (scope.userId) return "user";
   if (scope.organizationId) return "org";
@@ -359,10 +360,7 @@ async function listAgentSurfaceBindings(agentId) {
 async function fetchSurfaceBindingLayers(agentId, surfaceName) {
   const chain = [...getSurfaceAncestry(surfaceName), surfaceName];
   const sb = createClient();
-  const {
-    data: { session }
-  } = await sb.auth.getSession();
-  if (!session) return [];
+  if (!await hasBrowserSession()) return [];
   const { data, error } = await sb.schema("agent").from("menu_surface").select(MENU_SURFACE_COLUMNS).eq("agent_id", agentId).in("surface_name", chain);
   if (error) throw error;
   const rows = (data ?? []).map(fromRow).filter(

package/dist/surfaces/services/surface-config.service.js

@@ -3,7 +3,7 @@ import { storedMandateKey } from "@ai-matrx/agents/mandates";
 import { createClient } from "../../host/db.js";
 import { writeOne } from "@ai-matrx/data/db";
 import { getClaimsUser } from "../../host/db.js";
-import { isJsonObject } from "../../utils/json.js";
+import { isJsonObject } from "@ai-matrx/rich-content/utils/json";
 import { fetchMandatePins } from "../../mandates/service.js";
 import {
   getNamespaceHandler,

package/dist/tool-call-visualization/components/ToolCallBatch.js

@@ -4,7 +4,7 @@ import { useEffect, useState } from "react";
 import { ChevronDown, ChevronRight } from "lucide-react";
 import { cn } from "@ai-matrx/design-system";
 import { useAppSelector } from "../../store/hooks.js";
-import { ShimmerText } from "../../ui/ShimmerText.js";
+import { ShimmerText } from "@ai-matrx/rich-content/utils/lifted/ShimmerText";
 import { getToolDisplayName } from "../registry/registry.js";
 import { DIFF_START_OPEN_KNOB, readSurfaceWrite } from "../surface-write/readSurfaceWrite.js";
 import { holdsADecision } from "./holdsADecision.js";

package/dist/tool-call-visualization/components/ToolCallVisualization.js

@@ -11,7 +11,7 @@ import { cn } from "@ai-matrx/design-system";
 import { useAppDispatch, useAppSelector } from "../../store/hooks.js";
 import { smartExecute } from "../../agents/redux/execution-system/thunks/smart-execute.thunk.js";
 import { openOverlay, CHAT_WINDOWS } from "../../host/windows.js";
-import { ShimmerText } from "../../ui/ShimmerText.js";
+import { ShimmerText } from "@ai-matrx/rich-content/utils/lifted/ShimmerText";
 import {
   getInlineRenderer,
   getToolDisplayName,