@ai-matrx/chat 0.4.12 → 0.4.15

package/dist/host/contract.d.ts

@@ -738,6 +738,34 @@ export interface ChatAppIdentity {
  * `"local-only"` (confidential) conversation refuses every target but the Matrx Local engine on this
  * computer, loudly, before a byte leaves the machine. Default: `"any"` for every conversation.
  */
+/** What a device-tool run answered (the same shape the browser-extension bridge answers). */
+export type ChatDeviceToolInvocation = {
+    handled: false;
+    reason: string;
+} | {
+    handled: true;
+    ok: true;
+    output: Record<string, unknown>;
+} | {
+    handled: true;
+    ok: false;
+    error: string;
+};
+/**
+ * Tools that run ON THIS DEVICE for a cloud agent (lanes/agents-chat-proposal.md W0(c)): the
+ * browser tools when the chat runs inside Matrx Extend, local machine tools in a desktop host. The
+ * package owns the whole loop around them — the delegated call's lifecycle, the durable result
+ * submit with retry, and the resume (`surfaceDelegatedToolCall` → `submitToolResult`); the host
+ * only executes. `handled: false` = "not a tool this device owns" (the model is told, never a
+ * wedge). Absent: delegated device tools go to the installed browser extension through the server
+ * port (`invokeMatrxExtendTool`), as on the web.
+ */
+export interface ChatDeviceToolsPort {
+    invoke(toolName: string, args: Record<string, unknown>, context: {
+        conversationId: string;
+        callId: string;
+    }): Promise<ChatDeviceToolInvocation>;
+}
 export interface ChatRoutingPort {
     policy(conversationId: string): ChatRoutingPolicy;
 }
@@ -767,7 +795,16 @@ export interface ChatHost {
      * that is not matrx-frontend never labels its rows as the main app's.
      */
     app?: ChatAppIdentity;
-    /** Default: from db.auth (getSession + onAuthStateChange); admin level from admin.admins. */
+    /**
+     * The token function a token-only client was built with (supabase-js `accessToken` option, the
+     * matrx-local custodian shape): pass the SAME function here and the default identity reads who is
+     * signed in from it. A token-only `db` without it is signed out, announced once with this remedy.
+     */
+    accessToken?: () => Promise<string | null>;
+    /**
+     * Default: from db.auth (getSession + onAuthStateChange); for a token-only `db`, from
+     * `accessToken`. Admin level from admin.admins either way.
+     */
     identity?: ChatIdentityPort;
     /** Default: no active org; `require` refuses loudly (never auto-picks). */
     org?: ChatOrgPort;
@@ -803,8 +840,10 @@ export interface ChatHost {
     canvas?: ChatCanvasPort;
     /** Default: every conversation may go to any target (`"any"`). */
     routing?: ChatRoutingPort;
+    /** Default: none — delegated device tools go to the browser extension via the server port. */
+    deviceTools?: ChatDeviceToolsPort;
 }
-export type ChatPortName = "identity" | "org" | "server" | "notify" | "diagnostics" | "prefs" | "navigation" | "windows" | "catalog" | "registry" | "chrome" | "feedback" | "routes" | "canvas" | "routing";
+export type ChatPortName = "identity" | "org" | "server" | "notify" | "diagnostics" | "prefs" | "navigation" | "windows" | "catalog" | "registry" | "chrome" | "feedback" | "routes" | "canvas" | "routing" | "deviceTools";
 /** Every port present. `overridden` names the ports the host supplied itself. */
 export interface ResolvedChatHost {
     /** The host's client, or the no-database stand-in when it gave only a `source`. */
@@ -831,5 +870,7 @@ export interface ResolvedChatHost {
     routes: ChatRoutes;
     canvas: ChatCanvasPort;
     routing: ChatRoutingPort;
+    /** The host's on-device tool executor, or null. */
+    deviceTools: ChatDeviceToolsPort | null;
     overridden: ReadonlySet<ChatPortName>;
 }

package/dist/host/db-types.d.ts

@@ -16251,6 +16251,10 @@ export type ChatDatabase = {
                     token: string;
                 }[];
             };
+            access_shadow_status: {
+                Args: never;
+                Returns: Json;
+            };
             accessible_child_parents: {
                 Args: {
                     p_child_type: string;
@@ -17034,12 +17038,25 @@ export type ChatDatabase = {
                 Args: never;
                 Returns: boolean;
             };
+            kernel_set_form_on: {
+                Args: {
+                    p_person: string;
+                };
+                Returns: boolean;
+            };
             kernel_shadow_on: {
                 Args: {
                     p_person: string;
                 };
                 Returns: boolean;
             };
+            kernel_shadow_sweep: {
+                Args: {
+                    p_people?: number;
+                    p_tables?: number;
+                };
+                Returns: Json;
+            };
             lane_of: {
                 Args: {
                     p_resource_id: string;
@@ -19866,6 +19883,21 @@ export type ChatDatabase = {
                     version_live: boolean;
                 }[];
             };
+            run_history: {
+                Args: {
+                    p_agent_id?: string;
+                    p_desc?: boolean;
+                    p_limit?: number;
+                    p_mandate_key?: string;
+                    p_offset?: number;
+                    p_org_id?: string;
+                    p_sort?: string;
+                    p_status?: string;
+                    p_user_id?: string;
+                    p_view?: string;
+                };
+                Returns: Json;
+            };
             sanitize_app_segment: {
                 Args: {
                     p_seg: string;
@@ -28302,6 +28334,26 @@ export type ChatDatabase = {
                 };
                 Returns: Json;
             };
+            _drill_fine_agg_sql: {
+                Args: {
+                    p_cnt: string;
+                    p_col: string;
+                    p_filter?: string;
+                    p_measure: Json;
+                    p_once: string;
+                };
+                Returns: string;
+            };
+            _drill_fine_ratio_sql: {
+                Args: {
+                    p_cnt: string;
+                    p_filter?: string;
+                    p_measure: Json;
+                    p_once: string;
+                    p_prefix: string;
+                };
+                Returns: string;
+            };
             _drill_fk: {
                 Args: {
                     p_column: string;
@@ -30411,6 +30463,10 @@ export type ChatDatabase = {
                 Args: never;
                 Returns: Json;
             };
+            drill_def__account_roster: {
+                Args: never;
+                Returns: Json;
+            };
             drill_def__agents_by_model: {
                 Args: never;
                 Returns: Json;
@@ -30427,10 +30483,46 @@ export type ChatDatabase = {
                 Args: never;
                 Returns: Json;
             };
+            drill_def__app_log: {
+                Args: never;
+                Returns: Json;
+            };
+            drill_def__crm_deals: {
+                Args: never;
+                Returns: Json;
+            };
+            drill_def__cx_requests: {
+                Args: never;
+                Returns: Json;
+            };
+            drill_def__hr_timesheets: {
+                Args: never;
+                Returns: Json;
+            };
             drill_def__kg_cost: {
                 Args: never;
                 Returns: Json;
             };
+            drill_def__ops_issue_events: {
+                Args: never;
+                Returns: Json;
+            };
+            drill_def__rs_analyses: {
+                Args: never;
+                Returns: Json;
+            };
+            drill_def__rs_syntheses: {
+                Args: never;
+                Returns: Json;
+            };
+            drill_def__system_errors: {
+                Args: never;
+                Returns: Json;
+            };
+            drill_def__tool_calls: {
+                Args: never;
+                Returns: Json;
+            };
             drill_def__tool_refetch: {
                 Args: never;
                 Returns: Json;
@@ -30443,6 +30535,10 @@ export type ChatDatabase = {
                 Args: never;
                 Returns: Json;
             };
+            drill_def__write_failures: {
+                Args: never;
+                Returns: Json;
+            };
             drill_definition_problems: {
                 Args: {
                     p_def: Json;
@@ -51605,6 +51701,22 @@ export type ChatDatabase = {
             };
         };
         Views: {
+            _account_facts: {
+                Row: {
+                    blocked: boolean | null;
+                    campaign: string | null;
+                    cost: number | null;
+                    created_at: string | null;
+                    identity_state: string | null;
+                    person_id: string | null;
+                    plan_key: string | null;
+                    plan_name: string | null;
+                    referrer_host: string | null;
+                    requests: number | null;
+                    traffic_kind: string | null;
+                };
+                Relationships: [];
+            };
             _acquisition_facts: {
                 Row: {
                     blocked: boolean | null;

package/dist/host/db.js

@@ -3,6 +3,7 @@ import {
   AuthSessionMissingError
 } from "@supabase/supabase-js";
 import { getChatHost } from "./configure.js";
+import { decodeTokenClaims, isTokenOnlyClient } from "./defaults/identity.js";
 function createClient() {
   return getChatHost().db;
 }
@@ -35,6 +36,11 @@ function userFromClaims(claims) {
   };
 }
 async function getClaimsUser(client, jwt) {
+  if (isTokenOnlyClient(client)) {
+    const token = jwt ?? await getChatHost().identity.getAccessToken().catch(() => null);
+    const claims = token ? decodeTokenClaims(token) : null;
+    return { data: { user: userFromClaims(claims ?? void 0) }, error: null };
+  }
   const { data, error } = await client.auth.getClaims(jwt);
   if (error) {
     if (isSignedOutError(error)) return { data: { user: null }, error: null };

package/dist/host/defaults/diagnostics.d.ts

@@ -27,6 +27,11 @@ export interface LogClientErrorDiagnosticsOptions {
     /** Default: `process.env.NODE_ENV === "production"`. */
     persist?: boolean;
     flushDelayMs?: number;
+    /**
+     * Is someone signed in? The resolver passes the identity port's answer, so a token-only client
+     * works. Default (a db with an auth-js session): `db.auth.getSession()`.
+     */
+    signedIn?: () => Promise<boolean>;
 }
 export declare function isChatSourceApp(value: unknown): value is ChatSourceApp;
 export declare function createLogClientErrorDiagnostics(db: ChatDb, options: LogClientErrorDiagnosticsOptions): ChatDiagnosticsPort;

package/dist/host/defaults/diagnostics.js

@@ -59,8 +59,7 @@ function createLogClientErrorDiagnostics(db, options) {
     if (queue.length === 0) return;
     let signedIn = false;
     try {
-      const { data } = await db.auth.getSession();
-      signedIn = Boolean(data.session?.user);
+      signedIn = options.signedIn ? await options.signedIn() : Boolean((await db.auth.getSession()).data.session?.user);
     } catch {
       signedIn = false;
     }

package/dist/host/defaults/identity.d.ts

@@ -3,6 +3,32 @@
  * admin level from `admin.admins` (RLS: a person reads their own row). Starts
  * on first use, never at import, so SSR and tests that never ask pay nothing.
  */
+import type { User } from "@supabase/supabase-js";
 import type { ChatDb, ChatDiagnosticsPort, ChatIdentity, ChatIdentityPort } from "../contract.js";
 export declare const SIGNED_OUT_IDENTITY: ChatIdentity;
 export declare function createDbIdentity(db: ChatDb, diagnostics: () => ChatDiagnosticsPort): ChatIdentityPort;
+/**
+ * Is this a supabase-js client built with the `accessToken` option? Such a client has no auth-js
+ * session: touching `db.auth` throws by construction (matrx-local's custodian client is one). The
+ * probe reads the property inside a try, so it never throws itself.
+ */
+export declare function isTokenOnlyClient(db: unknown): boolean;
+/** A JWT's payload as an object (no verification — routing metadata only). */
+export declare function decodeTokenClaims(token: string): Record<string, unknown> | null;
+/**
+ * The person a token names, read from its claims — routing metadata, not verification (the
+ * server and RLS verify every call that token makes). `null` when the token names nobody.
+ */
+export declare function userFromAccessToken(token: string | null): User | null;
+/**
+ * Identity for a token-only client: the host hands the same `accessToken` function it gave
+ * supabase-js, and the package reads who is signed in from it. Every `getAccessToken()` re-reads
+ * the token, so a refresh or an account switch reaches the snapshot (and its subscribers) the next
+ * time anything asks; admin level is read through `db` exactly like the session default.
+ */
+export declare function createTokenIdentity(db: ChatDb, getToken: () => Promise<string | null>, diagnostics: () => ChatDiagnosticsPort): ChatIdentityPort;
+/**
+ * A token-only client with no `accessToken` function: nobody can be read. Signed out and settled
+ * (never a forever-loading screen), announced once with the remedy.
+ */
+export declare function createUnreadableTokenIdentity(announce: (message: string) => void): ChatIdentityPort;

package/dist/host/defaults/identity.js

@@ -113,7 +113,139 @@ function createDbIdentity(db, diagnostics) {
     }
   };
 }
+function isTokenOnlyClient(db) {
+  if (db === null || typeof db !== "object") return false;
+  try {
+    const auth = db.auth;
+    if (!auth) return true;
+    void auth.getSession;
+    return false;
+  } catch {
+    return true;
+  }
+}
+function decodeTokenClaims(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+  try {
+    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+    const parsed = JSON.parse(
+      typeof atob === "function" ? atob(padded) : Buffer.from(padded, "base64").toString("utf8")
+    );
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function userFromAccessToken(token) {
+  if (!token) return null;
+  const claims = decodeTokenClaims(token);
+  if (!claims || typeof claims.sub !== "string" || !claims.sub) return null;
+  const meta = claims.user_metadata;
+  const appMeta = claims.app_metadata;
+  return {
+    id: claims.sub,
+    email: typeof claims.email === "string" ? claims.email : void 0,
+    user_metadata: meta !== null && typeof meta === "object" ? meta : {},
+    app_metadata: appMeta !== null && typeof appMeta === "object" ? appMeta : {},
+    aud: typeof claims.aud === "string" ? claims.aud : "authenticated",
+    created_at: ""
+  };
+}
+function createTokenIdentity(db, getToken, diagnostics) {
+  let snapshot = SIGNED_OUT_IDENTITY;
+  let started = false;
+  let adminFor = null;
+  const listeners = /* @__PURE__ */ new Set();
+  function publish(next) {
+    if (snapshot.userId === next.userId && snapshot.accessToken === next.accessToken && snapshot.adminLevel === next.adminLevel && snapshot.authReady === next.authReady) {
+      return;
+    }
+    snapshot = next;
+    for (const listener of listeners) listener();
+  }
+  async function readAdminLevel(userId) {
+    try {
+      const { data, error } = await db.schema("admin").from("admins").select("level").eq("user_id", userId).maybeSingle();
+      if (error) throw error;
+      const level = data?.level;
+      return ADMIN_LEVELS.includes(level) ? level : null;
+    } catch (error) {
+      diagnostics().capture(error, { area: "identity", code: "admin-level-unreadable" });
+      return null;
+    }
+  }
+  async function refresh() {
+    let token;
+    try {
+      token = await getToken();
+    } catch (error) {
+      diagnostics().capture(error, { area: "identity", code: "access-token-unreadable" });
+      token = null;
+    }
+    const user = userFromAccessToken(token);
+    const level = user && user.id === snapshot.userId ? snapshot.adminLevel : null;
+    publish(identityFromUser(user, level, user ? token : null));
+    if (user && adminFor !== user.id) {
+      adminFor = user.id;
+      const read = await readAdminLevel(user.id);
+      if (snapshot.userId === user.id) publish(identityFromUser(user, read, snapshot.accessToken));
+    }
+    return user ? token : null;
+  }
+  function start() {
+    if (started) return;
+    started = true;
+    void refresh();
+  }
+  return {
+    current() {
+      start();
+      return snapshot;
+    },
+    subscribe(listener) {
+      start();
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    getAccessToken: refresh
+  };
+}
+function createUnreadableTokenIdentity(announce) {
+  const value = Object.freeze({ ...SIGNED_OUT_IDENTITY, authReady: true });
+  let said = false;
+  const say = () => {
+    if (said) return;
+    said = true;
+    announce(
+      "This chat's database client was built with an access-token function, so the chat cannot read who is signed in. Pass the same function to the chat host as `accessToken`."
+    );
+  };
+  return {
+    current() {
+      say();
+      return value;
+    },
+    subscribe() {
+      say();
+      return () => {
+      };
+    },
+    async getAccessToken() {
+      say();
+      return null;
+    }
+  };
+}
 export {
   SIGNED_OUT_IDENTITY,
-  createDbIdentity
+  createDbIdentity,
+  createTokenIdentity,
+  createUnreadableTokenIdentity,
+  decodeTokenClaims,
+  isTokenOnlyClient,
+  userFromAccessToken
 };

package/dist/host/identity.d.ts

@@ -50,8 +50,25 @@ export declare function isNotAuthenticatedError(error: unknown): error is NotAut
 /** The signed-in person's id; throws `NotAuthenticatedError` when nobody is. */
 export declare function requireUserId(): string;
 /**
- * Does this client carry a signed-in session? A local read of the host's
- * `db.auth` (no network). For skipping reads only a signed-in person can make;
+ * The signed-in person's access token, or null — THE one session read in the package. It goes
+ * through the host's identity port, so a session client (auth-js) and a token-only client
+ * (`ChatHost.accessToken`) answer the same way; nothing else in the package touches `db.auth`
+ * (guard: `host/__tests__/session-reads-go-through-the-identity-port.test.ts`).
+ */
+export declare function readSessionToken(): Promise<string | null>;
+/** `readSessionToken` in the structural shape `@ai-matrx/data`'s session retry reads. */
+export declare const hostSessionSource: {
+    getSession(): Promise<{
+        data: {
+            session: {
+                access_token: string;
+            } | null;
+        };
+        error: null;
+    }>;
+};
+/**
+ * Does this client carry a signed-in session? For skipping reads only a signed-in person can make;
  * "no session" means an empty result, never a way around a reader a guest needs.
  */
 export declare function hasBrowserSession(): Promise<boolean>;

package/dist/host/identity.js

@@ -40,11 +40,11 @@ function requireUserId() {
   if (!id) throw new NotAuthenticatedError();
   return id;
 }
-async function hasBrowserSession() {
-  if (!chatHostHasDatabase()) return false;
-  let db;
+async function readSessionToken() {
+  if (!chatHostHasDatabase()) return null;
+  let host;
   try {
-    db = getChatHost().db;
+    host = getChatHost();
   } catch (error) {
     announceOnce(
       "identity:no-host-session",
@@ -52,16 +52,22 @@ async function hasBrowserSession() {
         error?.message ?? error
       )}).`
     );
-    return false;
+    return null;
   }
   try {
-    const {
-      data: { session }
-    } = await db.auth.getSession();
-    return Boolean(session);
+    return await host.identity.getAccessToken();
   } catch {
-    return false;
+    return null;
+  }
+}
+const hostSessionSource = {
+  async getSession() {
+    const token = await readSessionToken();
+    return { data: { session: token ? { access_token: token } : null }, error: null };
   }
+};
+async function hasBrowserSession() {
+  return await readSessionToken() !== null;
 }
 async function isSignedOutVisitor() {
   return !getUserId() && !await hasBrowserSession();
@@ -70,8 +76,10 @@ export {
   NotAuthenticatedError,
   getUserId,
   hasBrowserSession,
+  hostSessionSource,
   isNotAuthenticatedError,
   isSignedOutVisitor,
+  readSessionToken,
   requireUserId,
   selectAccessToken,
   selectActiveUserName,

package/dist/host/session-retry.js

@@ -1,11 +1,11 @@
 import { createSessionRetry } from "@ai-matrx/data/db";
-import { supabase } from "./db.js";
+import { hostSessionSource } from "./identity.js";
 import {
   isMissingSessionError,
   SessionUnavailableError
 } from "@ai-matrx/data/db";
 const runWithSessionRetry = createSessionRetry({
-  auth: { getSession: () => supabase.auth.getSession() }
+  auth: hostSessionSource
 });
 export {
   SessionUnavailableError,

package/dist/host/ui-slots.js

@@ -18,7 +18,8 @@ function slotComponent(name, Fallback) {
   const Wrapper = (props) => {
     const Impl = slots[name];
     if (!Impl) {
-      reportUnregistered(name, Fallback ? "a plain stand-in is drawn" : "it renders nothing here");
+      const absent = !Fallback || Fallback.optionalAbsent;
+      reportUnregistered(name, absent ? "it renders nothing here" : "a plain stand-in is drawn");
       return Fallback ? createElement(Fallback, props) : null;
     }
     return createElement(Impl, props);
@@ -35,6 +36,12 @@ function unregisteredWidget(name) {
   UnregisteredWidget.displayName = `UnregisteredWidget(${name})`;
   return UnregisteredWidget;
 }
+function optionalWidget(name) {
+  const AbsentOptionalWidget = () => null;
+  AbsentOptionalWidget.displayName = `AbsentOptionalWidget(${name})`;
+  AbsentOptionalWidget.optionalAbsent = true;
+  return AbsentOptionalWidget;
+}
 function hostSlot(name, Fallback) {
   return slotComponent(name, Fallback);
 }
@@ -160,7 +167,7 @@ function slotFn(name, declared) {
 const CopyButtons = slotComponent("CopyButtons");
 const InfoHint = slotComponent("InfoHint");
 const AnswerValueView = slotComponent("AnswerValueView");
-const ErrorAlchemyMenu = slotComponent("ErrorAlchemyMenu", unregisteredWidget("ErrorAlchemyMenu"));
+const ErrorAlchemyMenu = slotComponent("ErrorAlchemyMenu", optionalWidget("ErrorAlchemyMenu"));
 const ErrorNotice = slotComponent(
   "ErrorNotice",
   ({ title, message, error, actions, children, className }) => createElement(
@@ -187,16 +194,16 @@ const NonEditableContextMenu = slotComponent("NonEditableContextMenu", contentWi
 const TableChooser = slotComponent("TableChooser");
 const FileResourceChip = slotComponent("FileResourceChip");
 const ConnectorMark = slotComponent("ConnectorMark");
-const MessageFilesStrip = slotComponent("MessageFilesStrip", unregisteredWidget("MessageFilesStrip"));
-const RulebookNudge = slotComponent("RulebookNudge", unregisteredWidget("RulebookNudge"));
-const NegativeVerdictFollowUp = slotComponent("NegativeVerdictFollowUp", unregisteredWidget("NegativeVerdictFollowUp"));
-const SpeakerButton = slotComponent("SpeakerButton", unregisteredWidget("SpeakerButton"));
-const GmailReviewCard = slotComponent("GmailReviewCard", unregisteredWidget("GmailReviewCard"));
-const ShareButton = slotComponent("ShareButton", unregisteredWidget("ShareButton"));
-const ShareModal = slotComponent("ShareModal", unregisteredWidget("ShareModal"));
-const ReviewAnswersLink = slotComponent("ReviewAnswersLink", unregisteredWidget("ReviewAnswersLink"));
-const RecordChangeApprovalCard = slotComponent("RecordChangeApprovalCard", unregisteredWidget("RecordChangeApprovalCard"));
-const AttachedResourcesSection = slotComponent("AttachedResourcesSection", unregisteredWidget("AttachedResourcesSection"));
+const MessageFilesStrip = slotComponent("MessageFilesStrip", optionalWidget("MessageFilesStrip"));
+const RulebookNudge = slotComponent("RulebookNudge", optionalWidget("RulebookNudge"));
+const NegativeVerdictFollowUp = slotComponent("NegativeVerdictFollowUp", optionalWidget("NegativeVerdictFollowUp"));
+const SpeakerButton = slotComponent("SpeakerButton", optionalWidget("SpeakerButton"));
+const GmailReviewCard = slotComponent("GmailReviewCard", optionalWidget("GmailReviewCard"));
+const ShareButton = slotComponent("ShareButton", optionalWidget("ShareButton"));
+const ShareModal = slotComponent("ShareModal", optionalWidget("ShareModal"));
+const ReviewAnswersLink = slotComponent("ReviewAnswersLink", optionalWidget("ReviewAnswersLink"));
+const RecordChangeApprovalCard = slotComponent("RecordChangeApprovalCard", optionalWidget("RecordChangeApprovalCard"));
+const AttachedResourcesSection = slotComponent("AttachedResourcesSection", optionalWidget("AttachedResourcesSection"));
 const ConnectorPromptHost = slotComponent("ConnectorPromptHost");
 const WebpageSnapshotView = slotComponent("WebpageSnapshotView", DefaultWebpageSnapshotView);
 function hostFn(name, fallback) {
@@ -230,16 +237,16 @@ const traceWarRoomRenderPath = slotFn("traceWarRoomRenderPath", () => void 0);
 const isWarRoomThreadAgentSurface = slotFn("isWarRoomThreadAgentSurface", () => false);
 const useOpenCloudBrowserCanvas = slotFn("useOpenCloudBrowserCanvas", () => () => void 0);
 const cloudBrowserCanvasSourceId = slotFn("cloudBrowserCanvasSourceId", (conversationId) => `cloud-browser:${conversationId}`);
-const SystemInstructionModal = slotComponent("SystemInstructionModal", unregisteredWidget("SystemInstructionModal"));
+const SystemInstructionModal = slotComponent("SystemInstructionModal", optionalWidget("SystemInstructionModal"));
 const WindowPanel = slotComponent("WindowPanel", DefaultWindowPanel);
 const FullScreenOverlay = slotComponent("FullScreenOverlay", DefaultFullScreenOverlay);
-const ResourcePickerWindow = slotComponent("ResourcePickerWindow", unregisteredWidget("ResourcePickerWindow"));
-const ResourcePickerMenu = slotComponent("ResourcePickerMenu", unregisteredWidget("ResourcePickerMenu"));
-const FilesResourcePicker = slotComponent("FilesResourcePicker", unregisteredWidget("FilesResourcePicker"));
-const NotePickerPopover = slotComponent("NotePickerPopover", unregisteredWidget("NotePickerPopover"));
+const ResourcePickerWindow = slotComponent("ResourcePickerWindow", optionalWidget("ResourcePickerWindow"));
+const ResourcePickerMenu = slotComponent("ResourcePickerMenu", optionalWidget("ResourcePickerMenu"));
+const FilesResourcePicker = slotComponent("FilesResourcePicker", optionalWidget("FilesResourcePicker"));
+const NotePickerPopover = slotComponent("NotePickerPopover", optionalWidget("NotePickerPopover"));
 const SmartInputMessageTemplatePicker = slotComponent(
   "SmartInputMessageTemplatePicker",
-  unregisteredWidget("SmartInputMessageTemplatePicker")
+  optionalWidget("SmartInputMessageTemplatePicker")
 );
 const flattenResourcePickerItems = slotFn("flattenResourcePickerItems", defaultResourcePickerItems);
 const useRunControlCounts = slotFn("useRunControlCounts", () => ({}));
@@ -253,8 +260,8 @@ const emitFullScreenEditorSave = slotFn(
   () => Promise.reject(new Error("This host has no full-screen editor save target"))
 );
 const FileRagBadge = slotComponent("FileRagBadge");
-const MediaAttachmentThumbnail = slotComponent("MediaAttachmentThumbnail", unregisteredWidget("MediaAttachmentThumbnail"));
-const UnifiedImageBlockRenderer = slotComponent("UnifiedImageBlockRenderer", unregisteredWidget("UnifiedImageBlockRenderer"));
+const MediaAttachmentThumbnail = slotComponent("MediaAttachmentThumbnail", optionalWidget("MediaAttachmentThumbnail"));
+const UnifiedImageBlockRenderer = slotComponent("UnifiedImageBlockRenderer", optionalWidget("UnifiedImageBlockRenderer"));
 const MicrophoneIconButton = slotComponent("MicrophoneIconButton");
 const TranscriptionLoader = slotComponent("TranscriptionLoader");
 const MicDeviceMenu = slotComponent("MicDeviceMenu");