@ai-matrx/kit 0.9.2 → 0.10.0

package/dist/opener.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/opener.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/opener — THE opener pattern, once.\n *\n * An \"opener\" is the imperative half of a global dialog: a pure-TS function\n * you can `await` from anywhere (a Redux thunk, a util, a sync handler, an\n * async pipeline) that resolves with what the user chose, plus a registry a\n * React host attaches itself to on mount. The whole point is that the CALL\n * SITE never imports the dialog: the opener is zero-React, zero-markup,\n * zero-CSS, so hundreds of static call sites cost nothing and the heavy body\n * stays behind a lazy host.\n *\n * This module is the generic engine. `./confirm-opener` is a three-line\n * specialisation of it, and so is every app-side opener — the sandbox gate,\n * the scope-mismatch gate, the value prompts. Before this existed each one\n * hand-rolled the same `let host`, the same `queue`, the same\n * `_registerHost` drain loop, the same never-resolve-silently promise; four\n * copies of one contract, three of them with module-level state that would\n * have split across loader graphs the moment they left the app.\n *\n * THE CONTRACT — every opener made here behaves identically:\n *\n *  • ONE host at a time. It registers on mount and unregisters on unmount;\n *    a late unmount of a SUPERSEDED host never tears down the live one\n *    (the React double-mount / provider-swap case).\n *  • NEVER a silent default. With no host mounted, `open()` does NOT resolve\n *    to some assumed yes/no — the promise stays pending and the request\n *    queues, so a destructive action fired in the first ~50ms after page load\n *    still gets a real dialog once the host hydrates. Requests are served in\n *    call order.\n *  • NOTHING FAILS SILENTLY (platform law 4). \"Stays pending\" would be an\n *    invisible hang if the host is never mounted at all, so an opener that\n *    has waited `warnWithoutHostAfterMs` with a queued request SCREAMS on the\n *    console, naming the remedy (`hostHint`) — once per opener, cleared the\n *    moment a host registers.\n *  • DEDUPE is opt-in. With a `dedupeKey`, a second `open()` for the same key\n *    while the first is unsettled returns THE SAME promise instead of\n *    stacking a second dialog (double-clicked send buttons).\n *  • CANCELLATION is opt-in per call. Pass an `AbortSignal` and the pending\n *    request is dropped from the queue and settled — resolved with\n *    `onAbortResolveWith` when the caller supplies a neutral answer\n *    (\"cancel\"), rejected with an `AbortError` otherwise. A host that answers\n *    an already-settled request is ignored, never a double-resolve.\n *\n * 🚨 STATE LIVES ON A `globalThis` SLOT, NEVER A MODULE LOCAL. With the\n * package built `splitting: false` in dual ESM/CJS format — and the host\n * routinely living in a DIFFERENT PACKAGE from the caller — each loader graph\n * instantiates its own copy of this module. A module-level `let host` would\n * silently split host registration from the callers: the dialog mounts, the\n * caller queues into a different registry, and the promise hangs forever with\n * no error anywhere. Same hazard `@ai-matrx/tap-target` documents for its link\n * registry. Never \"clean this up\" into a module local; the tarball canary\n * proves the slot spans both graphs.\n */\n\n/** What a mounted host must provide. */\nexport interface OpenerHostController<TRequest, TResponse> {\n  show: (request: TRequest, resolve: (response: TResponse) => void) => void;\n}\n\ninterface PendingEntry<TRequest, TResponse> {\n  request: TRequest;\n  /** Wrapped resolver: settles once, then every later call is a no-op. */\n  settle: (response: TResponse) => void;\n  /** Present only while the entry is still queued (no host yet). */\n  dedupeKey: string | undefined;\n  settled: boolean;\n}\n\ninterface OpenerState<TRequest, TResponse> {\n  host: OpenerHostController<TRequest, TResponse> | null;\n  queue: PendingEntry<TRequest, TResponse>[];\n  /** Unsettled entries by dedupe key — queued AND in-flight at the host. */\n  inFlight: Map<string, { entry: PendingEntry<TRequest, TResponse>; promise: Promise<TResponse> }>;\n  warnTimer: ReturnType<typeof setTimeout> | null;\n  warned: boolean;\n}\n\nexport interface OpenerOptions<TRequest> {\n  /**\n   * Collapse concurrent duplicates. Return a stable string for requests that\n   * must not stack (the same conversation's send gate, say), or `undefined`\n   * to opt this request out of deduping.\n   */\n  dedupeKey?: ((request: TRequest) => string | undefined) | undefined;\n  /**\n   * How long a request may sit queued with no host before the opener screams\n   * on the console. `0` disables the scream (tests, deliberately host-less\n   * environments). Default 5000ms.\n   */\n  warnWithoutHostAfterMs?: number | undefined;\n  /**\n   * The remedy named in that scream — say EXACTLY what to mount and from\n   * where, e.g. `\"<ConfirmDialogHost /> from @ai-matrx/design-system\"`.\n   */\n  hostHint?: string | undefined;\n}\n\nexport interface OpenRequestOptions<TResponse> {\n  /** Abort the request: drops it from the queue and settles the promise. */\n  signal?: AbortSignal | undefined;\n  /**\n   * On abort, resolve with this value instead of rejecting. Use it when the\n   * response type already HAS a neutral answer (`\"cancel\"`, `null`) — an\n   * abort is then indistinguishable from the user dismissing the dialog, and\n   * no call site needs a try/catch.\n   */\n  onAbortResolveWith?: TResponse | undefined;\n}\n\nexport interface Opener<TRequest, TResponse> {\n  /** The `globalThis` slot name this opener's state lives under. */\n  readonly slot: string;\n  /**\n   * Open the dialog. Resolves with the host's answer. With no host mounted\n   * the request queues and the promise stays pending — never a silent\n   * default.\n   */\n  open: (request: TRequest, options?: OpenRequestOptions<TResponse>) => Promise<TResponse>;\n  /** @internal Called by the host component on mount. */\n  _registerHost: (controller: OpenerHostController<TRequest, TResponse>) => void;\n  /** @internal Called by the host component on unmount. */\n  _unregisterHost: (controller: OpenerHostController<TRequest, TResponse>) => void;\n  /** @internal Test-only: drop the registered host, the queue and the timers. */\n  _reset: () => void;\n  /** @internal Diagnostics: is a host currently registered? */\n  _hasHost: () => boolean;\n}\n\n/** Thrown to an aborted `open()` that supplied no `onAbortResolveWith`. */\nexport class OpenerAbortError extends Error {\n  override readonly name = \"AbortError\";\n  constructor(slot: string) {\n    super(`The ${slot} request was aborted before the user answered it.`);\n  }\n}\n\nfunction getState<TRequest, TResponse>(slot: string): OpenerState<TRequest, TResponse> {\n  const holder = globalThis as Record<symbol, unknown>;\n  const symbol = Symbol.for(slot);\n  let state = holder[symbol] as OpenerState<TRequest, TResponse> | undefined;\n  if (!state) {\n    state = { host: null, queue: [], inFlight: new Map(), warnTimer: null, warned: false };\n    holder[symbol] = state;\n  }\n  return state;\n}\n\n/**\n * Build an opener.\n *\n * @param slot The `globalThis` slot name — the opener's identity across every\n *   module graph in the process, so it must be globally unique and stable.\n *   Convention: `\"<owner>.<name>-opener-state\"`, e.g.\n *   `\"ai-matrx.kit.confirm-opener-state\"` or\n *   `\"matrx-frontend.sandbox-gate-opener-state\"`. Changing it after release\n *   splits live hosts from live callers — treat it as a public name.\n *\n * @example\n *   // sandboxGateOpener.ts — the whole module.\n *   const opener = createOpener<SandboxGateOptions, SandboxGateChoice>(\n *     \"matrx-frontend.sandbox-gate-opener-state\",\n *     { hostHint: \"<SandboxGateHost /> (mounted once per provider tree)\" },\n *   );\n *   export const openSandboxGate = opener.open;\n */\nexport function createOpener<TRequest, TResponse>(\n  slot: string,\n  options: OpenerOptions<TRequest> = {},\n): Opener<TRequest, TResponse> {\n  const warnAfterMs = options.warnWithoutHostAfterMs ?? 5000;\n  const hostHint = options.hostHint;\n  const dedupeKeyOf = options.dedupeKey;\n\n  function clearWarnTimer(state: OpenerState<TRequest, TResponse>): void {\n    if (state.warnTimer !== null) {\n      clearTimeout(state.warnTimer);\n      state.warnTimer = null;\n    }\n  }\n\n  function armWarnTimer(state: OpenerState<TRequest, TResponse>): void {\n    if (warnAfterMs <= 0 || state.warned || state.warnTimer !== null) return;\n    state.warnTimer = setTimeout(() => {\n      state.warnTimer = null;\n      if (state.host || state.queue.length === 0) return;\n      state.warned = true;\n      // THE SCREAM. A queued request with no host is a promise that will hang\n      // forever — invisible to the user, invisible in the network tab. Say\n      // what is stuck and exactly what to mount.\n      console.error(\n        `[@ai-matrx/kit/opener] ${state.queue.length} request(s) on \"${slot}\" have been waiting ` +\n          `${warnAfterMs}ms with no host registered, so the awaiting code is stuck and the user ` +\n          `sees nothing. REMEDY: mount ${hostHint ?? `the host for \"${slot}\"`} once, near the root ` +\n          `of this provider tree.`,\n      );\n    }, warnAfterMs);\n    // Never hold a Node process open for a diagnostic timer.\n    (state.warnTimer as unknown as { unref?: () => void }).unref?.();\n  }\n\n  function drainTo(\n    state: OpenerState<TRequest, TResponse>,\n    controller: OpenerHostController<TRequest, TResponse>,\n  ): void {\n    while (state.queue.length > 0) {\n      const next = state.queue.shift()!;\n      if (next.settled) continue;\n      controller.show(next.request, next.settle);\n    }\n  }\n\n  const opener: Opener<TRequest, TResponse> = {\n    slot,\n\n    open(request, requestOptions = {}) {\n      const state = getState<TRequest, TResponse>(slot);\n      const signal = requestOptions.signal;\n      const dedupeKey = dedupeKeyOf?.(request);\n\n      if (dedupeKey !== undefined) {\n        const existing = state.inFlight.get(dedupeKey);\n        // A duplicate NEVER stacks a second dialog: the second caller awaits\n        // the answer the first one is already asking for.\n        if (existing && !existing.entry.settled) return existing.promise;\n      }\n\n      let entry!: PendingEntry<TRequest, TResponse>;\n      const promise = new Promise<TResponse>((resolve, reject) => {\n        const finish = (run: () => void): void => {\n          if (entry.settled) return;\n          entry.settled = true;\n          if (entry.dedupeKey !== undefined) state.inFlight.delete(entry.dedupeKey);\n          const queuedAt = state.queue.indexOf(entry);\n          if (queuedAt >= 0) state.queue.splice(queuedAt, 1);\n          if (state.queue.length === 0) clearWarnTimer(state);\n          run();\n        };\n\n        entry = {\n          request,\n          dedupeKey,\n          settled: false,\n          settle: (response) => finish(() => resolve(response)),\n        };\n\n        const abort = (): void =>\n          finish(() => {\n            if (\"onAbortResolveWith\" in requestOptions && requestOptions.onAbortResolveWith !== undefined) {\n              resolve(requestOptions.onAbortResolveWith);\n            } else {\n              reject(new OpenerAbortError(slot));\n            }\n          });\n\n        if (signal?.aborted) {\n          abort();\n          return;\n        }\n        signal?.addEventListener(\"abort\", abort, { once: true });\n      });\n\n      if (entry.settled) return promise; // aborted before it ever queued\n\n      if (dedupeKey !== undefined) state.inFlight.set(dedupeKey, { entry, promise });\n\n      if (state.host) {\n        state.host.show(entry.request, entry.settle);\n      } else {\n        state.queue.push(entry);\n        armWarnTimer(state);\n      }\n      return promise;\n    },\n\n    _registerHost(controller) {\n      const state = getState<TRequest, TResponse>(slot);\n      state.host = controller;\n      state.warned = false;\n      clearWarnTimer(state);\n      drainTo(state, controller);\n    },\n\n    _unregisterHost(controller) {\n      const state = getState<TRequest, TResponse>(slot);\n      // Only the CURRENT host may unregister: a superseded host's late unmount\n      // must not tear down the live one.\n      if (state.host === controller) state.host = null;\n    },\n\n    _reset() {\n      const state = getState<TRequest, TResponse>(slot);\n      clearWarnTimer(state);\n      state.host = null;\n      state.queue.length = 0;\n      state.inFlight.clear();\n      state.warned = false;\n    },\n\n    _hasHost() {\n      return getState<TRequest, TResponse>(slot).host !== null;\n    },\n  };\n\n  return opener;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiIO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACxB,OAAO;AAAA,EACzB,YAAY,MAAc;AACxB,UAAM,OAAO,IAAI,mDAAmD;AAAA,EACtE;AACF;AAEA,SAAS,SAA8B,MAAgD;AACrF,QAAM,SAAS;AACf,QAAM,SAAS,OAAO,IAAI,IAAI;AAC9B,MAAI,QAAQ,OAAO,MAAM;AACzB,MAAI,CAAC,OAAO;AACV,YAAQ,EAAE,MAAM,MAAM,OAAO,CAAC,GAAG,UAAU,oBAAI,IAAI,GAAG,WAAW,MAAM,QAAQ,MAAM;AACrF,WAAO,MAAM,IAAI;AAAA,EACnB;AACA,SAAO;AACT;AAoBO,SAAS,aACd,MACA,UAAmC,CAAC,GACP;AAC7B,QAAM,cAAc,QAAQ,0BAA0B;AACtD,QAAM,WAAW,QAAQ;AACzB,QAAM,cAAc,QAAQ;AAE5B,WAAS,eAAe,OAA+C;AACrE,QAAI,MAAM,cAAc,MAAM;AAC5B,mBAAa,MAAM,SAAS;AAC5B,YAAM,YAAY;AAAA,IACpB;AAAA,EACF;AAEA,WAAS,aAAa,OAA+C;AACnE,QAAI,eAAe,KAAK,MAAM,UAAU,MAAM,cAAc,KAAM;AAClE,UAAM,YAAY,WAAW,MAAM;AACjC,YAAM,YAAY;AAClB,UAAI,MAAM,QAAQ,MAAM,MAAM,WAAW,EAAG;AAC5C,YAAM,SAAS;AAIf,cAAQ;AAAA,QACN,0BAA0B,MAAM,MAAM,MAAM,mBAAmB,IAAI,uBAC9D,WAAW,sGACiB,YAAY,iBAAiB,IAAI,GAAG;AAAA,MAEvE;AAAA,IACF,GAAG,WAAW;AAEd,IAAC,MAAM,UAAgD,QAAQ;AAAA,EACjE;AAEA,WAAS,QACP,OACA,YACM;AACN,WAAO,MAAM,MAAM,SAAS,GAAG;AAC7B,YAAM,OAAO,MAAM,MAAM,MAAM;AAC/B,UAAI,KAAK,QAAS;AAClB,iBAAW,KAAK,KAAK,SAAS,KAAK,MAAM;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,SAAsC;AAAA,IAC1C;AAAA,IAEA,KAAK,SAAS,iBAAiB,CAAC,GAAG;AACjC,YAAM,QAAQ,SAA8B,IAAI;AAChD,YAAM,SAAS,eAAe;AAC9B,YAAM,YAAY,cAAc,OAAO;AAEvC,UAAI,cAAc,QAAW;AAC3B,cAAM,WAAW,MAAM,SAAS,IAAI,SAAS;AAG7C,YAAI,YAAY,CAAC,SAAS,MAAM,QAAS,QAAO,SAAS;AAAA,MAC3D;AAEA,UAAI;AACJ,YAAM,UAAU,IAAI,QAAmB,CAAC,SAAS,WAAW;AAC1D,cAAM,SAAS,CAAC,QAA0B;AACxC,cAAI,MAAM,QAAS;AACnB,gBAAM,UAAU;AAChB,cAAI,MAAM,cAAc,OAAW,OAAM,SAAS,OAAO,MAAM,SAAS;AACxE,gBAAM,WAAW,MAAM,MAAM,QAAQ,KAAK;AAC1C,cAAI,YAAY,EAAG,OAAM,MAAM,OAAO,UAAU,CAAC;AACjD,cAAI,MAAM,MAAM,WAAW,EAAG,gBAAe,KAAK;AAClD,cAAI;AAAA,QACN;AAEA,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,CAAC,aAAa,OAAO,MAAM,QAAQ,QAAQ,CAAC;AAAA,QACtD;AAEA,cAAM,QAAQ,MACZ,OAAO,MAAM;AACX,cAAI,wBAAwB,kBAAkB,eAAe,uBAAuB,QAAW;AAC7F,oBAAQ,eAAe,kBAAkB;AAAA,UAC3C,OAAO;AACL,mBAAO,IAAI,iBAAiB,IAAI,CAAC;AAAA,UACnC;AAAA,QACF,CAAC;AAEH,YAAI,QAAQ,SAAS;AACnB,gBAAM;AACN;AAAA,QACF;AACA,gBAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAAA,MACzD,CAAC;AAED,UAAI,MAAM,QAAS,QAAO;AAE1B,UAAI,cAAc,OAAW,OAAM,SAAS,IAAI,WAAW,EAAE,OAAO,QAAQ,CAAC;AAE7E,UAAI,MAAM,MAAM;AACd,cAAM,KAAK,KAAK,MAAM,SAAS,MAAM,MAAM;AAAA,MAC7C,OAAO;AACL,cAAM,MAAM,KAAK,KAAK;AACtB,qBAAa,KAAK;AAAA,MACpB;AACA,aAAO;AAAA,IACT;AAAA,IAEA,cAAc,YAAY;AACxB,YAAM,QAAQ,SAA8B,IAAI;AAChD,YAAM,OAAO;AACb,YAAM,SAAS;AACf,qBAAe,KAAK;AACpB,cAAQ,OAAO,UAAU;AAAA,IAC3B;AAAA,IAEA,gBAAgB,YAAY;AAC1B,YAAM,QAAQ,SAA8B,IAAI;AAGhD,UAAI,MAAM,SAAS,WAAY,OAAM,OAAO;AAAA,IAC9C;AAAA,IAEA,SAAS;AACP,YAAM,QAAQ,SAA8B,IAAI;AAChD,qBAAe,KAAK;AACpB,YAAM,OAAO;AACb,YAAM,MAAM,SAAS;AACrB,YAAM,SAAS,MAAM;AACrB,YAAM,SAAS;AAAA,IACjB;AAAA,IAEA,WAAW;AACT,aAAO,SAA8B,IAAI,EAAE,SAAS;AAAA,IACtD;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/opener.d.cts

@@ -0,0 +1,131 @@
+/**
+ * @ai-matrx/kit/opener — THE opener pattern, once.
+ *
+ * An "opener" is the imperative half of a global dialog: a pure-TS function
+ * you can `await` from anywhere (a Redux thunk, a util, a sync handler, an
+ * async pipeline) that resolves with what the user chose, plus a registry a
+ * React host attaches itself to on mount. The whole point is that the CALL
+ * SITE never imports the dialog: the opener is zero-React, zero-markup,
+ * zero-CSS, so hundreds of static call sites cost nothing and the heavy body
+ * stays behind a lazy host.
+ *
+ * This module is the generic engine. `./confirm-opener` is a three-line
+ * specialisation of it, and so is every app-side opener — the sandbox gate,
+ * the scope-mismatch gate, the value prompts. Before this existed each one
+ * hand-rolled the same `let host`, the same `queue`, the same
+ * `_registerHost` drain loop, the same never-resolve-silently promise; four
+ * copies of one contract, three of them with module-level state that would
+ * have split across loader graphs the moment they left the app.
+ *
+ * THE CONTRACT — every opener made here behaves identically:
+ *
+ *  • ONE host at a time. It registers on mount and unregisters on unmount;
+ *    a late unmount of a SUPERSEDED host never tears down the live one
+ *    (the React double-mount / provider-swap case).
+ *  • NEVER a silent default. With no host mounted, `open()` does NOT resolve
+ *    to some assumed yes/no — the promise stays pending and the request
+ *    queues, so a destructive action fired in the first ~50ms after page load
+ *    still gets a real dialog once the host hydrates. Requests are served in
+ *    call order.
+ *  • NOTHING FAILS SILENTLY (platform law 4). "Stays pending" would be an
+ *    invisible hang if the host is never mounted at all, so an opener that
+ *    has waited `warnWithoutHostAfterMs` with a queued request SCREAMS on the
+ *    console, naming the remedy (`hostHint`) — once per opener, cleared the
+ *    moment a host registers.
+ *  • DEDUPE is opt-in. With a `dedupeKey`, a second `open()` for the same key
+ *    while the first is unsettled returns THE SAME promise instead of
+ *    stacking a second dialog (double-clicked send buttons).
+ *  • CANCELLATION is opt-in per call. Pass an `AbortSignal` and the pending
+ *    request is dropped from the queue and settled — resolved with
+ *    `onAbortResolveWith` when the caller supplies a neutral answer
+ *    ("cancel"), rejected with an `AbortError` otherwise. A host that answers
+ *    an already-settled request is ignored, never a double-resolve.
+ *
+ * 🚨 STATE LIVES ON A `globalThis` SLOT, NEVER A MODULE LOCAL. With the
+ * package built `splitting: false` in dual ESM/CJS format — and the host
+ * routinely living in a DIFFERENT PACKAGE from the caller — each loader graph
+ * instantiates its own copy of this module. A module-level `let host` would
+ * silently split host registration from the callers: the dialog mounts, the
+ * caller queues into a different registry, and the promise hangs forever with
+ * no error anywhere. Same hazard `@ai-matrx/tap-target` documents for its link
+ * registry. Never "clean this up" into a module local; the tarball canary
+ * proves the slot spans both graphs.
+ */
+/** What a mounted host must provide. */
+interface OpenerHostController<TRequest, TResponse> {
+    show: (request: TRequest, resolve: (response: TResponse) => void) => void;
+}
+interface OpenerOptions<TRequest> {
+    /**
+     * Collapse concurrent duplicates. Return a stable string for requests that
+     * must not stack (the same conversation's send gate, say), or `undefined`
+     * to opt this request out of deduping.
+     */
+    dedupeKey?: ((request: TRequest) => string | undefined) | undefined;
+    /**
+     * How long a request may sit queued with no host before the opener screams
+     * on the console. `0` disables the scream (tests, deliberately host-less
+     * environments). Default 5000ms.
+     */
+    warnWithoutHostAfterMs?: number | undefined;
+    /**
+     * The remedy named in that scream — say EXACTLY what to mount and from
+     * where, e.g. `"<ConfirmDialogHost /> from @ai-matrx/design-system"`.
+     */
+    hostHint?: string | undefined;
+}
+interface OpenRequestOptions<TResponse> {
+    /** Abort the request: drops it from the queue and settles the promise. */
+    signal?: AbortSignal | undefined;
+    /**
+     * On abort, resolve with this value instead of rejecting. Use it when the
+     * response type already HAS a neutral answer (`"cancel"`, `null`) — an
+     * abort is then indistinguishable from the user dismissing the dialog, and
+     * no call site needs a try/catch.
+     */
+    onAbortResolveWith?: TResponse | undefined;
+}
+interface Opener<TRequest, TResponse> {
+    /** The `globalThis` slot name this opener's state lives under. */
+    readonly slot: string;
+    /**
+     * Open the dialog. Resolves with the host's answer. With no host mounted
+     * the request queues and the promise stays pending — never a silent
+     * default.
+     */
+    open: (request: TRequest, options?: OpenRequestOptions<TResponse>) => Promise<TResponse>;
+    /** @internal Called by the host component on mount. */
+    _registerHost: (controller: OpenerHostController<TRequest, TResponse>) => void;
+    /** @internal Called by the host component on unmount. */
+    _unregisterHost: (controller: OpenerHostController<TRequest, TResponse>) => void;
+    /** @internal Test-only: drop the registered host, the queue and the timers. */
+    _reset: () => void;
+    /** @internal Diagnostics: is a host currently registered? */
+    _hasHost: () => boolean;
+}
+/** Thrown to an aborted `open()` that supplied no `onAbortResolveWith`. */
+declare class OpenerAbortError extends Error {
+    readonly name = "AbortError";
+    constructor(slot: string);
+}
+/**
+ * Build an opener.
+ *
+ * @param slot The `globalThis` slot name — the opener's identity across every
+ *   module graph in the process, so it must be globally unique and stable.
+ *   Convention: `"<owner>.<name>-opener-state"`, e.g.
+ *   `"ai-matrx.kit.confirm-opener-state"` or
+ *   `"matrx-frontend.sandbox-gate-opener-state"`. Changing it after release
+ *   splits live hosts from live callers — treat it as a public name.
+ *
+ * @example
+ *   // sandboxGateOpener.ts — the whole module.
+ *   const opener = createOpener<SandboxGateOptions, SandboxGateChoice>(
+ *     "matrx-frontend.sandbox-gate-opener-state",
+ *     { hostHint: "<SandboxGateHost /> (mounted once per provider tree)" },
+ *   );
+ *   export const openSandboxGate = opener.open;
+ */
+declare function createOpener<TRequest, TResponse>(slot: string, options?: OpenerOptions<TRequest>): Opener<TRequest, TResponse>;
+
+export { type OpenRequestOptions, type Opener, OpenerAbortError, type OpenerHostController, type OpenerOptions, createOpener };

package/dist/opener.d.ts

@@ -0,0 +1,131 @@
+/**
+ * @ai-matrx/kit/opener — THE opener pattern, once.
+ *
+ * An "opener" is the imperative half of a global dialog: a pure-TS function
+ * you can `await` from anywhere (a Redux thunk, a util, a sync handler, an
+ * async pipeline) that resolves with what the user chose, plus a registry a
+ * React host attaches itself to on mount. The whole point is that the CALL
+ * SITE never imports the dialog: the opener is zero-React, zero-markup,
+ * zero-CSS, so hundreds of static call sites cost nothing and the heavy body
+ * stays behind a lazy host.
+ *
+ * This module is the generic engine. `./confirm-opener` is a three-line
+ * specialisation of it, and so is every app-side opener — the sandbox gate,
+ * the scope-mismatch gate, the value prompts. Before this existed each one
+ * hand-rolled the same `let host`, the same `queue`, the same
+ * `_registerHost` drain loop, the same never-resolve-silently promise; four
+ * copies of one contract, three of them with module-level state that would
+ * have split across loader graphs the moment they left the app.
+ *
+ * THE CONTRACT — every opener made here behaves identically:
+ *
+ *  • ONE host at a time. It registers on mount and unregisters on unmount;
+ *    a late unmount of a SUPERSEDED host never tears down the live one
+ *    (the React double-mount / provider-swap case).
+ *  • NEVER a silent default. With no host mounted, `open()` does NOT resolve
+ *    to some assumed yes/no — the promise stays pending and the request
+ *    queues, so a destructive action fired in the first ~50ms after page load
+ *    still gets a real dialog once the host hydrates. Requests are served in
+ *    call order.
+ *  • NOTHING FAILS SILENTLY (platform law 4). "Stays pending" would be an
+ *    invisible hang if the host is never mounted at all, so an opener that
+ *    has waited `warnWithoutHostAfterMs` with a queued request SCREAMS on the
+ *    console, naming the remedy (`hostHint`) — once per opener, cleared the
+ *    moment a host registers.
+ *  • DEDUPE is opt-in. With a `dedupeKey`, a second `open()` for the same key
+ *    while the first is unsettled returns THE SAME promise instead of
+ *    stacking a second dialog (double-clicked send buttons).
+ *  • CANCELLATION is opt-in per call. Pass an `AbortSignal` and the pending
+ *    request is dropped from the queue and settled — resolved with
+ *    `onAbortResolveWith` when the caller supplies a neutral answer
+ *    ("cancel"), rejected with an `AbortError` otherwise. A host that answers
+ *    an already-settled request is ignored, never a double-resolve.
+ *
+ * 🚨 STATE LIVES ON A `globalThis` SLOT, NEVER A MODULE LOCAL. With the
+ * package built `splitting: false` in dual ESM/CJS format — and the host
+ * routinely living in a DIFFERENT PACKAGE from the caller — each loader graph
+ * instantiates its own copy of this module. A module-level `let host` would
+ * silently split host registration from the callers: the dialog mounts, the
+ * caller queues into a different registry, and the promise hangs forever with
+ * no error anywhere. Same hazard `@ai-matrx/tap-target` documents for its link
+ * registry. Never "clean this up" into a module local; the tarball canary
+ * proves the slot spans both graphs.
+ */
+/** What a mounted host must provide. */
+interface OpenerHostController<TRequest, TResponse> {
+    show: (request: TRequest, resolve: (response: TResponse) => void) => void;
+}
+interface OpenerOptions<TRequest> {
+    /**
+     * Collapse concurrent duplicates. Return a stable string for requests that
+     * must not stack (the same conversation's send gate, say), or `undefined`
+     * to opt this request out of deduping.
+     */
+    dedupeKey?: ((request: TRequest) => string | undefined) | undefined;
+    /**
+     * How long a request may sit queued with no host before the opener screams
+     * on the console. `0` disables the scream (tests, deliberately host-less
+     * environments). Default 5000ms.
+     */
+    warnWithoutHostAfterMs?: number | undefined;
+    /**
+     * The remedy named in that scream — say EXACTLY what to mount and from
+     * where, e.g. `"<ConfirmDialogHost /> from @ai-matrx/design-system"`.
+     */
+    hostHint?: string | undefined;
+}
+interface OpenRequestOptions<TResponse> {
+    /** Abort the request: drops it from the queue and settles the promise. */
+    signal?: AbortSignal | undefined;
+    /**
+     * On abort, resolve with this value instead of rejecting. Use it when the
+     * response type already HAS a neutral answer (`"cancel"`, `null`) — an
+     * abort is then indistinguishable from the user dismissing the dialog, and
+     * no call site needs a try/catch.
+     */
+    onAbortResolveWith?: TResponse | undefined;
+}
+interface Opener<TRequest, TResponse> {
+    /** The `globalThis` slot name this opener's state lives under. */
+    readonly slot: string;
+    /**
+     * Open the dialog. Resolves with the host's answer. With no host mounted
+     * the request queues and the promise stays pending — never a silent
+     * default.
+     */
+    open: (request: TRequest, options?: OpenRequestOptions<TResponse>) => Promise<TResponse>;
+    /** @internal Called by the host component on mount. */
+    _registerHost: (controller: OpenerHostController<TRequest, TResponse>) => void;
+    /** @internal Called by the host component on unmount. */
+    _unregisterHost: (controller: OpenerHostController<TRequest, TResponse>) => void;
+    /** @internal Test-only: drop the registered host, the queue and the timers. */
+    _reset: () => void;
+    /** @internal Diagnostics: is a host currently registered? */
+    _hasHost: () => boolean;
+}
+/** Thrown to an aborted `open()` that supplied no `onAbortResolveWith`. */
+declare class OpenerAbortError extends Error {
+    readonly name = "AbortError";
+    constructor(slot: string);
+}
+/**
+ * Build an opener.
+ *
+ * @param slot The `globalThis` slot name — the opener's identity across every
+ *   module graph in the process, so it must be globally unique and stable.
+ *   Convention: `"<owner>.<name>-opener-state"`, e.g.
+ *   `"ai-matrx.kit.confirm-opener-state"` or
+ *   `"matrx-frontend.sandbox-gate-opener-state"`. Changing it after release
+ *   splits live hosts from live callers — treat it as a public name.
+ *
+ * @example
+ *   // sandboxGateOpener.ts — the whole module.
+ *   const opener = createOpener<SandboxGateOptions, SandboxGateChoice>(
+ *     "matrx-frontend.sandbox-gate-opener-state",
+ *     { hostHint: "<SandboxGateHost /> (mounted once per provider tree)" },
+ *   );
+ *   export const openSandboxGate = opener.open;
+ */
+declare function createOpener<TRequest, TResponse>(slot: string, options?: OpenerOptions<TRequest>): Opener<TRequest, TResponse>;
+
+export { type OpenRequestOptions, type Opener, OpenerAbortError, type OpenerHostController, type OpenerOptions, createOpener };

package/dist/opener.js

@@ -0,0 +1,126 @@
+// src/opener.ts
+var OpenerAbortError = class extends Error {
+  name = "AbortError";
+  constructor(slot) {
+    super(`The ${slot} request was aborted before the user answered it.`);
+  }
+};
+function getState(slot) {
+  const holder = globalThis;
+  const symbol = Symbol.for(slot);
+  let state = holder[symbol];
+  if (!state) {
+    state = { host: null, queue: [], inFlight: /* @__PURE__ */ new Map(), warnTimer: null, warned: false };
+    holder[symbol] = state;
+  }
+  return state;
+}
+function createOpener(slot, options = {}) {
+  const warnAfterMs = options.warnWithoutHostAfterMs ?? 5e3;
+  const hostHint = options.hostHint;
+  const dedupeKeyOf = options.dedupeKey;
+  function clearWarnTimer(state) {
+    if (state.warnTimer !== null) {
+      clearTimeout(state.warnTimer);
+      state.warnTimer = null;
+    }
+  }
+  function armWarnTimer(state) {
+    if (warnAfterMs <= 0 || state.warned || state.warnTimer !== null) return;
+    state.warnTimer = setTimeout(() => {
+      state.warnTimer = null;
+      if (state.host || state.queue.length === 0) return;
+      state.warned = true;
+      console.error(
+        `[@ai-matrx/kit/opener] ${state.queue.length} request(s) on "${slot}" have been waiting ${warnAfterMs}ms with no host registered, so the awaiting code is stuck and the user sees nothing. REMEDY: mount ${hostHint ?? `the host for "${slot}"`} once, near the root of this provider tree.`
+      );
+    }, warnAfterMs);
+    state.warnTimer.unref?.();
+  }
+  function drainTo(state, controller) {
+    while (state.queue.length > 0) {
+      const next = state.queue.shift();
+      if (next.settled) continue;
+      controller.show(next.request, next.settle);
+    }
+  }
+  const opener = {
+    slot,
+    open(request, requestOptions = {}) {
+      const state = getState(slot);
+      const signal = requestOptions.signal;
+      const dedupeKey = dedupeKeyOf?.(request);
+      if (dedupeKey !== void 0) {
+        const existing = state.inFlight.get(dedupeKey);
+        if (existing && !existing.entry.settled) return existing.promise;
+      }
+      let entry;
+      const promise = new Promise((resolve, reject) => {
+        const finish = (run) => {
+          if (entry.settled) return;
+          entry.settled = true;
+          if (entry.dedupeKey !== void 0) state.inFlight.delete(entry.dedupeKey);
+          const queuedAt = state.queue.indexOf(entry);
+          if (queuedAt >= 0) state.queue.splice(queuedAt, 1);
+          if (state.queue.length === 0) clearWarnTimer(state);
+          run();
+        };
+        entry = {
+          request,
+          dedupeKey,
+          settled: false,
+          settle: (response) => finish(() => resolve(response))
+        };
+        const abort = () => finish(() => {
+          if ("onAbortResolveWith" in requestOptions && requestOptions.onAbortResolveWith !== void 0) {
+            resolve(requestOptions.onAbortResolveWith);
+          } else {
+            reject(new OpenerAbortError(slot));
+          }
+        });
+        if (signal?.aborted) {
+          abort();
+          return;
+        }
+        signal?.addEventListener("abort", abort, { once: true });
+      });
+      if (entry.settled) return promise;
+      if (dedupeKey !== void 0) state.inFlight.set(dedupeKey, { entry, promise });
+      if (state.host) {
+        state.host.show(entry.request, entry.settle);
+      } else {
+        state.queue.push(entry);
+        armWarnTimer(state);
+      }
+      return promise;
+    },
+    _registerHost(controller) {
+      const state = getState(slot);
+      state.host = controller;
+      state.warned = false;
+      clearWarnTimer(state);
+      drainTo(state, controller);
+    },
+    _unregisterHost(controller) {
+      const state = getState(slot);
+      if (state.host === controller) state.host = null;
+    },
+    _reset() {
+      const state = getState(slot);
+      clearWarnTimer(state);
+      state.host = null;
+      state.queue.length = 0;
+      state.inFlight.clear();
+      state.warned = false;
+    },
+    _hasHost() {
+      return getState(slot).host !== null;
+    }
+  };
+  return opener;
+}
+export {
+  OpenerAbortError,
+  createOpener
+};
+//# sourceMappingURL=opener.js.map

package/dist/opener.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/opener.ts"],"sourcesContent":["/**\n * @ai-matrx/kit/opener — THE opener pattern, once.\n *\n * An \"opener\" is the imperative half of a global dialog: a pure-TS function\n * you can `await` from anywhere (a Redux thunk, a util, a sync handler, an\n * async pipeline) that resolves with what the user chose, plus a registry a\n * React host attaches itself to on mount. The whole point is that the CALL\n * SITE never imports the dialog: the opener is zero-React, zero-markup,\n * zero-CSS, so hundreds of static call sites cost nothing and the heavy body\n * stays behind a lazy host.\n *\n * This module is the generic engine. `./confirm-opener` is a three-line\n * specialisation of it, and so is every app-side opener — the sandbox gate,\n * the scope-mismatch gate, the value prompts. Before this existed each one\n * hand-rolled the same `let host`, the same `queue`, the same\n * `_registerHost` drain loop, the same never-resolve-silently promise; four\n * copies of one contract, three of them with module-level state that would\n * have split across loader graphs the moment they left the app.\n *\n * THE CONTRACT — every opener made here behaves identically:\n *\n *  • ONE host at a time. It registers on mount and unregisters on unmount;\n *    a late unmount of a SUPERSEDED host never tears down the live one\n *    (the React double-mount / provider-swap case).\n *  • NEVER a silent default. With no host mounted, `open()` does NOT resolve\n *    to some assumed yes/no — the promise stays pending and the request\n *    queues, so a destructive action fired in the first ~50ms after page load\n *    still gets a real dialog once the host hydrates. Requests are served in\n *    call order.\n *  • NOTHING FAILS SILENTLY (platform law 4). \"Stays pending\" would be an\n *    invisible hang if the host is never mounted at all, so an opener that\n *    has waited `warnWithoutHostAfterMs` with a queued request SCREAMS on the\n *    console, naming the remedy (`hostHint`) — once per opener, cleared the\n *    moment a host registers.\n *  • DEDUPE is opt-in. With a `dedupeKey`, a second `open()` for the same key\n *    while the first is unsettled returns THE SAME promise instead of\n *    stacking a second dialog (double-clicked send buttons).\n *  • CANCELLATION is opt-in per call. Pass an `AbortSignal` and the pending\n *    request is dropped from the queue and settled — resolved with\n *    `onAbortResolveWith` when the caller supplies a neutral answer\n *    (\"cancel\"), rejected with an `AbortError` otherwise. A host that answers\n *    an already-settled request is ignored, never a double-resolve.\n *\n * 🚨 STATE LIVES ON A `globalThis` SLOT, NEVER A MODULE LOCAL. With the\n * package built `splitting: false` in dual ESM/CJS format — and the host\n * routinely living in a DIFFERENT PACKAGE from the caller — each loader graph\n * instantiates its own copy of this module. A module-level `let host` would\n * silently split host registration from the callers: the dialog mounts, the\n * caller queues into a different registry, and the promise hangs forever with\n * no error anywhere. Same hazard `@ai-matrx/tap-target` documents for its link\n * registry. Never \"clean this up\" into a module local; the tarball canary\n * proves the slot spans both graphs.\n */\n\n/** What a mounted host must provide. */\nexport interface OpenerHostController<TRequest, TResponse> {\n  show: (request: TRequest, resolve: (response: TResponse) => void) => void;\n}\n\ninterface PendingEntry<TRequest, TResponse> {\n  request: TRequest;\n  /** Wrapped resolver: settles once, then every later call is a no-op. */\n  settle: (response: TResponse) => void;\n  /** Present only while the entry is still queued (no host yet). */\n  dedupeKey: string | undefined;\n  settled: boolean;\n}\n\ninterface OpenerState<TRequest, TResponse> {\n  host: OpenerHostController<TRequest, TResponse> | null;\n  queue: PendingEntry<TRequest, TResponse>[];\n  /** Unsettled entries by dedupe key — queued AND in-flight at the host. */\n  inFlight: Map<string, { entry: PendingEntry<TRequest, TResponse>; promise: Promise<TResponse> }>;\n  warnTimer: ReturnType<typeof setTimeout> | null;\n  warned: boolean;\n}\n\nexport interface OpenerOptions<TRequest> {\n  /**\n   * Collapse concurrent duplicates. Return a stable string for requests that\n   * must not stack (the same conversation's send gate, say), or `undefined`\n   * to opt this request out of deduping.\n   */\n  dedupeKey?: ((request: TRequest) => string | undefined) | undefined;\n  /**\n   * How long a request may sit queued with no host before the opener screams\n   * on the console. `0` disables the scream (tests, deliberately host-less\n   * environments). Default 5000ms.\n   */\n  warnWithoutHostAfterMs?: number | undefined;\n  /**\n   * The remedy named in that scream — say EXACTLY what to mount and from\n   * where, e.g. `\"<ConfirmDialogHost /> from @ai-matrx/design-system\"`.\n   */\n  hostHint?: string | undefined;\n}\n\nexport interface OpenRequestOptions<TResponse> {\n  /** Abort the request: drops it from the queue and settles the promise. */\n  signal?: AbortSignal | undefined;\n  /**\n   * On abort, resolve with this value instead of rejecting. Use it when the\n   * response type already HAS a neutral answer (`\"cancel\"`, `null`) — an\n   * abort is then indistinguishable from the user dismissing the dialog, and\n   * no call site needs a try/catch.\n   */\n  onAbortResolveWith?: TResponse | undefined;\n}\n\nexport interface Opener<TRequest, TResponse> {\n  /** The `globalThis` slot name this opener's state lives under. */\n  readonly slot: string;\n  /**\n   * Open the dialog. Resolves with the host's answer. With no host mounted\n   * the request queues and the promise stays pending — never a silent\n   * default.\n   */\n  open: (request: TRequest, options?: OpenRequestOptions<TResponse>) => Promise<TResponse>;\n  /** @internal Called by the host component on mount. */\n  _registerHost: (controller: OpenerHostController<TRequest, TResponse>) => void;\n  /** @internal Called by the host component on unmount. */\n  _unregisterHost: (controller: OpenerHostController<TRequest, TResponse>) => void;\n  /** @internal Test-only: drop the registered host, the queue and the timers. */\n  _reset: () => void;\n  /** @internal Diagnostics: is a host currently registered? */\n  _hasHost: () => boolean;\n}\n\n/** Thrown to an aborted `open()` that supplied no `onAbortResolveWith`. */\nexport class OpenerAbortError extends Error {\n  override readonly name = \"AbortError\";\n  constructor(slot: string) {\n    super(`The ${slot} request was aborted before the user answered it.`);\n  }\n}\n\nfunction getState<TRequest, TResponse>(slot: string): OpenerState<TRequest, TResponse> {\n  const holder = globalThis as Record<symbol, unknown>;\n  const symbol = Symbol.for(slot);\n  let state = holder[symbol] as OpenerState<TRequest, TResponse> | undefined;\n  if (!state) {\n    state = { host: null, queue: [], inFlight: new Map(), warnTimer: null, warned: false };\n    holder[symbol] = state;\n  }\n  return state;\n}\n\n/**\n * Build an opener.\n *\n * @param slot The `globalThis` slot name — the opener's identity across every\n *   module graph in the process, so it must be globally unique and stable.\n *   Convention: `\"<owner>.<name>-opener-state\"`, e.g.\n *   `\"ai-matrx.kit.confirm-opener-state\"` or\n *   `\"matrx-frontend.sandbox-gate-opener-state\"`. Changing it after release\n *   splits live hosts from live callers — treat it as a public name.\n *\n * @example\n *   // sandboxGateOpener.ts — the whole module.\n *   const opener = createOpener<SandboxGateOptions, SandboxGateChoice>(\n *     \"matrx-frontend.sandbox-gate-opener-state\",\n *     { hostHint: \"<SandboxGateHost /> (mounted once per provider tree)\" },\n *   );\n *   export const openSandboxGate = opener.open;\n */\nexport function createOpener<TRequest, TResponse>(\n  slot: string,\n  options: OpenerOptions<TRequest> = {},\n): Opener<TRequest, TResponse> {\n  const warnAfterMs = options.warnWithoutHostAfterMs ?? 5000;\n  const hostHint = options.hostHint;\n  const dedupeKeyOf = options.dedupeKey;\n\n  function clearWarnTimer(state: OpenerState<TRequest, TResponse>): void {\n    if (state.warnTimer !== null) {\n      clearTimeout(state.warnTimer);\n      state.warnTimer = null;\n    }\n  }\n\n  function armWarnTimer(state: OpenerState<TRequest, TResponse>): void {\n    if (warnAfterMs <= 0 || state.warned || state.warnTimer !== null) return;\n    state.warnTimer = setTimeout(() => {\n      state.warnTimer = null;\n      if (state.host || state.queue.length === 0) return;\n      state.warned = true;\n      // THE SCREAM. A queued request with no host is a promise that will hang\n      // forever — invisible to the user, invisible in the network tab. Say\n      // what is stuck and exactly what to mount.\n      console.error(\n        `[@ai-matrx/kit/opener] ${state.queue.length} request(s) on \"${slot}\" have been waiting ` +\n          `${warnAfterMs}ms with no host registered, so the awaiting code is stuck and the user ` +\n          `sees nothing. REMEDY: mount ${hostHint ?? `the host for \"${slot}\"`} once, near the root ` +\n          `of this provider tree.`,\n      );\n    }, warnAfterMs);\n    // Never hold a Node process open for a diagnostic timer.\n    (state.warnTimer as unknown as { unref?: () => void }).unref?.();\n  }\n\n  function drainTo(\n    state: OpenerState<TRequest, TResponse>,\n    controller: OpenerHostController<TRequest, TResponse>,\n  ): void {\n    while (state.queue.length > 0) {\n      const next = state.queue.shift()!;\n      if (next.settled) continue;\n      controller.show(next.request, next.settle);\n    }\n  }\n\n  const opener: Opener<TRequest, TResponse> = {\n    slot,\n\n    open(request, requestOptions = {}) {\n      const state = getState<TRequest, TResponse>(slot);\n      const signal = requestOptions.signal;\n      const dedupeKey = dedupeKeyOf?.(request);\n\n      if (dedupeKey !== undefined) {\n        const existing = state.inFlight.get(dedupeKey);\n        // A duplicate NEVER stacks a second dialog: the second caller awaits\n        // the answer the first one is already asking for.\n        if (existing && !existing.entry.settled) return existing.promise;\n      }\n\n      let entry!: PendingEntry<TRequest, TResponse>;\n      const promise = new Promise<TResponse>((resolve, reject) => {\n        const finish = (run: () => void): void => {\n          if (entry.settled) return;\n          entry.settled = true;\n          if (entry.dedupeKey !== undefined) state.inFlight.delete(entry.dedupeKey);\n          const queuedAt = state.queue.indexOf(entry);\n          if (queuedAt >= 0) state.queue.splice(queuedAt, 1);\n          if (state.queue.length === 0) clearWarnTimer(state);\n          run();\n        };\n\n        entry = {\n          request,\n          dedupeKey,\n          settled: false,\n          settle: (response) => finish(() => resolve(response)),\n        };\n\n        const abort = (): void =>\n          finish(() => {\n            if (\"onAbortResolveWith\" in requestOptions && requestOptions.onAbortResolveWith !== undefined) {\n              resolve(requestOptions.onAbortResolveWith);\n            } else {\n              reject(new OpenerAbortError(slot));\n            }\n          });\n\n        if (signal?.aborted) {\n          abort();\n          return;\n        }\n        signal?.addEventListener(\"abort\", abort, { once: true });\n      });\n\n      if (entry.settled) return promise; // aborted before it ever queued\n\n      if (dedupeKey !== undefined) state.inFlight.set(dedupeKey, { entry, promise });\n\n      if (state.host) {\n        state.host.show(entry.request, entry.settle);\n      } else {\n        state.queue.push(entry);\n        armWarnTimer(state);\n      }\n      return promise;\n    },\n\n    _registerHost(controller) {\n      const state = getState<TRequest, TResponse>(slot);\n      state.host = controller;\n      state.warned = false;\n      clearWarnTimer(state);\n      drainTo(state, controller);\n    },\n\n    _unregisterHost(controller) {\n      const state = getState<TRequest, TResponse>(slot);\n      // Only the CURRENT host may unregister: a superseded host's late unmount\n      // must not tear down the live one.\n      if (state.host === controller) state.host = null;\n    },\n\n    _reset() {\n      const state = getState<TRequest, TResponse>(slot);\n      clearWarnTimer(state);\n      state.host = null;\n      state.queue.length = 0;\n      state.inFlight.clear();\n      state.warned = false;\n    },\n\n    _hasHost() {\n      return getState<TRequest, TResponse>(slot).host !== null;\n    },\n  };\n\n  return opener;\n}\n"],"mappings":";AAiIO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACxB,OAAO;AAAA,EACzB,YAAY,MAAc;AACxB,UAAM,OAAO,IAAI,mDAAmD;AAAA,EACtE;AACF;AAEA,SAAS,SAA8B,MAAgD;AACrF,QAAM,SAAS;AACf,QAAM,SAAS,OAAO,IAAI,IAAI;AAC9B,MAAI,QAAQ,OAAO,MAAM;AACzB,MAAI,CAAC,OAAO;AACV,YAAQ,EAAE,MAAM,MAAM,OAAO,CAAC,GAAG,UAAU,oBAAI,IAAI,GAAG,WAAW,MAAM,QAAQ,MAAM;AACrF,WAAO,MAAM,IAAI;AAAA,EACnB;AACA,SAAO;AACT;AAoBO,SAAS,aACd,MACA,UAAmC,CAAC,GACP;AAC7B,QAAM,cAAc,QAAQ,0BAA0B;AACtD,QAAM,WAAW,QAAQ;AACzB,QAAM,cAAc,QAAQ;AAE5B,WAAS,eAAe,OAA+C;AACrE,QAAI,MAAM,cAAc,MAAM;AAC5B,mBAAa,MAAM,SAAS;AAC5B,YAAM,YAAY;AAAA,IACpB;AAAA,EACF;AAEA,WAAS,aAAa,OAA+C;AACnE,QAAI,eAAe,KAAK,MAAM,UAAU,MAAM,cAAc,KAAM;AAClE,UAAM,YAAY,WAAW,MAAM;AACjC,YAAM,YAAY;AAClB,UAAI,MAAM,QAAQ,MAAM,MAAM,WAAW,EAAG;AAC5C,YAAM,SAAS;AAIf,cAAQ;AAAA,QACN,0BAA0B,MAAM,MAAM,MAAM,mBAAmB,IAAI,uBAC9D,WAAW,sGACiB,YAAY,iBAAiB,IAAI,GAAG;AAAA,MAEvE;AAAA,IACF,GAAG,WAAW;AAEd,IAAC,MAAM,UAAgD,QAAQ;AAAA,EACjE;AAEA,WAAS,QACP,OACA,YACM;AACN,WAAO,MAAM,MAAM,SAAS,GAAG;AAC7B,YAAM,OAAO,MAAM,MAAM,MAAM;AAC/B,UAAI,KAAK,QAAS;AAClB,iBAAW,KAAK,KAAK,SAAS,KAAK,MAAM;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,SAAsC;AAAA,IAC1C;AAAA,IAEA,KAAK,SAAS,iBAAiB,CAAC,GAAG;AACjC,YAAM,QAAQ,SAA8B,IAAI;AAChD,YAAM,SAAS,eAAe;AAC9B,YAAM,YAAY,cAAc,OAAO;AAEvC,UAAI,cAAc,QAAW;AAC3B,cAAM,WAAW,MAAM,SAAS,IAAI,SAAS;AAG7C,YAAI,YAAY,CAAC,SAAS,MAAM,QAAS,QAAO,SAAS;AAAA,MAC3D;AAEA,UAAI;AACJ,YAAM,UAAU,IAAI,QAAmB,CAAC,SAAS,WAAW;AAC1D,cAAM,SAAS,CAAC,QAA0B;AACxC,cAAI,MAAM,QAAS;AACnB,gBAAM,UAAU;AAChB,cAAI,MAAM,cAAc,OAAW,OAAM,SAAS,OAAO,MAAM,SAAS;AACxE,gBAAM,WAAW,MAAM,MAAM,QAAQ,KAAK;AAC1C,cAAI,YAAY,EAAG,OAAM,MAAM,OAAO,UAAU,CAAC;AACjD,cAAI,MAAM,MAAM,WAAW,EAAG,gBAAe,KAAK;AAClD,cAAI;AAAA,QACN;AAEA,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,CAAC,aAAa,OAAO,MAAM,QAAQ,QAAQ,CAAC;AAAA,QACtD;AAEA,cAAM,QAAQ,MACZ,OAAO,MAAM;AACX,cAAI,wBAAwB,kBAAkB,eAAe,uBAAuB,QAAW;AAC7F,oBAAQ,eAAe,kBAAkB;AAAA,UAC3C,OAAO;AACL,mBAAO,IAAI,iBAAiB,IAAI,CAAC;AAAA,UACnC;AAAA,QACF,CAAC;AAEH,YAAI,QAAQ,SAAS;AACnB,gBAAM;AACN;AAAA,QACF;AACA,gBAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAAA,MACzD,CAAC;AAED,UAAI,MAAM,QAAS,QAAO;AAE1B,UAAI,cAAc,OAAW,OAAM,SAAS,IAAI,WAAW,EAAE,OAAO,QAAQ,CAAC;AAE7E,UAAI,MAAM,MAAM;AACd,cAAM,KAAK,KAAK,MAAM,SAAS,MAAM,MAAM;AAAA,MAC7C,OAAO;AACL,cAAM,MAAM,KAAK,KAAK;AACtB,qBAAa,KAAK;AAAA,MACpB;AACA,aAAO;AAAA,IACT;AAAA,IAEA,cAAc,YAAY;AACxB,YAAM,QAAQ,SAA8B,IAAI;AAChD,YAAM,OAAO;AACb,YAAM,SAAS;AACf,qBAAe,KAAK;AACpB,cAAQ,OAAO,UAAU;AAAA,IAC3B;AAAA,IAEA,gBAAgB,YAAY;AAC1B,YAAM,QAAQ,SAA8B,IAAI;AAGhD,UAAI,MAAM,SAAS,WAAY,OAAM,OAAO;AAAA,IAC9C;AAAA,IAEA,SAAS;AACP,YAAM,QAAQ,SAA8B,IAAI;AAChD,qBAAe,KAAK;AACpB,YAAM,OAAO;AACb,YAAM,MAAM,SAAS;AACrB,YAAM,SAAS,MAAM;AACrB,YAAM,SAAS;AAAA,IACjB;AAAA,IAEA,WAAW;AACT,aAAO,SAA8B,IAAI,EAAE,SAAS;AAAA,IACtD;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/kit",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "The always-include AI Matrx kit: the little primitives every Matrx app speaks — autosave that never loses a keystroke, stale-response guards, clipboard with graceful fallbacks — one per subpath, tree-shaken to what you use.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -27,6 +27,7 @@
     "file-size",
     "escape-html",
     "uuid",
+    "opener",
     "confirm-opener"
   ],
   "repository": {
@@ -136,6 +137,26 @@
         "default": "./dist/confirm-opener.cjs"
       }
     },
+    "./opener": {
+      "import": {
+        "types": "./dist/opener.d.ts",
+        "default": "./dist/opener.js"
+      },
+      "require": {
+        "types": "./dist/opener.d.cts",
+        "default": "./dist/opener.cjs"
+      }
+    },
+    "./opener-react": {
+      "import": {
+        "types": "./dist/opener-react.d.ts",
+        "default": "./dist/opener-react.js"
+      },
+      "require": {
+        "types": "./dist/opener-react.d.cts",
+        "default": "./dist/opener-react.cjs"
+      }
+    },
     "./toast": {
       "import": {
         "types": "./dist/toast.d.ts",