@artooi/ag-ui-web-component 0.27.0 → 0.28.0

package/dist/core/ag_ui_chat.d.ts

@@ -92,6 +92,22 @@ export declare class AgUiChat extends HTMLElement {
      * `Authorization` are configured independently and neither drops the other.
      */
     getHeaders: (() => Record<string, string>) | null;
+    /**
+     * Origins, besides the page's own, that this element may send {@link headers}
+     * and {@link getHeaders} credentials to without saying so on the console.
+     *
+     * Seven attributes name a URL, and every one of them carries these headers.
+     * They are plain HTML, so a page that builds one from a query parameter or
+     * from tenant-authored configuration has handed an attacker the destination,
+     * and the token leaves on the element's first request. Naming the origins you
+     * expect turns that from silent into either confirmed or reported.
+     *
+     * A notice rather than a refusal: a cross-origin agent is a documented
+     * deployment, so refusing would break working installations to defend against
+     * a page that is already interpolating untrusted data into its own markup.
+     * Leaving this empty costs nothing but one console line per foreign origin.
+     */
+    trustedOrigins: readonly string[];
     /**
      * Permit `<img>` in rendered assistant markdown. **Off by default**: a
      * model-controlled image URL is fetched with no user interaction, which
@@ -218,7 +234,18 @@ export declare class AgUiChat extends HTMLElement {
     /** Attributes the element reacts to after it has been connected. */
     static get observedAttributes(): string[];
     attributeChangedCallback(name: string, previous: string | null, value: string | null): void;
-    /** Declare a frontend tool the agent may call. */
+    /**
+     * Declare a frontend tool the agent may call.
+     *
+     * **A handler's thrown message leaves the browser.** When a handler rejects,
+     * its `Error.message` is posted back as that call's tool result — into the
+     * conversation, on to the AG-UI endpoint, persisted server-side, and
+     * forwarded to the model provider on every later round. That is deliberate,
+     * since it is what lets the agent recover from a failure it caused; but it
+     * means an internal hostname, a signed URL or a stack-derived path in a
+     * rethrown error is disclosed to parties the host never chose. Throw the
+     * message you would be content for the model to read, and log the detail.
+     */
     registerTool(tool: ClientTool): void;
     /**
      * AG-UI **shared state** for this conversation — the protocol's own state
@@ -242,6 +269,33 @@ export declare class AgUiChat extends HTMLElement {
     /** The AG-UI endpoint URL, read from the `endpoint` attribute. */
     get endpoint(): string;
     set endpoint(value: string);
+    /**
+     * Who the stored conversation belongs to, from the `user-key` attribute.
+     *
+     * Set it to whatever identifies the signed-in principal — a user id, an
+     * account id, a hash of one. The value joins the storage namespace, so two
+     * principals in the same tab cannot read each other's transcript, and
+     * **changing it purges what the previous one left behind**.
+     *
+     * That purge is the reason this is a live attribute rather than a
+     * connect-time one. `sessionStorage` survives same-tab navigation, so it
+     * survives a logout; and a single-page app signs out through its own router
+     * without remounting anything, so there is no other moment at which the
+     * element could find out. The host naming the new principal — or dropping the
+     * attribute — is the signal.
+     *
+     * Absent means exactly today's behaviour, which is why nothing breaks by
+     * leaving it off: the conversation is scoped to the element and to nobody in
+     * particular, and on a shared workstation it carries into whoever signs in
+     * next in the same tab.
+     *
+     * The first value to arrive is treated as a host naming the user who was
+     * already there, not as a handover: the conversation in progress moves into
+     * the principal's namespace rather than being destroyed, so an element
+     * configured by an async auth handshake keeps what is on screen.
+     */
+    get userKey(): string;
+    set userKey(value: string);
     /**
      * Cookie policy for **every** request this element makes, as `fetch`'s own
      * `credentials` mode (`"omit"` / `"same-origin"` / `"include"`). Mirrored to

package/dist/core/ag_ui_chat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ag_ui_chat.d.ts","sourceRoot":"","sources":["../../src/core/ag_ui_chat.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAsB,IAAI,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAUL,YAAY,EAWb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,kCAAkC,CAAC;AAGvF,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EAAwB,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,wBAAwB,CAAC;AAchC,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASzF,OAAO,EAAE,KAAK,aAAa,EAAsB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAE1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,YAAY,EAAmB,MAAM,wBAAwB,CAAC;AAG5E,OAAO,EAAE,KAAK,iBAAiB,EAAmB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,KAAK,aAAa,EAAoB,MAAM,wBAAwB,CAAC;AAG9E,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,SAAS,aAAa,EAAE,CAAC;CAChD;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,SAAS,aAAa,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,sFAAsF;AACtF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACpC;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;CACpC;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAmDD;;;;;;;;;;GAUG;AACH,qBAAa,QAAS,SAAQ,WAAW;;IACvC,wEAAwE;IACxE,YAAY,EAAE,YAAY,CAAmB;IAE7C;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM;IAErC;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CAAQ;IAEzD;;;;;OAKG;IACH,WAAW,UAAS;IAEpB,yEAAyE;IACzE,WAAW,UAAS;IAEpB;;;;;OAKG;IACH,OAAO,UAAS;IAEhB;;;;OAIG;IACH,eAAe,EAAE,gBAAgB,GAAG,IAAI,CAAQ;IAEhD;;;;;;OAMG;IACH,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAQ;IAEjD;;;;;;OAMG;IACH,gBAAgB,EACZ,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,GACjF,IAAI,CAAQ;IAEhB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,IAAI,EAAE,CAOpB;IAEF;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,OAAO,EAAE,CAEzB;IAEF;;;OAGG;IACH,QAAQ,EAAE,QAAQ,CAAM;IAExB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAQ;IAEjD,iEAAiE;IACjE,UAAU,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,IAAI,CAAQ;IAE1C,iEAAiE;IACjE,iBAAiB,UAAQ;IAEzB;;;;OAIG;IACH,iBAAiB,EAAE,uBAAuB,CAA6B;IAEvE;;;;;;OAMG;IACH,aAAa,EAAE,aAAa,GAAG,IAAI,CAAQ;IAE3C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAEnD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,UAAU,EAAE,oBAAoB,KAAK,OAAO,CAG5D;IAEH;;;;OAIG;IACH,YAAY,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAc;IAEzD;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM;IAE3C;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAM;IAEjC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAA2D;IAsH/F,cAqCC;IAqED,oEAAoE;IACpE,MAAM,KAAK,kBAAkB,IAAI,MAAM,EAAE,CAExC;IAED,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAgD1F;IAED,kDAAkD;IAClD,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAEnC;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEnD;IAED,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAKvD;IAED,6EAA6E;IAC7E,iBAAiB,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAI1C;IAED;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAE1C;IAoJD,kEAAkE;IAClE,IAAI,QAAQ,IAAI,MAAM,CAErB;IAKD,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAEzB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,IAAI,WAAW,IAAI,kBAAkB,GAAG,IAAI,CAG3C;IAED,IAAI,WAAW,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,EAe/C;IAqCD;;;;;;;OAOG;IACH,IAAI,WAAW,IAAI,eAAe,CAUjC;IAED,IAAI,WAAW,CAAC,KAAK,EAAE,eAAe,EAErC;IAED,iBAAiB,IAAI,IAAI,CAgDxB;IAiCD;;;;;;;;;;;;OAYG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAK5B;IAED;;;;;OAKG;IACH,oBAAoB,IAAI,IAAI,CAK3B;IAwMD;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,IAAI,CAGxC;IAiHD,gFAAgF;IAChF,IAAI,SAAS,IAAI,OAAO,CAEvB;IAID,IAAI,SAAS,CAAC,KAAK,EAAE,OAAO,EAE3B;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAiBrC;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,qEAAqE;IACrE,eAAe,IAAI,IAAI,CAEtB;IAED;;;;;OAKG;IACH,WAAW,IAAI,IAAI,CAKlB;IAwJD;;;;;;;;OAQG;IACH,WAAW,IAAI,IAAI,CAQlB;IAED;;;;;;OAMG;IACH,eAAe,IAAI,IAAI,CAKtB;IAED,kDAAkD;IAClD,gBAAgB,IAAI,IAAI,CAEvB;IAED;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI,CAMxB;IAED;;;;;;;OAOG;IACH,OAAO,IAAI,IAAI,CAcd;IAoPD;;;;;;;;;OASG;IACH,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAkBhE;IA4fD;;;;;;;;;;;;;;OAcG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,GAAE,SAAS,aAAa,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB5F;IAED;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAM9B;IAmiBD;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,MAAM,GAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAyB,GAAG,IAAI,CAgBlF;CA0FF"}
+{"version":3,"file":"ag_ui_chat.d.ts","sourceRoot":"","sources":["../../src/core/ag_ui_chat.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAsB,IAAI,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,EAUL,YAAY,EAWb,MAAM,iBAAiB,CAAC;AAGzB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,kCAAkC,CAAC;AAGvF,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAC9F,OAAO,EAAwB,KAAK,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAwB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAE9E,OAAO,EAAoB,KAAK,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,wBAAwB,CAAC;AAchC,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASzF,OAAO,EAAE,KAAK,aAAa,EAAsB,MAAM,iBAAiB,CAAC;AACzE,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAG1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,YAAY,EAAmB,MAAM,wBAAwB,CAAC;AAG5E,OAAO,EAAE,KAAK,iBAAiB,EAAmB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,KAAK,aAAa,EAAoB,MAAM,wBAAwB,CAAC;AAG9E,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE3E,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,SAAS,aAAa,EAAE,CAAC;CAChD;AAED,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,SAAS,aAAa,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,sFAAsF;AACtF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACpC;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;CACpC;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AA+DD;;;;;;;;;;GAUG;AACH,qBAAa,QAAS,SAAQ,WAAW;;IACvC,wEAAwE;IACxE,YAAY,EAAE,YAAY,CAAmB;IAE7C;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM;IAErC;;;;;;;;OAQG;IACH,UAAU,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CAAQ;IAEzD;;;;;;;;;;;;;;OAcG;IACH,cAAc,EAAE,SAAS,MAAM,EAAE,CAAM;IAEvC;;;;;OAKG;IACH,WAAW,UAAS;IAEpB,yEAAyE;IACzE,WAAW,UAAS;IAEpB;;;;;OAKG;IACH,OAAO,UAAS;IAEhB;;;;OAIG;IACH,eAAe,EAAE,gBAAgB,GAAG,IAAI,CAAQ;IAEhD;;;;;;OAMG;IACH,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAQ;IAEjD;;;;;;OAMG;IACH,gBAAgB,EACZ,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,GACjF,IAAI,CAAQ;IAEhB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,IAAI,EAAE,CAOpB;IAEF;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,OAAO,EAAE,CAEzB;IAEF;;;OAGG;IACH,QAAQ,EAAE,QAAQ,CAAM;IAExB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAQ;IAEjD,iEAAiE;IACjE,UAAU,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,IAAI,CAAQ;IAE1C,iEAAiE;IACjE,iBAAiB,UAAQ;IAEzB;;;;OAIG;IACH,iBAAiB,EAAE,uBAAuB,CAA6B;IAEvE;;;;;;OAMG;IACH,aAAa,EAAE,aAAa,GAAG,IAAI,CAAQ;IAE3C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAQ;IAEnD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,UAAU,EAAE,oBAAoB,KAAK,OAAO,CAG5D;IAEH;;;;OAIG;IACH,YAAY,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAc;IAEzD;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM;IAE3C;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAM;IAEjC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAA2D;IAoK/F,cAqCC;IAsED,oEAAoE;IACpE,MAAM,KAAK,kBAAkB,IAAI,MAAM,EAAE,CAExC;IAED,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CA0D1F;IAED;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAEnC;IAED;;;;;;;;OAQG;IACH,IAAI,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEnD;IAED,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAKvD;IAED,6EAA6E;IAC7E,iBAAiB,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAI1C;IAED;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAE1C;IAiKD,kEAAkE;IAClE,IAAI,QAAQ,IAAI,MAAM,CAErB;IAKD,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAEzB;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,EAExB;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,IAAI,WAAW,IAAI,kBAAkB,GAAG,IAAI,CAG3C;IAED,IAAI,WAAW,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,EAe/C;IAwDD;;;;;;;OAOG;IACH,IAAI,WAAW,IAAI,eAAe,CAUjC;IAED,IAAI,WAAW,CAAC,KAAK,EAAE,eAAe,EAErC;IAED,iBAAiB,IAAI,IAAI,CAqDxB;IAiCD;;;;;;;;;;;;OAYG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAK5B;IAED;;;;;OAKG;IACH,oBAAoB,IAAI,IAAI,CAa3B;IA8MD;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,IAAI,CAGxC;IAiHD,gFAAgF;IAChF,IAAI,SAAS,IAAI,OAAO,CAEvB;IAID,IAAI,SAAS,CAAC,KAAK,EAAE,OAAO,EAE3B;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAiBrC;IAED;;;;;OAKG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,qEAAqE;IACrE,eAAe,IAAI,IAAI,CAEtB;IAED;;;;;OAKG;IACH,WAAW,IAAI,IAAI,CAKlB;IAoRD;;;;;;;;OAQG;IACH,WAAW,IAAI,IAAI,CAQlB;IAED;;;;;;OAMG;IACH,eAAe,IAAI,IAAI,CAKtB;IAED,kDAAkD;IAClD,gBAAgB,IAAI,IAAI,CAEvB;IAED;;;;;OAKG;IACH,iBAAiB,IAAI,IAAI,CAMxB;IAED;;;;;;;OAOG;IACH,OAAO,IAAI,IAAI,CAcd;IAuPD;;;;;;;;;OASG;IACH,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAkBhE;IA4fD;;;;;;;;;;;;;;OAcG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,GAAE,SAAS,aAAa,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB5F;IAED;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAM9B;IAmnBD;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,MAAM,GAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAyB,GAAG,IAAI,CAgBlF;CA0FF"}

package/dist/core/agui_client.d.ts

@@ -87,7 +87,14 @@ export interface AgUiClientHandlers {
     onActivityChanged(messageId: string, activityType: string, content: unknown): void;
     /** Fired when a reasoning model starts emitting its chain-of-thought. */
     onReasoningStart(): void;
-    /** Fired on every reasoning token; ``buffer`` is the full reasoning text so far. */
+    /**
+     * Fired on every reasoning token, and once more when the block ends.
+     *
+     * ``buffer`` is the text accumulated *before* the token that triggered the
+     * call, which is what the protocol client passes -- so the stream trails by
+     * one delta and the final call, at the end of the block, is what completes
+     * it. Render the buffer wholesale rather than appending it.
+     */
     onReasoningDelta(buffer: string): void;
     /** Fired when the reasoning block ends (before the answer text streams). */
     onReasoningEnd(): void;

package/dist/core/agui_client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agui_client.d.ts","sourceRoot":"","sources":["../../src/core/agui_client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAe,IAAI,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAEpG;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,UAAU,EAAE,SAAS,SAAS,EAAE,KAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,IAAI,IAAI,CAAC;IACnB,uEAAuE;IACvE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,8EAA8E;IAC9E,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,+EAA+E;IAC/E,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD;;;;OAIG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;;;;;;OASG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnF,yEAAyE;IACzE,gBAAgB,IAAI,IAAI,CAAC;IACzB,oFAAoF;IACpF,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,4EAA4E;IAC5E,cAAc,IAAI,IAAI,CAAC;IACvB,QAAQ,IAAI,IAAI,CAAC;IACjB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,IAAI,IAAI,CAAC;IACpB;;;;OAIG;IACH,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,sEAAsE;IACtE,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,oEAAoE;IACpE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,KAAK,IAAI,CAAC;IACnD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;IACpE;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,UAAU;;IAmBrB,YAAY,MAAM,EAAE,gBAAgB,EAoBnC;IAED,oEAAoE;IACpE,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE7C;IAED,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAEvD;IAED,4CAA4C;IAC5C,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,wEAAwE;IACxE,IAAI,QAAQ,IAAI,SAAS,OAAO,EAAE,CAEjC;IAED;;;;;;;;;;OAUG;IACG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,GAAE,SAAS,aAAa,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrF;IAED;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAE5B;IAED,0EAA0E;IAC1E,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAGvD;IAED;;;;;;OAMG;IACH,MAAM,IAAI,IAAI,CAGb;CAiPF"}
+{"version":3,"file":"agui_client.d.ts","sourceRoot":"","sources":["../../src/core/agui_client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAe,IAAI,EAAE,MAAM,aAAa,CAAC;AAElF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC;AAEpG;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,UAAU,EAAE,SAAS,SAAS,EAAE,KAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,IAAI,IAAI,CAAC;IACnB,uEAAuE;IACvE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,8EAA8E;IAC9E,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,+EAA+E;IAC/E,UAAU,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD;;;;OAIG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;;;;;;OASG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACnF,yEAAyE;IACzE,gBAAgB,IAAI,IAAI,CAAC;IACzB;;;;;;;OAOG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,4EAA4E;IAC5E,cAAc,IAAI,IAAI,CAAC;IACvB,QAAQ,IAAI,IAAI,CAAC;IACjB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,IAAI,IAAI,CAAC;IACpB;;;;OAIG;IACH,SAAS,IAAI,IAAI,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,sEAAsE;IACtE,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,oEAAoE;IACpE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,KAAK,IAAI,CAAC;IACnD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;IACpE;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,UAAU;;IAmBrB,YAAY,MAAM,EAAE,gBAAgB,EAoBnC;IAED,oEAAoE;IACpE,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAE7C;IAED,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAEvD;IAED,4CAA4C;IAC5C,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,wEAAwE;IACxE,IAAI,QAAQ,IAAI,SAAS,OAAO,EAAE,CAEjC;IAED;;;;;;;;;;OAUG;IACG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,GAAE,SAAS,aAAa,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrF;IAED;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAE5B;IAED,0EAA0E;IAC1E,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAGvD;IAED;;;;;;OAMG;IACH,MAAM,IAAI,IAAI,CAGb;CA2PF"}

package/dist/core/conversation_store.d.ts

@@ -84,6 +84,23 @@ export interface ClientConversationStore {
      */
     isUnsent?(threadId: string): boolean;
 }
+/**
+ * `sessionStorage.setItem` that survives a store which refuses to write.
+ *
+ * `setItem` throws on an exhausted quota (a long conversation, or one turn
+ * carrying a large tool result) and in privacy modes that deny storage
+ * altogether. Every write here is a *durability* concern — surviving a reload —
+ * and none of them is worth an exception, because of where they are called
+ * from: the element persists the transcript from inside the run loop, so an
+ * unguarded throw escapes as a run error and tells the user the agent failed
+ * when nothing but the browser's storage did. On the cancel path it escapes as
+ * an unhandled rejection instead.
+ *
+ * So a failed write loses the reload, never the conversation on screen, and
+ * says so once. Recovery is in the user's hands already: deleting the oversized
+ * thread from the history drawer is a `removeItem`, which frees the quota.
+ */
+export declare function writeStoredItem(key: string, value: string): void;
 /**
  * Default {@link ClientConversationStore}: per-tab `sessionStorage`.
  *
@@ -95,11 +112,36 @@ export interface ClientConversationStore {
  * An optional `namespace` scopes every key to one element, so two
  * `<ag-ui-chat>` instances on the same origin keep separate active-thread
  * pointers and drawer indexes instead of clobbering each other. The default
- * empty namespace keeps the origin-global keys; see {@link #migrateLegacyKeys}.
+ * empty namespace keeps the origin-global keys, which a namespaced store adopts
+ * on construction; see {@link SessionStorageStore.adopt}.
  */
 export declare class SessionStorageStore implements ClientConversationStore {
     #private;
     constructor(namespace?: string);
+    /**
+     * Move every key a store owns out of `from`'s namespace and into `to`'s.
+     *
+     * Two callers, one move. The constructor adopts the pre-namespacing global
+     * keys (`from` = `""`); `<ag-ui-chat>` adopts an element-scoped conversation
+     * into a principal-scoped one the first time a `user-key` arrives, which is a
+     * host naming the user who was already there rather than a handover.
+     *
+     * Only this store's own suffixes move — the element's `collapsed` / `size` /
+     * `theme` keys share the global root and are deliberately left where they
+     * are. A value already present at the destination wins: the destination is
+     * the durable record and the source is the stray this move exists to clear.
+     */
+    static adopt(from: string, to: string): void;
+    /**
+     * Forget everything a store holds for `namespace`.
+     *
+     * The logout primitive: `<ag-ui-chat>` calls it when its `user-key` changes,
+     * and a host driving its own store can call it from its own sign-out path.
+     * Deliberately narrow — it removes only keys under this exact namespace whose
+     * suffix parses as one this store writes, so it can never reach another
+     * element's conversation or the host's own `sessionStorage` entries.
+     */
+    static purge(namespace: string): void;
     threadId(): string;
     newThread(): string;
     isUnsent(threadId: string): boolean;

package/dist/core/conversation_store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"conversation_store.d.ts","sourceRoot":"","sources":["../../src/core/conversation_store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,QAAQ,IAAI,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,IAAI,MAAM,CAAC;IACrB,sEAAsE;IACtE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,8EAA8E;IAC9E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC;IACnE,0EAA0E;IAC1E,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAAC;IAC9D,4EAA4E;IAC5E,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;IAChF,+EAA+E;IAC/E,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,+EAA+E;IAC/E,WAAW,IAAI,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,gEAAgE;IAChE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC;AAwBD;;;;;;;;;;;;GAYG;AACH,qBAAa,mBAAoB,YAAW,uBAAuB;;IAGjE,YAAY,SAAS,SAAK,EAKzB;IAED,QAAQ,IAAI,MAAM,CAEjB;IAED,SAAS,IAAI,MAAM,CAKlB;IAED,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKlC;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC,CAEjE;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAIjE;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAE5D;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAO9E;IAED,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAW5B;IAED,WAAW,IAAI,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAK5C;IAED,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEtC;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CASlD;CAuFF"}
+{"version":3,"file":"conversation_store.d.ts","sourceRoot":"","sources":["../../src/core/conversation_store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,QAAQ,IAAI,MAAM,CAAC;IACnB;;;;;;;;;;OAUG;IACH,SAAS,CAAC,IAAI,MAAM,CAAC;IACrB,sEAAsE;IACtE,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACnE,8EAA8E;IAC9E,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC;IACnE,0EAA0E;IAC1E,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAAC;IAC9D,4EAA4E;IAC5E,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;IAChF,+EAA+E;IAC/E,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,+EAA+E;IAC/E,WAAW,IAAI,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,gEAAgE;IAChE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACpD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CACtC;AAoBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAehE;AAgBD;;;;;;;;;;;;;GAaG;AACH,qBAAa,mBAAoB,YAAW,uBAAuB;;IAGjE,YAAY,SAAS,SAAK,EAOzB;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAW3C;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAIpC;IAED,QAAQ,IAAI,MAAM,CAEjB;IAED,SAAS,IAAI,MAAM,CAKlB;IAED,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKlC;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC,CAEjE;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAIjE;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAE5D;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAO9E;IAED,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAW5B;IAED,WAAW,IAAI,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAK5C;IAED,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEtC;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CASlD;CAwDF"}

package/dist/core/create_http_agent.d.ts

@@ -30,6 +30,19 @@ export interface HttpAgentOptions {
      * server streams `STATE_SNAPSHOT` / `STATE_DELTA`.
      */
     initialState?: Readonly<Record<string, unknown>>;
+    /**
+     * Origins, besides the document's own, this agent may carry the host's
+     * credentials to.
+     *
+     * Running the agent on another subdomain is a normal deployment and stays
+     * supported, so a cross-origin endpoint is not refused — it is *announced*,
+     * once per origin, on the console. Listing an origin here says the
+     * destination was chosen deliberately and silences the notice for it.
+     *
+     * Entries are compared as serialized origins (`https://agent.example.com`,
+     * scheme and port included), which is what `URL.origin` produces.
+     */
+    trustedOrigins?: readonly string[];
 }
 /**
  * Build an AG-UI {@link HttpAgent} pointed at `endpoint`.

package/dist/core/create_http_agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create_http_agent.d.ts","sourceRoot":"","sources":["../../src/core/create_http_agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAa,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,eAAe,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CA4BxE;AAED,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC"}
+{"version":3,"file":"create_http_agent.d.ts","sourceRoot":"","sources":["../../src/core/create_http_agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAa,MAAM,eAAe,CAAC;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,eAAe,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAqCxE;AAED,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,aAAa,CAAC"}

package/dist/core/remote_conversation_store.d.ts

@@ -23,10 +23,32 @@ type CredentialsProvider = () => RequestCredentials | undefined;
  * the fallback when a request fails. Rename and delete apply optimistically via
  * a local overlay, so the drawer reflects them before the fire-and-forget
  * round-trip lands.
+ *
+ * Pass `cacheMessages: false` to keep message bodies out of the browser
+ * entirely; see the constructor.
  */
 export declare class RemoteConversationStore implements ClientConversationStore {
     #private;
-    constructor(url: string, headers?: HeadersProvider, local?: ClientConversationStore, credentials?: CredentialsProvider);
+    /**
+     * @param cacheMessages Whether to mirror message bodies into the local store.
+     *
+     * `true` (the default, and the behaviour this class has always had) keeps a
+     * local copy of every turn, so the transcript still replays when the thread
+     * endpoint is unreachable. `false` is for the deployment that chose a
+     * server-backed store precisely so transcripts do not sit in the browser:
+     * regulated content, a shared workstation, an operator who has to be able to
+     * say where the conversation lives. It is not the same as passing a local
+     * store that does nothing — the local store also owns the active thread id,
+     * the navigation checkpoint and the "nothing sent here yet" marker, all of
+     * which must keep working — so the opt-out is scoped to the bodies alone.
+     *
+     * The cost is deliberate and worth stating: with no local copy there is
+     * nothing to fall back to, so a failed request shows an empty transcript
+     * rather than a stale one, and the drawer's offline list loses its previews
+     * (a preview is an excerpt of a message, which is the very thing being kept
+     * off the client).
+     */
+    constructor(url: string, headers?: HeadersProvider, local?: ClientConversationStore, credentials?: CredentialsProvider, cacheMessages?: boolean);
     threadId(): string;
     setActiveThread(threadId: string): void;
     /**

package/dist/core/remote_conversation_store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote_conversation_store.d.ts","sourceRoot":"","sources":["../../src/core/remote_conversation_store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAWjC,sFAAsF;AACtF,KAAK,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpD;;;;GAIG;AACH,KAAK,mBAAmB,GAAG,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAEhE;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,uBAAwB,YAAW,uBAAuB;;IAQrE,YACE,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,eAA4B,EACrC,KAAK,GAAE,uBAAmD,EAC1D,WAAW,GAAE,mBAAqC,EAMnD;IAED,QAAQ,IAAI,MAAM,CAEjB;IAED,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEtC;IAED;;;;OAIG;IACH,SAAS,IAAI,MAAM,CAElB;IAED,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElC;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAGjE;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAE5D;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAE9E;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIlD;IAED,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAI5B;IAEK,WAAW,IAAI,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAMlD;IAEK,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC,CAsBvE;CAoEF"}
+{"version":3,"file":"remote_conversation_store.d.ts","sourceRoot":"","sources":["../../src/core/remote_conversation_store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAEzB,KAAK,UAAU,EAChB,MAAM,yBAAyB,CAAC;AAWjC,sFAAsF;AACtF,KAAK,eAAe,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpD;;;;GAIG;AACH,KAAK,mBAAmB,GAAG,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,uBAAwB,YAAW,uBAAuB;;IASrE;;;;;;;;;;;;;;;;;;OAkBG;IACH,YACE,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,eAA4B,EACrC,KAAK,GAAE,uBAAmD,EAC1D,WAAW,GAAE,mBAAqC,EAClD,aAAa,UAAO,EAOrB;IAED,QAAQ,IAAI,MAAM,CAEjB;IAED,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAEtC;IAED;;;;OAIG;IACH,SAAS,IAAI,MAAM,CAElB;IAED,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElC;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,IAAI,CAWjE;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAE5D;IAED,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAE9E;IAED,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIlD;IAED,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAI5B;IAEK,WAAW,IAAI,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAMlD;IAEK,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC,CAsBvE;CAoEF"}

package/dist/core/utils.d.ts

@@ -21,4 +21,32 @@ export declare function withCredentials(init: RequestInit | undefined, credentia
  * conversation is not a reason to destroy the previous one.
  */
 export declare function mintThread(store: ClientConversationStore): string;
+/**
+ * Announce host credentials about to leave the document's origin.
+ *
+ * `endpoint` and its six sibling URL attributes are plain HTML, and a page that
+ * interpolates one from a query parameter or from tenant-authored
+ * configuration has handed an attacker the destination. The browser preflights
+ * the custom header, any server willing to answer `Access-Control-Allow-Headers`
+ * receives it, and the token leaves on the element's very first request —
+ * before the user has done anything. Nothing else in this package compares a
+ * configured URL against an expected origin, so without this the delivery is
+ * silent, which is the only part of that sequence worth changing.
+ *
+ * A warning rather than a refusal because a cross-origin agent is a documented
+ * deployment: refusing would break working installations to defend against a
+ * page that is already interpolating untrusted data into its own markup. What
+ * it removes is the silence.
+ *
+ * `warned` is supplied by the caller rather than held here, per this package's
+ * rule against shared mutable state: two elements on one page must each get
+ * their own notice, and the set lives exactly as long as its owner.
+ *
+ * Every configured URL goes through this, not the agent endpoint alone. The
+ * tool catalog, the skills list, the thread and attachment endpoints and the
+ * upload target are all named by the same kind of host attribute and all carry
+ * the same headers, so covering one of them and not the rest would report the
+ * least interesting of the seven.
+ */
+export declare function warnOnCrossOriginCredentials(url: string | URL, credentialNames: readonly string[], trustedOrigins: readonly string[], warned: Set<string>): void;
 //# sourceMappingURL=utils.d.ts.map

package/dist/core/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/core/utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,WAAW,EAAE,kBAAkB,GAAG,SAAS,GAC1C,WAAW,GAAG,SAAS,CAEzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAOjE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/core/utils.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAEvE;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,WAAW,EAAE,kBAAkB,GAAG,SAAS,GAC1C,WAAW,GAAG,SAAS,CAEzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,uBAAuB,GAAG,MAAM,CAOjE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,eAAe,EAAE,SAAS,MAAM,EAAE,EAClC,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAClB,IAAI,CAwBN"}