@belonguniverseai/react-sdk 0.1.0

package/dist/components/ui/select.d.ts

@@ -0,0 +1,15 @@
+import { Select as SelectPrimitive } from 'radix-ui';
+import * as React from "react";
+declare function Select({ ...props }: React.ComponentProps<typeof SelectPrimitive.Root>): React.JSX.Element;
+declare function SelectGroup({ ...props }: React.ComponentProps<typeof SelectPrimitive.Group>): React.JSX.Element;
+declare function SelectValue({ ...props }: React.ComponentProps<typeof SelectPrimitive.Value>): React.JSX.Element;
+declare function SelectTrigger({ className, size, children, ...props }: React.ComponentProps<typeof SelectPrimitive.Trigger> & {
+    size?: "sm" | "default";
+}): React.JSX.Element;
+declare function SelectContent({ className, children, position, align, ...props }: React.ComponentProps<typeof SelectPrimitive.Content>): React.JSX.Element;
+declare function SelectLabel({ className, ...props }: React.ComponentProps<typeof SelectPrimitive.Label>): React.JSX.Element;
+declare function SelectItem({ className, children, ...props }: React.ComponentProps<typeof SelectPrimitive.Item>): React.JSX.Element;
+declare function SelectSeparator({ className, ...props }: React.ComponentProps<typeof SelectPrimitive.Separator>): React.JSX.Element;
+declare function SelectScrollUpButton({ className, ...props }: React.ComponentProps<typeof SelectPrimitive.ScrollUpButton>): React.JSX.Element;
+declare function SelectScrollDownButton({ className, ...props }: React.ComponentProps<typeof SelectPrimitive.ScrollDownButton>): React.JSX.Element;
+export { Select, SelectContent, SelectGroup, SelectItem, SelectLabel, SelectScrollDownButton, SelectScrollUpButton, SelectSeparator, SelectTrigger, SelectValue, };

package/dist/components/ui/separator.d.ts

@@ -0,0 +1,4 @@
+import { Separator as SeparatorPrimitive } from 'radix-ui';
+import * as React from "react";
+declare function Separator({ className, orientation, decorative, ...props }: React.ComponentProps<typeof SeparatorPrimitive.Root>): React.JSX.Element;
+export { Separator };

package/dist/components/ui/spinner.d.ts

@@ -0,0 +1,2 @@
+declare function Spinner({ className, ...props }: React.ComponentProps<"svg">): import("react").JSX.Element;
+export { Spinner };

package/dist/components/ui/switch.d.ts

@@ -0,0 +1,6 @@
+import { Switch as SwitchPrimitive } from 'radix-ui';
+import * as React from "react";
+declare function Switch({ className, size, ...props }: React.ComponentProps<typeof SwitchPrimitive.Root> & {
+    size?: "sm" | "default";
+}): React.JSX.Element;
+export { Switch };

package/dist/components/ui/tabs.d.ts

@@ -0,0 +1,11 @@
+import { VariantProps } from 'class-variance-authority';
+import { Tabs as TabsPrimitive } from 'radix-ui';
+import * as React from "react";
+declare function Tabs({ className, orientation, ...props }: React.ComponentProps<typeof TabsPrimitive.Root>): React.JSX.Element;
+declare const tabsListVariants: (props?: ({
+    variant?: "default" | "line" | null | undefined;
+} & import('class-variance-authority/types').ClassProp) | undefined) => string;
+declare function TabsList({ className, variant, ...props }: React.ComponentProps<typeof TabsPrimitive.List> & VariantProps<typeof tabsListVariants>): React.JSX.Element;
+declare function TabsTrigger({ className, ...props }: React.ComponentProps<typeof TabsPrimitive.Trigger>): React.JSX.Element;
+declare function TabsContent({ className, ...props }: React.ComponentProps<typeof TabsPrimitive.Content>): React.JSX.Element;
+export { Tabs, TabsList, TabsTrigger, TabsContent, tabsListVariants };

package/dist/components/ui/textarea.d.ts

@@ -0,0 +1,3 @@
+import * as React from "react";
+declare function Textarea({ className, ...props }: React.ComponentProps<"textarea">): React.JSX.Element;
+export { Textarea };

package/dist/components/ui/tooltip.d.ts

@@ -0,0 +1,7 @@
+import { Tooltip as TooltipPrimitive } from 'radix-ui';
+import * as React from "react";
+declare function TooltipProvider({ delayDuration, ...props }: React.ComponentProps<typeof TooltipPrimitive.Provider>): React.JSX.Element;
+declare function Tooltip({ ...props }: React.ComponentProps<typeof TooltipPrimitive.Root>): React.JSX.Element;
+declare function TooltipTrigger({ ...props }: React.ComponentProps<typeof TooltipPrimitive.Trigger>): React.JSX.Element;
+declare function TooltipContent({ className, sideOffset, children, ...props }: React.ComponentProps<typeof TooltipPrimitive.Content>): React.JSX.Element;
+export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };

package/dist/embed/agent-grant-refresh.d.ts

@@ -0,0 +1,37 @@
+import { AgentGrantStatusView } from '../api/agent-grants.ts';
+import { ChatMode } from './chat-mode.ts';
+/**
+ * Re-grant once an active grant has this long or less until expiry.
+ * Deliberately larger than the status poll cadence (`grantStatusPollMs`,
+ * ~30 min) so at least one poll lands inside the window before expiry.
+ */
+export declare const DEFAULT_GRANT_REFRESH_WINDOW_MS: number;
+/**
+ * The active refresh window, with a per-session diagnostic override
+ * (`localStorage["belong:grant-refresh-window-ms"]`) — set it very large in one
+ * tab to refresh on every poll and exercise the loop live (BEL-79). The shipped
+ * default stays safe for every other dock.
+ */
+export declare const grantRefreshWindowMs: () => number;
+/**
+ * The grant the dock should preemptively refresh now, or null. Pure: the caller
+ * supplies `nowMs`, the last-attempted id, and the (possibly overridden)
+ * `windowMs`.
+ *
+ * Only Auto ("bypass") mode auto-refreshes — it is the unattended mode where a
+ * silent re-grant matches the existing auto-consent (BEL-75); the other modes
+ * have a human present who reconnects via the card. `none`/`expired` belong to
+ * the consent effect (and a re-grant there would be a connect, not a refresh);
+ * `revoked` is the explicit kill switch and must never auto-reconnect.
+ *
+ * Returns the `grantId` so the caller can fire at most once per active grant:
+ * a successful refresh yields a new grant id, which naturally re-arms the next
+ * cycle (~once per grant lifetime — low churn).
+ */
+export declare const grantIdToRefresh: (input: {
+    readonly mode: ChatMode;
+    readonly view: AgentGrantStatusView;
+    readonly nowMs: number;
+    readonly lastAttemptedGrantId: string | null;
+    readonly windowMs: number;
+}) => string | null;

package/dist/embed/at-mentions.d.ts

@@ -0,0 +1,80 @@
+import { WorkspaceFile } from '../api/workspace-files.ts';
+/** An active `@`-mention token: the `@` at [start], caret at [end], `query` between. */
+export type AtMentionMatch = {
+    readonly query: string;
+    readonly start: number;
+    readonly end: number;
+};
+/** Default rows shown in the picker — enough to scan, few enough to not scroll. */
+export declare const AT_MENTION_LIMIT = 8;
+/**
+ * A picked path is embedded in the draft as `@<escaped-path>`, where spaces and
+ * backslashes are backslash-escaped (`a b` → `a\ b`, `a\b` → `a\\b`). That keeps
+ * a path containing spaces a SINGLE token — only the trailing UNescaped space
+ * commits it — which is exactly how Claude Code escapes its `@`-referenced
+ * paths, so the text the agent receives reads the same. {@link unescapeMentionPath}
+ * reverses it; the chip/pill always display the unescaped (real) path. Pure.
+ */
+export declare const escapeMentionPath: (path: string) => string;
+/** Reverse {@link escapeMentionPath}: a backslash makes the next char literal. Pure. */
+export declare const unescapeMentionPath: (token: string) => string;
+/**
+ * Detect a `@`-mention being typed at `caret` within `text`. Returns the `@`
+ * position, the caret, and the query (the run between them) — or null when the
+ * caret is not inside a `@token`. The `@` must start the text or follow
+ * whitespace (so an email like `user@host` never triggers), and the run from `@`
+ * to the caret must contain no whitespace (a space ends the token). The query may
+ * be empty — bare `@` opens the picker with the default rows.
+ */
+export declare const atMentionMatch: (text: string, caret: number) => AtMentionMatch | null;
+/**
+ * Rank the workspace files for the typed query: filename-prefix matches first,
+ * then any path-substring match, capped at `limit`. An EMPTY query (bare `@`)
+ * surfaces the most-recently-modified files — typically what the agent just
+ * wrote, which is what the user most often wants to reference. Pure.
+ */
+export declare const filterWorkspaceFiles: (files: readonly WorkspaceFile[], query: string, limit?: number) => readonly WorkspaceFile[];
+/**
+ * Replace the matched `@query` token with `@<escaped-path> ` (a trailing space
+ * commits the token so the picker closes and typing continues after it). The
+ * path is escaped ({@link escapeMentionPath}) so spaces in the filename don't
+ * split the token. Returns the new draft and the caret position just past the
+ * inserted space. A space already at the splice point is absorbed so we never
+ * leave `@path  rest`. Pure.
+ */
+export declare const applyMention: (text: string, match: AtMentionMatch, path: string) => {
+    readonly text: string;
+    readonly caret: number;
+};
+/** A `@<path>` reference span in the draft: `text.slice(start, end)` is `@<path>`. */
+export type MentionToken = {
+    readonly start: number;
+    readonly end: number;
+};
+/**
+ * Every committed `@<path>` reference in the draft — a `@` at start-of-text or
+ * after whitespace, followed by ≥1 char up to the first UNescaped whitespace.
+ * A backslash escapes the next char, so a `\ ` inside the path stays part of the
+ * token (see {@link escapeMentionPath}); `text.slice(start+1, end)` is the
+ * escaped path, which the caller unescapes for display. These are what the
+ * composer renders as chips and deletes atomically. Pure. (The reference being
+ * actively TYPED — the one the picker is open for — is excluded by the caller via
+ * its start offset; here we just find every `@token` shape.)
+ */
+export declare const findMentionTokens: (text: string) => readonly MentionToken[];
+/**
+ * The range a Backspace/Delete should remove so a whole `@<path>` reference goes
+ * at once (the chip is one unit) — or null to fall through to normal character
+ * deletion. Only acts on a COLLAPSED caret adjacent to a committed reference;
+ * `activeStart` (the reference currently being typed, if any) is never atomic —
+ * you're editing it. Pure. The contentEditable editor drives this explicitly
+ * because native chip deletion is unreliable (leading atoms resist a keystroke).
+ *
+ *   • Backspace: caret just past a reference's trailing space → drop reference +
+ *     space; caret exactly at a reference's end → drop it.
+ *   • Delete: caret at a reference's `@` → drop it (and a following space).
+ */
+export declare const atomicMentionDeletion: (text: string, caret: number, direction: "backward" | "forward", activeStart: number | null) => {
+    readonly from: number;
+    readonly to: number;
+} | null;

package/dist/embed/auth0-refresh.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Proactive Auth0 token refresh for hosts whose SPA signs the user in with
+ * `@auth0/auth0-spa-js` (e.g. Simetrik).
+ *
+ * The problem: the dock reads the host's access token straight from the Auth0
+ * SPA's localStorage cache (auto-embed.ts). But the host SPA only rotates that
+ * token LAZILY, on its own API calls. While the user is idle, the host makes no
+ * calls, the cached token expires (~50 min TTL), and the dock's long-lived
+ * paths — the browser-control relay and the chat SSE stream — fail to
+ * reconnect with a 401 ("No browser is attached").
+ *
+ * The fix (refresh-at-boundary): construct OUR OWN `Auth0Client` keyed to the
+ * SAME `clientId` / `audience` / `scope` the host uses. With
+ * `cacheLocation: "localstorage"` it shares the EXACT same `@@auth0spajs@@`
+ * cache entry AND the same `browser-tabs-lock`, so `getTokenSilently()`:
+ *   - returns the cached token when it's still valid (cheap, no network);
+ *   - rotates it via the refresh token when stale, writing the fresh token
+ *     back into the shared cache — lock-safely, without racing the host app.
+ *
+ * The per-request hot path stays the synchronous cache read (`peekBelongToken`,
+ * unchanged); this module is awaited only at staleness boundaries
+ * (`ensureFreshBelongToken`, called before relay/stream reconnect) plus a
+ * low-frequency idle keepalive. So a token the idle host stopped rotating is
+ * refreshed BEFORE the request that would otherwise 401.
+ *
+ * Degrades to a no-op when the host isn't Auth0-SPA-based (no matching cache
+ * entry) — the dock then behaves exactly as before (sync cache read only).
+ */
+/**
+ * The config needed to construct an `Auth0Client` that shares the host's cache.
+ * `clientId` / `audience` / `scope` come from the cache KEY; `domain` from the
+ * access token's `iss` claim.
+ */
+export type Auth0RefreshConfig = {
+    readonly domain: string;
+    readonly clientId: string;
+    readonly audience: string;
+    readonly scope: string;
+};
+/**
+ * A minimal client surface so tests can inject a fake (no real network).
+ *
+ * The real `Auth0Client.getTokenSilently` returns the access-token STRING by
+ * default, or the full token response when `detailedResponse: true`. We use the
+ * detailed form on the force path so we can read the freshly-minted
+ * `access_token` and detect the host-side "no rotation" case (see
+ * `forceMintFreshToken`). The return type is `unknown` because the two modes
+ * resolve to different shapes; the force path parses it.
+ */
+export type TokenRefreshClient = {
+    readonly getTokenSilently: (options?: {
+        readonly cacheMode?: "on" | "off" | "cache-only";
+        readonly detailedResponse?: boolean;
+    }) => Promise<unknown>;
+};
+/**
+ * Derive the Auth0 config from the host's `@@auth0spajs@@` localStorage cache.
+ * Returns null when no entry matches `audience` (host isn't Auth0-SPA, or the
+ * user isn't signed in for this API) — the caller then degrades to a no-op.
+ */
+export declare const deriveAuth0RefreshConfig: (audience: string) => Auth0RefreshConfig | null;
+export type InstallAuth0RefreshOptions = {
+    /** The API audience whose token the dock sends (matches auto-embed's). */
+    readonly audience: string;
+    /** Idle keepalive cadence; defaults to 10 min. */
+    readonly keepaliveIntervalMs?: number;
+    /** Injected in tests so no real Auth0Client / network is constructed. */
+    readonly createClient?: (config: Auth0RefreshConfig) => TokenRefreshClient;
+};
+/**
+ * Wire proactive refresh for the current host. Registers the async refresher
+ * (`ensureFreshBelongToken` then rotates on demand) and runs a low-frequency
+ * idle keepalive plus refresh-on-refocus/reconnect. Returns a disposer.
+ *
+ * No-op (returns an empty disposer) when the host isn't Auth0-SPA-based, so it
+ * is always safe to call from auto-embed.
+ */
+export declare const installAuth0Refresh: (options: InstallAuth0RefreshOptions) => (() => void);

package/dist/embed/auto-embed.d.ts

@@ -0,0 +1,19 @@
+/**
+ * One-script-tag auto-embed.
+ *
+ * Lets a host drop the dock in with a single tag and no glue JS:
+ *
+ *   <script src="https://…/belong-a3s-sdk.js" id="belong-sdk-script"
+ *           data-backend="https://api.example.com"></script>
+ *
+ * On load we find that tag, read `data-backend`, and — for hosts that sign the
+ * user in with Auth0 (e.g. Simetrik) — read the user's EXISTING access token
+ * straight from the Auth0 SPA's localStorage cache and forward it to the dock.
+ * No second sign-in, no `window.__auth0` global required. The token is
+ * re-read periodically + on tab focus, so when the Auth0 SPA rotates/refreshes
+ * it the dock follows.
+ *
+ * Hosts that init programmatically (`window.belong.init(...)`) simply omit
+ * `data-backend`; this then no-ops.
+ */
+export declare const autoEmbed: () => void;

package/dist/embed/bootstrap.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Side-effect bootstrap. Imported by `public-api.ts` so that any host
+ * script that imports the SDK gets `window.belong` automatically.
+ *
+ * Mounting the React tree is deferred to `init` so the host can wire
+ * the token + base URL before we render. The shadow-DOM + CSS-isolation
+ * mechanics live in `embed/shadow-mount.ts` (shared with the React component
+ * `component/BelongWidget.tsx`).
+ */
+export {};

package/dist/embed/brand-marks.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Brand marks as inline SVG data-URLs. The Belong mark is the existing
+ * multicolour organic glyph (moved here from BelongMark.tsx so the component
+ * and the Belong preset's logo build from one source). The Simetrik mark is
+ * the official Simetrik logo (a two-blob "S" in the brand indigo #3B3AF3),
+ * supplied as the real asset.
+ * Both are static strings: nothing host-controlled reaches the DOM.
+ */
+export declare const BELONG_INNER = "<defs><linearGradient id=\"g0\" gradientUnits=\"userSpaceOnUse\" x1=\"103\" y1=\"17\" x2=\"30\" y2=\"41\"><stop offset=\"0\" stop-color=\"#0F1B2E\"></stop><stop offset=\"1\" stop-color=\"#0F1B2E\"></stop></linearGradient><linearGradient id=\"g1\" gradientUnits=\"userSpaceOnUse\" x1=\"103\" y1=\"17\" x2=\"154\" y2=\"81\"><stop offset=\"0\" stop-color=\"#0F1B2E\"></stop><stop offset=\"1\" stop-color=\"#2D6F66\"></stop></linearGradient><linearGradient id=\"g2\" gradientUnits=\"userSpaceOnUse\" x1=\"154\" y1=\"81\" x2=\"112\" y2=\"142\"><stop offset=\"0\" stop-color=\"#2D6F66\"></stop><stop offset=\"1\" stop-color=\"#D9A441\"></stop></linearGradient><linearGradient id=\"g3\" gradientUnits=\"userSpaceOnUse\" x1=\"112\" y1=\"142\" x2=\"34\" y2=\"124\"><stop offset=\"0\" stop-color=\"#D9A441\"></stop><stop offset=\"1\" stop-color=\"#E06A4F\"></stop></linearGradient><linearGradient id=\"g4\" gradientUnits=\"userSpaceOnUse\" x1=\"34\" y1=\"124\" x2=\"30\" y2=\"41\"><stop offset=\"0\" stop-color=\"#E06A4F\"></stop><stop offset=\"1\" stop-color=\"#0F1B2E\"></stop></linearGradient></defs>\n  <g>\n  <path d=\"M 102.3,6.5 L 100.4,7.3 L 98.5,8.1 L 96.6,8.9 L 94.7,9.7 L 92.9,10.5 L 91.0,11.3 L 89.2,12.1 L 87.4,12.9 L 85.6,13.7 L 83.9,14.5 L 82.1,15.3 L 80.4,16.1 L 78.6,16.9 L 76.9,17.6 L 75.2,18.4 L 73.5,19.1 L 71.8,19.8 L 70.1,20.5 L 68.4,21.2 L 66.8,21.9 L 65.1,22.5 L 63.3,23.1 L 61.6,23.6 L 59.8,24.1 L 58.1,24.5 L 56.3,24.9 L 54.5,25.3 L 52.7,25.7 L 50.9,26.1 L 49.0,26.4 L 47.2,26.8 L 45.3,27.1 L 43.4,27.5 L 41.5,27.8 L 39.6,28.1 L 37.6,28.4 L 35.6,28.8 L 33.6,29.1 L 31.6,29.4 L 29.6,29.7 L 27.5,30.0 L 25.4,30.3 L 23.3,30.7 L 36.7,51.3 L 37.6,49.7 L 38.6,48.1 L 39.7,46.5 L 40.7,45.0 L 41.8,43.5 L 43.0,42.1 L 44.2,40.7 L 45.4,39.3 L 46.7,38.0 L 48.0,36.7 L 49.3,35.5 L 50.7,34.3 L 52.1,33.2 L 53.5,32.1 L 55.0,31.1 L 56.5,30.1 L 58.0,29.2 L 59.5,28.3 L 61.1,27.5 L 62.7,26.8 L 64.4,26.2 L 66.0,25.6 L 67.8,25.2 L 69.5,24.8 L 71.2,24.5 L 73.0,24.2 L 74.8,24.0 L 76.6,23.9 L 78.4,23.8 L 80.2,23.8 L 82.0,23.8 L 83.8,23.9 L 85.6,24.0 L 87.4,24.2 L 89.2,24.4 L 91.1,24.6 L 92.9,24.9 L 94.7,25.2 L 96.5,25.6 L 98.3,26.0 L 100.1,26.5 L 101.9,27.0 L 103.7,27.5 Z\" fill=\"url(#g0)\"></path>\n  <path d=\"M 96.7,25.4 L 98.6,26.0 L 100.4,26.6 L 102.3,27.3 L 104.1,28.0 L 105.9,28.7 L 107.7,29.5 L 109.5,30.3 L 111.2,31.2 L 112.9,32.1 L 114.6,33.0 L 116.3,34.0 L 117.9,35.0 L 119.5,36.1 L 121.0,37.2 L 122.6,38.3 L 124.1,39.5 L 125.5,40.7 L 126.9,42.0 L 128.3,43.3 L 129.6,44.6 L 130.9,46.0 L 132.0,47.5 L 133.1,49.1 L 134.2,50.6 L 135.1,52.3 L 136.0,53.9 L 136.9,55.6 L 137.7,57.3 L 138.4,59.1 L 139.1,60.9 L 139.8,62.7 L 140.3,64.5 L 140.9,66.3 L 141.4,68.2 L 141.8,70.1 L 142.2,72.0 L 142.5,73.9 L 142.8,75.8 L 143.0,77.8 L 143.2,79.8 L 143.3,81.7 L 143.4,83.7 L 143.4,85.7 L 164.6,76.3 L 163.0,74.7 L 161.4,73.2 L 159.9,71.6 L 158.4,70.1 L 156.8,68.6 L 155.3,67.1 L 153.8,65.7 L 152.3,64.2 L 150.9,62.7 L 149.4,61.3 L 148.0,59.8 L 146.6,58.4 L 145.2,57.0 L 143.8,55.6 L 142.4,54.1 L 141.1,52.7 L 139.7,51.3 L 138.4,49.9 L 137.1,48.4 L 135.8,47.0 L 134.6,45.5 L 133.4,44.0 L 132.2,42.5 L 131.1,40.9 L 130.0,39.3 L 128.9,37.7 L 127.8,36.1 L 126.7,34.5 L 125.6,32.8 L 124.5,31.2 L 123.4,29.5 L 122.3,27.8 L 121.2,26.1 L 120.0,24.4 L 118.9,22.7 L 117.8,21.0 L 116.6,19.2 L 115.4,17.5 L 114.2,15.7 L 113.0,14.0 L 111.8,12.2 L 110.6,10.4 L 109.3,8.6 Z\" fill=\"url(#g1)\"></path>\n  <path d=\"M 143.1,77.1 L 143.3,78.9 L 143.4,80.7 L 143.5,82.5 L 143.5,84.3 L 143.5,86.1 L 143.4,87.8 L 143.3,89.6 L 143.1,91.4 L 142.9,93.1 L 142.6,94.8 L 142.3,96.6 L 141.9,98.3 L 141.5,99.9 L 141.0,101.6 L 140.5,103.2 L 139.9,104.9 L 139.3,106.5 L 138.6,108.0 L 137.9,109.6 L 137.0,111.1 L 136.2,112.5 L 135.2,113.9 L 134.2,115.3 L 133.0,116.6 L 131.9,117.8 L 130.7,119.0 L 129.4,120.2 L 128.1,121.3 L 126.8,122.4 L 125.4,123.5 L 124.0,124.5 L 122.5,125.5 L 121.1,126.4 L 119.5,127.3 L 118.0,128.2 L 116.5,129.0 L 114.9,129.8 L 113.3,130.6 L 111.6,131.3 L 110.0,132.0 L 108.3,132.6 L 106.6,133.2 L 104.9,133.8 L 119.1,150.2 L 120.1,148.4 L 121.0,146.7 L 122.0,144.9 L 122.9,143.1 L 123.8,141.4 L 124.7,139.7 L 125.6,138.0 L 126.5,136.3 L 127.4,134.6 L 128.2,133.0 L 129.1,131.3 L 129.9,129.7 L 130.8,128.1 L 131.7,126.5 L 132.5,124.9 L 133.4,123.3 L 134.2,121.8 L 135.1,120.3 L 136.0,118.7 L 136.9,117.3 L 137.9,115.8 L 138.8,114.3 L 139.9,112.9 L 141.0,111.6 L 142.1,110.2 L 143.2,108.8 L 144.3,107.5 L 145.5,106.1 L 146.7,104.8 L 147.9,103.4 L 149.1,102.0 L 150.3,100.7 L 151.6,99.3 L 152.8,97.9 L 154.1,96.5 L 155.4,95.1 L 156.7,93.7 L 158.1,92.3 L 159.4,90.9 L 160.7,89.4 L 162.1,87.9 L 163.5,86.5 L 164.9,84.9 Z\" fill=\"url(#g2)\"></path>\n  <path d=\"M 111.7,131.1 L 109.9,131.9 L 108.1,132.5 L 106.3,133.2 L 104.5,133.8 L 102.6,134.4 L 100.8,134.9 L 98.9,135.4 L 97.1,135.8 L 95.2,136.2 L 93.4,136.5 L 91.5,136.8 L 89.6,137.0 L 87.8,137.2 L 85.9,137.4 L 84.0,137.4 L 82.2,137.5 L 80.3,137.4 L 78.4,137.3 L 76.6,137.2 L 74.8,137.0 L 72.9,136.7 L 71.2,136.2 L 69.4,135.7 L 67.6,135.1 L 65.9,134.4 L 64.2,133.7 L 62.5,132.9 L 60.9,132.1 L 59.3,131.1 L 57.7,130.2 L 56.1,129.1 L 54.6,128.1 L 53.1,126.9 L 51.6,125.8 L 50.1,124.5 L 48.7,123.3 L 47.3,121.9 L 46.0,120.6 L 44.6,119.2 L 43.4,117.7 L 42.1,116.2 L 40.9,114.7 L 39.7,113.1 L 28.3,134.9 L 30.5,135.1 L 32.7,135.3 L 34.8,135.4 L 37.0,135.6 L 39.1,135.8 L 41.2,135.9 L 43.3,136.1 L 45.3,136.3 L 47.3,136.4 L 49.3,136.6 L 51.3,136.8 L 53.3,137.0 L 55.3,137.2 L 57.2,137.4 L 59.1,137.7 L 61.0,137.9 L 62.9,138.1 L 64.8,138.4 L 66.7,138.7 L 68.6,139.0 L 70.4,139.4 L 72.2,139.8 L 74.1,140.3 L 75.9,140.8 L 77.7,141.4 L 79.5,142.0 L 81.3,142.5 L 83.2,143.1 L 85.0,143.8 L 86.9,144.4 L 88.7,145.0 L 90.6,145.7 L 92.5,146.3 L 94.4,147.0 L 96.3,147.6 L 98.2,148.3 L 100.2,148.9 L 102.2,149.6 L 104.1,150.3 L 106.1,150.9 L 108.2,151.6 L 110.2,152.2 L 112.3,152.9 Z\" fill=\"url(#g3)\"></path>\n  <path d=\"M 45.8,120.3 L 44.4,118.8 L 43.1,117.2 L 41.9,115.6 L 40.7,114.0 L 39.5,112.4 L 38.4,110.7 L 37.3,109.0 L 36.3,107.3 L 35.3,105.6 L 34.4,103.8 L 33.6,102.1 L 32.8,100.3 L 32.0,98.5 L 31.3,96.6 L 30.7,94.8 L 30.1,93.0 L 29.6,91.1 L 29.2,89.2 L 28.8,87.3 L 28.5,85.4 L 28.3,83.5 L 28.2,81.6 L 28.2,79.7 L 28.3,77.8 L 28.5,75.9 L 28.8,74.0 L 29.1,72.1 L 29.5,70.2 L 29.9,68.3 L 30.5,66.4 L 31.0,64.6 L 31.7,62.7 L 32.4,60.9 L 33.1,59.1 L 33.9,57.3 L 34.7,55.5 L 35.6,53.7 L 36.6,52.0 L 37.6,50.2 L 38.6,48.5 L 39.7,46.8 L 40.9,45.2 L 42.1,43.5 L 17.9,38.5 L 18.3,40.7 L 18.7,42.9 L 19.1,45.1 L 19.5,47.3 L 19.9,49.5 L 20.3,51.6 L 20.7,53.7 L 21.1,55.8 L 21.4,57.9 L 21.8,59.9 L 22.2,62.0 L 22.5,64.0 L 22.8,66.0 L 23.2,68.0 L 23.5,70.0 L 23.8,72.0 L 24.1,73.9 L 24.3,75.9 L 24.6,77.9 L 24.8,79.8 L 24.9,81.8 L 25.0,83.7 L 25.1,85.7 L 25.0,87.6 L 25.0,89.6 L 24.9,91.6 L 24.8,93.6 L 24.7,95.6 L 24.6,97.6 L 24.5,99.6 L 24.3,101.6 L 24.2,103.7 L 24.0,105.8 L 23.8,107.9 L 23.7,110.0 L 23.5,112.1 L 23.3,114.3 L 23.1,116.5 L 22.9,118.6 L 22.8,120.9 L 22.6,123.1 L 22.4,125.4 L 22.2,127.7 Z\" fill=\"url(#g4)\"></path>\n  <circle cx=\"30\" cy=\"41\" r=\"17\" fill=\"#0F1B2E\"></circle>\n  <circle cx=\"103\" cy=\"17\" r=\"14.5\" fill=\"#0F1B2E\"></circle>\n  <circle cx=\"154\" cy=\"81\" r=\"16\" fill=\"#2D6F66\"></circle>\n  <circle cx=\"112\" cy=\"142\" r=\"15\" fill=\"#D9A441\"></circle>\n  <circle cx=\"34\" cy=\"124\" r=\"17\" fill=\"#E06A4F\"></circle>\n  </g>";
+export declare const BELONG_MARK_DATA_URL: string;
+export declare const SIMETRIK_MARK_DATA_URL: string;

package/dist/embed/build-info.d.ts

@@ -0,0 +1,30 @@
+/**
+ * SDK build provenance, baked into the bundle by `define` (vite.config.ts) on
+ * the build machine:
+ *
+ *   __BELONG_SDK_VERSION__   "<git short sha>+<build date>", e.g. "8dbb882+2026-06-24"
+ *   __BELONG_SDK_BUILT_AT__  full ISO-8601 build timestamp, e.g. "2026-06-24T15:45:02.317Z"
+ *
+ * The release workflow builds and uploads the bundle in one CI job, so the
+ * build timestamp is our closest client-visible proxy for "when did this deploy
+ * go live" — surfaced as the deploy datetime in the dev panel
+ * (components/embed/dev-runtime-bar.tsx) and logged once at init (bootstrap.ts).
+ *
+ * Both constants are declared module-locally (not only in vite-env.d.ts) so
+ * consumers that typecheck the SDK FROM SOURCE — fakesaas resolves
+ * `types: ./src/public-api.ts` and never loads that ambient file — stay green.
+ * Surfaces that bypass vite.config.ts (Storybook's isolated pipeline) don't
+ * substitute the constants, so each read guards with `typeof`, which is
+ * uniquely safe on an undeclared identifier (yields "undefined", never throws).
+ */
+/** `<git short sha>+<build date>`, or "dev" on surfaces that don't bake it in. */
+export declare const SDK_VERSION: string;
+/** ISO-8601 build timestamp, or null when the bundle didn't bake one in. */
+export declare const SDK_BUILT_AT: string | null;
+/**
+ * The build timestamp formatted for the dev panel in the viewer's locale (a
+ * developer wants "when did this deploy go out, my time"), or null when there's
+ * no valid timestamp to show. The raw ISO string stays on SDK_BUILT_AT so the
+ * panel can keep it as an unambiguous hover title.
+ */
+export declare const formatBuiltAt: (iso: string | null) => string | null;

package/dist/embed/build-version.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Build version stamp — a UTC timestamp compressed to consecutive digits:
+ * `YYMMDDHHmmssSSS` (15 digits; every field is 2 digits except the 3-digit
+ * millisecond). Monotonically increasing, so a larger number is always a newer
+ * build.
+ *
+ * Computed once at Vite config-eval time and baked into the bundle via
+ * `define` — never recomputed in the browser. It is therefore regenerated on
+ * every `vp build` (the deployed SDK bundle) and every SDK dev-server start.
+ * Surfaced in the dock avatar menu directly above "Log out" (see
+ * EmbedAvatar.tsx) and logged once at init (embed/bootstrap.ts).
+ *
+ * Config-time tooling, NOT part of the runtime graph: the dock reads the
+ * injected `__BELONG_SDK_BUILD__` constant, never this module. It is imported
+ * only by the SDK's own Vite config (packages/belong-sdk/vite.config.ts), so it
+ * is tree-shaken out of the browser bundle. Co-located here with the embed
+ * surface that displays it. A host that serves the SDK from SOURCE rather than
+ * the built bundle (e.g. the fakesaas dev harness) compiles these files through
+ * its own Vite and so does not substitute the constant — the dock then shows
+ * "Build dev" via the `typeof` guard, exactly as __BELONG_SDK_VERSION__ does.
+ */
+/**
+ * Format an explicit date as the 15-digit build stamp. Pure + deterministic
+ * (UTC), so it is the unit-tested entry point.
+ */
+export declare const formatBuildVersion: (date: Date) => string;
+/** Stamp for "now" — called once per build/dev-server start from the Vite configs. */
+export declare const resolveBuildVersion: () => string;

package/dist/embed/chat-mode.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The dock's execution mode (BEL-75, unified with P0's autonomy dial) — the
+ * composer selector that controls how much human-in-the-loop a message gets:
+ *
+ *   plan     → the agent PROPOSES: read-only investigation + `propose_plan`,
+ *              mutating tools blocked server-side.
+ *   approve  → ask first: every consequential tool raises an approval card the
+ *              user resolves before the call runs.
+ *   balanced → ask once per kind of action: the first consequential call of a
+ *              kind raises an approval; resolving with "always allow" records a
+ *              consent so later calls of that kind run without asking.
+ *   bypass   → run without asking (the historical "execute" behavior, and the
+ *              default).
+ *
+ * Mode rides on each posted message (`postMessageSchema.mode`), so this is
+ * pure client UI state. Persisted best-effort to localStorage SCOPED TO THE
+ * SESSION (`{ sessionId, mode }`, zod-validated at the storage perimeter via
+ * the generic session-record store) so a reload of the same conversation
+ * resumes in the same mode, while a new chat / a different session opens in the
+ * bypass default. Deliberately a sibling key to `belong:stream-state` rather
+ * than a field on it: the stream cursor is written by the transport on every
+ * SSE tick and gated by a 120s resume window — neither of which applies to the
+ * mode, which the chat route owns and which must restore regardless of age.
+ * Private-mode / disabled storage — and a record persisted by a pre-unification
+ * build (`mode: "execute"`, or the old `autonomy` values, which fail the parse
+ * below) — just mean the dock opens back in the default.
+ */
+export type ChatMode = "plan" | "approve" | "balanced" | "bypass";
+/** The mode for new sessions and unparseable/legacy persisted records. */
+export declare const DEFAULT_CHAT_MODE: "bypass";
+/** The active conversation's mode (bypass until a chat route reads/writes). */
+export declare const peekCurrentChatMode: () => ChatMode;
+export declare const subscribeChatMode: (listener: () => void) => (() => void);
+/**
+ * The persisted mode for `sessionId`, or the bypass default when nothing is
+ * stored, the stored record belongs to a different session, or the value is
+ * corrupted / from an older build (the pre-session-scoped bare string, the
+ * pre-BEL-75 `"execute"` value, or a pre-unification `autonomy` value). Reading
+ * also publishes the resolved mode to the in-memory current-mode store so the
+ * dock shell follows the active conversation.
+ */
+export declare const readChatMode: (sessionId: string) => ChatMode;
+/** Persist `mode` as the choice for `sessionId` (replaces any prior record). */
+export declare const writeChatMode: (sessionId: string, mode: ChatMode) => void;
+/** Test-only: reset the in-memory current mode + listeners between tests. */
+export declare const __resetChatModeForTest: () => void;

package/dist/embed/composer-focus.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A 1-shot "focus the composer editor" signal.
+ *
+ * The composer (`EmbedComposer`) subscribes and focuses its contentEditable
+ * editor when fired. Callers elsewhere request focus without prop-drilling a
+ * ref through the dock — e.g. the voice-dictation flow drops a transcript into
+ * the draft and then `requestComposerFocus()` so the user can immediately edit
+ * the text or press Enter to send. A module-level emitter mirrors the
+ * voice-bus / plan-store external-store idiom used across the dock.
+ */
+/** Subscribe to focus requests; returns an unsubscribe. */
+export declare const subscribeComposerFocus: (listener: () => void) => (() => void);
+/** Ask the mounted composer to focus its editor (no-op when none is mounted). */
+export declare const requestComposerFocus: () => void;

package/dist/embed/copy.d.ts

@@ -0,0 +1,84 @@
+import { Locale } from './locale.ts';
+import { TourStep, TourStepId } from './onboarding-steps.ts';
+export type WelcomeCapabilityIcon = "exchange" | "command" | "microphone";
+export type WelcomeCardCopy = {
+    readonly greeting: (brandName: string) => string;
+    readonly subtitle: string;
+    readonly capabilities: readonly {
+        readonly icon: WelcomeCapabilityIcon;
+        readonly label: string;
+    }[];
+    readonly tourCta: string;
+    readonly skipCta: string;
+    readonly close: string;
+    readonly languageHint: string;
+};
+export type TourLabels = {
+    readonly counter: (current: number, total: number) => string;
+    readonly back: string;
+    readonly next: string;
+    readonly finish: string;
+    readonly skip: string;
+};
+export type TourCopy = TourLabels & {
+    readonly steps: Readonly<Record<TourStepId, {
+        readonly title: string;
+        readonly body: string;
+    }>>;
+};
+export type HintItem = {
+    readonly keyLabel: string;
+    readonly label: string;
+};
+export type MenuCopy = {
+    readonly signedInAs: (user: string) => string;
+    readonly notSignedIn: string;
+    readonly darkMode: string;
+    readonly lightMode: string;
+    readonly moveLeft: string;
+    readonly moveRight: string;
+    readonly voice: string;
+    readonly pushToTalk: string;
+    readonly pressAnyKey: string;
+    readonly change: string;
+    readonly reset: string;
+    readonly style: string;
+    readonly appearance: string;
+    readonly accentColor: string;
+    readonly customCss: string;
+    readonly logOut: string;
+};
+export type DockCopy = {
+    readonly welcomeCard: WelcomeCardCopy;
+    readonly tour: TourCopy;
+    readonly hints: {
+        readonly commands: HintItem;
+        readonly files: HintItem;
+        readonly voice: HintItem;
+    };
+    readonly replayMenu: string;
+    readonly language: {
+        readonly label: string;
+        readonly english: string;
+        readonly spanish: string;
+    };
+    readonly menu: MenuCopy;
+    readonly intro: {
+        readonly greeting: (brandName: string) => string;
+        readonly body: string;
+    };
+    readonly suggestions: readonly string[];
+    readonly composer: {
+        readonly placeholderDefault: string;
+        readonly placeholderPlan: string;
+        readonly voiceHint: (keyLabel: string) => string;
+        readonly micNotSupported: string;
+        readonly micNotConfigured: string;
+        readonly micTooltip: (keyLabel: string) => string;
+        readonly viewPlan: string;
+        readonly hidePlan: string;
+    };
+};
+export declare const DOCK_COPY: Record<Locale, DockCopy>;
+/** Merge the locale-independent step defs with this locale's titles/bodies. */
+export declare const buildTourSteps: (locale: Locale) => readonly TourStep[];

package/dist/embed/custom-css.d.ts

@@ -0,0 +1,2 @@
+export declare const parseCssVars: (text: string) => Record<string, string>;
+export declare const serializeCssVars: (vars: Record<string, string>) => string;

package/dist/embed/debug-overrides.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Dev/test diagnostic overrides, read from `localStorage`.
+ *
+ * The shipped SDK bundle carries SAFE production defaults; these let a single
+ * browser session opt into different values WITHOUT a separate build — so we
+ * can, e.g., tighten the agent-grant refresh cadence to verify the loop live
+ * (BEL-79) in one tab without making every other dock on the shared dev bundle
+ * re-grant aggressively. Absent / unparseable / non-positive → the default.
+ */
+/** A positive-integer-ms override from `localStorage[key]`, else `fallbackMs`. */
+export declare const readMsOverride: (key: string, fallbackMs: number) => number;

package/dist/embed/dev-mode.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The dock's hidden DEV MODE — a cheat code typed into the chat composer
+ * (`belong:dev`) toggles a small panel for selecting which agent RUNTIME
+ * serves this chat's turns (mastra / claude-managed / claude-agent-sdk /
+ * fake), overriding the deployment default per message.
+ *
+ * Pure client UI state: the selection rides each posted message
+ * (`postMessageSchema.runtime`) and the WORKER enforces the gate — the
+ * override is honored only on non-production deployments, so exposing the
+ * toggle in the shipped bundle is safe. Persisted best-effort to
+ * localStorage so a reload keeps the developer's setup.
+ */
+export declare const DEV_CHEAT_CODE = "belong:dev";
+export declare const AGENT_RUNTIMES: readonly ["mastra", "claude-managed", "claude-agent-sdk", "fake"];
+export type AgentRuntime = (typeof AGENT_RUNTIMES)[number];
+/**
+ * LLM providers the dev panel can swap the model to. Honored by the MASTRA
+ * runtime only (its model resolves per turn); the other runtimes own their
+ * model wiring and ignore the override. `gateway` is the generic router
+ * (Vercel AI Gateway): pair it with a free-typed `provider/model` slug
+ * (e.g. `deepseek/deepseek-v4-pro`) to reach any model the gateway serves.
+ */
+export declare const LLM_PROVIDERS: readonly ["anthropic", "google", "openai", "cerebras", "gateway"];
+export type LlmProvider = (typeof LLM_PROVIDERS)[number];
+/**
+ * A free-typed model id must be safe to ride the wire verbatim: bounded, no
+ * whitespace, provider-id charset only (mirrors the backend's perimeter
+ * schema so a typo fails HERE, not as a 400 on send).
+ */
+export declare const isValidLlmModelId: (value: string) => boolean;
+/** True when the typed text is the cheat code (trim + case-insensitive). */
+export declare const isDevCheatCode: (text: string) => boolean;
+/** `useSyncExternalStore` subscribe — fires on any dev-mode state change. */
+export declare const subscribeDevMode: (listener: () => void) => (() => void);
+/**
+ * Dev mode is "unlocked" (the rail shows its button) once the cheat code has
+ * been typed once in this browser — end users never see the affordance.
+ */
+export declare const readDevUnlocked: () => boolean;
+/** Toggle the panel (cheat code or rail button); first use unlocks the rail button. */
+export declare const toggleDevPanel: () => void;
+export declare const readDevPanelOpen: () => boolean;
+export declare const writeDevPanelOpen: (open: boolean) => void;
+/** The persisted runtime override; null = the deployment default. */
+export declare const readDevRuntime: () => AgentRuntime | null;
+export declare const writeDevRuntime: (runtime: AgentRuntime | null) => void;
+/** The persisted LLM provider override; null = the deployment's model. */
+export declare const readDevLlmProvider: () => LlmProvider | null;
+export declare const writeDevLlmProvider: (provider: LlmProvider | null) => void;
+/**
+ * The persisted free-typed model id; null = the deployment's env-pinned
+ * model. Only a wire-valid id is ever returned — a stored value that fails
+ * the charset check (old garbage, manual edits) reads as null.
+ */
+export declare const readDevLlmModel: () => string | null;
+export declare const writeDevLlmModel: (model: string | null) => void;

package/dist/embed/dock-layout.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Pure geometry + state transitions for the dock's three resize states.
+ * No DOM, no React — unit-testable. The shell (BelongDock) owns the React
+ * state and applies the resolved width; the host <body> margin reservation
+ * uses the same resolver so the dock never overlaps host content.
+ */
+export type DockResizeState = "collapsed" | "expanded" | "modal";
+/** The always-visible rail strip. Reference spec: 52px. */
+export declare const RAIL_WIDTH_PX = 52;
+/** Fixed panel width in modal state. Reference spec: 760px panel. */
+export declare const MODAL_PANEL_WIDTH_PX = 760;
+/** Lower bound for a user-dragged expanded panel width. */
+export declare const MIN_PANEL_WIDTH_PX = 320;
+/** Upper bound for a user-dragged expanded panel width. */
+export declare const MAX_PANEL_WIDTH_PX = 720;
+/** Clamp a dragged panel width to [MIN, min(MAX, 90% of viewport)]. */
+export declare const clampPanelWidth: (px: number, viewportPx: number) => number;
+/** Total dock width (panel + rail) for a state, given the expanded panel width. */
+export declare const resolveDockWidthPx: (state: DockResizeState, panelWidth: number) => number;
+/**
+ * The panel's OWN width for a state. While collapsed this is the width the
+ * panel would reveal to (the dock container clips it), so the panel keeps a
+ * stable layout and the expand animation is a clean wipe — never a continuous
+ * reflow of text at every intermediate width.
+ */
+export declare const resolvePanelWidthPx: (state: DockResizeState, panelWidth: number) => number;
+/** Collapse toggle: any open state → collapsed; collapsed → expanded. */
+export declare const nextOnToggleCollapse: (state: DockResizeState) => DockResizeState;
+/** Modal toggle: expanded ↔ modal; no-op while collapsed. */
+export declare const nextOnToggleModal: (state: DockResizeState) => DockResizeState;