@belonguniverseai/react-sdk 0.4.1 → 0.4.3

package/dist/api/agent-grants.d.ts

@@ -13,6 +13,14 @@ export declare const useAgentGrantStatus: (input: {
     readonly provider: string;
     readonly scopeExternalId: string;
 } | null) => import('@tanstack/react-query').UseQueryResult<NoInfer<AgentGrantStatusView>, Error>;
+/**
+ * The backend error type for a rate-limited mint (BEL-178). Its own status +
+ * type precisely so the dock can tell "wait, the provider is throttling" apart
+ * from "transient, try again now" — the distinction Belong lacked on
+ * 2026-07-24, when a rate limit arrived as a 502 and the ladder below turned
+ * one user action into 10–15 provider calls.
+ */
+export declare const GRANT_RATE_LIMITED = "rate_limited";
 /** Injectable timing/randomness so the backoff loop is deterministic in tests. */
 export type GrantRetryOptions = {
     readonly maxRetries?: number;
@@ -20,7 +28,23 @@ export type GrantRetryOptions = {
     readonly sleep?: (ms: number) => Promise<void>;
     readonly random?: () => number;
     readonly now?: () => number;
+    /**
+     * Fired once, BEFORE the rate-limit wait, so the surface can say why nothing
+     * is happening ("retrying automatically in 60 s") instead of showing a
+     * generic failure the user answers by clicking Retry (BEL-178).
+     */
+    readonly onRateLimited?: (info: {
+        readonly retryAfterMs: number;
+    }) => void;
 };
+/**
+ * Did this grant failure come from the provider's rate limiter? Callers that
+ * own an OUTER retry (the headless auto-connect, the reconnect note) must NOT
+ * re-fire on it: `createAgentGrantRequest` has already waited the provider's
+ * window and been refused a second time. Another attempt is one more request
+ * into a limiter that is, by then, demonstrably saturated.
+ */
+export declare const isRateLimitedGrantError: (error: unknown) => boolean;
 /**
  * POST a grant create with two layers of self-heal:
  *   1. Per attempt — the 409/429 anti-replay / session-cap force-mint retry
@@ -30,6 +54,15 @@ export type GrantRetryOptions = {
  *      `isTransientGrantFailure`): up to `maxRetries` retries with full-jitter
  *      backoff under a total time budget, so a passing Daytona runner blip or a
  *      sandbox write hiccup self-heals instead of surfacing to the user.
+ *   3. Rate limiting (BEL-178) — a 429 `rate_limited` schedules EXACTLY ONE
+ *      retry, at the `retryAfterMs` the backend passed through from the
+ *      provider. It is deliberately outside layer 2's count and time budget:
+ *      the provider's window (60 s) is four times the ladder's whole budget,
+ *      so folding it in would either truncate the wait or spend the budget on
+ *      requests guaranteed to be refused. One retry, at the honest time — and
+ *      if that one is refused too, the failure surfaces instead of looping,
+ *      because a second consecutive refusal means the limiter is saturated by
+ *      something we can't fix by asking again.
  * Injectable timing/randomness so the whole loop is unit-testable.
  */
 export declare const createAgentGrantRequest: (api: ApiClient, input: {

package/dist/api/client.d.ts

@@ -436,7 +436,7 @@ export declare const createApiClient: (baseUrl: string) => {
                                 skill?: string | undefined;
                                 mode?: "plan" | "approve" | "balanced" | "bypass" | "execute" | undefined;
                                 runtime?: "mastra" | "claude-managed" | "fake" | "claude-agent-sdk" | undefined;
-                                llmProvider?: "anthropic" | "google" | "openai" | "cerebras" | "gateway" | undefined;
+                                llmProvider?: "openai" | "anthropic" | "google" | "cerebras" | "gateway" | undefined;
                                 llmModel?: string | undefined;
                                 timezone?: string | undefined;
                                 workspaceExternalId?: string | undefined;
@@ -463,7 +463,7 @@ export declare const createApiClient: (baseUrl: string) => {
                                 skill?: string | undefined;
                                 mode?: "plan" | "approve" | "balanced" | "bypass" | "execute" | undefined;
                                 runtime?: "mastra" | "claude-managed" | "fake" | "claude-agent-sdk" | undefined;
-                                llmProvider?: "anthropic" | "google" | "openai" | "cerebras" | "gateway" | undefined;
+                                llmProvider?: "openai" | "anthropic" | "google" | "cerebras" | "gateway" | undefined;
                                 llmModel?: string | undefined;
                                 timezone?: string | undefined;
                                 workspaceExternalId?: string | undefined;
@@ -489,7 +489,7 @@ export declare const createApiClient: (baseUrl: string) => {
                                 skill?: string | undefined;
                                 mode?: "plan" | "approve" | "balanced" | "bypass" | "execute" | undefined;
                                 runtime?: "mastra" | "claude-managed" | "fake" | "claude-agent-sdk" | undefined;
-                                llmProvider?: "anthropic" | "google" | "openai" | "cerebras" | "gateway" | undefined;
+                                llmProvider?: "openai" | "anthropic" | "google" | "cerebras" | "gateway" | undefined;
                                 llmModel?: string | undefined;
                                 timezone?: string | undefined;
                                 workspaceExternalId?: string | undefined;
@@ -515,7 +515,7 @@ export declare const createApiClient: (baseUrl: string) => {
                                 skill?: string | undefined;
                                 mode?: "plan" | "approve" | "balanced" | "bypass" | "execute" | undefined;
                                 runtime?: "mastra" | "claude-managed" | "fake" | "claude-agent-sdk" | undefined;
-                                llmProvider?: "anthropic" | "google" | "openai" | "cerebras" | "gateway" | undefined;
+                                llmProvider?: "openai" | "anthropic" | "google" | "cerebras" | "gateway" | undefined;
                                 llmModel?: string | undefined;
                                 timezone?: string | undefined;
                                 workspaceExternalId?: string | undefined;
@@ -613,7 +613,7 @@ export declare const createApiClient: (baseUrl: string) => {
                             };
                         };
                         outputFormat: "json";
-                        status: 404 | 403 | 409;
+                        status: 403 | 404 | 409;
                     } | {
                         input: {
                             param: {
@@ -673,7 +673,7 @@ export declare const createApiClient: (baseUrl: string) => {
                             };
                         };
                         outputFormat: "json";
-                        status: 404 | 403 | 409;
+                        status: 403 | 404 | 409;
                     };
                 }>;
             };
@@ -1161,6 +1161,19 @@ export declare const createApiClient: (baseUrl: string) => {
                 };
                 outputFormat: "json";
                 status: 400;
+            } | {
+                input: {};
+                output: {
+                    error: {
+                        type: string;
+                        reason: import('node_modules/@belong/cloud/src/features/files/file.schemas').UploadTypeRefusal;
+                        filename: string;
+                        declaredMimeType: string;
+                        message: string;
+                    };
+                };
+                outputFormat: "json";
+                status: 415;
             } | {
                 input: {};
                 output: {
@@ -1534,6 +1547,7 @@ export declare const createApiClient: (baseUrl: string) => {
                     output: {
                         url: string;
                         expiresAt: string;
+                        expiresInSeconds: number;
                     };
                     outputFormat: "json";
                     status: 201;
@@ -2145,6 +2159,70 @@ export declare const createApiClient: (baseUrl: string) => {
             };
         };
     };
+} & {
+    v1: {
+        terminal: {
+            workspace: {
+                file: {
+                    preview: import('hono/client').ClientRequest<string, "/v1/terminal/workspace/file/preview", {
+                        $post: {
+                            input: {};
+                            output: {
+                                error: {
+                                    type: string;
+                                };
+                            };
+                            outputFormat: "json";
+                            status: 503;
+                        } | {
+                            input: {};
+                            output: {
+                                error: {
+                                    type: string;
+                                };
+                            };
+                            outputFormat: "json";
+                            status: 409;
+                        } | {
+                            input: {};
+                            output: {
+                                error: {
+                                    type: string;
+                                };
+                            };
+                            outputFormat: "json";
+                            status: 400;
+                        } | {
+                            input: {};
+                            output: {
+                                error: {
+                                    type: string;
+                                };
+                            };
+                            outputFormat: "json";
+                            status: 404;
+                        } | {
+                            input: {};
+                            output: {
+                                fileId: import('node_modules/@belong/cloud/src/platform/ids').FileId;
+                            };
+                            outputFormat: "json";
+                            status: 201;
+                        } | {
+                            input: {};
+                            output: {
+                                error: {
+                                    type: string;
+                                };
+                            };
+                            outputFormat: "json";
+                            status: 415;
+                        };
+                    }>;
+                };
+            };
+        };
+    };
 } & {
     v1: {
         browser: {
@@ -3216,9 +3294,11 @@ export declare const createApiClient: (baseUrl: string) => {
                         clientScheduleId: string;
                         notification?: {
                             kind: "completion_email";
+                            recipients?: string[] | undefined;
                         } | {
                             kind: "custom_email";
                             templatePath: string;
+                            recipients?: string[] | undefined;
                         } | undefined;
                         title?: string | undefined;
                         mode?: "plan" | "approve" | "balanced" | "bypass" | undefined;
@@ -3239,7 +3319,7 @@ export declare const createApiClient: (baseUrl: string) => {
                         originatingSessionId?: string | undefined;
                         workspaceExternalId?: string | undefined;
                         runtime?: "mastra" | "claude-managed" | "fake" | "claude-agent-sdk" | undefined;
-                        llmProvider?: "anthropic" | "google" | "openai" | "cerebras" | "gateway" | undefined;
+                        llmProvider?: "openai" | "anthropic" | "google" | "cerebras" | "gateway" | undefined;
                         llmModel?: string | undefined;
                     };
                 };
@@ -3261,9 +3341,11 @@ export declare const createApiClient: (baseUrl: string) => {
                         clientScheduleId: string;
                         notification?: {
                             kind: "completion_email";
+                            recipients?: string[] | undefined;
                         } | {
                             kind: "custom_email";
                             templatePath: string;
+                            recipients?: string[] | undefined;
                         } | undefined;
                         title?: string | undefined;
                         mode?: "plan" | "approve" | "balanced" | "bypass" | undefined;
@@ -3284,7 +3366,7 @@ export declare const createApiClient: (baseUrl: string) => {
                         originatingSessionId?: string | undefined;
                         workspaceExternalId?: string | undefined;
                         runtime?: "mastra" | "claude-managed" | "fake" | "claude-agent-sdk" | undefined;
-                        llmProvider?: "anthropic" | "google" | "openai" | "cerebras" | "gateway" | undefined;
+                        llmProvider?: "openai" | "anthropic" | "google" | "cerebras" | "gateway" | undefined;
                         llmModel?: string | undefined;
                     };
                 };
@@ -3311,9 +3393,11 @@ export declare const createApiClient: (baseUrl: string) => {
                         clientScheduleId: string;
                         notification?: {
                             kind: "completion_email";
+                            recipients?: string[] | undefined;
                         } | {
                             kind: "custom_email";
                             templatePath: string;
+                            recipients?: string[] | undefined;
                         } | undefined;
                         title?: string | undefined;
                         mode?: "plan" | "approve" | "balanced" | "bypass" | undefined;
@@ -3334,7 +3418,7 @@ export declare const createApiClient: (baseUrl: string) => {
                         originatingSessionId?: string | undefined;
                         workspaceExternalId?: string | undefined;
                         runtime?: "mastra" | "claude-managed" | "fake" | "claude-agent-sdk" | undefined;
-                        llmProvider?: "anthropic" | "google" | "openai" | "cerebras" | "gateway" | undefined;
+                        llmProvider?: "openai" | "anthropic" | "google" | "cerebras" | "gateway" | undefined;
                         llmModel?: string | undefined;
                     };
                 };
@@ -3355,9 +3439,11 @@ export declare const createApiClient: (baseUrl: string) => {
                         clientScheduleId: string;
                         notification?: {
                             kind: "completion_email";
+                            recipients?: string[] | undefined;
                         } | {
                             kind: "custom_email";
                             templatePath: string;
+                            recipients?: string[] | undefined;
                         } | undefined;
                         title?: string | undefined;
                         mode?: "plan" | "approve" | "balanced" | "bypass" | undefined;
@@ -3378,7 +3464,7 @@ export declare const createApiClient: (baseUrl: string) => {
                         originatingSessionId?: string | undefined;
                         workspaceExternalId?: string | undefined;
                         runtime?: "mastra" | "claude-managed" | "fake" | "claude-agent-sdk" | undefined;
-                        llmProvider?: "anthropic" | "google" | "openai" | "cerebras" | "gateway" | undefined;
+                        llmProvider?: "openai" | "anthropic" | "google" | "cerebras" | "gateway" | undefined;
                         llmModel?: string | undefined;
                     };
                 };
@@ -3445,9 +3531,11 @@ export declare const createApiClient: (baseUrl: string) => {
                         message: string;
                         notification: {
                             kind: "completion_email";
+                            recipients?: string[] | undefined;
                         } | {
                             kind: "custom_email";
                             templatePath: string;
+                            recipients?: string[] | undefined;
                         };
                         mode: "plan" | "approve" | "balanced" | "bypass";
                         timeExpression: string;
@@ -4571,4 +4659,60 @@ export declare const createApiClient: (baseUrl: string) => {
             };
         };
     };
+} & {
+    v1: {
+        admin: {
+            tenants: {
+                ":slug": {
+                    assets: {
+                        publish: import('hono/client').ClientRequest<string, "/v1/admin/tenants/:slug/assets/publish", {
+                            $post: {
+                                input: {
+                                    param: {
+                                        slug: string;
+                                    };
+                                };
+                                output: {
+                                    error: {
+                                        type: string;
+                                        issues: readonly {
+                                            readonly path: string;
+                                            readonly message: string;
+                                        }[];
+                                    };
+                                };
+                                outputFormat: "json";
+                                status: 422;
+                            } | {
+                                input: {
+                                    param: {
+                                        slug: string;
+                                    };
+                                };
+                                output: {
+                                    readonly tenantId: string;
+                                    readonly assetsRevision: number;
+                                };
+                                outputFormat: "json";
+                                status: 200;
+                            } | {
+                                input: {
+                                    param: {
+                                        slug: string;
+                                    };
+                                };
+                                output: {
+                                    error: {
+                                        type: string;
+                                    };
+                                };
+                                outputFormat: "json";
+                                status: 404;
+                            };
+                        }>;
+                    };
+                };
+            };
+        };
+    };
 };

package/dist/api/retry-fetch.d.ts

@@ -18,7 +18,9 @@
  *    matters (`clientMessageId` dedupe on message posts, §18/§28 state guards
  *    on approvals/cancels), so a replay is safe.
  *  - `Retry-After` (seconds form) is honored when present, capped like any
- *    other delay.
+ *    other delay — and a `Retry-After` LONGER than that cap ENDS the ladder:
+ *    the server is throttling, not scaling out, so the response goes back to
+ *    the caller, whose own policy owns the (long) wait.
  *  - Abort-aware: an aborted `init.signal` short-circuits both the request
  *    and any backoff wait — a user cancel must never be held by a retry.
  *

package/dist/api/task-schedules.d.ts

@@ -27,9 +27,11 @@ export type CreateTaskScheduleRequest = {
     readonly recurrence?: Recurrence;
     readonly notification?: {
         readonly kind: "completion_email";
+        readonly recipients?: readonly string[];
     } | {
         readonly kind: "custom_email";
         readonly templatePath: string;
+        readonly recipients?: readonly string[];
     };
     readonly mode: ChatMode;
     readonly clientScheduleId: string;
@@ -246,19 +248,25 @@ declare const taskScheduleDetailSchema: z.ZodObject<{
     updatedAt: z.ZodString;
     notification: z.ZodDefault<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"completion_email">;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         kind: "completion_email";
+        recipients?: string[] | undefined;
     }, {
         kind: "completion_email";
+        recipients?: string[] | undefined;
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"custom_email">;
         templatePath: z.ZodString;
+        recipients: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
         kind: "custom_email";
         templatePath: string;
+        recipients?: string[] | undefined;
     }, {
         kind: "custom_email";
         templatePath: string;
+        recipients?: string[] | undefined;
     }>]>>;
 }, "strip", z.ZodTypeAny, {
     status: "active" | "completed" | "paused" | "deleted";
@@ -274,9 +282,11 @@ declare const taskScheduleDetailSchema: z.ZodObject<{
     taskScheduleId: string;
     notification: {
         kind: "completion_email";
+        recipients?: string[] | undefined;
     } | {
         kind: "custom_email";
         templatePath: string;
+        recipients?: string[] | undefined;
     };
     recurrence: {
         readonly kind: "none";
@@ -323,9 +333,11 @@ declare const taskScheduleDetailSchema: z.ZodObject<{
     messagePreview: string;
     notification?: {
         kind: "completion_email";
+        recipients?: string[] | undefined;
     } | {
         kind: "custom_email";
         templatePath: string;
+        recipients?: string[] | undefined;
     } | undefined;
     explicitTitle?: string | null | undefined;
 }>;
@@ -406,9 +418,11 @@ export declare const useTaskSchedule: (taskScheduleId: string | null) => import(
     taskScheduleId: string;
     notification: {
         kind: "completion_email";
+        recipients?: string[] | undefined;
     } | {
         kind: "custom_email";
         templatePath: string;
+        recipients?: string[] | undefined;
     };
     recurrence: {
         readonly kind: "none";

package/dist/browser/agent-link.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Where a link in agent output should go. Two members only: a third "inert"
+ * kind for Streamdown's mid-stream sentinel was dropped because the sentinel
+ * never reaches `components.a` (proven in the pipeline suite), so the branch
+ * would have been permanently dead.
+ */
+export type AgentLinkTarget = {
+    readonly kind: "in_app";
+    readonly href: string;
+} | {
+    readonly kind: "external";
+    readonly href: string;
+};
+/**
+ * Classify `rawHref`. Fails CLOSED: anything not PROVABLY a path on the live
+ * page's own origin is `external`, which is byte-for-byte today's behaviour.
+ */
+export declare const classifyAgentLink: (rawHref: string | undefined) => AgentLinkTarget;

package/dist/browser/agent-touch.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Agent-touch highlight (BEL-147, absorbing BEL-108) — the ONE affordance that
+ * shows the user which host-page element the agent is currently driving.
+ *
+ * Why here. `dom-bridge.ts` is the only code that touches the host page's DOM,
+ * and its `click` / `type` / `select` ops already resolve a snapshot `ref` to a
+ * live `Element`. That resolved element IS "the thing the agent is interacting
+ * with" — nothing else in the system knows it. The dock, meanwhile, already
+ * renders a `[ui_action] … [ok]` status card for the declared-UI-action family
+ * (`ai-sdk-part-renderers.tsx`), so the missing half was never the dock: it was
+ * the HOST PAGE. This module is that half.
+ *
+ * How it paints, and why it cannot move the host's layout.
+ * The glow is NOT an overlay node. Appending a positioned box to the host page
+ * means tracking the target through scroll / resize / re-render, and it drops a
+ * foreign element into someone else's DOM. Instead we set ONE namespaced
+ * attribute on the target and let a single document-scoped rule paint it:
+ *
+ *     [data-belong-agent-touch] { animation: … }   →   box-shadow only
+ *
+ * `box-shadow` and `animation` are the ONLY properties the rule declares, and
+ * neither participates in layout — a shadow paints outside the border box
+ * without reserving space, so nothing reflows and nothing shifts. The glow also
+ * follows the element for free: through scrolling, through a host re-render
+ * that repositions it, through its own CSS transitions. No rAF loop, no
+ * `ResizeObserver`, no coordinate math. (Contrast `OnboardingTour.tsx`, which
+ * measures + repositions — it has to, because it dims the page around a
+ * cut-out. We only outline one element, so we do not.)
+ *
+ * Removability. Teardown removes the attribute and the one custom property, and
+ * drops the `style` attribute entirely when ours was the only inline property
+ * on it — so the host element returns to byte-identical markup. The stylesheet
+ * is a single idempotent `<style data-belong-agent-touch>` in `document.head`
+ * (the same precedent `shadow-mount.ts` uses for its `@property` block) and is
+ * inert while no element carries the attribute: its only selector is an
+ * attribute we own and the host will never write.
+ *
+ * Theme. The colour is read from the live dock theme at show time —
+ * `activePalette(peekTheme()).primary`, the same token the dock's own spotlight
+ * ring uses. A tenant on `SIMETRIK_INDIGO_THEME` glows indigo; the default
+ * Belong tenant glows teal. Nothing here is a colour literal. The value rides
+ * on the element as `--belong-agent-touch-color` rather than through the host
+ * layout-var contract, because the highlight is per-element and ephemeral —
+ * publishing a brand colour on `document.documentElement` would be a new,
+ * permanent host contract for a transient effect.
+ *
+ * Degrading. Every reason a target cannot be highlighted is a returned value
+ * (§19), never a throw: a selector that matches nothing, a node from another
+ * realm, an element already detached. The agent's action runs either way — the
+ * caller in `dom-bridge.ts` ignores the outcome entirely.
+ *
+ * §41 (a reload must not change what the user sees). The glow is deliberately
+ * EPHEMERAL and is not part of the replayable ledger. §41 governs what the dock
+ * reconstructs from `task_events`; this is not a rendered part, it is live
+ * feedback bound to an in-flight browser command that has already run. After a
+ * reload the run resumes and its NEXT command re-highlights; a past command's
+ * glow is gone, which is honest — that DOM action is finished. Nothing the user
+ * can act on is lost, so there is nothing to persist.
+ */
+/** The one attribute the stylesheet keys on. Namespaced; the host never sets it. */
+export declare const AGENT_TOUCH_ATTRIBUTE = "data-belong-agent-touch";
+/** Per-element custom property carrying the tenant's brand colour. */
+export declare const AGENT_TOUCH_COLOR_VAR = "--belong-agent-touch-color";
+/**
+ * Floor on how long a glow stays up once shown. A `click` settles in a single
+ * tick, so releasing the instant the op returns would paint a frame the user
+ * cannot perceive. `release()` therefore waits out this window before clearing.
+ */
+export declare const MIN_VISIBLE_MS = 700;
+/**
+ * Ceiling, enforced with a timer the show path always arms. A caller that
+ * throws, or a command whose result never comes back, must not be able to leave
+ * a permanent glow burned onto someone else's application.
+ */
+export declare const MAX_HOLD_MS = 10000;
+/** Handle returned to the caller that owns the glow's lifetime. */
+type AgentTouchHandle = {
+    /**
+     * Clear the glow. Idempotent, and safe to call after a newer highlight has
+     * already superseded this one. Honours `MIN_VISIBLE_MS`, so an action that
+     * completes instantly still reads as a visible pulse.
+     */
+    readonly release: () => void;
+};
+/**
+ * Why a highlight did not appear. Values, not exceptions (§19) — the caller
+ * branches on this only in tests; production ignores it and runs the action.
+ */
+type AgentTouchSkipReason = "no_target" | "not_an_html_element" | "detached";
+type ShowAgentTouchResult = {
+    readonly shown: true;
+    readonly handle: AgentTouchHandle;
+} | {
+    readonly shown: false;
+    readonly reason: AgentTouchSkipReason;
+};
+/**
+ * Paint the glow on the element the agent is about to drive.
+ *
+ * Accepts `null` / `undefined` directly so a selector-addressed caller can hand
+ * over `document.querySelector(sel)` without a guard: a selector that matches
+ * nothing degrades to `{ shown: false }` and the agent's action proceeds.
+ */
+export declare const showAgentTouch: (target: Element | null | undefined) => ShowAgentTouchResult;
+export {};

package/dist/browser/spa-navigate.d.ts

@@ -37,6 +37,17 @@
  * Belong API host as its origin; the guard then measured every navigation —
  * even a same-origin path — against that foreign host and refused it.)
  */
+/**
+ * The live page origin as a string, or null when it is opaque/unparseable —
+ * the single origin anchor for classifying a link in agent output (BEL-109).
+ *
+ * Deliberately NOT `isCrossOriginNav`: that answers "should I refuse a
+ * destructive full load?", whose safe default for an opaque origin is `false`
+ * ("same origin, don't refuse"). Reusing it to answer "may I skip the safety
+ * modal?" would invert the safety property and classify EVERY link as in-app
+ * inside a sandboxed document. Returning null here lets the caller fail CLOSED.
+ */
+export declare const pageOrigin: () => string | null;
 type RouterLocationLike = {
     readonly pathname: string;
     readonly search?: string;
@@ -64,7 +75,19 @@ export declare const findHostRouter: (doc?: Document) => DataRouterLike | null;
  * keeping path, query, and hash — so the user stays on THEIR environment and
  * the navigation can route client-side instead of full-loading to the wrong
  * domain. Anything genuinely external is returned unchanged (a real full load
- * to the real site). Idempotent: a result is always same-origin or untouched.
+ * to the real site).
+ *
+ * INVARIANT, now ENFORCED rather than merely asserted: the result is either on
+ * the LIVE page origin or the input untouched — never a third origin. That used
+ * to be violable. `//evil.test/x` is a legal `pathname`, and it is a
+ * SCHEME-RELATIVE reference when re-parsed, so rebasing it via
+ * `new URL(pathname, here.origin)` produced `https://evil.test/x` — a host in
+ * NEITHER input. Two guards now: refuse to rebase a `//`-prefixed pathname (an
+ * env-variant rebase has no legitimate use for that shape, and returning it
+ * untouched keeps the caller's cross-origin check measuring the host the agent
+ * actually named), then re-assert the origin on the way out so the claim is
+ * proved instead of reasoned about. Callers still re-check afterwards — this is
+ * a security boundary, and that redundancy is deliberate, not dead code.
  */
 export declare const resolveNavUrl: (rawUrl: string) => string;
 /**

package/dist/component/{arc-Du1-HUt0.js → arc-ByLm_58u.js}

@@ -1,4 +1,4 @@
-import { O as ln, P as an, Q as g, S as on, T as Z, V as w, W as _, X as sn, Y as rn, Z as z, $ as t, a0 as V, a1 as un, a2 as tn, a3 as fn } from "./mermaid-GHXKKRXX-D7NVqIBP.js";
+import { O as ln, P as an, Q as g, S as on, T as Z, V as w, W as _, X as sn, Y as rn, Z as z, $ as t, a0 as V, a1 as un, a2 as tn, a3 as fn } from "./mermaid-GHXKKRXX-DiPCfS1n.js";
 globalThis.process = globalThis.process || { env: {} };
 globalThis.global = globalThis.global || globalThis;
 function cn(l) {
@@ -83,4 +83,4 @@ function xn() {
 export {
   xn as d
 };
-//# sourceMappingURL=arc-Du1-HUt0.js.map
+//# sourceMappingURL=arc-ByLm_58u.js.map

package/dist/component/{architectureDiagram-3BPJPVTR-NTFoFNN-.js → architectureDiagram-3BPJPVTR-DcYT4v9Q.js}

@@ -1,5 +1,5 @@
-import { b7 as $e, _ as dt, N as ke, ai as Ze, l as Re, b as qe, a as Qe, q as Je, t as Ke, g as je, s as _e, B as tr, I as er, G as rr, K as ir, c as ye, aR as Ee, b8 as ve, i as ar, d as nr, y as or, b9 as sr, ba as hr } from "./mermaid-GHXKKRXX-D7NVqIBP.js";
-import { p as lr } from "./chunk-4BX2VUAB-BLlcE09Q.js";
+import { b7 as $e, _ as dt, N as ke, ai as Ze, l as Re, b as qe, a as Qe, q as Je, t as Ke, g as je, s as _e, B as tr, I as er, G as rr, K as ir, c as ye, aR as Ee, b8 as ve, i as ar, d as nr, y as or, b9 as sr, ba as hr } from "./mermaid-GHXKKRXX-DiPCfS1n.js";
+import { p as lr } from "./chunk-4BX2VUAB-BKmdmdRY.js";
 import { p as fr } from "./wardley-L42UT6IY-HA1eSIS_.js";
 import { c as Se } from "./cytoscape.esm-C31R6JOv.js";
 globalThis.process = globalThis.process || { env: {} };
@@ -4694,4 +4694,4 @@ var Pr = /* @__PURE__ */ dt(async (C, G, w, U) => {
 export {
   Wr as diagram
 };
-//# sourceMappingURL=architectureDiagram-3BPJPVTR-NTFoFNN-.js.map
+//# sourceMappingURL=architectureDiagram-3BPJPVTR-DcYT4v9Q.js.map

package/dist/component/{blockDiagram-GPEHLZMM-9LBL4EUV.js → blockDiagram-GPEHLZMM-CHk-YSun.js}

@@ -1,7 +1,7 @@
-import { g as pe } from "./chunk-FMBD7UC4-CWrggihb.js";
-import { aq as fe, ar as Ut, as as xe, at as ye, au as be, av as we, aw as me, ax as Se, ay as Le, az as ke, aA as ve, aB as Ee, aC as _e, aD as Te, aE as De, aF as Be, aG as Ne, aH as Ie, aI as Ce, aJ as Oe, aK as Re, aL as Ae, aM as ze, aN as Me, aO as Pe, _ as d, G as at, d as D, e as Fe, l as k, B as We, D as Ye, aP as He, ac as Ke, ad as Ue, c as A, a9 as Xe, aQ as P, aR as vt, aS as $, aT as Ve, u as tt, k as je, aU as Ge, i as Ot, aV as Rt, aW as Ze } from "./mermaid-GHXKKRXX-D7NVqIBP.js";
+import { g as pe } from "./chunk-FMBD7UC4-CG5DaKp9.js";
+import { aq as fe, ar as Ut, as as xe, at as ye, au as be, av as we, aw as me, ax as Se, ay as Le, az as ke, aA as ve, aB as Ee, aC as _e, aD as Te, aE as De, aF as Be, aG as Ne, aH as Ie, aI as Ce, aJ as Oe, aK as Re, aL as Ae, aM as ze, aN as Me, aO as Pe, _ as d, G as at, d as D, e as Fe, l as k, B as We, D as Ye, aP as He, ac as Ke, ad as Ue, c as A, a9 as Xe, aQ as P, aR as vt, aS as $, aT as Ve, u as tt, k as je, aU as Ge, i as Ot, aV as Rt, aW as Ze } from "./mermaid-GHXKKRXX-DiPCfS1n.js";
 import { G as qe } from "./graph-BZLHvygk.js";
-import { c as Je } from "./channel-CNnOkAN_.js";
+import { c as Je } from "./channel-D67v09ii.js";
 globalThis.process = globalThis.process || { env: {} };
 globalThis.global = globalThis.global || globalThis;
 function Qe(e) {
@@ -2418,4 +2418,4 @@ var Ta = /* @__PURE__ */ d(function(e, t) {
 export {
   Ra as diagram
 };
-//# sourceMappingURL=blockDiagram-GPEHLZMM-9LBL4EUV.js.map
+//# sourceMappingURL=blockDiagram-GPEHLZMM-CHk-YSun.js.map