@jini-ai/agentic 0.4.3 → 0.4.5

package/dist/dom/model-context.d.ts

@@ -1,69 +0,0 @@
-/**
- * @module dom/model-context
- *
- * Feature-detected access to the browser's (draft) WebMCP surface —
- * `document.modelContext`, falling back to the deprecated `navigator.modelContext`
- * alias (the spec moved the getter from Navigator to Document in 2026;
- * see the polyfill ecosystem's own back-compat posture). No `@mcp-b/*` or
- * other WebMCP package dependency: this module only needs the shape, the
- * same "typed global + validated getter + graceful unavailable path"
- * pattern `@jini-ai/desktop-host`'s `bridge.ts` and other host-provided-global
- * bridges already use.
- * A page that wants `document.modelContext` to actually exist in a browser
- * without native support must load a real polyfill itself (e.g.
- * `@mcp-b/webmcp-polyfill`) — this module only ever reads what's there.
- *
- * Moved 2026-07-26 from `@jini-ai/ui/src/features/agent-tools/model-context.ts` (plan §4/§8 step 6).
- * Lives under `src/dom/`, not alongside `../webmcp.ts`'s pure `CapabilityDef` → WebMCP-tool
- * projection, because it reads `document`/`navigator` — `webmcp.ts`'s own module doc is explicit
- * that "that detection is deliberately NOT here: it touches browser globals, and this package
- * holds none," which is exactly the DOM-free guarantee `src/dom/` exists to carve an exception
- * for. See `dom/index.ts`'s re-export of this module.
- *
- * `AgentModelContextToolRegistration` gained `title`/`annotations` 2026-07-28, matching the same
- * `ModelContextTool` dict fields `../webmcp.ts`'s `WebMcpToolRegistration` closed the same day —
- * this file models the identical spec dictionary independently (no shared import; see the module
- * doc above for why the DOM/DOM-free split keeps them separate files), so the two had drifted out
- * of sync on the exact same gap. Found while wiring `examples/reference-web`'s WebMCP stress-test
- * fixture: a raw (non-`toWebMcpTool`) registration carrying a `title` failed TypeScript's
- * excess-property check against the un-widened type here.
- */
-export interface AgentModelContextToolRegistration {
-    readonly name: string;
-    /** `ModelContextTool.title` — optional human-readable label, distinct from `name` and `description`. */
-    readonly title?: string;
-    readonly description: string;
-    readonly inputSchema: unknown;
-    readonly execute: (args: Record<string, unknown>) => Promise<unknown>;
-    /** `ModelContextTool.annotations` — `{ readOnlyHint?, untrustedContentHint? }` behavior hints. */
-    readonly annotations?: {
-        readonly readOnlyHint?: boolean;
-        readonly untrustedContentHint?: boolean;
-    };
-}
-/**
- * Options `registerTool` accepts. Matches the draft's
- * `ModelContextRegisterToolOptions`: an `AbortSignal` that unregisters the tool when aborted, and
- * `exposedTo` to scope which consumers may see it.
- */
-export interface AgentModelContextRegisterToolOptions {
-    readonly signal?: AbortSignal;
-    readonly exposedTo?: readonly string[];
-}
-export interface AgentModelContextLike {
-    /**
-     * Draft IDL: `Promise<undefined> registerTool(ModelContextTool tool, optional
-     * ModelContextRegisterToolOptions options = {})` — it is **async**. Callers must not assume it
-     * has taken effect synchronously, and must not let a rejection escape.
-     */
-    registerTool(tool: AgentModelContextToolRegistration, options?: AgentModelContextRegisterToolOptions): Promise<void>;
-    /**
-     * NOT in the spec — the draft's only unregistration mechanism is aborting the `signal` passed to
-     * `registerTool`. Kept optional purely so a polyfill that happens to expose one can be used;
-     * never rely on its presence, and always pass a `signal` as the real cleanup path.
-     */
-    unregisterTool?(name: string): void;
-}
-/** Returns the page's WebMCP surface if one is installed (native or polyfilled), or `undefined`. */
-export declare function getAgentModelContext(): AgentModelContextLike | undefined;
-//# sourceMappingURL=model-context.d.ts.map

package/dist/dom/model-context.js

@@ -1,44 +0,0 @@
-/**
- * @module dom/model-context
- *
- * Feature-detected access to the browser's (draft) WebMCP surface —
- * `document.modelContext`, falling back to the deprecated `navigator.modelContext`
- * alias (the spec moved the getter from Navigator to Document in 2026;
- * see the polyfill ecosystem's own back-compat posture). No `@mcp-b/*` or
- * other WebMCP package dependency: this module only needs the shape, the
- * same "typed global + validated getter + graceful unavailable path"
- * pattern `@jini-ai/desktop-host`'s `bridge.ts` and other host-provided-global
- * bridges already use.
- * A page that wants `document.modelContext` to actually exist in a browser
- * without native support must load a real polyfill itself (e.g.
- * `@mcp-b/webmcp-polyfill`) — this module only ever reads what's there.
- *
- * Moved 2026-07-26 from `@jini-ai/ui/src/features/agent-tools/model-context.ts` (plan §4/§8 step 6).
- * Lives under `src/dom/`, not alongside `../webmcp.ts`'s pure `CapabilityDef` → WebMCP-tool
- * projection, because it reads `document`/`navigator` — `webmcp.ts`'s own module doc is explicit
- * that "that detection is deliberately NOT here: it touches browser globals, and this package
- * holds none," which is exactly the DOM-free guarantee `src/dom/` exists to carve an exception
- * for. See `dom/index.ts`'s re-export of this module.
- *
- * `AgentModelContextToolRegistration` gained `title`/`annotations` 2026-07-28, matching the same
- * `ModelContextTool` dict fields `../webmcp.ts`'s `WebMcpToolRegistration` closed the same day —
- * this file models the identical spec dictionary independently (no shared import; see the module
- * doc above for why the DOM/DOM-free split keeps them separate files), so the two had drifted out
- * of sync on the exact same gap. Found while wiring `examples/reference-web`'s WebMCP stress-test
- * fixture: a raw (non-`toWebMcpTool`) registration carrying a `title` failed TypeScript's
- * excess-property check against the un-widened type here.
- */
-function isModelContext(value) {
-    return typeof value === 'object' && value !== null && typeof value.registerTool === 'function';
-}
-/** Returns the page's WebMCP surface if one is installed (native or polyfilled), or `undefined`. */
-export function getAgentModelContext() {
-    const doc = globalThis.document;
-    if (isModelContext(doc?.modelContext))
-        return doc.modelContext;
-    const nav = globalThis.navigator;
-    if (isModelContext(nav?.modelContext))
-        return nav.modelContext;
-    return undefined;
-}
-//# sourceMappingURL=model-context.js.map

package/dist/element-handles.d.ts

@@ -1,120 +0,0 @@
-/**
- * @module element-handles
- *
- * The `data-agent-*` markup convention: how a page names the things an agent may act on.
- *
- * Handles are an **allowlist**, not a query language. A caller names a handle the page
- * already published; it never supplies a selector. That is the whole security property —
- * `resolveHandleSelector` can only ever build `[data-agent-element="<validated-handle>"]`,
- * so there is no path from caller input to an arbitrary `querySelector`.
- */
-import type { FieldDescriptor } from './guards.js';
-export declare const AGENT_ELEMENT_ATTRIBUTE = "data-agent-element";
-export declare const AGENT_ROLE_ATTRIBUTE = "data-agent-role";
-export declare const AGENT_LABEL_ATTRIBUTE = "data-agent-label";
-export declare const AGENT_PAGE_ATTRIBUTE = "data-agent-page";
-/** What verb applies to a tagged element. Mirrors the convention documented in the sample markup. */
-export type AgentElementRole = 'button' | 'checkbox' | 'field' | 'form' | 'list' | 'status' | 'region' | 'link';
-export declare const AGENT_ELEMENT_ROLES: readonly AgentElementRole[];
-/**
- * Whether `handle` is a syntactically valid agent element handle.
- *
- * @param handle - Candidate handle, typically caller-supplied.
- * @returns True when it is safe to interpolate into an attribute selector.
- */
-export declare function isValidElementHandle(handle: string): boolean;
-/**
- * Builds the one selector shape this system will ever resolve.
- *
- * @param handle - A handle published by the page.
- * @returns The attribute selector for that handle.
- * @throws If the handle is not valid — never fall back to treating it as a raw selector.
- */
-export declare function resolveHandleSelector(handle: string): string;
-/** A tagged element as described back to a caller. `label` is page-authored, so it is untrusted. */
-export interface AgentElementDescriptor {
-    readonly handle: string;
-    readonly role: AgentElementRole | undefined;
-    readonly label: string;
-    readonly labelTruncated: boolean;
-    readonly page: string | undefined;
-}
-/**
- * What an element currently *is*, as opposed to what it is *for*.
- *
- * `label` answers "what is this control" and is stable page ontology — it stays `"Full name"`
- * whether the box is empty or holds `"Ada Lovelace"`. That stability is the reason a caller can
- * address the same element across a whole session, and the reason a driver must never overwrite a
- * label with live text. But it leaves a caller unable to check its own work: after typing a name,
- * after ticking a box, after navigating, the reply named the element and said nothing about
- * whether anything had actually happened.
- *
- * This is the missing half — a separate channel, so observation is added rather than ontology
- * traded away.
- *
- * `text` and any `value` are page-authored and therefore untrusted, exactly like `label`.
- */
-export interface AgentElementState {
-    /**
-     * Live text rendered inside the element, normalized and bounded. Empty for a bare input, and
-     * empty when withheld — see {@link AgentElementState.textWithheld}.
-     */
-    readonly text: string;
-    readonly textTruncated: boolean;
-    /**
-     * Why `text` is empty on an element that has some — so a caller reads "withheld", not "blank".
-     *
-     * Only ever set for an editable region (a `contenteditable`), whose text is the field's own
-     * contents rather than page-authored chrome. Every other element's text is what the page already
-     * renders openly to anyone looking at it.
-     */
-    readonly textWithheld?: string;
-    /** The field's current contents. Absent when the element is not a field, or when withheld. */
-    readonly value?: string;
-    readonly valueTruncated?: boolean;
-    /** Why `value` is absent on a field that has one — so a caller reads "withheld", not "empty". */
-    readonly valueWithheld?: string;
-    /** Checkbox/radio state. Absent when the element is neither. */
-    readonly checked?: boolean;
-    readonly disabled?: boolean;
-    /** False when the element is present in the DOM but not rendered. */
-    readonly visible?: boolean;
-    /**
-     * A dropdown's available option texts — what `page.select_option` will accept. Absent for
-     * everything else. Reported even when the current `value` is withheld: which options exist is
-     * page-authored ontology, not the user's data.
-     */
-    readonly options?: readonly string[];
-}
-/**
- * What a driver reports for one element, before policy runs.
- *
- * Drivers stay mechanical: this carries the raw `value` and the `field` descriptor, and the
- * executor decides whether the value may be reported at all (see `findFieldReadRefusal`). Putting
- * that decision in the driver would place a secrecy rule in the one layer this design says must
- * not hold policy — and would have to be re-derived correctly by every future driver.
- */
-export interface AgentElementRawState {
-    /** Raw text content. The executor normalizes and bounds it. */
-    readonly text: string;
-    /**
-     * True when this element's `text` IS the field's contents rather than page-authored chrome —
-     * i.e. it is an editable region (`contenteditable`), which has no `value` of its own.
-     *
-     * A mechanical fact about the element, which is why a driver reports it: only the driver can
-     * tell. What follows from it is policy and stays in `projectElementState`, which gates such text
-     * with the same read guard it applies to `value`. Without this, a `<div contenteditable
-     * name="password">` had no `value` to withhold and handed the secret back as `text` instead.
-     */
-    readonly textIsValue?: boolean | undefined;
-    /** Raw field contents, reported unconditionally; the executor applies the read guard. */
-    readonly value?: string | undefined;
-    readonly checked?: boolean | undefined;
-    readonly disabled?: boolean | undefined;
-    readonly visible?: boolean | undefined;
-    /** Present when the element resolves to a field, so the executor can apply the read guard. */
-    readonly field?: FieldDescriptor | undefined;
-    /** A dropdown's option texts. Page-authored, so it is bounded but never withheld. */
-    readonly options?: readonly string[] | undefined;
-}
-//# sourceMappingURL=element-handles.d.ts.map

package/dist/element-handles.js

@@ -1,39 +0,0 @@
-export const AGENT_ELEMENT_ATTRIBUTE = 'data-agent-element';
-export const AGENT_ROLE_ATTRIBUTE = 'data-agent-role';
-export const AGENT_LABEL_ATTRIBUTE = 'data-agent-label';
-export const AGENT_PAGE_ATTRIBUTE = 'data-agent-page';
-export const AGENT_ELEMENT_ROLES = [
-    'button', 'checkbox', 'field', 'form', 'list', 'status', 'region', 'link',
-];
-/**
- * Lowercase, digits and single hyphens. Deliberately narrower than CSS allows: a handle that
- * cannot contain a quote, bracket, backslash or whitespace cannot break out of the attribute
- * selector it is interpolated into.
- */
-const HANDLE_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-/** Upper bound on a handle, so a hostile page cannot publish a megabyte-long name. */
-const MAX_HANDLE_LENGTH = 128;
-/**
- * Whether `handle` is a syntactically valid agent element handle.
- *
- * @param handle - Candidate handle, typically caller-supplied.
- * @returns True when it is safe to interpolate into an attribute selector.
- */
-export function isValidElementHandle(handle) {
-    return handle.length > 0 && handle.length <= MAX_HANDLE_LENGTH && HANDLE_PATTERN.test(handle);
-}
-/**
- * Builds the one selector shape this system will ever resolve.
- *
- * @param handle - A handle published by the page.
- * @returns The attribute selector for that handle.
- * @throws If the handle is not valid — never fall back to treating it as a raw selector.
- */
-export function resolveHandleSelector(handle) {
-    if (!isValidElementHandle(handle)) {
-        throw new Error(`invalid element handle "${handle.slice(0, MAX_HANDLE_LENGTH)}": `
-            + 'handles are lowercase words joined by single hyphens, and are never CSS selectors');
-    }
-    return `[${AGENT_ELEMENT_ATTRIBUTE}="${handle}"]`;
-}
-//# sourceMappingURL=element-handles.js.map

package/dist/gen-ui/encoder.d.ts

@@ -1,50 +0,0 @@
-/**
- * @module agui/encoder
- *
- * Encodes `@jini-ai/protocol`'s `RunProtocolEvent` stream into AG-UI wire events (see
- * `./events.ts`'s module doc). Rewritten from scratch against `@jini-ai/protocol`'s actual
- * current shape — the ported adapter's original encoder targeted a different, product-specific
- * event union with no direct correspondence to `RunProtocolEvent`/`RunAgentPayload`; only the
- * *shape* of the job (a big per-event-kind switch, unrecognized events silently dropped) carried
- * over. See `source-map.md` for the full old→new field-mapping table and the generalization
- * writeup for the six event kinds that had no generic equivalent before this task.
- *
- * Folded in 2026-07-26 from the standalone `@jini-ai/agui` package (plan §3a) into this `src/gen-ui/`
- * subdirectory — kept out of the flat `ag-ui.ts` namespace because that file is a different
- * projection ({@link CapabilityDef} → an AG-UI *frontend tool*); this one turns a run's event
- * stream into AG-UI *wire* events. Same protocol, two unrelated halves of it.
- */
-import type { RunProtocolEvent } from '@jini-ai/protocol';
-import type { GenUiEvent } from './events.js';
-export interface GenUiEncodeContext {
-    /** The run this event belongs to — stamped onto every produced `GenUiEvent`. */
-    readonly runId: string;
-    /** Passed through onto the produced event's `seq`, when the caller tracks one (e.g. an SSE `Last-Event-ID`-shaped cursor). Omitted entirely (not set to `undefined`) when absent, matching the original adapter's own base-field construction. */
-    readonly seq?: number;
-    /** Injectable clock for the produced event's `ts`. Defaults to `Date.now`. Test-only hook. */
-    readonly now?: () => number;
-}
-/**
- * A stateful AG-UI encoder for one run's event stream. Stateful because `tool_use`/`tool_result`
- * correlation requires remembering each in-flight tool call's name/args between the two protocol
- * events that describe its start and end — a pure per-event function cannot do this alone. Create
- * one instance per run (e.g. one per `RunLifecycle.stream(runId, ...)` subscription); do not share
- * an instance across multiple runs, since the correlation map has no per-run partitioning of its
- * own (`ctx.runId` is only used to stamp the produced event, not to scope the map).
- */
-export interface GenUiEncoder {
-    /**
-     * Encodes one `RunProtocolEvent` into an `GenUiEvent`, or `null` if this event has no AG-UI
-     * equivalent (an unrecognized/not-yet-generalized event kind — silently dropped by the relay,
-     * matching the original adapter's own default behavior).
-     */
-    encode(event: RunProtocolEvent, ctx: GenUiEncodeContext): GenUiEvent | null;
-}
-/**
- * Creates a fresh `GenUiEncoder` with its own, empty tool-call correlation map.
- * @complexity `encode` is O(1) per call (one `Map` get/set/delete); memory is O(k) in the number
- * of currently in-flight (not yet resolved) tool calls for the run this instance encodes.
- * @overallScore 100/100
- */
-export declare function createGenUiEncoder(): GenUiEncoder;
-//# sourceMappingURL=encoder.d.ts.map

package/dist/gen-ui/encoder.js

@@ -1,97 +0,0 @@
-/**
- * Creates a fresh `GenUiEncoder` with its own, empty tool-call correlation map.
- * @complexity `encode` is O(1) per call (one `Map` get/set/delete); memory is O(k) in the number
- * of currently in-flight (not yet resolved) tool calls for the run this instance encodes.
- * @overallScore 100/100
- */
-export function createGenUiEncoder() {
-    const pendingToolCalls = new Map();
-    function baseFields(ctx) {
-        const ts = ctx.now ? ctx.now() : Date.now();
-        return ctx.seq !== undefined ? { runId: ctx.runId, ts, seq: ctx.seq } : { runId: ctx.runId, ts };
-    }
-    function encodeAgentPayload(payload, ctx) {
-        const base = baseFields(ctx);
-        switch (payload.type) {
-            case 'text_delta':
-                return { ...base, kind: 'agent.message', text: payload.delta };
-            case 'tool_use':
-                // Overwrites any prior entry under the same id (a duplicate tool_use for one id) — the
-                // most recent call's name/args are what a matching tool_result should be attributed to,
-                // and there is no protocol-level guarantee ids are never reused within one run.
-                pendingToolCalls.set(payload.id, { toolName: payload.name, args: payload.input });
-                return { ...base, kind: 'tool_call', toolName: payload.name, args: payload.input, callId: payload.id, status: 'started' };
-            case 'tool_result': {
-                const pending = pendingToolCalls.get(payload.toolUseId);
-                pendingToolCalls.delete(payload.toolUseId);
-                return {
-                    ...base,
-                    kind: 'tool_call',
-                    // A tool_result with no matching prior tool_use (never observed, or already resolved/
-                    // cleared — e.g. after a run-ending 'end' event, see below) falls back to an 'unknown'
-                    // name and null args rather than throwing: the result itself is still real and worth
-                    // relaying even when its originating call wasn't captured.
-                    toolName: pending?.toolName ?? 'unknown',
-                    args: pending?.args ?? null,
-                    callId: payload.toolUseId,
-                    status: payload.isError ? 'failed' : 'completed',
-                    result: payload.content,
-                };
-            }
-            // Generalization (see source-map.md): pipeline_stage_started/completed generalized into a
-            // named-stage boundary any multi-step driver can emit, flowing through the same 'agent'
-            // channel as tool_use/tool_result.
-            case 'stage_start':
-                return {
-                    ...base,
-                    kind: 'run.lifecycle',
-                    status: 'pipeline_stage_started',
-                    stageId: payload.stageId,
-                    ...(payload.iteration !== undefined ? { iteration: payload.iteration } : {}),
-                };
-            case 'stage_end':
-                return {
-                    ...base,
-                    kind: 'run.lifecycle',
-                    status: 'pipeline_stage_completed',
-                    stageId: payload.stageId,
-                    ...(payload.iteration !== undefined ? { iteration: payload.iteration } : {}),
-                };
-            // Generalization (see source-map.md): genui_surface_request/response generalized into a
-            // generic human-in-the-loop ask/answer pair.
-            case 'surface_request':
-                return { ...base, kind: 'ui.surface_requested', surfaceId: payload.surfaceId, surfaceKind: payload.surfaceKind, payload: payload.payload };
-            case 'surface_response':
-                return { ...base, kind: 'ui.surface_responded', surfaceId: payload.surfaceId, value: payload.value, respondedBy: payload.respondedBy };
-            // 'status' / 'thinking_start' / 'thinking_delta' / 'tool_input_delta' / 'usage' / 'raw':
-            // no AG-UI equivalent — silently dropped, matching the original adapter's default behavior.
-            default:
-                return null;
-        }
-    }
-    function encode(event, ctx) {
-        switch (event.kind) {
-            case 'start':
-                return { ...baseFields(ctx), kind: 'run.lifecycle', status: 'started' };
-            case 'end': {
-                const status = event.payload.status === 'failed' ? 'failed' : event.payload.status === 'canceled' ? 'cancelled' : 'completed';
-                // A run can legitimately end while a tool_use is still in flight (its tool_result never
-                // arrived, or arrived after 'end' and was already rejected by RunLifecycle — see
-                // run-lifecycle.ts's "cannot emit on terminal run" guard). Clearing here means any such
-                // stale entries never leak past this run's own lifetime, and a same-id tool_result that
-                // somehow still reaches this encoder afterward correctly falls back to 'unknown' rather
-                // than resolving against a call from a run that has already ended.
-                pendingToolCalls.clear();
-                return { ...baseFields(ctx), kind: 'run.lifecycle', status };
-            }
-            case 'agent':
-                return encodeAgentPayload(event.payload, ctx);
-            // 'stdout' / 'stderr' / 'error': no AG-UI equivalent — silently dropped, matching the
-            // original adapter's default behavior for unrecognized event kinds.
-            default:
-                return null;
-        }
-    }
-    return { encode };
-}
-//# sourceMappingURL=encoder.js.map

package/dist/gen-ui/events.d.ts

@@ -1,59 +0,0 @@
-/**
- * @module agui/events
- *
- * The AG-UI wire event shapes `./encoder.ts` produces. AG-UI (Agent-User Interaction
- * Protocol) is CopilotKit's open, external wire protocol for streaming an agent's run over SSE to
- * a UI client — see https://github.com/ag-ui-protocol/ag-ui. This module is a near-verbatim port
- * of a 312-line adapter that encoded a product's own run-event stream into this shape; the types
- * themselves are unchanged in kind, only de-branded (see `source-map.md` for the full
- * field-mapping table and provenance).
- *
- * Folded in 2026-07-26 from the standalone `@jini-ai/agui` package (plan §3a) into this `src/gen-ui/`
- * subdirectory — see `./encoder.ts` for why it is kept apart from the flat `ag-ui.ts`.
- */
-export type GenUiEventKind = 'agent.message' | 'tool_call' | 'state_update' | 'ui.surface_requested' | 'ui.surface_responded' | 'run.lifecycle';
-export interface GenUiEventBase {
-    kind: GenUiEventKind;
-    runId: string;
-    seq?: number;
-    ts: number;
-}
-export interface GenUiAgentMessageEvent extends GenUiEventBase {
-    kind: 'agent.message';
-    text: string;
-    done?: boolean;
-}
-export interface GenUiToolCallEvent extends GenUiEventBase {
-    kind: 'tool_call';
-    toolName: string;
-    args: unknown;
-    callId?: string;
-    status?: 'started' | 'completed' | 'failed';
-    result?: unknown;
-}
-export interface GenUiStateUpdateEvent extends GenUiEventBase {
-    kind: 'state_update';
-    path: string;
-    value: unknown;
-}
-export interface GenUiSurfaceRequestedEvent extends GenUiEventBase {
-    kind: 'ui.surface_requested';
-    surfaceId: string;
-    surfaceKind: 'form' | 'choice' | 'confirmation' | 'oauth-prompt';
-    payload: unknown;
-}
-export interface GenUiSurfaceRespondedEvent extends GenUiEventBase {
-    kind: 'ui.surface_responded';
-    surfaceId: string;
-    value: unknown;
-    respondedBy: 'user' | 'agent' | 'auto' | 'cache';
-}
-export interface GenUiRunLifecycleEvent extends GenUiEventBase {
-    kind: 'run.lifecycle';
-    status: 'started' | 'pipeline_stage_started' | 'pipeline_stage_completed' | 'completed' | 'cancelled' | 'failed';
-    stageId?: string;
-    iteration?: number;
-    message?: string;
-}
-export type GenUiEvent = GenUiAgentMessageEvent | GenUiToolCallEvent | GenUiStateUpdateEvent | GenUiSurfaceRequestedEvent | GenUiSurfaceRespondedEvent | GenUiRunLifecycleEvent;
-//# sourceMappingURL=events.d.ts.map

package/dist/gen-ui/events.js

@@ -1,15 +0,0 @@
-/**
- * @module agui/events
- *
- * The AG-UI wire event shapes `./encoder.ts` produces. AG-UI (Agent-User Interaction
- * Protocol) is CopilotKit's open, external wire protocol for streaming an agent's run over SSE to
- * a UI client — see https://github.com/ag-ui-protocol/ag-ui. This module is a near-verbatim port
- * of a 312-line adapter that encoded a product's own run-event stream into this shape; the types
- * themselves are unchanged in kind, only de-branded (see `source-map.md` for the full
- * field-mapping table and provenance).
- *
- * Folded in 2026-07-26 from the standalone `@jini-ai/agui` package (plan §3a) into this `src/gen-ui/`
- * subdirectory — see `./encoder.ts` for why it is kept apart from the flat `ag-ui.ts`.
- */
-export {};
-//# sourceMappingURL=events.js.map

package/dist/gen-ui/index.d.ts

@@ -1,18 +0,0 @@
-/**
- * @module gen-ui
- *
- * Jini's **own** run-stream surface protocol — six event kinds (`agent.message`, `tool_call`,
- * `state_update`, `ui.surface_requested`, `ui.surface_responded`, `run.lifecycle`) and the encoder
- * that produces them from a `RunProtocolEvent` stream.
- *
- * **This is not AG-UI**, despite what this directory was called until 2026-07-27. The real
- * Agent-User Interaction Protocol uses a 33-member `SCREAMING_SNAKE` event enum and shares zero
- * event names with these six; `../ag-ui.ts` is the genuine AG-UI projection and lives at `src/`
- * root, apart from this. See `source-map.md` for how the two came to be confused.
- *
- * Nothing here opens a connection or touches a browser global. Transport (SSE, WebSocket) belongs
- * to a host — `@jini-ai/http-kit`'s run-stream route is the shipped consumer.
- */
-export { createGenUiEncoder, type GenUiEncodeContext, type GenUiEncoder, } from './encoder.js';
-export type { GenUiAgentMessageEvent, GenUiEvent, GenUiEventBase, GenUiEventKind, GenUiRunLifecycleEvent, GenUiStateUpdateEvent, GenUiSurfaceRequestedEvent, GenUiSurfaceRespondedEvent, GenUiToolCallEvent, } from './events.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/gen-ui/index.js

@@ -1,17 +0,0 @@
-/**
- * @module gen-ui
- *
- * Jini's **own** run-stream surface protocol — six event kinds (`agent.message`, `tool_call`,
- * `state_update`, `ui.surface_requested`, `ui.surface_responded`, `run.lifecycle`) and the encoder
- * that produces them from a `RunProtocolEvent` stream.
- *
- * **This is not AG-UI**, despite what this directory was called until 2026-07-27. The real
- * Agent-User Interaction Protocol uses a 33-member `SCREAMING_SNAKE` event enum and shares zero
- * event names with these six; `../ag-ui.ts` is the genuine AG-UI projection and lives at `src/`
- * root, apart from this. See `source-map.md` for how the two came to be confused.
- *
- * Nothing here opens a connection or touches a browser global. Transport (SSE, WebSocket) belongs
- * to a host — `@jini-ai/http-kit`'s run-stream route is the shipped consumer.
- */
-export { createGenUiEncoder, } from './encoder.js';
-//# sourceMappingURL=index.js.map

package/dist/guards.d.ts

@@ -1,96 +0,0 @@
-/**
- * @module guards
- *
- * The refusals that must hold on every surface, expressed over plain descriptors rather than
- * DOM nodes so they are testable in Node and reusable from any framework binding.
- *
- * Both guards here answer review findings that an allowlist alone does not cover: a generic
- * filler will happily type into a password or card-number field even when that field carries a
- * legitimate handle, and `data-agent-label` is page-authored text that reaches a model as if
- * the host had written it.
- */
-/** The subset of an input element these guards need. Framework- and DOM-free by design. */
-export interface FieldDescriptor {
-    /** The `type` attribute, lowercased. */
-    readonly type?: string | undefined;
-    /** The `autocomplete` attribute, lowercased. */
-    readonly autocomplete?: string | undefined;
-    readonly name?: string | undefined;
-    readonly id?: string | undefined;
-    /**
-     * **Every** human-visible naming of the field the driver could resolve — `aria-label`,
-     * `placeholder`, and the text of each associated `<label>`.
-     *
-     * Carried because `name`/`id` are the *machine* names, and a form builder or CMS that emits
-     * `name="field_47"` leaves the guard nothing to judge while the page still plainly reads
-     * "Card number" to the user. A field whose sensitivity is stated only in its label was
-     * invisible to every refusal here until this existed.
-     *
-     * Plural, and required to be exhaustive, because the singular form this replaced took whichever
-     * source resolved *first*: a page could then mask a sensitive field behind a benign one —
-     * `<label for=f>Card number</label><input id=f name=field_47 placeholder="Enter value">` reached
-     * the guard as the single label "Enter value", and its value was reported back in full.
-     */
-    readonly accessibleLabels?: readonly string[] | undefined;
-    readonly readOnly?: boolean | undefined;
-    readonly disabled?: boolean | undefined;
-}
-/**
- * The refusals that are about *secrecy* — the field's contents are not an agent's to know.
- *
- * Separated from the two writability refusals below because reading and writing are different
- * questions with different answers. A read-only field's value is perfectly safe to read back; a
- * password's is not safe to read even though it is, mechanically, just as readable. Folding both
- * into one list would either leak the password or hide the read-only field's value for no reason.
- */
-export type FieldReadRefusal = 'denied-type' | 'denied-autocomplete' | 'suspicious-name';
-export type FieldRefusal = FieldReadRefusal | 'not-text' | 'read-only' | 'disabled';
-/**
- * Why this field's current value must not be reported back to a caller, or `null` when reading
- * it is safe.
- *
- * Reading is the strictly more dangerous direction: writing into a password box gives an agent
- * nothing, whereas reading one out hands over the secret itself. So every secrecy signal the fill
- * guard uses applies here identically — type, autocomplete token, and a name or id that indicates
- * a credential or anti-forgery token — and none of them may be relaxed for reads.
- *
- * @param field - The field's attributes.
- * @returns The first secrecy refusal, or `null` when the value may be reported.
- */
-export declare function findFieldReadRefusal(field: FieldDescriptor): FieldReadRefusal | null;
-/**
- * Why an automated fill must be refused for this field, or `null` when it is safe to write.
- *
- * Fails closed on anything that looks like a credential, payment instrument, one-time code, or
- * anti-forgery token, independent of whether the field carries an agent handle. Tagging a
- * password box does not make it fillable. Every secrecy refusal is also a fill refusal — a field
- * whose contents an agent may not read is certainly not one it may overwrite — and two further
- * refusals cover fields that are simply not writable.
- *
- * @param field - The field's attributes.
- * @returns The first refusal reason, or `null` when the field may be filled.
- */
-export declare function findFieldFillRefusal(field: FieldDescriptor): FieldRefusal | null;
-/** Model-readable reason for a refusal, so a blocked fill explains itself instead of failing opaquely. */
-export declare function describeFieldRefusal(refusal: FieldRefusal): string;
-/** Model-readable reason a value was withheld, so a caller knows the field has contents it may not see rather than assuming it is empty. */
-export declare function describeFieldReadRefusal(refusal: FieldReadRefusal): string;
-/** Default cap on page-authored text handed to a model. */
-export declare const MAX_AGENT_LABEL_LENGTH = 200;
-export interface NormalizedLabel {
-    readonly text: string;
-    readonly truncated: boolean;
-}
-/**
- * Normalizes page-authored text before it reaches a model.
- *
- * Strips control characters (including the bidirectional overrides used to make text render
- * differently from how it reads), collapses whitespace, and caps the length. The result is still
- * untrusted *content* — this only bounds it; it does not make it safe to follow as instruction.
- *
- * @param raw - Text read off the page, e.g. a `data-agent-label`.
- * @param maxLength - Cap, defaulting to {@link MAX_AGENT_LABEL_LENGTH}.
- * @returns The bounded text and whether anything was cut.
- */
-export declare function normalizeAgentLabel(raw: string, maxLength?: number): NormalizedLabel;
-//# sourceMappingURL=guards.d.ts.map