@jini-ai/chat 0.6.15-rc.2 → 0.6.16

package/dist/core/util/recover.js

@@ -6,10 +6,11 @@
  * a standalone document reply, or as a single fenced ```html block.
  */
 import { validateHtmlArtifact } from './validate.js';
+import { fencedCodeRanges } from './markdown-context.js';
 const HTML_OPEN_RE = /<html\b/gi;
 const HTML_CLOSE_RE = /<\/html\s*>/gi;
 const ADJACENT_DOCTYPE_RE = /<!doctype\s+html\b[^>]*>\s*$/i;
-const HTML_FENCE_RE = /```(?:html|HTML)\s*\n([\s\S]*?)\n```/g;
+const HTML_FENCE_RE = /```(?:html|HTML)/g;
 function findLastArtifactOpen(sourceText, identifier) {
     if (!identifier)
         return sourceText.lastIndexOf('<artifact');
@@ -99,15 +100,11 @@ export function recoverStandaloneHtmlDocument({ sourceText }) {
  */
 export function recoverHtmlDocumentFromMarkdownFence({ sourceText }) {
     const text = String(sourceText || '');
-    HTML_FENCE_RE.lastIndex = 0;
     let recovered = null;
     let count = 0;
-    let match;
-    while ((match = HTML_FENCE_RE.exec(text)) !== null) {
-        const candidate = (match[1] || '').replace(/^/, '').trim();
-        if (!/<\/html\s*>$/i.test(candidate))
-            continue;
-        if (!validateHtmlArtifact({ content: candidate }).ok)
+    for (const range of fencedCodeRanges({ content: text, opener: HTML_FENCE_RE })) {
+        const candidate = range.body.replace(/^/, '').trim();
+        if (!/<\/html\s*>$/i.test(candidate) || !validateHtmlArtifact({ content: candidate }).ok)
             continue;
         recovered = candidate;
         count += 1;

package/dist/core/util/strip.js

@@ -1,15 +1,16 @@
+import { trimChars } from '@jini-ai/core/primitives';
 /**
  * @module strip
  *
  * Post-stream `<artifact>` removal/summarization and the streaming-display
  * counterpart that surfaces an in-flight (not-yet-closed) artifact block.
  */
-import { computeSkipRanges, isRealArtifactOpenAt, rangeContains } from './markdown-context.js';
+import { fencedCodeRanges, computeSkipRanges, isRealArtifactOpenAt, rangeContains } from './markdown-context.js';
 import { parseQuotedAttrs } from './markup-attributes.js';
 import { recoverHtmlArtifactFromPrecedingDocument, recoverHtmlDocumentFromMarkdownFence, recoverStandaloneHtmlDocument, } from './recover.js';
 const OPEN = '<artifact';
 const CLOSE = '</artifact>';
-const HTML_FENCE_RE = /```(?:html|HTML)\s*\n([\s\S]*?)\n```/g;
+const HTML_FENCE_RE = /```(?:html|HTML)/g;
 function findUnskipped(content, needle, fromIndex, ranges) {
     let from = fromIndex;
     // `needle` (always `CLOSE`, non-empty) makes `content.indexOf` itself
@@ -91,17 +92,14 @@ export function stripArtifact({ content }) {
     return (content.slice(0, block.open) + content.slice(block.close + CLOSE.length)).trim();
 }
 function findSingleRecoverableHtmlFence(content) {
-    HTML_FENCE_RE.lastIndex = 0;
     let recovered = null;
     let count = 0;
-    let match = HTML_FENCE_RE.exec(content);
-    while (match !== null) {
-        const html = (match[1] || '').replace(/^/, '').trim();
-        if (recoverHtmlDocumentFromMarkdownFence({ sourceText: match[0] }) === html) {
-            recovered = { start: match.index, end: match.index + match[0].length, html };
+    for (const range of fencedCodeRanges({ content, opener: HTML_FENCE_RE })) {
+        const html = range.body.replace(/^/, '').trim();
+        if (recoverHtmlDocumentFromMarkdownFence({ sourceText: content.slice(range.start, range.end) }) === html) {
+            recovered = { start: range.start, end: range.end, html };
             count += 1;
         }
-        match = HTML_FENCE_RE.exec(content);
     }
     return count === 1 ? recovered : null;
 }
@@ -177,10 +175,9 @@ function artifactExtensionForAttrs(attrs) {
 }
 // The slug a persist path would derive the file name from.
 function artifactBaseNameForAttrs(attrs) {
-    return ((attrs['identifier'] || attrs['title'] || 'artifact')
-        .toLowerCase()
-        .replace(/[^a-z0-9_-]+/g, '-')
-        .replace(/^-+|-+$/g, '')
+    return (trimChars({ text: (attrs['identifier'] || attrs['title'] || 'artifact')
+            .toLowerCase()
+            .replace(/[^a-z0-9_-]+/g, '-'), chars: '-' })
         .slice(0, 60) || 'artifact');
 }
 /**
@@ -296,7 +293,7 @@ export function splitStreamingArtifact({ content }) {
         // known yet, but an artifact is starting, so show the box (empty body)
         // and hide the partial `<artifact …` tail from Markdown.
         return {
-            head: content.slice(0, open).replace(/\s+$/, ''),
+            head: content.slice(0, open).trimEnd(),
             live: { artifactType: '', title: '', identifier: '', content: '' },
         };
     }
@@ -311,7 +308,7 @@ export function splitStreamingArtifact({ content }) {
     if (artifactType && !/html|text\//i.test(artifactType))
         return { head: content, live: null };
     return {
-        head: content.slice(0, open).replace(/\s+$/, ''),
+        head: content.slice(0, open).trimEnd(),
         live: {
             artifactType,
             title: attrs['title'] ?? '',

package/dist/core/util/validate.js

@@ -43,8 +43,9 @@ const URL_ATTRIBUTE_RE = /\b(href|src|srcset|poster|action|formaction|data|xlink
 const STYLE_ATTRIBUTE_RE = /\bstyle\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'`=<>]+))/gi;
 const HTML_TAG_RE = /<[a-z][^>]*>/gi;
 const STYLE_BLOCK_RE = /<style\b[^>]*>([\s\S]*?)<\/style>/gi;
-const CSS_URL_RE = /\burl\(\s*(?:"([^"]*)"|'([^']*)'|([^)]*?))\s*\)/gi;
-const CSS_IMPORT_RE = /@import\s+(?:url\(\s*(?:"([^"]*)"|'([^']*)'|([^)]*?))\s*\)|"([^"]*)"|'([^']*)')/gi;
+const CSS_URL_RE = /\burl\((?:\s*"([^"]*)"\s*|\s*'([^']*)'\s*|([^)]*))\)/gi;
+const CSS_IMPORT_START_RE = /@import\s+/gi;
+const CSS_QUOTED_IMPORT_RE = /(?:"([^"]*)"|'([^']*)')/y;
 /**
  * Sniff-test whether `content` looks like a complete HTML document rather
  * than prose that happens to mention HTML.
@@ -127,22 +128,34 @@ function hasReservedWorkspacePathInStyleBlocks(content) {
     return false;
 }
 function cssTextReferencesReservedWorkspacePath(cssText) {
-    for (const pattern of [CSS_URL_RE, CSS_IMPORT_RE]) {
-        pattern.lastIndex = 0;
-        let match;
-        while ((match = pattern.exec(cssText)) !== null) {
-            // Both CSS_URL_RE and CSS_IMPORT_RE are single top-level alternations
-            // across all their capture groups, so exactly one group is ever defined
-            // on a successful match — `.find` always finds it; the assertion just
-            // satisfies `noUncheckedIndexedAccess`.
-            const candidate = match.slice(1).find((value) => value !== undefined);
-            if (candidateReferencesReservedWorkspacePath(candidate, false)) {
-                return true;
-            }
-        }
+    for (const match of cssReferenceMatches({ cssText })) {
+        // Quote/unquoted alternatives are mutually exclusive, so exactly one capture is defined
+        // after success; TypeScript cannot express that guarantee for RegExpExecArray.
+        const candidate = match.slice(1).find((value) => value !== undefined);
+        if (candidateReferencesReservedWorkspacePath(candidate, false))
+            return true;
     }
     return false;
 }
+/** Keep each import's whole span consumed, including URL imports already inspected by the first
+ * pass. Rescanning @import text quoted inside such a URL would change the path-refusal policy. */
+function* cssReferenceMatches({ cssText }) {
+    yield* cssText.matchAll(CSS_URL_RE);
+    const imports = new RegExp(CSS_IMPORT_START_RE);
+    const url = new RegExp(CSS_URL_RE.source, 'iy');
+    const quoted = new RegExp(CSS_QUOTED_IMPORT_RE);
+    let header = imports.exec(cssText);
+    while (header !== null) {
+        url.lastIndex = imports.lastIndex;
+        quoted.lastIndex = imports.lastIndex;
+        const value = url.exec(cssText) ?? quoted.exec(cssText);
+        if (value) {
+            imports.lastIndex = value.index + value[0].length;
+            yield value;
+        }
+        header = imports.exec(cssText);
+    }
+}
 function candidateReferencesReservedWorkspacePath(candidate, splitCandidates) {
     const paths = splitCandidates ? srcsetCandidateUrls(candidate) : [firstUrlToken(candidate)];
     return paths.some((path) => {
@@ -171,10 +184,9 @@ function srcsetCandidateUrls(srcset) {
             continue;
         }
         candidate ??= { isDataUrl: /^data:/i.test(srcset.slice(index)), sawWhitespaceAfterUrl: false };
-        if (isSpace) {
+        if (isSpace)
             candidate.sawWhitespaceAfterUrl = true;
-        }
-        else if (endsSrcsetCandidate(candidate, char)) {
+        if (!isSpace && endsSrcsetCandidate(candidate, char)) {
             candidates.push(srcset.slice(start, index));
             start = index + 1;
             candidate = null;

package/dist/embed-widget/browser/frontend-session-bridge.d.ts

@@ -0,0 +1,99 @@
+import { type PageDriver } from '@jini-ai/agentic';
+import type { ApprovalAnswer } from '@jini-ai/core';
+import type { ChatPaneAgentToolAction, ChatPaneAgentBridgeAccess } from '../../react/features/chat-pane/types.js';
+export interface FrontendSessionBridgeOptions {
+    /** Host validates its server-bound envelope before the shared page executor sees plain args. */
+    readonly preparePageInput?: (args: {
+        action: ChatPaneAgentToolAction;
+    }) => Record<string, unknown>;
+    readonly capabilityIds?: readonly string[];
+    /** Bounds the HTTP envelope before it reaches a host JSON-body limit. Oversized reads refuse. */
+    readonly maxResponseBytes?: number;
+    /** Flush host state; a defined return replaces the machine response before acknowledgement. */
+    readonly onBeforeResponse?: (args: {
+        action: ChatPaneAgentToolAction;
+        output: unknown;
+    }) => unknown | Promise<unknown>;
+    readonly onAfterResponse?: (args: {
+        action: ChatPaneAgentToolAction;
+        output: unknown;
+    }) => void | Promise<void>;
+    /** Host policy and the existing app dialog. It never receives an assistant decision. */
+    readonly pageApproval?: {
+        isDirect(required: {
+            capabilityId: string;
+            input: Record<string, unknown>;
+        }): boolean;
+        request(required: {
+            capabilityId: string;
+            input: Record<string, unknown>;
+            signal: AbortSignal;
+        }): Promise<ApprovalAnswer>;
+    };
+    /** Supplying one claims the six `page.*` verbs. Omit for a chat-only surface. */
+    readonly pageDriver?: PageDriver;
+    /**
+     * Product capabilities, keyed by id prefix (`'cms.'`). Each claims every capability under it.
+     * This is how a consumer exposes verbs the engine has never heard of.
+     */
+    readonly executors?: Readonly<Record<string, (capabilityId: string, input: Record<string, unknown>) => Promise<unknown>>>;
+    /** Called for every invocation before it runs — the hook a product uses to show an activity trail. */
+    readonly onInvocation?: (action: ChatPaneAgentToolAction) => void;
+    /** Reported for failures that are nobody's tool call: stream errors, malformed frames. */
+    readonly onError?: (error: unknown) => void;
+}
+/** The host supplies its origin and stream transport; native fetch defaults may be overridden. */
+export interface FrontendSessionBridgeArgs {
+    /** Pass an empty string for the same-origin proxy used by a browser host. */
+    readonly baseUrl: string;
+    readonly endpointPrefix?: string;
+    readonly headers?: () => Record<string, string>;
+    readonly openStream: (args: {
+        url: string;
+        headers?: Record<string, string>;
+    }) => Pick<EventSource, 'addEventListener' | 'close'>;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly request?: (args: {
+        url: string;
+        init: RequestInit;
+        timeoutMs: number;
+    }) => Promise<Response>;
+}
+export interface FrontendSessionBridge {
+    /** Hand this to `ChatPane`'s `agentControl.bridgeAccess`. */
+    readonly bridgeAccess: ChatPaneAgentBridgeAccess;
+    /**
+     * Resolves the *first* time the daemon attaches this surface — an "is it live yet" signal.
+     *
+     * Its `bindToken` is only correct until the next reconnect, so do not stash it. Call
+     * {@link FrontendSessionBridge.bindToken} when building a run request instead.
+     */
+    readonly ready: Promise<{
+        sessionId: string;
+        bindToken: string;
+    }>;
+    /**
+     * The token for the attachment that is live *now*, or `undefined` before the first attach and
+     * after {@link FrontendSessionBridge.close}. Read it at run-start; see the module doc.
+     */
+    bindToken(): string | undefined;
+    close(): void;
+}
+/**
+ * Opens the surface's connection and starts routing invocations.
+ *
+ * @param options - What this page can serve and where the daemon is.
+ * @returns The pane's bridge, the attach result, and a teardown.
+ */
+export declare function createFrontendSessionBridge({ baseUrl: base, openStream, request, fetch, endpointPrefix, headers }: FrontendSessionBridgeArgs, options?: FrontendSessionBridgeOptions): FrontendSessionBridge;
+/** Authenticated streaming replacement for EventSource when credentials belong in headers.
+ * Uses the shared SSE decoder; reconnect creates a new attachment and clears the old token.
+ * O(stream bytes), bounded frame buffer; close aborts fetch/readers and the reconnect timer. */
+export declare function openFetchFrontendStream({ url, headers }: {
+    url: string;
+    headers: () => Record<string, string>;
+}, { fetch: send, reconnectMs }?: {
+    fetch?: typeof globalThis.fetch;
+    reconnectMs?: number;
+}): Pick<EventSource, 'addEventListener' | 'close'>;
+//# sourceMappingURL=frontend-session-bridge.d.ts.map

package/dist/embed-widget/browser/frontend-session-bridge.js

@@ -0,0 +1,384 @@
+import { decodeSseFrames } from '@jini-ai/core/primitives';
+/**
+ * @module agent-bridge/frontend-session-bridge
+ *
+ * The browser half of agent-driven frontend control: one SSE connection to the daemon, and the
+ * routing that turns each relayed invocation into a call on something in this page.
+ *
+ * Everything on the server side already existed — `FrontendSessionRegistry` addresses a run to a
+ * surface, the frontend-session routes carry invocations out and answers back, and
+ * `createFrontendControl` assembles them. `ChatPaneAgentBridgeAccess` declared the contract this
+ * satisfies and had **zero implementations**, which is why an agent could reach a tool and the
+ * tool could reach nothing.
+ *
+ * Design notes worth knowing before changing this:
+ *
+ * - **The connection is owned here, not by `subscribe`.** `ChatPaneAgentBridgeAccess.subscribe` is
+ *   called by the chat pane's own effect, so tying the stream's lifetime to it would mean page
+ *   control dies when the pane unmounts — and the page is drivable whether or not a chat pane
+ *   exists. `subscribe` registers a listener; `close()` tears the connection down.
+ * - **Capabilities are claimed from what is actually wired.** The claim sent at connect time is
+ *   derived from the presence of a `pageDriver` and the keys of `executors`, never from a static
+ *   list. A surface that claims what it cannot serve turns a fast, named refusal into a timeout.
+ * - **An executed invocation is never executed twice.** If the stream drops between the daemon
+ *   delivering an invocation and this page POSTing the answer, the daemon correctly fails that
+ *   call — but the click already happened. Without the `executed` set below, the retry clicks
+ *   again. Buttons are not idempotent.
+ * - **The bind token never leaves this module except to the host.** It arrives on the `attached`
+ *   event and must ride to run-start; it deliberately does not appear in any URL (see
+ *   `@jini-ai/daemon`'s `FrontendSessionHandle`).
+ * - **Read the bind token at send time, not once.** `EventSource` reconnects on its own — after a
+ *   daemon restart, a sleeping laptop, or an ordinary network blip — and each reattach mints a new
+ *   session and a new token. A host that captured `ready`'s token keeps sending a dead one, every
+ *   later run fails to bind, and the only trace is a daemon-side log line: the agent is simply told
+ *   "no frontend is bound to this run". `ready` therefore answers "has it attached at least once";
+ *   {@link FrontendSessionBridge.bindToken} answers "what is valid now", and only the latter
+ *   belongs in a run request.
+ */
+import { CHAT_CAPABILITIES } from '../../core/index.js';
+import { PAGE_CAPABILITIES, executePageCapability } from '@jini-ai/agentic';
+/** How many settled invocation ids to remember for replay suppression. */
+const EXECUTED_MEMORY = 256;
+/** Ids this surface can actually serve, given what the host wired up. */
+function claimedCapabilities(options) {
+    if (options.capabilityIds)
+        return [...options.capabilityIds];
+    const claims = CHAT_CAPABILITIES.map((capability) => capability.id);
+    if (options.pageDriver !== undefined) {
+        claims.push(...PAGE_CAPABILITIES.map((capability) => capability.id));
+    }
+    // Dialog-support handshake only; page.approval is not an executable tool id.
+    if (options.pageApproval)
+        claims.push('page.approval');
+    claims.push(...Object.keys(options.executors ?? {}));
+    return claims;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Parses a frame's data into an object, or says why it is not one. */
+function parseFrameObject(data) {
+    let parsed;
+    try {
+        parsed = JSON.parse(data);
+    }
+    catch (error) {
+        return { error };
+    }
+    // `JSON.parse` succeeds on any valid JSON value, not just objects — a bare `null`, number,
+    // string or boolean parses cleanly and would throw *outside* this try/catch on the very next
+    // `frame['type']` read (`null` is the one of those that actually throws; the others just read
+    // back `undefined` harmlessly). Guarding here routes every one of those through the same
+    // `onError` path as an unparseable frame, rather than only some of them crashing the listener.
+    if (parsed === null || typeof parsed !== 'object') {
+        return { error: new Error(`malformed frame: expected a JSON object, got ${JSON.stringify(parsed)}`) };
+    }
+    return { frame: parsed };
+}
+/** Reads an `invocation` frame into the pane's action shape, refusing one with no usable id. */
+function readInvocation(frame) {
+    const rawInvocationId = frame['invocationId'];
+    if (typeof rawInvocationId !== 'string' || rawInvocationId.length === 0) {
+        return { kind: 'malformed', error: new Error('invocation frame missing invocationId') };
+    }
+    return {
+        kind: 'invocation',
+        action: {
+            invocationId: rawInvocationId,
+            capabilityId: String(frame['capabilityId']),
+            input: (frame['input'] ?? {}),
+        },
+    };
+}
+/** Classifies one frame's raw data; the listener only applies the result. */
+function readFrame(data) {
+    const parsed = parseFrameObject(data);
+    if ('error' in parsed)
+        return { kind: 'malformed', error: parsed.error };
+    const { frame } = parsed;
+    switch (frame['type']) {
+        case 'cancelled':
+            return { kind: 'cancelled', invocationId: String(frame['invocationId']) };
+        case 'attached':
+            return { kind: 'attached', sessionId: String(frame['sessionId']), bindToken: String(frame['bindToken']) };
+        case 'error':
+            return { kind: 'refused', message: String(frame['message']) };
+        case 'invocation':
+            return readInvocation(frame);
+        default:
+            // Unknown frame types are ignored rather than treated as errors, so the daemon's event
+            // vocabulary can grow without every deployed surface needing to ship first.
+            return { kind: 'ignored' };
+    }
+}
+/**
+ * Opens the surface's connection and starts routing invocations.
+ *
+ * @param options - What this page can serve and where the daemon is.
+ * @returns The pane's bridge, the attach result, and a teardown.
+ */
+export function createFrontendSessionBridge({ baseUrl: base, openStream, request, fetch, endpointPrefix = '/api/frontend-sessions', headers }, options = {}) {
+    const capabilities = claimedCapabilities(options);
+    // The only caller (`respond`) never passes its own signal, so the deadline is the whole signal.
+    const send = request ?? (({ url, init, timeoutMs }) => (fetch ?? globalThis.fetch)(url, { ...init, signal: AbortSignal.timeout(timeoutMs) }));
+    let sessionId;
+    /** Replaced on every reattach; a promise resolved once could never carry this. */
+    let currentBindToken;
+    // Definite assignment rather than no-op placeholders: a Promise executor runs synchronously, so
+    // both are set before this line finishes, and placeholders would only add two functions that
+    // can never be called.
+    let resolveReady;
+    let rejectReady;
+    const ready = new Promise((resolve, reject) => {
+        resolveReady = resolve;
+        rejectReady = reject;
+    });
+    /** Chat-pane listeners. The pane registers exactly one; a second host could register another. */
+    const chatListeners = new Set();
+    /** Invocation ids already run here, so a stream reconnect cannot double-click a button. */
+    const executed = new Set();
+    const pending = new Map();
+    // A page driver owns one live screen. Serialize its observations, effect and acknowledgement;
+    // otherwise a second invocation could overwrite the first one's host-bound navigation plan.
+    let pageQueue = Promise.resolve();
+    const abortPending = () => {
+        for (const controller of pending.values()) {
+            controller.abort();
+        }
+        pending.clear();
+    };
+    const query = capabilities.map((id) => `capability=${encodeURIComponent(id)}`).join('&');
+    const source = openStream({ url: `${base}${endpointPrefix}/stream?${query}`, ...(headers ? { headers: headers() } : {}) });
+    async function respond(invocationId, body) {
+        if (sessionId === undefined)
+            throw new Error('the surface is not attached yet');
+        const wire = boundedFrontendResponse({ invocationId, body, maxBytes: options.maxResponseBytes });
+        const response = await send({
+            url: `${base}${endpointPrefix}/${encodeURIComponent(sessionId)}/responses`,
+            init: { method: 'POST', headers: { 'content-type': 'application/json', ...headers?.(), ...(headers ? { 'x-frontend-bind-token': currentBindToken ?? '' } : {}) }, body: wire.payload },
+            timeoutMs: 15_000,
+        });
+        await assertFrontendResponse({ response, invocationId, body, scoped: Boolean(headers), refused: wire.refused });
+    }
+    const respondSuccess = (invocationId, output) => respond(invocationId, { ok: true, output });
+    const respondError = (invocationId, message) => respond(invocationId, { ok: false, message });
+    /** Freeze once, ask on the app's existing human-only channel, then use the same page executor.
+     * The server pauses its execution deadline only after acknowledging the bounded human wait. */
+    async function servePage(action, signal) {
+        const input = options.preparePageInput ? options.preparePageInput({ action }) : structuredClone(action.input);
+        const args = { capabilityId: action.capabilityId, input };
+        if (options.pageApproval && !options.pageApproval.isDirect(args)) {
+            await respond(action.invocationId, { phase: 'approval-pending' });
+            const answer = await options.pageApproval.request({ ...args, input: structuredClone(input), signal });
+            // Report the decision before effects, including decline/expiry; the server audits it.
+            await respond(action.invocationId, { phase: 'execution-started', decision: answer.confirmed ? 'approved' : answer.reason });
+            if (!answer.confirmed)
+                return { executed: false, reason: answer.reason };
+        }
+        if (signal.aborted)
+            return { executed: false, reason: 'abandoned' };
+        return executePageCapability({ driver: options.pageDriver, ...args }, { signal });
+    }
+    /** Runs one non-chat invocation here and answers it. Chat ones go to the pane instead. */
+    async function serveLocally(action, controller) {
+        let output;
+        try {
+            controller.signal.throwIfAborted();
+            if (options.pageDriver !== undefined && action.capabilityId.startsWith('page.')) {
+                output = await servePage(action, controller.signal);
+            }
+            else {
+                const entry = Object.entries(options.executors ?? {})
+                    .find(([prefix]) => action.capabilityId.startsWith(prefix));
+                if (entry === undefined)
+                    throw new Error(`nothing on this page serves "${action.capabilityId}"`);
+                output = await entry[1](action.capabilityId, action.input);
+            }
+        }
+        catch (error) {
+            pending.delete(action.invocationId);
+            await respondError(action.invocationId, errorMessage(error)).catch(options.onError ?? (() => undefined));
+            return;
+        }
+        await acknowledge({ action, output, signal: controller.signal });
+        pending.delete(action.invocationId);
+    }
+    async function acknowledge({ action, output, signal }) {
+        try {
+            signal.throwIfAborted();
+            const projected = await options.onBeforeResponse?.({ action, output });
+            const acceptedOutput = projected ?? output;
+            await respondSuccess(action.invocationId, acceptedOutput);
+            signal.throwIfAborted();
+            await options.onAfterResponse?.({ action, output: acceptedOutput });
+        }
+        catch (error) {
+            options.onError?.(error);
+        }
+    }
+    function remember(invocationId) {
+        executed.add(invocationId);
+        if (executed.size > EXECUTED_MEMORY) {
+            const oldest = executed.values().next().value;
+            if (oldest !== undefined)
+                executed.delete(oldest);
+        }
+    }
+    /** Runs one well-formed invocation: replay check, announcement, then pane or local serving. */
+    function handleInvocation(action) {
+        // A redelivery after a dropped answer must not re-run the side effect.
+        if (executed.has(action.invocationId)) {
+            void respondError(action.invocationId, 'already executed on this surface').catch(() => undefined);
+            return;
+        }
+        if (options.capabilityIds && !options.capabilityIds.includes(action.capabilityId)) {
+            void respondError(action.invocationId, 'Capability unavailable').catch(() => undefined);
+            return;
+        }
+        remember(action.invocationId);
+        options.onInvocation?.(action);
+        if (action.capabilityId.startsWith('chat.')) {
+            for (const listener of chatListeners)
+                listener(action);
+            return;
+        }
+        const controller = new AbortController();
+        pending.set(action.invocationId, controller);
+        if (action.capabilityId.startsWith('page.')) {
+            pageQueue = pageQueue.then(() => serveLocally(action, controller)).catch(error => options.onError?.(error));
+        }
+        else
+            void serveLocally(action, controller);
+    }
+    source.addEventListener('message', (event) => {
+        const frame = readFrame(event.data);
+        switch (frame.kind) {
+            case 'cancelled':
+                pending.get(frame.invocationId)?.abort();
+                return;
+            case 'attached':
+                abortPending();
+                sessionId = frame.sessionId;
+                currentBindToken = frame.bindToken;
+                // A no-op after the first attach — which is exactly why `currentBindToken` exists.
+                resolveReady({ sessionId, bindToken: currentBindToken });
+                return;
+            case 'refused':
+                rejectReady(new Error(frame.message));
+                return;
+            case 'malformed':
+                options.onError?.(frame.error);
+                return;
+            case 'invocation':
+                handleInvocation(frame.action);
+                return;
+            case 'ignored':
+                return;
+        }
+    });
+    source.addEventListener('error', (event) => {
+        abortPending();
+        // The daemon deletes a session's bind token the instant that connection drops, so by the time
+        // this fires the token in hand is already gone from the registry. Holding it until the next
+        // `attached` frame leaves a window where `bindToken()` hands back something dead, and a run
+        // started in that window fails to bind — reported to the agent only as "no frontend is bound
+        // to this run", with the real reason (a reconnect it never saw) nowhere in view.
+        // Reporting no token is the honest answer for a surface that is, right now, not attached.
+        currentBindToken = undefined;
+        sessionId = undefined;
+        options.onError?.(event);
+    });
+    const bridgeAccess = {
+        subscribe(onAction) {
+            chatListeners.add(onAction);
+            // Removes this listener only. The connection outlives any one pane — see the module doc.
+            return () => chatListeners.delete(onAction);
+        },
+        respondSuccess,
+        respondError,
+    };
+    return {
+        bridgeAccess,
+        ready,
+        bindToken: () => currentBindToken,
+        close() {
+            abortPending();
+            source.close();
+            chatListeners.clear();
+            // A closed bridge serves nothing, so binding a run to it would strand that run rather than
+            // fail it — this is what stops a torn-down surface (a StrictMode remount, a route change)
+            // from handing its dead token to the next run.
+            currentBindToken = undefined;
+            sessionId = undefined;
+        },
+    };
+}
+/** Authenticated streaming replacement for EventSource when credentials belong in headers.
+ * Uses the shared SSE decoder; reconnect creates a new attachment and clears the old token.
+ * O(stream bytes), bounded frame buffer; close aborts fetch/readers and the reconnect timer. */
+export function openFetchFrontendStream({ url, headers }, { fetch: send = globalThis.fetch, reconnectMs = 1000 } = {}) {
+    const events = new EventTarget();
+    const abort = new AbortController();
+    let retry;
+    let delay = reconnectMs;
+    async function connect() {
+        let retryable = true;
+        try {
+            const response = await send(url, { credentials: 'same-origin', mode: 'same-origin', redirect: 'error', headers: headers(), signal: abort.signal });
+            retryable = ![401, 403, 404, 429].includes(response.status);
+            if (!response.ok || !response.body)
+                throw new Error('Frontend stream unavailable');
+            for await (const frame of decodeSseFrames({ source: streamChunks(response.body) }, { maxBufferChars: 128_000 })) {
+                delay = reconnectMs; // A delivered event proves the connection recovered.
+                if (!abort.signal.aborted)
+                    events.dispatchEvent(new MessageEvent('message', { data: frame.data }));
+            }
+        }
+        catch { /* The stream error has one value-free notification below. */ }
+        if (abort.signal.aborted)
+            return;
+        events.dispatchEvent(new Event('error'));
+        if (retryable) {
+            retry = setTimeout(() => { void connect(); }, delay);
+            delay = Math.min(delay * 2, 30_000);
+        }
+    }
+    void connect();
+    return { addEventListener: events.addEventListener.bind(events),
+        close() { abort.abort(); clearTimeout(retry); } };
+}
+async function* streamChunks(body) {
+    const reader = body.getReader();
+    try {
+        for (;;) {
+            const next = await reader.read();
+            if (next.done) {
+                return;
+            }
+            yield next.value;
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+/** Transport bounds differ from executor output truncation: keep the envelope valid JSON. */
+function boundedFrontendResponse({ invocationId, body, maxBytes }) {
+    const payload = JSON.stringify({ invocationId, ...body });
+    if (maxBytes === undefined || new TextEncoder().encode(payload).length <= maxBytes)
+        return { payload, refused: false };
+    return { payload: JSON.stringify({ invocationId, ok: false, message: 'Frontend result too large; narrow the query.' }), refused: true };
+}
+async function assertFrontendResponse({ response, invocationId, body, scoped, refused }) {
+    if (!response.ok)
+        throw new Error(`answering "${invocationId}" failed: ${response.status}`);
+    if (refused)
+        throw new Error('Frontend result too large; narrow the query.');
+    if ('phase' in body || scoped) {
+        const result = await response.json();
+        if (!result.settled)
+            throw new Error('Page invocation expired or was cancelled; no action was taken');
+    }
+}
+//# sourceMappingURL=frontend-session-bridge.js.map