@jini-ai/chat 0.6.5 → 0.6.7

package/dist/embed-widget/browser/session-store.js

@@ -19,7 +19,6 @@ export function createBrowserSessionStore(args) {
     if (!Number.isSafeInteger(maxBytes) || maxBytes < 28)
         throw new Error('Invalid byte limit');
     const empty = () => ({ open: false, messages: [] });
-    const bytes = (value) => new TextEncoder().encode(value).length;
     const clear = (_args) => {
         try {
             storage.removeItem(transcriptKey);
@@ -38,16 +37,7 @@ export function createBrowserSessionStore(args) {
             if (raw === null)
                 return empty();
             try {
-                if (bytes(raw) > maxBytes)
-                    throw new Error('Transcript exceeds byte limit');
-                const value = JSON.parse(raw);
-                if (typeof value !== 'object' || value === null || Array.isArray(value))
-                    throw new Error('Invalid envelope');
-                const state = value;
-                if (typeof state.open !== 'boolean' || !Array.isArray(state.messages)
-                    || state.messages.length > maxMessages || !state.messages.every(value => validateMessage({ value })))
-                    throw new Error('Invalid transcript');
-                return { open: state.open, messages: state.messages };
+                return parseTranscript({ raw, maxBytes, maxMessages, validateMessage });
             }
             catch {
                 clear({});
@@ -58,7 +48,7 @@ export function createBrowserSessionStore(args) {
             try {
                 let messages = maxMessages === 0 ? [] : state.messages.slice(-maxMessages);
                 let serialized = JSON.stringify({ open: state.open, messages });
-                while (messages.length > 0 && bytes(serialized) > maxBytes) {
+                while (messages.length > 0 && utf8Bytes(serialized) > maxBytes) {
                     messages = messages.slice(1);
                     serialized = JSON.stringify({ open: state.open, messages });
                 }
@@ -100,4 +90,23 @@ export function createBrowserSessionStore(args) {
         },
     };
 }
+const utf8Bytes = (value) => new TextEncoder().encode(value).length;
+/**
+ * Parses and validates one stored transcript envelope. Throws on any defect so the caller can
+ * clear the whole entry (no partial recovery). Oversized envelopes are rejected before parsing.
+ */
+function parseTranscript(args) {
+    const { raw, maxBytes, maxMessages, validateMessage } = args;
+    if (utf8Bytes(raw) > maxBytes)
+        throw new Error('Transcript exceeds byte limit');
+    const value = JSON.parse(raw);
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        throw new Error('Invalid envelope');
+    const state = value;
+    if (typeof state.open !== 'boolean' || !Array.isArray(state.messages))
+        throw new Error('Invalid transcript');
+    if (state.messages.length > maxMessages || !state.messages.every(value => validateMessage({ value })))
+        throw new Error('Invalid transcript');
+    return { open: state.open, messages: state.messages };
+}
 //# sourceMappingURL=session-store.js.map

package/dist/embed-widget/transports/fetch-sse.js

@@ -8,19 +8,17 @@ export function mapJsonChatSseFrame({ frame, directiveEventName, streamError })
         return {};
     const data = JSON.parse(frame.data);
     const obj = typeof data === 'object' && data !== null ? data : {};
-    if (frame.event === 'text') {
-        if (typeof obj.delta !== 'string')
-            throw new Error('Invalid text frame');
-        return { event: { kind: 'text', text: obj.delta } };
+    switch (frame.event) {
+        case 'text':
+            if (typeof obj.delta !== 'string')
+                throw new Error('Invalid text frame');
+            return { event: { kind: 'text', text: obj.delta } };
+        case 'error': return { error: new Error(nonEmptyString(obj.message) ?? streamError) };
+        case 'end': return { done: true };
+        default: return frame.event === directiveEventName ? { event: { kind: 'ext', name: directiveEventName, data } } : {};
     }
-    if (frame.event === 'error')
-        return { error: new Error(typeof obj.message === 'string' && obj.message ? obj.message : streamError) };
-    if (frame.event === 'end')
-        return { done: true };
-    if (frame.event === directiveEventName)
-        return { event: { kind: 'ext', name: directiveEventName, data } };
-    return {};
 }
+const nonEmptyString = (value) => (typeof value === 'string' && value ? value : undefined);
 async function* responseChunks(body, signal) {
     const reader = body.getReader();
     const cancel = () => { void reader.cancel().catch(() => { }); };
@@ -71,15 +69,11 @@ export function createFetchSseTransport(args, options = {}) {
     };
     return {
         async startRun(input, handlers) {
-            let latestIndex = input.history.length - 1;
-            while (latestIndex >= 0 && input.history[latestIndex]?.role !== 'user')
-                latestIndex -= 1;
+            const latestIndex = latestUserIndex(input.history);
             const message = input.history[latestIndex]?.content;
             if (!message)
                 throw new Error(args.copy.noUserMessage);
-            const history = (args.maxHistoryMessages === 0 ? [] : input.history.slice(Math.max(0, latestIndex - args.maxHistoryMessages), latestIndex))
-                .filter(m => m.content.trim().length > 0)
-                .map(m => ({ role: m.role, content: m.content.slice(0, args.maxHistoryMessageChars) }));
+            const history = priorHistory({ history: input.history, latestIndex, maxMessages: args.maxHistoryMessages, maxChars: args.maxHistoryMessageChars });
             // Build before registering a run, so a synchronous host-builder failure leaks no state.
             const request = args.requestBuilder({ endpoint: args.endpoint, agentId: args.agentId, message, history, input });
             const runId = args.ids({});
@@ -87,84 +81,8 @@ export function createFetchSseTransport(args, options = {}) {
                 throw new Error('Run ID must be unique and nonempty');
             const controller = options.createAbortController?.({}) ?? new AbortController();
             activeRuns.set(runId, controller);
-            const collected = [];
-            let settled = false;
-            const signals = [input.signal, ...(input.cancelSignal ? [input.cancelSignal] : [])];
-            const finish = () => {
-                if (settled)
-                    return;
-                settled = true;
-                activeRuns.delete(runId);
-                for (const signal of signals)
-                    signal.removeEventListener('abort', abort);
-                controller.signal.removeEventListener('abort', onAborted);
-                observe(runId, 'settled');
-                handlers.onDone([...collected]);
-            };
-            const onAborted = () => { observe(runId, 'aborted'); finish(); };
-            const abort = () => controller.abort();
-            controller.signal.addEventListener('abort', onAborted, { once: true });
-            for (const signal of signals)
-                signal.addEventListener('abort', abort, { once: true });
-            observe(runId, 'started');
-            if (signals.some(signal => signal.aborted))
-                abort();
-            void (async () => {
-                try {
-                    if (settled)
-                        return;
-                    const response = await args.fetch(args.endpoint, { ...request, signal: controller.signal });
-                    if (settled) {
-                        try {
-                            await response.body?.cancel();
-                        }
-                        catch { /* closed body */ }
-                        return;
-                    }
-                    if (!response.ok) {
-                        const body = await response.json().catch(() => null);
-                        if (settled)
-                            return;
-                        const error = typeof body === 'object' && body !== null && 'error' in body && typeof body.error === 'string' && body.error
-                            ? body.error : args.copy.requestFailed({ status: response.status });
-                        observe(runId, 'error');
-                        handlers.onError(new Error(error));
-                        return;
-                    }
-                    if (!response.body)
-                        throw new Error(args.copy.missingBody);
-                    for await (const frame of args.decode({ source: responseChunks(response.body, controller.signal) })) {
-                        if (settled)
-                            break;
-                        const result = args.frameMapper({ frame });
-                        if (result.event) {
-                            collected.push(result.event);
-                            handlers.onEvent(result.event);
-                        }
-                        if (settled)
-                            break;
-                        if (result.error) {
-                            observe(runId, 'error');
-                            handlers.onError(result.error);
-                        }
-                        if (settled)
-                            break;
-                        if (result.done) {
-                            finish();
-                            break;
-                        }
-                    }
-                }
-                catch (error) {
-                    if (!settled && !controller.signal.aborted) {
-                        observe(runId, 'error');
-                        handlers.onError(error instanceof Error ? error : new Error(String(error)));
-                    }
-                }
-                finally {
-                    finish();
-                }
-            })();
+            const run = openRun({ controller, input, handlers }, { observe: phase => observe(runId, phase), release: () => activeRuns.delete(runId) });
+            void pumpRun({ run, args, request });
             return { runId };
         },
         async reattachRun(_runId, handlers) { handlers.onDone([]); },
@@ -172,4 +90,99 @@ export function createFetchSseTransport(args, options = {}) {
         async stopRun(runId) { activeRuns.get(runId)?.abort(); },
     };
 }
+function latestUserIndex(history) {
+    let index = history.length - 1;
+    while (index >= 0 && history[index]?.role !== 'user')
+        index -= 1;
+    return index;
+}
+/** Prior turns only (the latest user turn travels as `message`), non-empty, count- and char-bounded. */
+function priorHistory({ history, latestIndex, maxMessages, maxChars }) {
+    return (maxMessages === 0 ? [] : history.slice(Math.max(0, latestIndex - maxMessages), latestIndex))
+        .filter(m => m.content.trim().length > 0)
+        .map(m => ({ role: m.role, content: m.content.slice(0, maxChars) }));
+}
+/** Wires abort listeners and returns the settle-once handle; an already-aborted signal aborts at once. */
+function openRun({ controller, input, handlers }, { observe, release }) {
+    const collected = [];
+    let settled = false;
+    const signals = [input.signal, ...(input.cancelSignal ? [input.cancelSignal] : [])];
+    const finish = () => {
+        if (settled)
+            return;
+        settled = true;
+        release();
+        for (const signal of signals)
+            signal.removeEventListener('abort', abort);
+        controller.signal.removeEventListener('abort', onAborted);
+        observe('settled');
+        handlers.onDone([...collected]);
+    };
+    const onAborted = () => { observe('aborted'); finish(); };
+    const abort = () => controller.abort();
+    controller.signal.addEventListener('abort', onAborted, { once: true });
+    for (const signal of signals)
+        signal.addEventListener('abort', abort, { once: true });
+    observe('started');
+    if (signals.some(signal => signal.aborted))
+        abort();
+    const report = (error) => { observe('error'); handlers.onError(error); };
+    return { controller, handlers, collected, isSettled: () => settled, finish, report };
+}
+/** Performs the POST and streams frames; always settles the run exactly once when it returns. */
+async function pumpRun({ run, args, request }) {
+    try {
+        if (run.isSettled())
+            return;
+        const response = await args.fetch(args.endpoint, { ...request, signal: run.controller.signal });
+        await deliverResponse({ run, args, response });
+    }
+    catch (error) {
+        if (!run.isSettled() && !run.controller.signal.aborted)
+            run.report(error instanceof Error ? error : new Error(String(error)));
+    }
+    finally {
+        run.finish();
+    }
+}
+async function deliverResponse({ run, args, response }) {
+    if (run.isSettled()) {
+        try {
+            await response.body?.cancel();
+        }
+        catch { /* closed body */ }
+        return;
+    }
+    if (!response.ok)
+        return reportHttpFailure({ run, response, requestFailed: args.copy.requestFailed });
+    if (!response.body)
+        throw new Error(args.copy.missingBody);
+    for await (const frame of args.decode({ source: responseChunks(response.body, run.controller.signal) })) {
+        if (run.isSettled() || !dispatchFrame({ run, result: args.frameMapper({ frame }) }))
+            break;
+    }
+}
+async function reportHttpFailure({ run, response, requestFailed }) {
+    const body = await response.json().catch(() => null);
+    if (run.isSettled())
+        return;
+    const serverError = typeof body === 'object' && body !== null && 'error' in body ? nonEmptyString(body.error) : undefined;
+    run.report(new Error(serverError ?? requestFailed({ status: response.status })));
+}
+/** Delivers one mapped frame; returns false once the run is settled (by a handler or an end frame). */
+function dispatchFrame({ run, result }) {
+    if (result.event) {
+        run.collected.push(result.event);
+        run.handlers.onEvent(result.event);
+    }
+    if (run.isSettled())
+        return false;
+    if (result.error)
+        run.report(result.error);
+    if (run.isSettled() || result.done) {
+        run.finish();
+        return false;
+    }
+    return true;
+}
 //# sourceMappingURL=fetch-sse.js.map

package/dist/embed-widget/vanilla/index.js

@@ -95,7 +95,8 @@ export function mountVanillaChat(args, options = {}) {
     const suggestions = node('div', 'jini-chat-vanilla__suggestions');
     if (copy.suggestionsLabel)
         suggestions.setAttribute('aria-label', copy.suggestionsLabel);
-    const suggestionButtons = (args.suggestions ?? []).map(text => button(text));
+    const suggestionEntries = (args.suggestions ?? []).map(text => ({ text, button: button(text) }));
+    const suggestionButtons = suggestionEntries.map(entry => entry.button);
     suggestions.append(...suggestionButtons);
     log.append(greeting, suggestions);
     panel.append(header, confirmation, log, status, announcements, error, proposal, form);
@@ -123,6 +124,39 @@ export function mountVanillaChat(args, options = {}) {
         proposal.hidden = state.proposal === null;
         proposalText.textContent = state.proposal ? copy.proposalLabel({ title: state.proposal.navigate.target.title }) : '';
     };
+    const createRow = ({ message }) => {
+        const row = { element: node('div', `jini-chat-vanilla__message jini-chat-vanilla__message--${message.role}`), content: '\0' };
+        rows.set(message.id, row);
+        log.append(row.element);
+        return row;
+    };
+    const renderRow = ({ message }) => {
+        const row = rows.get(message.id) ?? createRow({ message });
+        if (row.content === message.content)
+            return;
+        if (message.role === 'user')
+            row.element.textContent = message.content;
+        else
+            args.renderMarkdown({ content: message.content, element: row.element });
+        row.content = message.content;
+    };
+    const announce = ({ text }) => {
+        if (!text)
+            return;
+        announcements.append(node('span', '', text));
+        // Bound the additions-only live region without replaying earlier replies.
+        while (announcements.childElementCount > 2)
+            announcements.firstElementChild.remove();
+    };
+    const announceSettledReplies = ({ messages }) => {
+        // A dedicated additions-only region announces each LIVE settled reply once. Markdown rows
+        // may be rebuilt while streaming, but restored transcripts and old text stay silent.
+        for (const message of messages) {
+            if (message.role !== 'assistant' || message.runStatus === 'running' || !liveReplies.delete(message.id))
+                continue;
+            announce({ text: rows.get(message.id)?.element.textContent });
+        }
+    };
     const renderRows = ({ state }) => {
         const pinned = log.scrollHeight - log.scrollTop - log.clientHeight < 80;
         const ids = new Set(state.messages.map(message => message.id));
@@ -131,53 +165,33 @@ export function mountVanillaChat(args, options = {}) {
                 row.element.remove();
                 rows.delete(id);
             }
-        for (const message of state.messages) {
-            let row = rows.get(message.id);
-            if (!row) {
-                row = { element: node('div', `jini-chat-vanilla__message jini-chat-vanilla__message--${message.role}`), content: '\0' };
-                rows.set(message.id, row);
-                log.append(row.element);
-            }
-            if (row.content !== message.content) {
-                if (message.role === 'user')
-                    row.element.textContent = message.content;
-                else
-                    args.renderMarkdown({ content: message.content, element: row.element });
-                row.content = message.content;
-            }
-        }
-        // A dedicated additions-only region announces each LIVE settled reply once. Markdown rows
-        // may be rebuilt while streaming, but restored transcripts and old text stay silent.
-        for (const message of state.messages) {
-            if (message.role !== 'assistant' || message.runStatus === 'running' || !liveReplies.delete(message.id))
-                continue;
-            const text = rows.get(message.id)?.element.textContent;
-            if (text) {
-                announcements.append(node('span', '', text));
-                // Bound the additions-only live region without replaying earlier replies.
-                while (announcements.childElementCount > 2)
-                    announcements.firstElementChild.remove();
-            }
-        }
+        for (const message of state.messages)
+            renderRow({ message });
+        announceSettledReplies({ messages: state.messages });
         if (state.messages.length === 0)
             announcements.replaceChildren();
         if (pinned)
             log.scrollTop = log.scrollHeight;
     };
-    const renderFocus = ({ state, composerHadFocus, stopHadFocus, panelHadFocus }) => {
-        if (state.open && !wasOpen && initialized) {
-            if (state.busy)
-                close.focus();
-            else
-                input.focus();
-        }
-        else if (state.open && state.busy && composerHadFocus)
+    const focusEntry = ({ busy }) => { if (busy)
+        close.focus();
+    else
+        input.focus(); };
+    const moveFocus = ({ state, composerHadFocus, stopHadFocus }) => {
+        if (!state.open)
+            return;
+        if (!wasOpen && initialized)
+            focusEntry({ busy: state.busy });
+        else if (state.busy && composerHadFocus)
             stop.focus();
-        else if (state.open && !state.busy && stopHadFocus)
+        else if (!state.busy && stopHadFocus)
             input.focus();
+    };
+    const renderFocus = ({ state, composerHadFocus, stopHadFocus, panelHadFocus }) => {
+        moveFocus({ state, composerHadFocus, stopHadFocus });
+        // renderChrome (which always runs first) already ended modal semantics for a closed panel.
         if (!state.open && wasOpen) {
             confirmation.hidden = true;
-            panel.setAttribute('aria-modal', 'false');
             if (panelHadFocus)
                 fab.focus();
         }
@@ -216,8 +230,8 @@ export function mountVanillaChat(args, options = {}) {
         target.addEventListener(type, handler);
         listeners.push(() => target.removeEventListener(type, handler));
     };
-    suggestionButtons.forEach(button => listen(button, 'click', () => {
-        input.value = button.textContent ?? '';
+    suggestionEntries.forEach(({ text, button }) => listen(button, 'click', () => {
+        input.value = text;
         renderChrome({ state: controller.getState({}) });
         input.focus();
     }));
@@ -234,7 +248,8 @@ export function mountVanillaChat(args, options = {}) {
         confirmation.hidden = false;
         keep.focus();
     });
-    listen(keep, 'click', () => { confirmation.hidden = true; reset.focus(); });
+    const dismissConfirmation = () => { confirmation.hidden = true; reset.focus(); };
+    listen(keep, 'click', dismissConfirmation);
     listen(confirm, 'click', () => { confirmation.hidden = true; input.value = ''; controller.reset({}); input.focus(); });
     listen(go, 'click', () => controller.acceptProposal({}));
     listen(stop, 'click', () => controller.cancel({}));
@@ -257,41 +272,37 @@ export function mountVanillaChat(args, options = {}) {
             form.requestSubmit();
         }
     });
-    listen(document, 'keydown', event => {
-        if (!controller.getState({}).open || !panel.contains(document.activeElement))
-            return;
-        const key = event;
-        if (key.key === 'Escape') {
-            key.preventDefault();
-            if (!confirmation.hidden) {
-                confirmation.hidden = true;
-                reset.focus();
-            }
-            else
-                controller.setOpen({ open: false });
-            return;
-        }
-        if (key.key !== 'Tab')
-            return;
+    const onEscape = ({ key }) => {
+        key.preventDefault();
+        if (!confirmation.hidden)
+            dismissConfirmation();
+        else
+            controller.setOpen({ open: false });
+    };
+    // Only reached while focus is inside the panel (see the document keydown guard), so wrapping
+    // happens exactly at the first/last visible enabled control.
+    const trapTab = ({ key }) => {
         const focusable = Array.from(panel.querySelectorAll('button:not(:disabled), textarea:not(:disabled), a[href], [tabindex="0"]'))
             .filter(candidate => !candidate.closest('[hidden]'));
         const first = focusable[0];
         const last = focusable.at(-1);
-        if (key.shiftKey && (document.activeElement === first || !panel.contains(document.activeElement))) {
-            key.preventDefault();
-            last?.focus();
-        }
-        else if (!key.shiftKey && (document.activeElement === last || !panel.contains(document.activeElement))) {
-            key.preventDefault();
-            first?.focus();
-        }
+        if (document.activeElement !== (key.shiftKey ? first : last))
+            return;
+        key.preventDefault();
+        (key.shiftKey ? last : first)?.focus();
+    };
+    listen(document, 'keydown', event => {
+        if (!controller.getState({}).open || !panel.contains(document.activeElement))
+            return;
+        const key = event;
+        if (key.key === 'Escape')
+            onEscape({ key });
+        else if (key.key === 'Tab')
+            trapTab({ key });
     });
     listen(element, 'jini-chat-open', () => {
         controller.setOpen({ open: true });
-        if (controller.getState({}).busy)
-            close.focus();
-        else
-            input.focus();
+        focusEntry({ busy: controller.getState({}).busy });
     });
     const queued = { value: args.session.drain({}) };
     let cancelFrame = () => { };

package/dist/react/agent-bridge/frontend-session-bridge.js

@@ -44,14 +44,65 @@ function claimedCapabilities(options) {
     if (options.pageDriver !== undefined) {
         claims.push(...PAGE_CAPABILITIES.map((capability) => capability.id));
     }
-    for (const [prefix, _executor] of Object.entries(options.executors ?? {})) {
-        claims.push(prefix);
-    }
+    claims.push(...Object.keys(options.executors ?? {}));
     return claims;
 }
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/** Parses a frame's data into an object, or says why it is not one. */
+function parseFrameObject(data) {
+    let parsed;
+    try {
+        parsed = JSON.parse(data);
+    }
+    catch (error) {
+        return { error };
+    }
+    // `JSON.parse` succeeds on any valid JSON value, not just objects — a bare `null`, number,
+    // string or boolean parses cleanly and would throw *outside* this try/catch on the very next
+    // `frame['type']` read (`null` is the one of those that actually throws; the others just read
+    // back `undefined` harmlessly). Guarding here routes every one of those through the same
+    // `onError` path as an unparseable frame, rather than only some of them crashing the listener.
+    if (parsed === null || typeof parsed !== 'object') {
+        return { error: new Error(`malformed frame: expected a JSON object, got ${JSON.stringify(parsed)}`) };
+    }
+    return { frame: parsed };
+}
+/** Reads an `invocation` frame into the pane's action shape, refusing one with no usable id. */
+function readInvocation(frame) {
+    const rawInvocationId = frame['invocationId'];
+    if (typeof rawInvocationId !== 'string' || rawInvocationId.length === 0) {
+        return { kind: 'malformed', error: new Error('invocation frame missing invocationId') };
+    }
+    return {
+        kind: 'invocation',
+        action: {
+            invocationId: rawInvocationId,
+            capabilityId: String(frame['capabilityId']),
+            input: (frame['input'] ?? {}),
+        },
+    };
+}
+/** Classifies one frame's raw data; the listener only applies the result. */
+function readFrame(data) {
+    const parsed = parseFrameObject(data);
+    if ('error' in parsed)
+        return { kind: 'malformed', error: parsed.error };
+    const { frame } = parsed;
+    switch (frame['type']) {
+        case 'attached':
+            return { kind: 'attached', sessionId: String(frame['sessionId']), bindToken: String(frame['bindToken']) };
+        case 'error':
+            return { kind: 'refused', message: String(frame['message']) };
+        case 'invocation':
+            return readInvocation(frame);
+        default:
+            // Unknown frame types are ignored rather than treated as errors, so the daemon's event
+            // vocabulary can grow without every deployed surface needing to ship first.
+            return { kind: 'ignored' };
+    }
+}
 /**
  * Opens the surface's connection and starts routing invocations.
  *
@@ -60,11 +111,8 @@ function errorMessage(error) {
  */
 export function createFrontendSessionBridge({ baseUrl: base, openStream, request, fetch }, options = {}) {
     const capabilities = claimedCapabilities(options);
-    const send = request ?? (({ url, init, timeoutMs }) => {
-        const timeout = AbortSignal.timeout(timeoutMs);
-        const signal = init.signal ? AbortSignal.any([init.signal, timeout]) : timeout;
-        return (fetch ?? globalThis.fetch)(url, { ...init, signal });
-    });
+    // The only caller (`respond`) never passes its own signal, so the deadline is the whole signal.
+    const send = request ?? (({ url, init, timeoutMs }) => (fetch ?? globalThis.fetch)(url, { ...init, signal: AbortSignal.timeout(timeoutMs) }));
     let sessionId;
     /** Replaced on every reattach; a promise resolved once could never carry this. */
     let currentBindToken;
@@ -125,50 +173,8 @@ export function createFrontendSessionBridge({ baseUrl: base, openStream, request
                 executed.delete(oldest);
         }
     }
-    source.addEventListener('message', (event) => {
-        let parsed;
-        try {
-            parsed = JSON.parse(event.data);
-        }
-        catch (error) {
-            options.onError?.(error);
-            return;
-        }
-        // `JSON.parse` succeeds on any valid JSON value, not just objects — a bare `null`, number,
-        // string or boolean parses cleanly and would throw *outside* this try/catch on the very next
-        // `frame['type']` read (`null` is the one of those that actually throws; the others just read
-        // back `undefined` harmlessly). Guarding here routes every one of those through the same
-        // `onError` path as an unparseable frame, rather than only some of them crashing the listener.
-        if (parsed === null || typeof parsed !== 'object') {
-            options.onError?.(new Error(`malformed frame: expected a JSON object, got ${JSON.stringify(parsed)}`));
-            return;
-        }
-        const frame = parsed;
-        if (frame['type'] === 'attached') {
-            sessionId = String(frame['sessionId']);
-            currentBindToken = String(frame['bindToken']);
-            // A no-op after the first attach — which is exactly why `currentBindToken` exists.
-            resolveReady({ sessionId, bindToken: currentBindToken });
-            return;
-        }
-        if (frame['type'] === 'error') {
-            rejectReady(new Error(String(frame['message'])));
-            return;
-        }
-        // Unknown frame types are ignored rather than treated as errors, so the daemon's event
-        // vocabulary can grow without every deployed surface needing to ship first.
-        if (frame['type'] !== 'invocation')
-            return;
-        const rawInvocationId = frame['invocationId'];
-        if (typeof rawInvocationId !== 'string' || rawInvocationId.length === 0) {
-            options.onError?.(new Error('invocation frame missing invocationId'));
-            return;
-        }
-        const action = {
-            invocationId: rawInvocationId,
-            capabilityId: String(frame['capabilityId']),
-            input: (frame['input'] ?? {}),
-        };
+    /** Runs one well-formed invocation: replay check, announcement, then pane or local serving. */
+    function handleInvocation(action) {
         // A redelivery after a dropped answer must not re-run the side effect.
         if (executed.has(action.invocationId)) {
             void respondError(action.invocationId, 'already executed on this surface').catch(() => undefined);
@@ -182,6 +188,28 @@ export function createFrontendSessionBridge({ baseUrl: base, openStream, request
             return;
         }
         void serveLocally(action);
+    }
+    source.addEventListener('message', (event) => {
+        const frame = readFrame(event.data);
+        switch (frame.kind) {
+            case 'attached':
+                sessionId = frame.sessionId;
+                currentBindToken = frame.bindToken;
+                // A no-op after the first attach — which is exactly why `currentBindToken` exists.
+                resolveReady({ sessionId, bindToken: currentBindToken });
+                return;
+            case 'refused':
+                rejectReady(new Error(frame.message));
+                return;
+            case 'malformed':
+                options.onError?.(frame.error);
+                return;
+            case 'invocation':
+                handleInvocation(frame.action);
+                return;
+            case 'ignored':
+                return;
+        }
     });
     source.addEventListener('error', (event) => {
         // The daemon deletes a session's bind token the instant that connection drops, so by the time