@jini-ai/ui 0.1.1 → 0.3.0

package/dist/features/interactive-ui/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/features/interactive-ui/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;;;;;;;GAQG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B"}

package/dist/features/interactive-ui/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/features/interactive-ui/types.ts"],"names":[],"mappings":""}

package/dist/features/language/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/features/language/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAChE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/features/language/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/features/language/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/features/language/react/components/LanguageTab.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LanguageTab.d.ts","sourceRoot":"","sources":["../../../../../src/features/language/react/components/LanguageTab.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,gBAAgB,+BA6BnG"}

package/dist/features/language/react/components/LanguageTab.js

@@ -0,0 +1,18 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useT } from '../../../i18n/index.js';
+import { Icon } from '../../../../react/components/Icon.js';
+/**
+ * Locale radio-tile grid. Origin: the inline `language` tab body in
+ * `SettingsDialog.tsx` — GENERIC, no product coupling beyond the (already
+ * dropped) analytics tracking call and OD's own fixed locale list (now a
+ * host-supplied `locales` prop).
+ */
+export function LanguageTab({ locales, selectedLocale, onSelectLocale, ariaLabel }) {
+    const t = useT();
+    const resolvedAriaLabel = ariaLabel ?? t('Language');
+    return (_jsx("section", { className: "jini-settings-section jini-settings-language", children: _jsx("div", { className: "jini-settings-language-grid", role: "radiogroup", "aria-label": resolvedAriaLabel, children: locales.map(({ code, label }) => {
+                const active = selectedLocale === code;
+                return (_jsxs("button", { type: "button", role: "radio", "aria-checked": active, className: `jini-settings-language-tile${active ? ' active' : ''}`, onClick: () => onSelectLocale(code), children: [_jsxs("span", { className: "jini-settings-language-tile-text", children: [_jsx("span", { className: "jini-settings-language-tile-title", children: label }), _jsx("span", { className: "jini-settings-language-tile-code", children: code })] }), active ? _jsx(Icon, { name: "check", size: 16 }) : null] }, code));
+            }) }) }));
+}
+//# sourceMappingURL=LanguageTab.js.map

package/dist/features/language/react/components/LanguageTab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LanguageTab.js","sourceRoot":"","sources":["../../../../../src/features/language/react/components/LanguageTab.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,sCAAsC,CAAC;AAU5D;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,EAAoB;IAClG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACjB,MAAM,iBAAiB,GAAG,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;IAErD,OAAO,CACL,kBAAS,SAAS,EAAC,8CAA8C,YAC/D,cAAK,SAAS,EAAC,6BAA6B,EAAC,IAAI,EAAC,YAAY,gBAAa,iBAAiB,YACzF,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC/B,MAAM,MAAM,GAAG,cAAc,KAAK,IAAI,CAAC;gBACvC,OAAO,CACL,kBAEE,IAAI,EAAC,QAAQ,EACb,IAAI,EAAC,OAAO,kBACE,MAAM,EACpB,SAAS,EAAE,8BAA8B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAClE,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,aAEnC,gBAAM,SAAS,EAAC,kCAAkC,aAChD,eAAM,SAAS,EAAC,mCAAmC,YAAE,KAAK,GAAQ,EAClE,eAAM,SAAS,EAAC,kCAAkC,YAAE,IAAI,GAAQ,IAC3D,EACN,MAAM,CAAC,CAAC,CAAC,KAAC,IAAI,IAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAE,EAAE,GAAI,CAAC,CAAC,CAAC,IAAI,KAX3C,IAAI,CAYF,CACV,CAAC;YACJ,CAAC,CAAC,GACE,GACE,CACX,CAAC;AACJ,CAAC"}

package/dist/features/language/types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Origin: the inline `language` tab body in `SettingsDialog.tsx` (a
+ * radio-tile grid over a fixed locale list), GENERIC per
+ * `ADS-memory/reports/jini-port/recon/r6-god-component-internals.md` §1.3. OD's own fixed
+ * 19-locale `LOCALES`/`LOCALE_LABEL` tables are product content, not ported
+ * — a host supplies its own `LocaleOption[]`, same convention
+ * `@jini-ai/ui`'s `features/i18n` already established for
+ * `I18nProvider`'s `dictionaries` prop.
+ *
+ * Reuses the `LocaleOption` shape already shipped for `LanguageMenu`
+ * (`{ code, label }`) rather than declaring a near-duplicate — the two
+ * components pick from the same kind of host-supplied locale list.
+ */
+/** One selectable locale. Defined here rather than beside the menu component
+ *  that renders it: it is plain data, and both the settings tab and
+ *  `@jini-ai/ui`'s `LanguageMenu` need the same shape. */
+export interface LocaleOption {
+    code: string;
+    label: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/features/language/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/features/language/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH;;0DAE0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf"}

package/dist/features/language/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/features/language/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/features/language/types.ts"],"names":[],"mappings":""}

package/dist/features/list-detail-panel/types.d.ts

@@ -9,7 +9,7 @@
  * instance of this shape — see `packages/ui/source-map.md` for why
  * `PluginsView.tsx`'s detail modal and `ProjectView.tsx`'s composition were
  * verified NOT to share it despite the surface-level "conceptually related"
- * flag in `foundry/docs/jini-port/recon/r6-god-component-internals.md`).
+ * flag in `ADS-memory/reports/jini-port/recon/r6-god-component-internals.md`).
  */
 /** The minimum shape a summary item must carry: a stable identity. */
 export interface ListDetailItem {

package/dist/features/list-detail-panel/types.js

@@ -9,7 +9,7 @@
  * instance of this shape — see `packages/ui/source-map.md` for why
  * `PluginsView.tsx`'s detail modal and `ProjectView.tsx`'s composition were
  * verified NOT to share it despite the surface-level "conceptually related"
- * flag in `foundry/docs/jini-port/recon/r6-god-component-internals.md`).
+ * flag in `ADS-memory/reports/jini-port/recon/r6-god-component-internals.md`).
  */
 export {};
 //# sourceMappingURL=types.js.map

package/dist/features/mcp-ui/confirmation-store.d.ts

@@ -0,0 +1,110 @@
+/**
+ * @module features/mcp-ui/confirmation-store
+ *
+ * A short-lived, single-use, binding-checked token store — the server half of the MCP-UI two-step
+ * confirmation pattern. Generalized from the reference implementation's `pending-confirmations.ts`,
+ * which was already domain-agnostic in intent but hardcoded one binding shape (tool/workspace/principal/
+ * entity/entityVersion); here the binding is whatever record the caller mints with.
+ *
+ * ## Why a token rather than a boolean "requires confirmation" flag
+ *
+ * A flag makes the *agent* the thing that confirms. This makes the *human* the thing that confirms,
+ * because of where the secret lives: a destructive tool's first call mints a token, embeds it only
+ * inside the UI resource's HTML, and returns without acting. Per MCP Apps' security model a host
+ * renders that HTML for the user and does not feed it to the model — so the model sees "a dialog is
+ * open", the rendered dialog holds the only copy of the token, and the second call is unreachable
+ * without a human clicking. If the token ever appears in the tool result's text block, in `_meta`,
+ * or in an error message, the whole arrangement collapses into theater; keeping it out of those
+ * places is the caller's obligation, and one this module cannot enforce for it.
+ *
+ * ## Deliberate divergence from the reference implementation's version: no hashing at rest, by default
+ *
+ * The reference implementation stores `sha256(token)` so a heap dump yields nothing redeemable. That is defense in depth on
+ * top of the real properties (random, single-use, TTL-bounded, binding-checked), and it costs a
+ * `node:crypto` import — which this package, a browser-runtime package, cannot take. The two
+ * isomorphic alternatives are both worse than the trade made here: `crypto.subtle.digest` is async
+ * (it would make `mint`/`redeem` return promises for a defense-in-depth property) *and* absent
+ * outside secure contexts, and a non-cryptographic hash would add collisions while implying a
+ * strength it does not have. So the default keys entries by the raw token, and {@link
+ * ConfirmationStoreDeps.digestToken} is the one-line seam a Node consumer uses to restore hashing:
+ * `digestToken: (token) => createHash('sha256').update(token, 'utf8').digest('hex')`.
+ */
+/** Default lifetime: long enough for a human to read a dialog, short enough that an abandoned one cannot be redeemed later out of scrollback. */
+export declare const DEFAULT_CONFIRMATION_TTL_MS: number;
+/**
+ * What a token is bound to. Every entry is compared on redemption, and any difference — a changed
+ * value, a missing key, an extra key — is a rejection rather than a warning.
+ *
+ * Values are `string | number` rather than `unknown` on purpose: a binding is an identity claim, and
+ * comparing arbitrary values would need a deep-equality contract this module has no business
+ * defining. A caller with structured binding data should serialize it into a string itself, so it
+ * owns the serialization rather than inheriting a surprising one.
+ */
+export type ConfirmationBinding = Readonly<Record<string, string | number>>;
+/** A minted, not-yet-redeemed confirmation. */
+export interface PendingConfirmation {
+    readonly binding: ConfirmationBinding;
+    /** Human-readable description of what was agreed to, echoed back on redemption for the audit trail. */
+    readonly summary: string;
+    readonly expiresAtMs: number;
+}
+/**
+ * Why a redemption failed.
+ *
+ * Deliberately coarse. "No such token" and "expired token" share one reason because distinguishing
+ * them tells a caller holding a guessed token that it was once real. There is no `already-used`
+ * reason for the same kind of reason: a redeemed token is deleted, so a replay is indistinguishable
+ * from a guess, which is the intended behavior rather than a missing case.
+ */
+export type ConfirmationRejectionReason = 'unknown-or-expired' | 'binding-mismatch';
+export type RedeemResult = {
+    readonly ok: true;
+    readonly confirmation: PendingConfirmation;
+} | {
+    readonly ok: false;
+    readonly reason: ConfirmationRejectionReason;
+};
+export interface ConfirmationStore {
+    /**
+     * Mints a token for one pending action.
+     *
+     * @returns The RAW token and its expiry. The token's only safe destination is inside the UI
+     * resource's HTML — see this module's header.
+     */
+    mint(spec: {
+        binding: ConfirmationBinding;
+        summary: string;
+    }): {
+        readonly token: string;
+        readonly expiresAtMs: number;
+    };
+    /** Redeems a token exactly once, against the binding the caller expects it to carry. */
+    redeem(spec: {
+        token: string;
+        binding: ConfirmationBinding;
+    }): RedeemResult;
+    /** Pending, unexpired count — for tests and diagnostics only. */
+    size(): number;
+}
+export interface ConfirmationStoreDeps {
+    /** Millisecond clock, injected so TTL expiry is testable without waiting. */
+    now?: () => number;
+    /** Token source, injected so a test can assert a known value. Defaults to 256 bits of `crypto.getRandomValues`, never `Math.random`. */
+    randomToken?: () => string;
+    /** Lifetime of a minted token. Defaults to {@link DEFAULT_CONFIRMATION_TTL_MS}. */
+    ttlMs?: number;
+    /** Maps a raw token to the key it is stored under. Defaults to identity — see this module's header for why, and what to pass to get hashing at rest. */
+    digestToken?: (token: string) => string;
+}
+/**
+ * Creates an in-process confirmation store.
+ *
+ * In-process is correct rather than a shortcut: a confirmation that does not survive a process
+ * restart is a confirmation the human is simply asked for again — the fail-closed direction —
+ * whereas persisting them would build a durable store of pre-authorized destructive actions.
+ *
+ * @param deps - See {@link ConfirmationStoreDeps}.
+ * @complexity O(1) amortized per operation; expired entries are swept lazily on `mint`/`size`.
+ */
+export declare function createConfirmationStore(deps?: ConfirmationStoreDeps): ConfirmationStore;
+//# sourceMappingURL=confirmation-store.d.ts.map

package/dist/features/mcp-ui/confirmation-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmation-store.d.ts","sourceRoot":"","sources":["../../../src/features/mcp-ui/confirmation-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iJAAiJ;AACjJ,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAKzD;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC;AAE5E,+CAA+C;AAC/C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,uGAAuG;IACvG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,2BAA2B,GAAG,oBAAoB,GAAG,kBAAkB,CAAC;AAEpF,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;CAAE,GACjE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,wFAAwF;IACxF,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,mBAAmB,CAAA;KAAE,GAAG,YAAY,CAAC;IAC5E,iEAAiE;IACjE,IAAI,IAAI,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wIAAwI;IACxI,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wJAAwJ;IACxJ,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC;AA0DD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,GAAE,qBAA0B,GAAG,iBAAiB,CAgD3F"}

package/dist/features/mcp-ui/confirmation-store.js

@@ -0,0 +1,149 @@
+/**
+ * @module features/mcp-ui/confirmation-store
+ *
+ * A short-lived, single-use, binding-checked token store — the server half of the MCP-UI two-step
+ * confirmation pattern. Generalized from the reference implementation's `pending-confirmations.ts`,
+ * which was already domain-agnostic in intent but hardcoded one binding shape (tool/workspace/principal/
+ * entity/entityVersion); here the binding is whatever record the caller mints with.
+ *
+ * ## Why a token rather than a boolean "requires confirmation" flag
+ *
+ * A flag makes the *agent* the thing that confirms. This makes the *human* the thing that confirms,
+ * because of where the secret lives: a destructive tool's first call mints a token, embeds it only
+ * inside the UI resource's HTML, and returns without acting. Per MCP Apps' security model a host
+ * renders that HTML for the user and does not feed it to the model — so the model sees "a dialog is
+ * open", the rendered dialog holds the only copy of the token, and the second call is unreachable
+ * without a human clicking. If the token ever appears in the tool result's text block, in `_meta`,
+ * or in an error message, the whole arrangement collapses into theater; keeping it out of those
+ * places is the caller's obligation, and one this module cannot enforce for it.
+ *
+ * ## Deliberate divergence from the reference implementation's version: no hashing at rest, by default
+ *
+ * The reference implementation stores `sha256(token)` so a heap dump yields nothing redeemable. That is defense in depth on
+ * top of the real properties (random, single-use, TTL-bounded, binding-checked), and it costs a
+ * `node:crypto` import — which this package, a browser-runtime package, cannot take. The two
+ * isomorphic alternatives are both worse than the trade made here: `crypto.subtle.digest` is async
+ * (it would make `mint`/`redeem` return promises for a defense-in-depth property) *and* absent
+ * outside secure contexts, and a non-cryptographic hash would add collisions while implying a
+ * strength it does not have. So the default keys entries by the raw token, and {@link
+ * ConfirmationStoreDeps.digestToken} is the one-line seam a Node consumer uses to restore hashing:
+ * `digestToken: (token) => createHash('sha256').update(token, 'utf8').digest('hex')`.
+ */
+/** Default lifetime: long enough for a human to read a dialog, short enough that an abandoned one cannot be redeemed later out of scrollback. */
+export const DEFAULT_CONFIRMATION_TTL_MS = 5 * 60 * 1000;
+/** 256 bits — the same sizing as a session token, since a guessable confirmation token is a bypass. */
+const TOKEN_BYTES = 32;
+/**
+ * Compares two strings without leaking their contents through timing.
+ *
+ * Length is compared first and therefore does leak, exactly as `node:crypto`'s own
+ * `timingSafeEqual` leaks it (by throwing on a length mismatch). That is acceptable here: binding
+ * values are ids the caller already knows the shape of, and the secret — the token — is not
+ * compared with this at all, it is a map key.
+ */
+function constantTimeEquals(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < a.length; index += 1) {
+        difference |= a.charCodeAt(index) ^ b.charCodeAt(index);
+    }
+    return difference === 0;
+}
+function bindingsMatch(minted, presented) {
+    const mintedKeys = Object.keys(minted);
+    if (mintedKeys.length !== Object.keys(presented).length)
+        return false;
+    let matched = true;
+    for (const key of mintedKeys) {
+        if (!Object.prototype.hasOwnProperty.call(presented, key)) {
+            matched = false;
+            continue;
+        }
+        const left = minted[key];
+        const right = presented[key];
+        // Compared as strings so a `1` presented where `1` was minted still matches, while `'1'` vs `1`
+        // does not — the type check below is what keeps those apart, and it is exact on purpose: a
+        // binding that silently coerces is a binding that can be satisfied by a value the minter never
+        // agreed to.
+        if (typeof left !== typeof right) {
+            matched = false;
+            continue;
+        }
+        if (!constantTimeEquals(String(left), String(right)))
+            matched = false;
+    }
+    return matched;
+}
+function defaultRandomToken() {
+    const source = globalThis.crypto;
+    if (typeof source?.getRandomValues !== 'function') {
+        // No `Math.random` fallback. A predictable confirmation token is a confirmation bypass, and a
+        // store that silently degrades to one is worse than a store that refuses to start — every
+        // browser and every supported Node exposes `getRandomValues` (it needs no secure context,
+        // unlike `crypto.subtle`), so reaching this means something is deeply wrong with the host.
+        throw new Error('createConfirmationStore requires crypto.getRandomValues; pass deps.randomToken to override.');
+    }
+    const bytes = source.getRandomValues(new Uint8Array(TOKEN_BYTES));
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Creates an in-process confirmation store.
+ *
+ * In-process is correct rather than a shortcut: a confirmation that does not survive a process
+ * restart is a confirmation the human is simply asked for again — the fail-closed direction —
+ * whereas persisting them would build a durable store of pre-authorized destructive actions.
+ *
+ * @param deps - See {@link ConfirmationStoreDeps}.
+ * @complexity O(1) amortized per operation; expired entries are swept lazily on `mint`/`size`.
+ */
+export function createConfirmationStore(deps = {}) {
+    const now = deps.now ?? (() => Date.now());
+    const randomToken = deps.randomToken ?? defaultRandomToken;
+    const ttlMs = deps.ttlMs ?? DEFAULT_CONFIRMATION_TTL_MS;
+    const digestToken = deps.digestToken ?? ((token) => token);
+    const pending = new Map();
+    function sweep(nowMs) {
+        for (const [key, entry] of pending) {
+            if (entry.expiresAtMs <= nowMs)
+                pending.delete(key);
+        }
+    }
+    return {
+        mint(spec) {
+            const nowMs = now();
+            sweep(nowMs);
+            const token = randomToken();
+            const expiresAtMs = nowMs + ttlMs;
+            pending.set(digestToken(token), {
+                binding: { ...spec.binding },
+                summary: spec.summary,
+                expiresAtMs,
+            });
+            return { token, expiresAtMs };
+        },
+        redeem(spec) {
+            const nowMs = now();
+            const key = digestToken(spec.token);
+            const entry = pending.get(key);
+            if (!entry)
+                return { ok: false, reason: 'unknown-or-expired' };
+            // Deleted before any binding check, so a held token cannot be probed repeatedly against
+            // different bindings to learn what it was minted for.
+            pending.delete(key);
+            if (entry.expiresAtMs <= nowMs)
+                return { ok: false, reason: 'unknown-or-expired' };
+            if (!bindingsMatch(entry.binding, spec.binding))
+                return { ok: false, reason: 'binding-mismatch' };
+            return { ok: true, confirmation: entry };
+        },
+        size() {
+            sweep(now());
+            return pending.size;
+        },
+    };
+}
+//# sourceMappingURL=confirmation-store.js.map

package/dist/features/mcp-ui/confirmation-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmation-store.js","sourceRoot":"","sources":["../../../src/features/mcp-ui/confirmation-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,iJAAiJ;AACjJ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,uGAAuG;AACvG,MAAM,WAAW,GAAG,EAAE,CAAC;AA+DvB;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACjD,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,MAA2B,EAAE,SAA8B;IAChF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,gGAAgG;QAChG,2FAA2F;QAC3F,+FAA+F;QAC/F,aAAa;QACb,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,EAAE,CAAC;YACjC,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,GAAG,KAAK,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,IAAI,OAAO,MAAM,EAAE,eAAe,KAAK,UAAU,EAAE,CAAC;QAClD,8FAA8F;QAC9F,0FAA0F;QAC1F,0FAA0F;QAC1F,2FAA2F;QAC3F,MAAM,IAAI,KAAK,CAAC,6FAA6F,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA8B,EAAE;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAEnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEvD,SAAS,KAAK,CAAC,KAAa;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI;YACP,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;YACpB,KAAK,CAAC,KAAK,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;gBAC9B,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW;aACZ,CAAC,CAAC;YACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,CAAC,IAAI;YACT,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAE/D,wFAAwF;YACxF,sDAAsD;YACtD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEpB,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YACnF,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YAClG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QAED,IAAI;YACF,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/features/mcp-ui/early-message-buffer.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @module features/mcp-ui/early-message-buffer
+ *
+ * A framework-free fix for the exact race `@jini-ai/agentic`'s `mcp-ui-apps.ts` names as its reason
+ * for existing: a View can post `ui/initialize` before the Host component has mounted and attached
+ * its `window.addEventListener('message', …)`.
+ *
+ * `postMessage` does not queue for a listener that does not exist yet — posted with nobody
+ * listening, a message is gone. The only way a Host survives this is to start listening before the
+ * View could possibly have sent anything, and to buffer whatever arrives until a (possibly much
+ * later, React-effect-timed) subscriber drains it. A `useEffect`-only listener loses anything posted
+ * between mount-commit and effect-run, which a lazy import, a Suspense boundary, or an expensive
+ * first render makes a real window rather than a theoretical one.
+ *
+ * Lives in `features/` — not next to the Host it serves — because it is plain TypeScript with no
+ * DOM types and no React, so it is testable in a plain Node environment. The module-scope
+ * `window.addEventListener` that feeds it belongs to the React half; see
+ * `../../react/mcp-ui/host-message-source.ts`.
+ *
+ * Ported from `examples/reference-web/src/mcpui-lab-message-buffer.ts` unchanged in behavior.
+ */
+/**
+ * A raw `MessageEvent`, narrowed to the fields this module needs. `source` stays `unknown` (rather
+ * than the DOM `MessageEventSource`) so this module carries no DOM lib dependency; the caller
+ * compares it by identity against a live iframe's `contentWindow` and it is never inspected here.
+ */
+export interface BufferedWindowMessage {
+    readonly data: unknown;
+    readonly origin: string;
+    readonly source: unknown;
+}
+export interface EarlyMessageBuffer {
+    /** Delivers to every live subscriber if at least one exists; otherwise appends to the backlog. */
+    push(message: BufferedWindowMessage): void;
+    /**
+     * Installs a live subscriber, immediately draining anything already buffered to it in arrival
+     * order.
+     *
+     * Any number of subscribers may be live at once — a chat transcript can hold several Views, and
+     * each needs every message rather than only those posted while it happened to be the most recent
+     * subscriber. Each subscriber is responsible for filtering to messages sourced from its own
+     * iframe. The returned disposer removes only this handler's own registration.
+     */
+    subscribe(handler: (message: BufferedWindowMessage) => void): () => void;
+    /** Number of messages currently backlogged (no live subscriber yet). Exposed for tests and diagnostics. */
+    readonly backlogSize: number;
+}
+/**
+ * Bound so a hostile or confused page flooding `postMessage` at a tab that never subscribes cannot
+ * grow this buffer without limit. Oldest-first eviction: if the cap is hit, the newest arrivals are
+ * likelier to matter (the most recent handshake attempt) than the oldest.
+ */
+export declare const MAX_BUFFERED_MESSAGES = 200;
+/**
+ * Creates an independent buffer. The React half calls this once at module scope; tests call it
+ * fresh per test so buffered state never leaks between cases.
+ *
+ * @param maxBuffered - Backlog cap. See {@link MAX_BUFFERED_MESSAGES}.
+ * @complexity O(1) per push, O(n) per subscribe in the backlog length.
+ */
+export declare function createEarlyMessageBuffer(maxBuffered?: number): EarlyMessageBuffer;
+//# sourceMappingURL=early-message-buffer.d.ts.map

package/dist/features/mcp-ui/early-message-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"early-message-buffer.d.ts","sourceRoot":"","sources":["../../../src/features/mcp-ui/early-message-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,kGAAkG;IAClG,IAAI,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C;;;;;;;;OAQG;IACH,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACzE,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,GAAE,MAA8B,GAAG,kBAAkB,CAgCxG"}

package/dist/features/mcp-ui/early-message-buffer.js

@@ -0,0 +1,69 @@
+/**
+ * @module features/mcp-ui/early-message-buffer
+ *
+ * A framework-free fix for the exact race `@jini-ai/agentic`'s `mcp-ui-apps.ts` names as its reason
+ * for existing: a View can post `ui/initialize` before the Host component has mounted and attached
+ * its `window.addEventListener('message', …)`.
+ *
+ * `postMessage` does not queue for a listener that does not exist yet — posted with nobody
+ * listening, a message is gone. The only way a Host survives this is to start listening before the
+ * View could possibly have sent anything, and to buffer whatever arrives until a (possibly much
+ * later, React-effect-timed) subscriber drains it. A `useEffect`-only listener loses anything posted
+ * between mount-commit and effect-run, which a lazy import, a Suspense boundary, or an expensive
+ * first render makes a real window rather than a theoretical one.
+ *
+ * Lives in `features/` — not next to the Host it serves — because it is plain TypeScript with no
+ * DOM types and no React, so it is testable in a plain Node environment. The module-scope
+ * `window.addEventListener` that feeds it belongs to the React half; see
+ * `../../react/mcp-ui/host-message-source.ts`.
+ *
+ * Ported from `examples/reference-web/src/mcpui-lab-message-buffer.ts` unchanged in behavior.
+ */
+/**
+ * Bound so a hostile or confused page flooding `postMessage` at a tab that never subscribes cannot
+ * grow this buffer without limit. Oldest-first eviction: if the cap is hit, the newest arrivals are
+ * likelier to matter (the most recent handshake attempt) than the oldest.
+ */
+export const MAX_BUFFERED_MESSAGES = 200;
+/**
+ * Creates an independent buffer. The React half calls this once at module scope; tests call it
+ * fresh per test so buffered state never leaks between cases.
+ *
+ * @param maxBuffered - Backlog cap. See {@link MAX_BUFFERED_MESSAGES}.
+ * @complexity O(1) per push, O(n) per subscribe in the backlog length.
+ */
+export function createEarlyMessageBuffer(maxBuffered = MAX_BUFFERED_MESSAGES) {
+    const backlog = [];
+    const liveHandlers = new Set();
+    return {
+        push(message) {
+            if (liveHandlers.size > 0) {
+                // Snapshot before iterating: a handler that subscribes or unsubscribes synchronously (a
+                // Host tearing itself down mid-dispatch) must not mutate the Set out from under the loop.
+                for (const handler of [...liveHandlers])
+                    handler(message);
+                return;
+            }
+            backlog.push(message);
+            if (backlog.length > maxBuffered)
+                backlog.shift();
+        },
+        subscribe(handler) {
+            liveHandlers.add(handler);
+            // Shift one at a time, not splice-all: a handler that calls `push` synchronously must not see
+            // a backlog it just extended replayed back at it in the same drain.
+            let next = backlog.shift();
+            while (next !== undefined) {
+                handler(next);
+                next = backlog.shift();
+            }
+            return () => {
+                liveHandlers.delete(handler);
+            };
+        },
+        get backlogSize() {
+            return backlog.length;
+        },
+    };
+}
+//# sourceMappingURL=early-message-buffer.js.map

package/dist/features/mcp-ui/early-message-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"early-message-buffer.js","sourceRoot":"","sources":["../../../src/features/mcp-ui/early-message-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA8BH;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,cAAsB,qBAAqB;IAClF,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA4C,CAAC;IAEzE,OAAO;QACL,IAAI,CAAC,OAAO;YACV,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC1B,wFAAwF;gBACxF,0FAA0F;gBAC1F,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,YAAY,CAAC;oBAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW;gBAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACpD,CAAC;QACD,SAAS,CAAC,OAAO;YACf,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1B,8FAA8F;YAC9F,oEAAoE;YACpE,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;YACD,OAAO,GAAG,EAAE;gBACV,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,WAAW;YACb,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/features/mcp-ui/escape.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @module features/mcp-ui/escape
+ *
+ * The two escapes every generated MCP-UI surface needs, and the reason they are a module rather
+ * than a one-liner at each call site: a surface's HTML is assembled by string concatenation (there
+ * is no DOM, no JSX, and no template engine on the builder side), so every caller-supplied value
+ * crossing into that string is an injection site. Ported from the reference implementation's
+ * `mcp-ui.ts` — the implementations were already correct there; only the location and
+ * the doc are new.
+ */
+/**
+ * Escapes a value for interpolation into generated HTML.
+ *
+ * Escapes all five of `& < > " '`, which makes the result safe in a text node **and** inside a
+ * quoted attribute value with either quote style — the builders in `surfaces/` use it for both, so
+ * a text-node-only escape (`& < >`) would be a live attribute-injection hole the first time someone
+ * interpolated a label into `title="…"`.
+ *
+ * @param value - Untrusted text.
+ * @returns The escaped text.
+ * @complexity O(n) in the value's length.
+ */
+export declare function escapeHtml(value: string): string;
+/**
+ * Serializes a value as a JS literal safe to embed in an inline `<script>`.
+ *
+ * `JSON.stringify` alone is not enough for three reasons a real surface hits:
+ * - a literal `</script` anywhere in the value closes the script element early, so every `<` is
+ *   escaped to `<` (which also defuses `<!--`, the other sequence the HTML parser treats
+ *   specially inside a script element);
+ * - U+2028 / U+2029 are legal in JSON but were not legal in JS string literals before ES2019, and
+ *   a surface's script is parsed as a classic script by whatever engine the host embeds.
+ *
+ * Accepts any JSON-serializable value, not just strings, so a builder can inline a params object
+ * with the same guarantees it gets for a label.
+ *
+ * @param value - Any JSON-serializable value. `undefined` (and anything else `JSON.stringify`
+ * drops) serializes to the literal `undefined`, which is valid JS in expression position.
+ * @returns A JS literal.
+ * @complexity O(n) in the serialized length.
+ */
+export declare function escapeJsValue(value: unknown): string;
+/**
+ * {@link escapeJsValue} narrowed to strings.
+ *
+ * Kept as its own export because the overwhelmingly common call is "inline this one string", and a
+ * `string`-typed signature makes a caller that accidentally passes an object a compile error rather
+ * than a silently-inlined `[object Object]`-free-but-surprising literal.
+ */
+export declare function escapeJsString(value: string): string;
+//# sourceMappingURL=escape.d.ts.map

package/dist/features/mcp-ui/escape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"escape.d.ts","sourceRoot":"","sources":["../../../src/features/mcp-ui/escape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOpD;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD"}

package/dist/features/mcp-ui/escape.js

@@ -0,0 +1,68 @@
+/**
+ * @module features/mcp-ui/escape
+ *
+ * The two escapes every generated MCP-UI surface needs, and the reason they are a module rather
+ * than a one-liner at each call site: a surface's HTML is assembled by string concatenation (there
+ * is no DOM, no JSX, and no template engine on the builder side), so every caller-supplied value
+ * crossing into that string is an injection site. Ported from the reference implementation's
+ * `mcp-ui.ts` — the implementations were already correct there; only the location and
+ * the doc are new.
+ */
+/**
+ * Escapes a value for interpolation into generated HTML.
+ *
+ * Escapes all five of `& < > " '`, which makes the result safe in a text node **and** inside a
+ * quoted attribute value with either quote style — the builders in `surfaces/` use it for both, so
+ * a text-node-only escape (`& < >`) would be a live attribute-injection hole the first time someone
+ * interpolated a label into `title="…"`.
+ *
+ * @param value - Untrusted text.
+ * @returns The escaped text.
+ * @complexity O(n) in the value's length.
+ */
+export function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Serializes a value as a JS literal safe to embed in an inline `<script>`.
+ *
+ * `JSON.stringify` alone is not enough for three reasons a real surface hits:
+ * - a literal `</script` anywhere in the value closes the script element early, so every `<` is
+ *   escaped to `<` (which also defuses `<!--`, the other sequence the HTML parser treats
+ *   specially inside a script element);
+ * - U+2028 / U+2029 are legal in JSON but were not legal in JS string literals before ES2019, and
+ *   a surface's script is parsed as a classic script by whatever engine the host embeds.
+ *
+ * Accepts any JSON-serializable value, not just strings, so a builder can inline a params object
+ * with the same guarantees it gets for a label.
+ *
+ * @param value - Any JSON-serializable value. `undefined` (and anything else `JSON.stringify`
+ * drops) serializes to the literal `undefined`, which is valid JS in expression position.
+ * @returns A JS literal.
+ * @complexity O(n) in the serialized length.
+ */
+export function escapeJsValue(value) {
+    const json = JSON.stringify(value);
+    if (json === undefined)
+        return 'undefined';
+    return json
+        .replace(/</g, '\\u003c')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
+/**
+ * {@link escapeJsValue} narrowed to strings.
+ *
+ * Kept as its own export because the overwhelmingly common call is "inline this one string", and a
+ * `string`-typed signature makes a caller that accidentally passes an object a compile error rather
+ * than a silently-inlined `[object Object]`-free-but-surprising literal.
+ */
+export function escapeJsString(value) {
+    return escapeJsValue(value);
+}
+//# sourceMappingURL=escape.js.map