@jini-ai/ui 0.3.13 → 0.4.0

package/dist/features/mcp-ui/surfaces/text-input.js

@@ -48,10 +48,10 @@ export function renderTextInput(props) {
         ? `<textarea class="mcpui-textarea"${common}${optionalAttribute('rows', props.rows)}>${props.value === undefined ? '' : escapeHtml(String(props.value))}</textarea>`
         : `<input class="mcpui-input" type="${type}"${common}` +
             optionalAttribute('value', props.value) +
-            // A stored secret (e.g. a cloud provider's access key) must never be offered to a browser's
-            // password manager as a saveable website login — it belongs to this `ui://` surface, not a
-            // credential the browser should remember.
-            (props.secret === true ? optionalAttribute('autocomplete', 'off') : '') +
+            // A stored secret (e.g. a cloud provider's access key or a database password) must never be
+            // autofilled with a saved website login. `new-password`, not `off`: Chrome ignores `off` on
+            // password inputs by design and fills the saved login anyway.
+            (type === 'password' ? optionalAttribute('autocomplete', 'new-password') : '') +
             (isNumber
                 ? optionalAttribute('min', props.min) + optionalAttribute('max', props.max) + optionalAttribute('step', props.step)
                 : '') +

package/dist/features/mcp-ui/surfaces/tokens.d.ts

@@ -17,10 +17,8 @@
  * alone moves the accent, its hover state, its focus ring, and its tinted background together,
  * because all four resolve through it.
  *
- * `@jini-ai/ui` has no package-wide custom-property design system to reuse (checked: its only two
- * stylesheets, `react/chat/styles/reference.css` and the Remix icon font, declare no custom
- * properties at all), so these are namespaced `--jini-mcpui-*` to stay out of the way of one if it
- * ever lands.
+ * The sandbox cannot inherit the host's CSS. These names are a document adapter of
+ * defaultAdminTheme; hosts forward their active values through the existing overrides port.
  *
  * ## Dark mode
  *
@@ -43,26 +41,26 @@
  * render in whatever the engine falls back to after a delay.
  */
 export declare const SURFACE_TOKENS: {
-    readonly '--jini-mcpui-bg': "#faf9f7";
-    readonly '--jini-mcpui-panel': "#fdfcfa";
-    readonly '--jini-mcpui-border': "#e1e5eb";
-    readonly '--jini-mcpui-border-strong': "#c9d0da";
-    readonly '--jini-mcpui-text': "#1a1916";
-    readonly '--jini-mcpui-text-strong': "#0d0c0a";
-    readonly '--jini-mcpui-text-muted': "#74716b";
-    readonly '--jini-mcpui-text-soft': "#989590";
-    readonly '--jini-mcpui-text-faint': "#b3b0a8";
-    readonly '--jini-mcpui-accent': "#c96442";
-    readonly '--jini-mcpui-accent-strong': "#b45a3b";
-    readonly '--jini-mcpui-danger': "#a8443a";
+    readonly '--jini-mcpui-bg': string;
+    readonly '--jini-mcpui-panel': string;
+    readonly '--jini-mcpui-border': string;
+    readonly '--jini-mcpui-border-strong': string;
+    readonly '--jini-mcpui-text': string;
+    readonly '--jini-mcpui-text-strong': string;
+    readonly '--jini-mcpui-text-muted': string;
+    readonly '--jini-mcpui-text-soft': string;
+    readonly '--jini-mcpui-text-faint': string;
+    readonly '--jini-mcpui-accent': string;
+    readonly '--jini-mcpui-accent-strong': string;
+    readonly '--jini-mcpui-danger': string;
     readonly '--jini-mcpui-radius-xs': "4px";
     readonly '--jini-mcpui-radius-sm': "6px";
     readonly '--jini-mcpui-radius-md': "8px";
     readonly '--jini-mcpui-radius-lg': "10px";
     readonly '--jini-mcpui-radius-xl': "12px";
     readonly '--jini-mcpui-radius-pill': "999px";
-    readonly '--jini-mcpui-font': "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Arial, sans-serif";
-    readonly '--jini-mcpui-font-mono': "ui-monospace, SFMono-Regular, Menlo, Consolas, monospace";
+    readonly '--jini-mcpui-font': string;
+    readonly '--jini-mcpui-font-mono': string;
 };
 /** The token names a caller may override. */
 export type SurfaceTokenName = keyof typeof SURFACE_TOKENS;
@@ -79,8 +77,7 @@ export declare const SURFACE_TOKENS_DARK: Record<SurfaceTokenName, string>;
  * Whether every generated surface is pinned to the light palette regardless of the embedding
  * browser/OS's `prefers-color-scheme`.
  *
- * True today because the host product — currently this package's only consumer — has no real
- * light/dark toggle yet (`apps/admin`'s Appearance section is a disabled "SOON" placeholder), so a
+ * True by default because without an explicit app-level theme signal, a
  * surface that honors the OS preference doesn't track any actual app theme — it tracks whatever the
  * operator's OS happens to be set to, which produces a dark card floating in an always-light admin
  * UI. Flip this to `false` once the host product has a real app-level theme signal to forward in;

package/dist/features/mcp-ui/surfaces/tokens.js

@@ -1,3 +1,4 @@
+import { defaultAdminTheme } from '../../../theme/default.js';
 /**
  * @module features/mcp-ui/surfaces/tokens
  *
@@ -17,10 +18,8 @@
  * alone moves the accent, its hover state, its focus ring, and its tinted background together,
  * because all four resolve through it.
  *
- * `@jini-ai/ui` has no package-wide custom-property design system to reuse (checked: its only two
- * stylesheets, `react/chat/styles/reference.css` and the Remix icon font, declare no custom
- * properties at all), so these are namespaced `--jini-mcpui-*` to stay out of the way of one if it
- * ever lands.
+ * The sandbox cannot inherit the host's CSS. These names are a document adapter of
+ * defaultAdminTheme; hosts forward their active values through the existing overrides port.
  *
  * ## Dark mode
  *
@@ -43,28 +42,28 @@
  * render in whatever the engine falls back to after a delay.
  */
 export const SURFACE_TOKENS = {
-    '--jini-mcpui-bg': '#faf9f7',
-    '--jini-mcpui-panel': '#fdfcfa',
-    '--jini-mcpui-border': '#e1e5eb',
-    '--jini-mcpui-border-strong': '#c9d0da',
-    '--jini-mcpui-text': '#1a1916',
-    '--jini-mcpui-text-strong': '#0d0c0a',
-    '--jini-mcpui-text-muted': '#74716b',
-    '--jini-mcpui-text-soft': '#989590',
-    '--jini-mcpui-text-faint': '#b3b0a8',
-    '--jini-mcpui-accent': '#c96442',
-    '--jini-mcpui-accent-strong': '#b45a3b',
+    '--jini-mcpui-bg': defaultAdminTheme.light.bg,
+    '--jini-mcpui-panel': defaultAdminTheme.light.surface,
+    '--jini-mcpui-border': defaultAdminTheme.light.border,
+    '--jini-mcpui-border-strong': defaultAdminTheme.light.border,
+    '--jini-mcpui-text': defaultAdminTheme.light.text,
+    '--jini-mcpui-text-strong': defaultAdminTheme.light.text,
+    '--jini-mcpui-text-muted': defaultAdminTheme.light.muted,
+    '--jini-mcpui-text-soft': defaultAdminTheme.light.muted,
+    '--jini-mcpui-text-faint': defaultAdminTheme.light.muted,
+    '--jini-mcpui-accent': defaultAdminTheme.light.primary,
+    '--jini-mcpui-accent-strong': defaultAdminTheme.light.primary,
     // Desaturated and earthy, in the same family as the accent rather than a saturated pure red — a
     // destructive action should read as serious, not as an alarm the eye learns to discount.
-    '--jini-mcpui-danger': '#a8443a',
+    '--jini-mcpui-danger': defaultAdminTheme.light.danger,
     '--jini-mcpui-radius-xs': '4px',
     '--jini-mcpui-radius-sm': '6px',
     '--jini-mcpui-radius-md': '8px',
     '--jini-mcpui-radius-lg': '10px',
     '--jini-mcpui-radius-xl': '12px',
     '--jini-mcpui-radius-pill': '999px',
-    '--jini-mcpui-font': "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Arial, sans-serif",
-    '--jini-mcpui-font-mono': "ui-monospace, SFMono-Regular, Menlo, Consolas, monospace",
+    '--jini-mcpui-font': defaultAdminTheme.fonts.body,
+    '--jini-mcpui-font-mono': defaultAdminTheme.fonts.mono,
 };
 /**
  * The dark-scheme value for every token in {@link SURFACE_TOKENS}, keyed the same way and typed as
@@ -75,18 +74,18 @@ export const SURFACE_TOKENS = {
  * against exactly that omission.
  */
 export const SURFACE_TOKENS_DARK = {
-    '--jini-mcpui-bg': '#1a1917',
-    '--jini-mcpui-panel': '#222120',
-    '--jini-mcpui-border': '#333128',
-    '--jini-mcpui-border-strong': '#46433c',
-    '--jini-mcpui-text': '#e8e4dc',
-    '--jini-mcpui-text-strong': '#f2ede4',
-    '--jini-mcpui-text-muted': '#9a9690',
-    '--jini-mcpui-text-soft': '#6e6b65',
-    '--jini-mcpui-text-faint': '#4e4b46',
-    '--jini-mcpui-accent': '#d97a56',
-    '--jini-mcpui-accent-strong': '#e8896a',
-    '--jini-mcpui-danger': '#e0685f',
+    '--jini-mcpui-bg': defaultAdminTheme.dark.bg,
+    '--jini-mcpui-panel': defaultAdminTheme.dark.surface,
+    '--jini-mcpui-border': defaultAdminTheme.dark.border,
+    '--jini-mcpui-border-strong': defaultAdminTheme.dark.border,
+    '--jini-mcpui-text': defaultAdminTheme.dark.text,
+    '--jini-mcpui-text-strong': defaultAdminTheme.dark.text,
+    '--jini-mcpui-text-muted': defaultAdminTheme.dark.muted,
+    '--jini-mcpui-text-soft': defaultAdminTheme.dark.muted,
+    '--jini-mcpui-text-faint': defaultAdminTheme.dark.muted,
+    '--jini-mcpui-accent': defaultAdminTheme.dark.primary,
+    '--jini-mcpui-accent-strong': defaultAdminTheme.dark.primary,
+    '--jini-mcpui-danger': defaultAdminTheme.dark.danger,
     '--jini-mcpui-radius-xs': SURFACE_TOKENS['--jini-mcpui-radius-xs'],
     '--jini-mcpui-radius-sm': SURFACE_TOKENS['--jini-mcpui-radius-sm'],
     '--jini-mcpui-radius-md': SURFACE_TOKENS['--jini-mcpui-radius-md'],
@@ -102,10 +101,10 @@ export const SURFACE_TOKENS_DARK = {
  * which is the exact failure this indirection removes.
  */
 const DERIVED_TOKENS = {
-    '--jini-mcpui-accent-hover': 'color-mix(in srgb, var(--jini-mcpui-accent) 88%, #000)',
+    '--jini-mcpui-accent-hover': 'color-mix(in srgb, var(--jini-mcpui-accent) 88%, var(--jini-mcpui-text))',
     '--jini-mcpui-accent-tint': 'color-mix(in srgb, var(--jini-mcpui-accent) 10%, transparent)',
     '--jini-mcpui-accent-ring': 'color-mix(in srgb, var(--jini-mcpui-accent) 35%, transparent)',
-    '--jini-mcpui-danger-hover': 'color-mix(in srgb, var(--jini-mcpui-danger) 88%, #000)',
+    '--jini-mcpui-danger-hover': 'color-mix(in srgb, var(--jini-mcpui-danger) 88%, var(--jini-mcpui-text))',
     '--jini-mcpui-danger-tint': 'color-mix(in srgb, var(--jini-mcpui-danger) 10%, transparent)',
     '--jini-mcpui-danger-ring': 'color-mix(in srgb, var(--jini-mcpui-danger) 35%, transparent)',
     '--jini-mcpui-surface-shadow': '0 1px 2px color-mix(in srgb, var(--jini-mcpui-text) 8%, transparent)',
@@ -119,13 +118,12 @@ const DERIVED_TOKENS = {
  * itself is light. A drop shadow should stay dark ink at low opacity in both schemes, so this is a
  * fixed value the dark media block below applies as a second, later declaration of the same property.
  */
-const DARK_SURFACE_SHADOW = '0 1px 2px rgba(0, 0, 0, 0.32)';
+const DARK_SURFACE_SHADOW = '0 1px 2px color-mix(in srgb, var(--jini-mcpui-bg) 32%, transparent)';
 /**
  * Whether every generated surface is pinned to the light palette regardless of the embedding
  * browser/OS's `prefers-color-scheme`.
  *
- * True today because the host product — currently this package's only consumer — has no real
- * light/dark toggle yet (`apps/admin`'s Appearance section is a disabled "SOON" placeholder), so a
+ * True by default because without an explicit app-level theme signal, a
  * surface that honors the OS preference doesn't track any actual app theme — it tracks whatever the
  * operator's OS happens to be set to, which produces a dark card floating in an always-light admin
  * UI. Flip this to `false` once the host product has a real app-level theme signal to forward in;

package/dist/features/media-providers/index.d.ts

@@ -1,7 +1,7 @@
 export { DEFAULT_MEDIA_PROVIDER_CATALOG } from './constants.js';
 export { createFakeMediaProvidersPort, type FakeMediaProvidersPortOptions } from './dependencies.js';
 export type { MediaProvidersPort } from './ports.js';
-export { hasAnyConfiguredProvider, hasRecoverableFields, isEntryEmpty, isEntryPresent, isMarkerOnlyEntry, maskedKeyLabel, mergeDaemonProviders, resolveProviderBaseUrl, shouldSyncLocalProvidersToDaemon, sortProvidersByConfigured, } from './rules.js';
+export { hasAnyConfiguredProvider, hasRecoverableFields, isEntryEmpty, isEntryPresent, isMarkerOnlyEntry, maskedKeyLabel, mergeDaemonProviders, resolveProviderBaseUrl, shouldSyncLocalProvidersToDaemon, sortProvidersByConfigured, isProviderBaseUrlInvalid, invalidBaseUrlProviderIds, } from './rules.js';
 export type { MediaProviderCredentials, MediaProviderMap, MediaProviderOption, MediaProvidersLoadState, MediaProvidersSaveState, } from './types.js';
 export { useMediaProvidersTab } from './react/hooks/useMediaProvidersTab.js';
 export type { MediaProviderEditPatch, UseMediaProvidersTabOptions, UseMediaProvidersTabResult, } from './react/hooks/useMediaProvidersTab.js';

package/dist/features/media-providers/index.js

@@ -1,6 +1,6 @@
 export { DEFAULT_MEDIA_PROVIDER_CATALOG } from './constants.js';
 export { createFakeMediaProvidersPort } from './dependencies.js';
-export { hasAnyConfiguredProvider, hasRecoverableFields, isEntryEmpty, isEntryPresent, isMarkerOnlyEntry, maskedKeyLabel, mergeDaemonProviders, resolveProviderBaseUrl, shouldSyncLocalProvidersToDaemon, sortProvidersByConfigured, } from './rules.js';
+export { hasAnyConfiguredProvider, hasRecoverableFields, isEntryEmpty, isEntryPresent, isMarkerOnlyEntry, maskedKeyLabel, mergeDaemonProviders, resolveProviderBaseUrl, shouldSyncLocalProvidersToDaemon, sortProvidersByConfigured, isProviderBaseUrlInvalid, invalidBaseUrlProviderIds, } from './rules.js';
 export { useMediaProvidersTab } from './react/hooks/useMediaProvidersTab.js';
 export { MediaProvidersTab } from './react/components/MediaProvidersTab.js';
 //# sourceMappingURL=index.js.map

package/dist/features/media-providers/react/components/MediaProvidersTab.js

@@ -57,7 +57,7 @@ export function MediaProvidersTab({ port, catalog = DEFAULT_MEDIA_PROVIDER_CATAL
     };
     const orderedCatalog = sortProvidersByConfigured(catalog, providers, pinnedProviderIds);
     const providerHandles = agentHandle
-        ? buildAgentListHandles(agentHandle, orderedCatalog.map((option) => option.id))
+        ? buildAgentListHandles({ prefix: agentHandle, ids: orderedCatalog.map((option) => option.id) })
         : undefined;
     // Membership check against the ALREADY-ORDERED result, not `pinnedProviderIds` directly: a
     // pinned id absent from `catalog` never appears in `orderedCatalog` either (see
@@ -68,7 +68,7 @@ export function MediaProvidersTab({ port, catalog = DEFAULT_MEDIA_PROVIDER_CATAL
     // Save writes every provider at once, so ONE unacceptable endpoint blocks the
     // whole button rather than being silently persisted alongside the good ones.
     const blockedByInvalidBaseUrl = invalidBaseUrlProviderIds(providers).length > 0;
-    return (_jsxs("section", { className: "jini-settings-section jini-settings-media-providers", children: [_jsxs("div", { className: "jini-section-head", children: [_jsxs("div", { children: [_jsx("h4", { children: title }), _jsx("p", { className: "jini-hint", children: description })] }), _jsxs("button", { type: "button", className: "jini-button jini-button-ghost", onClick: reload, disabled: load.status === 'loading', ...agentHandleProps(agentHandle, { action: 'reload', role: 'button', label: reloadLabel }), children: [_jsx(Icon, { name: "refresh", size: 13 }), _jsx("span", { children: load.status === 'loading' ? reloadingLabel : reloadLabel })] })] }), load.status === 'unreachable' ? (_jsx("p", { className: "jini-hint jini-hint-error", role: "alert", children: unreachableLabel })) : null, !hasAnyConfigured ? _jsx("p", { className: "jini-hint", children: emptyStateLabel }) : null, _jsx("div", { className: "jini-media-provider-list", children: orderedCatalog.map((option, index) => {
+    return (_jsxs("section", { className: "jini-settings-section jini-settings-media-providers", children: [_jsxs("div", { className: "jini-section-head", children: [_jsxs("div", { children: [_jsx("h4", { children: title }), _jsx("p", { className: "jini-hint", children: description })] }), _jsxs("button", { type: "button", className: "jini-button jini-button-ghost", onClick: reload, disabled: load.status === 'loading', ...agentHandleProps({}, { base: agentHandle, ...({ action: 'reload', role: 'button', label: reloadLabel }) }), children: [_jsx(Icon, { name: "refresh", size: 13 }), _jsx("span", { children: load.status === 'loading' ? reloadingLabel : reloadLabel })] })] }), load.status === 'unreachable' ? (_jsx("p", { className: "jini-hint jini-hint-error", role: "alert", children: unreachableLabel })) : null, !hasAnyConfigured ? _jsx("p", { className: "jini-hint", children: emptyStateLabel }) : null, _jsx("div", { className: "jini-media-provider-list", children: orderedCatalog.map((option, index) => {
                     const entry = providers[option.id] ?? {};
                     const clearable = isEntryPresent(entry);
                     const saved = isMarkerOnlyEntry(entry);
@@ -96,7 +96,7 @@ export function MediaProvidersTab({ port, catalog = DEFAULT_MEDIA_PROVIDER_CATAL
                                                            credential-shaped fields, which is how a saved password gets autofilled into
                                                            an API-key box. Same defect, same fix, same reasoning as
                                                            `ByokProviderForm`'s own API-key input; see its comment. */
-                                                        autoComplete: "new-password", spellCheck: false, placeholder: saved ? maskedLabel : apiKeyPlaceholder, "aria-label": `${option.label} ${apiKeyLabel}`, value: entry.apiKey ?? '', onChange: (event) => updateProvider(option.id, { apiKey: event.target.value }), ...agentHandleProps(providerHandle, { action: 'api-key', role: 'field', label: `${option.label} ${apiKeyLabel}` }) }), _jsx("button", { type: "button", className: "jini-input-affix-btn", "aria-pressed": keyVisible, "aria-label": `${option.label} ${keyVisible ? hideKeyLabel : showKeyLabel}`, onClick: () => toggleKeyVisible(option.id), ...agentHandleProps(providerHandle, { action: 'reveal-key', role: 'button', label: `${option.label} ${showKeyLabel}` }), children: _jsx(Icon, { name: keyVisible ? 'eye-off' : 'eye', size: 14 }) })] }), _jsxs("label", { className: "jini-media-provider-field", children: [_jsx("span", { className: "jini-field-label jini-sr-only", children: baseUrlLabel }), _jsx("input", { className: "jini-input", type: "url", inputMode: "url", spellCheck: false, placeholder: option.defaultBaseUrl || baseUrlPlaceholder, "aria-label": `${option.label} ${baseUrlLabel}`, value: rawBaseUrl, "aria-invalid": baseUrlInvalid || undefined, onChange: (event) => updateProvider(option.id, { baseUrl: event.target.value }), ...agentHandleProps(providerHandle, { action: 'base-url', role: 'field', label: `${option.label} ${baseUrlLabel}` }) })] }), option.models && option.models.length > 0 ? (_jsxs("label", { className: "jini-media-provider-field", children: [_jsx("span", { className: "jini-field-label jini-sr-only", children: modelLabel }), _jsx("input", { className: "jini-input", list: modelListId, spellCheck: false, placeholder: modelPlaceholder, "aria-label": `${option.label} ${modelLabel}`, value: entry.model ?? '', onChange: (event) => updateProvider(option.id, { model: event.target.value }), ...agentHandleProps(providerHandle, { action: 'model', role: 'field', label: `${option.label} ${modelLabel}` }) }), _jsx("datalist", { id: modelListId, children: option.models.map((model) => (_jsx("option", { value: model }, model))) })] })) : null, _jsx("button", { type: "button", className: "jini-button jini-button-ghost", disabled: !clearable, "aria-label": `${option.label} ${clearLabel}`, onClick: () => clearProvider(option.id), ...agentHandleProps(providerHandle, { action: 'clear', role: 'button', label: `${option.label} ${clearLabel}` }), children: clearLabel })] }), baseUrlInvalid ? (_jsx("span", { className: "jini-field-hint jini-hint-error", role: "alert", children: baseUrlInvalidLabel })) : !rawBaseUrl.trim() && effectiveBaseUrl ? (_jsx("span", { className: "jini-field-hint", children: t(baseUrlDefaultHintTemplate, { url: effectiveBaseUrl }) })) : null] })] }, option.id));
-                }) }), _jsxs("div", { className: "jini-media-provider-save-row", children: [_jsx("button", { type: "button", className: "jini-button", onClick: saveChanges, disabled: save.status === 'saving' || !hasPendingChanges || blockedByInvalidBaseUrl, ...agentHandleProps(agentHandle, { action: 'save', role: 'button', label: saveChangesLabel }), children: save.status === 'saving' ? savingLabel : saveChangesLabel }), save.status === 'saved' ? (_jsx("span", { className: "jini-hint", role: "status", children: savedNoticeLabel })) : null, save.status === 'save-error' ? (_jsx("span", { className: "jini-hint jini-hint-error", role: "alert", children: saveErrorLabel })) : null] })] }));
+                                                        autoComplete: "new-password", spellCheck: false, placeholder: saved ? maskedLabel : apiKeyPlaceholder, "aria-label": `${option.label} ${apiKeyLabel}`, value: entry.apiKey ?? '', onChange: (event) => updateProvider(option.id, { apiKey: event.target.value }), ...agentHandleProps({}, { base: providerHandle, ...({ action: 'api-key', role: 'field', label: `${option.label} ${apiKeyLabel}` }) }) }), _jsx("button", { type: "button", className: "jini-input-affix-btn", "aria-pressed": keyVisible, "aria-label": `${option.label} ${keyVisible ? hideKeyLabel : showKeyLabel}`, onClick: () => toggleKeyVisible(option.id), ...agentHandleProps({}, { base: providerHandle, ...({ action: 'reveal-key', role: 'button', label: `${option.label} ${showKeyLabel}` }) }), children: _jsx(Icon, { name: keyVisible ? 'eye-off' : 'eye', size: 14 }) })] }), _jsxs("label", { className: "jini-media-provider-field", children: [_jsx("span", { className: "jini-field-label jini-sr-only", children: baseUrlLabel }), _jsx("input", { className: "jini-input", type: "url", inputMode: "url", spellCheck: false, placeholder: option.defaultBaseUrl || baseUrlPlaceholder, "aria-label": `${option.label} ${baseUrlLabel}`, value: rawBaseUrl, "aria-invalid": baseUrlInvalid || undefined, onChange: (event) => updateProvider(option.id, { baseUrl: event.target.value }), ...agentHandleProps({}, { base: providerHandle, ...({ action: 'base-url', role: 'field', label: `${option.label} ${baseUrlLabel}` }) }) })] }), option.models && option.models.length > 0 ? (_jsxs("label", { className: "jini-media-provider-field", children: [_jsx("span", { className: "jini-field-label jini-sr-only", children: modelLabel }), _jsx("input", { className: "jini-input", list: modelListId, spellCheck: false, placeholder: modelPlaceholder, "aria-label": `${option.label} ${modelLabel}`, value: entry.model ?? '', onChange: (event) => updateProvider(option.id, { model: event.target.value }), ...agentHandleProps({}, { base: providerHandle, ...({ action: 'model', role: 'field', label: `${option.label} ${modelLabel}` }) }) }), _jsx("datalist", { id: modelListId, children: option.models.map((model) => (_jsx("option", { value: model }, model))) })] })) : null, _jsx("button", { type: "button", className: "jini-button jini-button-ghost", disabled: !clearable, "aria-label": `${option.label} ${clearLabel}`, onClick: () => clearProvider(option.id), ...agentHandleProps({}, { base: providerHandle, ...({ action: 'clear', role: 'button', label: `${option.label} ${clearLabel}` }) }), children: clearLabel })] }), baseUrlInvalid ? (_jsx("span", { className: "jini-field-hint jini-hint-error", role: "alert", children: baseUrlInvalidLabel })) : !rawBaseUrl.trim() && effectiveBaseUrl ? (_jsx("span", { className: "jini-field-hint", children: t(baseUrlDefaultHintTemplate, { url: effectiveBaseUrl }) })) : null] })] }, option.id));
+                }) }), _jsxs("div", { className: "jini-media-provider-save-row", children: [_jsx("button", { type: "button", className: "jini-button", onClick: saveChanges, disabled: save.status === 'saving' || !hasPendingChanges || blockedByInvalidBaseUrl, ...agentHandleProps({}, { base: agentHandle, ...({ action: 'save', role: 'button', label: saveChangesLabel }) }), children: save.status === 'saving' ? savingLabel : saveChangesLabel }), save.status === 'saved' ? (_jsx("span", { className: "jini-hint", role: "status", children: savedNoticeLabel })) : null, save.status === 'save-error' ? (_jsx("span", { className: "jini-hint jini-hint-error", role: "alert", children: saveErrorLabel })) : null] })] }));
 }
 //# sourceMappingURL=MediaProvidersTab.js.map

package/dist/features/media-providers/rules.js

@@ -155,7 +155,7 @@ export function isProviderBaseUrlInvalid(entry) {
     const typed = entry?.baseUrl?.trim();
     if (!typed)
         return false;
-    return !isAllowedEndpointUrl(typed);
+    return !isAllowedEndpointUrl({ raw: typed });
 }
 /** Every provider id in the map whose typed base URL is unacceptable — the save gate's input. */
 export function invalidBaseUrlProviderIds(providers) {

package/dist/features/memory/async-commit-guard.d.ts

@@ -18,7 +18,7 @@
  * useMemoryConfig's hydrate() — invalidate() was only called at toggle
  * start, not in the write's onSettled callback — before being caught in
  * review and fixed. Ported with that fix already applied — see
- * `packages/ui/source-map.md`.)
+ * `packages/ui/archived provenance ledger`.)
  */
 export interface AsyncCommitGuard {
     begin: () => number;

package/dist/features/memory/constants.d.ts

@@ -27,7 +27,7 @@ export declare function connectorAppLabel(connectorId: string): string | undefin
 /**
  * Placeholder `provider` label for a memory-connector catalogue row this
  * client has only an id for (no full connector detail has loaded yet).
- * The pinned source hardcoded `'composio'` here — that's a specific
+ * The pinned source hardcoded `'connector-provider'` here — that's a specific
  * third-party OAuth-integration vendor OD's real deployment happens to use,
  * not a generic concept, so this package uses a neutral placeholder instead;
  * a host resolving real connector details overwrites it via

package/dist/features/memory/constants.js

@@ -65,7 +65,7 @@ export function connectorAppLabel(connectorId) {
 /**
  * Placeholder `provider` label for a memory-connector catalogue row this
  * client has only an id for (no full connector detail has loaded yet).
- * The pinned source hardcoded `'composio'` here — that's a specific
+ * The pinned source hardcoded `'connector-provider'` here — that's a specific
  * third-party OAuth-integration vendor OD's real deployment happens to use,
  * not a generic concept, so this package uses a neutral placeholder instead;
  * a host resolving real connector details overwrites it via

package/dist/features/memory/dependencies.d.ts

@@ -1,29 +1,17 @@
 import type { Connector } from '../connectors/types.js';
 import type { MemoryConfigPort, MemoryConnectorsPort, MemoryEntriesPort, MemoryExtractionsPort } from './ports.js';
 import type { ConnectorMemorySuggestionResponse, MemoryListResponse } from './types.js';
-export declare const memoryConfigPort: MemoryConfigPort;
-/**
- * `entries` drives the saved-memory list; `rootDir`/`index`/`enabled` are
- * consumed directly (no fallback) by `useMemoryEntries.reload()` and
- * `useMemoryConfig.hydrate()`.
- *
- * BUG FIX (ported from the pinned source with this fix applied — see
- * `packages/ui/source-map.md`): the pinned source validated only `entries`
- * here, even though `hydrate()`/`reload()` read `enabled`/`rootDir`/`index`
- * off this same response with no fallback. A malformed `200` like
- * `{ entries: [] }` passed validation and then silently hydrated those other
- * fields to `undefined`. Fixed the same way `fetchMemoryEntry()` below
- * already handles a missing required field: validate every field this
- * shared read path's callers actually trust unconditionally, and throw
- * instead of returning a response that looks like a legitimate empty state.
- * The four per-hook flags are deliberately NOT added to this list — they
- * keep their own established legacy-default semantics in `hydrate()`
- * (`list.xEnabled !== false`), so their absence is intentionally not a
- * transport failure.
- */
-export declare function fetchMemoryList(): Promise<MemoryListResponse>;
-export declare const memoryEntriesPort: MemoryEntriesPort;
-export declare const memoryExtractionsPort: MemoryExtractionsPort;
+/** Build the real REST ports with one native fetch binding; defaults remain browser-owned. */
+export declare function createMemoryHttpPorts(_required: Record<string, never>, { fetch }?: {
+    fetch?: typeof globalThis.fetch;
+}): {
+    config: MemoryConfigPort;
+    entries: MemoryEntriesPort;
+    extractions: MemoryExtractionsPort;
+};
+export declare const memoryConfigPort: MemoryConfigPort, memoryEntriesPort: MemoryEntriesPort, memoryExtractionsPort: MemoryExtractionsPort;
+/** Standalone default read shares the entries port's validated REST implementation. */
+export declare const fetchMemoryList: () => Promise<MemoryListResponse>;
 export interface FakeMemoryConnectorsPortOptions {
     connectors?: Connector[];
     suggestionResponse?: ConnectorMemorySuggestionResponse | null;