@jini-ai/ui 0.4.3 → 0.4.5

package/dist/features/mcp-ui/resource.js

@@ -12,11 +12,8 @@
  * ``ui://${string}`` URI scheme and the wider MIME union reproduced in
  * {@link UIResourceMimeType}.
  *
- * Ported from the reference implementation's `mcp-ui.ts`, minus that file's hand-rolled copy of the
- * JSON-RPC envelope and its `UIActionResult` union: the reference implementation declared those
- * because its tsconfig's
- * `moduleResolution: "Node"` cannot read a modern package's `exports` map, and this package has no
- * such constraint — the envelope comes from `protocol.ts`'s re-exports instead. See
+ * The envelope comes from protocol.ts's re-exports, so this resource layer has no parallel
+ * JSON-RPC or UIActionResult definition. See
  * `surfaces/bridge.ts` for why the legacy `{type:'tool', payload}` action shape is not emitted.
  */
 /**
@@ -94,7 +91,7 @@ export const MCP_UI_EXPIRES_AT_META_KEY = `${JINI_MCP_UI_METADATA_PREFIX}expires
  * @returns The `EmbeddedResource` to place in a tool result's `content` array.
  * @complexity O(1).
  */
-export function createUIResource(spec) {
+export function createUIResource(spec, _optional = {}) {
     const meta = {
         ...(spec.preferredFrameSize === undefined
             ? {}
@@ -109,7 +106,7 @@ export function createUIResource(spec) {
             uri: spec.uri,
             mimeType: MCP_UI_MIME_TYPE,
             text: spec.htmlString,
-            ...(Object.keys(meta).length === 0 ? {} : { _meta: meta }),
+            ...(Object.keys(meta).length === 0 && spec.meta === undefined ? {} : { _meta: meta }),
         },
     };
 }
@@ -122,7 +119,7 @@ export function createUIResource(spec) {
  * @param spec.meta - Optional result-level `_meta`.
  * @complexity O(1).
  */
-export function buildUIToolResult(spec) {
+export function buildUIToolResult(spec, _optional = {}) {
     return {
         content: [{ type: 'text', text: spec.modelText }, spec.ui],
         ...(spec.meta === undefined ? {} : { _meta: spec.meta }),

package/dist/features/mcp-ui/secret-card.d.ts

@@ -0,0 +1,115 @@
+/**
+ * One human-only secret-card lifecycle. Keystrokes go directly to the held exchange and save
+ * port, never through model input, chat text, or logs. Saved values must stay in the host's
+ * sealed store; save returns only a safe summary for result/outcome projections.
+ *
+ * Fail closed without an emitter: returning a form or accepting a second model call would
+ * strand the held call or route a secret through model context. Cancel posts a dismissal so
+ * the call wakes immediately instead of waiting for its TTL. askThenReport keeps the exchange
+ * open until the real save finishes; reusing the form URI replaces premature "Done." with its
+ * actual outcome. The host supplies the daemon's existing helper, never a second store.
+ */
+import { type SurfaceAskThenReport, type SurfaceExchangeStore, type ToolExecutionContext, type ToolExecutionOptions } from '@jini-ai/core';
+import { type FormSurfaceSpec } from './surfaces/form.js';
+import { type SurfaceOutcomeSpec } from './surfaces/outcome.js';
+import type { StringField, SurfaceField } from './surfaces/fields.js';
+/** Secret fields cannot carry a value, even through a previously declared variable.
+ * `allowBlank` permits an empty string for stored-value preservation or public-client auth. */
+export type SecretCardField = (SurfaceField & {
+    readonly secret?: false;
+}) | (Omit<StringField, 'value' | 'secret'> & {
+    readonly secret: true;
+    readonly value?: never;
+    readonly allowBlank?: boolean;
+});
+/** The host controls copy, field construction and display; routing/dismissal belong to the engine. */
+export type SecretCardForm = Omit<FormSurfaceSpec, 'fields' | 'toolName' | 'baseParams' | 'cancel'> & {
+    readonly fields: readonly SecretCardField[];
+    readonly cancelLabel?: string;
+};
+export type SecretCardRun<Saved> = {
+    readonly status: 'saved';
+    readonly saved: Saved;
+} | {
+    readonly status: 'cancelled';
+} | {
+    readonly status: 'expired';
+} | {
+    readonly status: 'abandoned';
+} | {
+    readonly status: 'blank';
+} | {
+    readonly status: 'failed';
+    readonly safeMessage: string;
+};
+/** A domain spec, with authorization and target resolution in prepare and persistence in save.
+ * Projections must contain safe metadata only. Neither projection receives the submitted values. */
+export interface SecretCardSpec<Prep, Saved, Result> {
+    readonly toolId: string;
+    /** Validate public model input, authorize and resolve the target before opening a card.
+     * Reject secret-bearing input; never read stored plaintext for form construction. */
+    prepare(required: {
+        ctx: ToolExecutionContext;
+    }): Promise<Prep>;
+    form(required: {
+        prep: Prep;
+    }): SecretCardForm;
+    /** Only declared field names are forwarded. Domain validation remains authoritative.
+     * Values keep their native field types and exact bytes; stored secrets are never needed here. */
+    save(required: {
+        values: Readonly<Record<string, unknown>>;
+        prep: Prep;
+        signal: AbortSignal;
+    }): Promise<Saved>;
+    /** Return undefined for cancellation/expiry when the form already reports that state locally. */
+    outcome(required: {
+        prep: Prep;
+        run: SecretCardRun<Saved>;
+    }): SurfaceOutcomeSpec | undefined;
+    result(required: {
+        prep: Prep;
+        run: SecretCardRun<Saved>;
+    }): Result;
+}
+export interface SecretCardText {
+    readonly noEmitter?: string;
+    readonly saveFailure?: string;
+    readonly cancelLabel?: string;
+}
+export interface SecretCardOptions {
+    /** Allowlist known error kinds to fixed text. Never return raw error.message. */
+    readonly safeError?: (error: unknown) => string | undefined;
+    readonly text?: SecretCardText;
+    readonly frameSize?: readonly [string, string];
+    readonly uriHost?: string;
+    /** Fixed metadata only: errors and submitted values are deliberately absent. */
+    readonly logFailure?: (metadata: {
+        toolId: string;
+        exchangeId: string;
+        saved: false;
+    }) => void;
+}
+export interface SecretCardDeps {
+    readonly surfaceExchanges: Pick<SurfaceExchangeStore, 'open'>;
+    readonly askThenReport: SurfaceAskThenReport;
+}
+export type SecretCardHandler<Result> = (required: ToolExecutionContext, optional?: ToolExecutionOptions) => Promise<Result>;
+export interface SecretCardTool<Prep, Result> {
+    readonly toolId: string;
+    secretFieldNames(prep: Prep): string[];
+    handler(deps: SecretCardDeps): SecretCardHandler<Result>;
+}
+/**
+ * Define a secret card once; inject the exchange store and daemon askThenReport at composition.
+ * @param required - Domain fields, permission/target checks, save port and safe projections.
+ * @param options - Optional copy, error allowlist, fixed-metadata logger and resource framing.
+ * @returns Tool identity, dynamic secret-field metadata and a typed registry-compatible handler.
+ * @throws ToolInputError if the emitter is missing or fields violate the secret/routing contract.
+ * Prepare/transport failures propagate; save failures become a fixed safe outcome.
+ * @complexity O(n + h + b) locally in fields, rendered HTML and submitted secret bytes, plus host I/O.
+ * @example
+ * const tool = defineSecretCardTool(spec);
+ * registry.register({ descriptor, policy, handler: tool.handler({ surfaceExchanges, askThenReport }) });
+ */
+export declare function defineSecretCardTool<Prep, Saved, Result>(required: SecretCardSpec<Prep, Saved, Result>, options?: SecretCardOptions): SecretCardTool<Prep, Result>;
+//# sourceMappingURL=secret-card.d.ts.map

package/dist/features/mcp-ui/secret-card.js

@@ -0,0 +1,137 @@
+/**
+ * One human-only secret-card lifecycle. Keystrokes go directly to the held exchange and save
+ * port, never through model input, chat text, or logs. Saved values must stay in the host's
+ * sealed store; save returns only a safe summary for result/outcome projections.
+ *
+ * Fail closed without an emitter: returning a form or accepting a second model call would
+ * strand the held call or route a secret through model context. Cancel posts a dismissal so
+ * the call wakes immediately instead of waiting for its TTL. askThenReport keeps the exchange
+ * open until the real save finishes; reusing the form URI replaces premature "Done." with its
+ * actual outcome. The host supplies the daemon's existing helper, never a second store.
+ */
+import { ToolInputError, redactSecrets, SURFACE_DISMISSED_PARAM, SURFACE_EXCHANGE_ID_PARAM, SURFACE_TYPED_ANSWER_PARAM, } from '@jini-ai/core';
+import { buildFormSurface } from './surfaces/form.js';
+import { buildOutcomeSurface } from './surfaces/outcome.js';
+/** Reject ambiguous or protocol-reserved names and runtime attempts to prefill secrets.
+ * @complexity O(n) time/space in the field count. Throws fixed ToolInputError text only. */
+function checkedFields(form) {
+    const names = new Set([SURFACE_EXCHANGE_ID_PARAM, SURFACE_DISMISSED_PARAM, SURFACE_TYPED_ANSWER_PARAM]);
+    for (const field of form.fields) {
+        if (!field.name || names.has(field.name))
+            throw new ToolInputError({ message: 'Secret card field names must be unique and cannot use exchange parameters.' });
+        names.add(field.name);
+        if (field.secret === true && field.value !== undefined)
+            throw new ToolInputError({ message: 'Secret fields cannot have a pre-filled value. Omit value.' });
+    }
+    // Snapshot policies before waiting: host mutation must not change which submitted fields are secret.
+    return form.fields.map(field => ({ ...field }));
+}
+/** Classify before persistence; an abort wins over an already-buffered answer.
+ * Trimming tests blankness only: rewriting a provider secret can corrupt intentional newlines.
+ * @complexity O(n + b) before save in fields and submitted secret bytes; failure text delegates
+ * to core's exact-secret redaction scan. Host persistence cost is external. */
+async function saveAnswer(required) {
+    const { answer, fields, prep, ctx, spec, options, exchangeId } = required;
+    if (ctx.signal.aborted)
+        return { status: 'abandoned' };
+    if (answer.status !== 'received')
+        return { status: answer.status };
+    if (answer.params[SURFACE_DISMISSED_PARAM] === true)
+        return { status: 'cancelled' };
+    const values = Object.fromEntries(fields.map(field => [field.name, answer.params[field.name]]));
+    const secrets = [];
+    for (const field of fields) {
+        if (field.secret !== true)
+            continue;
+        const value = values[field.name];
+        if (value !== undefined && typeof value !== 'string')
+            return { status: 'blank' };
+        const secret = typeof value === 'string' ? value : '';
+        if (secret.trim() === '' && (secret !== '' || field.allowBlank !== true))
+            return { status: 'blank' };
+        values[field.name] = secret;
+        secrets.push(secret);
+    }
+    if (ctx.signal.aborted)
+        return { status: 'abandoned' };
+    try {
+        return { status: 'saved', saved: await spec.save({ values, prep, signal: ctx.signal }) };
+    }
+    catch (error) {
+        if (ctx.signal.aborted)
+            return { status: 'abandoned' };
+        let safeMessage = options.text?.saveFailure ?? 'Saving failed. Nothing was saved.';
+        try {
+            safeMessage = options.safeError?.(error) ?? safeMessage;
+        }
+        catch { /* An error mapper must not disclose a second exception containing the submitted value. */ }
+        // Even an accidentally permissive allowlist must not echo the submitted secret.
+        safeMessage = redactSecrets({ input: safeMessage }, { exactSecrets: secrets });
+        try {
+            options.logFailure?.({ toolId: spec.toolId, exchangeId, saved: false });
+        }
+        catch { /* Logging must not replace the safe model result with an opaque logger exception. */ }
+        return { status: 'failed', safeMessage };
+    }
+}
+/**
+ * Define a secret card once; inject the exchange store and daemon askThenReport at composition.
+ * @param required - Domain fields, permission/target checks, save port and safe projections.
+ * @param options - Optional copy, error allowlist, fixed-metadata logger and resource framing.
+ * @returns Tool identity, dynamic secret-field metadata and a typed registry-compatible handler.
+ * @throws ToolInputError if the emitter is missing or fields violate the secret/routing contract.
+ * Prepare/transport failures propagate; save failures become a fixed safe outcome.
+ * @complexity O(n + h + b) locally in fields, rendered HTML and submitted secret bytes, plus host I/O.
+ * @example
+ * const tool = defineSecretCardTool(spec);
+ * registry.register({ descriptor, policy, handler: tool.handler({ surfaceExchanges, askThenReport }) });
+ */
+export function defineSecretCardTool(required, options = {}) {
+    const spec = required;
+    return {
+        toolId: spec.toolId,
+        secretFieldNames: prep => checkedFields(spec.form({ prep })).filter(field => field.secret === true).map(field => field.name),
+        handler: deps => async (ctx, optional = {}) => {
+            if (!optional.emitSurface)
+                throw new ToolInputError({ message: options.text?.noEmitter ?? `${spec.toolId}: this execution context has no interactive form channel (no emitSurface), so this form cannot be shown here. Nothing was changed.` });
+            const prep = await spec.prepare({ ctx });
+            if (ctx.signal.aborted)
+                return spec.result({ prep, run: { status: 'abandoned' } });
+            const form = spec.form({ prep });
+            const fields = checkedFields(form);
+            if (ctx.signal.aborted)
+                return spec.result({ prep, run: { status: 'abandoned' } });
+            const exchange = deps.surfaceExchanges.open({ binding: { toolId: spec.toolId, principalId: ctx.principal.id, channel: 'mcp-ui' }, emit: optional.emitSurface });
+            const closeOnAbort = () => exchange.close({});
+            ctx.signal.addEventListener('abort', closeOnAbort, { once: true });
+            try {
+                // Close the open/register race as well as the prepare/abort race.
+                if (ctx.signal.aborted)
+                    return spec.result({ prep, run: { status: 'abandoned' } });
+                const uri = `ui://${options.uriHost ?? 'jini'}/secret-card/${encodeURIComponent(spec.toolId)}/${encodeURIComponent(exchange.id)}`;
+                const framing = options.frameSize === undefined ? {} : { preferredFrameSize: options.frameSize };
+                const resource = buildFormSurface({ ...form, fields, uri, ...framing, toolName: spec.toolId,
+                    baseParams: { [SURFACE_EXCHANGE_ID_PARAM]: exchange.id },
+                    cancel: { label: form.cancelLabel ?? options.text?.cancelLabel ?? 'Cancel', toolName: spec.toolId,
+                        params: { [SURFACE_EXCHANGE_ID_PARAM]: exchange.id, [SURFACE_DISMISSED_PARAM]: true } },
+                });
+                return await deps.askThenReport({ exchange, confirmationEmission: { channel: 'mcp-ui', payload: { resource } },
+                    handle: async (answer) => {
+                        const run = await saveAnswer({ answer, fields, prep, ctx, spec, options, exchangeId: exchange.id });
+                        const result = spec.result({ prep, run });
+                        const outcome = spec.outcome({ prep, run });
+                        if (outcome === undefined)
+                            return { result };
+                        return { result, outcome: { channel: 'mcp-ui', payload: { resource: buildOutcomeSurface({ ...outcome, uri, ...framing }) } } };
+                    },
+                });
+            }
+            finally {
+                ctx.signal.removeEventListener('abort', closeOnAbort);
+                // Also covers rendering/projection failures before or inside askThenReport; close is idempotent.
+                exchange.close({});
+            }
+        },
+    };
+}
+//# sourceMappingURL=secret-card.js.map

package/dist/features/mcp-ui/surfaces/confirmation.js

@@ -209,6 +209,11 @@ ${SURFACE_SCRIPT_PRELUDE}
   }
   onVisibilityChange();
   document.addEventListener("visibilitychange", onVisibilityChange);
+  // Published Jini started the dwell during document.write. If the iframe is hidden then, no
+  // timer is armed; becoming visible by sandbox initialization need not send visibilitychange
+  // to that new document. Re-check at the bridge ready boundary, preserving the original
+  // visibility, dwell, trusted-click and single-call gates. whenReady is already in every bridge.
+  api.whenReady(onVisibilityChange);
 
   for (var i = 0; i < actionButtons.length; i++) {
     actionButtons[i].addEventListener("click", onClick);

package/dist/features/mcp-ui/surfaces/fields.d.ts

@@ -1,4 +1,5 @@
 import { type SelectOption } from './select.js';
+import { type SecretInputText } from './text-input.js';
 interface SurfaceFieldBase {
     /** HTML `name`, DOM `id` suffix, and the params key the value is posted under. */
     readonly name: string;
@@ -14,7 +15,8 @@ export interface StringField extends SurfaceFieldBase {
     readonly placeholder?: string;
     readonly multiline?: boolean;
     readonly rows?: number;
-    /** Renders as a masked `<input type="password">` — see {@link TextInputProps.secret}. */
+    /** Renders as a masked input or multiline textarea; pre-filled values are forbidden.
+     *  See {@link TextInputProps.secret}. */
     readonly secret?: boolean;
 }
 export interface NumberField extends SurfaceFieldBase {
@@ -60,10 +62,11 @@ export type SurfaceField = StringField | NumberField | BooleanField | EnumField
  * Renders the control fragment for one field, dispatching on its kind.
  *
  * @param field - See {@link SurfaceField}.
+ * @param text - Optional host translations for secret reveal controls.
  * @returns An HTML fragment.
  * @complexity O(n) in the rendered length.
  */
-export declare function renderFieldControl(field: SurfaceField): string;
+export declare function renderFieldControl(field: SurfaceField, text?: Partial<SecretInputText>): string;
 /** What the surface's inline script needs to read a field's value back and coerce it — the runtime half of {@link SurfaceField}, with the presentation stripped out. */
 export interface FieldReadSpec {
     readonly name: string;

package/dist/features/mcp-ui/surfaces/fields.js

@@ -32,14 +32,16 @@ function base(field) {
  * Renders the control fragment for one field, dispatching on its kind.
  *
  * @param field - See {@link SurfaceField}.
+ * @param text - Optional host translations for secret reveal controls.
  * @returns An HTML fragment.
  * @complexity O(n) in the rendered length.
  */
-export function renderFieldControl(field) {
+export function renderFieldControl(field, text) {
     switch (field.kind) {
         case 'string':
             return renderTextInput({
                 ...base(field),
+                ...text,
                 ...(field.value === undefined ? {} : { value: field.value }),
                 ...(field.placeholder === undefined ? {} : { placeholder: field.placeholder }),
                 ...(field.multiline === undefined ? {} : { multiline: field.multiline }),

package/dist/features/mcp-ui/surfaces/form.d.ts

@@ -28,8 +28,11 @@ import { type SurfaceDetail, type SurfaceStatusText } from './document.js';
 import { type SurfaceField } from './fields.js';
 import type { BridgeScriptSpec } from './bridge.js';
 import type { SurfaceTokenName } from './tokens.js';
+import { type SecretInputText } from './text-input.js';
 export interface FormSurfaceSpec {
     readonly title: string;
+    /** Resource framing carried through host form projections; ignored by HTML rendering. */
+    readonly preferredFrameSize?: readonly [string, string];
     readonly description?: string;
     /** Read-only context shown above the fields — what the input is *about*. */
     readonly details?: readonly SurfaceDetail[];
@@ -52,7 +55,7 @@ export interface FormSurfaceSpec {
         readonly toolName?: string;
         readonly params?: Readonly<Record<string, unknown>>;
     };
-    readonly text?: Partial<SurfaceStatusText>;
+    readonly text?: Partial<SurfaceStatusText & SecretInputText>;
     readonly app?: BridgeScriptSpec;
     readonly lang?: string;
     readonly tokens?: Partial<Record<SurfaceTokenName, string>>;

package/dist/features/mcp-ui/surfaces/form.js

@@ -27,6 +27,7 @@ import { createUIResource } from '../resource.js';
 import { escapeHtml, escapeJsValue } from '../escape.js';
 import { DEFAULT_SURFACE_STATUS_TEXT, SURFACE_SCRIPT_PRELUDE, renderActions, renderDetailList, renderStatusRegion, renderSurfaceDocument, renderSurfaceHeader, } from './document.js';
 import { renderFieldControl, toFieldReadSpecs } from './fields.js';
+import { DEFAULT_SECRET_INPUT_TEXT } from './text-input.js';
 const DEFAULT_APP = { appName: 'jini-mcp-ui-form', appVersion: '1' };
 /** The form element's id, fixed so the emitted script can find it without a fragile selector. */
 const FORM_ELEMENT_ID = 'mcpui-form';
@@ -38,7 +39,14 @@ const FORM_ELEMENT_ID = 'mcpui-form';
  * @complexity O(n) in the number of fields plus the rendered length.
  */
 export function renderFormDocument(spec) {
-    const text = { ...DEFAULT_SURFACE_STATUS_TEXT, ...spec.text };
+    // A base param with a secret field's name would leak the same value through the emitted script,
+    // even though the collected value overrides it at submit time. Reject that hidden prefill too.
+    for (const field of spec.fields) {
+        if (field.kind === 'string' && field.secret === true && spec.baseParams?.[field.name] !== undefined) {
+            throw new Error('Secret fields cannot have a pre-filled value. Omit value.');
+        }
+    }
+    const text = { ...DEFAULT_SURFACE_STATUS_TEXT, ...DEFAULT_SECRET_INPUT_TEXT, ...spec.text };
     // Not `type: 'submit'` — see the runtime script below for why a submit-typed button inside this
     // particular `<form>` cannot work at all in production.
     const actions = [
@@ -46,7 +54,9 @@ export function renderFormDocument(spec) {
     ];
     if (spec.cancel !== undefined)
         actions.push({ id: 'cancel', label: spec.cancel.label, variant: 'neutral' });
-    const controls = spec.fields.map(renderFieldControl).join('\n');
+    const controls = spec.fields
+        .map((field) => renderFieldControl(field, { showSecret: text.showSecret, hideSecret: text.hideSecret }))
+        .join('\n');
     const warning = spec.warning === undefined ? '' : `<p class="mcpui-warning">${escapeHtml(spec.warning)}</p>`;
     const bodyHtml = [
         renderSurfaceHeader(spec.description === undefined ? { title: spec.title } : { title: spec.title, description: spec.description }),
@@ -69,6 +79,57 @@ ${SURFACE_SCRIPT_PRELUDE}
   var TEXT = ${escapeJsValue(text)};
   var form = document.getElementById(${escapeJsValue(FORM_ELEMENT_ID)});
 
+  // A textarea normalizes CRLF/CR to LF even on .value assignment. Keep the original trusted paste
+  // privately, outside DOM/HTML, so multiline credentials reach the tool with their original bytes.
+  // An edit that changes the DOM value makes the snapshot ineligible; typed text then follows the
+  // native textarea value. Offsets count CRLF as one visible newline when a second paste replaces
+  // a selection, otherwise the original raw string would be spliced at the wrong position.
+  var secretPastes = new WeakMap();
+  function rawOffset(raw, visibleOffset) {
+    var rawIndex = 0;
+    var visibleIndex = 0;
+    while (rawIndex < raw.length && visibleIndex < visibleOffset) {
+      if (raw.charCodeAt(rawIndex) === 13 && raw.charCodeAt(rawIndex + 1) === 10) rawIndex++;
+      rawIndex++;
+      visibleIndex++;
+    }
+    return rawIndex;
+  }
+  form.addEventListener("paste", function (event) {
+    var control = event.target;
+    if (event.isTrusted !== true || !control || control.tagName !== "TEXTAREA" || !control.hasAttribute("data-mcpui-secret") || !event.clipboardData) return;
+    var pasted = event.clipboardData.getData("text/plain");
+    if (!pasted) return;
+    var snapshot = secretPastes.get(control);
+    var raw = snapshot && snapshot.normalized === control.value ? snapshot.raw : control.value;
+    var start = control.selectionStart;
+    var end = control.selectionEnd;
+    var next = raw.slice(0, rawOffset(raw, start)) + pasted + raw.slice(rawOffset(raw, end));
+    event.preventDefault();
+    control.value = next;
+    // Caret offsets use the displayed newline representation, independent of the saved raw text.
+    var caret = start + pasted.replace(/\\r\\n?/g, "\\n").length;
+    control.setSelectionRange(caret, caret);
+    secretPastes.set(control, { raw: next, normalized: control.value });
+    control.dispatchEvent(new Event("input", { bubbles: true }));
+  });
+
+  // A reveal button only changes presentation: replacing a textarea with a password input would
+  // discard line breaks. Listen on the form so clicks on the button's contents work too.
+  form.addEventListener("click", function (event) {
+    if (event.isTrusted !== true) return;
+    var target = event.target;
+    if (!target || typeof target.closest !== "function") return;
+    var button = target.closest("button[data-mcpui-secret-toggle]");
+    if (!button || button.disabled) return;
+    var control = document.getElementById(button.getAttribute("data-mcpui-secret-toggle"));
+    if (!control) return;
+    var reveal = button.getAttribute("aria-pressed") !== "true";
+    control.setAttribute("style", "-webkit-text-security: " + (reveal ? "none" : "disc") + ";");
+    button.setAttribute("aria-pressed", reveal ? "true" : "false");
+    button.textContent = button.getAttribute(reveal ? "data-mcpui-hide-secret" : "data-mcpui-show-secret");
+  });
+
   // form.elements[name] yields a RadioNodeList when several controls share a name and the BARE
   // element when only one does. A one-option checklist would otherwise read as "no options" —
   // silently, since a bare input has no length to iterate. Presence of "checked" is what tells the
@@ -88,7 +149,8 @@ ${SURFACE_SCRIPT_PRELUDE}
     if (field.kind === "multi-enum") return checkedValues(control);
     // Covers a radio-presented enum too: a RadioNodeList's own .value is the checked radio's
     // value, or "" when none is checked — the same shape a <select> reports.
-    return control.value;
+    var snapshot = secretPastes.get(control);
+    return snapshot && snapshot.normalized === control.value ? snapshot.raw : control.value;
   }
 
   function isBlank(field, value) {

package/dist/features/mcp-ui/surfaces/outcome.d.ts

@@ -48,6 +48,8 @@ import type { BridgeScriptSpec } from './bridge.js';
 import type { SurfaceTokenName } from './tokens.js';
 export interface SurfaceOutcomeSpec {
     readonly title: string;
+    /** Resource framing carried through host outcome projections; ignored by HTML rendering. */
+    readonly preferredFrameSize?: readonly [string, string];
     readonly description?: string;
     /** The facts of what actually happened — same shape as a confirmation's own `details`, but
      *  reporting the RESULT (e.g. the real URL, the real status) rather than what was proposed. */

package/dist/features/mcp-ui/surfaces/text-input.d.ts

@@ -1,8 +1,15 @@
-export interface TextInputProps {
+/** Labels the host can translate for a multiline secret's reveal toggle. */
+export interface SecretInputText {
+    readonly showSecret: string;
+    readonly hideSecret: string;
+}
+export declare const DEFAULT_SECRET_INPUT_TEXT: SecretInputText;
+export interface TextInputProps extends Partial<SecretInputText> {
     /** HTML `name`, DOM `id` suffix, and the params key the value is posted under. */
     readonly name: string;
     readonly label: string;
-    /** Pre-filled value. Numbers are stringified; `undefined` leaves the control empty. */
+    /** Pre-filled value. Numbers are stringified; `undefined` leaves the control empty.
+     *  Forbidden when `secret` is true, including an empty string. */
     readonly value?: string | number;
     readonly placeholder?: string;
     /** Help text, wired up with `aria-describedby`. */
@@ -11,10 +18,11 @@ export interface TextInputProps {
     readonly disabled?: boolean;
     /** `'number'` also constrains the on-screen keyboard on touch devices, which `'text'` would not. */
     readonly inputType?: 'text' | 'number';
-    /** Renders as `<input type="password">` — the value is never visible on screen, and browser
-     *  password managers may offer to remember it. Ignored when `inputType` is `'number'` (no such
-     *  thing as a masked number) and forces `multiline` off (no `<textarea type="password">` exists) —
-     *  same precedence `multiline`'s own doc comment already gives `inputType: 'number'`. */
+    /** Renders as `<input type="password">`, or a masked textarea with a show/hide toggle when
+     *  multiline. No `<textarea type="password">` exists, so multiline uses CSS text security.
+     *  Ignored for presentation when `inputType` is `'number'` (no such thing as a masked number) —
+     *  same precedence `multiline`'s own doc comment already gives `inputType: 'number'`.
+     *  A supplied value is always rejected: masking cannot protect a secret serialized into HTML. */
     readonly secret?: boolean;
     /** Renders a `<textarea>`. Ignored when `inputType` is `'number'` — there is no multiline number. */
     readonly multiline?: boolean;

package/dist/features/mcp-ui/surfaces/text-input.js

@@ -7,6 +7,7 @@
  */
 import { escapeHtml } from '../escape.js';
 import { fieldDescribedBy, fieldElementId, renderFieldLabel } from './document.js';
+export const DEFAULT_SECRET_INPUT_TEXT = { showSecret: 'Show', hideSecret: 'Hide' };
 function optionalAttribute(name, value) {
     if (value === undefined)
         return '';
@@ -36,6 +37,11 @@ function resolveInputType(props) {
  * @complexity O(n) in the rendered length.
  */
 export function renderTextInput(props) {
+    // Even an empty prefill is forbidden: callers must omit value so a stored credential can never
+    // enter the resource's HTML. Keep this error fixed, without the field name or rejected value.
+    if (props.secret === true && props.value !== undefined) {
+        throw new Error('Secret fields cannot have a pre-filled value. Omit value.');
+    }
     const id = fieldElementId(props.name);
     const common = ` id="${escapeHtml(id)}" name="${escapeHtml(props.name)}"` +
         optionalAttribute('placeholder', props.placeholder) +
@@ -44,8 +50,16 @@ export function renderTextInput(props) {
         fieldDescribedBy(props);
     const type = resolveInputType(props);
     const isNumber = type === 'number';
-    const control = props.multiline === true && type === 'text'
-        ? `<textarea class="mcpui-textarea"${common}${optionalAttribute('rows', props.rows)}>${props.value === undefined ? '' : escapeHtml(String(props.value))}</textarea>`
+    const secretMultiline = props.secret === true && props.multiline === true && !isNumber;
+    const control = props.multiline === true && !isNumber
+        ? `<textarea class="mcpui-textarea"${common}${optionalAttribute('rows', props.rows)}` +
+            // Password inputs strip line breaks. CSS masking keeps the textarea's actual value intact,
+            // and disables browser text assistance that could retain or alter a pasted credential.
+            (secretMultiline ? ' data-mcpui-secret style="-webkit-text-security: disc;" autocomplete="off" spellcheck="false"' : '') +
+            `>${props.value === undefined ? '' : escapeHtml(String(props.value))}</textarea>` +
+            (secretMultiline
+                ? `<button type="button" class="mcpui-button" data-mcpui-secret-toggle="${escapeHtml(id)}" data-mcpui-show-secret="${escapeHtml(props.showSecret ?? DEFAULT_SECRET_INPUT_TEXT.showSecret)}" data-mcpui-hide-secret="${escapeHtml(props.hideSecret ?? DEFAULT_SECRET_INPUT_TEXT.hideSecret)}" aria-controls="${escapeHtml(id)}" aria-pressed="false"${booleanAttribute('disabled', props.disabled)}>${escapeHtml(props.showSecret ?? DEFAULT_SECRET_INPUT_TEXT.showSecret)}</button>`
+                : '')
         : `<input class="mcpui-input" type="${type}"${common}` +
             optionalAttribute('value', props.value) +
             // A stored secret (e.g. a cloud provider's access key or a database password) must never be

package/dist/features/mcp-ui/surfaces/tokens.js

@@ -1,4 +1,4 @@
-import { defaultAdminTheme } from '../../../theme/default.js';
+import { defaultAdminTheme } from '../../../core/theme/default.js';
 /**
  * @module features/mcp-ui/surfaces/tokens
  *

package/dist/features/memory/react/components/MemoryConnectedPanel.d.ts

@@ -1,4 +1,4 @@
-import { type Connector, type ConnectorStatusMap } from '../../../connectors/types.js';
+import type { Connector, ConnectorStatusMap } from '../../../connectors/types.js';
 import type { ConnectorMemoryAttempt, MemoryExtractionRecord, MemorySuggestion } from '../../types.js';
 export declare function MemoryConnectedPanel({ enabled, onOpenConnectors, connectorStatuses, connectorsLoading, connectedCount, selectedConnectorIds, selectedConnectedConnectorIds, connectingConnectorIds, pendingConnectorAuthIds, connectorConnectErrors, connectorIdsWithDetails, connectorExtracting, connectorSaving, connectorScanLabel, connectorSuggestions, selectedSuggestionIds, selectedConnectorSuggestions, connectorStatus, connectorError, connectorLoadError, connectorAttempts, connectorContextBytes, connectorExtractions, memoryConnectors, toggleConnectorSelection, onConnectMemoryConnector, toggleConnectorSuggestion, onSuggestConnectorMemory, onSaveConnectorSuggestions, onDiscardConnectorSuggestions, nowClock, onOpenPreview, onDeleteExtraction, }: {
     enabled: boolean;

package/dist/features/memory/react/components/MemoryConnectedPanel.js

@@ -9,7 +9,6 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // concern was already dropped when the connectors canary shipped; a host
 // resolving theme-swapped logo URLs does so before handing `logoUrl` in).
 import { useMemo } from 'react';
-import {} from '../../../connectors/types.js';
 import { connectorAttemptDetail, connectorAttemptTitle, formatConnectorContextBytes, memoryTypeLabels, } from '../../formatters.js';
 import { ConnectorLogo } from '../../../connectors/index.js';
 import { Icon } from '../../../../react/components/Icon.js';

package/dist/features/panel-kit/helpers/format-timestamp.d.ts

@@ -1,11 +1,13 @@
 /**
- * Centralize the historical fixed-width display so formatting changes have one owner. Preserve
- * the stored timestamp's prefix byte for byte: no parsing, locale formatting or timezone conversion.
+ * Centralize the fixed-width display so formatting changes have one owner. The default
+ * preserves the stored timestamp's prefix byte for byte, without parsing or timezone conversion.
  * Trailing seconds, milliseconds and zone suffix are intentionally dropped; callers supply ISO text.
  */
-/** Render the ISO prefix as YYYY-MM-DD HH:MM without timezone conversion. */
+/** Render YYYY-MM-DD HH:MM; hosts can select the viewer's local timezone explicitly. */
 export declare function formatTimestamp({ iso }: {
     iso: string;
+}, { timeZone }?: {
+    timeZone?: "stored" | "local";
 }): string;
 /** Inject 'now' to keep relative-time display deterministic. The fallback wording uses simple
  * English singular/plural templates; hosts can translate them, but this is not full locale pluralization. */

package/dist/features/panel-kit/helpers/format-timestamp.js

@@ -1,10 +1,19 @@
 /**
- * Centralize the historical fixed-width display so formatting changes have one owner. Preserve
- * the stored timestamp's prefix byte for byte: no parsing, locale formatting or timezone conversion.
+ * Centralize the fixed-width display so formatting changes have one owner. The default
+ * preserves the stored timestamp's prefix byte for byte, without parsing or timezone conversion.
  * Trailing seconds, milliseconds and zone suffix are intentionally dropped; callers supply ISO text.
  */
-/** Render the ISO prefix as YYYY-MM-DD HH:MM without timezone conversion. */
-export function formatTimestamp({ iso }) {
+/** Render YYYY-MM-DD HH:MM; hosts can select the viewer's local timezone explicitly. */
+export function formatTimestamp({ iso }, { timeZone = "stored" } = {}) {
+    if (timeZone === "local") {
+        // A stored UTC prefix can label server time as viewer time (Tovu D-06). Local getters
+        // follow the browser's timezone and DST; zone-less ISO is already local wall time.
+        const date = new Date(iso);
+        if (Number.isNaN(date.getTime()))
+            return iso; // Keep malformed source data visible.
+        const pad = (value) => String(value).padStart(2, "0");
+        return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
+    }
     return iso.slice(0, 16).replace("T", " ");
 }
 /** Inject 'now' to keep relative-time display deterministic. The fallback wording uses simple

package/dist/features/panel-kit/helpers/permissions.js

@@ -1,3 +1,5 @@
+// ADR-021: GET /auth/me flattens effectivePermissions, losing resourceType/constraintJson.
+// ADR-006 keeps one server evaluator; every mutation and tool call must be rechecked there.
 /** UI affordance check for exact grants or the literal * wildcard; server authorization remains host-owned. */
 /**
  * A flattened permission list has lost resource scopes and constraints. Treating '*' as an ordinary