@jini-ai/ui 0.4.4 → 0.4.6

package/dist/features/execution/react/hooks/use-execution-credential.hooks.js

@@ -0,0 +1,217 @@
+import { useEffect, useRef, useState } from "react";
+import { useSerialWrites } from "../../../panel-kit/hooks/use-serial-writes.hooks.js";
+import { useSettlementGeneration } from "../../../panel-kit/hooks/use-settlement-generation.hooks.js";
+/**
+ * @complexity Time: O(1) per call — one GET on mount, one PUT per explicit save/migrate. Space:
+ * O(1) — no caller-controlled collections.
+ */
+export function useExecutionCredential({ byok, onByokChange, locale, port, effects }, _options = {}) {
+    const [stored, setStored] = useState(null);
+    const [saveState, setSaveState] = useState({ status: "idle" });
+    const [settingsSaveState, setSettingsSaveState] = useState({ status: "idle" });
+    const [legacyKey, setLegacyKey] = useState(null);
+    const [legacyDismissed, setLegacyDismissed] = useState(false);
+    // The operator's latest `byok`/`onByokChange`, read back by `saveKey` AFTER its await — never the
+    // `byok` its own closure captured at button-press time. Without this, a provider chip click, a
+    // model edit, or a newly typed key made while a key save was in flight was reverted to the
+    // click-time config the instant the response landed, and the ledger slice then autosaved that
+    // revert (S1). Assigning a ref during render is the same idiom `use-visitor-credential-
+    // form.hooks.ts`'s `apiRef` uses for the identical reason.
+    const inputRef = useRef({ byok, onByokChange });
+    inputRef.current = { byok, onByokChange };
+    // The server rebuilds every write from the row it read when the request arrived
+    // (`execution-credential-store.ts`'s `setExecutionCredential`: read -> seal -> upsert the WHOLE
+    // merged record), so a key save, a settings save and a migration in flight together each merge
+    // over the same stale row and the later upsert reverts the other's fields — both still answer
+    // 200. Chained, each write reads what the one before it actually wrote. Tab-local only: two tabs,
+    // or the Settings and AI Assistant mounts in two different browser windows, can still race — that
+    // needs a server-side concurrency check (see the plan's "Needs owner decision" section). Same
+    // shared lane `use-visitor-credential-form.hooks.ts` (`8ac256353`) and
+    // `use-other-credentials.hooks.ts` queue their own credential writes through.
+    const writes = useSerialWrites();
+    // Guards `setStored` against an out-of-order read: the mount GET, the post-save refresh GET, and
+    // each write's own response are all independent round trips with no ordering between them. A slow
+    // mount GET that resolves after a save (or after the save's own refresh) must not overwrite the
+    // fresher view those already installed — see F2 in plan-components.md (2026-09-20). Only `setStored`
+    // is guarded; `setSaveState`/`setSettingsSaveState`, `clearLegacyLocalCredential`, `setLegacyKey`
+    // and `publishSettingsRefresh` all belong to the button that called them and the write really did
+    // happen, so none of those are stale just because a later call also started.
+    const storedSettlement = useSettlementGeneration();
+    // A write's own response is the freshest view of the row this mount has at the instant it lands,
+    // so it mints its generation THEN — after the await, and only on success — superseding any read
+    // still in flight, and installs unconditionally. Minting before the PUT instead let a FAILED
+    // write (which learned nothing about the row) strand a slower read that was still coming back:
+    // `stored` then stayed at its pre-load value until some unrelated refresh ran. Unlike
+    // `useSerialWrites`' own "mint before `run`" rule, this generation orders RESPONSES by arrival,
+    // not button presses by intent — nothing here is a "which click owns the UI" decision.
+    function installWrittenView(view) {
+        storedSettlement.next();
+        setStored(view);
+    }
+    // Hydrate the stored view, on mount AND whenever another mount (or `AssistantDock`'s own separate
+    // copy) publishes a change to this same server row — see this file's "Cross-mount staleness" doc
+    // above. Silent on failure, same posture `use-visitor-credential-form.hooks.ts` takes for its own
+    // GET: a failed read must not put an error next to a key field the operator has not touched yet,
+    // and the only visible consequence is that the "already stored" affordances stay at whatever they
+    // last held until a refresh works.
+    useEffect(() => {
+        let cancelled = false;
+        const refresh = () => {
+            const generation = storedSettlement.next();
+            port
+                .loadAdminExecutionCredential({}, {})
+                .then((view) => {
+                if (!cancelled && storedSettlement.isCurrent({ generation }))
+                    setStored(view);
+            })
+                .catch(() => undefined);
+        };
+        refresh();
+        // `scope` is `null` ("refresh everything") or the list of namespaces a publisher named — narrow
+        // to this credential's own namespace so an unrelated slice's save does not trigger a pointless
+        // refetch here, matching `useSettingsSlice`'s identical narrowing.
+        const unsubscribe = effects.refreshPort.subscribe({ listener: (scope) => {
+                if (scope && !scope.includes(effects.namespace))
+                    return;
+                refresh();
+            } }, {});
+        return () => {
+            cancelled = true;
+            unsubscribe();
+        };
+        // `port` is referentially stable in production (`useWiredAdminExecutionCredential` always passes
+        // the same module-level singleton), so adding it changes nothing about when this effect re-runs —
+        // it is here only because it is now a function-scoped value ESLint's exhaustive-deps rule can see,
+        // where the old `loadAdminExecutionCredential` import was invisible to that rule.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [port, effects]);
+    // Offer the migration prompt only once the server's own state is known AND nothing is already
+    // stored there — an admin who already has a server-side credential (migrated earlier, or just
+    // saved fresh this session) gets no benefit from being asked to migrate a now-superseded local
+    // value, and re-asking would read as the screen not noticing its own save.
+    useEffect(() => {
+        if (stored === null)
+            return;
+        setLegacyKey(stored.isSet ? null : effects.readLegacyCredential({}, {}));
+    }, [stored, effects]);
+    function saveKey() {
+        const apiKey = byok.apiKey.trim();
+        // The BUTTON's rule, applied again here so a blank field cannot reach the server even through a
+        // direct call. Deliberately NOT `hasUsableAdminKey`: a stored key makes the credential usable,
+        // not the empty field writable. See `hasTypedAdminKey`'s own doc for the bug that distinction fixes.
+        // OUTSIDE the write chain on purpose: a no-op call must never queue a link that would only hold
+        // up the migrate/settings writes behind it for nothing.
+        if (!effects.hasTypedKey({ apiKey }, {}))
+            return Promise.resolve(); // nothing typed — there is no key to write
+        // Set synchronously, at call time, so a press queued behind another write shows "Saving…"
+        // immediately rather than sitting at "idle" until its turn on the chain arrives.
+        setSaveState({ status: "saving" });
+        return writes.run({ task: async () => {
+                try {
+                    // The key ALONE. Every other field is `saveSettings`'s, and building the patch from one
+                    // literal (rather than spreading `byok` and deleting) is what makes that readable at a glance
+                    // — there is no branch here that could let another field through.
+                    const patch = { apiKey };
+                    const view = await port.saveAdminExecutionCredential({ patch }, {});
+                    installWrittenView(view);
+                    setSaveState({ status: "saved" });
+                    // Tells every other mounted copy of this credential (the other settings screen, the dock) to
+                    // re-read — see this file's "Cross-mount staleness" doc above.
+                    effects.refreshPort.publish({ namespaces: [effects.namespace] }, {});
+                    // Clear the field once the key is safely stored — see this file's `onByokChange` doc. Reads
+                    // the LATEST input, not the `byok`/`onByokChange` this closure captured at button-press time
+                    // (S1 above), and only actually clears when the field still holds exactly the key that was
+                    // just saved — otherwise the operator has since typed something new, and clearing it would
+                    // discard that unsaved edit instead of the key this save actually persisted.
+                    const latestInput = inputRef.current;
+                    if (latestInput.byok.apiKey.trim() === apiKey) {
+                        latestInput.onByokChange({ ...latestInput.byok, apiKey: "" });
+                    }
+                }
+                catch (error) {
+                    setSaveState({ status: "error", message: effects.describeError({ error, fallback: "failed to save the key" }, {}) });
+                }
+            } });
+    }
+    function saveSettings() {
+        setSettingsSaveState({ status: "saving" });
+        return writes.run({ task: async () => {
+                try {
+                    // No `apiKey` key at all, under any condition — see this controller's `saveSettings` doc. The
+                    // field's contents are not consulted here, so there is no state of the form in which this
+                    // patch can grow one.
+                    const patch = {
+                        protocol: byok.protocol,
+                        providerId: byok.providerId,
+                        baseUrl: byok.baseUrl,
+                        model: byok.model,
+                        ...(byok.maxTokens !== undefined ? { maxTokens: byok.maxTokens } : {}),
+                    };
+                    const view = await port.saveAdminExecutionCredential({ patch }, {});
+                    installWrittenView(view);
+                    setSettingsSaveState({ status: "saved" });
+                    effects.refreshPort.publish({ namespaces: [effects.namespace] }, {});
+                }
+                catch (error) {
+                    setSettingsSaveState({
+                        status: "error",
+                        message: effects.describeError({ error, fallback: "failed to save the settings" }, {}),
+                    });
+                }
+            } });
+    }
+    function migrateLegacyKey() {
+        if (!legacyKey)
+            return Promise.resolve();
+        setSaveState({ status: "saving" });
+        return writes.run({ task: async () => {
+                try {
+                    const patch = {
+                        apiKey: legacyKey,
+                        protocol: byok.protocol,
+                        providerId: byok.providerId,
+                        baseUrl: byok.baseUrl,
+                        model: byok.model,
+                        ...(byok.maxTokens !== undefined ? { maxTokens: byok.maxTokens } : {}),
+                    };
+                    const view = await port.saveAdminExecutionCredential({ patch }, {});
+                    // Clear the local copy ONLY after the PUT above has actually resolved successfully — the
+                    // design's explicit ordering requirement (§6: "only after that PUT succeeds does the code
+                    // clear the localStorage entry"). A throw above skips every line from here down, so a failed
+                    // migration leaves both the local key AND `legacyKey` state untouched — the prompt stays up
+                    // and the admin can retry or decline.
+                    effects.clearLegacyCredential({}, {});
+                    installWrittenView(view);
+                    setLegacyKey(null);
+                    setSaveState({ status: "saved" });
+                    // Same cross-mount notification `saveKey` above sends — a migration is a write to the same row.
+                    effects.refreshPort.publish({ namespaces: [effects.namespace] }, {});
+                }
+                catch (error) {
+                    setSaveState({ status: "error", message: effects.describeError({ error, fallback: "failed to save the migrated key" }, {}) });
+                }
+            } });
+    }
+    function dismissLegacyPrompt() {
+        setLegacyDismissed(true);
+    }
+    // All three read the form's CURRENT endpoint, so they follow a provider switch on the same render.
+    const storedKeyIsForOtherEndpoint = effects.storedKeyIsForOtherEndpoint({ stored, baseUrl: byok.baseUrl }, {});
+    const apiKeyPlaceholder = effects.credentialHint({ stored, storedKeyIsForOtherEndpoint }, { locale });
+    return {
+        stored,
+        apiKeyStoredExternally: effects.hasUsableKey({ apiKey: byok.apiKey, stored, baseUrl: byok.baseUrl }, {}),
+        apiKeyPlaceholder,
+        storedKeyIsForOtherEndpoint,
+        canDiscoverModels: !effects.storedKeyBlocksProbe({ apiKey: byok.apiKey, stored, baseUrl: byok.baseUrl }, {}),
+        saveState,
+        settingsSaveState,
+        canSaveKey: effects.hasTypedKey({ apiKey: byok.apiKey }, {}),
+        saveKey,
+        saveSettings,
+        legacyKey: legacyDismissed ? null : legacyKey,
+        migrateLegacyKey,
+        dismissLegacyPrompt,
+    };
+}
+//# sourceMappingURL=use-execution-credential.hooks.js.map

package/dist/features/html-editor/canvas-style.d.ts

@@ -1,4 +1,4 @@
-import type { AdminTheme, ColorScheme } from '../../theme/types.js';
+import type { AdminTheme, ColorScheme } from '../../core/theme/types.js';
 /**
  * @file Builds the `canvas.frameStyle` GrapesJS injects into its editing canvas, so a host that
  * supplies its own canvas styling is not silently overruled by GrapesJS's own defaults.

package/dist/features/html-editor/canvas-style.js

@@ -1,5 +1,5 @@
-import { defaultAdminTheme } from '../../theme/default.js';
-import { renderAdminThemeVariables } from '../../theme/stylesheet.js';
+import { defaultAdminTheme } from '../../core/theme/default.js';
+import { renderAdminThemeVariables } from '../../core/theme/stylesheet.js';
 /** GrapesJS's own default scrollbar chrome for the canvas, restated verbatim from its
  *  `canvas.frameStyle` default so overriding that option does not silently drop it. */
 const CANVAS_SCROLLBAR_STYLE = [

package/dist/features/i18n/dictionaries/settings-dialog.ar.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_AR = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "أزلت من رسالتك ما بدا كمفتاح. إن كان حقيقيًا، فاستبدله. استخدم النموذج الآمن لحفظه.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "استخدم النموذج الآمن لحفظ المفاتيح والرموز وكلمات المرور والأسرار. تُرسل إجابات الدردشة إلى المساعد.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# مهارتي\n\n1. اشرح سير العمل.\n2. صف المدخلات والمخرجات.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'لم يعمل مسار مخصص بديل، لذلك استُخدم الملف التنفيذي الذي تم اكتشافه تلقائيًا بدلاً منه.',
     'API key': 'مفتاح API',

package/dist/features/i18n/dictionaries/settings-dialog.bn.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_BN = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "আপনার বার্তা থেকে কী বলে মনে হওয়া অংশটি সরিয়ে দিয়েছি। সেটি আসল হলে বদলে ফেলুন। সংরক্ষণ করতে নিরাপদ ফর্ম ব্যবহার করুন।",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "কী, টোকেন, পাসওয়ার্ড ও গোপন তথ্য সংরক্ষণ করতে নিরাপদ ফর্ম ব্যবহার করুন। চ্যাটের উত্তর সহকারীকে পাঠানো হয়।",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# আমার স্কিল\n\n1. ওয়ার্কফ্লো ব্যাখ্যা করুন।\n2. ইনপুট এবং আউটপুট বর্ণনা করুন।',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'একটি কাস্টম পাথ ওভাররাইড কাজ করেনি, তাই এর পরিবর্তে স্বয়ংক্রিয়ভাবে শনাক্ত করা বাইনারি ব্যবহার করা হয়েছে।',
     'API key': 'API কী',

package/dist/features/i18n/dictionaries/settings-dialog.de.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_DE = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Ich habe aus deiner Nachricht entfernt, was wie ein Schlüssel aussah. Falls er echt war, ersetze ihn. Speichere ihn über das sichere Formular.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Speichere Schlüssel, Tokens, Passwörter und Geheimnisse über das sichere Formular. Chatantworten werden an den Assistenten gesendet.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Meine Skill\n\n1. Erkläre den Workflow.\n2. Beschreibe die Eingaben und Ausgaben.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Eine benutzerdefinierte Pfadüberschreibung hat nicht funktioniert, daher wurde stattdessen die automatisch erkannte Binärdatei verwendet.',
     'API key': 'API-Schlüssel',

package/dist/features/i18n/dictionaries/settings-dialog.en.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_EN = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'A custom path override did not work, so this used the automatically detected binary instead.',
     'API key': 'API key',

package/dist/features/i18n/dictionaries/settings-dialog.es.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_ES = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "He eliminado de tu mensaje lo que parecía una clave. Si era real, cámbiala. Usa el formulario seguro para guardarla.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Usa el formulario seguro para guardar claves, tokens, contraseñas y secretos. Las respuestas del chat se envían al asistente.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Mi skill\n\n1. Explica el flujo de trabajo.\n2. Describe las entradas y salidas.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Una ruta personalizada no funcionó, así que se usó en su lugar el binario detectado automáticamente.',
     'API key': 'Clave de API',

package/dist/features/i18n/dictionaries/settings-dialog.fa.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_FA = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "متنی را که شبیه کلید بود از پیامتان حذف کردم. اگر واقعی بود، آن را تعویض کنید. برای ذخیره از فرم امن استفاده کنید.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "برای ذخیره کلیدها، توکن‌ها، گذرواژه‌ها و اطلاعات محرمانه از فرم امن استفاده کنید. پاسخ‌های گفتگو به دستیار فرستاده می‌شوند.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# مهارت من\n\n1. گردش کار را توضیح دهید.\n2. ورودی‌ها و خروجی‌ها را شرح دهید.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'مسیر سفارشی جایگزین کار نکرد، بنابراین به‌جای آن از فایل اجرایی شناسایی‌شده به‌طور خودکار استفاده شد.',
     'API key': 'کلید API',

package/dist/features/i18n/dictionaries/settings-dialog.fr.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_FR = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "J’ai supprimé de votre message ce qui ressemblait à une clé. Si elle était réelle, remplacez-la. Utilisez le formulaire sécurisé pour l’enregistrer.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Utilisez le formulaire sécurisé pour enregistrer les clés, jetons, mots de passe et secrets. Les réponses du chat sont envoyées à l’assistant.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Ma compétence\n\n1. Expliquez le déroulement.\n2. Décrivez les entrées et sorties.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Le chemin personnalisé n\'a pas fonctionné ; le binaire détecté automatiquement a donc été utilisé à la place.',
     'API key': 'Clé API',

package/dist/features/i18n/dictionaries/settings-dialog.hi.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_HI = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "मैंने आपके संदेश से कुंजी जैसा दिखने वाला हिस्सा हटा दिया है। अगर वह असली कुंजी थी, तो उसे बदलें। उसे सहेजने के लिए सुरक्षित फ़ॉर्म का उपयोग करें।",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "कुंजियाँ, टोकन, पासवर्ड और गोपनीय जानकारी सहेजने के लिए सुरक्षित फ़ॉर्म का उपयोग करें। चैट के उत्तर सहायक को भेजे जाते हैं।",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# मेरी स्किल\n\n1. वर्कफ़्लो के बारे में बताएं।\n2. इनपुट और आउटपुट के बारे में बताएं।',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'एक कस्टम पाथ ओवरराइड काम नहीं कर सका, इसलिए इसके बजाय स्वचालित रूप से पहचानी गई बाइनरी का उपयोग किया गया।',
     'API key': 'API कुंजी',

package/dist/features/i18n/dictionaries/settings-dialog.hu.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_HU = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Eltávolítottam az üzenetedből azt, ami kulcsnak tűnt. Ha valódi volt, cseréld le. A biztonságos űrlapon mentsd el.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "A kulcsokat, tokeneket, jelszavakat és titkokat a biztonságos űrlapon mentsd el. A chatválaszokat elküldjük az asszisztensnek.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Saját képességem\n\n1. Írd le a munkafolyamatot.\n2. Írd le a bemeneteket és a kimeneteket.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Az egyéni útvonal felülbírálása nem működött, ezért ez az automatikusan felismert binárist használta helyette.',
     'API key': 'API-kulcs',

package/dist/features/i18n/dictionaries/settings-dialog.id.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_ID = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Saya menghapus teks yang tampak seperti kunci dari pesan Anda. Jika itu kunci asli, gantilah. Gunakan formulir aman untuk menyimpannya.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Gunakan formulir aman untuk menyimpan kunci, token, kata sandi, dan rahasia. Jawaban chat dikirim ke asisten.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Skill saya\n\n1. Jelaskan alur kerjanya.\n2. Jelaskan input dan outputnya.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Penggantian jalur kustom tidak berhasil, jadi ini menggunakan biner yang terdeteksi otomatis sebagai gantinya.',
     'API key': 'Kunci API',

package/dist/features/i18n/dictionaries/settings-dialog.it.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_IT = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Ho rimosso dal messaggio ciò che sembrava una chiave. Se era reale, sostituiscila. Usa il modulo sicuro per salvarla.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Usa il modulo sicuro per salvare chiavi, token, password e segreti. Le risposte nella chat vengono inviate all’assistente.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# La mia competenza\n\n1. Spiega il flusso di lavoro.\n2. Descrivi gli input e gli output.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Il percorso personalizzato specificato non ha funzionato, quindi è stato usato il binario rilevato automaticamente.',
     'API key': 'Chiave API',

package/dist/features/i18n/dictionaries/settings-dialog.ja.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_JA = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "メッセージからキーと思われる文字列を削除しました。本物のキーだった場合は再発行してください。保存には安全なフォームを使ってください。",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "キー、トークン、パスワード、シークレットの保存には安全なフォームを使ってください。チャットの回答はアシスタントに送信されます。",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# マイスキル\n\n1. ワークフローを説明してください。\n2. 入力と出力を説明してください。',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'カスタムパスの上書きが機能しなかったため、自動検出されたバイナリを代わりに使用しました。',
     'API key': 'APIキー',

package/dist/features/i18n/dictionaries/settings-dialog.ko.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_KO = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "메시지에서 키로 보이는 내용을 제거했습니다. 실제 키였다면 교체하세요. 저장하려면 보안 양식을 사용하세요.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "키, 토큰, 비밀번호, 비밀 정보를 저장하려면 보안 양식을 사용하세요. 채팅 답변은 어시스턴트에게 전송됩니다.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# 내 스킬\n\n1. 워크플로를 설명하세요.\n2. 입력과 출력을 설명하세요.',
     'A custom path override did not work, so this used the automatically detected binary instead.': '사용자 지정 경로 재정의가 작동하지 않아 자동으로 감지된 바이너리를 대신 사용했습니다.',
     'API key': 'API 키',

package/dist/features/i18n/dictionaries/settings-dialog.pl.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_PL = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Usunąłem z wiadomości tekst, który wyglądał jak klucz. Jeśli był prawdziwy, wymień go. Zapisz go za pomocą bezpiecznego formularza.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Użyj bezpiecznego formularza do zapisywania kluczy, tokenów, haseł i sekretów. Odpowiedzi na czacie są wysyłane do asystenta.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Moja umiejętność\n\n1. Opisz przebieg pracy.\n2. Opisz dane wejściowe i wyjściowe.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Niestandardowa ścieżka nie zadziałała, więc użyto automatycznie wykrytego pliku binarnego.',
     'API key': 'Klucz API',

package/dist/features/i18n/dictionaries/settings-dialog.pt-BR.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_PT_BR = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Removi da sua mensagem o que parecia ser uma chave. Se era real, substitua-a. Use o formulário seguro para salvá-la.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Use o formulário seguro para salvar chaves, tokens, senhas e segredos. As respostas do chat são enviadas ao assistente.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Minha skill\n\n1. Explique o fluxo de trabalho.\n2. Descreva as entradas e saídas.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Uma substituição de caminho personalizado não funcionou, então foi usado o binário detectado automaticamente.',
     'API key': 'Chave de API',

package/dist/features/i18n/dictionaries/settings-dialog.ru.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_RU = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Я удалил из сообщения то, что было похоже на ключ. Если он настоящий, замените его. Сохраните его через защищённую форму.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Используйте защищённую форму для сохранения ключей, токенов, паролей и секретов. Ответы в чате отправляются ассистенту.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Мой навык\n\n1. Опишите рабочий процесс.\n2. Опишите входные и выходные данные.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Переопределение пользовательского пути не сработало, поэтому был использован автоматически обнаруженный бинарный файл.',
     'API key': 'Ключ API',

package/dist/features/i18n/dictionaries/settings-dialog.th.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_TH = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "ฉันลบข้อความที่ดูเหมือนคีย์ออกจากข้อความของคุณแล้ว หากเป็นคีย์จริง ให้เปลี่ยนคีย์ใหม่ ใช้แบบฟอร์มที่ปลอดภัยเพื่อบันทึก",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "ใช้แบบฟอร์มที่ปลอดภัยเพื่อบันทึกคีย์ โทเค็น รหัสผ่าน และข้อมูลลับ คำตอบในแชตจะถูกส่งไปยังผู้ช่วย",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# ทักษะของฉัน\n\n1. อธิบายขั้นตอนการทำงาน\n2. อธิบายข้อมูลนำเข้าและผลลัพธ์',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'การกำหนดพาธที่กำหนดเองไม่สำเร็จ จึงใช้ไบนารีที่ตรวจพบโดยอัตโนมัติแทน',
     'API key': 'คีย์ API',

package/dist/features/i18n/dictionaries/settings-dialog.tr.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_TR = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Mesajınızdan anahtara benzeyen metni kaldırdım. Gerçekse yenileyin. Kaydetmek için güvenli formu kullanın.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Anahtarları, tokenları, parolaları ve gizli bilgileri kaydetmek için güvenli formu kullanın. Sohbet yanıtları asistana gönderilir.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Becerim\n\n1. İş akışını açıkla.\n2. Girdileri ve çıktıları tanımla.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Özel bir yol geçersiz kılması işe yaramadı, bu yüzden bunun yerine otomatik olarak algılanan ikili dosya kullanıldı.',
     'API key': 'API anahtarı',

package/dist/features/i18n/dictionaries/settings-dialog.uk.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_UK = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "Я видалив із повідомлення те, що було схоже на ключ. Якщо він справжній, замініть його. Збережіть його через захищену форму.",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "Використовуйте захищену форму для збереження ключів, токенів, паролів і секретів. Відповіді в чаті надсилаються асистенту.",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# Моя навичка\n\n1. Опишіть робочий процес.\n2. Опишіть вхідні та вихідні дані.',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'Користувацький шлях не спрацював, тому натомість було використано автоматично визначений виконуваний файл.',
     'API key': 'Ключ API',

package/dist/features/i18n/dictionaries/settings-dialog.ur.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_UR = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "میں نے آپ کے پیغام سے وہ متن ہٹا دیا جو کلید جیسا لگ رہا تھا۔ اگر وہ حقیقی تھی تو اسے تبدیل کریں۔ محفوظ کرنے کے لیے محفوظ فارم استعمال کریں۔",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "کلیدیں، ٹوکن، پاس ورڈ اور راز محفوظ کرنے کے لیے محفوظ فارم استعمال کریں۔ چیٹ کے جوابات اسسٹنٹ کو بھیجے جاتے ہیں۔",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# میری اسکل\n\n1. ورک فلو کی وضاحت کریں۔\n2. ان پٹس اور آؤٹ پٹس بیان کریں۔',
     'A custom path override did not work, so this used the automatically detected binary instead.': 'ایک کسٹم پاتھ اوور رائیڈ کام نہیں کر سکا، اس لیے اس کے بجائے خودکار طور پر شناخت شدہ بائنری استعمال کی گئی۔',
     'API key': 'API کلید',

package/dist/features/i18n/dictionaries/settings-dialog.zh-CN.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_ZH_CN = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "我已从你的消息中移除疑似密钥的内容。如果是真实密钥，请更换它。请使用安全表单保存。",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "请使用安全表单保存密钥、令牌、密码和机密信息。聊天回答会发送给助手。",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# 我的技能\n\n1. 说明工作流程。\n2. 描述输入和输出。',
     'A custom path override did not work, so this used the automatically detected binary instead.': '自定义路径覆盖未生效，因此改用自动检测到的二进制文件。',
     'API key': 'API 密钥',

package/dist/features/i18n/dictionaries/settings-dialog.zh-TW.js

@@ -1,4 +1,6 @@
 export const SETTINGS_DIALOG_ZH_TW = {
+    "I removed what looked like a key from your message. If it was real, rotate it. Use the secure form to save it.": "我已從你的訊息中移除疑似金鑰的內容。如果是真實金鑰，請更換它。請使用安全表單儲存。",
+    "Use the secure form to save keys, tokens, passwords, and secrets. Chat answers are sent to the assistant.": "請使用安全表單儲存金鑰、權杖、密碼和機密資訊。聊天回答會傳送給助理。",
     '# My skill\n\n1. Explain the workflow.\n2. Describe the inputs and outputs.': '# 我的技能\n\n1. 說明工作流程。\n2. 描述輸入與輸出。',
     'A custom path override did not work, so this used the automatically detected binary instead.': '自訂路徑覆寫未生效，因此改用自動偵測到的二進位檔。',
     'API key': 'API 金鑰',

package/dist/features/i18n/dictionary-translator.d.ts

@@ -2,10 +2,13 @@
 export type LocaleDictionary = Readonly<Record<string, Readonly<Record<string, string>>>>;
 /** Locale-bound translation injected into a widget or panel hook. */
 export type Translate = (key: string) => string;
-export type DictionaryTranslator = (required: {
+export type DictionaryTranslator = ((required: {
     locale: string;
     key: string;
-}) => string;
+}) => string) & {
+    /** Expose caller-owned copy so translation audits can detect untranslated locales despite fallback. */
+    readonly dictionary: LocaleDictionary;
+};
 /** Feature copy wins over the host's common copy, then falls back to the source key.
  * No locale context or product dictionary is installed by this helper. */
 export declare function createDictionaryTranslator({ featureDictionary }: {

package/dist/features/i18n/dictionary-translator.js

@@ -9,6 +9,6 @@ function lookup(dictionary, locale, key) {
 /** Feature copy wins over the host's common copy, then falls back to the source key.
  * No locale context or product dictionary is installed by this helper. */
 export function createDictionaryTranslator({ featureDictionary }, { commonDictionary = {} } = {}) {
-    return ({ locale, key }) => lookup(featureDictionary, locale, key) ?? lookup(commonDictionary, locale, key) ?? key;
+    return Object.assign(({ locale, key }) => lookup(featureDictionary, locale, key) ?? lookup(commonDictionary, locale, key) ?? key, { dictionary: featureDictionary });
 }
 //# sourceMappingURL=dictionary-translator.js.map

package/dist/features/i18n/index.d.ts

@@ -7,5 +7,5 @@ export { SETTINGS_DIALOG_EN, SETTINGS_DIALOG_ES, SETTINGS_DIALOG_DICTIONARIES, }
 export type { SettingsDialogDict } from './dictionaries/index.js';
 export { createDictionaryTranslator } from './dictionary-translator.js';
 export type { Translate, DictionaryTranslator, LocaleDictionary } from './dictionary-translator.js';
-export { interpolate, splitOnPlaceholders, pickPlural } from './template-i18n.js';
+export { interpolate, splitOnPlaceholders, pickPlural, localeEntry } from './template-i18n.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/features/i18n/index.js

@@ -2,5 +2,5 @@ export { detectInitialLocale, resolveSystemLocale, defaultDetectSystemLocale, }
 export { I18nProvider, useI18n, useT } from './context.js';
 export { SETTINGS_DIALOG_EN, SETTINGS_DIALOG_ES, SETTINGS_DIALOG_DICTIONARIES, } from './dictionaries/index.js';
 export { createDictionaryTranslator } from './dictionary-translator.js';
-export { interpolate, splitOnPlaceholders, pickPlural } from './template-i18n.js';
+export { interpolate, splitOnPlaceholders, pickPlural, localeEntry } from './template-i18n.js';
 //# sourceMappingURL=index.js.map

package/dist/features/i18n/template-i18n.d.ts

@@ -10,6 +10,7 @@ export declare function interpolate({ template, vars }: {
  * Missing/mistyped locale tokens collapse the remaining text into one segment, followed by
  * empty segments, so a translation defect does not crash its dialog.
  */
+/** Returns tokens.length + 1 segments in token order; callers interleave their node values. */
 export declare function splitOnPlaceholders({ template, tokens }: {
     template: string;
     tokens: readonly string[];
@@ -23,4 +24,14 @@ export declare function pickPlural({ count, forms }: {
         other: string;
     };
 }): string;
+/** Resolve caller-owned locale data, defaulting to English or an explicit fallback.
+ * Own-property lookup prevents constructor/toString/__proto__ locale names from returning
+ * prototype objects, which would throw when passed to a string interpolator.
+ * @throws When neither the requested entry nor a fallback is defined. */
+export declare function localeEntry<T>({ table, locale }: {
+    table: Readonly<Record<string, T>>;
+    locale: string;
+}, { fallback }?: {
+    fallback?: T;
+}): T;
 //# sourceMappingURL=template-i18n.d.ts.map

package/dist/features/i18n/template-i18n.js

@@ -11,6 +11,7 @@ export function interpolate({ template, vars }) {
  * Missing/mistyped locale tokens collapse the remaining text into one segment, followed by
  * empty segments, so a translation defect does not crash its dialog.
  */
+/** Returns tokens.length + 1 segments in token order; callers interleave their node values. */
 export function splitOnPlaceholders({ template, tokens }) {
     const segments = [];
     let rest = template;
@@ -33,4 +34,15 @@ export function splitOnPlaceholders({ template, tokens }) {
 export function pickPlural({ count, forms }) {
     return count === 1 ? forms.one : forms.other;
 }
+/** Resolve caller-owned locale data, defaulting to English or an explicit fallback.
+ * Own-property lookup prevents constructor/toString/__proto__ locale names from returning
+ * prototype objects, which would throw when passed to a string interpolator.
+ * @throws When neither the requested entry nor a fallback is defined. */
+export function localeEntry({ table, locale }, { fallback = table.en } = {}) {
+    const entry = Object.hasOwn(table, locale) ? (table[locale] ?? fallback) : fallback;
+    if (entry === undefined) {
+        throw new Error(`No locale entry for "${locale}" and no English or explicit fallback`);
+    }
+    return entry;
+}
 //# sourceMappingURL=template-i18n.js.map

package/dist/features/interactive-ui/providers/recharts/chart-tokens.d.ts

@@ -4,7 +4,7 @@
  * The CSS variables every recharts provider paints with — the host's theme owns the colors.
  *
  * Why `--jini-chart-*` with fallbacks rather than bare `--jini-primary`: a host that styles its own
- * chrome and never maps Jini's base tokens (Tovu's admin) got Jini's near-black default bars, in
+ * chrome and never maps Jini's base tokens (an adopting admin shell) got Jini's near-black default bars, in
  * dark mode too ("the color is ugly", demo V3, 2026-10-05). A host sets `--jini-chart-1`..`-6`,
  * `--jini-chart-grid`, `--jini-chart-axis`, `--jini-chart-cursor`, `--jini-chart-surface` and
  * `--jini-chart-text` in its own CSS; a host that sets none keeps the base-token look for the

package/dist/features/interactive-ui/providers/recharts/chart-tokens.js

@@ -4,7 +4,7 @@
  * The CSS variables every recharts provider paints with — the host's theme owns the colors.
  *
  * Why `--jini-chart-*` with fallbacks rather than bare `--jini-primary`: a host that styles its own
- * chrome and never maps Jini's base tokens (Tovu's admin) got Jini's near-black default bars, in
+ * chrome and never maps Jini's base tokens (an adopting admin shell) got Jini's near-black default bars, in
  * dark mode too ("the color is ugly", demo V3, 2026-10-05). A host sets `--jini-chart-1`..`-6`,
  * `--jini-chart-grid`, `--jini-chart-axis`, `--jini-chart-cursor`, `--jini-chart-surface` and
  * `--jini-chart-text` in its own CSS; a host that sets none keeps the base-token look for the

package/dist/features/lexical-rich-text-editor/deserialize.d.ts

@@ -1,8 +1,3 @@
-/**
- * Origin: `apps/web/src/components/composer/deserialize.ts`. Ported
- * verbatim, except `buildInlineMentionParts` → `parseMentionParts` (this
- * package's generalized mention parser, see `mention-parser.ts`).
- */
 import { type LexicalEditor } from 'lexical';
 import type { MentionEntity } from './types.js';
 export declare function setRichTextFromPlainText(editor: LexicalEditor, text: string, knownMentions: MentionEntity[]): void;

package/dist/features/lexical-rich-text-editor/deserialize.js

@@ -1,8 +1,3 @@
-/**
- * Origin: `apps/web/src/components/composer/deserialize.ts`. Ported
- * verbatim, except `buildInlineMentionParts` → `parseMentionParts` (this
- * package's generalized mention parser, see `mention-parser.ts`).
- */
 import { $createLineBreakNode, $createParagraphNode, $createTextNode, $getRoot, } from 'lexical';
 import { $createMentionNode } from './mention-node.js';
 import { parseMentionParts } from './mention-parser.js';

package/dist/features/lexical-rich-text-editor/mention-node.d.ts

@@ -1,21 +1,9 @@
 /**
- * The atomic `@mention` node. Extends `TextNode` so the node's *text* remains
- * the literal `@token` and serialization back to the wire format is free:
- * `getTextContent()` already yields `@token`. Lexical token mode deletes the
- * node as one entity but still allows character-by-character caret
- * navigation, so `rules.ts` adds explicit keyboard normalization for arrows.
- *
- * Origin: `apps/web/src/components/composer/MentionNode.ts`. The origin
- * imported OD's `connectorBrandColor`/`resolveBrandTheme` directly to color
- * a `connector`-kind pill's `--m-hue` CSS custom property, and installed a
- * document-wide `MutationObserver` to re-stamp every mounted pill on a live
- * theme flip. Both are dropped from this node entirely — no per-instance
- * color logic and no global observer belong on a generic Lexical node class.
- * A host that wants per-kind/per-entity coloring supplies a
- * `resolveMentionColor` callback to `RichTextInput`, applied by
- * `react/hooks/useMentionColorStamping.ts` via Lexical's own
- * `registerMutationListener` (scoped to that one editor instance, not the
- * whole document) — see that file for the replacement mechanism.
+ * Atomic @mention extends TextNode so getTextContent preserves the wire token. Token mode deletes
+ * one entity but still permits character-level caret movement; rules.ts normalizes arrow navigation.
+ * Generic nodes own no brand resolution or document-wide observer. Host colors enter through
+ * RichTextInput.resolveMentionColor and an editor-scoped Lexical mutation listener; see
+ * react/hooks/useMentionColorStamping.ts.
  */
 import { TextNode, type EditorConfig, type LexicalNode, type NodeKey, type SerializedTextNode, type Spread } from 'lexical';
 import type { MentionEntity } from './types.js';