@jini-ai/ui 0.4.4 → 0.4.6

package/dist/features/mcp-ui/surfaces/form.d.ts

@@ -28,8 +28,11 @@ import { type SurfaceDetail, type SurfaceStatusText } from './document.js';
 import { type SurfaceField } from './fields.js';
 import type { BridgeScriptSpec } from './bridge.js';
 import type { SurfaceTokenName } from './tokens.js';
+import { type SecretInputText } from './text-input.js';
 export interface FormSurfaceSpec {
     readonly title: string;
+    /** Resource framing carried through host form projections; ignored by HTML rendering. */
+    readonly preferredFrameSize?: readonly [string, string];
     readonly description?: string;
     /** Read-only context shown above the fields — what the input is *about*. */
     readonly details?: readonly SurfaceDetail[];
@@ -52,7 +55,7 @@ export interface FormSurfaceSpec {
         readonly toolName?: string;
         readonly params?: Readonly<Record<string, unknown>>;
     };
-    readonly text?: Partial<SurfaceStatusText>;
+    readonly text?: Partial<SurfaceStatusText & SecretInputText>;
     readonly app?: BridgeScriptSpec;
     readonly lang?: string;
     readonly tokens?: Partial<Record<SurfaceTokenName, string>>;

package/dist/features/mcp-ui/surfaces/form.js

@@ -27,6 +27,7 @@ import { createUIResource } from '../resource.js';
 import { escapeHtml, escapeJsValue } from '../escape.js';
 import { DEFAULT_SURFACE_STATUS_TEXT, SURFACE_SCRIPT_PRELUDE, renderActions, renderDetailList, renderStatusRegion, renderSurfaceDocument, renderSurfaceHeader, } from './document.js';
 import { renderFieldControl, toFieldReadSpecs } from './fields.js';
+import { DEFAULT_SECRET_INPUT_TEXT } from './text-input.js';
 const DEFAULT_APP = { appName: 'jini-mcp-ui-form', appVersion: '1' };
 /** The form element's id, fixed so the emitted script can find it without a fragile selector. */
 const FORM_ELEMENT_ID = 'mcpui-form';
@@ -38,7 +39,14 @@ const FORM_ELEMENT_ID = 'mcpui-form';
  * @complexity O(n) in the number of fields plus the rendered length.
  */
 export function renderFormDocument(spec) {
-    const text = { ...DEFAULT_SURFACE_STATUS_TEXT, ...spec.text };
+    // A base param with a secret field's name would leak the same value through the emitted script,
+    // even though the collected value overrides it at submit time. Reject that hidden prefill too.
+    for (const field of spec.fields) {
+        if (field.kind === 'string' && field.secret === true && spec.baseParams?.[field.name] !== undefined) {
+            throw new Error('Secret fields cannot have a pre-filled value. Omit value.');
+        }
+    }
+    const text = { ...DEFAULT_SURFACE_STATUS_TEXT, ...DEFAULT_SECRET_INPUT_TEXT, ...spec.text };
     // Not `type: 'submit'` — see the runtime script below for why a submit-typed button inside this
     // particular `<form>` cannot work at all in production.
     const actions = [
@@ -46,7 +54,9 @@ export function renderFormDocument(spec) {
     ];
     if (spec.cancel !== undefined)
         actions.push({ id: 'cancel', label: spec.cancel.label, variant: 'neutral' });
-    const controls = spec.fields.map(renderFieldControl).join('\n');
+    const controls = spec.fields
+        .map((field) => renderFieldControl(field, { showSecret: text.showSecret, hideSecret: text.hideSecret }))
+        .join('\n');
     const warning = spec.warning === undefined ? '' : `<p class="mcpui-warning">${escapeHtml(spec.warning)}</p>`;
     const bodyHtml = [
         renderSurfaceHeader(spec.description === undefined ? { title: spec.title } : { title: spec.title, description: spec.description }),
@@ -69,6 +79,57 @@ ${SURFACE_SCRIPT_PRELUDE}
   var TEXT = ${escapeJsValue(text)};
   var form = document.getElementById(${escapeJsValue(FORM_ELEMENT_ID)});
 
+  // A textarea normalizes CRLF/CR to LF even on .value assignment. Keep the original trusted paste
+  // privately, outside DOM/HTML, so multiline credentials reach the tool with their original bytes.
+  // An edit that changes the DOM value makes the snapshot ineligible; typed text then follows the
+  // native textarea value. Offsets count CRLF as one visible newline when a second paste replaces
+  // a selection, otherwise the original raw string would be spliced at the wrong position.
+  var secretPastes = new WeakMap();
+  function rawOffset(raw, visibleOffset) {
+    var rawIndex = 0;
+    var visibleIndex = 0;
+    while (rawIndex < raw.length && visibleIndex < visibleOffset) {
+      if (raw.charCodeAt(rawIndex) === 13 && raw.charCodeAt(rawIndex + 1) === 10) rawIndex++;
+      rawIndex++;
+      visibleIndex++;
+    }
+    return rawIndex;
+  }
+  form.addEventListener("paste", function (event) {
+    var control = event.target;
+    if (event.isTrusted !== true || !control || control.tagName !== "TEXTAREA" || !control.hasAttribute("data-mcpui-secret") || !event.clipboardData) return;
+    var pasted = event.clipboardData.getData("text/plain");
+    if (!pasted) return;
+    var snapshot = secretPastes.get(control);
+    var raw = snapshot && snapshot.normalized === control.value ? snapshot.raw : control.value;
+    var start = control.selectionStart;
+    var end = control.selectionEnd;
+    var next = raw.slice(0, rawOffset(raw, start)) + pasted + raw.slice(rawOffset(raw, end));
+    event.preventDefault();
+    control.value = next;
+    // Caret offsets use the displayed newline representation, independent of the saved raw text.
+    var caret = start + pasted.replace(/\\r\\n?/g, "\\n").length;
+    control.setSelectionRange(caret, caret);
+    secretPastes.set(control, { raw: next, normalized: control.value });
+    control.dispatchEvent(new Event("input", { bubbles: true }));
+  });
+
+  // A reveal button only changes presentation: replacing a textarea with a password input would
+  // discard line breaks. Listen on the form so clicks on the button's contents work too.
+  form.addEventListener("click", function (event) {
+    if (event.isTrusted !== true) return;
+    var target = event.target;
+    if (!target || typeof target.closest !== "function") return;
+    var button = target.closest("button[data-mcpui-secret-toggle]");
+    if (!button || button.disabled) return;
+    var control = document.getElementById(button.getAttribute("data-mcpui-secret-toggle"));
+    if (!control) return;
+    var reveal = button.getAttribute("aria-pressed") !== "true";
+    control.setAttribute("style", "-webkit-text-security: " + (reveal ? "none" : "disc") + ";");
+    button.setAttribute("aria-pressed", reveal ? "true" : "false");
+    button.textContent = button.getAttribute(reveal ? "data-mcpui-hide-secret" : "data-mcpui-show-secret");
+  });
+
   // form.elements[name] yields a RadioNodeList when several controls share a name and the BARE
   // element when only one does. A one-option checklist would otherwise read as "no options" —
   // silently, since a bare input has no length to iterate. Presence of "checked" is what tells the
@@ -88,7 +149,8 @@ ${SURFACE_SCRIPT_PRELUDE}
     if (field.kind === "multi-enum") return checkedValues(control);
     // Covers a radio-presented enum too: a RadioNodeList's own .value is the checked radio's
     // value, or "" when none is checked — the same shape a <select> reports.
-    return control.value;
+    var snapshot = secretPastes.get(control);
+    return snapshot && snapshot.normalized === control.value ? snapshot.raw : control.value;
   }
 
   function isBlank(field, value) {

package/dist/features/mcp-ui/surfaces/outcome.d.ts

@@ -48,6 +48,8 @@ import type { BridgeScriptSpec } from './bridge.js';
 import type { SurfaceTokenName } from './tokens.js';
 export interface SurfaceOutcomeSpec {
     readonly title: string;
+    /** Resource framing carried through host outcome projections; ignored by HTML rendering. */
+    readonly preferredFrameSize?: readonly [string, string];
     readonly description?: string;
     /** The facts of what actually happened — same shape as a confirmation's own `details`, but
      *  reporting the RESULT (e.g. the real URL, the real status) rather than what was proposed. */

package/dist/features/mcp-ui/surfaces/text-input.d.ts

@@ -1,8 +1,15 @@
-export interface TextInputProps {
+/** Labels the host can translate for a multiline secret's reveal toggle. */
+export interface SecretInputText {
+    readonly showSecret: string;
+    readonly hideSecret: string;
+}
+export declare const DEFAULT_SECRET_INPUT_TEXT: SecretInputText;
+export interface TextInputProps extends Partial<SecretInputText> {
     /** HTML `name`, DOM `id` suffix, and the params key the value is posted under. */
     readonly name: string;
     readonly label: string;
-    /** Pre-filled value. Numbers are stringified; `undefined` leaves the control empty. */
+    /** Pre-filled value. Numbers are stringified; `undefined` leaves the control empty.
+     *  Forbidden when `secret` is true, including an empty string. */
     readonly value?: string | number;
     readonly placeholder?: string;
     /** Help text, wired up with `aria-describedby`. */
@@ -11,10 +18,11 @@ export interface TextInputProps {
     readonly disabled?: boolean;
     /** `'number'` also constrains the on-screen keyboard on touch devices, which `'text'` would not. */
     readonly inputType?: 'text' | 'number';
-    /** Renders as `<input type="password">` — the value is never visible on screen, and browser
-     *  password managers may offer to remember it. Ignored when `inputType` is `'number'` (no such
-     *  thing as a masked number) and forces `multiline` off (no `<textarea type="password">` exists) —
-     *  same precedence `multiline`'s own doc comment already gives `inputType: 'number'`. */
+    /** Renders as `<input type="password">`, or a masked textarea with a show/hide toggle when
+     *  multiline. No `<textarea type="password">` exists, so multiline uses CSS text security.
+     *  Ignored for presentation when `inputType` is `'number'` (no such thing as a masked number) —
+     *  same precedence `multiline`'s own doc comment already gives `inputType: 'number'`.
+     *  A supplied value is always rejected: masking cannot protect a secret serialized into HTML. */
     readonly secret?: boolean;
     /** Renders a `<textarea>`. Ignored when `inputType` is `'number'` — there is no multiline number. */
     readonly multiline?: boolean;

package/dist/features/mcp-ui/surfaces/text-input.js

@@ -7,6 +7,7 @@
  */
 import { escapeHtml } from '../escape.js';
 import { fieldDescribedBy, fieldElementId, renderFieldLabel } from './document.js';
+export const DEFAULT_SECRET_INPUT_TEXT = { showSecret: 'Show', hideSecret: 'Hide' };
 function optionalAttribute(name, value) {
     if (value === undefined)
         return '';
@@ -36,6 +37,11 @@ function resolveInputType(props) {
  * @complexity O(n) in the rendered length.
  */
 export function renderTextInput(props) {
+    // Even an empty prefill is forbidden: callers must omit value so a stored credential can never
+    // enter the resource's HTML. Keep this error fixed, without the field name or rejected value.
+    if (props.secret === true && props.value !== undefined) {
+        throw new Error('Secret fields cannot have a pre-filled value. Omit value.');
+    }
     const id = fieldElementId(props.name);
     const common = ` id="${escapeHtml(id)}" name="${escapeHtml(props.name)}"` +
         optionalAttribute('placeholder', props.placeholder) +
@@ -44,8 +50,16 @@ export function renderTextInput(props) {
         fieldDescribedBy(props);
     const type = resolveInputType(props);
     const isNumber = type === 'number';
-    const control = props.multiline === true && type === 'text'
-        ? `<textarea class="mcpui-textarea"${common}${optionalAttribute('rows', props.rows)}>${props.value === undefined ? '' : escapeHtml(String(props.value))}</textarea>`
+    const secretMultiline = props.secret === true && props.multiline === true && !isNumber;
+    const control = props.multiline === true && !isNumber
+        ? `<textarea class="mcpui-textarea"${common}${optionalAttribute('rows', props.rows)}` +
+            // Password inputs strip line breaks. CSS masking keeps the textarea's actual value intact,
+            // and disables browser text assistance that could retain or alter a pasted credential.
+            (secretMultiline ? ' data-mcpui-secret style="-webkit-text-security: disc;" autocomplete="off" spellcheck="false"' : '') +
+            `>${props.value === undefined ? '' : escapeHtml(String(props.value))}</textarea>` +
+            (secretMultiline
+                ? `<button type="button" class="mcpui-button" data-mcpui-secret-toggle="${escapeHtml(id)}" data-mcpui-show-secret="${escapeHtml(props.showSecret ?? DEFAULT_SECRET_INPUT_TEXT.showSecret)}" data-mcpui-hide-secret="${escapeHtml(props.hideSecret ?? DEFAULT_SECRET_INPUT_TEXT.hideSecret)}" aria-controls="${escapeHtml(id)}" aria-pressed="false"${booleanAttribute('disabled', props.disabled)}>${escapeHtml(props.showSecret ?? DEFAULT_SECRET_INPUT_TEXT.showSecret)}</button>`
+                : '')
         : `<input class="mcpui-input" type="${type}"${common}` +
             optionalAttribute('value', props.value) +
             // A stored secret (e.g. a cloud provider's access key or a database password) must never be

package/dist/features/mcp-ui/surfaces/tokens.js

@@ -1,4 +1,4 @@
-import { defaultAdminTheme } from '../../../theme/default.js';
+import { defaultAdminTheme } from '../../../core/theme/default.js';
 /**
  * @module features/mcp-ui/surfaces/tokens
  *

package/dist/features/memory/react/components/MemoryConnectedPanel.d.ts

@@ -1,4 +1,4 @@
-import { type Connector, type ConnectorStatusMap } from '../../../connectors/types.js';
+import type { Connector, ConnectorStatusMap } from '../../../connectors/types.js';
 import type { ConnectorMemoryAttempt, MemoryExtractionRecord, MemorySuggestion } from '../../types.js';
 export declare function MemoryConnectedPanel({ enabled, onOpenConnectors, connectorStatuses, connectorsLoading, connectedCount, selectedConnectorIds, selectedConnectedConnectorIds, connectingConnectorIds, pendingConnectorAuthIds, connectorConnectErrors, connectorIdsWithDetails, connectorExtracting, connectorSaving, connectorScanLabel, connectorSuggestions, selectedSuggestionIds, selectedConnectorSuggestions, connectorStatus, connectorError, connectorLoadError, connectorAttempts, connectorContextBytes, connectorExtractions, memoryConnectors, toggleConnectorSelection, onConnectMemoryConnector, toggleConnectorSuggestion, onSuggestConnectorMemory, onSaveConnectorSuggestions, onDiscardConnectorSuggestions, nowClock, onOpenPreview, onDeleteExtraction, }: {
     enabled: boolean;

package/dist/features/memory/react/components/MemoryConnectedPanel.js

@@ -9,7 +9,6 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // concern was already dropped when the connectors canary shipped; a host
 // resolving theme-swapped logo URLs does so before handing `logoUrl` in).
 import { useMemo } from 'react';
-import {} from '../../../connectors/types.js';
 import { connectorAttemptDetail, connectorAttemptTitle, formatConnectorContextBytes, memoryTypeLabels, } from '../../formatters.js';
 import { ConnectorLogo } from '../../../connectors/index.js';
 import { Icon } from '../../../../react/components/Icon.js';

package/dist/features/panel-kit/helpers/format-timestamp.d.ts

@@ -1,11 +1,13 @@
 /**
- * Centralize the historical fixed-width display so formatting changes have one owner. Preserve
- * the stored timestamp's prefix byte for byte: no parsing, locale formatting or timezone conversion.
+ * Centralize the fixed-width display so formatting changes have one owner. The default
+ * preserves the stored timestamp's prefix byte for byte, without parsing or timezone conversion.
  * Trailing seconds, milliseconds and zone suffix are intentionally dropped; callers supply ISO text.
  */
-/** Render the ISO prefix as YYYY-MM-DD HH:MM without timezone conversion. */
+/** Render YYYY-MM-DD HH:MM; hosts can select the viewer's local timezone explicitly. */
 export declare function formatTimestamp({ iso }: {
     iso: string;
+}, { timeZone }?: {
+    timeZone?: "stored" | "local";
 }): string;
 /** Inject 'now' to keep relative-time display deterministic. The fallback wording uses simple
  * English singular/plural templates; hosts can translate them, but this is not full locale pluralization. */

package/dist/features/panel-kit/helpers/format-timestamp.js

@@ -1,10 +1,19 @@
 /**
- * Centralize the historical fixed-width display so formatting changes have one owner. Preserve
- * the stored timestamp's prefix byte for byte: no parsing, locale formatting or timezone conversion.
+ * Centralize the fixed-width display so formatting changes have one owner. The default
+ * preserves the stored timestamp's prefix byte for byte, without parsing or timezone conversion.
  * Trailing seconds, milliseconds and zone suffix are intentionally dropped; callers supply ISO text.
  */
-/** Render the ISO prefix as YYYY-MM-DD HH:MM without timezone conversion. */
-export function formatTimestamp({ iso }) {
+/** Render YYYY-MM-DD HH:MM; hosts can select the viewer's local timezone explicitly. */
+export function formatTimestamp({ iso }, { timeZone = "stored" } = {}) {
+    if (timeZone === "local") {
+        // A stored UTC prefix can label server time as viewer time (Tovu D-06). Local getters
+        // follow the browser's timezone and DST; zone-less ISO is already local wall time.
+        const date = new Date(iso);
+        if (Number.isNaN(date.getTime()))
+            return iso; // Keep malformed source data visible.
+        const pad = (value) => String(value).padStart(2, "0");
+        return `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
+    }
     return iso.slice(0, 16).replace("T", " ");
 }
 /** Inject 'now' to keep relative-time display deterministic. The fallback wording uses simple

package/dist/features/panel-kit/helpers/permissions.js

@@ -1,3 +1,5 @@
+// ADR-021: GET /auth/me flattens effectivePermissions, losing resourceType/constraintJson.
+// ADR-006 keeps one server evaluator; every mutation and tool call must be rechecked there.
 /** UI affordance check for exact grants or the literal * wildcard; server authorization remains host-owned. */
 /**
  * A flattened permission list has lost resource scopes and constraints. Treating '*' as an ordinary

package/dist/features/panel-kit/helpers/resolve-active-tab-id.js

@@ -1,3 +1,5 @@
+// ADR-063: URL-owned screens retain their own tab lists and defaults. Pages mirrors local state
+// to the URL to avoid navigation over eagerly fetched data; tab-manifest enumerability is a separate decision.
 /** Keep an allowed selection or choose the allowed default/first id; an empty list keeps defaultId. */
 /**
  * URL query values can come from stale bookmarks or typos; validating against allowed ids prevents

package/dist/features/panel-kit/helpers/standing-draft-local-backup.d.ts

@@ -0,0 +1,51 @@
+import type { StandingDraftAutosaveInput, StandingDraftAutosaveSnapshot } from "../hooks/use-standing-draft-autosave.hooks.js";
+/**
+ * @file Last-resort per-tab mirror for a standing draft the SERVER REFUSED (2026-09-06 stale-basis
+ * fix). Deliberately NOT a general autosave backend — browser storage was explicitly rejected for
+ * that (see `use-standing-draft-autosave.hooks.ts`'s header); this holds exactly one thing: the
+ * text the server answered `applied: false` or HTTP 401 to, which it will keep refusing until the
+ * editor reloads the row or the operator signs in again. Server-side parking is impossible for that text, so without this the
+ * operator's only copy lives in a tab they may close at any moment.
+ *
+ * Written only on a refusal, read only as the mount-time fallback when the server has nothing
+ * parked, and dropped the moment the server accepts a write again, the operator discards, or a real
+ * Save lands. Every access is wrapped: `localStorage` throws outright in some privacy modes and on
+ * quota exhaustion, and a failed backup must never break the editor it is protecting.
+ *
+ * Type-only import from the hook module — no runtime edge, and the hook keeps owning the shapes
+ * both editors already import from it.
+ */
+/** Namespaced so one entry's backup can never collide with another's, or with unrelated app keys. */
+/** Legacy marker for injected ports with no identity metadata — a recovered backup is identifiably
+ *  local rather than pretending the server parked it. Production now uses the actual principal id
+ *  captured by the session adapter. The legacy marker still keeps old fakes honest because
+ *  {@link StandingDraftAutosaveSnapshot} requires the field; inventing a server principal would be
+ *  the same class of defect this whole fix is about. */
+export declare const LOCAL_BACKUP_PRINCIPAL_ID = "local-tab-backup";
+/** Bind a profile-local refusal mirror without choosing the host's storage namespace.
+ * Storage is obtained lazily inside guarded operations, so privacy-mode getters cannot break mount.
+ * @complexity O(draft size) for reads/writes; O(1) for clears.
+ */
+export declare function createStandingDraftLocalBackup({ keyPrefix: KEY_PREFIX, getStorage }: {
+    keyPrefix: string;
+    getStorage: (required: Record<string, never>, optional?: Record<string, never>) => Pick<Storage, "getItem" | "setItem" | "removeItem">;
+}, _options?: Record<string, never>): {
+    write: ({ entryId, draft, savedAt }: {
+        entryId: string;
+        draft: StandingDraftAutosaveInput;
+        savedAt: string;
+    }, options?: {
+        principalId?: string | null | undefined;
+    }) => void;
+    read: ({ entryId }: {
+        entryId: string;
+    }, options?: {
+        principalId?: string | null | undefined;
+    }) => StandingDraftAutosaveSnapshot | null;
+    clear: ({ entryId }: {
+        entryId: string;
+    }, options?: {
+        principalId?: string | null | undefined;
+    }) => void;
+};
+//# sourceMappingURL=standing-draft-local-backup.d.ts.map

package/dist/features/panel-kit/helpers/standing-draft-local-backup.js

@@ -0,0 +1,77 @@
+/**
+ * @file Last-resort per-tab mirror for a standing draft the SERVER REFUSED (2026-09-06 stale-basis
+ * fix). Deliberately NOT a general autosave backend — browser storage was explicitly rejected for
+ * that (see `use-standing-draft-autosave.hooks.ts`'s header); this holds exactly one thing: the
+ * text the server answered `applied: false` or HTTP 401 to, which it will keep refusing until the
+ * editor reloads the row or the operator signs in again. Server-side parking is impossible for that text, so without this the
+ * operator's only copy lives in a tab they may close at any moment.
+ *
+ * Written only on a refusal, read only as the mount-time fallback when the server has nothing
+ * parked, and dropped the moment the server accepts a write again, the operator discards, or a real
+ * Save lands. Every access is wrapped: `localStorage` throws outright in some privacy modes and on
+ * quota exhaustion, and a failed backup must never break the editor it is protecting.
+ *
+ * Type-only import from the hook module — no runtime edge, and the hook keeps owning the shapes
+ * both editors already import from it.
+ */
+/** Namespaced so one entry's backup can never collide with another's, or with unrelated app keys. */
+/** Legacy marker for injected ports with no identity metadata — a recovered backup is identifiably
+ *  local rather than pretending the server parked it. Production now uses the actual principal id
+ *  captured by the session adapter. The legacy marker still keeps old fakes honest because
+ *  {@link StandingDraftAutosaveSnapshot} requires the field; inventing a server principal would be
+ *  the same class of defect this whole fix is about. */
+export const LOCAL_BACKUP_PRINCIPAL_ID = "local-tab-backup";
+/** Bind a profile-local refusal mirror without choosing the host's storage namespace.
+ * Storage is obtained lazily inside guarded operations, so privacy-mode getters cannot break mount.
+ * @complexity O(draft size) for reads/writes; O(1) for clears.
+ */
+export function createStandingDraftLocalBackup({ keyPrefix: KEY_PREFIX, getStorage }, _options = {}) {
+    function keyFor(entryId, principalId) {
+        return principalId === undefined ? `${KEY_PREFIX}${entryId}` : `${KEY_PREFIX}${encodeURIComponent(principalId ?? "")}.${encodeURIComponent(entryId)}`;
+    }
+    /** Mirrors a refused draft for this browser profile. Silent no-op on any storage failure.
+     *  @complexity Time/space: O(size of the draft) for the one `JSON.stringify`. */
+    function writeStandingDraftLocalBackup({ entryId, draft, savedAt }, options = {}) {
+        if (options.principalId === null)
+            return;
+        const snapshot = { ...draft, savedAt, savedByPrincipalId: options.principalId ?? LOCAL_BACKUP_PRINCIPAL_ID };
+        try {
+            const storage = getStorage({}, {});
+            storage.setItem(keyFor(entryId, options.principalId), JSON.stringify(snapshot));
+        }
+        catch {
+            // eslint-disable-next-line no-console -- best-effort; the operator's text is still in the tab.
+            console.warn("standing-draft local backup: could not write");
+        }
+    }
+    /** The mirrored draft, or `null` when there is none (or storage is unreadable/corrupt).
+     *  @complexity Time/space: O(size of the stored draft). */
+    function readStandingDraftLocalBackup({ entryId }, options = {}) {
+        if (options.principalId === null)
+            return null;
+        try {
+            const storage = getStorage({}, {});
+            const raw = storage.getItem(keyFor(entryId, options.principalId));
+            return raw ? JSON.parse(raw) : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Drops the mirror. Called on an accepted write, an explicit discard, and a real Save.
+     *  @complexity Time/space: O(1). */
+    function clearStandingDraftLocalBackup({ entryId }, options = {}) {
+        if (options.principalId === null)
+            return;
+        try {
+            const storage = getStorage({}, {});
+            storage.removeItem(keyFor(entryId, options.principalId));
+        }
+        catch {
+            // Nothing to do and nothing to tell the operator — a backup that cannot be removed is
+            // superseded by the next write anyway, and is never auto-applied.
+        }
+    }
+    return { write: writeStandingDraftLocalBackup, read: readStandingDraftLocalBackup, clear: clearStandingDraftLocalBackup };
+}
+//# sourceMappingURL=standing-draft-local-backup.js.map

package/dist/features/panel-kit/helpers/standing-draft-recovery-message.d.ts

@@ -0,0 +1,8 @@
+import type { StandingDraftAutosaveSnapshot } from "../hooks/use-standing-draft-autosave.hooks.js";
+/** Compare timestamps explicitly; restoration only changes the working copy, never the server. */
+export declare function standingDraftRecoveryMessage({ draft, t, serverUpdatedAt }: {
+    draft: StandingDraftAutosaveSnapshot;
+    t: (key: string) => string;
+    serverUpdatedAt?: string;
+}, _options?: {}): string;
+//# sourceMappingURL=standing-draft-recovery-message.d.ts.map

package/dist/features/panel-kit/helpers/standing-draft-recovery-message.js

@@ -0,0 +1,10 @@
+/** Compare timestamps explicitly; restoration only changes the working copy, never the server. */
+export function standingDraftRecoveryMessage({ draft, t, serverUpdatedAt }, _options = {}) {
+    const captured = Date.parse(draft.savedAt);
+    const server = Date.parse(serverUpdatedAt ?? draft.serverUpdatedAt ?? "");
+    const comparison = server > captured ? "Server content is newer."
+        : server < captured ? "Local changes are newer."
+            : server === captured ? "Both copies have the same timestamp." : "";
+    return `${t("Restore unsaved changes from")} ${draft.savedAt}${comparison ? ` · ${t(comparison)}` : ""}`;
+}
+//# sourceMappingURL=standing-draft-recovery-message.js.map

package/dist/features/panel-kit/hooks/use-async-action.hooks.d.ts

@@ -1,5 +1,6 @@
 import { type Dispatch, type SetStateAction } from "react";
 export interface AsyncActionState {
+    /** True for the most recent run; error resets before each attempt and stays null on success. */
     saving: boolean;
     error: string | null;
     setError: Dispatch<SetStateAction<string | null>>;

package/dist/features/panel-kit/hooks/use-dirty-guard.hooks.d.ts

@@ -6,6 +6,7 @@ export interface DirtyGuard {
         unsavedBeyondTracked?: boolean;
     }) => boolean;
 }
+/** @complexity O(n) per render in the serialized size of current/original; intended for small forms. */
 /** Compare small JSON-serializable form states (including key order). Null original is clean.
  * Warn on unload and offer a translated native confirmation for caller-owned navigation. */
 export declare function useDirtyGuard<T>({ current, original }: {

package/dist/features/panel-kit/hooks/use-dirty-guard.hooks.js

@@ -4,6 +4,7 @@ import { useEffect } from "react";
 function shallowJsonEqual(a, b) {
     return JSON.stringify(a) === JSON.stringify(b);
 }
+/** @complexity O(n) per render in the serialized size of current/original; intended for small forms. */
 /** Compare small JSON-serializable form states (including key order). Null original is clean.
  * Warn on unload and offer a translated native confirmation for caller-owned navigation. */
 export function useDirtyGuard({ current, original }, { translate = (key) => key, host = window } = {}) {

package/dist/features/panel-kit/hooks/use-serial-writes.hooks.d.ts

@@ -12,6 +12,14 @@
  * Re-entrant run calls queue normally, but awaiting an inner call from a task on the same
  * lane deadlocks: the inner task is waiting for the outer task to release that lane.
  */
+/**
+ * @example
+ * const generation = settlement.next();
+ * await writes.run({ task: async () => {
+ *   const result = await port.write();
+ *   if (settlement.isCurrent({ generation })) setResult(result);
+ * } });
+ */
 export interface SerialWrites {
     /** Each caller observes its own task result or rejection, never the internal lane tail. */
     run<T>({ task }: {

package/dist/features/panel-kit/hooks/use-serial-writes.hooks.js

@@ -38,4 +38,7 @@ export function useSerialWrites() {
         ref.current = createSerialWrites();
     return ref.current;
 }
+// Credentials, activation and autosave share this queue so writes cannot race or be dropped;
+// some callers enqueue their last persistence write from unmount cleanup to prevent data loss.
+// Controllers use this handle in useCallback/useMemo dependencies; keep the adapter stable too.
 //# sourceMappingURL=use-serial-writes.hooks.js.map