@kitn.ai/ui 0.24.0 → 0.25.0

package/src/components/artifact.tsx

@@ -16,6 +16,7 @@ import { CodeBlock, CodeBlockCode } from './code-block';
 import { FileTree, type FileTreeFile } from './file-tree';
 import { Loader } from './loader';
 import { isPdfPreviewEnabled, renderPdfInto } from '../primitives/pdf-preview';
+import { isSafeUrl, isScriptUrl } from '../primitives/card-routing';
 import {
   ArrowLeft,
   ArrowRight,
@@ -123,6 +124,18 @@ export interface ArtifactProps extends Omit<JSX.HTMLAttributes<HTMLDivElement>,
 
 const DEFAULT_SANDBOX = 'allow-scripts allow-forms';
 
+/** Refuse loudly. `src` and `files[].url` are MODEL-REACHABLE -- they arrive on
+ *  an `artifact` card envelope produced by a tool call, and the card schema
+ *  validates them only as `format: "uri"`, which constrains no scheme -- so
+ *  every url this component puts in an href, hands to `window.open`, or frames
+ *  is filtered. A refusal without a trace would be a decision made while hiding
+ *  that it happened; the component has no error channel of its own, so it warns
+ *  the way `card-routing` does. */
+function warnBlockedUrl(sink: string, url: string): void {
+  // eslint-disable-next-line no-console
+  console.warn(`[kai-artifact] blocked unsafe url in ${sink}: ${url}`);
+}
+
 /** Resolve a file's preview URL: explicit `url`, else `<src-origin> + /path`. */
 function resolveFileUrl(file: ArtifactFile, src: string | undefined): string {
   if (file.url) return file.url;
@@ -205,14 +218,47 @@ export function Artifact(props: ArtifactProps): JSX.Element {
   // navigations it initiates (path-edit, file-click, home, src changes) and
   // back/forward/reload operate on that. (In-frame relative-link clicks navigate
   // the iframe itself but can't be observed cross-origin — a known, accepted
-  // sandbox limitation; opt into `allow-same-origin` if the consumer trusts the
-  // artifact and wants those tracked.)
+  // sandbox limitation.)
+  //
+  // DO NOT add `allow-same-origin` to get those clicks tracked. This comment
+  // used to suggest exactly that "if the consumer trusts the artifact", and it
+  // was the worst advice in the file: `allow-same-origin` gives the framed
+  // document the HOST's origin, so a hostile `src` runs with full access to the
+  // embedding page, zero clicks -- confirmed executing in Chromium. And "the
+  // artifact is trusted" is not a premise you get to hold when the url can come
+  // from tool output: on the card path `src` and `files[].url` are
+  // model-supplied. The scheme filter below is a backstop, not a licence --
+  // `allow-same-origin` still hands the framed document the host's cookies,
+  // storage and DOM for everything else it does. Losing in-frame click tracking
+  // is the correct trade.
   const [history, setHistory] = createSignal<string[]>(local.src ? [local.src] : []);
   const [cursor, setCursor] = createSignal(local.src ? 0 : -1);
   const currentUrl = () => history()[cursor()] ?? '';
   const canBack = () => cursor() > 0;
   const canForward = () => cursor() < history().length - 1;
 
+  /** What the iframe is actually pointed at.
+   *
+   *  Separate from `currentUrl()` on purpose: the history stack and the address
+   *  field keep reporting what ARRIVED (a reader looking at a refused artifact
+   *  should see the address that was refused, not a blank), while this is the
+   *  only value that reaches the `src` sink.
+   *
+   *  `isScriptUrl` and not `isSafeUrl`: a `data:`/`blob:` src is a legitimate
+   *  artifact -- see the note on `displayUrl` -- and gets an opaque origin, so
+   *  it cannot touch the host page. `javascript:`/`vbscript:` run in the
+   *  EMBEDDER's origin, which the default sandbox already refuses but a
+   *  consumer-set `allow-same-origin` re-enables (see the note on the history
+   *  stack above for why nothing here recommends that setting). */
+  const framedUrl = createMemo(() => {
+    const u = currentUrl();
+    if (u && isScriptUrl(u)) {
+      warnBlockedUrl('preview', u);
+      return '';
+    }
+    return u;
+  });
+
   // Seed the internal tab: a present `tab` (controlled) wins; otherwise the
   // uncontrolled `defaultTab` (which merges to 'preview'). The user can then
   // switch freely unless `tab` is set (the effect below re-asserts the controlled
@@ -230,14 +276,23 @@ export function Artifact(props: ArtifactProps): JSX.Element {
     local.onMaximizeChange?.(next);
   };
 
-  // Open-in-tab — only enabled when there's a concrete url to open.
+  // Open-in-tab — only enabled when there's a concrete SAFE url to open. The
+  // scheme filter is part of `canOpenInTab` rather than only of the handler so
+  // the button renders DISABLED for a url that would be refused: a control that
+  // looks live and does nothing is the worse failure.
   const canOpenInTab = createMemo(() => {
     const u = currentUrl();
-    return !!u && u !== 'about:blank';
+    return !!u && u !== 'about:blank' && isSafeUrl(u);
   });
   const openInNewTab = () => {
-    if (!canOpenInTab()) return;
-    window.open(currentUrl(), '_blank', 'noopener,noreferrer');
+    const u = currentUrl();
+    if (!canOpenInTab()) {
+      // `openExternal()` on the controller reaches this without any button, so
+      // the refusal has to be stated here and not only in the disabled state.
+      if (u && u !== 'about:blank') warnBlockedUrl('openExternal', u);
+      return;
+    }
+    window.open(u, '_blank', 'noopener,noreferrer');
   };
 
   // The expand button is suppressed in standalone (no enclosing resizable).
@@ -300,9 +355,11 @@ export function Artifact(props: ArtifactProps): JSX.Element {
 
   /** Point the iframe at the current cursor entry + emit `navigate`. */
   function loadCurrent() {
-    const url = currentUrl();
-    if (iframeEl) iframeEl.src = url || 'about:blank';
-    local.onNavigate?.(url);
+    if (iframeEl) iframeEl.src = framedUrl() || 'about:blank';
+    // Reports the REAL url, not the framed one: a consumer observing navigation
+    // (or a card patching `src` back into its envelope) must not be told the
+    // model sent something it did not.
+    local.onNavigate?.(currentUrl());
   }
 
   function selectTab(next: ArtifactTab) {
@@ -329,14 +386,13 @@ export function Artifact(props: ArtifactProps): JSX.Element {
     loadCurrent();
   };
   function reload() {
-    const url = currentUrl();
     if (iframeEl) {
       // Force a real reload even when the src is unchanged.
       iframeEl.src = 'about:blank';
-      iframeEl.src = url || 'about:blank';
+      iframeEl.src = framedUrl() || 'about:blank';
     }
     setReloadKey((k) => k + 1); // re-render the inline PDF viewer too
-    local.onNavigate?.(url);
+    local.onNavigate?.(currentUrl());
   }
   const goHome = () => {
     if (local.src) navigate(local.src);
@@ -458,7 +514,7 @@ export function Artifact(props: ArtifactProps): JSX.Element {
             fallback={
               <ArtifactPreview
                 ref={(el) => (iframeEl = el)}
-                src={currentUrl}
+                src={framedUrl}
                 sandbox={local.sandbox}
                 title={local.iframeTitle ?? 'Artifact preview'}
                 onLoad={onIframeLoad}
@@ -719,12 +775,30 @@ function ArtifactCode(props: CodeProps): JSX.Element {
 
 // --- ArtifactPdfFallback (internal) ---------------------------------------
 
-/** Shown when inline PDF rendering is disabled or fails (CORS / load / parse). */
+/** Shown when inline PDF rendering is disabled or fails (CORS / load / parse).
+ *
+ *  THIS IS THE DEFAULT VIEW FOR A HOSTILE URL, not an edge case: pdf.js has to
+ *  FETCH the document to render it inline, and it cannot fetch a `javascript:`
+ *  or `data:` one, so every such url fails straight through to here -- where two
+ *  anchors used to put it in an `href`, one click from executing in the host
+ *  page's origin. The url is model-reachable (`artifact` card `src` /
+ *  `files[].url`, schema-validated only as `format: "uri"`), so it is filtered
+ *  with the same `isSafeUrl` the markdown renderer and the card `open` verb use.
+ *  Relative paths pass, which matters here: `resolveFileUrl` returns a bare
+ *  `path` when the artifact has no `src`. */
 function ArtifactPdfFallback(props: { url: string }): JSX.Element {
   const name = () => {
     const path = props.url.split(/[?#]/)[0];
     return path.slice(path.lastIndexOf('/') + 1) || 'document.pdf';
   };
+  /** The url actually put in `href`, or `undefined` -- which OMITS the attribute.
+   *  Never `''`: an empty href navigates to the current page. */
+  const href = createMemo(() => {
+    if (!props.url) return undefined;
+    if (isSafeUrl(props.url)) return props.url;
+    warnBlockedUrl('pdf fallback', props.url);
+    return undefined;
+  });
   const linkClass =
     'inline-flex h-8 items-center gap-1.5 rounded-md border border-border bg-background px-3 text-xs font-medium text-foreground transition-colors hover:bg-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring';
   return (
@@ -736,16 +810,28 @@ function ArtifactPdfFallback(props: { url: string }): JSX.Element {
       <FileText size={40} class="text-muted-foreground" aria-hidden="true" />
       <div class="text-sm font-medium text-foreground">{name()}</div>
       <div class="text-xs text-muted-foreground">Can't preview this PDF inline.</div>
-      <div class="flex flex-wrap items-center justify-center gap-2">
-        <a class={linkClass} href={props.url} target="_blank" rel="noopener noreferrer">
-          Open in new tab
-          <ExternalLink size={13} aria-hidden="true" />
-        </a>
-        <a class={linkClass} href={props.url} download="">
-          <Download size={13} aria-hidden="true" />
-          Download
-        </a>
-      </div>
+      {/* No safe address, no controls. Two buttons that silently do nothing
+          would be worse than saying what happened -- and a bare `<a>` with the
+          href dropped is exactly that. */}
+      <Show
+        when={href()}
+        fallback={
+          <div class="text-xs text-muted-foreground">
+            Blocked: that address uses a scheme this viewer won't open.
+          </div>
+        }
+      >
+        <div class="flex flex-wrap items-center justify-center gap-2">
+          <a class={linkClass} href={href()} target="_blank" rel="noopener noreferrer">
+            Open in new tab
+            <ExternalLink size={13} aria-hidden="true" />
+          </a>
+          <a class={linkClass} href={href()} download="">
+            <Download size={13} aria-hidden="true" />
+            Download
+          </a>
+        </div>
+      </Show>
     </div>
   );
 }

package/src/components/markdown.tsx

@@ -1,10 +1,86 @@
 import { splitProps, createMemo, createUniqueId, For, Show, Switch, Match } from 'solid-js';
 import { cn } from '../utils/cn';
-import { marked } from 'marked';
+import { Marked } from 'marked';
 import { CodeBlock, CodeBlockCode } from './code-block';
 import { useChatConfig, textClass } from '../primitives/chat-config';
+import { isSafeUrl } from '../primitives/card-routing';
 
-marked.setOptions({ gfm: true, breaks: true });
+// --- The markdown sink -------------------------------------------------------
+//
+// `MarkdownBlock` writes this parser's output to `innerHTML`, so THIS is the one
+// place in the kit where a string the model produced becomes live DOM in the
+// host page's origin. `marked` passes raw HTML through verbatim by default and
+// dropped its own URL sanitizing in v5, so both have to be handled here.
+//
+// The threat model is NOT a hostile provider. An attacker only needs to
+// influence the model's OUTPUT -- a user asking to be shown an `<img onerror>`
+// example, a prompt-injected model, or RAG over an untrusted document all reach
+// this sink against a perfectly trusted provider.
+//
+// WHY ESCAPE RATHER THAN SANITIZE (no DOMPurify):
+//   - A sanitizer needs a DOM. In Node this package's ESM build has no
+//     `sanitize` at all (`isSupported === false`), so the SSR path either throws
+//     or gets "guarded" into returning the payload UNCHANGED -- a silent
+//     passthrough of exactly the string we were trying to neutralise. Escaping
+//     is pure string work and behaves identically on server and client.
+//   - It costs no dependency. Escaping is the ~20 lines below; DOMPurify is
+//     ~35 KB gzipped of ESM in a package that gates its own footprint.
+//   - For a CHAT UI it is also the better RENDERING, not just the safer one.
+//     Raw HTML in model output is either the model quoting markup -- which the
+//     reader should SEE as text -- or an injection. Escaping serves the first
+//     case correctly and defuses the second. Nothing in this repo emits markdown
+//     that relies on inline HTML.
+// There is deliberately NO opt-in to restore raw HTML: nothing needs it today,
+// and an unsafe switch is the hole again for whoever flips it.
+//
+// This is a PRIVATE `Marked` instance, and that is load-bearing rather than
+// tidiness. Configuring the shared `marked` singleton would mean a consumer's
+// own `marked.use({ renderer })` elsewhere in the same app silently replaces
+// this renderer and reopens the vulnerability. It also stops the kit mutating
+// global `marked` options out from under a consumer, which it used to do.
+
+/** Escape for HTML TEXT content. */
+function escapeText(s: string): string {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+/** Escape for a double-quoted ATTRIBUTE value. */
+function escapeAttr(s: string): string {
+  return escapeText(s).replace(/"/g, '&quot;');
+}
+
+const md = new Marked({
+  gfm: true,
+  breaks: true,
+  renderer: {
+    /** Raw HTML -- block (`Tokens.HTML`) and inline (`Tokens.Tag`) both land
+     *  here. Rendered as visible text instead of markup. */
+    html({ text }) {
+      return escapeText(text);
+    },
+
+    /** Markdown link syntax. marked BUILDS this anchor itself, so escaping raw
+     *  HTML does not cover it and it needs the scheme allowlist of its own.
+     *  A blocked link keeps its LABEL -- the reader still sees what the model
+     *  wrote, we simply refuse to make it clickable. */
+    link({ href, title, tokens }) {
+      const text = this.parser.parseInline(tokens);
+      if (!isSafeUrl(href)) return text;
+      const t = title ? ` title="${escapeAttr(title)}"` : '';
+      return `<a href="${escapeAttr(href)}"${t}>${text}</a>`;
+    },
+
+    /** Markdown image syntax. Same reasoning as `link`; a blocked image falls
+     *  back to its alt text. NOTE this also blocks `data:` image URIs, which
+     *  are inert inside `<img>` -- one allowlist for both is worth more than
+     *  the rare inline-data-image case it costs. */
+    image({ href, title, text }) {
+      if (!isSafeUrl(href)) return escapeText(text);
+      const t = title ? ` title="${escapeAttr(title)}"` : '';
+      return `<img src="${escapeAttr(href)}" alt="${escapeAttr(text)}"${t}>`;
+    },
+  },
+});
 
 export interface MarkdownProps {
   content: string;
@@ -23,7 +99,7 @@ interface ParsedBlock {
 }
 
 function parseMarkdownIntoBlocks(markdown: string): ParsedBlock[] {
-  const tokens = marked.lexer(markdown);
+  const tokens = md.lexer(markdown);
   return tokens.map((token) => {
     if (token.type === 'code') {
       return {
@@ -42,9 +118,11 @@ function parseMarkdownIntoBlocks(markdown: string): ParsedBlock[] {
 function MarkdownBlock(props: { content: string }) {
   const html = createMemo(() => {
     try {
-      return marked.parse(props.content, { async: false }) as string;
+      return md.parse(props.content, { async: false }) as string;
     } catch {
-      return props.content;
+      // The parse failed, so nothing has been escaped -- the raw source must
+      // NOT go to `innerHTML`. Escape it and show it as text.
+      return escapeText(props.content);
     }
   });
 

package/src/components/source.tsx

@@ -1,6 +1,7 @@
 import { type JSX, createContext, useContext, Show, splitProps } from 'solid-js';
 import { cn } from '../utils/cn';
 import { HoverCardRoot, HoverCardTrigger, HoverCardContent } from '../ui/hover-card';
+import { isRenderableLink } from '../primitives/link-preview';
 
 // --- Context ---
 
@@ -30,12 +31,43 @@ export interface SourceProps {
 }
 
 function Source(props: SourceProps) {
-  const href = () => props.href ?? '';
+  const raw = () => props.href ?? '';
+
+  /** The url actually put in `href`.
+   *
+   *  A citation url is MODEL-SUPPLIED: `wire/formats/openai.ts` (`sourcesOf`)
+   *  and `wire/formats/anthropic.ts` (`citations_delta`) both take it as an
+   *  arbitrary string. `javascript:`/`data:` in an href is script execution one
+   *  click away, and today the only thing stopping it is `target="_blank"` plus
+   *  current Chrome behaviour -- an accident of the browser, not a guard. Anyone
+   *  dropping `target="_blank"` for styling would silently make it live.
+   *
+   *  Filtered HERE, at render, rather than in `wire/`, for two reasons.
+   *  (1) The wire layer is OPTIONAL: a consumer with their own backend adapter
+   *  can set `messages` containing `source` parts directly and never touch
+   *  `wire/`, so a wire-side filter would leave that path exploitable while
+   *  looking fixed. Every path renders through here.
+   *  (2) `parts` should keep reporting what the model actually said, so a
+   *  consumer logging or auditing citations is not lied to. The kit refuses to
+   *  LINK the url; it does not pretend the url was never there.
+   *
+   *  `isRenderableLink` (absolute http(s) only) is the right guard rather than
+   *  `isSafeUrl` from card-routing: a citation is a reference to a page on the
+   *  web, so unlike a markdown body link it has no business being relative. */
+  const href = () => (isRenderableLink(raw()) ? raw() : '');
+
+  /** Display only, and deliberately derived from the RAW value: a blocked url
+   *  still has to label its chip, and dropping to an empty string here would
+   *  render a blank chip instead of showing the reader what arrived. The value
+   *  lands in a text node, which Solid escapes. */
   const domain = () => {
-    const h = href();
+    const h = raw();
     if (!h) return '';
     try {
-      return new URL(h).hostname;
+      // `new URL('javascript:x')` parses fine and yields an EMPTY hostname, so
+      // a blocked citation would otherwise label an empty chip. Fall back to the
+      // raw string: the reader sees what arrived, just not as a link.
+      return new URL(h).hostname || h;
     } catch {
       return h.split('/').pop() || h;
     }

package/src/primitives/card-routing.ts

@@ -17,8 +17,60 @@ export function emitCardEvent(element: HTMLElement, event: CardEvent): void {
 }
 
 const SAFE_SCHEMES = ['http:', 'https:', 'mailto:'];
-function isSafeUrl(url: string): boolean {
-  try { return SAFE_SCHEMES.includes(new URL(url, 'http://_invalid_base').protocol); } catch { return false; }
+const SCRIPT_SCHEMES = ['javascript:', 'vbscript:'];
+
+/** The scheme the WHATWG parser reads out of `url`, resolved against a base so a
+ *  relative input inherits `http:`. `undefined` when it will not parse at all.
+ *
+ *  ONE parser for the two questions below, deliberately: the parsing is where
+ *  the subtlety lives (it strips embedded tabs/newlines and trims surrounding
+ *  whitespace before reading the scheme, so `java\nscript:` and
+ *  `  javascript:...  ` are both read as `javascript:` -- which a regex over the
+ *  raw string would miss). Two predicates over one parse cannot drift on that;
+ *  two hand-rolled parsers would. */
+function schemeOf(url: string): string | undefined {
+  try { return new URL(url, 'http://_invalid_base').protocol; } catch { return undefined; }
+}
+
+/** True when `url` is safe to put in an href / hand to `window.open`.
+ *
+ *  Exported so the MARKDOWN renderer and the ARTIFACT viewer reuse this exact
+ *  guard rather than growing a second scheme list that can drift from this one.
+ *
+ *  Resolving against a base is deliberate and is what makes it correct for
+ *  markdown: a relative or fragment link (`/docs`, `#section`, `./rel`) is
+ *  ordinary markdown, and resolving it inherits the base's `http:` so it
+ *  passes, while `javascript:`/`data:`/`vbscript:` keep their own protocol and
+ *  fail. It is correct for the artifact viewer for the same reason: a file with
+ *  no `src` to resolve against yields a bare relative path (`docs/report.pdf`),
+ *  which is a legitimate artifact address. Contrast `isRenderableLink` in
+ *  `primitives/link-preview.ts`, which takes NO base and so demands an absolute
+ *  http(s) URL: that is the right guard for a model-supplied citation -- a
+ *  reference to a page on the public web -- this one for markdown body links and
+ *  artifact file addresses. */
+export function isSafeUrl(url: string): boolean {
+  const scheme = schemeOf(url);
+  return scheme !== undefined && SAFE_SCHEMES.includes(scheme);
+}
+
+/** True when navigating to `url` would EXECUTE it as script in the initiating
+ *  document's origin.
+ *
+ *  Strictly narrower than `!isSafeUrl(url)`, and not a competing policy: it
+ *  answers a different question, for the one sink where the allowlist is the
+ *  wrong tool. An `<iframe src>` legitimately takes `data:` and `blob:` (a
+ *  `data:` blob artifact is a documented `<kai-artifact>` use -- it is what
+ *  `displayUrl` exists for) and both get an OPAQUE origin in every modern
+ *  browser, so neither can reach the host page. `javascript:`/`vbscript:` are
+ *  the schemes that run in the EMBEDDER's origin, and they are the whole risk:
+ *  the default sandbox (no `allow-same-origin`) already makes the browser refuse
+ *  them, but a consumer who sets `allow-same-origin` turns a model-supplied
+ *  `src` into host-origin script execution. The artifact viewer used to suggest
+ *  that setting for "an artifact you trust"; it no longer does, and this guard
+ *  is what protects the consumers who took the old advice. */
+export function isScriptUrl(url: string): boolean {
+  const scheme = schemeOf(url);
+  return scheme !== undefined && SCRIPT_SCHEMES.includes(scheme);
 }
 function warnNoHandler(kind: string): void {
   // eslint-disable-next-line no-console

package/src/wire/formats/openai.ts

@@ -84,6 +84,19 @@ function detailField(details: unknown[], key: 'index' | 'signature'): unknown {
   return undefined;
 }
 
+/** The sibling reasoning STRINGS, in precedence order. See `applyReasoning`. */
+const REASONING_KEYS = ['reasoning', 'reasoning_content'] as const;
+
+/** First non-empty sibling string wins. These are alternative SPELLINGS of the
+ *  same text, never two halves of it, so this coalesces and never concatenates. */
+function siblingReasoning(delta: Record<string, unknown>): string | undefined {
+  for (const key of REASONING_KEYS) {
+    const raw = str(delta[key]);
+    if (raw !== undefined && raw !== '') return raw;
+  }
+  return undefined;
+}
+
 /**
  * FINDINGS: OpenRouter frequently puts the SAME text in `reasoning` AND in
  * `reasoning_details` on the same delta. Concatenating both doubles every
@@ -92,11 +105,34 @@ function detailField(details: unknown[], key: 'index' | 'signature'): unknown {
  * `reasoning_details` is still read in BOTH cases, for `reasoningRaw`, the block
  * index and the signature. It is the provider's own block list, and dropping it
  * is exactly the Anthropic 400 this entry exists to avoid.
+ *
+ * SIBLING NAMES. Chat-completions says nothing about reasoning, so every vendor
+ * extended it on its own and each parser in the wild reads a different subset:
+ * `reasoning` is what OpenRouter normalises to, `reasoning_content` is what
+ * DeepSeek's own API emits and what LiteLLM forwards. Nobody is ahead here and
+ * there is no canonical spelling. A stream that only ever went through
+ * OpenRouter never shows the other name, which is the whole reason this one
+ * stayed invisible: reading `reasoning` alone loses a DeepSeek-direct stream's
+ * reasoning completely, and silently.
+ *
+ * PRECEDENCE. The siblings coalesce, first non-empty wins, and both outrank the
+ * details text. `reasoning` is checked first, which is what keeps this additive:
+ * any stream that already carried `reasoning` parses byte for byte as it did
+ * before, so the order is only observable on a provider that disagrees with
+ * itself. A gateway that aliases one spelling onto the other sends identical
+ * text in both, and summing them would double every token exactly the way
+ * summing `reasoning` and `reasoning_details` does.
+ *
+ * SCOPE, and it is NOT a closed class. This covers the NAMING axis only.
+ * Reasoning on this wire is fragmented three ways STRUCTURALLY: a sibling string
+ * (here), a block array (`reasoning_details`), and reasoning carried inside a
+ * polymorphic `content` array. Aliasing bridges names, not shapes. A fourth
+ * spelling is one entry in REASONING_KEYS; a fourth SHAPE is not, and needs its
+ * own branch plus its own fixture.
  */
 function applyReasoning(delta: Record<string, unknown>, out: ModelStreamChunk): void {
   const details = Array.isArray(delta.reasoning_details) ? delta.reasoning_details : undefined;
-  const primaryRaw = str(delta.reasoning);
-  const primary = primaryRaw !== undefined && primaryRaw !== '' ? primaryRaw : undefined;
+  const primary = siblingReasoning(delta);
   const fallback = details ? detailText(details) : undefined;
   const hasDetails = details !== undefined && details.length > 0;
   const text = primary ?? fallback;

package/dist/elements/chunks/artifact-BhJIuh3D.js

@@ -1 +0,0 @@
-import{c as a,m as P,s as ce,g as k,k as C,l as F,x as G,o as Z,q as ue,i as h,S as g,t as v,d as p,a as y,b as J,v as Q,j as he,h as fe,e as ge}from"./define-B_tXMYRm.js";import{c as N}from"./cn-CU7UAWzk.js";import{B as z}from"./button-B9okqG73.js";import{C as be,a as me}from"./code-block-ClhQO9RW.js";import{F as ve}from"./file-tree-yGWNK0Js.js";import{L as pe}from"./loader-B5QzK_8_.js";import{a as we}from"./arrow-left-iJVnQmxA.js";import{I as X}from"./Icon-b5A8hlHs.js";import{r as xe,h as ke,c as ye}from"./rotate-cw-DzVDJOA1.js";import{d as ze}from"./download-DnCyWFJE.js";import{e as Y}from"./external-link-DG2sRdQL.js";import{f as Te}from"./file-text-D0J9F6M7.js";import{m as Ce,a as Fe}from"./minimize-2-SegJ_oku.js";var Pe=[["path",{d:"M5 12h14",key:"1ays0h"}],["path",{d:"m12 5 7 7-7 7",key:"xquz4c"}]],Se=r=>a(X,P(r,{name:"ArrowRight",iconNode:Pe})),Oe=Se,Re=[["path",{d:"M2 12s3-7 10-7 10 7 10 7-3 7-10 7-10-7-10-7Z",key:"rwhkz3"}],["circle",{cx:"12",cy:"12",r:"3",key:"1v7zrd"}]],je=r=>a(X,P(r,{name:"Eye",iconNode:Re})),Ie=je;const Ne="6.0.227",ee=`https://cdn.jsdelivr.net/npm/pdfjs-dist@${Ne}/build`,He=()=>import(/*@vite-ignore*/`${ee}/pdf.min.mjs`),Me=`${ee}/pdf.worker.min.mjs`;let Ee=He,Le=Me,H=null;function Ue(){if(!H){const r=Ee;H=(async()=>{const t=await r(),e=t.default??t;return e.GlobalWorkerOptions.workerSrc=Le,e})()}return H}async function $e(r,t,e){const o=await(await Ue()).getDocument({url:r}).promise;t.replaceChildren();const l=typeof window<"u"&&window.devicePixelRatio?window.devicePixelRatio:1;for(let s=1;s<=o.numPages;s++){const d=await o.getPage(s),c=d.getViewport({scale:1}),u=c.width>0?e/c.width:1,f=d.getViewport({scale:u*l}),b=document.createElement("canvas");b.width=Math.max(1,Math.floor(f.width)),b.height=Math.max(1,Math.floor(f.height)),b.setAttribute("role","img"),b.setAttribute("aria-label",`Page ${s}`),b.style.width="100%",b.style.height="auto",b.style.display="block";const w=b.getContext("2d");t.appendChild(b),await d.render({canvasContext:w,viewport:f}).promise}return{pages:o.numPages}}var Be=v('<div><div class="relative min-h-0 flex-1">'),De=v('<form class="min-w-0 flex-1"><label class=sr-only for=kai-artifact-path>Address</label><input id=kai-artifact-path name=kai-artifact-path type=text autocomplete=off placeholder="Enter a path or URL\u2026">'),Ae=v("<div class=flex-1 aria-hidden=true>"),Ve=v('<div role=tablist aria-label=View class="flex shrink-0 items-center gap-0.5 rounded-md bg-muted p-0.5">'),We=v('<div data-artifact-toolbar class="flex shrink-0 items-center gap-1.5 border-b border-border bg-surface px-2 py-1.5">'),qe=v("<button type=button role=tab>"),Ke=v('<iframe class="absolute inset-0 h-full w-full border-0 bg-white">'),_e=v('<div class="absolute inset-0 flex"><div class="w-56 shrink-0 overflow-auto border-r border-border bg-surface-sunken py-1.5 scrollbar-thin"></div><div class="min-w-0 flex-1 overflow-auto scrollbar-thin">'),Ge=v('<div class="flex h-full items-center justify-center p-6 text-sm text-muted-foreground">Select a file to view its source.'),Ze=v('<div class="flex h-full items-center justify-center p-6 text-sm text-muted-foreground">No source \u2014 this file (<!>) has no code view.'),Je=v(`<div role=region aria-label="PDF preview unavailable"class="absolute inset-0 flex flex-col items-center justify-center gap-3 bg-card p-6 text-center"><div class="text-sm font-medium text-foreground"></div><div class="text-xs text-muted-foreground">Can't preview this PDF inline.</div><div class="flex flex-wrap items-center justify-center gap-2"><a class="inline-flex h-8 items-center gap-1.5 rounded-md border border-border bg-background px-3 text-xs font-medium text-foreground transition-colors hover:bg-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"target=_blank rel="noopener noreferrer">Open in new tab</a><a class="inline-flex h-8 items-center gap-1.5 rounded-md border border-border bg-background px-3 text-xs font-medium text-foreground transition-colors hover:bg-muted focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"download>Download`),Qe=v('<div class="pointer-events-none absolute inset-0 flex items-center justify-center">'),Xe=v('<div class="absolute inset-0"><div role=region aria-label="PDF preview"tabindex=0 class="absolute inset-0 flex flex-col items-center gap-3 overflow-auto bg-surface-sunken p-3 scrollbar-thin focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset">');const Ye="allow-scripts allow-forms";function er(r,t){if(r.url)return r.url;if(!t)return r.path;try{return new URL(r.path,t).href}catch{return r.path}}function rr(r,t){if(!r)return!1;const e=t.find(l=>l.url===r||l.path===r);if(e?.type==="pdf")return!0;const o=r.split(/[?#]/)[0];return/\.pdf$/i.test(o)}function nr(r){const t=P({files:[],defaultTab:"preview",sandbox:Ye,showNav:!0,showReload:!0,showHome:!0,showPathField:!0,showTabs:!0,expandable:!1,openInTab:!1,standalone:!1,readonlyPath:!1,maximized:!1},r),[e,o]=ce(t,["src","files","tab","defaultTab","activeFile","sandbox","iframeTitle","onNavigate","onTabChange","onFileSelect","maximized","onMaximizeChange","showNav","showReload","showHome","showPathField","showTabs","expandable","openInTab","standalone","readonlyPath","displayUrl","controllerRef","class"]),[l,s]=k(e.src?[e.src]:[]),[d,c]=k(e.src?0:-1),u=()=>l()[d()]??"",f=()=>d()>0,b=()=>d()<l().length-1,[w,M]=k(e.tab??e.defaultTab),[E,L]=k(e.activeFile),[ne,te]=k(0),[S,O]=k(e.maximized??!1);C(()=>O(e.maximized??!1));const ae=()=>{var n;const i=!S();O(i),(n=e.onMaximizeChange)==null||n.call(e,i)},U=F(()=>{const n=u();return!!n&&n!=="about:blank"}),$=()=>{U()&&window.open(u(),"_blank","noopener,noreferrer")},B=F(()=>e.expandable&&!e.standalone),ie=F(()=>e.showNav||e.showReload||e.showHome||e.showPathField||e.showTabs||B()||e.openInTab);let x;C(()=>{e.tab!==void 0&&M(e.tab)}),C(()=>L(e.activeFile)),C(G(()=>e.src,n=>{n&&n!==u()&&T(n)},{defer:!0}));const D=n=>n===void 0?void 0:e.files.find(i=>i.path===n),A=F(()=>D(E())),oe=F(()=>{const n=A();return!!n&&n.type!=="image"&&n.type!=="pdf"&&typeof n.code=="string"});function T(n){if(n===u()){j();return}s(i=>[...i.slice(0,d()+1),n]),c(i=>i+1),R()}function R(){var n;const i=u();x&&(x.src=i||"about:blank"),(n=e.onNavigate)==null||n.call(e,i)}function le(n){var i;n!==w()&&(M(n),(i=e.onTabChange)==null||i.call(e,n))}function V(n,i){var m;L(n),(m=e.onFileSelect)==null||m.call(e,n),T(er(i,e.src))}const W=()=>{f()&&(c(n=>n-1),R())},q=()=>{b()&&(c(n=>n+1),R())};function j(){var n;const i=u();x&&(x.src="about:blank",x.src=i||"about:blank"),te(m=>m+1),(n=e.onNavigate)==null||n.call(e,i)}const K=()=>{e.src&&T(e.src)},_=n=>{var i;S()!==n&&(O(n),(i=e.onMaximizeChange)==null||i.call(e,n))};Z(()=>{var n;(n=e.controllerRef)==null||n.call(e,{back:()=>W(),forward:()=>q(),reload:()=>j(),home:()=>K(),navigate:i=>T(i),selectFile:i=>{const m=D(i);m&&V(i,m)},openExternal:()=>$(),maximize:()=>_(!0),restore:()=>_(!1)})});const se=()=>{var n,i;try{const m=(n=x?.contentWindow)==null?void 0:n.location.href;m&&m!=="about:blank"&&m!==u()&&(s(I=>[...I.slice(0,d()+1),m]),c(I=>I+1),(i=e.onNavigate)==null||i.call(e,m))}catch{}},de=n=>{n.preventDefault();const i=n.currentTarget.elements.namedItem("kai-artifact-path");if(e.readonlyPath||e.displayUrl!=null){i&&(i.value=e.displayUrl??u());return}i&&i.value&&T(i.value)};return(()=>{var n=Be(),i=n.firstChild;return ue(n,P({get class(){return N("flex h-full w-full flex-col overflow-hidden bg-card text-card-foreground",e.standalone&&"rounded-xl border border-border",e.class)}},o),!1,!0),h(n,a(g,{get when(){return ie()},get children(){return a(tr,{url:()=>e.displayUrl??u(),tab:w,canBack:f,canForward:b,canHome:()=>!!e.src,onBack:W,onForward:q,onReload:j,onHome:K,onSubmitPath:de,onTab:le,showNav:()=>e.showNav,showReload:()=>e.showReload,showHome:()=>e.showHome,showPathField:()=>e.showPathField,showTabs:()=>e.showTabs,showExpand:B,showOpenInTab:()=>e.openInTab,maximized:S,onToggleMaximize:ae,canOpenInTab:U,onOpenInTab:$,readonlyPath:()=>e.readonlyPath||e.displayUrl!=null})}}),i),h(i,a(g,{get when(){return w()==="preview"},get fallback(){return a(ir,{get files(){return e.files},activeFile:E,activeFileObj:A,hasSource:oe,onSelect:V})},get children(){return a(g,{get when(){return rr(u(),e.files)},get fallback(){return a(ar,{ref:m=>x=m,src:u,get sandbox(){return e.sandbox},get title(){return e.iframeTitle??"Artifact preview"},onLoad:se})},get children(){return a(lr,{get url(){return u()},get reloadKey(){return ne()}})}})}})),n})()}function tr(r){return(()=>{var t=We();return h(t,a(g,{get when(){return r.showNav()},get children(){return[a(z,{variant:"ghost",size:"icon-sm","aria-label":"Back",get disabled(){return!r.canBack()},onClick:()=>r.onBack(),get children(){return a(we,{size:16,"aria-hidden":"true"})}}),a(z,{variant:"ghost",size:"icon-sm","aria-label":"Forward",get disabled(){return!r.canForward()},onClick:()=>r.onForward(),get children(){return a(Oe,{size:16,"aria-hidden":"true"})}})]}}),null),h(t,a(g,{get when(){return r.showReload()},get children(){return a(z,{variant:"ghost",size:"icon-sm","aria-label":"Reload",onClick:()=>r.onReload(),get children(){return a(xe,{size:15,"aria-hidden":"true"})}})}}),null),h(t,a(g,{get when(){return r.showHome()},get children(){return a(z,{variant:"ghost",size:"icon-sm","aria-label":"Home",get disabled(){return!r.canHome()},onClick:()=>r.onHome(),get children(){return a(ke,{size:15,"aria-hidden":"true"})}})}}),null),h(t,a(g,{get when(){return r.showPathField()},get children(){var e=De(),o=e.firstChild,l=o.nextSibling;return e.addEventListener("submit",s=>r.onSubmitPath(s)),p(l,"spellcheck",!1),y(s=>{var d=r.readonlyPath()||void 0,c=r.readonlyPath()?"true":void 0,u=N("h-7 w-full rounded-md border border-border px-2.5 text-xs text-foreground font-mono outline-none",r.readonlyPath()?"bg-muted/40 cursor-default":"bg-background focus-visible:ring-2 focus-visible:ring-ring");return d!==s.e&&(l.readOnly=s.e=d),c!==s.t&&p(l,"aria-readonly",s.t=c),u!==s.a&&J(l,s.a=u),s},{e:void 0,t:void 0,a:void 0}),y(()=>l.value=r.url()),e}}),null),h(t,a(g,{get when(){return!r.showPathField()},get children(){return Ae()}}),null),h(t,a(g,{get when(){return r.showExpand()},get children(){return a(z,{variant:"ghost",size:"icon-sm",get"aria-label"(){return r.maximized()?"Collapse":"Expand"},get"aria-expanded"(){return r.maximized()},onClick:()=>r.onToggleMaximize(),get children(){return a(g,{get when(){return r.maximized()},get fallback(){return a(Fe,{size:15,"aria-hidden":"true"})},get children(){return a(Ce,{size:15,"aria-hidden":"true"})}})}})}}),null),h(t,a(g,{get when(){return r.showOpenInTab()},get children(){return a(z,{variant:"ghost",size:"icon-sm","aria-label":"Open in new tab",get disabled(){return!r.canOpenInTab()},onClick:()=>r.onOpenInTab(),get children(){return a(Y,{size:15,"aria-hidden":"true"})}})}}),null),h(t,a(g,{get when(){return r.showTabs()},get children(){var e=Ve();return h(e,a(re,{label:"Preview",get icon(){return a(Ie,{size:14,"aria-hidden":"true"})},get selected(){return r.tab()==="preview"},onClick:()=>r.onTab("preview")}),null),h(e,a(re,{label:"Code",get icon(){return a(ye,{size:14,"aria-hidden":"true"})},get selected(){return r.tab()==="code"},onClick:()=>r.onTab("code")}),null),e}}),null),t})()}function re(r){return(()=>{var t=qe();return t.$$click=()=>r.onClick(),h(t,()=>r.icon,null),h(t,()=>r.label,null),y(e=>{var o=r.selected,l=N("inline-flex h-6 items-center gap-1.5 rounded px-2 text-xs font-medium transition-colors outline-none","focus-visible:ring-2 focus-visible:ring-ring",r.selected?"bg-background text-foreground shadow-sm":"text-muted-foreground hover:text-foreground");return o!==e.e&&p(t,"aria-selected",e.e=o),l!==e.t&&J(t,e.t=l),e},{e:void 0,t:void 0}),t})()}function ar(r){return(()=>{var t=Ke();t.addEventListener("load",()=>r.onLoad());var e=r.ref;return typeof e=="function"?Q(e,t):r.ref=t,y(o=>{var l=r.src()||"about:blank",s=r.sandbox,d=r.title;return l!==o.e&&p(t,"src",o.e=l),s!==o.t&&p(t,"sandbox",o.t=s),d!==o.a&&p(t,"title",o.a=d),o},{e:void 0,t:void 0,a:void 0}),t})()}function ir(r){return(()=>{var t=_e(),e=t.firstChild,o=e.nextSibling;return h(e,a(ve,{get files(){return r.files},get activeFile(){return r.activeFile()},onSelect:(l,s)=>r.onSelect(l,s)})),h(o,a(g,{get when(){return r.activeFileObj()},get fallback(){return Ge()},get children(){return a(g,{get when(){return r.hasSource()},get fallback(){return(()=>{var l=Ze(),s=l.firstChild,d=s.nextSibling;return d.nextSibling,h(l,()=>r.activeFileObj().type??"binary",d),l})()},get children(){return a(be,{class:"h-full rounded-none border-0",get children(){return a(me,{get code(){return r.activeFileObj().code??""},get language(){return r.activeFileObj().language}})}})}})}})),t})()}function or(r){const t=()=>{const e=r.url.split(/[?#]/)[0];return e.slice(e.lastIndexOf("/")+1)||"document.pdf"};return(()=>{var e=Je(),o=e.firstChild,l=o.nextSibling,s=l.nextSibling,d=s.firstChild;d.firstChild;var c=d.nextSibling,u=c.firstChild;return h(e,a(Te,{size:40,class:"text-muted-foreground","aria-hidden":"true"}),o),h(o,t),h(d,a(Y,{size:13,"aria-hidden":"true"}),null),h(c,a(ze,{size:13,"aria-hidden":"true"}),u),y(f=>{var b=r.url,w=r.url;return b!==f.e&&p(d,"href",f.e=b),w!==f.t&&p(c,"href",f.t=w),f},{e:void 0,t:void 0}),e})()}function lr(r){const[t,e]=k("loading");let o,l=0,s;const d=async()=>{if(!o){e("error");return}const c=++l;e("loading");try{const u=o.clientWidth||600;await $e(r.url,o,u),c===l&&e("success")}catch{c===l&&e("error")}};return C(G(()=>[r.url,r.reloadKey],()=>{d()})),Z(()=>{if(!o||typeof ResizeObserver>"u")return;const c=new ResizeObserver(()=>{t()==="success"&&(clearTimeout(s),s=setTimeout(()=>{d()},200))});c.observe(o),fe(()=>{c.disconnect(),clearTimeout(s),l++})}),(()=>{var c=Xe(),u=c.firstChild;return Q(f=>o=f,u),h(c,a(g,{get when(){return he(()=>!0)()&&t()==="loading"},get children(){var f=Qe();return h(f,a(pe,{variant:"circular",size:"md"})),f}}),null),h(c,a(g,{get when(){return t()==="error"},get children(){return a(or,{get url(){return r.url}})}}),null),y(()=>p(u,"aria-busy",t()==="loading")),c})()}ge(["click"]);export{nr as A};

package/dist/elements/chunks/card-routing-C986KuUA.js

@@ -1 +0,0 @@
-const o="kai-card";function c(t,e){t.dispatchEvent(new CustomEvent(o,{detail:e,bubbles:!0,composed:!0}))}const d=["http:","https:","mailto:"];function i(t){try{return d.includes(new URL(t,"http://_invalid_base").protocol)}catch{return!1}}function r(t){console.warn(`[kai-card] no policy handler for "${t}"`)}function p(t,e){const n=t??{};switch(e.kind){case"ready":break;case"submit":n.onSubmit?n.onSubmit(e.cardId,e.data):r("submit");break;case"action":n.onAction?n.onAction(e.cardId,e.action,e.payload):r("action");break;case"send-prompt":{const a=e.mode??"compose",s=n.maxSendPromptMode==="send"?a:"compose";n.onSendPrompt?n.onSendPrompt(e.text,{mode:s,context:e.context}):r("send-prompt");break}case"open":{if(!i(e.url)){n.onError?n.onError(e.cardId,`Blocked unsafe url: ${e.url}`):r("open(unsafe)");break}const a=e.target??"tab";n.onOpen?n.onOpen(e.url,a):typeof window<"u"&&window.open(e.url,"_blank","noopener,noreferrer");break}case"state":n.onState?n.onState(e.cardId,e.patch):r("state");break;case"dismiss":n.onDismiss?n.onDismiss(e.cardId):r("dismiss");break;case"reopen":n.onReopen?n.onReopen(e.cardId):r("reopen");break;case"error":n.onError?n.onError(e.cardId,e.message):r("error");break}}export{o as C,c as e,p as r};

package/dist/elements/chunks/link-preview-C9-jNJBf.js

@@ -1 +0,0 @@
-import{s as q,g as x,l as v,o as B,k as L,x as C,c as n,i as a,S as g,a as m,d as f,b as S,t as c,e as F}from"./define-B_tXMYRm.js";import{c as z}from"./cn-CU7UAWzk.js";import{S as w}from"./skeleton-N8BuWYmf.js";import{l as D}from"./link-BdsfLB7b.js";function G(d){try{return new URL(d).hostname.replace(/^www\./,"")}catch{return}}const H=["http:","https:"];function J(d){try{return H.includes(new URL(d).protocol)}catch{return!1}}var K=c('<div class="space-y-2 p-3">'),M=c('<img role=img class="aspect-[16/9] w-full object-cover">'),P=c('<img alt class="h-3.5 w-3.5 shrink-0 rounded-sm">'),Q=c('<div class="line-clamp-3 text-xs text-muted-foreground">'),T=c('<div class="space-y-1 p-3"><div class="flex items-center gap-1.5 text-xs text-muted-foreground"><span class=truncate></span></div><div class="line-clamp-2 text-sm font-semibold text-foreground">'),V=c('<a rel="noopener noreferrer">'),W=c('<div role=img aria-label="Invalid link"><span class=truncate>Invalid link');function X(d){return!!(d.title||d.description||d.image)}function Y(d){const[i]=q(d,["cardId","data","onEmit","class"]),b=r=>{var e;return(e=i.onEmit)==null?void 0:e.call(i,r)},[R,_]=x(),[y,Z]=x(!1),[U,I]=x(!1),u=()=>i.data.url,h=v(()=>J(u())),s=v(()=>({...i.data,...R()}));B(()=>b({kind:"ready",cardId:i.cardId})),L(C(h,r=>{r||b({kind:"error",cardId:i.cardId,message:`Invalid link url: ${u()}`})})),L(C(()=>[i.data,h()],([r,e])=>{I(!1),!e||X(r)}));const k=v(()=>s().domain??G(u())??u()),j=v(()=>s().siteName??k()),$=v(()=>s().title??k()),A=v(()=>!!s().image&&!U()),E=()=>{h()&&b({kind:"open",cardId:i.cardId,url:u(),target:"tab"})},N=r=>{r.preventDefault(),E()},O=r=>{(r.key==="Enter"||r.key===" ")&&(r.preventDefault(),E())};return n(g,{get when(){return h()},get fallback(){return(()=>{var r=W(),e=r.firstChild;return a(r,n(D,{size:16,"aria-hidden":"true"}),e),m(()=>S(r,z("flex items-center gap-2 rounded-xl border border-destructive/40 bg-destructive/10 px-3 py-2 text-sm text-destructive dark:border-red-400/50 dark:bg-destructive/20 dark:text-red-400",i.class))),r})()},get children(){var r=V();return r.$$keydown=O,r.$$click=N,a(r,n(g,{get when(){return y()},get children(){return[n(w,{class:"aspect-[16/9] w-full rounded-none"}),(()=>{var e=K();return a(e,n(w,{class:"h-3 w-1/3"}),null),a(e,n(w,{class:"h-4 w-2/3"}),null),a(e,n(w,{class:"h-3 w-full"}),null),e})()]}}),null),a(r,n(g,{get when(){return!y()},get children(){return[n(g,{get when(){return A()},get children(){var e=M();return e.addEventListener("error",()=>I(!0)),m(t=>{var l=s().image,o=s().imageAlt??"";return l!==t.e&&f(e,"src",t.e=l),o!==t.t&&f(e,"alt",t.t=o),t},{e:void 0,t:void 0}),e}}),(()=>{var e=T(),t=e.firstChild,l=t.firstChild,o=t.nextSibling;return a(t,n(g,{get when(){return s().favicon},get fallback(){return n(D,{size:12,class:"shrink-0 opacity-70","aria-hidden":"true"})},get children(){var p=P();return m(()=>f(p,"src",s().favicon)),p}}),l),a(l,j),a(o,$),a(e,n(g,{get when(){return s().description},get children(){var p=Q();return a(p,()=>s().description),p}}),null),e})()]}}),null),m(e=>{var t=u(),l=`Open ${$()} on ${k()}`,o=z("group block overflow-hidden rounded-xl border border-border bg-card text-card-foreground no-underline outline-none transition-shadow","cursor-pointer hover:shadow-md focus-visible:ring-2 focus-visible:ring-ring",i.class);return t!==e.e&&f(r,"href",e.e=t),l!==e.t&&f(r,"aria-label",e.t=l),o!==e.a&&S(r,e.a=o),e},{e:void 0,t:void 0,a:void 0}),r}})}F(["click","keydown"]);export{Y as L};

package/dist/elements/chunks/source-eJurW_-L.js

@@ -1 +0,0 @@
-import{i as o,a as c,d as u,b as m,c as a,S as d,j as w,t as l,z as x,A as b}from"./define-B_tXMYRm.js";import{c as f}from"./cn-CU7UAWzk.js";import{H as y,a as z,b as S}from"./hover-card-6KtXpLwT.js";var C=l('<img alt=favicon width=14 height=14 class="size-3.5 rounded-full">'),_=l('<a target=_blank rel="noopener noreferrer"><span class="truncate tabular-nums text-center font-normal">'),k=l('<div class="flex items-center gap-1.5"><img alt=favicon class="size-4 rounded-full"width=16 height=16><div class="text-primary truncate text-sm">'),R=l('<div class="line-clamp-2 text-sm font-medium">'),F=l('<div class="text-muted-foreground line-clamp-2 text-sm">'),I=l('<a target=_blank rel="noopener noreferrer"class="flex flex-col gap-2 p-3">'),U=l("<div>");const v=x();function p(){const r=b(v);if(!r)throw new Error("Source.* must be used inside <Source>");return r}function $(r){const n=()=>r.href??"",t=()=>{const e=n();if(!e)return"";try{return new URL(e).hostname}catch{return e.split("/").pop()||e}};return a(v.Provider,{value:{get href(){return n()},get domain(){return t()}},get children(){return a(y,{openDelay:150,get children(){return r.children}})}})}function j(r){const n=p(),t=()=>r.label??n.domain.replace("www.","");return a(z,{get children(){var e=_(),s=e.firstChild;return o(e,a(d,{get when(){return w(()=>!!r.showFavicon)()&&n.href},get children(){var i=C();return c(()=>u(i,"src",`https://www.google.com/s2/favicons?sz=64&domain_url=${encodeURIComponent(n.href)}`)),i}}),s),o(s,t),c(i=>{var h=n.href||void 0,g=f("bg-muted text-foreground/80 hover:bg-muted-foreground/30 hover:text-primary focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-1 focus-visible:ring-offset-background inline-flex h-5 max-w-32 items-center gap-1 overflow-hidden rounded-full py-0 text-xs no-underline transition-colors duration-150",r.showFavicon?"pr-2 pl-1":"px-2",r.class);return h!==i.e&&u(e,"href",i.e=h),g!==i.t&&m(e,i.t=g),i},{e:void 0,t:void 0}),e}})}function H(r){const n=p();return a(S,{get class(){return f("w-80 p-0 shadow-xs",r.class)},get children(){var t=I();return o(t,a(d,{get when(){return n.href},get children(){var e=k(),s=e.firstChild,i=s.nextSibling;return o(i,()=>n.domain.replace("www.","")),c(()=>u(s,"src",`https://www.google.com/s2/favicons?sz=64&domain_url=${encodeURIComponent(n.href)}`)),e}}),null),o(t,a(d,{get when(){return r.title},get children(){var e=R();return o(e,()=>r.title),e}}),null),o(t,a(d,{get when(){return r.description},get children(){var e=F();return o(e,()=>r.description),e}}),null),c(()=>u(t,"href",n.href||void 0)),t}})}function L(r){return(()=>{var n=U();return o(n,()=>r.children),c(t=>{var e=r.part,s=f("flex flex-wrap gap-1.5 mt-3",r.class);return e!==t.e&&u(n,"part",t.e=e),s!==t.t&&m(n,t.t=s),t},{e:void 0,t:void 0}),n})()}export{L as S,$ as a,j as b,H as c};