@kitn.ai/ui 0.28.0 → 0.29.0

package/README.md

@@ -75,7 +75,7 @@ The element bundle is a self-contained ES module — load it directly from [jsDe
 ```
 
 <!-- x-release-please-start-version -->
-The URLs above track the **latest** release — handy for trying things out. **For production, pin an exact version** (e.g. `@kitn.ai/ui@0.28.0/dist/kai.es.js`): pinned URLs are immutable and cached far more aggressively, and — since this package is pre-1.0 — pinning shields you from breaking changes in a future minor release.
+The URLs above track the **latest** release — handy for trying things out. **For production, pin an exact version** (e.g. `@kitn.ai/ui@0.29.0/dist/kai.es.js`): pinned URLs are immutable and cached far more aggressively, and — since this package is pre-1.0 — pinning shields you from breaking changes in a future minor release.
 <!-- x-release-please-end -->
 
 > **Pin `0.25.0` or newer.** Every version from `0.14.1` through `0.24.0` is covered by a [critical security advisory](https://github.com/kitn-ai/ui/security/advisories) and is deprecated on npm. `npm install` warns you about a deprecated version; **a CDN fetch does not**, so an old pinned URL in a page keeps serving the vulnerable bundle silently.

package/dist/agent-tooling/construct/public.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The public `@kitn.ai/ui/construct` export surface (dist/construct.js).
+ *
+ * Zod stays the single source of truth for the construct format (see
+ * schema.ts's header) — this re-export is what lets a BUILD-TIME consumer
+ * (create-kai's wizard, Task 2 of this round) validate a construct against the
+ * exact same schema the `kai` CLI and the MCP `construct` tool use, without
+ * hand-deriving a second copy the way the reference harness had to for the
+ * card schemas (see verify-schemas-exported.mjs's header for that history).
+ *
+ * Deliberately NOT added to the existing `./schemas` entry: that entry's
+ * source documents a size budget it holds itself to, and zod does not fit it.
+ * `./construct` is its own exports key for exactly that reason.
+ */
+export { ConstructSchema, validateConstruct, CONSTRUCT_SCHEMA_URL, type Construct, type ConstructProblem, type ValidationOutcome, } from './schema.js';

package/dist/agent-tooling/construct/schema.d.ts

@@ -0,0 +1,111 @@
+import { z } from 'zod';
+export declare const CONSTRUCT_SCHEMA_URL = "https://ui.kitn.ai/schemas/construct/v1.json";
+export declare const ConstructSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+    layout: z.ZodEnum<{
+        custom: "custom";
+        widget: "widget";
+        fullscreen: "fullscreen";
+        aside: "aside";
+        split: "split";
+    }>;
+    provider: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"mock">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"endpoint">;
+        url: z.ZodString;
+        wire: z.ZodEnum<{
+            openai: "openai";
+            anthropic: "anthropic";
+        }>;
+    }, z.core.$strict>], "mode">;
+    userId: z.ZodOptional<z.ZodString>;
+    theme: z.ZodOptional<z.ZodObject<{
+        accent: z.ZodOptional<z.ZodString>;
+        unreadColor: z.ZodOptional<z.ZodString>;
+        mode: z.ZodDefault<z.ZodEnum<{
+            light: "light";
+            dark: "dark";
+            system: "system";
+        }>>;
+    }, z.core.$strict>>;
+    header: z.ZodOptional<z.ZodObject<{
+        title: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    empty: z.ZodOptional<z.ZodObject<{
+        title: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        icon: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    home: z.ZodOptional<z.ZodObject<{
+        greeting: z.ZodOptional<z.ZodObject<{
+            title: z.ZodOptional<z.ZodString>;
+            subtitle: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        recentConversation: z.ZodOptional<z.ZodLiteral<true>>;
+        newConversation: z.ZodOptional<z.ZodObject<{
+            label: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        links: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            label: z.ZodString;
+            href: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            icon: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    capabilities: z.ZodOptional<z.ZodObject<{
+        starters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        attachments: z.ZodOptional<z.ZodObject<{
+            accept: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+        history: z.ZodOptional<z.ZodObject<{
+            persistence: z.ZodEnum<{
+                endpoint: "endpoint";
+                none: "none";
+                local: "local";
+            }>;
+            url: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        reasoning: z.ZodOptional<z.ZodEnum<{
+            full: "full";
+            compact: "compact";
+            off: "off";
+        }>>;
+        reasoningOpen: z.ZodOptional<z.ZodBoolean>;
+        conversations: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>;
+    cards: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>>>;
+    slots: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    widget: z.ZodOptional<z.ZodObject<{
+        position: z.ZodOptional<z.ZodEnum<{
+            "bottom-end": "bottom-end";
+            "bottom-start": "bottom-start";
+            "top-end": "top-end";
+            "top-start": "top-start";
+        }>>;
+        launcherIcon: z.ZodOptional<z.ZodString>;
+        defaultOpen: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Construct = z.infer<typeof ConstructSchema>;
+export interface ConstructProblem {
+    /** Dotted path into the construct, '' for the root. */
+    path: string;
+    message: string;
+}
+export type ValidationOutcome = {
+    ok: true;
+    construct: Construct;
+} | {
+    ok: false;
+    problems: ConstructProblem[];
+};
+/**
+ * Validate one construct. The ONLY doorway to codegen: a failure never reaches
+ * generation — the problems go back to the author/agent with paths and reasons.
+ */
+export declare function validateConstruct(input: unknown): ValidationOutcome;

package/dist/construct-cli.es.js

@@ -1211,12 +1211,12 @@ function writeProject(files, dir) {
   return overwritten;
 }
 const defaultIo = { log: (s) => console.log(s), error: (s) => console.error(s) };
-const USAGE = `usage: kai <command>
+const USAGE = `usage: npx @kitn.ai/ui <command>   (or \`kai <command>\` once @kitn.ai/ui is installed)
 
   kai validate <construct.json>          check a construct, print problems with paths
   kai eject <construct.json> <outDir>    write the generated Solid project (it's yours)
-  kai dev <construct.json>               live preview with reload-on-edit (Task 5)
-  kai compile <construct.json> [outDir]  one self-registering .js (Task 6)
+  kai dev <construct.json>               live preview with reload-on-edit
+  kai compile <construct.json> [outDir]  one self-registering .js
 `;
 function homeRecentConversationWarning(construct) {
   if (construct.home?.recentConversation && !construct.capabilities?.conversations) {

package/dist/construct.d.ts

@@ -0,0 +1,5 @@
+// GENERATED by scripts/emit-subpath-dts.mjs — do not edit.
+// Sibling declarations for dist/construct.js, so that RELATIVE imports
+// of this bundle (which bypass package.json "exports") still resolve to types.
+// Without this, tsc resolves the path to the .js and reports TS7016.
+export * from './agent-tooling/construct/public.js';

package/dist/construct.js

@@ -0,0 +1,327 @@
+import { z as e } from "zod";
+const I = ["http:", "https:", "mailto:"];
+function v(t) {
+  try {
+    return new URL(t, "http://_invalid_base").protocol;
+  } catch {
+    return;
+  }
+}
+function r(t) {
+  const o = v(t);
+  return o !== void 0 && I.includes(o);
+}
+const k = "https://ui.kitn.ai/schemas/construct/v1.json", y = /^[a-z][a-z0-9]*-[a-z0-9-]+$/, w = e.discriminatedUnion("mode", [
+  e.object({ mode: e.literal("mock") }).strict(),
+  e.object({
+    mode: e.literal("endpoint"),
+    /** The CONSUMER's chat route. Kit parses, consumer fetches. */
+    url: e.string().min(1),
+    wire: e.enum(["openai", "anthropic"])
+  }).strict()
+]), j = e.object({
+  $schema: e.string().optional(),
+  /** The emitted tag: <acme-support>. Must satisfy customElements.define. */
+  name: e.string().regex(y, 'must be a valid custom-element tag: lowercase, with a hyphen (e.g. "acme-support")'),
+  // Widened progressively: fullscreen/aside/split landed in Task 12, custom in Task 13.
+  layout: e.enum(["widget", "fullscreen", "aside", "split", "custom"]),
+  provider: w,
+  /** Plain (unsigned) identity passthrough — no signing/auth infra (owner
+   *  ruling, 2026-08-26: signed JWT/HMAC identity is later additive
+   *  vocabulary, not this field). TOP-LEVEL, not nested under `provider`:
+   *  local history scoping (`capabilities.history.persistence: 'local'`)
+   *  needs userId independent of provider mode — nesting it inside the
+   *  provider union would make it silently inert for `mode: 'mock'` +
+   *  local history, a real and common combination. Threaded as the
+   *  `x-kai-user-id` header on every emitted fetch to the CONSUMER's own
+   *  backend (the endpoint provider's chat POST, history's endpoint
+   *  GET/PUT), and folded into the localStorage key for `local` history so
+   *  different users on the same browser profile don't share one thread.
+   *  Constrained to printable-ASCII (no CR/LF, no non-ISO-8859-1 code
+   *  points) beyond the usual construct-authored-text escaping: this value
+   *  reaches an HTTP HEADER VALUE, not just a JS string literal, and
+   *  `fetch()` throws at RUNTIME on a header value containing CR/LF or
+   *  outside ISO-8859-1 — a bad userId would surface as an opaque crash in
+   *  the CONSUMER's generated app, not a construct-validation error. Reject
+   *  loudly here instead, where the author gets a path + message. */
+  userId: e.string().min(1).regex(
+    /^[\x20-\x7E]+$/,
+    "must be printable ASCII with no line breaks (it becomes an HTTP header value)"
+  ).optional(),
+  theme: e.object({
+    /** Any CSS color; becomes --kai-color-primary on the host. */
+    accent: e.string().optional(),
+    /** Any CSS color; becomes --kai-color-unread on the host (owner
+     *  ruling, 2026-08-26 — the unread-indicator round). Same treatment
+     *  as `accent` in every way that matters for safety: construct-
+     *  authored/untrusted text, carried to the emitted facade via
+     *  `ctx.element.style.setProperty('--kai-color-unread',
+     *  JSON.stringify(...))` — never string-interpolated into CSS
+     *  text — so it can never break out into a new declaration or rule
+     *  (see emitElement's doc on why `accent` uses setProperty at all).
+     *  Unlike `accent`, this has no paired -foreground to compute: the
+     *  three surfaces that read --color-unread (the conversation-list
+     *  row dot, the header toggle's badge, Dock's own closed-launcher
+     *  badge) are all small filled dots with no text sitting ON them, so
+     *  there is nothing to contrast-pair — the value is set and used
+     *  as-is. */
+    unreadColor: e.string().optional(),
+    mode: e.enum(["light", "dark", "system"]).default("system")
+  }).strict().optional(),
+  /** Construct-wide header chrome, valid on every layout (not layout-scoped
+   *  like `widget`, and not a capability toggle — a header is a construct-
+   *  wide fact, like `theme`). Rendered inside ChatThread's own built-in
+   *  header bar; a logo/icon projects through the kit's EXISTING
+   *  `header-start` named slot (`slots` vocabulary above), not a second
+   *  image-prop convention here. */
+  header: e.object({
+    /** Rendered in ChatThread's built-in header bar (left side). Construct-
+     *  authored/untrusted text, like theme.accent/provider.url — JSON.stringify'd
+     *  at its one emit site, never a raw JSX attribute string. */
+    title: e.string().min(1).optional()
+  }).strict().optional(),
+  /** Greeting shown while the thread is empty (no messages yet) — the
+   *  proven "welcome screen" pattern (Intercom-class): title + optional
+   *  description + optional icon above, with `capabilities.starters`'
+   *  chips and the composer still rendering below (ChatThread's `empty`
+   *  REPLACE slot only stands in for the empty MESSAGE LIST — see
+   *  chat-thread.tsx's own doc comment on `empty` — so the chips are
+   *  never lost). Construct-wide like `header`, not a capability: it's a
+   *  fact about the empty state, not a toggleable affordance.
+   *  `title`/`description` are construct-authored/untrusted text, like
+   *  `header.title`/`theme.accent`/`provider.url` — JSON.stringify'd at
+   *  their one emit site, never a raw JSX attribute string. `icon` is a
+   *  URL reaching an `<img src>` sink in emitted code, exactly like
+   *  `widget.launcherIcon` — same `isSafeUrl` policy, same superRefine
+   *  shape, below. */
+  empty: e.object({
+    title: e.string().min(1),
+    description: e.string().min(1).optional(),
+    icon: e.string().min(1).optional()
+  }).strict().optional(),
+  /** Home screen (spec 2026-08-27, H-1..H-5): Intercom-style landing view behind
+   *  a Home/Messages tab bar. PRESENCE of `home` enables the tab chrome (H-4) —
+   *  no `enabled` boolean, like `header`/`empty`. Every sub-key optional;
+   *  `home: {}` still means "tabs on, defaults". Never requires another
+   *  capability (H-3): the recent card simply renders nothing without
+   *  `capabilities.conversations` (the CLI warns — see cli.ts). All strings are
+   *  construct-authored/untrusted: JSON.stringify'd at every emit site; hrefs
+   *  and URL-shaped icons through isSafeUrl in superRefine below. */
+  home: e.object({
+    greeting: e.object({ title: e.string().min(1).optional(), subtitle: e.string().min(1).optional() }).strict().optional(),
+    recentConversation: e.literal(!0).optional(),
+    newConversation: e.object({ label: e.string().min(1).optional() }).strict().optional(),
+    links: e.array(
+      e.object({
+        label: e.string().min(1),
+        href: e.string().min(1).optional(),
+        description: e.string().min(1).optional(),
+        /** renderIcon name (e.g. 'book-open') or a safe URL — the icon NAME
+         *  list is renderIcon's own vocabulary, never restated here; unknown
+         *  names warn loudly at DEV runtime. */
+        icon: e.string().min(1).optional()
+      }).strict()
+    ).optional()
+  }).strict().optional(),
+  // Capability vocabulary, widened one field at a time by later tasks.
+  capabilities: e.object({
+    /** Starter prompts shown on the empty thread; clicking one sends it.
+     *  1-6 non-empty strings — construct-authored text, escaped like
+     *  `theme.accent`/`provider.url` at every emit interpolation site. */
+    starters: e.array(e.string().min(1)).min(1).max(6).optional(),
+    /** Enables the paperclip attach affordance; accept is a non-empty
+     *  list of media types/globs, e.g. ["image/*", "application/pdf"] —
+     *  WHETHER stays with the construct author (this field), HOW stays
+     *  with the kit (ChatThread's own attach/accept props, threaded
+     *  through by codegen). */
+    attachments: e.object({
+      /** Accept-list of media types/globs, e.g. ["image/*", "application/pdf"]. */
+      accept: e.array(e.string().min(1)).min(1)
+    }).strict().optional(),
+    /** Conversation persistence. `none` (default, nothing emitted): the
+     *  thread lives only in memory for the tab's lifetime. `local`:
+     *  persisted to this browser's localStorage, keyed by the construct's
+     *  tag — a mechanism decision (WHERE); what to retain and for how
+     *  long stays an app decision (component-scope-boundary), so no
+     *  retention count/quota lands here. `endpoint`: the CONSUMER's own
+     *  thread route (GET returns ChatMessage[], PUT stores them) —
+     *  requires `url`; `url` is rejected for any other persistence
+     *  (superRefine below, both directions loud). */
+    history: e.object({
+      persistence: e.enum(["none", "local", "endpoint"]),
+      /** endpoint persistence only: the CONSUMER's thread routes (GET returns
+       *  ChatMessage[], PUT stores them). Refined below. */
+      url: e.string().min(1).optional()
+    }).strict().optional(),
+    /** How the model's thinking (reasoning parts) renders. `'full'`
+     *  (the default when omitted — see codegen.ts's emitReasoningProp)
+     *  is the collapsible "Thinking" disclosure, shimmering while it
+     *  streams. `'compact'` shows only a shimmer/typing loader while
+     *  reasoning streams, with no expandable detail. `'off'` hides
+     *  reasoning entirely. This is HOW an existing medium fact (the
+     *  model's thinking) displays — the kit's call — so it maps straight
+     *  onto ChatThread's own `reasoning` prop; there is no app-layer
+     *  quota or retention decision hiding in it. Left `.optional()`
+     *  rather than `.default('full')`, matching every sibling field in
+     *  this object: a zod `.default()` here would make `reasoning`
+     *  REQUIRED on the inferred input type (z.infer is the output type),
+     *  breaking every `capabilities: {...}` object literal in this file
+     *  and its tests that doesn't mention it. */
+    reasoning: e.enum(["full", "compact", "off"]).optional(),
+    /** Seeds the reasoning disclosure open AND keeps it tracking the
+     *  stream (open while streaming, closes when it settles) — the
+     *  pre-Task-19f `full` behavior. Default false/absent: the panel
+     *  starts closed (just the "Thinking" shimmer chip) and only opens
+     *  on click — the current default (owner ruling, 2026-08-26).
+     *  Meaningless when `reasoning` is `'compact'` (no expandable
+     *  content exists) or `'off'` (nothing renders); rejected on both,
+     *  loudly, below. */
+    reasoningOpen: e.boolean().optional(),
+    /** Turns on the prior-conversations list (C-1..C-9 of the
+     *  conversations design). `true` only — there is no `false` form,
+     *  matching this schema's other presence-only capability flags.
+     *  Requires `capabilities.history.persistence` to be `local` or
+     *  `endpoint` (superRefine below, loud): a conversation list with
+     *  nowhere to persist conversations is not a coherent construct.
+     *  WHAT persists (this field, plus history) stays construct
+     *  vocabulary; HOW it persists (the ConversationStore adapter,
+     *  localStorage vs. a fetch endpoint) is codegen's call, never
+     *  vocabulary here (C-3 — no transport-layer vocabulary). */
+    conversations: e.literal(!0).optional()
+  }).strict().optional(),
+  /** Named generative-UI card definitions the model can emit as tool calls,
+   *  rendered in the thread. Top-level (not a capability): a card is
+   *  something the construct's model can DO at any point once a card is
+   *  declared, not a thread-affordance toggle like starters/attachments/
+   *  reasoning. Reuses the kit's own card-tool projection end to end
+   *  (`cardTools`/`toOpenAITools`/`toAnthropicTools`, `@kitn.ai/ui/schemas`)
+   *  — never a second one authored here. `schema` is validated structurally
+   *  only; deep card validation (incl. `x-kai-format` mask hints) is the
+   *  kit's own card contract at render time. */
+  cards: e.array(
+    e.object({
+      /** Tool-facing card name, e.g. "refund_approval". */
+      name: e.string().regex(/^[a-z][a-z0-9_]*$/),
+      /** The kit's card schema JSON (incl. x-kai-format mask hints).
+       *  Validated structurally here; deep card validation is the kit's
+       *  own card contract at render time. */
+      schema: e.record(e.string(), e.unknown())
+    }).strict()
+  ).min(1).optional(),
+  /** Named `<slot>` projection points the emitted web component exposes —
+   *  the format's ONLY escape hatch (named slots, no code-in-JSON). Each
+   *  name must be a valid HTML slot-attribute value AND a legible
+   *  identifier: kebab-case, starting with a letter (the same shape as a
+   *  CSS custom-ident) — `slot name="Header!"` is rejected, not sanitized,
+   *  matching the format's loud-rejection discipline everywhere else.
+   *  1-8 entries, no duplicates (superRefine below — a regex alone can't
+   *  see across array entries). `layout: 'custom'` requires at least one
+   *  declared slot (superRefine below): `custom` IS the slots grain — a
+   *  `custom` layout with nothing to project into is not meaningfully
+   *  different from `fullscreen`. */
+  slots: e.array(e.string().regex(/^[a-z][a-z0-9-]*$/, "slot names must be kebab-case, starting with a letter")).min(1).max(8).optional(),
+  /** Layout-scoped FAB chrome, `layout: 'widget'` only (superRefine below).
+   *  Purely additive sibling to `layout` (widen-never-restructure) — mirrors
+   *  Dock's own props verbatim, threaded through by codegen's emitLayoutOpen. */
+  widget: e.object({
+    /** Which corner. Mirrors Dock's own DockPosition enum verbatim — not a
+     *  new left/right binary. Omitted keeps Dock's own default (bottom-end). */
+    position: e.enum(["bottom-end", "bottom-start", "top-end", "top-start"]).optional(),
+    /** An image URL for the closed-state launcher glyph, replacing Dock's
+     *  built-in chat-bubble icon. Construct-authored/untrusted text, like
+     *  theme.accent and provider.url — escaped the same way at its one emit site. */
+    launcherIcon: e.string().min(1).optional(),
+    /** Seed Dock's open state at mount. Uncontrolled — never steals focus (Dock's
+     *  own focus contract, dock.tsx). Omitted keeps Dock's own default (closed). */
+    defaultOpen: e.boolean().optional()
+  }).strict().optional()
+}).strict().superRefine((t, o) => {
+  var c, p, d, m, u, h, g;
+  if (t.slots) {
+    const a = /* @__PURE__ */ new Set();
+    t.slots.forEach((s, b) => {
+      a.has(s) && o.addIssue({
+        code: e.ZodIssueCode.custom,
+        path: ["slots", b],
+        message: `duplicate slot name "${s}"`
+      }), a.add(s);
+    });
+  }
+  if (t.layout === "custom" && (!t.slots || t.slots.length === 0) && o.addIssue({
+    code: e.ZodIssueCode.custom,
+    path: ["slots"],
+    message: '"custom" layout requires at least one declared slot — custom IS the slots grain'
+  }), t.layout === "split" && t.slots) {
+    const a = t.slots.indexOf("pane");
+    a !== -1 && o.addIssue({
+      code: e.ZodIssueCode.custom,
+      path: ["slots", a],
+      message: `"pane" collides with the "split" layout's own fixed <slot name="pane"> — choose a different slot name`
+    });
+  }
+  t.widget && t.layout !== "widget" && o.addIssue({
+    code: e.ZodIssueCode.custom,
+    path: ["widget"],
+    message: '"widget" is only valid on layout: "widget"'
+  }), (c = t.widget) != null && c.launcherIcon && !r(t.widget.launcherIcon) && o.addIssue({
+    code: e.ZodIssueCode.custom,
+    path: ["widget", "launcherIcon"],
+    message: "launcherIcon must be an http(s)/mailto or relative URL — no javascript:/data: schemes"
+  }), (p = t.empty) != null && p.icon && !r(t.empty.icon) && o.addIssue({
+    code: e.ZodIssueCode.custom,
+    path: ["empty", "icon"],
+    message: "icon must be an http(s)/mailto or relative URL — no javascript:/data: schemes"
+  });
+  const i = (d = t.capabilities) == null ? void 0 : d.reasoning;
+  ((m = t.capabilities) == null ? void 0 : m.reasoningOpen) !== void 0 && (i === "compact" || i === "off") && o.addIssue({
+    code: e.ZodIssueCode.custom,
+    path: ["capabilities", "reasoningOpen"],
+    message: '"reasoningOpen" only applies when reasoning is "full" or omitted — "compact"/"off" have no disclosure to open'
+  });
+  const n = (u = t.capabilities) == null ? void 0 : u.history;
+  (h = t.capabilities) != null && h.conversations && (!n || n.persistence === "none") && o.addIssue({
+    code: e.ZodIssueCode.custom,
+    path: ["capabilities", "conversations"],
+    message: '"conversations" requires capabilities.history.persistence to be "local" or "endpoint" — a conversation list needs somewhere to persist conversations'
+  });
+  const f = /^[a-zA-Z][a-zA-Z0-9+.-]*:|^\/\//;
+  for (const [a, s] of (((g = t.home) == null ? void 0 : g.links) ?? []).entries())
+    s.href && !r(s.href) && o.addIssue({
+      code: e.ZodIssueCode.custom,
+      path: ["home", "links", a, "href"],
+      message: "href must be an http(s)/mailto or relative URL — no javascript:/data: schemes"
+    }), s.icon && f.test(s.icon) && !r(s.icon) && o.addIssue({
+      code: e.ZodIssueCode.custom,
+      path: ["home", "links", a, "icon"],
+      message: "icon must be a kit icon name or an http(s)/relative URL — no javascript:/data: schemes"
+    });
+  n && (n.persistence === "endpoint" && !n.url && o.addIssue({
+    code: e.ZodIssueCode.custom,
+    path: ["capabilities", "history", "url"],
+    message: '"endpoint" persistence requires a url'
+  }), n.persistence !== "endpoint" && n.url !== void 0 && o.addIssue({
+    code: e.ZodIssueCode.custom,
+    path: ["capabilities", "history", "url"],
+    message: 'url is only valid with "endpoint" persistence'
+  }));
+});
+function S(t) {
+  const o = j.safeParse(t);
+  return o.success ? { ok: !0, construct: o.data } : {
+    ok: !1,
+    problems: o.error.issues.flatMap((i) => i.code === "unrecognized_keys" ? i.keys.map((l) => ({
+      path: [...i.path.map(String), l].join("."),
+      message: `"${l}" is not construct vocabulary`
+    })) : [
+      {
+        path: i.path.map(String).join("."),
+        message: i.message
+      }
+    ])
+  };
+}
+export {
+  k as CONSTRUCT_SCHEMA_URL,
+  j as ConstructSchema,
+  S as validateConstruct
+};