@kortix/ui 0.0.0-stage → 0.14.4

package/dist/internal/lib/project-preamble.d.ts

@@ -0,0 +1,71 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+/**
+ * Structured XML ref tags for every @-mention kind in the chat pipeline.
+ *
+ * Each block is a header line + one or more self-closing XML tags, appended
+ * to the end of the outgoing message text. The agent sees structured
+ * metadata, and the frontend strips every block back out of the rendered
+ * bubble (see parse{Project,FileMention,AgentMention,Session}References in
+ * session-chat.tsx).
+ *
+ * Shape is identical across kinds so the pattern stays uniform:
+ *
+ *   <user's text>
+ *
+ *   Referenced files (...):
+ *   <file_ref path="..." name="..." />
+ *
+ *   Referenced agents (...):
+ *   <agent_ref name="..." />
+ *
+ *   Referenced sessions (...):
+ *   <session_ref id="..." title="..." />
+ */
+/**
+ * Escape a value for a double-quoted XML attribute in ONE pass: `&`, `"`,
+ * `'`, `<` and `>`. Values here often come from outside the user's own input
+ * (an agent writes session titles), so the result can never close the
+ * attribute or read as another tag. The inverse is `unescapeAttr` in
+ * packages/ui/src/session/thread/message-parsing.tsx.
+ */
+export declare function escapeXmlAttr(value: string): string;
+export interface FileRefLike {
+    /** Path inside the workspace, e.g. `src/foo.ts` or absolute. */
+    path: string;
+    /** Display name — defaults to path. */
+    name?: string;
+}
+export interface AgentRefLike {
+    name: string;
+}
+export interface SessionRefLike {
+    id: string;
+    title: string;
+}
+export declare function buildFileRef(f: FileRefLike): string;
+export declare function buildAgentRef(a: AgentRefLike): string;
+export declare function buildSessionRef(s: SessionRefLike): string;
+export declare function buildFileRefsBlock(files: ReadonlyArray<FileRefLike>): string;
+export declare function buildAgentRefsBlock(agents: ReadonlyArray<AgentRefLike>): string;
+/** The parenthesised hint `parseSessionReferences` strips with the header. */
+export declare const SESSION_REFS_HINT = "use the session_context tool to fetch details when needed";
+export declare function buildSessionRefsBlock(sessions: ReadonlyArray<SessionRefLike>): string;
+export declare function appendFileRefs(text: string, files: ReadonlyArray<FileRefLike>): string;
+export declare function appendAgentRefs(text: string, agents: ReadonlyArray<AgentRefLike>): string;
+export declare function appendSessionRefs(text: string, sessions: ReadonlyArray<SessionRefLike>): string;
+/** One tracked `@` mention, as the composer collects it (`TrackedMention`). */
+export interface MentionRefLike {
+    kind: string;
+    label: string;
+    /** A session mention's session id. */
+    value?: string;
+}
+/**
+ * Append the reference blocks for a draft's `@` mentions: sessions, then files,
+ * then agents, the order an in-session send writes them. The draft text holds
+ * only `@label`, so without these blocks the agent gets no path to open and no
+ * agent to hand off to. Used by every path that is not that send: a chat's
+ * first message (`ComposerChatInput`) and a slash command's args
+ * (`planDraftSubmission`).
+ */
+export declare function appendMentionRefs(text: string, mentions: ReadonlyArray<MentionRefLike> | undefined): string;

package/dist/internal/lib/project-preamble.js

@@ -0,0 +1,112 @@
+/**
+ * Structured XML ref tags for every @-mention kind in the chat pipeline.
+ *
+ * Each block is a header line + one or more self-closing XML tags, appended
+ * to the end of the outgoing message text. The agent sees structured
+ * metadata, and the frontend strips every block back out of the rendered
+ * bubble (see parse{Project,FileMention,AgentMention,Session}References in
+ * session-chat.tsx).
+ *
+ * Shape is identical across kinds so the pattern stays uniform:
+ *
+ *   <user's text>
+ *
+ *   Referenced files (...):
+ *   <file_ref path="..." name="..." />
+ *
+ *   Referenced agents (...):
+ *   <agent_ref name="..." />
+ *
+ *   Referenced sessions (...):
+ *   <session_ref id="..." title="..." />
+ */
+// ─── Attribute escaping ─────────────────────────────────────────────────────
+const XML_ATTR_ESCAPES = {
+    '&': '&amp;',
+    '"': '&quot;',
+    "'": '&#39;',
+    '<': '&lt;',
+    '>': '&gt;',
+};
+/**
+ * Escape a value for a double-quoted XML attribute in ONE pass: `&`, `"`,
+ * `'`, `<` and `>`. Values here often come from outside the user's own input
+ * (an agent writes session titles), so the result can never close the
+ * attribute or read as another tag. The inverse is `unescapeAttr` in
+ * packages/ui/src/session/thread/message-parsing.tsx.
+ */
+export function escapeXmlAttr(value) {
+    return value.replace(/[&"'<>]/g, (ch) => XML_ATTR_ESCAPES[ch]);
+}
+// ─── Tag builders ───────────────────────────────────────────────────────────
+export function buildFileRef(f) {
+    const name = f.name ?? f.path;
+    return `<file_ref path="${escapeXmlAttr(f.path)}" name="${escapeXmlAttr(name)}" />`;
+}
+export function buildAgentRef(a) {
+    return `<agent_ref name="${escapeXmlAttr(a.name)}" />`;
+}
+export function buildSessionRef(s) {
+    return `<session_ref id="${escapeXmlAttr(s.id)}" title="${escapeXmlAttr(s.title)}" />`;
+}
+// ─── Block builders ─────────────────────────────────────────────────────────
+export function buildFileRefsBlock(files) {
+    if (!files.length)
+        return '';
+    const refs = files.map(buildFileRef).join('\n');
+    return `Referenced files (the user has explicitly @-mentioned these — read them if relevant):\n${refs}`;
+}
+export function buildAgentRefsBlock(agents) {
+    if (!agents.length)
+        return '';
+    const refs = agents.map(buildAgentRef).join('\n');
+    return `Referenced agents (the user has @-mentioned these agents — delegate or hand off as appropriate):\n${refs}`;
+}
+/** The parenthesised hint `parseSessionReferences` strips with the header. */
+export const SESSION_REFS_HINT = 'use the session_context tool to fetch details when needed';
+export function buildSessionRefsBlock(sessions) {
+    if (!sessions.length)
+        return '';
+    const refs = sessions.map(buildSessionRef).join('\n');
+    return `Referenced sessions (${SESSION_REFS_HINT}):\n${refs}`;
+}
+// ─── Appenders (text-in, text-out) ──────────────────────────────────────────
+export function appendFileRefs(text, files) {
+    const block = buildFileRefsBlock(files);
+    if (!block)
+        return text;
+    return `${text}\n\n${block}`;
+}
+export function appendAgentRefs(text, agents) {
+    const block = buildAgentRefsBlock(agents);
+    if (!block)
+        return text;
+    return `${text}\n\n${block}`;
+}
+export function appendSessionRefs(text, sessions) {
+    const block = buildSessionRefsBlock(sessions);
+    if (!block)
+        return text;
+    return `${text}\n\n${block}`;
+}
+/**
+ * Append the reference blocks for a draft's `@` mentions: sessions, then files,
+ * then agents, the order an in-session send writes them. The draft text holds
+ * only `@label`, so without these blocks the agent gets no path to open and no
+ * agent to hand off to. Used by every path that is not that send: a chat's
+ * first message (`ComposerChatInput`) and a slash command's args
+ * (`planDraftSubmission`).
+ */
+export function appendMentionRefs(text, mentions) {
+    const labelled = (mentions ?? []).filter((mention) => mention.label);
+    const sessions = labelled
+        .filter((mention) => mention.kind === 'session' && mention.value)
+        .map((mention) => ({ id: mention.value, title: mention.label }));
+    const files = labelled
+        .filter((mention) => mention.kind === 'file')
+        .map((mention) => ({ path: mention.label, name: mention.label }));
+    const agents = labelled
+        .filter((mention) => mention.kind === 'agent')
+        .map((mention) => ({ name: mention.label }));
+    return appendAgentRefs(appendFileRefs(appendSessionRefs(text, sessions), files), agents);
+}

package/dist/internal/lib/promo-art.d.ts

@@ -0,0 +1,9 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+/**
+ * The mobile-app promo's art gradient, sampled from the eclipse orb it is
+ * modelled on: bone at the top, a red horizon, navy, then black. One art value,
+ * so its raw colours live in this one module. `in oklab` keeps the brightness
+ * even through the band. Read by the promo modal's art panel and the download
+ * page's Desktop card, so both surfaces share one backdrop.
+ */
+export declare const PROMO_GRADIENT = "linear-gradient(170deg in oklab, #DAD9D5 0%, #DAD9D5 34%, #943637 50%, #1D1F2C 60%, #000 82%)";

package/dist/internal/lib/promo-art.js

@@ -0,0 +1,9 @@
+/**
+ * The mobile-app promo's art gradient, sampled from the eclipse orb it is
+ * modelled on: bone at the top, a red horizon, navy, then black. One art value,
+ * so its raw colours live in this one module. `in oklab` keeps the brightness
+ * even through the band. Read by the promo modal's art panel and the download
+ * page's Desktop card, so both surfaces share one backdrop.
+ */
+// prettier-ignore
+export const PROMO_GRADIENT = 'linear-gradient(170deg in oklab, #DAD9D5 0%, #DAD9D5 34%, #943637 50%, #1D1F2C 60%, #000 82%)';

package/dist/internal/lib/provider-branding.d.ts

@@ -0,0 +1,26 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+export declare const POPULAR_PROVIDER_IDS: string[];
+export declare const MODEL_SELECTOR_PROVIDER_IDS: readonly string[];
+export declare const PROVIDER_LABELS: Record<string, string>;
+export declare const PROVIDER_HINTS: Record<string, string>;
+export declare const PROVIDER_NOTES: Record<string, string>;
+/**
+ * Resolve a provider id to its logo, or `undefined` when there is none (the
+ * caller falls back to monochrome initials). Keyed on the VERBATIM models.dev
+ * provider ids so live-catalog entries resolve — see the icon-map notes above
+ * for the Moonshot trio / Bedrock / Vertex cases. A mapped provider uses the
+ * host's copy under `baseUrl` when the host serves one, else the models.dev
+ * logo; a catalog provider without a mapped icon uses its models.dev logo.
+ * models.dev answers any id with a generic mark, so an id outside the catalog
+ * (a custom provider) keeps initials.
+ */
+export declare function providerIconSrc(providerID: string, baseUrl?: string): string | undefined;
+export declare function ProviderLogo({ providerID, name, className, size, tone, }: {
+    providerID: string;
+    name?: string;
+    className?: string;
+    size?: 'xs' | 'small' | 'medium' | 'default' | 'large';
+    /** `light`: a white tile with a hairline and the black mark in BOTH
+     *  themes. `theme` follows the theme. */
+    tone?: 'theme' | 'light';
+}): import("react").JSX.Element;

package/dist/internal/lib/provider-branding.js

@@ -0,0 +1,175 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { cn } from '../../lib/utils.js';
+import { CATALOG_PROVIDER_ENV, MODEL_SELECTOR_PROVIDER_IDS as SHARED_MODEL_SELECTOR_PROVIDER_IDS, PROVIDER_LABELS as SHARED_PROVIDER_LABELS, } from '@kortix/llm-catalog';
+import { KortixLogo } from '../../primitives/kortix-logo.js';
+import { useUiHostConfig, useUiImage } from '../../providers/ui-provider.js';
+import { useState } from 'react';
+export const POPULAR_PROVIDER_IDS = [
+    'anthropic',
+    'openai',
+    'github-copilot',
+    'google',
+    'openrouter',
+    'vercel',
+];
+export const MODEL_SELECTOR_PROVIDER_IDS = SHARED_MODEL_SELECTOR_PROVIDER_IDS;
+export const PROVIDER_LABELS = SHARED_PROVIDER_LABELS;
+export const PROVIDER_HINTS = {
+    anthropic: 'Pro/Max or API key',
+    openai: 'Pro/Plus or API key',
+    'github-copilot': 'Use existing subscription',
+};
+export const PROVIDER_NOTES = {
+    opencode: 'One key for many hosted models',
+    anthropic: 'Claude Pro/Max subscription or your own API key',
+    openai: 'ChatGPT Pro/Plus subscription or your own API key',
+    'github-copilot': 'Reuse your existing Copilot plan',
+    google: 'Gemini models from Google AI Studio',
+    openrouter: 'Route across many providers',
+    vercel: 'Use Vercel AI Gateway credentials',
+};
+/**
+ * Provider id → icon file name. apps/web serves the files at `/provider-icons/<icon>.svg`
+ * (`UiHostConfig.providerIconBaseUrl`); a host without them gets the models.dev logo of
+ * the same name. `kortix` is drawn by `KortixLogo`, so the host's brand mark replaces it.
+ */
+const PROVIDER_ICON_MAP = {
+    anthropic: { icon: 'anthropic', fallback: 'AN' },
+    openai: { icon: 'openai', fallback: 'OA' },
+    codex: { icon: 'openai', fallback: 'GPT' },
+    opencode: { icon: 'opencode', fallback: 'OC' },
+    'opencode-go': { icon: 'opencode', fallback: 'OC' },
+    'github-copilot': { icon: 'github-copilot', fallback: 'GH' },
+    google: { icon: 'google', fallback: 'GO' },
+    openrouter: { icon: 'openrouter', fallback: 'OR' },
+    vercel: { icon: 'vercel', fallback: 'VE' },
+    groq: { icon: 'groq', fallback: 'GQ' },
+    xai: { icon: 'xai', fallback: 'XA' },
+    // Bedrock: models.dev's canonical id is `amazon-bedrock`; keep the short
+    // `bedrock` alias for any legacy call site that still passes it.
+    'amazon-bedrock': { icon: 'amazon-bedrock', fallback: 'AW' },
+    bedrock: { icon: 'amazon-bedrock', fallback: 'AW' },
+    // Moonshot ships as three distinct providers on models.dev — Moonshot AI,
+    // Moonshot AI (China), and the Kimi For Coding plan. They share the one
+    // Moonshot mark (no separate -cn / kimi asset exists), but their VERBATIM
+    // names keep them readable apart in the list.
+    moonshotai: { icon: 'moonshotai', fallback: 'MS' },
+    'moonshotai-cn': { icon: 'moonshotai', fallback: 'MS' },
+    'kimi-for-coding': { icon: 'moonshotai', fallback: 'KI' },
+    deepseek: { icon: 'deepseek', fallback: 'DS' },
+    mistral: { icon: 'mistral', fallback: 'MI' },
+    cohere: { icon: 'cohere', fallback: 'CO' },
+    'cohere-platform': { icon: 'cohere', fallback: 'CO' },
+    llama: { icon: 'llama', fallback: 'LL' },
+    huggingface: { icon: 'huggingface', fallback: 'HF' },
+    cerebras: { icon: 'cerebras', fallback: 'CE' },
+    togetherai: { icon: 'togetherai', fallback: 'TA' },
+    // Fireworks: `fireworks-ai` is the models.dev id; `firepass` is its
+    // pass-through variant; keep `fireworks` as a legacy alias.
+    'fireworks-ai': { icon: 'fireworks-ai', fallback: 'FW' },
+    firepass: { icon: 'fireworks-ai', fallback: 'FW' },
+    fireworks: { icon: 'fireworks-ai', fallback: 'FW' },
+    deepinfra: { icon: 'deepinfra', fallback: 'DI' },
+    nvidia: { icon: 'nvidia', fallback: 'NV' },
+    // Google Vertex reuses the Google mark; the Anthropic-on-Vertex variant
+    // reuses the Anthropic mark so it reads as what it actually serves.
+    'google-vertex': { icon: 'google', fallback: 'GV' },
+    'google-vertex-anthropic': { icon: 'anthropic', fallback: 'GV' },
+    cloudflare: { icon: 'cloudflare-workers-ai', fallback: 'CF' },
+    'cloudflare-workers-ai': { icon: 'cloudflare-workers-ai', fallback: 'CF' },
+    azure: { icon: 'azure', fallback: 'AZ' },
+    ollama: { icon: 'ollama-cloud', fallback: 'OL' },
+    perplexity: { icon: 'perplexity', fallback: 'PE' },
+    'perplexity-agent': { icon: 'perplexity', fallback: 'PE' },
+    lmstudio: { icon: 'lmstudio', fallback: 'LM' },
+    v0: { icon: 'v0', fallback: 'V0' },
+    wandb: { icon: 'wandb', fallback: 'WB' },
+    baseten: { icon: 'baseten', fallback: 'BT' },
+    // Everything else falls back to monochrome initials.
+};
+const CATALOG_PROVIDER_IDS = new Set(CATALOG_PROVIDER_ENV.map((provider) => provider.id));
+/**
+ * Resolve a provider id to its logo, or `undefined` when there is none (the
+ * caller falls back to monochrome initials). Keyed on the VERBATIM models.dev
+ * provider ids so live-catalog entries resolve — see the icon-map notes above
+ * for the Moonshot trio / Bedrock / Vertex cases. A mapped provider uses the
+ * host's copy under `baseUrl` when the host serves one, else the models.dev
+ * logo; a catalog provider without a mapped icon uses its models.dev logo.
+ * models.dev answers any id with a generic mark, so an id outside the catalog
+ * (a custom provider) keeps initials.
+ */
+export function providerIconSrc(providerID, baseUrl) {
+    const icon = PROVIDER_ICON_MAP[providerID]?.icon;
+    if (icon)
+        return baseUrl === undefined ? `https://models.dev/logos/${icon}.svg` : `${baseUrl}/${icon}.svg`;
+    if (CATALOG_PROVIDER_IDS.has(providerID))
+        return `https://models.dev/logos/${providerID}.svg`;
+    return undefined;
+}
+function initialsFor(providerID, name) {
+    const label = PROVIDER_LABELS[providerID];
+    if (label) {
+        const words = label.split(/\s+/);
+        if (words.length >= 2) {
+            return (words[0][0] + words[1][0]).toUpperCase();
+        }
+        return label.slice(0, 2).toUpperCase();
+    }
+    const source = (name || providerID).replace(/[^a-zA-Z0-9 ]/g, ' ').trim();
+    const parts = source.split(/\s+/).filter(Boolean);
+    return (parts
+        .slice(0, 2)
+        .map((part) => part[0])
+        .join('') || providerID.slice(0, 2)).toUpperCase();
+}
+/** A third-party logo on a white tile with a hairline: black marks stay
+ *  legible in both themes, so the tile never follows the theme. */
+const LOGO_TILE_LIGHT = 'border-border rounded-md border bg-white';
+const LOGO_TILE_LIGHT_TEXT = 'text-black';
+/** The Kortix mark has no built-in padding, so it gets its own size per tile
+ *  to match the other logos' optical size (roughly half the tile). In spacing
+ *  steps (`size-3.5` … `size-5`), so the mark follows the host's `--spacing`. */
+const KORTIX_MARK_STEPS = {
+    xs: 3.5,
+    small: 3,
+    medium: 4,
+    default: 4,
+    large: 5,
+};
+export function ProviderLogo({ providerID, name, className, size = 'default', tone = 'theme', }) {
+    const Image = useUiImage();
+    const { providerIconBaseUrl } = useUiHostConfig();
+    const light = tone === 'light';
+    // An unreachable models.dev logo (offline self-host) falls back to initials.
+    const [failedSrc, setFailedSrc] = useState();
+    const kortix = providerID === 'kortix';
+    const iconSrc = kortix ? undefined : providerIconSrc(providerID, providerIconBaseUrl);
+    const src = iconSrc === failedSrc ? undefined : iconSrc;
+    const sizeClasses = {
+        xs: 'size-4',
+        small: 'size-8',
+        medium: 'size-9',
+        default: 'size-9',
+        large: 'size-11',
+    };
+    const iconSizes = {
+        xs: 16,
+        small: 20,
+        medium: 24,
+        default: 22,
+        large: 24,
+    };
+    return (_jsx("span", { className: cn('flex shrink-0 items-center justify-center', 
+        // `xs` is the INLINE size — a bare mark sitting on a line of text (a
+        // command-palette group heading), not a chip. The tile is what makes
+        // the other sizes read as an avatar, and at 16px a tile around a 12px
+        // mark is all frame and no logo. The initials fallback keeps its tile
+        // at every size: two bare letters at 9px read as debris, not a logo.
+        (src || kortix) && size === 'xs' ? 'bg-transparent' : light ? LOGO_TILE_LIGHT : 'bg-muted rounded-md', sizeClasses[size], className), "aria-hidden": "true", children: kortix ? (
+        // The host's brand mark (`useBrand` icon), else the Kortix symbol in currentColor.
+        _jsx(KortixLogo, { variant: "icon", style: {
+                width: `calc(var(--spacing) * ${KORTIX_MARK_STEPS[size]})`,
+                height: `calc(var(--spacing) * ${KORTIX_MARK_STEPS[size]})`,
+            }, className: light ? LOGO_TILE_LIGHT_TEXT : 'text-foreground' })) : src ? (_jsx(Image, { src: src, alt: "", width: iconSizes[size], height: iconSizes[size], unoptimized: src.startsWith('https:'), onError: () => setFailedSrc(src), className: cn('object-contain', !light && 'dark:invert') })) : (_jsx("span", { className: cn('font-semibold tracking-wide uppercase', light ? LOGO_TILE_LIGHT_TEXT : 'text-muted-foreground', size === 'xs' ? 'text-[9px]' : 'text-xs'), children: initialsFor(providerID, name) })) }));
+}

package/dist/internal/lib/query-client-singleton.d.ts

@@ -0,0 +1,9 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+import type { QueryClient } from '@tanstack/react-query';
+export declare function registerQueryClient(client: QueryClient): void;
+export declare function getSharedQueryClient(): QueryClient | null;
+/**
+ * Run `run` with the shared client — now if it is registered, else as soon as
+ * it registers. A one-shot: it fires once and is forgotten.
+ */
+export declare function whenQueryClientReady(run: (client: QueryClient) => void): void;

package/dist/internal/lib/query-client-singleton.js

@@ -0,0 +1,34 @@
+/**
+ * Module-level handle on the app's single QueryClient.
+ *
+ * AuthProvider is mounted ABOVE ReactQueryProvider in the tree, so it can't
+ * reach the client via `useQueryClient()`. Auth-driven cache resets (logout,
+ * cross-account sign-in) need to wipe the React Query cache from there, so we
+ * register the instance here when the provider creates it and read it back
+ * from the central reset helper.
+ */
+let sharedQueryClient = null;
+let waiters = [];
+export function registerQueryClient(client) {
+    sharedQueryClient = client;
+    // AuthProvider sits ABOVE ReactQueryProvider, and #10344 mounts the app
+    // shell one auth round trip sooner, so `adoptDeviceCaches` can run before
+    // this registers. Flush anyone who asked for the client before it existed.
+    const pending = waiters;
+    waiters = [];
+    for (const run of pending)
+        run(client);
+}
+export function getSharedQueryClient() {
+    return sharedQueryClient;
+}
+/**
+ * Run `run` with the shared client — now if it is registered, else as soon as
+ * it registers. A one-shot: it fires once and is forgotten.
+ */
+export function whenQueryClientReady(run) {
+    if (sharedQueryClient)
+        run(sharedQueryClient);
+    else
+        waiters.push(run);
+}

package/dist/internal/lib/relative-time.d.ts

@@ -0,0 +1,22 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+/** The long-form options every build/audit "age" stamp shares. */
+export declare const LONG_AGO: {
+    readonly style: "long";
+    readonly empty: "—";
+    readonly zero: "minute";
+};
+/**
+ * Short "how long ago" label — `just now`, `12m ago`, `3h ago`, `11d ago`, then
+ * an absolute date past a month. A future timestamp (a key expiry, a scheduled
+ * run) counts down the same ladder: `in 5m`, `in 23h`, `in 1d`, then the date.
+ *
+ * Age is not decoration on a status: an error with no timestamp reads as "now",
+ * which is how an 11-day-old build failure passed for a live one. Anything that
+ * shows a past event shows its age — and an expiry that has not happened yet
+ * must not read as if it already had.
+ */
+export declare function relativeTime(t?: string | number | null, locale?: string, now?: number, options?: {
+    style?: Intl.RelativeTimeFormatStyle;
+    empty?: string;
+    zero?: 'second' | 'minute';
+}): string;

package/dist/internal/lib/relative-time.js

@@ -0,0 +1,48 @@
+/** The long-form options every build/audit "age" stamp shares. */
+export const LONG_AGO = { style: 'long', empty: '—', zero: 'minute' };
+/**
+ * Short "how long ago" label — `just now`, `12m ago`, `3h ago`, `11d ago`, then
+ * an absolute date past a month. A future timestamp (a key expiry, a scheduled
+ * run) counts down the same ladder: `in 5m`, `in 23h`, `in 1d`, then the date.
+ *
+ * Age is not decoration on a status: an error with no timestamp reads as "now",
+ * which is how an 11-day-old build failure passed for a live one. Anything that
+ * shows a past event shows its age — and an expiry that has not happened yet
+ * must not read as if it already had.
+ */
+export function relativeTime(t, locale = 'en', now = Date.now(), options = {}) {
+    if (!t)
+        return options.empty ?? '';
+    const then = typeof t === 'string' ? +new Date(t) : t;
+    if (!Number.isFinite(then))
+        return options.empty ?? '';
+    const m = ((now - then) / 60000) | 0;
+    const formatter = new Intl.RelativeTimeFormat(locale, { numeric: 'auto', style: options.style ?? 'narrow' });
+    if (m === 0) {
+        // Within a minute of `now`. A fresh past stamp reads "just now"; an
+        // imminent expiry still counts down — "in 1m" — because a key that stops
+        // working in thirty seconds is not "just now" anything.
+        if (then > now) {
+            const countdown = new Intl.RelativeTimeFormat(locale, { numeric: 'always', style: options.style ?? 'narrow' });
+            return countdown.format(1, 'minute');
+        }
+        return !options.zero && locale.toLowerCase().startsWith('en')
+            ? 'just now'
+            : formatter.format(0, options.zero ?? 'second');
+    }
+    // `numeric: 'auto'` for the past ("yesterday", "5m ago"); `always` for the
+    // future so a one-day-out expiry reads "in 1d", not Intl's "tomorrow" —
+    // an expiry is a countdown the same way an age is an age.
+    const rtf = m < 0
+        ? new Intl.RelativeTimeFormat(locale, { numeric: 'always', style: options.style ?? 'narrow' })
+        : formatter;
+    if (Math.abs(m) < 60)
+        return rtf.format(-m, 'minute');
+    const h = (m / 60) | 0;
+    if (Math.abs(h) < 24)
+        return rtf.format(-h, 'hour');
+    const d = (h / 24) | 0;
+    if (d > -30 && d < 30)
+        return rtf.format(-d, 'day');
+    return new Date(then).toLocaleDateString(locale, { month: 'short', day: 'numeric' });
+}

package/dist/internal/lib/safe-url.d.ts

@@ -0,0 +1,2 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+export declare function openSafeExternalUrl(value: unknown): void;

package/dist/internal/lib/safe-url.js

@@ -0,0 +1,7 @@
+import { safeHttpUrl } from '../../_vendor/kortix-shared.js';
+export function openSafeExternalUrl(value) {
+    const url = safeHttpUrl(value);
+    if (!url || typeof window === 'undefined')
+        return;
+    window.open(url, '_blank', 'noopener,noreferrer');
+}

package/dist/internal/lib/sandbox-providers.d.ts

@@ -0,0 +1,11 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+/** Sandbox provider names, order and labels. Platinum is the reference provider. */
+/** Platinum is the reference provider. Daytona is a legacy fallback with removal scheduled. */
+export declare function isLegacySandboxProvider(provider: string): boolean;
+/** Sort key: Platinum first, legacy providers last. */
+export declare function sandboxProviderRank(provider: string): number;
+export declare function sortSandboxProviders<T extends string>(providers: readonly T[]): T[];
+/** A value with no label (an old `e2b` row) shows raw. */
+export declare function formatSandboxProvider(provider: string): string;
+/** `Platinum`, `Platinum and Daytona`. */
+export declare function formatSandboxProviders(providers: readonly string[]): string;

package/dist/internal/lib/sandbox-providers.js

@@ -0,0 +1,27 @@
+/** Sandbox provider names, order and labels. Platinum is the reference provider. */
+const PROVIDER_LABEL = {
+    platinum: 'Platinum',
+    daytona: 'Daytona',
+};
+/** Platinum is the reference provider. Daytona is a legacy fallback with removal scheduled. */
+export function isLegacySandboxProvider(provider) {
+    return provider === 'daytona';
+}
+/** Sort key: Platinum first, legacy providers last. */
+export function sandboxProviderRank(provider) {
+    return provider === 'platinum' ? 0 : isLegacySandboxProvider(provider) ? 2 : 1;
+}
+export function sortSandboxProviders(providers) {
+    return [...providers].sort((a, b) => sandboxProviderRank(a) - sandboxProviderRank(b));
+}
+/** A value with no label (an old `e2b` row) shows raw. */
+export function formatSandboxProvider(provider) {
+    return PROVIDER_LABEL[provider] ?? provider;
+}
+/** `Platinum`, `Platinum and Daytona`. */
+export function formatSandboxProviders(providers) {
+    const names = sortSandboxProviders(providers).map(formatSandboxProvider);
+    if (names.length <= 1)
+        return names[0] ?? '';
+    return `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
+}

package/dist/internal/lib/security/iframe-sandbox.d.ts

@@ -0,0 +1,15 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+/**
+ * Iframe `sandbox` token sets. A frame that shows agent-written content does
+ * not pick one of these itself: it asks `framePolicy` in
+ * `packages/ui/src/files/viewer/preview-policy.ts`, which owns the origin rule.
+ */
+/** A running app on an origin of its own: same-origin, scripts, forms, popups, downloads, modals. */
+export declare const INTERACTIVE_PREVIEW_IFRAME_SANDBOX: string;
+/** Agent-written HTML: scripts, forms, popups and downloads run; the origin is opaque. */
+export declare const ISOLATED_HTML_PREVIEW_IFRAME_SANDBOX: string;
+/** A deck slide on an origin of its own. */
+export declare const SLIDE_IFRAME_SANDBOX: string;
+/** A deck slide on a privileged origin: scripts and modals, opaque origin. */
+export declare const ISOLATED_SLIDE_IFRAME_SANDBOX: string;
+export declare const CLIPBOARD_IFRAME_ALLOW = "clipboard-read; clipboard-write";

package/dist/internal/lib/security/iframe-sandbox.js

@@ -0,0 +1,26 @@
+/**
+ * Iframe `sandbox` token sets. A frame that shows agent-written content does
+ * not pick one of these itself: it asks `framePolicy` in
+ * `packages/ui/src/files/viewer/preview-policy.ts`, which owns the origin rule.
+ */
+/** A running app on an origin of its own: same-origin, scripts, forms, popups, downloads, modals. */
+export const INTERACTIVE_PREVIEW_IFRAME_SANDBOX = [
+    'allow-same-origin',
+    'allow-scripts',
+    'allow-forms',
+    'allow-popups',
+    'allow-downloads',
+    'allow-modals',
+].join(' ');
+/** Agent-written HTML: scripts, forms, popups and downloads run; the origin is opaque. */
+export const ISOLATED_HTML_PREVIEW_IFRAME_SANDBOX = [
+    'allow-scripts',
+    'allow-forms',
+    'allow-popups',
+    'allow-downloads',
+].join(' ');
+/** A deck slide on an origin of its own. */
+export const SLIDE_IFRAME_SANDBOX = ['allow-same-origin', 'allow-scripts', 'allow-modals'].join(' ');
+/** A deck slide on a privileged origin: scripts and modals, opaque origin. */
+export const ISOLATED_SLIDE_IFRAME_SANDBOX = ['allow-scripts', 'allow-modals'].join(' ');
+export const CLIPBOARD_IFRAME_ALLOW = 'clipboard-read; clipboard-write';

package/dist/internal/lib/security/privileged-frame-origins.d.ts

@@ -0,0 +1,10 @@
+/** @internal Kortix apps only. No semver: it may change in any release. */
+/**
+ * Origins that agent-authored frames must never share: the page itself, the
+ * configured app URL, and the API (which also serves the sandbox path proxy).
+ * The page origin comes first, so a relative frame URL resolves against it.
+ *
+ * `backendUrl` may be root-relative (`/v1` on a self-host), which puts the
+ * API on the page origin; resolving it against the page covers that case.
+ */
+export declare function privilegedFrameOrigins(): string[];