@kortix/ui 0.14.8 → 0.14.10

package/dist/_vendor/shared/channel-descriptors.d.ts

@@ -0,0 +1,96 @@
+/**
+ * One descriptor per chat channel: the facts the API, the manifest schema and
+ * the web read instead of repeating them. To add a channel, add its id and its
+ * descriptor here; `tsc` then names every record that needs a value for it.
+ *
+ * No imports, so the dependency-free manifest constants can read it. Not in the
+ * package root: `channel-message.ts` already exports `CHANNEL_PLATFORMS` there.
+ */
+/** The `platform` of a `channel` connector. The order is the manifest schema's enum order. */
+export declare const CHANNEL_PLATFORM_IDS: readonly ["slack", "teams", "email", "telegram"];
+export type ChannelPlatformId = (typeof CHANNEL_PLATFORM_IDS)[number];
+export interface ChannelDescriptor {
+    /** The display name. */
+    label: string;
+    /** The platform word of a prompt header, `[<envelope> · …]`. Transcripts store it: never rename one. */
+    envelope: string;
+    /** The `native:<id>` catalog card. Its icon is `/connector-icons/<id>.svg`. */
+    catalog: {
+        domain: string;
+        description: string;
+    };
+    /** The most characters one message holds. */
+    messageChars?: number;
+    /** One tap per option up to `max` options. `dataBytes`: the platform's cap on a button's data. */
+    buttons?: {
+        max: number;
+        dataBytes?: number;
+    };
+    /** The token a person pastes to connect. */
+    connect?: {
+        tokenPattern: RegExp;
+        tokenPlaceholder: string;
+    };
+    /** Senders pass an allow-list of these user ids. */
+    access?: {
+        userId: RegExp;
+        idPlaceholder: string;
+        idsPlaceholder: string;
+        idInputMode: 'numeric' | 'text';
+    };
+}
+export declare const CHANNELS: {
+    readonly slack: {
+        readonly label: "Slack";
+        readonly envelope: "Slack";
+        readonly catalog: {
+            readonly domain: "slack.com";
+            readonly description: "Message the agent in Slack: mentions, DMs and channels, through the Kortix Slack app.";
+        };
+    };
+    readonly teams: {
+        readonly label: "Microsoft Teams";
+        readonly envelope: "Teams";
+        readonly catalog: {
+            readonly domain: "teams.microsoft.com";
+            readonly description: "Message the agent in Microsoft Teams chats and channels, through the Kortix Teams app.";
+        };
+        readonly buttons: {
+            readonly max: 6;
+        };
+    };
+    readonly email: {
+        readonly label: "Email";
+        readonly envelope: "Email";
+        readonly catalog: {
+            readonly domain: "email.kortix";
+            readonly description: "Give the project an inbox: people email the agent and it replies.";
+        };
+    };
+    readonly telegram: {
+        readonly label: "Telegram";
+        readonly envelope: "Telegram";
+        readonly catalog: {
+            readonly domain: "telegram.org";
+            readonly description: "Message the agent from Telegram through a bot you own.";
+        };
+        readonly messageChars: 4096;
+        readonly buttons: {
+            readonly max: 6;
+            readonly dataBytes: 64;
+        };
+        readonly connect: {
+            readonly tokenPattern: RegExp;
+            readonly tokenPlaceholder: "123456789:…";
+        };
+        readonly access: {
+            readonly userId: RegExp;
+            readonly idPlaceholder: "123456789";
+            readonly idsPlaceholder: "123456789, 987654321";
+            readonly idInputMode: "numeric";
+        };
+    };
+};
+/** The reserved slug a channel's built-in connector uses, so a user connector cannot take it. */
+export declare const channelConnectorSlug: <P extends ChannelPlatformId>(platform: P) => `kortix_${P}`;
+export declare const isChannelPlatform: (platform: string) => platform is ChannelPlatformId;

package/dist/_vendor/shared/channel-message.d.ts

@@ -1,20 +1,24 @@
 /**
  * Recognise a channel-originated user message (Slack, Microsoft Teams,
- * Telegram) inside the raw prompt text the API scaffolds for the agent, and
+ * Telegram, email) inside the raw prompt text the API scaffolds for the agent, and
  * pull out what a person wants to see: who wrote it, where, and the words they
  * typed — not the tenant ids and the `How to work:` instructions.
  *
- * Every shape here is produced by exactly one API renderer:
+ * `channelPromptText` below writes the current shape, so its writer and reader
+ * are one module. Every other shape is produced by exactly one API renderer:
  *
  * | Shape | Producer |
  * | --- | --- |
+ * | `[<Platform> · <where> · message from <sender>]`, the text, then `── <Platform> instructions` after a blank line | `channelPromptText` (this module) |
  * | `You're answering a message on Slack as a teammate.` | `channels/slack/session.ts` renderAgentPrompt |
  * | `New message from <user> in Slack channel <channel>, thread <ts>:` | `channels/slack/session.ts` renderFollowUpPrompt |
  * | `New message from <user> in the same Slack thread:` | the same renderer before 2026-09, kept for old transcripts |
  * | `You're answering a message on Microsoft Teams as a teammate.` | `channels/teams/session.ts` renderAgentPrompt |
  * | `New message from <user> in the same Teams conversation:` | `channels/teams/session.ts` renderFollowUpPrompt |
- * | `You received a message on Telegram.` | `channels/telegram-webhook.ts` renderAgentPrompt |
- * | `[<Platform> · <context> · message from <user>]` | the pre-2026 header, kept so old transcripts still render |
+ * | `You received a message on Telegram.` + `Chat:`/`From:`/`Message id:`, the text, `How to answer:` | the Telegram renderer from 2026-10-24 until `channelPromptText`, kept so old transcripts still render |
+ * | `New Telegram message from <user> in the same chat:` + the same block | the same renderer, kept so old transcripts still render |
+ * | `You received a message on Telegram.` + a `Message:` line | the retired one-session-per-message Telegram webhook (removed 2026-10-24), kept so old transcripts still render |
+ * | `[<Platform> · <context> · message from <user>]` with no such delimiter | the pre-2026 header, kept so old transcripts still render |
  *
  * The parser is pure and framework-free so `channel-message.test.ts` can pin
  * each shape against the real prompt text. The web and mobile session views
@@ -25,7 +29,9 @@
  * attempt. The pre-2026 header regex and the `<at>` strip did: 240k characters
  * took 22 s and 7 s.
  */
-export type ChannelPlatform = 'Slack' | 'Teams' | 'Telegram';
+/** The platform words a header names: each channel descriptor's `envelope`. Any other word reads as Slack, as every deployed build reads it. */
+export declare const CHANNEL_PLATFORMS: ("Slack" | "Teams" | "Email" | "Telegram")[];
+export type ChannelPlatform = (typeof CHANNEL_PLATFORMS)[number];
 export interface ChannelMessageInfo {
     platform: ChannelPlatform;
     /** Channel / conversation / chat id; empty for a follow-up, which carries none. */
@@ -36,3 +42,37 @@ export interface ChannelMessageInfo {
     followUp: boolean;
 }
 export declare function parseChannelMessage(rawText: string | null | undefined): ChannelMessageInfo | undefined;
+/**
+ * The lines Kortix wrote in a `channelPromptText` prompt: from its last `── <Platform> instructions`
+ * line on, where the channel core also puts each file's `<file>` tag. Empty for an older shape. A
+ * `<file>` tag before that line is in the sender's text, so it is text, not a file.
+ */
+export declare function channelPromptTail(text: string, platform: ChannelPlatform): string;
+/**
+ * True when the sender's text is only the label an adapter writes for a file sent with no caption
+ * (`(photo)`, `(file q3.pdf)`, `(voice message, 7 s)`). A view that draws the file hides it.
+ */
+export declare function isChannelFileLabel(text: string): boolean;
+/** What a channel adapter knows about one incoming message; `channelPromptText` writes it. */
+export interface ChannelEnvelope {
+    platform: ChannelPlatform;
+    /** What a person reads: `@sam`, `Sam Rivera`, `a@b.c`. */
+    sender: string;
+    /** The chat title, `direct message`, or an email subject. */
+    where: string;
+    /** The person's words, or a question answer. */
+    text: string;
+    /** One shell command that answers THIS message. */
+    reply: string;
+    /** Ids, limits and platform rules: for the agent only, one line each. */
+    notes: string[];
+}
+/**
+ * The prompt for one channel message. The header line is the one every client
+ * build reads (`readLegacyChannelHeader`), the text follows unchanged, and the
+ * agent-only lines start at the last `── <Platform> instructions` line, where
+ * `parseChannelMessage` cuts.
+ */
+export declare function channelPromptText(e: ChannelEnvelope, opts?: {
+    revived?: boolean;
+}): string;

package/dist/_vendor/shared/index.d.ts

@@ -26,3 +26,5 @@ export * from './slack-text';
 export * from './chat-mention';
 export * from './webhook-signing';
 export * from './pasted-content';
+export * from './space-slug';
+export * from './artifact-comments';

package/dist/_vendor/shared/space-slug.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A channel's slug from its name: lowercase, whitespace runs → `-`, other
+ * characters dropped, `-` runs collapsed and trimmed, at most 40 characters.
+ * Empty when the name has no `a-z0-9`. The API derives the stored slug with
+ * this function, and the create dialog previews it, so the two never differ.
+ */
+export declare function spaceSlug(name: string): string;
+/**
+ * Where every private channel's folder lives: outside `/Company`, so the
+ * project grant on `/Company` and project admins never reach it. Only the
+ * channel's members (one grant each) and the channel's own threads do. The
+ * folder is named by the channel's id, never its name: a rename moves
+ * nothing, and a later channel that takes the name never inherits the folder.
+ * Only `/Channels/<space_id>` of a private channel of the project is reserved;
+ * any other path under `/Channels` is an ordinary folder (the API's
+ * `privateChannelFolderOf`).
+ */
+export declare const PRIVATE_CHANNELS_DIR = "/Channels";
+/**
+ * A space's two folders in the project's Files (drive paths). A public
+ * channel's are shared with the project: `/Company/Channels/<slug>` and its
+ * `Memory`. A private channel's are `/Channels/<space_id>` and its `Memory`
+ * (pass its id as `privateSpaceId`). A DM's
+ * are in the member's own folder: `<personal>/Agents/<agent>` and its
+ * memory `<personal>/Memory/<agent>` (the agent folder of the DM's Memory
+ * tab, which also lists the rest of `<personal>/Memory`). Null for a DM without a personal folder,
+ * and for a name that is not one plain path segment (an agent name is not
+ * validated as one when the DM is opened).
+ * The API (folder create, rename, the session's /drives/README.md) and the web
+ * tabs read this, so both name the same folders.
+ */
+export declare function spaceDriveFolders(kind: 'channel' | 'dm', name: string, personalFolder: string | null, 
+/** A private channel's id; null for a public channel or a DM. */
+privateSpaceId?: string | null): {
+    files: string;
+    memory: string;
+} | null;

package/dist/access/access/access-detail-shell.js

@@ -18,5 +18,5 @@ import { UiLink as Link } from '../../providers/ui-provider.js';
 export function AccessDetailShell({ back, avatar, title, badges, meta, actions, tabs, activeTab, onTabChange, loading = false, children, className, }) {
     const backContent = back ? (_jsxs(_Fragment, { children: [_jsx(CaretLeftIcon, { className: "size-4" }), back.label] })) : null;
     const backClass = 'text-muted-foreground hover:text-foreground flex w-fit items-center gap-1 text-sm transition-colors';
-    return (_jsxs("div", { className: cn('mx-auto w-full max-w-6xl space-y-5 pb-10', className), children: [_jsxs("div", { className: "space-y-5", children: [!back ? null : back.href ? (_jsx(Link, { href: back.href, className: backClass, children: backContent })) : (_jsx("button", { type: "button", onClick: back.onClick, className: backClass, children: backContent })), _jsxs("div", { className: "flex min-w-0 items-start gap-3.5", children: [loading ? _jsx(Skeleton, { className: "size-10 rounded-md" }) : avatar, _jsxs("div", { className: "min-w-0 flex-1 space-y-0.5", children: [loading ? (_jsx(Skeleton, { className: "h-6 w-44" })) : (_jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx("h2", { className: "text-foreground truncate text-xl font-medium", children: title }), badges] })), meta ? _jsx("div", { className: "text-muted-foreground truncate text-sm", children: meta }) : null] }), actions ? _jsx("div", { className: "flex shrink-0 items-center gap-2", children: actions }) : null] })] }), tabs && tabs.length > 0 ? (_jsxs(Tabs, { value: activeTab, onValueChange: onTabChange, className: "space-y-6", children: [_jsx(TabsList, { type: "underline", className: "flex w-full items-center justify-start", children: tabs.map((tab) => (_jsxs(TabsTrigger, { value: tab.value, className: "w-fit flex-none", children: [tab.label, tab.badge] }, tab.value))) }), children] })) : (_jsx("div", { className: "space-y-6", children: children }))] }));
+    return (_jsxs("div", { className: cn('mx-auto w-full max-w-6xl space-y-5 pb-10', className), children: [_jsxs("div", { className: "space-y-5", children: [!back ? null : back.href ? (_jsx(Link, { href: back.href, className: backClass, children: backContent })) : (_jsx("button", { type: "button", onClick: back.onClick, className: backClass, children: backContent })), _jsxs("div", { className: "flex min-w-0 items-center gap-3.5", children: [loading ? _jsx(Skeleton, { className: "size-10 rounded-md" }) : avatar, _jsxs("div", { className: "min-w-0 flex-1 space-y-0.5", children: [loading ? (_jsx(Skeleton, { className: "h-6 w-44" })) : (_jsxs("div", { className: "flex min-w-0 items-center gap-2", children: [_jsx("h2", { className: "text-foreground truncate text-base leading-6 font-medium", children: title }), badges] })), meta ? _jsx("div", { className: "text-muted-foreground truncate text-sm", children: meta }) : null] }), actions ? _jsx("div", { className: "flex shrink-0 items-center gap-2", children: actions }) : null] })] }), tabs && tabs.length > 0 ? (_jsxs(Tabs, { value: activeTab, onValueChange: onTabChange, className: "space-y-6", children: [_jsx(TabsList, { type: "underline", className: "flex w-full items-center justify-start", children: tabs.map((tab) => (_jsxs(TabsTrigger, { value: tab.value, className: "w-fit flex-none", children: [tab.label, tab.badge] }, tab.value))) }), children] })) : (_jsx("div", { className: "space-y-6", children: children }))] }));
 }

package/dist/access/access/principal-picker.d.ts

@@ -88,3 +88,14 @@ export interface PrincipalPickerProps {
     className?: string;
 }
 export declare function PrincipalPicker({ scope, selection, kinds, allowInvite, everyone, excludeUserIds, value, onChange, emptyLabel, allExcludedLabel, autoFocus, disabled, searchPlaceholder, className, }: PrincipalPickerProps): import("react").JSX.Element;
+/** One picker row. Exported for the channel "Add members" picker, which moves `highlighted` with the arrow keys. */
+export declare function PickerRow({ selected, selection, highlighted, disabled, onSelect, leading, label, suffix, }: {
+    selected: boolean;
+    selection: 'single' | 'multi';
+    highlighted?: boolean;
+    disabled?: boolean;
+    onSelect: () => void;
+    leading: React.ReactNode;
+    label: string;
+    suffix?: string;
+}): import("react").JSX.Element;

package/dist/access/access/principal-picker.js

@@ -267,6 +267,7 @@ export function PrincipalPicker({ scope, selection = 'multi', kinds = ['member',
 function PickerSectionLabel({ children }) {
     return (_jsx("p", { className: "text-muted-foreground px-2 pt-2 pb-1 text-xs font-medium first:pt-1.5", children: children }));
 }
-function PickerRow({ selected, selection, disabled, onSelect, leading, label, suffix, }) {
-    return (_jsxs("button", { type: "button", role: selection === 'single' ? 'radio' : undefined, "aria-checked": selection === 'single' ? selected : undefined, "aria-pressed": selection === 'multi' ? selected : undefined, disabled: disabled, onClick: onSelect, className: cn('flex w-full items-center gap-2.5 rounded-lg px-2 py-1.5 text-left transition-colors', 'disabled:cursor-not-allowed disabled:opacity-50', selected ? 'bg-primary/[0.06]' : 'hover:bg-muted/50'), children: [leading, _jsxs("span", { className: "text-foreground min-w-0 flex-1 truncate text-sm", children: [label, suffix ? _jsx("span", { className: "text-muted-foreground ml-1 text-xs", children: suffix }) : null] }), selected ? (_jsx("span", { className: "shrink-0 px-1", children: _jsx(CheckCircleIcon, { weight: "fill", className: "size-[1.1rem]" }) })) : null] }));
+/** One picker row. Exported for the channel "Add members" picker, which moves `highlighted` with the arrow keys. */
+export function PickerRow({ selected, selection, highlighted = false, disabled, onSelect, leading, label, suffix, }) {
+    return (_jsxs("button", { type: "button", role: selection === 'single' ? 'radio' : undefined, "aria-checked": selection === 'single' ? selected : undefined, "aria-pressed": selection === 'multi' ? selected : undefined, disabled: disabled, onClick: onSelect, className: cn('flex w-full items-center gap-2.5 rounded-lg px-2 py-1.5 text-left transition-colors', 'disabled:cursor-not-allowed disabled:opacity-50', selected ? 'bg-primary/[0.06]' : highlighted ? 'bg-muted/50' : 'hover:bg-muted/50'), children: [leading, _jsxs("span", { className: "text-foreground min-w-0 flex-1 truncate text-sm", children: [label, suffix ? _jsx("span", { className: "text-muted-foreground ml-1 text-xs", children: suffix }) : null] }), selected ? (_jsx("span", { className: "shrink-0 px-1", children: _jsx(CheckCircleIcon, { weight: "fill", className: "size-[1.1rem]" }) })) : null] }));
 }

package/dist/apps/app-preview-pool.d.ts

@@ -12,6 +12,8 @@ export declare function ensureFrame(key: string, url: string, attributes: {
     title: string;
     sandbox: string;
     allow: string;
+    testid?: string;
+    referrerPolicy?: ReferrerPolicy;
 }): void;
 /** Show the frame in `slot`. Returns the release: the frame goes back to the previous claim. */
 export declare function claimFrame(key: string, slot: HTMLElement, placement: FramePlacement): () => void;
@@ -19,8 +21,11 @@ export declare function claimFrame(key: string, slot: HTMLElement, placement: Fr
 export declare function restyleFrame(key: string, slot: HTMLElement, placement: FramePlacement): void;
 /** Load the App again from `url` (a fresh access session). */
 export declare function reloadFrame(key: string, url: string): void;
-/** Drop every frame whose key is not in `keep` (a new release, a deleted App, another project). */
-export declare function pruneFrames(keep: Set<string>): void;
+/**
+ * Drop every frame whose key is not in `keep` (a new release, a deleted App,
+ * another project). `owns` limits the sweep to one kind of frame.
+ */
+export declare function pruneFrames(keep: Set<string>, owns?: (key: string) => boolean): void;
 /** The frame's load status, or null before it exists. */
 export declare function frameStatus(key: string): FrameStatus | null;
 export declare function useFrameStatus(key: string): FrameStatus | null;

package/dist/apps/app-preview-pool.js

@@ -1,6 +1,7 @@
 'use client';
 /**
- * One live frame per App preview, kept for as long as the project is open.
+ * One live frame per App preview (and per artifact page), kept for as long as
+ * the project is open.
  *
  * A card thumbnail and the big view used to each own an `<iframe>`, so every
  * page switch and every open loaded the App again. Here a frame is created
@@ -8,7 +9,10 @@
  * parked off screen. A card or the big view CLAIMS it: the frame moves into
  * that slot with `Element.moveBefore`, which keeps the document alive. The
  * newest claim wins; releasing hands it back to the previous claim, else to
- * the parking lot. Without `moveBefore` (older browsers) the move reloads the
+ * the parking lot. A release lands at the end of the task: a release and a
+ * claim in one React commit (a Strict Mode remount, a page handing the frame
+ * to the next) leave the frame where it is or move it once, never through the
+ * parking lot, whose different size makes the page lay out (and flash) twice. Without `moveBefore` (older browsers) the move reloads the
  * frame — the old behavior — and nothing is preloaded.
  *
  * The frame's `src` is set once. A refetched access session mints a new URL
@@ -76,7 +80,9 @@ export function ensureFrame(key, url, attributes) {
     frame.title = attributes.title;
     frame.setAttribute('sandbox', attributes.sandbox);
     frame.allow = attributes.allow;
-    frame.dataset.testid = 'app-live-preview';
+    frame.dataset.testid = attributes.testid ?? 'app-live-preview';
+    if (attributes.referrerPolicy)
+        frame.referrerPolicy = attributes.referrerPolicy;
     frame.dataset.frameKey = key;
     const entry = { frame, status: 'loading', claims: [] };
     frame.addEventListener('load', () => {
@@ -105,9 +111,23 @@ export function claimFrame(key, slot, placement) {
     return () => {
         entry.claims = entry.claims.filter((item) => item !== claim);
         if (entries.get(key) === entry)
-            place(entry);
+            placeAfterTask(entry);
     };
 }
+// Entries whose claims changed by a release, placed once the current task ends.
+const releasing = new Set();
+function placeAfterTask(entry) {
+    if (releasing.size === 0) {
+        queueMicrotask(() => {
+            const due = [...releasing];
+            releasing.clear();
+            for (const item of due)
+                if (entries.get(item.frame.dataset.frameKey ?? '') === item)
+                    place(item);
+        });
+    }
+    releasing.add(entry);
+}
 /** Restyle the current claim of `slot` (a card's scale changes as it is measured). */
 export function restyleFrame(key, slot, placement) {
     const entry = entries.get(key);
@@ -127,11 +147,14 @@ export function reloadFrame(key, url) {
     entry.frame.src = url;
     notify();
 }
-/** Drop every frame whose key is not in `keep` (a new release, a deleted App, another project). */
-export function pruneFrames(keep) {
+/**
+ * Drop every frame whose key is not in `keep` (a new release, a deleted App,
+ * another project). `owns` limits the sweep to one kind of frame.
+ */
+export function pruneFrames(keep, owns = () => true) {
     let changed = false;
     for (const [key, entry] of entries) {
-        if (keep.has(key) || entry.claims.length > 0)
+        if (!owns(key) || keep.has(key) || entry.claims.length > 0)
             continue;
         entry.frame.remove();
         entries.delete(key);

package/dist/apps/app-shared.d.ts

@@ -1,5 +1,5 @@
 import type { UiTranslator } from '../i18n/index.js';
-import { type App, type AppAccessMode, type AppCapability, type AppDeployment, type AppViewerTokenScope } from '@kortix/sdk';
+import { type App, type AppAccessMode, type AppCapability, type AppDeployment, type AppViewerTokenScope, type ProjectTrigger } from '@kortix/sdk';
 type DeploymentTone = 'success' | 'destructive' | 'warning' | 'muted';
 /**
  * Every deployment status, in words a person who did not build this can read.
@@ -65,31 +65,39 @@ export declare function appStatus(app: App, tI18nComplete: UiTranslator): {
     label: string;
     dot: string;
 };
+export { appAdminsOnly, gridApps } from '../_vendor/shared/app-config.js';
+/** The Apps of the project that are neither a card nor a tab: the ones the page counts as hidden. */
+export declare function hiddenApps(apps: App[], canAdmin?: boolean): App[];
 /**
- * Does this App offer `capability`? The ONE way the Apps UI branches between
- * Apps: the server lists what each App supports (`app.capabilities`), and a
- * control shows only for the Apps that support it.
+ * How an App is wired into the project's triggers: the ones that call it
+ * (`run: { app }`) and the ones its own events start (`on: { event, app }`).
  */
-/**
- * The Apps the grid shows as cards (`display`): not `listed: false`, and not a
- * tab of a parent that exists. A tab whose parent is gone stays reachable as a card.
- */
-export declare function gridApps(apps: App[], canAdmin?: boolean): App[];
+export declare function appTriggers(app: App, triggers: ProjectTrigger[]): {
+    calledBy: ProjectTrigger[];
+    startsOn: ProjectTrigger[];
+};
+/** The one-line state of the Background list: how many Apps are up, asleep, not deployed, external. */
+export declare function backgroundSummary(apps: App[]): {
+    running: number;
+    asleep: number;
+    undeployed: number;
+    external: number;
+};
 /** The Apps `app`'s detail shows as tabs (their `display.parent` is its slug). */
 export declare function childApps(apps: App[], app: App, canAdmin?: boolean): App[];
-/**
- * Its primary service is `access: admins` (a backend's admin dashboard): only
- * project admins can open it, so nobody else is shown a card or tab for it.
- */
 /**
  * The App whose live preview a card shows: the App itself, or, when it hides
  * its own (`display.preview: none`), its first tab the viewer may open (a
  * backend's dashboard). Null: the card shows an icon.
  */
 export declare function cardPreviewApp(apps: App[], app: App, canAdmin?: boolean): App | null;
-export declare function appAdminsOnly(app: App): boolean;
 /** A tab's label: the App's name without its parent's slug ("crm-data-dashboard" → "Dashboard"). */
 export declare function appTabLabel(child: App, parent: App): string;
+/**
+ * Does this App offer `capability`? The ONE way the Apps UI branches between
+ * Apps: the server lists what each App supports (`app.capabilities`), and a
+ * control shows only for the Apps that support it.
+ */
 export declare function appCan(app: App, capability: AppCapability): boolean;
 /** "2 vCPU · 4 GB · 20 GB": the machine size of an App. */
 export declare function appSizeLabel(app: App, t: UiTranslator): string;
@@ -151,4 +159,3 @@ export declare function localizedAppCopy(tI18nComplete: UiTranslator): {
         desc: string;
     }>;
 };
-export {};

package/dist/apps/app-shared.js

@@ -3,6 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { CopyButton } from '../markdown/copy-button.js';
 import { localizeUiCatalog, translateUiCatalogText } from '../i18n/ui-catalog/localize-ui-catalog.js';
 import { PRODUCT_CATALOG_TRANSLATION_KEYS } from '../i18n/ui-catalog/product-catalog-translation-keys.generated.js';
+import { appAdminsOnly } from '../_vendor/kortix-shared.js';
 import { cn } from '../lib/utils.js';
 import { stripTrailingSlashes } from '@kortix/sdk';
 /**
@@ -50,7 +51,7 @@ export function deployNotice(latest, tI18nComplete) {
     return { label: tI18nComplete.raw('text0b5260e1b405'), tone: 'warning' };
 }
 export function appCommand(app) {
-    return `kortix apps deploy . --app ${app.app_id}`;
+    return `kortix apps deploy . --app ${app.slug}`;
 }
 /**
  * The hostname a person reads an App by.
@@ -93,29 +94,44 @@ export function appStatus(app, tI18nComplete) {
         dot: live ? 'bg-kortix-green' : deployed ? 'bg-muted-foreground/50' : 'bg-muted-foreground/25',
     };
 }
-/**
- * Does this App offer `capability`? The ONE way the Apps UI branches between
- * Apps: the server lists what each App supports (`app.capabilities`), and a
- * control shows only for the Apps that support it.
- */
-/**
- * The Apps the grid shows as cards (`display`): not `listed: false`, and not a
- * tab of a parent that exists. A tab whose parent is gone stays reachable as a card.
- */
-export function gridApps(apps, canAdmin = true) {
+// The grid rule is shared with the API's channel Apps count (`@kortix/shared/app-config`).
+export { appAdminsOnly, gridApps } from '../_vendor/kortix-shared.js';
+/** The Apps of the project that are neither a card nor a tab: the ones the page counts as hidden. */
+export function hiddenApps(apps, canAdmin = true) {
     const slugs = new Set(apps.map((app) => app.slug));
-    return apps.filter((app) => app.display?.listed !== false
+    return apps.filter((app) => app.display?.listed !== true
         && !(app.display?.parent && slugs.has(app.display.parent))
         && (canAdmin || !appAdminsOnly(app)));
 }
+/**
+ * How an App is wired into the project's triggers: the ones that call it
+ * (`run: { app }`) and the ones its own events start (`on: { event, app }`).
+ */
+export function appTriggers(app, triggers) {
+    return {
+        calledBy: triggers.filter((row) => row.target?.app === app.slug),
+        startsOn: triggers.filter((row) => row.type === 'app' && row.app === app.slug),
+    };
+}
+/** The one-line state of the Background list: how many Apps are up, asleep, not deployed, external. */
+export function backgroundSummary(apps) {
+    const out = { running: 0, asleep: 0, undeployed: 0, external: 0 };
+    for (const row of apps) {
+        if (row.external_url)
+            out.external += 1;
+        else if (!row.active_deployment_id)
+            out.undeployed += 1;
+        else if (row.desired_state === 'running' || row.hosting_type === 'static')
+            out.running += 1;
+        else
+            out.asleep += 1;
+    }
+    return out;
+}
 /** The Apps `app`'s detail shows as tabs (their `display.parent` is its slug). */
 export function childApps(apps, app, canAdmin = true) {
     return apps.filter((row) => row.display?.parent === app.slug && (canAdmin || !appAdminsOnly(row)));
 }
-/**
- * Its primary service is `access: admins` (a backend's admin dashboard): only
- * project admins can open it, so nobody else is shown a card or tab for it.
- */
 /**
  * The App whose live preview a card shows: the App itself, or, when it hides
  * its own (`display.preview: none`), its first tab the viewer may open (a
@@ -127,14 +143,16 @@ export function cardPreviewApp(apps, app, canAdmin = true) {
     const first = childApps(apps, app, canAdmin)[0];
     return first && appCan(first, 'preview') && first.viewer_can_access !== false ? first : null;
 }
-export function appAdminsOnly(app) {
-    return app.services?.find((service) => service.name === 'http')?.access === 'admins';
-}
 /** A tab's label: the App's name without its parent's slug ("crm-data-dashboard" → "Dashboard"). */
 export function appTabLabel(child, parent) {
     const name = child.name.startsWith(`${parent.slug}-`) ? child.name.slice(parent.slug.length + 1) : child.name;
     return name.charAt(0).toUpperCase() + name.slice(1);
 }
+/**
+ * Does this App offer `capability`? The ONE way the Apps UI branches between
+ * Apps: the server lists what each App supports (`app.capabilities`), and a
+ * control shows only for the Apps that support it.
+ */
 export function appCan(app, capability) {
     return app.capabilities?.includes(capability) ?? false;
 }

package/dist/apps/index.d.ts

@@ -2,6 +2,6 @@
  * @kortix/ui/apps — Live App frames, the frame pool and the App view model.
  */
 export { AppPreview, AppPreviewOverlay, PREVIEW_SPINNER_DELAY_MS, PREVIEW_TILE_ASPECT, PREVIEW_VIEWPORT_HEIGHT, PREVIEW_VIEWPORT_WIDTH, framePlacement, previewScale, scheduleSlowPreview, } from './app-preview.js';
-export { ensureFrame, frameKey, framesKeepAlive, pruneFrames, reloadFrame, } from './app-preview-pool.js';
-export { ANONYMOUS_MODES, DEPLOYMENT_COPY, appCan, appCommand, appHost, appStatus, appTabLabel, cardPreviewApp, childApps, deployNotice, gridApps, localizedAppCopy, } from './app-shared.js';
+export { claimFrame, ensureFrame, frameKey, framesKeepAlive, pruneFrames, reloadFrame, restyleFrame, useFrameStatus, type FramePlacement, } from './app-preview-pool.js';
+export { ANONYMOUS_MODES, DEPLOYMENT_COPY, appCan, appCommand, appHost, appSizeLabel, DeployCommand, appStatus, appTabLabel, cardPreviewApp, childApps, deployNotice, gridApps, hiddenApps, appTriggers, backgroundSummary, localizedAppCopy, } from './app-shared.js';
 export { isKortixAppUrl } from './kortix-app-url.js';

package/dist/apps/index.js

@@ -2,6 +2,6 @@
  * @kortix/ui/apps — Live App frames, the frame pool and the App view model.
  */
 export { AppPreview, AppPreviewOverlay, PREVIEW_SPINNER_DELAY_MS, PREVIEW_TILE_ASPECT, PREVIEW_VIEWPORT_HEIGHT, PREVIEW_VIEWPORT_WIDTH, framePlacement, previewScale, scheduleSlowPreview, } from './app-preview.js';
-export { ensureFrame, frameKey, framesKeepAlive, pruneFrames, reloadFrame, } from './app-preview-pool.js';
-export { ANONYMOUS_MODES, DEPLOYMENT_COPY, appCan, appCommand, appHost, appStatus, appTabLabel, cardPreviewApp, childApps, deployNotice, gridApps, localizedAppCopy, } from './app-shared.js';
+export { claimFrame, ensureFrame, frameKey, framesKeepAlive, pruneFrames, reloadFrame, restyleFrame, useFrameStatus, } from './app-preview-pool.js';
+export { ANONYMOUS_MODES, DEPLOYMENT_COPY, appCan, appCommand, appHost, appSizeLabel, DeployCommand, appStatus, appTabLabel, cardPreviewApp, childApps, deployNotice, gridApps, hiddenApps, appTriggers, backgroundSummary, localizedAppCopy, } from './app-shared.js';
 export { isKortixAppUrl } from './kortix-app-url.js';

package/dist/artifacts/artifact-frame.d.ts

@@ -0,0 +1,16 @@
+/**
+ * An artifact page. The frame lives in the project's frame pool
+ * (`@kortix/ui/apps`, shared with App previews): it loads once, in the
+ * background or on first show, and moves between the gallery card and the
+ * viewer without reloading. `frameKey` changes after a save, so an edit loads
+ * the new page. The ref is the slot (the viewer's full screen target).
+ */
+export declare const ArtifactFrame: import("react").ForwardRefExoticComponent<{
+    frameKey: string;
+    src: string;
+    title: string;
+    className?: string;
+    preview?: boolean;
+} & import("react").RefAttributes<HTMLDivElement>>;
+/** Create (and park) the pooled frame for an artifact page; a no-op when it exists. */
+export declare function ensureArtifactFrame(key: string, src: string, title: string): void;

package/dist/artifacts/artifact-frame.js

@@ -0,0 +1,55 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { forwardRef, useLayoutEffect, useState } from 'react';
+import { claimFrame, ensureFrame } from '../apps/app-preview-pool.js';
+import { ARTIFACT_FRAME_ALLOW, ARTIFACT_IFRAME_SANDBOX } from './frame-policy.js';
+/**
+ * The frame's canvas: what shows where the page has not painted yet. Open, a
+ * third-party page with no background of its own reads as a white page, as it
+ * would in a browser tab, in both themes. As a card preview it is the app's
+ * background: a preview that is still painting (on load, on a tab switch)
+ * must not flash white in the dark theme.
+ */
+const ARTIFACT_CANVAS = 'bg-white';
+const PREVIEW_CANVAS = 'bg-background';
+/**
+ * An artifact page. The frame lives in the project's frame pool
+ * (`@kortix/ui/apps`, shared with App previews): it loads once, in the
+ * background or on first show, and moves between the gallery card and the
+ * viewer without reloading. `frameKey` changes after a save, so an edit loads
+ * the new page. The ref is the slot (the viewer's full screen target).
+ */
+export const ArtifactFrame = forwardRef(function ArtifactFrame({ frameKey, src, title, className, preview }, ref) {
+    const [slot, setSlot] = useState(null);
+    const interactive = !preview;
+    const frameClass = `${className ?? ''} ${preview ? PREVIEW_CANVAS : ARTIFACT_CANVAS}`;
+    useLayoutEffect(() => {
+        if (!slot)
+            return;
+        ensureArtifactFrame(frameKey, src, title);
+        const release = claimFrame(frameKey, slot, { className: frameClass, style: {}, interactive });
+        // The viewer hands the keyboard to the page, so a deck's arrow keys work at once.
+        if (interactive)
+            slot.querySelector('iframe')?.focus({ preventScroll: true });
+        return release;
+        // The URL is read once per key: a refetch must not reload the page.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [frameKey, slot, interactive, frameClass]);
+    return (_jsx("div", { ref: (node) => {
+            setSlot(node);
+            if (typeof ref === 'function')
+                ref(node);
+            else if (ref)
+                ref.current = node;
+        }, className: "absolute inset-0" }));
+});
+/** Create (and park) the pooled frame for an artifact page; a no-op when it exists. */
+export function ensureArtifactFrame(key, src, title) {
+    ensureFrame(key, src, {
+        title,
+        sandbox: ARTIFACT_IFRAME_SANDBOX,
+        allow: ARTIFACT_FRAME_ALLOW,
+        testid: 'artifact-frame',
+        referrerPolicy: 'no-referrer',
+    });
+}

package/dist/artifacts/artifact-session.d.ts

@@ -0,0 +1,18 @@
+/**
+ * An artifact in a chat: what the agent `show`ed when it handed one over. A
+ * live preview, its title and type. It is a link: on a session page the web
+ * app's link interceptor opens it in the session panel, like a Kortix App. A link
+ * the viewer cannot open (no access, flag off) renders `fallback` instead.
+ */
+export declare function ShowArtifactCard({ url, fallback }: {
+    url: string;
+    fallback: React.ReactNode;
+}): import("react").JSX.Element;
+/**
+ * An artifact in the session panel: the page itself (a doc read as its page),
+ * with its title, a way to the full viewer (where a doc is edited) and close.
+ */
+export declare function ArtifactPanelPreview({ url, onClose }: {
+    url: string;
+    onClose: () => void;
+}): import("react").JSX.Element;