@matterfact/embed 0.2.1 → 0.3.0

package/README.md

@@ -60,6 +60,34 @@ itself; showing/hiding your panel is the open/close control.
 
 Script-tag equivalent: `data-container="#your-panel"`.
 
+## Embedding an artifact
+
+Drop a matterfact **artifact** (a chart, table, dashboard you built in matterfact) straight
+into your page:
+
+```tsx
+import { MatterfactArtifact } from '@matterfact/embed/react';
+
+<MatterfactArtifact slug="tsla-liquidity" owner="you@firm.com" token="…" />;
+```
+
+`slug` and `owner` identify the artifact; `token` is the read-only embed token you mint for
+it (the **Share → Embed** dialog in matterfact generates the whole snippet, token included).
+It renders chrome-free in a sandboxed iframe and fills its container — size it with
+`className`/`style`.
+
+**The payoff when the agent is on the same page:** embed a `<MatterfactAgent>` too and the
+agent automatically sees the artifact you embedded and can answer questions about the data
+behind it — no wiring. The agent only ever gets read access to that artifact's own data, and
+the token never reaches the model. Nothing extra to configure.
+
+Script-tag / non-React hosts can use the iframe directly (the Share dialog shows this form):
+
+```html
+<iframe src="https://app.matterfact.com/embed/artifacts/tsla-liquidity?owner=you@firm.com&t=…"
+  width="100%" height="600" style="border:0"></iframe>
+```
+
 ## Signing users in
 
 By default the widget runs its own sign-in in a popup (the only way an embedded frame can
@@ -77,6 +105,45 @@ window.matterfact = { getEmbedAuthToken: () => getToken() };
 
 We verify the token either way — this skips a redundant login, it doesn't bypass auth.
 
+### Microsoft Entra (single-tenant)
+
+On a single-tenant Entra deployment there are **two app registrations**, and mixing them up
+is the thing that catches everyone:
+
+- the **matterfact** app registration — you created it in your tenant and gave us its
+  client id + secret. It *exposes* the scope.
+- the app you're **embedding into** (e.g. your portal) — a **different** registration with
+  its **own** client id. It's the one your users sign into.
+
+The token you pass to `getAuthToken` must be an **access token** for the matterfact app's
+scope — **not** your app's ID token. An ID token is addressed to your app, not matterfact's,
+and is rejected.
+
+A one-time setup on the matterfact registration (expose the scope, accept v2 tokens,
+pre-authorise your embedding app) is run by your Entra admin — the script and full
+walkthrough are in the [integration guide](https://app.matterfact.com/docs/api). Once it's
+done, your embedding app requests that scope with MSAL and hands the access token over:
+
+```tsx
+import { useMsal } from '@azure/msal-react';
+
+const { instance, accounts } = useMsal();  // configured with YOUR app's client id
+
+const getAuthToken = async () => {
+  const { accessToken } = await instance.acquireTokenSilent({
+    scopes: ['api://<matterfact-client-id>/embed.access'],
+    account: accounts[0],
+  });
+  return accessToken;  // access token, not the ID token
+};
+
+<MatterfactAgent publishableKey="pk_live_…" getAuthToken={getAuthToken} />;
+```
+
+The access token must carry an `email` / `preferred_username` / `upn` claim — the identity
+is keyed on it. Until the scope is set up, the default sign-in popup works with no
+configuration.
+
 ## What the agent can see
 
 Nothing until a user opens the chat; then a semantic snapshot of the **visible** page.

package/dist/{chunk-6VW4CCNF.js → chunk-33LPVL2R.js}

@@ -1,3 +1,3 @@
-import{a as re,b as P}from"./chunk-MWRVWYWX.js";var Be=Object.prototype.toString;function ie(e){return typeof e=="function"||Be.call(e)==="[object Function]"}function Fe(e){var t=Number(e);return isNaN(t)?0:t===0||!isFinite(t)?t:(t>0?1:-1)*Math.floor(Math.abs(t))}var Ke=Math.pow(2,53)-1;function ze(e){var t=Fe(e);return Math.min(Math.max(t,0),Ke)}function b(e,t){var n=Array,r=Object(e);if(e==null)throw new TypeError("Array.from requires an array-like object - not null or undefined");if(typeof t<"u"&&!ie(t))throw new TypeError("Array.from: when provided, the second argument must be a function");for(var a=ze(r.length),o=ie(n)?Object(new n(a)):new Array(a),l=0,u;l<a;)u=r[l],t?o[l]=t(u,l):o[l]=u,l+=1;return o.length=a,o}function D(e){"@babel/helpers - typeof";return D=typeof Symbol=="function"&&typeof Symbol.iterator=="symbol"?function(t){return typeof t}:function(t){return t&&typeof Symbol=="function"&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},D(e)}function Ye(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function ae(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,oe(r.key),r)}}function Qe(e,t,n){return t&&ae(e.prototype,t),n&&ae(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}function Je(e,t,n){return t=oe(t),t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function oe(e){var t=Ze(e,"string");return D(t)=="symbol"?t:t+""}function Ze(e,t){if(D(e)!="object"||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t||"default");if(D(r)!="object")return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return(t==="string"?String:Number)(e)}var et=(function(){function e(){var t=arguments.length>0&&arguments[0]!==void 0?arguments[0]:[];Ye(this,e),Je(this,"items",void 0),this.items=t}return Qe(e,[{key:"add",value:function(n){return this.has(n)===!1&&this.items.push(n),this}},{key:"clear",value:function(){this.items=[]}},{key:"delete",value:function(n){var r=this.items.length;return this.items=this.items.filter(function(a){return a!==n}),r!==this.items.length}},{key:"forEach",value:function(n){var r=this;this.items.forEach(function(a){n(a,a,r)})}},{key:"has",value:function(n){return this.items.indexOf(n)!==-1}},{key:"size",get:function(){return this.items.length}}])})(),le=typeof Set>"u"?Set:et;function d(e){var t;return(t=e.localName)!==null&&t!==void 0?t:e.tagName.toLowerCase()}var tt={article:"article",aside:"complementary",button:"button",datalist:"listbox",dd:"definition",details:"group",dialog:"dialog",dt:"term",fieldset:"group",figure:"figure",form:"form",footer:"contentinfo",h1:"heading",h2:"heading",h3:"heading",h4:"heading",h5:"heading",h6:"heading",header:"banner",hr:"separator",html:"document",legend:"legend",li:"listitem",math:"math",main:"main",menu:"list",nav:"navigation",ol:"list",optgroup:"group",option:"option",output:"status",progress:"progressbar",section:"region",summary:"button",table:"table",tbody:"rowgroup",textarea:"textbox",tfoot:"rowgroup",td:"cell",th:"columnheader",thead:"rowgroup",tr:"row",ul:"list"},nt={caption:new Set(["aria-label","aria-labelledby"]),code:new Set(["aria-label","aria-labelledby"]),deletion:new Set(["aria-label","aria-labelledby"]),emphasis:new Set(["aria-label","aria-labelledby"]),generic:new Set(["aria-label","aria-labelledby","aria-roledescription"]),insertion:new Set(["aria-label","aria-labelledby"]),none:new Set(["aria-label","aria-labelledby"]),paragraph:new Set(["aria-label","aria-labelledby"]),presentation:new Set(["aria-label","aria-labelledby"]),strong:new Set(["aria-label","aria-labelledby"]),subscript:new Set(["aria-label","aria-labelledby"]),superscript:new Set(["aria-label","aria-labelledby"])};function rt(e,t){return["aria-atomic","aria-busy","aria-controls","aria-current","aria-description","aria-describedby","aria-details","aria-dropeffect","aria-flowto","aria-grabbed","aria-hidden","aria-keyshortcuts","aria-label","aria-labelledby","aria-live","aria-owns","aria-relevant","aria-roledescription"].some(function(n){var r;return e.hasAttribute(n)&&!((r=nt[t])!==null&&r!==void 0&&r.has(n))})}function ue(e,t){return rt(e,t)}function C(e){var t=at(e);if(t===null||_.indexOf(t)!==-1){var n=it(e);if(_.indexOf(t||"")===-1||ue(e,n||""))return n}return t}function it(e){var t=tt[d(e)];if(t!==void 0)return t;switch(d(e)){case"a":case"area":case"link":if(e.hasAttribute("href"))return"link";break;case"img":return e.getAttribute("alt")===""&&!ue(e,"img")?"presentation":"img";case"input":{var n=e,r=n.type;switch(r){case"button":case"image":case"reset":case"submit":return"button";case"checkbox":case"radio":return r;case"range":return"slider";case"email":case"tel":case"text":case"url":return e.hasAttribute("list")?"combobox":"textbox";case"search":return e.hasAttribute("list")?"combobox":"searchbox";case"number":return"spinbutton";default:return null}}case"select":return e.hasAttribute("multiple")||e.size>1?"listbox":"combobox"}return null}function at(e){var t=e.getAttribute("role");if(t!==null){var n=t.trim().split(" ")[0];if(n.length>0)return n}return null}var _=["presentation","none"];function s(e){return e!==null&&e.nodeType===e.ELEMENT_NODE}function B(e){return s(e)&&d(e)==="caption"}function H(e){return s(e)&&d(e)==="input"}function se(e){return s(e)&&d(e)==="optgroup"}function fe(e){return s(e)&&d(e)==="select"}function ce(e){return s(e)&&d(e)==="table"}function de(e){return s(e)&&d(e)==="textarea"}function me(e){var t=e.ownerDocument===null?e:e.ownerDocument,n=t.defaultView;if(n===null)throw new TypeError("no window available");return n}function pe(e){return s(e)&&d(e)==="fieldset"}function be(e){return s(e)&&d(e)==="legend"}function ge(e){return s(e)&&d(e)==="slot"}function ot(e){return s(e)&&e.ownerSVGElement!==void 0}function he(e){return s(e)&&d(e)==="svg"}function ye(e){return ot(e)&&d(e)==="title"}function $(e,t){if(s(e)&&e.hasAttribute(t)){var n=e.getAttribute(t).split(" "),r=e.getRootNode?e.getRootNode():e.ownerDocument;return n.map(function(a){return r.getElementById(a)}).filter(function(a){return a!==null})}return[]}function g(e,t){return s(e)?t.indexOf(C(e))!==-1:!1}function lt(e){return e.trim().replace(/\s\s+/g," ")}function ut(e,t){if(!s(e))return!1;if(e.hasAttribute("hidden")||e.getAttribute("aria-hidden")==="true")return!0;var n=t(e);return n.getPropertyValue("display")==="none"||n.getPropertyValue("visibility")==="hidden"}function st(e){return g(e,["button","combobox","listbox","textbox"])||Ee(e,"range")}function Ee(e,t){if(!s(e))return!1;switch(t){case"range":return g(e,["meter","progressbar","scrollbar","slider","spinbutton"]);default:throw new TypeError("No knowledge about abstract role '".concat(t,"'. This is likely a bug :("))}}function ve(e,t){var n=b(e.querySelectorAll(t));return $(e,"aria-owns").forEach(function(r){n.push.apply(n,b(r.querySelectorAll(t)))}),n}function ft(e){return fe(e)?e.selectedOptions||ve(e,"[selected]"):ve(e,'[aria-selected="true"]')}function ct(e){return g(e,_)}function dt(e){return B(e)}function mt(e){return g(e,["button","cell","checkbox","columnheader","gridcell","heading","label","legend","link","menuitem","menuitemcheckbox","menuitemradio","option","radio","row","rowheader","switch","tab","tooltip","treeitem"])}function pt(e){return!1}function bt(e){return H(e)||de(e)?e.value:e.textContent||""}function Se(e){var t=e.getPropertyValue("content");return/^["'].*["']$/.test(t)?t.slice(1,-1):""}function xe(e){var t=d(e);return t==="button"||t==="input"&&e.getAttribute("type")!=="hidden"||t==="meter"||t==="output"||t==="progress"||t==="select"||t==="textarea"}function Ae(e){if(xe(e))return e;var t=null;return e.childNodes.forEach(function(n){if(t===null&&s(n)){var r=Ae(n);r!==null&&(t=r)}}),t}function gt(e){if(e.control!==void 0)return e.control;var t=e.getAttribute("for");return t!==null?e.ownerDocument.getElementById(t):Ae(e)}function ht(e){var t=e.labels;if(t===null)return t;if(t!==void 0)return b(t);if(!xe(e))return null;var n=e.ownerDocument;return b(n.querySelectorAll("label")).filter(function(r){return gt(r)===e})}function yt(e){var t=e.assignedNodes();return t.length===0?b(e.childNodes):t}function F(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},n=new le,r=typeof Map>"u"?void 0:new Map,a=me(e),o=t.compute,l=o===void 0?"name":o,u=t.computedStyleSupportsPseudoElements,m=u===void 0?t.getComputedStyle!==void 0:u,p=t.getComputedStyle,x=p===void 0?a.getComputedStyle.bind(a):p,M=t.hidden,O=M===void 0?!1:M,I=function(f,c){if(c!==void 0)throw new Error("use uncachedGetComputedStyle directly for pseudo elements");if(r===void 0)return x(f);var h=r.get(f);if(h)return h;var y=x(f,c);return r.set(f,y),y};function W(i,f){var c="";if(s(i)&&m){var h=x(i,"::before"),y=Se(h);c="".concat(y," ").concat(c)}var S=ge(i)?yt(i):b(i.childNodes).concat($(i,"aria-owns"));if(S.forEach(function(v){var N=A(v,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!1,recursion:!0}),E=s(v)?I(v).getPropertyValue("display"):"inline",k=E!=="inline"?" ":"";c+="".concat(k).concat(N).concat(k)}),s(i)&&m){var T=x(i,"::after"),w=Se(T);c="".concat(c," ").concat(w)}return c.trim()}function R(i,f){var c=i.getAttributeNode(f);return c!==null&&!n.has(c)&&c.value.trim()!==""?(n.add(c),c.value):null}function Ue(i){return s(i)?R(i,"title"):null}function Xe(i){if(!s(i))return null;if(pe(i)){n.add(i);for(var f=b(i.childNodes),c=0;c<f.length;c+=1){var h=f[c];if(be(h))return A(h,{isEmbeddedInLabel:!1,isReferenced:!1,recursion:!1})}}else if(ce(i)){n.add(i);for(var y=b(i.childNodes),S=0;S<y.length;S+=1){var T=y[S];if(B(T))return A(T,{isEmbeddedInLabel:!1,isReferenced:!1,recursion:!1})}}else if(he(i)){n.add(i);for(var w=b(i.childNodes),v=0;v<w.length;v+=1){var N=w[v];if(ye(N))return N.textContent}return null}else if(d(i)==="img"||d(i)==="area"){var E=R(i,"alt");if(E!==null)return E}else if(se(i)){var k=R(i,"label");if(k!==null)return k}if(H(i)&&(i.type==="button"||i.type==="submit"||i.type==="reset")){var Z=R(i,"value");if(Z!==null)return Z;if(i.type==="submit")return"Submit";if(i.type==="reset")return"Reset"}var U=ht(i);if(U!==null&&U.length!==0)return n.add(i),b(U).map(function(X){return A(X,{isEmbeddedInLabel:!0,isReferenced:!1,recursion:!0})}).filter(function(X){return X.length>0}).join(" ");if(H(i)&&i.type==="image"){var ee=R(i,"alt");if(ee!==null)return ee;var te=R(i,"title");return te!==null?te:"Submit Query"}if(g(i,["button"])){var ne=W(i,{isEmbeddedInLabel:!1,isReferenced:!1});if(ne!=="")return ne}return null}function A(i,f){if(n.has(i))return"";if(!O&&ut(i,I)&&!f.isReferenced)return n.add(i),"";var c=s(i)?i.getAttributeNode("aria-labelledby"):null,h=c!==null&&!n.has(c)?$(i,"aria-labelledby"):[];if(l==="name"&&!f.isReferenced&&h.length>0)return n.add(c),h.map(function(E){return A(E,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!0,recursion:!1})}).join(" ");var y=f.recursion&&st(i)&&l==="name";if(!y){var S=(s(i)&&i.getAttribute("aria-label")||"").trim();if(S!==""&&l==="name")return n.add(i),S;if(!ct(i)){var T=Xe(i);if(T!==null)return n.add(i),T}}if(g(i,["menu"]))return n.add(i),"";if(y||f.isEmbeddedInLabel||f.isReferenced){if(g(i,["combobox","listbox"])){n.add(i);var w=ft(i);return w.length===0?H(i)?i.value:"":b(w).map(function(E){return A(E,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!1,recursion:!0})}).join(" ")}if(Ee(i,"range"))return n.add(i),i.hasAttribute("aria-valuetext")?i.getAttribute("aria-valuetext"):i.hasAttribute("aria-valuenow")?i.getAttribute("aria-valuenow"):i.getAttribute("value")||"";if(g(i,["textbox"]))return n.add(i),bt(i)}if(mt(i)||s(i)&&f.isReferenced||dt(i)||pt(i)){var v=W(i,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!1});if(v!=="")return n.add(i),v}if(i.nodeType===i.TEXT_NODE)return n.add(i),i.textContent||"";if(f.recursion)return n.add(i),W(i,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!1});var N=Ue(i);return N!==null?(n.add(i),N):(n.add(i),"")}return lt(A(e,{isEmbeddedInLabel:!1,isReferenced:l==="description",recursion:!1}))}function vt(e){return g(e,["caption","code","deletion","emphasis","generic","insertion","none","paragraph","presentation","strong","subscript","superscript"])}function K(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{};return vt(e)?"":F(e,t)}function Te(e){var t,n=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},r=n.getComputedStyle,a=r===void 0?(t=e.ownerDocument.defaultView)===null||t===void 0?void 0:t.getComputedStyle:r,o=n.isSubtreeInaccessible,l=o===void 0?St:o;if(typeof a!="function")throw new TypeError("Owner document of the element needs to have an associated window.");if(a(e).visibility==="hidden")return!0;for(var u=e;u;){if(l(u,{getComputedStyle:a}))return!0;u=u.parentElement}return!1}function St(e){var t,n=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},r=n.getComputedStyle,a=r===void 0?(t=e.ownerDocument.defaultView)===null||t===void 0?void 0:t.getComputedStyle:r;if(typeof a!="function")throw new TypeError("Owner document of the element needs to have an associated window.");return e.hidden===!0||e.getAttribute("aria-hidden")==="true"||a(e).display==="none"}var Et=new Set(["button","fieldset","input","optgroup","option","select","textarea"]);function V(e){var t=d(e);return Et.has(t)&&e.hasAttribute("disabled")?!0:e.getAttribute("aria-disabled")==="true"}function Ne(){let e=new WeakMap;return((t,n)=>{if(n)return window.getComputedStyle(t,n);let r=e.get(t);return r||(r=window.getComputedStyle(t),e.set(t,r)),r})}function Le(){return document.documentElement.getClientRects().length>0}function Oe(e,t,n){let r=t.display;if(r==="none")return!1;let a=t.visibility;if(a==="hidden"||a==="collapse"||Number(t.opacity)===0)return!1;if(n&&r!=="contents"){let o=e.getBoundingClientRect();if(o.width<=0||o.height<=0||e.getClientRects().length===0||o.right<-2e3||o.bottom<-2e3)return!1}return!0}function Re(e){return e.pointerEvents!=="none"}var xt=new Set(["button","checkbox","combobox","link","listbox","menuitem","menuitemcheckbox","menuitemradio","option","radio","searchbox","slider","spinbutton","switch","tab","textbox","treeitem"]),At=new Set(["BUTTON","INPUT","SELECT","TEXTAREA","SUMMARY"]);function j(e){let t=e.getAttribute("contenteditable");return t!==null&&t!=="false"}function Ce(e,t,n,r){let a=e.tagName;if(a==="A"&&e.hasAttribute("href")||At.has(a)||t!==null&&xt.has(t))return!0;let o=e.getAttribute("tabindex");return!!(o!==null&&Number(o)>=0||j(e)||n.cursor==="pointer"&&r?.cursor!=="pointer")}var Me=new Set(["button","cell","checkbox","columnheader","gridcell","heading","link","menuitem","menuitemcheckbox","menuitemradio","option","radio","row","rowheader","switch","tab","tooltip","treeitem"]),Tt=new Set(["textbox","searchbox","spinbutton"]),wt=new Set(["INPUT","TEXTAREA"]);function Ie(e){return wt.has(e.tagName)||j(e)}function Nt(e,t){let n=e.tagName;return n==="INPUT"||n==="TEXTAREA"?Tt.has(t)?(e.value??"").length>0:!1:j(e)?(e.textContent??"").trim().length>0:!1}function we(e,t){let n=e.getAttribute(t);return n==="true"?"true":n==="mixed"?"mixed":null}function ke(e,t){let n=[],r=e.tagName;if(r==="INPUT"&&(t==="checkbox"||t==="radio"))e.checked&&n.push("[checked]");else{let l=we(e,"aria-checked");l==="mixed"?n.push("[checked=mixed]"):l==="true"&&n.push("[checked]")}V(e)&&n.push("[disabled]");let a=e.getAttribute("aria-expanded");if(a==="true"||a==="false")a==="true"&&n.push("[expanded]");else if(r==="SUMMARY"){let l=e.parentElement;l?.tagName==="DETAILS"&&l.open&&n.push("[expanded]")}if(t==="heading"){let l=e.getAttribute("aria-level"),u=Number(l||r[1]);Number.isFinite(u)&&u>0&&n.push(`[level=${u}]`)}let o=we(e,"aria-pressed");return o==="mixed"?n.push("[pressed=mixed]"):o==="true"&&n.push("[pressed]"),e.getAttribute("aria-selected")==="true"&&n.push("[selected]"),Nt(e,t)&&n.push("[filled]"),n.join(" ")}function Pe(e){return j(e)?"textbox":C(e)}var z='input,textarea,select,[contenteditable=""],[contenteditable="true"],[aria-valuetext],[data-mf-private]';function Lt(e){let t=e.getAttribute("aria-labelledby");if(t){for(let n of t.split(/\s+/)){if(!n)continue;let r=e.ownerDocument.getElementById(n);if(r&&(r.matches(z)||r.querySelector(z)))return!0}return!1}return e.hasAttribute("aria-label")?!1:e.querySelector(z)!==null}function De(e,t){let n=K(e,{getComputedStyle:t,computedStyleSupportsPseudoElements:!1});return n?Lt(e)?e.getAttribute("aria-label")||"":n:""}var Ot=0,G=0,Y=new WeakMap,q=new Map;function _e(){G++,q.clear()}function He(e,t,n){let r=`${t} ${n}`,a=Y.get(e);return!a||a.key!==r?(a={id:`e${++Ot}`,key:r,gen:G},Y.set(e,a)):a.gen=G,q.set(a.id,e),a.id}function Rt(e){let t=q.get(e);if(!t)return null;if(!t.isConnected)return q.delete(e),null;let n=Y.get(t);return!n||n.id!==e||n.gen!==G?null:t}var Ct=4e3,Mt=800,It=120,kt=120,Ge=25,$e=new Set(["generic","presentation","none"]),Pt=new Set(["SCRIPT","STYLE","NOSCRIPT","TEMPLATE","SVG","HEAD","LINK","META","BASE"]);function L(e){return e.nodes>=Ct||e.lines>=Mt?(e.truncated=!0,!1):!0}function Dt(e){return e.id==="matterfact-embed"||e.hasAttribute("data-mf-embed")}function _t(e,t,n){return e.getAttribute("aria-hidden")==="true"||e.hasAttribute("hidden")||e.hasAttribute("inert")?!0:!Oe(e,t,n)}function Ht(e){if(e.shadowRoot)return e.shadowRoot.childNodes;if(e.tagName==="SLOT"){let t=e.assignedNodes({flatten:!0});if(t.length)return t}return e.childNodes}function Q(e,t,n,r){let a=Ht(e);for(let o=0;o<a.length;o++){let l=a[o];l&&qt(l,t,n,r)}}function $t(e,t,n){let r=(e.nodeValue??"").replace(/\s+/g," ").trim();r&&(Me.has(t.role)||L(n)&&(n.lines++,t.children.push(r)))}function J(e){let t=e.matches(":disabled")||V(e);return{role:"option",name:(e.label||e.textContent||"").trim(),props:(t?" [disabled]":"")+(e.selected?" [selected]":""),children:[]}}function Vt(e,t,n){let r=e.options,a=Math.min(r.length,Ge);for(let m=0;m<a;m++){if(!L(n))return;let p=r[m];!p||P(p)||(n.lines++,t.children.push(J(p)))}let o=0,l=e.selectedOptions;for(let m=0;m<l.length;m++){let p=l[m];if(p&&p.index>=a&&!P(p)){if(!L(n))return;n.lines++,t.children.push(J(p)),o++}}let u=r.length-a-o;u>0&&L(n)&&(n.lines++,t.children.push(`\u2026 (+${u} more options)`))}function jt(e,t,n){let r=e.list;if(!r)return;let a=r.options,o=Math.min(a.length,Ge);for(let u=0;u<o;u++){if(!L(n))return;let m=a[u];!m||P(m)||(n.lines++,t.children.push(J(m)))}let l=a.length-o;l>0&&L(n)&&(n.lines++,t.children.push(`\u2026 (+${l} more options)`))}function Gt(e,t,n,r){if(!L(r)||Pt.has(e.tagName)||Dt(e)||P(e))return;r.nodes++;let a=r.styleOf(e);if(_t(e,a,r.layout))return;let o=Pe(e),l=o===null||$e.has(o),u=Ce(e,o,a,n);if(l&&!u){Q(e,t,a,r);return}let m=o===null||$e.has(o)?"generic":o,p=De(e,r.styleOf),x="";if(u&&Re(a)){let I=He(e,m,p);x=` [ref=${I}]`,r.onRef?.(I,e)}let M=ke(e,m),O={role:m,name:p,props:(M?` ${M}`:"")+x,children:[]};if(r.lines++,t.children.push(O),e.tagName==="SELECT"){Vt(e,O,r);return}e.tagName==="INPUT"&&e.list&&jt(e,O,r),!Ie(e)&&Q(e,O,a,r)}function qt(e,t,n,r){e.nodeType===3?$t(e,t,r):e.nodeType===1&&Gt(e,t,n,r)}function Ve(e,t){let n=e.replace(/\s+/g," ").trim(),r=re(n);return r.length>t?`${r.slice(0,t-1)}\u2026`:r}function je(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`}function qe(e,t,n){let r="  ".repeat(t);for(let a of e){if(typeof a=="string"){n.push(`${r}- text: ${je(Ve(a,kt))}`);continue}let o=a.name?` ${je(Ve(a.name,It))}`:"",l=`${r}- ${a.role}${o}${a.props}`;a.children.length?(n.push(`${l}:`),qe(a.children,t+1,n)):n.push(l)}}function We(e,t){let n=Ne(),r={styleOf:n,layout:Le(),nodes:0,lines:0,truncated:!1,onRef:t};if(Te(e,{getComputedStyle:n}))return{yaml:"",truncated:!1};let a={role:"",name:"",props:"",children:[]};Q(e,a,n(e),r);let o=[];return qe(a.children,0,o),r.truncated&&o.length&&(o[o.length-1]='- text: "\u2026 (snapshot truncated \u2014 more of the page is below)"'),{yaml:o.join(`
+import{a as re,b as P}from"./chunk-F7DLOR7F.js";var Be=Object.prototype.toString;function ie(e){return typeof e=="function"||Be.call(e)==="[object Function]"}function Fe(e){var t=Number(e);return isNaN(t)?0:t===0||!isFinite(t)?t:(t>0?1:-1)*Math.floor(Math.abs(t))}var Ke=Math.pow(2,53)-1;function ze(e){var t=Fe(e);return Math.min(Math.max(t,0),Ke)}function b(e,t){var n=Array,r=Object(e);if(e==null)throw new TypeError("Array.from requires an array-like object - not null or undefined");if(typeof t<"u"&&!ie(t))throw new TypeError("Array.from: when provided, the second argument must be a function");for(var a=ze(r.length),o=ie(n)?Object(new n(a)):new Array(a),l=0,u;l<a;)u=r[l],t?o[l]=t(u,l):o[l]=u,l+=1;return o.length=a,o}function D(e){"@babel/helpers - typeof";return D=typeof Symbol=="function"&&typeof Symbol.iterator=="symbol"?function(t){return typeof t}:function(t){return t&&typeof Symbol=="function"&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t},D(e)}function Ye(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}function ae(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable||!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,oe(r.key),r)}}function Qe(e,t,n){return t&&ae(e.prototype,t),n&&ae(e,n),Object.defineProperty(e,"prototype",{writable:!1}),e}function Je(e,t,n){return t=oe(t),t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function oe(e){var t=Ze(e,"string");return D(t)=="symbol"?t:t+""}function Ze(e,t){if(D(e)!="object"||!e)return e;var n=e[Symbol.toPrimitive];if(n!==void 0){var r=n.call(e,t||"default");if(D(r)!="object")return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return(t==="string"?String:Number)(e)}var et=(function(){function e(){var t=arguments.length>0&&arguments[0]!==void 0?arguments[0]:[];Ye(this,e),Je(this,"items",void 0),this.items=t}return Qe(e,[{key:"add",value:function(n){return this.has(n)===!1&&this.items.push(n),this}},{key:"clear",value:function(){this.items=[]}},{key:"delete",value:function(n){var r=this.items.length;return this.items=this.items.filter(function(a){return a!==n}),r!==this.items.length}},{key:"forEach",value:function(n){var r=this;this.items.forEach(function(a){n(a,a,r)})}},{key:"has",value:function(n){return this.items.indexOf(n)!==-1}},{key:"size",get:function(){return this.items.length}}])})(),le=typeof Set>"u"?Set:et;function d(e){var t;return(t=e.localName)!==null&&t!==void 0?t:e.tagName.toLowerCase()}var tt={article:"article",aside:"complementary",button:"button",datalist:"listbox",dd:"definition",details:"group",dialog:"dialog",dt:"term",fieldset:"group",figure:"figure",form:"form",footer:"contentinfo",h1:"heading",h2:"heading",h3:"heading",h4:"heading",h5:"heading",h6:"heading",header:"banner",hr:"separator",html:"document",legend:"legend",li:"listitem",math:"math",main:"main",menu:"list",nav:"navigation",ol:"list",optgroup:"group",option:"option",output:"status",progress:"progressbar",section:"region",summary:"button",table:"table",tbody:"rowgroup",textarea:"textbox",tfoot:"rowgroup",td:"cell",th:"columnheader",thead:"rowgroup",tr:"row",ul:"list"},nt={caption:new Set(["aria-label","aria-labelledby"]),code:new Set(["aria-label","aria-labelledby"]),deletion:new Set(["aria-label","aria-labelledby"]),emphasis:new Set(["aria-label","aria-labelledby"]),generic:new Set(["aria-label","aria-labelledby","aria-roledescription"]),insertion:new Set(["aria-label","aria-labelledby"]),none:new Set(["aria-label","aria-labelledby"]),paragraph:new Set(["aria-label","aria-labelledby"]),presentation:new Set(["aria-label","aria-labelledby"]),strong:new Set(["aria-label","aria-labelledby"]),subscript:new Set(["aria-label","aria-labelledby"]),superscript:new Set(["aria-label","aria-labelledby"])};function rt(e,t){return["aria-atomic","aria-busy","aria-controls","aria-current","aria-description","aria-describedby","aria-details","aria-dropeffect","aria-flowto","aria-grabbed","aria-hidden","aria-keyshortcuts","aria-label","aria-labelledby","aria-live","aria-owns","aria-relevant","aria-roledescription"].some(function(n){var r;return e.hasAttribute(n)&&!((r=nt[t])!==null&&r!==void 0&&r.has(n))})}function ue(e,t){return rt(e,t)}function C(e){var t=at(e);if(t===null||_.indexOf(t)!==-1){var n=it(e);if(_.indexOf(t||"")===-1||ue(e,n||""))return n}return t}function it(e){var t=tt[d(e)];if(t!==void 0)return t;switch(d(e)){case"a":case"area":case"link":if(e.hasAttribute("href"))return"link";break;case"img":return e.getAttribute("alt")===""&&!ue(e,"img")?"presentation":"img";case"input":{var n=e,r=n.type;switch(r){case"button":case"image":case"reset":case"submit":return"button";case"checkbox":case"radio":return r;case"range":return"slider";case"email":case"tel":case"text":case"url":return e.hasAttribute("list")?"combobox":"textbox";case"search":return e.hasAttribute("list")?"combobox":"searchbox";case"number":return"spinbutton";default:return null}}case"select":return e.hasAttribute("multiple")||e.size>1?"listbox":"combobox"}return null}function at(e){var t=e.getAttribute("role");if(t!==null){var n=t.trim().split(" ")[0];if(n.length>0)return n}return null}var _=["presentation","none"];function s(e){return e!==null&&e.nodeType===e.ELEMENT_NODE}function B(e){return s(e)&&d(e)==="caption"}function H(e){return s(e)&&d(e)==="input"}function se(e){return s(e)&&d(e)==="optgroup"}function fe(e){return s(e)&&d(e)==="select"}function ce(e){return s(e)&&d(e)==="table"}function de(e){return s(e)&&d(e)==="textarea"}function me(e){var t=e.ownerDocument===null?e:e.ownerDocument,n=t.defaultView;if(n===null)throw new TypeError("no window available");return n}function pe(e){return s(e)&&d(e)==="fieldset"}function be(e){return s(e)&&d(e)==="legend"}function ge(e){return s(e)&&d(e)==="slot"}function ot(e){return s(e)&&e.ownerSVGElement!==void 0}function he(e){return s(e)&&d(e)==="svg"}function ye(e){return ot(e)&&d(e)==="title"}function $(e,t){if(s(e)&&e.hasAttribute(t)){var n=e.getAttribute(t).split(" "),r=e.getRootNode?e.getRootNode():e.ownerDocument;return n.map(function(a){return r.getElementById(a)}).filter(function(a){return a!==null})}return[]}function g(e,t){return s(e)?t.indexOf(C(e))!==-1:!1}function lt(e){return e.trim().replace(/\s\s+/g," ")}function ut(e,t){if(!s(e))return!1;if(e.hasAttribute("hidden")||e.getAttribute("aria-hidden")==="true")return!0;var n=t(e);return n.getPropertyValue("display")==="none"||n.getPropertyValue("visibility")==="hidden"}function st(e){return g(e,["button","combobox","listbox","textbox"])||Ee(e,"range")}function Ee(e,t){if(!s(e))return!1;switch(t){case"range":return g(e,["meter","progressbar","scrollbar","slider","spinbutton"]);default:throw new TypeError("No knowledge about abstract role '".concat(t,"'. This is likely a bug :("))}}function ve(e,t){var n=b(e.querySelectorAll(t));return $(e,"aria-owns").forEach(function(r){n.push.apply(n,b(r.querySelectorAll(t)))}),n}function ft(e){return fe(e)?e.selectedOptions||ve(e,"[selected]"):ve(e,'[aria-selected="true"]')}function ct(e){return g(e,_)}function dt(e){return B(e)}function mt(e){return g(e,["button","cell","checkbox","columnheader","gridcell","heading","label","legend","link","menuitem","menuitemcheckbox","menuitemradio","option","radio","row","rowheader","switch","tab","tooltip","treeitem"])}function pt(e){return!1}function bt(e){return H(e)||de(e)?e.value:e.textContent||""}function Se(e){var t=e.getPropertyValue("content");return/^["'].*["']$/.test(t)?t.slice(1,-1):""}function xe(e){var t=d(e);return t==="button"||t==="input"&&e.getAttribute("type")!=="hidden"||t==="meter"||t==="output"||t==="progress"||t==="select"||t==="textarea"}function Ae(e){if(xe(e))return e;var t=null;return e.childNodes.forEach(function(n){if(t===null&&s(n)){var r=Ae(n);r!==null&&(t=r)}}),t}function gt(e){if(e.control!==void 0)return e.control;var t=e.getAttribute("for");return t!==null?e.ownerDocument.getElementById(t):Ae(e)}function ht(e){var t=e.labels;if(t===null)return t;if(t!==void 0)return b(t);if(!xe(e))return null;var n=e.ownerDocument;return b(n.querySelectorAll("label")).filter(function(r){return gt(r)===e})}function yt(e){var t=e.assignedNodes();return t.length===0?b(e.childNodes):t}function F(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},n=new le,r=typeof Map>"u"?void 0:new Map,a=me(e),o=t.compute,l=o===void 0?"name":o,u=t.computedStyleSupportsPseudoElements,m=u===void 0?t.getComputedStyle!==void 0:u,p=t.getComputedStyle,x=p===void 0?a.getComputedStyle.bind(a):p,M=t.hidden,O=M===void 0?!1:M,I=function(f,c){if(c!==void 0)throw new Error("use uncachedGetComputedStyle directly for pseudo elements");if(r===void 0)return x(f);var h=r.get(f);if(h)return h;var y=x(f,c);return r.set(f,y),y};function W(i,f){var c="";if(s(i)&&m){var h=x(i,"::before"),y=Se(h);c="".concat(y," ").concat(c)}var S=ge(i)?yt(i):b(i.childNodes).concat($(i,"aria-owns"));if(S.forEach(function(v){var N=A(v,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!1,recursion:!0}),E=s(v)?I(v).getPropertyValue("display"):"inline",k=E!=="inline"?" ":"";c+="".concat(k).concat(N).concat(k)}),s(i)&&m){var T=x(i,"::after"),w=Se(T);c="".concat(c," ").concat(w)}return c.trim()}function R(i,f){var c=i.getAttributeNode(f);return c!==null&&!n.has(c)&&c.value.trim()!==""?(n.add(c),c.value):null}function Ue(i){return s(i)?R(i,"title"):null}function Xe(i){if(!s(i))return null;if(pe(i)){n.add(i);for(var f=b(i.childNodes),c=0;c<f.length;c+=1){var h=f[c];if(be(h))return A(h,{isEmbeddedInLabel:!1,isReferenced:!1,recursion:!1})}}else if(ce(i)){n.add(i);for(var y=b(i.childNodes),S=0;S<y.length;S+=1){var T=y[S];if(B(T))return A(T,{isEmbeddedInLabel:!1,isReferenced:!1,recursion:!1})}}else if(he(i)){n.add(i);for(var w=b(i.childNodes),v=0;v<w.length;v+=1){var N=w[v];if(ye(N))return N.textContent}return null}else if(d(i)==="img"||d(i)==="area"){var E=R(i,"alt");if(E!==null)return E}else if(se(i)){var k=R(i,"label");if(k!==null)return k}if(H(i)&&(i.type==="button"||i.type==="submit"||i.type==="reset")){var Z=R(i,"value");if(Z!==null)return Z;if(i.type==="submit")return"Submit";if(i.type==="reset")return"Reset"}var U=ht(i);if(U!==null&&U.length!==0)return n.add(i),b(U).map(function(X){return A(X,{isEmbeddedInLabel:!0,isReferenced:!1,recursion:!0})}).filter(function(X){return X.length>0}).join(" ");if(H(i)&&i.type==="image"){var ee=R(i,"alt");if(ee!==null)return ee;var te=R(i,"title");return te!==null?te:"Submit Query"}if(g(i,["button"])){var ne=W(i,{isEmbeddedInLabel:!1,isReferenced:!1});if(ne!=="")return ne}return null}function A(i,f){if(n.has(i))return"";if(!O&&ut(i,I)&&!f.isReferenced)return n.add(i),"";var c=s(i)?i.getAttributeNode("aria-labelledby"):null,h=c!==null&&!n.has(c)?$(i,"aria-labelledby"):[];if(l==="name"&&!f.isReferenced&&h.length>0)return n.add(c),h.map(function(E){return A(E,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!0,recursion:!1})}).join(" ");var y=f.recursion&&st(i)&&l==="name";if(!y){var S=(s(i)&&i.getAttribute("aria-label")||"").trim();if(S!==""&&l==="name")return n.add(i),S;if(!ct(i)){var T=Xe(i);if(T!==null)return n.add(i),T}}if(g(i,["menu"]))return n.add(i),"";if(y||f.isEmbeddedInLabel||f.isReferenced){if(g(i,["combobox","listbox"])){n.add(i);var w=ft(i);return w.length===0?H(i)?i.value:"":b(w).map(function(E){return A(E,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!1,recursion:!0})}).join(" ")}if(Ee(i,"range"))return n.add(i),i.hasAttribute("aria-valuetext")?i.getAttribute("aria-valuetext"):i.hasAttribute("aria-valuenow")?i.getAttribute("aria-valuenow"):i.getAttribute("value")||"";if(g(i,["textbox"]))return n.add(i),bt(i)}if(mt(i)||s(i)&&f.isReferenced||dt(i)||pt(i)){var v=W(i,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!1});if(v!=="")return n.add(i),v}if(i.nodeType===i.TEXT_NODE)return n.add(i),i.textContent||"";if(f.recursion)return n.add(i),W(i,{isEmbeddedInLabel:f.isEmbeddedInLabel,isReferenced:!1});var N=Ue(i);return N!==null?(n.add(i),N):(n.add(i),"")}return lt(A(e,{isEmbeddedInLabel:!1,isReferenced:l==="description",recursion:!1}))}function vt(e){return g(e,["caption","code","deletion","emphasis","generic","insertion","none","paragraph","presentation","strong","subscript","superscript"])}function K(e){var t=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{};return vt(e)?"":F(e,t)}function Te(e){var t,n=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},r=n.getComputedStyle,a=r===void 0?(t=e.ownerDocument.defaultView)===null||t===void 0?void 0:t.getComputedStyle:r,o=n.isSubtreeInaccessible,l=o===void 0?St:o;if(typeof a!="function")throw new TypeError("Owner document of the element needs to have an associated window.");if(a(e).visibility==="hidden")return!0;for(var u=e;u;){if(l(u,{getComputedStyle:a}))return!0;u=u.parentElement}return!1}function St(e){var t,n=arguments.length>1&&arguments[1]!==void 0?arguments[1]:{},r=n.getComputedStyle,a=r===void 0?(t=e.ownerDocument.defaultView)===null||t===void 0?void 0:t.getComputedStyle:r;if(typeof a!="function")throw new TypeError("Owner document of the element needs to have an associated window.");return e.hidden===!0||e.getAttribute("aria-hidden")==="true"||a(e).display==="none"}var Et=new Set(["button","fieldset","input","optgroup","option","select","textarea"]);function V(e){var t=d(e);return Et.has(t)&&e.hasAttribute("disabled")?!0:e.getAttribute("aria-disabled")==="true"}function Ne(){let e=new WeakMap;return((t,n)=>{if(n)return window.getComputedStyle(t,n);let r=e.get(t);return r||(r=window.getComputedStyle(t),e.set(t,r)),r})}function Le(){return document.documentElement.getClientRects().length>0}function Oe(e,t,n){let r=t.display;if(r==="none")return!1;let a=t.visibility;if(a==="hidden"||a==="collapse"||Number(t.opacity)===0)return!1;if(n&&r!=="contents"){let o=e.getBoundingClientRect();if(o.width<=0||o.height<=0||e.getClientRects().length===0||o.right<-2e3||o.bottom<-2e3)return!1}return!0}function Re(e){return e.pointerEvents!=="none"}var xt=new Set(["button","checkbox","combobox","link","listbox","menuitem","menuitemcheckbox","menuitemradio","option","radio","searchbox","slider","spinbutton","switch","tab","textbox","treeitem"]),At=new Set(["BUTTON","INPUT","SELECT","TEXTAREA","SUMMARY"]);function j(e){let t=e.getAttribute("contenteditable");return t!==null&&t!=="false"}function Ce(e,t,n,r){let a=e.tagName;if(a==="A"&&e.hasAttribute("href")||At.has(a)||t!==null&&xt.has(t))return!0;let o=e.getAttribute("tabindex");return!!(o!==null&&Number(o)>=0||j(e)||n.cursor==="pointer"&&r?.cursor!=="pointer")}var Me=new Set(["button","cell","checkbox","columnheader","gridcell","heading","link","menuitem","menuitemcheckbox","menuitemradio","option","radio","row","rowheader","switch","tab","tooltip","treeitem"]),Tt=new Set(["textbox","searchbox","spinbutton"]),wt=new Set(["INPUT","TEXTAREA"]);function Ie(e){return wt.has(e.tagName)||j(e)}function Nt(e,t){let n=e.tagName;return n==="INPUT"||n==="TEXTAREA"?Tt.has(t)?(e.value??"").length>0:!1:j(e)?(e.textContent??"").trim().length>0:!1}function we(e,t){let n=e.getAttribute(t);return n==="true"?"true":n==="mixed"?"mixed":null}function ke(e,t){let n=[],r=e.tagName;if(r==="INPUT"&&(t==="checkbox"||t==="radio"))e.checked&&n.push("[checked]");else{let l=we(e,"aria-checked");l==="mixed"?n.push("[checked=mixed]"):l==="true"&&n.push("[checked]")}V(e)&&n.push("[disabled]");let a=e.getAttribute("aria-expanded");if(a==="true"||a==="false")a==="true"&&n.push("[expanded]");else if(r==="SUMMARY"){let l=e.parentElement;l?.tagName==="DETAILS"&&l.open&&n.push("[expanded]")}if(t==="heading"){let l=e.getAttribute("aria-level"),u=Number(l||r[1]);Number.isFinite(u)&&u>0&&n.push(`[level=${u}]`)}let o=we(e,"aria-pressed");return o==="mixed"?n.push("[pressed=mixed]"):o==="true"&&n.push("[pressed]"),e.getAttribute("aria-selected")==="true"&&n.push("[selected]"),Nt(e,t)&&n.push("[filled]"),n.join(" ")}function Pe(e){return j(e)?"textbox":C(e)}var z='input,textarea,select,[contenteditable=""],[contenteditable="true"],[aria-valuetext],[data-mf-private]';function Lt(e){let t=e.getAttribute("aria-labelledby");if(t){for(let n of t.split(/\s+/)){if(!n)continue;let r=e.ownerDocument.getElementById(n);if(r&&(r.matches(z)||r.querySelector(z)))return!0}return!1}return e.hasAttribute("aria-label")?!1:e.querySelector(z)!==null}function De(e,t){let n=K(e,{getComputedStyle:t,computedStyleSupportsPseudoElements:!1});return n?Lt(e)?e.getAttribute("aria-label")||"":n:""}var Ot=0,G=0,Y=new WeakMap,q=new Map;function _e(){G++,q.clear()}function He(e,t,n){let r=`${t} ${n}`,a=Y.get(e);return!a||a.key!==r?(a={id:`e${++Ot}`,key:r,gen:G},Y.set(e,a)):a.gen=G,q.set(a.id,e),a.id}function Rt(e){let t=q.get(e);if(!t)return null;if(!t.isConnected)return q.delete(e),null;let n=Y.get(t);return!n||n.id!==e||n.gen!==G?null:t}var Ct=4e3,Mt=800,It=120,kt=120,Ge=25,$e=new Set(["generic","presentation","none"]),Pt=new Set(["SCRIPT","STYLE","NOSCRIPT","TEMPLATE","SVG","HEAD","LINK","META","BASE"]);function L(e){return e.nodes>=Ct||e.lines>=Mt?(e.truncated=!0,!1):!0}function Dt(e){return e.id==="matterfact-embed"||e.hasAttribute("data-mf-embed")}function _t(e,t,n){return e.getAttribute("aria-hidden")==="true"||e.hasAttribute("hidden")||e.hasAttribute("inert")?!0:!Oe(e,t,n)}function Ht(e){if(e.shadowRoot)return e.shadowRoot.childNodes;if(e.tagName==="SLOT"){let t=e.assignedNodes({flatten:!0});if(t.length)return t}return e.childNodes}function Q(e,t,n,r){let a=Ht(e);for(let o=0;o<a.length;o++){let l=a[o];l&&qt(l,t,n,r)}}function $t(e,t,n){let r=(e.nodeValue??"").replace(/\s+/g," ").trim();r&&(Me.has(t.role)||L(n)&&(n.lines++,t.children.push(r)))}function J(e){let t=e.matches(":disabled")||V(e);return{role:"option",name:(e.label||e.textContent||"").trim(),props:(t?" [disabled]":"")+(e.selected?" [selected]":""),children:[]}}function Vt(e,t,n){let r=e.options,a=Math.min(r.length,Ge);for(let m=0;m<a;m++){if(!L(n))return;let p=r[m];!p||P(p)||(n.lines++,t.children.push(J(p)))}let o=0,l=e.selectedOptions;for(let m=0;m<l.length;m++){let p=l[m];if(p&&p.index>=a&&!P(p)){if(!L(n))return;n.lines++,t.children.push(J(p)),o++}}let u=r.length-a-o;u>0&&L(n)&&(n.lines++,t.children.push(`\u2026 (+${u} more options)`))}function jt(e,t,n){let r=e.list;if(!r)return;let a=r.options,o=Math.min(a.length,Ge);for(let u=0;u<o;u++){if(!L(n))return;let m=a[u];!m||P(m)||(n.lines++,t.children.push(J(m)))}let l=a.length-o;l>0&&L(n)&&(n.lines++,t.children.push(`\u2026 (+${l} more options)`))}function Gt(e,t,n,r){if(!L(r)||Pt.has(e.tagName)||Dt(e)||P(e))return;r.nodes++;let a=r.styleOf(e);if(_t(e,a,r.layout))return;let o=Pe(e),l=o===null||$e.has(o),u=Ce(e,o,a,n);if(l&&!u){Q(e,t,a,r);return}let m=o===null||$e.has(o)?"generic":o,p=De(e,r.styleOf),x="";if(u&&Re(a)){let I=He(e,m,p);x=` [ref=${I}]`,r.onRef?.(I,e)}let M=ke(e,m),O={role:m,name:p,props:(M?` ${M}`:"")+x,children:[]};if(r.lines++,t.children.push(O),e.tagName==="SELECT"){Vt(e,O,r);return}e.tagName==="INPUT"&&e.list&&jt(e,O,r),!Ie(e)&&Q(e,O,a,r)}function qt(e,t,n,r){e.nodeType===3?$t(e,t,r):e.nodeType===1&&Gt(e,t,n,r)}function Ve(e,t){let n=e.replace(/\s+/g," ").trim(),r=re(n);return r.length>t?`${r.slice(0,t-1)}\u2026`:r}function je(e){return`"${e.replace(/\\/g,"\\\\").replace(/"/g,'\\"')}"`}function qe(e,t,n){let r="  ".repeat(t);for(let a of e){if(typeof a=="string"){n.push(`${r}- text: ${je(Ve(a,kt))}`);continue}let o=a.name?` ${je(Ve(a.name,It))}`:"",l=`${r}- ${a.role}${o}${a.props}`;a.children.length?(n.push(`${l}:`),qe(a.children,t+1,n)):n.push(l)}}function We(e,t){let n=Ne(),r={styleOf:n,layout:Le(),nodes:0,lines:0,truncated:!1,onRef:t};if(Te(e,{getComputedStyle:n}))return{yaml:"",truncated:!1};let a={role:"",name:"",props:"",children:[]};Q(e,a,n(e),r);let o=[];return qe(a.children,0,o),r.truncated&&o.length&&(o[o.length-1]='- text: "\u2026 (snapshot truncated \u2014 more of the page is below)"'),{yaml:o.join(`
 `),truncated:r.truncated}}function Tn(){let e=document.body;if(!e)return{yaml:"",truncated:!1,visibleRefs:[]};_e();let t=[],n=window.innerHeight||0,r=window.innerWidth||0;return{...We(e,(o,l)=>{let u=l.getBoundingClientRect();u.bottom>0&&u.top<n&&u.right>0&&u.left<r&&t.push(o)}),visibleRefs:t}}function wn(e){return e.isConnected?We(e):{yaml:"",truncated:!1}}export{Rt as resolveRef,Tn as snapshot,wn as snapshotRegion};
-//# sourceMappingURL=chunk-6VW4CCNF.js.map
+//# sourceMappingURL=chunk-33LPVL2R.js.map

package/dist/{chunk-VMYCQB4O.js → chunk-CHPADW72.js}

@@ -35,6 +35,10 @@ function isPrivate(el) {
   }
   return false;
 }
+function artifactIdFromPath(pathname) {
+  const m = pathname.match(/^\/(?:embed\/)?artifacts\/(.+?)\/?$/);
+  return m ? decodeURIComponent(m[1]) : null;
+}
 function embeddedMatterfactEntities() {
   if (!widgetOrigin) return [];
   const out = [];
@@ -46,10 +50,9 @@ function embeddedMatterfactEntities() {
       continue;
     }
     if (u.origin !== widgetOrigin) continue;
-    const m = u.pathname.match(/^\/artifacts\/(.+?)\/?$/);
-    if (!m) continue;
-    const id = decodeURIComponent(m[1]);
-    if (!id || out.some((e) => e.id === id)) continue;
+    const id = artifactIdFromPath(u.pathname);
+    if (!id) continue;
+    if (out.some((e) => e.id === id)) continue;
     out.push({
       kind: "artifact",
       id,
@@ -93,6 +96,36 @@ function readPageContext() {
 function publishContext() {
   send?.({ type: "host.context", context: readPageContext() });
 }
+function grantsFromIframeSrcs(srcs, origin) {
+  const out = [];
+  for (const raw of srcs) {
+    let u;
+    try {
+      u = new URL(raw || "", location.href);
+    } catch {
+      continue;
+    }
+    if (u.origin !== origin) continue;
+    const id = artifactIdFromPath(u.pathname);
+    if (!id) continue;
+    const owner = u.searchParams.get("owner") || "";
+    const token = u.searchParams.get("t") || "";
+    if (!owner || !token) continue;
+    if (out.some((g) => g.id === id)) continue;
+    out.push({ id, owner, token });
+  }
+  return out;
+}
+function readArtifactGrants() {
+  if (!widgetOrigin) return [];
+  const srcs = Array.from(document.querySelectorAll("iframe")).map(
+    (f) => f.getAttribute("src") || ""
+  );
+  return grantsFromIframeSrcs(srcs, widgetOrigin);
+}
+function publishArtifactGrants() {
+  send?.({ type: "host.artifactGrants", grants: readArtifactGrants() });
+}
 function pushActivity(e) {
   activity.push({ ...e, seq: ++activitySeq, ts: Date.now() });
   if (activity.length > MAX_ACTIVITY) activity.shift();
@@ -156,6 +189,7 @@ function watchNavigation() {
     lastUrl = url;
     pushActivity({ type: "nav", summary: `navigated to ${url}` });
     publishContext();
+    publishArtifactGrants();
   };
   for (const name of ["pushState", "replaceState"]) {
     const orig = history[name];
@@ -180,7 +214,7 @@ async function readFocus() {
   }
   const active = document.activeElement;
   if (active && active !== document.body && !isPrivate(active) && !active.closest("[data-mf-private]")) {
-    const { snapshot } = await import('./snapshot-KN2KJ2PM.js');
+    const { snapshot } = await import('./snapshot-QBV7DTJP.js');
     focus.focused = {
       label: redact(describeControl(active)),
       role: active.getAttribute("role") || active.tagName.toLowerCase()
@@ -205,7 +239,7 @@ function scheduleFocus() {
 }
 var snapshotSeq = 0;
 async function sendSnapshot(emit) {
-  const { snapshot } = await import('./snapshot-KN2KJ2PM.js');
+  const { snapshot } = await import('./snapshot-QBV7DTJP.js');
   const { yaml, truncated, visibleRefs } = snapshot();
   emit({
     type: "host.snapshot",
@@ -215,7 +249,7 @@ async function sendSnapshot(emit) {
   emit({ type: "host.focus", focus: lastFocus });
 }
 async function sendRegion(ref, emit) {
-  const { snapshotRegion, resolveRef } = await import('./snapshot-KN2KJ2PM.js');
+  const { snapshotRegion, resolveRef } = await import('./snapshot-QBV7DTJP.js');
   const el = resolveRef(ref);
   if (!el) {
     emit({
@@ -259,6 +293,7 @@ function start(emit, origin) {
   widgetOrigin = origin || "";
   lastUrl = location.pathname;
   publishContext();
+  publishArtifactGrants();
   watchNavigation();
   document.addEventListener("click", onClick, { capture: true, passive: true });
   document.addEventListener("submit", onSubmit, {
@@ -284,6 +319,6 @@ function start(emit, origin) {
   emit({ type: "host.theme", mode: theme });
 }
 
-export { beginAuth, callTool, isPrivate, readPageContext, redact, sendRegion, sendSnapshot, start };
-//# sourceMappingURL=chunk-VMYCQB4O.js.map
-//# sourceMappingURL=chunk-VMYCQB4O.js.map
+export { artifactIdFromPath, beginAuth, callTool, grantsFromIframeSrcs, isPrivate, readPageContext, redact, sendRegion, sendSnapshot, start };
+//# sourceMappingURL=chunk-CHPADW72.js.map
+//# sourceMappingURL=chunk-CHPADW72.js.map

package/dist/chunk-CHPADW72.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/context.ts"],"names":[],"mappings":";AAWA,IAAI,YAAA,GAAe,EAAA;AAuBnB,IAAM,YAAA,GAAe,EAAA;AAErB,IAAI,IAAA,GAAoB,IAAA;AACxB,IAAI,WAAA,GAAc,CAAA;AAClB,IAAM,WAA4B,EAAC;AACnC,IAAI,OAAA,GAAU,EAAA;AAId,IAAM,GAAA,GAAM;AAAA,EACV,iCAAA;AAAA;AAAA,EACA,yBAAA;AAAA;AAAA,EACA,gCAAA;AAAA;AAAA,EACA,aAAA;AAAA;AAAA,EACA,4DAAA;AAAA;AAAA,EACA,oDAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AASO,SAAS,OAAO,IAAA,EAAsB;AAC3C,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,MAAM,GAAA,EAAK,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,IAAI,YAAY,CAAA;AACxD,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,UAAU,EAAA,EAAsB;AAC9C,EAAA,IAAI,EAAA,CAAG,OAAA,CAAQ,mBAAmB,CAAA,EAAG,OAAO,IAAA;AAC5C,EAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AACf,EAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,IAAA,MAAM,IAAK,EAAA,CAAwB,IAAA;AACnC,IAAA,IAAI,CAAA,KAAM,UAAA,IAAc,CAAA,KAAM,QAAA,EAAU,OAAO,IAAA;AAAA,EACjD;AACA,EAAA,OAAO,KAAA;AACT;AAgCO,SAAS,mBAAmB,QAAA,EAAiC;AAClE,EAAA,MAAM,CAAA,GAAI,QAAA,CAAS,KAAA,CAAM,qCAAqC,CAAA;AAC9D,EAAA,OAAO,CAAA,GAAI,kBAAA,CAAmB,CAAA,CAAE,CAAC,CAAC,CAAA,GAAI,IAAA;AACxC;AAEA,SAAS,0BAAA,GAA2C;AAClD,EAAA,IAAI,CAAC,YAAA,EAAc,OAAO,EAAC;AAC3B,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,SAAS,KAAA,CAAM,IAAA,CAAK,SAAS,gBAAA,CAAiB,QAAQ,CAAC,CAAA,EAAG;AACnE,IAAA,IAAI,CAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAA,GAAI,IAAI,IAAI,KAAA,CAAM,YAAA,CAAa,KAAK,CAAA,IAAK,EAAA,EAAI,SAAS,IAAI,CAAA;AAAA,IAC5D,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,IAAI,CAAA,CAAE,WAAW,YAAA,EAAc;AAC/B,IAAA,MAAM,EAAA,GAAK,kBAAA,CAAmB,CAAA,CAAE,QAAQ,CAAA;AACxC,IAAA,IAAI,CAAC,EAAA,EAAI;AACT,IAAA,IAAI,IAAI,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,EAAA,KAAO,EAAE,CAAA,EAAG;AAIlC,IAAA,GAAA,CAAI,IAAA,CAAK;AAAA,MACP,IAAA,EAAM,UAAA;AAAA,MACN,EAAA;AAAA,MACA,OAAO,MAAA,CAAO,KAAA,CAAM,aAAa,OAAO,CAAA,IAAK,EAAE,CAAA,IAAK;AAAA,KACrD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,GAAA;AACT;AAQA,SAAS,gBAAA,GAA2B;AAClC,EAAA,OAAO,KAAA,CAAM,KAAK,QAAA,CAAS,gBAAA,CAAiB,QAAQ,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,CAAA,CAAE,aAAa,KAAK,CAAA,IAAK,EAAA,EAAI,QAAA,CAAS,IAAI,CAAA;AAC5D,MAAA,OAAO,CAAA,CAAE,MAAA,KAAW,QAAA,CAAS,MAAA,IAAU,EAAE,MAAA,KAAW,YAAA;AAAA,IACtD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF,CAAC,CAAA,CAAE,MAAA;AACL;AAEO,SAAS,eAAA,GAA+B;AAC7C,EAAA,MAAM,QAAA,GACH,MAAA,CAAsD,UAAA,EACnD,OAAA,IAAW,EAAC;AAElB,EAAA,MAAM,QAAQ,0BAAA,EAA2B;AACzC,EAAA,MAAM,SAAS,gBAAA,EAAiB;AAEhC,EAAA,OAAO;AAAA;AAAA;AAAA,IAGL,GAAA,EAAK,QAAA,CAAS,MAAA,GAAS,QAAA,CAAS,QAAA;AAAA,IAChC,MAAM,QAAA,CAAS,QAAA;AAAA,IACf,KAAA,EAAO,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA;AAAA,IAC5B,MAAA,EAAQ,QAAA,CAAS,eAAA,CAAgB,IAAA,IAAQ,MAAA;AAAA,IACzC,GAAG,QAAA;AAAA;AAAA;AAAA;AAAA,IAIH,QAAA,EAAU,CAAC,GAAI,QAAA,CAAS,YAAY,EAAC,EAAI,GAAG,KAAK,CAAA;AAAA,IACjD,IAAA,EAAM;AAAA,MACJ,GAAI,QAAA,CAAS,IAAA,IAAQ,EAAC;AAAA,MACtB,GAAI,MAAA,GAAS,EAAE,aAAA,EAAe,MAAA,KAAW;AAAC;AAC5C,GACF;AACF;AAEA,SAAS,cAAA,GAAiB;AACxB,EAAA,IAAA,GAAO,EAAE,IAAA,EAAM,cAAA,EAAgB,OAAA,EAAS,eAAA,IAAmB,CAAA;AAC7D;AAaO,SAAS,oBAAA,CACd,MACA,MAAA,EACoB;AACpB,EAAA,MAAM,MAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,IAAI,CAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAA,GAAI,IAAI,GAAA,CAAI,GAAA,IAAO,EAAA,EAAI,SAAS,IAAI,CAAA;AAAA,IACtC,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAQ;AACzB,IAAA,MAAM,EAAA,GAAK,kBAAA,CAAmB,CAAA,CAAE,QAAQ,CAAA;AACxC,IAAA,IAAI,CAAC,EAAA,EAAI;AACT,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA,IAAK,EAAA;AAC7C,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA,IAAK,EAAA;AACzC,IAAA,IAAI,CAAC,KAAA,IAAS,CAAC,KAAA,EAAO;AACtB,IAAA,IAAI,IAAI,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,EAAA,KAAO,EAAE,CAAA,EAAG;AAClC,IAAA,GAAA,CAAI,IAAA,CAAK,EAAE,EAAA,EAAI,KAAA,EAAO,OAAO,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,kBAAA,GAAyC;AAChD,EAAA,IAAI,CAAC,YAAA,EAAc,OAAO,EAAC;AAC3B,EAAA,MAAM,OAAO,KAAA,CAAM,IAAA,CAAK,SAAS,gBAAA,CAAiB,QAAQ,CAAC,CAAA,CAAE,GAAA;AAAA,IAC3D,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,CAAa,KAAK,CAAA,IAAK;AAAA,GAClC;AACA,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAY,CAAA;AAChD;AAEA,SAAS,qBAAA,GAAwB;AAC/B,EAAA,IAAA,GAAO,EAAE,IAAA,EAAM,qBAAA,EAAuB,MAAA,EAAQ,kBAAA,IAAsB,CAAA;AACtE;AAIA,SAAS,aAAa,CAAA,EAAsC;AAC1D,EAAA,QAAA,CAAS,IAAA,CAAK,EAAE,GAAG,CAAA,EAAG,GAAA,EAAK,EAAE,WAAA,EAAa,EAAA,EAAI,IAAA,CAAK,GAAA,EAAI,EAAG,CAAA;AAC1D,EAAA,IAAI,QAAA,CAAS,MAAA,GAAS,YAAA,EAAc,QAAA,CAAS,KAAA,EAAM;AACnD,EAAA,IAAA,GAAO,EAAE,IAAA,EAAM,eAAA,EAAiB,MAAA,EAAQ,CAAC,QAAA,CAAS,QAAA,CAAS,MAAA,GAAS,CAAC,CAAC,CAAA,EAAG,CAAA;AAC3E;AAkBA,SAAS,aAAa,EAAA,EAAqB;AACzC,EAAA,MAAM,IAAA,GAAO,EAAA,CAAG,YAAA,CAAa,YAAY,CAAA;AACzC,EAAA,IAAI,MAAM,OAAO,IAAA;AAEjB,EAAA,MAAM,KAAK,EAAA,CAAG,EAAA;AACd,EAAA,IAAI,EAAA,EAAI;AACN,IAAA,MAAM,QAAA,GAAW,SAAS,aAAA,CAAc,CAAA,WAAA,EAAc,IAAI,MAAA,CAAO,EAAE,CAAC,CAAA,EAAA,CAAI,CAAA;AACxE,IAAA,MAAM,CAAA,GAAI,QAAA,EAAU,WAAA,EAAa,IAAA,EAAK;AACtC,IAAA,IAAI,GAAG,OAAO,CAAA;AAAA,EAChB;AACA,EAAA,MAAM,WAAW,EAAA,CAAG,OAAA,CAAQ,OAAO,CAAA,EAAG,aAAa,IAAA,EAAK;AACxD,EAAA,IAAI,UAAU,OAAO,QAAA;AAErB,EAAA,MAAM,WAAA,GAAc,EAAA,CAAG,YAAA,CAAa,aAAa,CAAA;AACjD,EAAA,IAAI,aAAa,OAAO,WAAA;AAExB,EAAA,OAAO,EAAA;AACT;AAEA,IAAM,gCAAgB,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,QAAA,EAAU,UAAU,CAAC,CAAA;AAE7D,SAAS,SAAS,EAAA,EAAqB;AACrC,EAAA,MAAM,OAAO,EAAA,CAAG,YAAA,CAAa,MAAM,CAAA,IAAK,EAAA,CAAG,QAAQ,WAAA,EAAY;AAC/D,EAAA,MAAM,KAAA,GACJ,EAAA,CAAG,YAAA,CAAa,YAAY,CAAA,KAC3B,cAAc,GAAA,CAAI,EAAA,CAAG,OAAO,CAAA,GACzB,YAAA,CAAa,EAAE,IACd,EAAA,CAAmB,SAAA,EAAW,IAAA,EAAK,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAA,IACrD,EAAA,CAAG,YAAA,CAAa,OAAO,CAAA,IACvB,EAAA;AACF,EAAA,OAAO,QAAQ,CAAA,EAAG,IAAI,KAAK,MAAA,CAAO,KAAK,CAAC,CAAA,CAAA,CAAA,GAAM,IAAA;AAChD;AAQA,IAAM,UAAA,GACJ,iMAAA;AAIF,SAAS,QAAQ,EAAA,EAAW;AAC1B,EAAA,MAAM,SAAS,EAAA,CAAG,MAAA;AAClB,EAAA,IAAI,CAAC,MAAA,IAAU,EAAE,MAAA,YAAkB,OAAA,CAAA,EAAU;AAI7C,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA;AACpC,EAAA,MAAM,WAAW,KAAA,GACZ,KAAA,CAAM,YAAA,CAAa,KAAK,KACvB,QAAA,CAAS,cAAA,CAAe,KAAA,CAAM,YAAA,CAAa,KAAK,CAAE,CAAA,IACpD,KAAA,CAAM,aAAA,CAAc,uBAAuB,CAAA,GAC3C,IAAA;AAEJ,EAAA,MAAM,UAAA,GAAa,QAAA,IAAY,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA;AAGxD,EAAA,IAAI,CAAC,UAAA,IAAc,SAAA,CAAU,UAAU,CAAA,EAAG;AAE1C,EAAA,YAAA,CAAa,EAAE,MAAM,OAAA,EAAS,OAAA,EAAS,WAAW,QAAA,CAAS,UAAU,CAAC,CAAA,CAAA,EAAI,CAAA;AAC5E;AAEA,SAAS,SAAS,EAAA,EAAW;AAC3B,EAAA,MAAM,KAAK,EAAA,CAAG,MAAA;AACd,EAAA,IAAI,CAAC,EAAA,IAAM,SAAA,CAAU,EAAE,CAAA,EAAG;AAE1B,EAAA,YAAA,CAAa,EAAE,MAAM,QAAA,EAAU,OAAA,EAAS,aAAa,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA,EAAI,CAAA;AACvE;AAeA,SAAS,SAAS,EAAA,EAAW;AAC3B,EAAA,MAAM,KAAK,EAAA,CAAG,MAAA;AACd,EAAA,IAAI,CAAC,EAAA,IAAM,EAAE,cAAc,OAAA,CAAA,IAAY,SAAA,CAAU,EAAE,CAAA,EAAG;AAEtD,EAAA,MAAM,MAAM,EAAA,CAAG,OAAA;AACf,EAAA,MAAM,OAAQ,EAAA,CAAwB,IAAA;AAGtC,EAAA,IAAI,GAAA,KAAQ,OAAA,KAAY,IAAA,KAAS,UAAA,IAAc,SAAS,QAAA,CAAA,EAAW;AAEnE,EAAA,IAAI,OAAA,GAAU,CAAA,QAAA,EAAW,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAErC,EAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,IAAA,MAAM,GAAA,GAAO,EAAA,CAAyB,eAAA,CAAgB,CAAC,CAAA,EAAG,IAAA;AAC1D,IAAA,IAAI,GAAA,YAAe,CAAA,EAAG,QAAA,CAAS,EAAE,CAAC,CAAA,SAAA,EAAO,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,EACtD,CAAA,MAAA,IAAW,IAAA,KAAS,UAAA,IAAc,IAAA,KAAS,OAAA,EAAS;AAClD,IAAA,OAAA,GAAU,CAAA,EAAI,GAAwB,OAAA,GAAU,SAAA,GAAY,WAAW,CAAA,CAAA,EAAI,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA;AAAA,EACzF;AAEA,EAAA,YAAA,CAAa,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,CAAA;AACzC;AAMA,SAAS,eAAA,GAAkB;AACzB,EAAA,MAAM,OAAO,MAAM;AACjB,IAAA,MAAM,MAAM,QAAA,CAAS,QAAA;AACrB,IAAA,IAAI,QAAQ,OAAA,EAAS;AACrB,IAAA,OAAA,GAAU,GAAA;AACV,IAAA,YAAA,CAAa,EAAE,IAAA,EAAM,KAAA,EAAO,SAAS,CAAA,aAAA,EAAgB,GAAG,IAAI,CAAA;AAC5D,IAAA,cAAA,EAAe;AACf,IAAA,qBAAA,EAAsB;AAAA,EACxB,CAAA;AAEA,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAC,WAAA,EAAa,cAAc,CAAA,EAAY;AACzD,IAAA,MAAM,IAAA,GAAO,QAAQ,IAAI,CAAA;AACzB,IAAA,OAAA,CAAQ,IAAI,CAAA,GAAI,SAAA,GAEX,IAAA,EACH;AACA,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,IAAI,CAAA;AAC/B,MAAA,IAAA,EAAK;AACL,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAAA,EACF;AACA,EAAA,MAAA,CAAO,gBAAA,CAAiB,YAAY,IAAI,CAAA;AAC1C;AAgBA,IAAI,YAA0B,EAAC;AAE/B,eAAe,SAAA,GAAmC;AAChD,EAAA,MAAM,QAAsB,EAAC;AAG7B,EAAA,MAAM,GAAA,GAAM,OAAO,YAAA,IAAe;AAClC,EAAA,IAAI,GAAA,IAAO,CAAC,GAAA,CAAI,WAAA,EAAa;AAC3B,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,UAAA,EAAY,aAAA,IAAiB,IAAA;AAGhD,IAAA,IAAI,CAAC,MAAA,IAAU,CAAC,MAAA,CAAO,OAAA,CAAQ,mBAAmB,CAAA,EAAG;AACnD,MAAA,MAAM,IAAA,GAAO,IAAI,QAAA,EAAS,CAAE,MAAK,CAAE,KAAA,CAAM,GAAG,GAAG,CAAA;AAC/C,MAAA,IAAI,IAAA,EAAM,KAAA,CAAM,SAAA,GAAY,MAAA,CAAO,IAAI,CAAA;AAAA,IACzC;AAAA,EACF;AAGA,EAAA,MAAM,SAAS,QAAA,CAAS,aAAA;AACxB,EAAA,IACE,MAAA,IACA,MAAA,KAAW,QAAA,CAAS,IAAA,IACpB,CAAC,SAAA,CAAU,MAAM,CAAA,IACjB,CAAC,MAAA,CAAO,OAAA,CAAQ,mBAAmB,CAAA,EACnC;AACA,IAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,OAAO,wBAAgB,CAAA;AAElD,IAAA,KAAA,CAAM,OAAA,GAAU;AAAA,MACd,KAAA,EAAO,MAAA,CAAO,eAAA,CAAgB,MAAM,CAAC,CAAA;AAAA,MACrC,MAAM,MAAA,CAAO,YAAA,CAAa,MAAM,CAAA,IAAK,MAAA,CAAO,QAAQ,WAAA;AAAY,KAClE;AAAA,EACF;AAEA,EAAA,MAAM,MAAM,QAAA,CAAS,eAAA;AACrB,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,YAAA,GAAe,GAAA,CAAI,YAAA;AAC1C,EAAA,KAAA,CAAM,MAAA,GACJ,UAAA,GAAa,CAAA,GAAI,IAAA,CAAK,KAAA,CAAO,IAAI,SAAA,GAAY,UAAA,GAAc,GAAG,CAAA,GAAI,GAAA,GAAM,CAAA;AAE1E,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,gBAAgB,EAAA,EAAqB;AAC5C,EAAA,OAAO,SAAS,EAAE,CAAA;AACpB;AAEA,IAAI,UAAA,GAAmD,IAAA;AAGvD,SAAS,aAAA,GAAgB;AACvB,EAAA,IAAI,UAAA,EAAY;AAChB,EAAA,UAAA,GAAa,WAAW,YAAY;AAClC,IAAA,UAAA,GAAa,IAAA;AACb,IAAA,SAAA,GAAY,MAAM,SAAA,EAAU;AAC5B,IAAA,IAAA,GAAO,EAAE,IAAA,EAAM,YAAA,EAAc,KAAA,EAAO,WAAW,CAAA;AAAA,EACjD,GAAG,GAAG,CAAA;AACR;AAIA,IAAI,WAAA,GAAc,CAAA;AAElB,eAAsB,aAAa,IAAA,EAAY;AAG7C,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,MAAM,OAAO,wBAAgB,CAAA;AAClD,EAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAW,WAAA,KAAgB,QAAA,EAAS;AAClD,EAAA,IAAA,CAAK;AAAA,IACH,IAAA,EAAM,eAAA;AAAA,IACN,QAAA,EAAU,EAAE,IAAA,EAAM,MAAA,CAAO,IAAI,CAAA,EAAG,GAAA,EAAK,EAAE,WAAA,EAAa,SAAA;AAAU,GAC/D,CAAA;AAGD,EAAA,SAAA,GAAY,EAAE,GAAG,SAAA,EAAW,WAAA,EAAY;AACxC,EAAA,IAAA,CAAK,EAAE,IAAA,EAAM,YAAA,EAAc,KAAA,EAAO,WAAW,CAAA;AAC/C;AAMA,eAAsB,UAAA,CAAW,KAAa,IAAA,EAAY;AACxD,EAAA,MAAM,EAAE,cAAA,EAAgB,UAAA,EAAW,GAAI,MAAM,OAAO,wBAAgB,CAAA;AACpE,EAAA,MAAM,EAAA,GAAK,WAAW,GAAG,CAAA;AACzB,EAAA,IAAI,CAAC,EAAA,EAAI;AACP,IAAA,IAAA,CAAK;AAAA,MACH,IAAA,EAAM,aAAA;AAAA,MACN,GAAA;AAAA,MACA,IAAA,EAAM;AAAA,KACP,CAAA;AACD,IAAA;AAAA,EACF;AACA,EAAA,MAAM,EAAE,IAAA,EAAK,GAAI,cAAA,CAAe,EAAE,CAAA;AAClC,EAAA,IAAA,CAAK,EAAE,MAAM,aAAA,EAAe,GAAA,EAAK,MAAM,MAAA,CAAO,IAAI,GAAG,CAAA;AACvD;AAiBA,eAAsB,QAAA,CAAS,MAAgB,IAAA,EAAY;AACzD,EAAA,IAAA,CAAK;AAAA,IACH,IAAA,EAAM,iBAAA;AAAA,IACN,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA,EAAO;AAAA,GACR,CAAA;AACH;AAaO,SAAS,SAAA,CACd,QACA,IAAA,EACA;AACA,EAAA,MAAM,IAAI,MAAA,CAAO,IAAA;AAAA,IACf,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,mBAAA,EAAsB,kBAAA;AAAA,MACpC,MAAA,CAAO;AAAA,KACR,CAAA,GAAA,EAAM,kBAAA,CAAmB,QAAA,CAAS,MAAM,CAAC,CAAA,CAAA;AAAA,IAC1C,SAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,CAAC,CAAA,EAAG;AAER,EAAA,MAAM,KAAA,GAAQ,CAAC,KAAA,KAAwB;AACrC,IAAA,IAAI,KAAA,CAAM,MAAA,KAAW,MAAA,CAAO,MAAA,EAAQ;AACpC,IAAA,MAAM,IAAI,KAAA,CAAM,IAAA;AAChB,IAAA,IAAI,CAAA,EAAG,SAAS,eAAA,EAAiB;AACjC,IAAA,MAAA,CAAO,mBAAA,CAAoB,WAAW,KAAK,CAAA;AAC3C,IAAA,IAAA,CAAK,EAAE,MAAM,WAAA,EAAa,KAAA,EAAO,EAAE,KAAA,EAAO,SAAA,EAAW,CAAA,CAAE,SAAA,EAAW,CAAA;AAAA,EACpE,CAAA;AACA,EAAA,MAAA,CAAO,gBAAA,CAAiB,WAAW,KAAK,CAAA;AAC1C;AAIO,SAAS,KAAA,CAAM,MAAY,MAAA,EAAiB;AACjD,EAAA,IAAA,GAAO,IAAA;AACP,EAAA,YAAA,GAAe,MAAA,IAAU,EAAA;AACzB,EAAA,OAAA,GAAU,QAAA,CAAS,QAAA;AAEnB,EAAA,cAAA,EAAe;AACf,EAAA,qBAAA,EAAsB;AACtB,EAAA,eAAA,EAAgB;AAGhB,EAAA,QAAA,CAAS,gBAAA,CAAiB,SAAS,OAAA,EAAS,EAAE,SAAS,IAAA,EAAM,OAAA,EAAS,MAAM,CAAA;AAC5E,EAAA,QAAA,CAAS,gBAAA,CAAiB,UAAU,QAAA,EAAU;AAAA,IAC5C,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACV,CAAA;AAID,EAAA,QAAA,CAAS,gBAAA,CAAiB,UAAU,QAAA,EAAU;AAAA,IAC5C,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACV,CAAA;AAID,EAAA,QAAA,CAAS,gBAAA,CAAiB,mBAAmB,aAAA,EAAe;AAAA,IAC1D,OAAA,EAAS;AAAA,GACV,CAAA;AACD,EAAA,QAAA,CAAS,gBAAA,CAAiB,WAAW,aAAA,EAAe;AAAA,IAClD,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACV,CAAA;AACD,EAAA,MAAA,CAAO,gBAAA,CAAiB,UAAU,aAAA,EAAe;AAAA,IAC/C,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,GACV,CAAA;AAED,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,8BAA8B,CAAA,CAAE,UACrD,MAAA,GACA,OAAA;AACJ,EAAA,IAAA,CAAK,EAAE,IAAA,EAAM,YAAA,EAAc,IAAA,EAAM,OAAO,CAAA;AAC1C","file":"chunk-CHPADW72.js","sourcesContent":["import type {\n  ActivityEvent,\n  FocusContext,\n  HostToWidget,\n  PageContext,\n  PageEntity,\n  ToolCall,\n} from './protocol';\n\n/** The origin serving our chat — how we tell OUR embedded content from the host's own\n *  iframes. Set by start(); empty until then, which just means we spot nothing. */\nlet widgetOrigin = '';\n\n/**\n * The eye.\n *\n * Everything in this module can see the customer's page. It is a SEPARATE CHUNK,\n * loaded only when someone actually opens the chat — so a page whose visitors never\n * click the widget pays nothing for any of it, and a security reviewer can read\n * exactly one file to know what we look at.\n *\n * The rules, which are not negotiable:\n *\n *   NEVER captured — no config enables it: the value of any <input>, <textarea> or\n *   contenteditable; anything inside a password field; cookies; localStorage;\n *   sessionStorage; the raw DOM; screenshots; network traffic; anything inside an\n *   element marked `data-mf-private`.\n *\n *   The agent never gets a selector and never touches the DOM. It gets refs. A ref\n *   is resolved to an element HERE, in the page, by us.\n */\n\ntype Send = (msg: HostToWidget) => void;\n\nconst MAX_ACTIVITY = 40;\n\nlet send: Send | null = null;\nlet activitySeq = 0;\nconst activity: ActivityEvent[] = [];\nlet lastUrl = '';\n\n/* ─────────────────────────── redaction ────────────────────────────────── */\n\nconst PII = [\n  /\\b[\\w.+-]+@[\\w-]+\\.[\\w.]{2,}\\b/g, // email\n  /\\b(?:\\d[ -]?){13,19}\\b/g, // card-ish\n  /\\b\\d{3}[- ]?\\d{2}[- ]?\\d{4}\\b/g, // ssn — dashed, spaced, OR bare 9 digits\n  /\\b\\d{9,}\\b/g, // long bare digit runs: account / MRN / routing numbers\n  /(?:\\+?\\d{1,2}[\\s.-]?)?\\(?\\d{3}\\)?[\\s.-]\\d{3}[\\s.-]\\d{4}\\b/g, // us phone\n  /\\b(?:sk|pk|rk|ak)_(?:live|test)_[A-Za-z0-9]{8,}\\b/g, // stripe-style api keys\n  /\\beyJ[\\w-]+\\.[\\w-]+\\.[\\w-]+\\b/g, // jwt\n];\n\n/**\n * Scrub before anything leaves the page — not after it arrives.\n *\n * A compromised widget, or a bug in ours, must not be able to retroactively obtain\n * a customer's users' email addresses. The only way to guarantee that is to never\n * put them on the wire.\n */\nexport function redact(text: string): string {\n  let out = text;\n  for (const re of PII) out = out.replace(re, '[redacted]');\n  return out;\n}\n\n/** Anything the host has marked private, or that is inherently sensitive, is out. */\nexport function isPrivate(el: Element): boolean {\n  if (el.closest('[data-mf-private]')) return true;\n  const tag = el.tagName;\n  if (tag === 'INPUT') {\n    const t = (el as HTMLInputElement).type;\n    if (t === 'password' || t === 'hidden') return true;\n  }\n  return false;\n}\n\n/* ───────────────────────── page context ───────────────────────────────── */\n\n/**\n * What the page says about itself.\n *\n * A host that declares nothing still gets URL + title, which is what every other\n * embeddable assistant on the market offers in total. The interesting fields\n * (`route`, `description`, `entities`) are host-declared, because only the host\n * knows that `/o/8813` is \"the Acme Corp order, 3 items, unpaid\".\n *\n * Declared via a global the host sets before we load:\n *   window.matterfact = { context: { route: '/orders/:id', description: '...', entities: [...] } }\n */\n/**\n * matterfact content embedded IN the host page — today, artifact iframes.\n *\n * A cross-origin iframe is opaque: `contentDocument` throws, so the DOM snapshot walks\n * straight past an embedded artifact and the agent is blind to the very thing the page\n * is built around. It reads the page as empty and asks which URL you mean.\n *\n * We don't need to see inside, and shouldn't want to. The artifact's ID is right there\n * in the src, and the agent can already resolve `artifacts/<id>/` in its session — the\n * same path an `@`-mention uses. So we report the ID and let the backend fetch the real\n * thing, which beats scraping a rendering of it: it gets the data, not the picture.\n *\n * Matched by ORIGIN, not by path shape: a customer is perfectly entitled to their own\n * /artifacts/ route, and it isn't ours.\n */\n/** The artifact slug from a matterfact artifact path, or null. Matches both the\n *  chrome-free embed route (/embed/artifacts/<slug>) and the bare /artifacts/<slug>. */\nexport function artifactIdFromPath(pathname: string): string | null {\n  const m = pathname.match(/^\\/(?:embed\\/)?artifacts\\/(.+?)\\/?$/);\n  return m ? decodeURIComponent(m[1]) : null;\n}\n\nfunction embeddedMatterfactEntities(): PageEntity[] {\n  if (!widgetOrigin) return [];\n  const out: PageEntity[] = [];\n  for (const frame of Array.from(document.querySelectorAll('iframe'))) {\n    let u: URL;\n    try {\n      u = new URL(frame.getAttribute('src') || '', location.href);\n    } catch {\n      continue;\n    }\n    if (u.origin !== widgetOrigin) continue;\n    const id = artifactIdFromPath(u.pathname);\n    if (!id) continue;\n    if (out.some((e) => e.id === id)) continue; // same artifact twice = once\n    // No url field: the agent reaches an artifact by ID (`artifacts/<id>/`), never by\n    // fetching the page, and an artifact URL can carry a share token we've no business\n    // forwarding. The id is the whole useful payload.\n    out.push({\n      kind: 'artifact',\n      id,\n      label: redact(frame.getAttribute('title') || '') || id,\n    });\n  }\n  return out;\n}\n\n/**\n * Frames we can see the existence of but nothing inside — someone else's cross-origin\n * embed. Worth one line: \"there is a thing here I cannot read\" is a true and useful\n * statement, and much better than the agent confidently describing a page while missing\n * the widget the user is actually asking about.\n */\nfunction opaqueFrameCount(): number {\n  return Array.from(document.querySelectorAll('iframe')).filter((f) => {\n    try {\n      const u = new URL(f.getAttribute('src') || '', location.href);\n      return u.origin !== location.origin && u.origin !== widgetOrigin;\n    } catch {\n      return false;\n    }\n  }).length;\n}\n\nexport function readPageContext(): PageContext {\n  const declared =\n    (window as { matterfact?: { context?: PageContext } }).matterfact\n      ?.context ?? {};\n\n  const found = embeddedMatterfactEntities();\n  const opaque = opaqueFrameCount();\n\n  return {\n    // Path only. A query string is where session ids, tokens and email addresses\n    // live; it is not ours to take.\n    url: location.origin + location.pathname,\n    path: location.pathname,\n    title: redact(document.title),\n    locale: document.documentElement.lang || undefined,\n    ...declared,\n    // After the spread: what we FOUND is additive to what the host DECLARED, never a\n    // replacement. A host that declares its own entities still gets the artifacts we\n    // spotted, and vice versa.\n    entities: [...(declared.entities ?? []), ...found],\n    data: {\n      ...(declared.data ?? {}),\n      ...(opaque ? { opaque_frames: opaque } : {}),\n    },\n  };\n}\n\nfunction publishContext() {\n  send?.({ type: 'host.context', context: readPageContext() });\n}\n\n/* ─────────────────────── artifact grants (backend-only) ────────────────── */\n\nexport interface ArtifactGrantSrc {\n  id: string;\n  owner: string;\n  token: string;\n}\n\n/** Read-only capability grants from co-embedded artifact iframes, for the backend to\n *  materialize their data. Separate from entities on purpose: the token must never ride\n *  ambient (rendered) context, only this backend-only channel. */\nexport function grantsFromIframeSrcs(\n  srcs: string[],\n  origin: string,\n): ArtifactGrantSrc[] {\n  const out: ArtifactGrantSrc[] = [];\n  for (const raw of srcs) {\n    let u: URL;\n    try {\n      u = new URL(raw || '', location.href);\n    } catch {\n      continue;\n    }\n    if (u.origin !== origin) continue;\n    const id = artifactIdFromPath(u.pathname);\n    if (!id) continue;\n    const owner = u.searchParams.get('owner') || '';\n    const token = u.searchParams.get('t') || '';\n    if (!owner || !token) continue;\n    if (out.some((g) => g.id === id)) continue;\n    out.push({ id, owner, token });\n  }\n  return out;\n}\n\nfunction readArtifactGrants(): ArtifactGrantSrc[] {\n  if (!widgetOrigin) return [];\n  const srcs = Array.from(document.querySelectorAll('iframe')).map(\n    (f) => f.getAttribute('src') || '',\n  );\n  return grantsFromIframeSrcs(srcs, widgetOrigin);\n}\n\nfunction publishArtifactGrants() {\n  send?.({ type: 'host.artifactGrants', grants: readArtifactGrants() });\n}\n\n/* ────────────────────────── activity ──────────────────────────────────── */\n\nfunction pushActivity(e: Omit<ActivityEvent, 'seq' | 'ts'>) {\n  activity.push({ ...e, seq: ++activitySeq, ts: Date.now() });\n  if (activity.length > MAX_ACTIVITY) activity.shift();\n  send?.({ type: 'host.activity', events: [activity[activity.length - 1]] });\n}\n\n/**\n * A short, human-readable label for what got clicked.\n *\n * Shaped after PostHog's autocapture, not after a session-replay frame: rrweb would\n * give us `{source:2, type:2, id:417, x:210, y:88}` — no text, no role, no href,\n * meaningless to a model without the full DOM snapshot it deltas against. One line\n * of \"clicked button 'Export CSV'\" is worth more and costs less.\n */\n/**\n * The accessible NAME of a form control — never its value.\n *\n * A control has no `innerText`, so the generic path below misses it. We look where a\n * control's name actually lives: `aria-label`, then a `<label for>` or a wrapping\n * `<label>`, then `placeholder`. `placeholder` is a LABEL, not a value — it is the\n * hint shown when the field is empty (\"Order number or customer\"), so it is safe.\n */\nfunction controlLabel(el: Element): string {\n  const aria = el.getAttribute('aria-label');\n  if (aria) return aria;\n\n  const id = el.id;\n  if (id) {\n    const forLabel = document.querySelector(`label[for=\"${CSS.escape(id)}\"]`);\n    const t = forLabel?.textContent?.trim();\n    if (t) return t;\n  }\n  const wrapping = el.closest('label')?.textContent?.trim();\n  if (wrapping) return wrapping;\n\n  const placeholder = el.getAttribute('placeholder');\n  if (placeholder) return placeholder;\n\n  return '';\n}\n\nconst FORM_CONTROLS = new Set(['INPUT', 'SELECT', 'TEXTAREA']);\n\nfunction describe(el: Element): string {\n  const role = el.getAttribute('role') || el.tagName.toLowerCase();\n  const label =\n    el.getAttribute('aria-label') ||\n    (FORM_CONTROLS.has(el.tagName)\n      ? controlLabel(el)\n      : (el as HTMLElement).innerText?.trim().slice(0, 60)) ||\n    el.getAttribute('title') ||\n    '';\n  return label ? `${role} \"${redact(label)}\"` : role;\n}\n\n/**\n * Elements a click is worth recording. Deliberately tight: the point of the activity\n * stream is INTENT (\"the user chose to export\"), and a click on a heading, a label,\n * a card gutter, or blank page is not intent, it is noise. We only log a click that\n * lands on something actionable.\n */\nconst ACTIONABLE =\n  'a[href],button,input,select,textarea,summary,' +\n  '[role=\"button\"],[role=\"link\"],[role=\"menuitem\"],[role=\"tab\"],[role=\"option\"],' +\n  '[role=\"checkbox\"],[role=\"switch\"],[role=\"radio\"],[onclick],[tabindex]';\n\nfunction onClick(ev: Event) {\n  const target = ev.target as Element | null;\n  if (!target || !(target instanceof Element)) return;\n\n  // Clicking a <label> operates the control it labels — record THAT, not \"clicked\n  // label\", so the event reads as the user's actual intent.\n  const label = target.closest('label');\n  const labelled = label\n    ? (label.getAttribute('for') &&\n        document.getElementById(label.getAttribute('for')!)) ||\n      label.querySelector('input,select,textarea')\n    : null;\n\n  const actionable = labelled ?? target.closest(ACTIONABLE);\n  // No actionable target — a click on text, a gutter, or blank space. That is not an\n  // action; dropping it is the whole fix for the click-log noise.\n  if (!actionable || isPrivate(actionable)) return;\n\n  pushActivity({ type: 'click', summary: `clicked ${describe(actionable)}` });\n}\n\nfunction onSubmit(ev: Event) {\n  const el = ev.target as Element | null;\n  if (!el || isPrivate(el)) return;\n  // The FORM was submitted — never its values.\n  pushActivity({ type: 'submit', summary: `submitted ${describe(el)}` });\n}\n\n/**\n * A form field changed.\n *\n * The rule is the same as everywhere else and the temptation here is sharpest:\n * record THAT a field changed and WHICH field (its label), never WHAT it was\n * changed to. `change` fires on exactly the elements whose values are off-limits.\n *\n * One safe exception: a <select>, a checkbox, or a radio chose from a fixed, visible\n * set of options the agent can already see in the snapshot — \"Unpaid\", \"Shipped\".\n * That is a user *choice*, not typed data, so the chosen option's LABEL is fair to\n * include and is the useful part (\"filtered status to Shipped\"). Free-text and\n * numeric inputs get their label only.\n */\nfunction onChange(ev: Event) {\n  const el = ev.target as (HTMLElement & { type?: string }) | null;\n  if (!el || !(el instanceof Element) || isPrivate(el)) return;\n\n  const tag = el.tagName;\n  const type = (el as HTMLInputElement).type;\n\n  // Never a password/hidden field, and isPrivate already covered data-mf-private.\n  if (tag === 'INPUT' && (type === 'password' || type === 'hidden')) return;\n\n  let summary = `changed ${describe(el)}`;\n\n  if (tag === 'SELECT') {\n    const opt = (el as HTMLSelectElement).selectedOptions[0]?.text;\n    if (opt) summary = `${describe(el)} → \"${redact(opt)}\"`;\n  } else if (type === 'checkbox' || type === 'radio') {\n    summary = `${(el as HTMLInputElement).checked ? 'checked' : 'unchecked'} ${describe(el)}`;\n  }\n\n  pushActivity({ type: 'input', summary });\n}\n\n/**\n * SPA navigation. There is no event for `pushState`, so we wrap it — a 20-line job\n * that no library does better.\n */\nfunction watchNavigation() {\n  const fire = () => {\n    const url = location.pathname;\n    if (url === lastUrl) return;\n    lastUrl = url;\n    pushActivity({ type: 'nav', summary: `navigated to ${url}` });\n    publishContext();\n    publishArtifactGrants();\n  };\n\n  for (const name of ['pushState', 'replaceState'] as const) {\n    const orig = history[name];\n    history[name] = function (\n      this: History,\n      ...args: Parameters<History['pushState']>\n    ) {\n      const r = orig.apply(this, args);\n      fire();\n      return r;\n    } as History[typeof name];\n  }\n  window.addEventListener('popstate', fire);\n}\n\n/* ─────────────────────────── focal context ────────────────────────────── */\n\n/**\n * Where the user's attention is, right now.\n *\n * This is the \"knows what you're doing\" layer, and it is deliberately small so it can\n * ride on every turn — where the full snapshot cannot. It is also the most sensitive:\n * `selection` is whatever the user highlighted, which could be their own email, so it\n * is redacted and respects data-mf-private like everything else. Focus and the\n * viewport are labels and refs — never a value.\n *\n * Held so the last-known focus can travel with a turn even between the (throttled)\n * push updates.\n */\nlet lastFocus: FocusContext = {};\n\nasync function readFocus(): Promise<FocusContext> {\n  const focus: FocusContext = {};\n\n  // Selection — the single strongest \"this is what I'm asking about\" signal.\n  const sel = window.getSelection?.();\n  if (sel && !sel.isCollapsed) {\n    const anchor = sel.anchorNode?.parentElement ?? null;\n    // Don't lift a selection out of a private region, and cap it — a user can select\n    // the whole page.\n    if (!anchor || !anchor.closest('[data-mf-private]')) {\n      const text = sel.toString().trim().slice(0, 500);\n      if (text) focus.selection = redact(text);\n    }\n  }\n\n  // The control they're working in — its label, never its contents.\n  const active = document.activeElement;\n  if (\n    active &&\n    active !== document.body &&\n    !isPrivate(active) &&\n    !active.closest('[data-mf-private]')\n  ) {\n    const { snapshot } = await import('./dom/snapshot');\n    void snapshot; // ensure the chunk that owns refFor is loaded before we describe\n    focus.focused = {\n      label: redact(describeControl(active)),\n      role: active.getAttribute('role') || active.tagName.toLowerCase(),\n    };\n  }\n\n  const doc = document.documentElement;\n  const scrollable = doc.scrollHeight - doc.clientHeight;\n  focus.scroll =\n    scrollable > 0 ? Math.round((doc.scrollTop / scrollable) * 100) / 100 : 0;\n\n  return focus;\n}\n\n/** A label for whatever is focused, reusing the same value-blind rules as activity. */\nfunction describeControl(el: Element): string {\n  return describe(el);\n}\n\nlet focusTimer: ReturnType<typeof setTimeout> | null = null;\n\n/** Coalesce a burst of selection/focus/scroll events into one push. */\nfunction scheduleFocus() {\n  if (focusTimer) return;\n  focusTimer = setTimeout(async () => {\n    focusTimer = null;\n    lastFocus = await readFocus();\n    send?.({ type: 'host.focus', focus: lastFocus });\n  }, 250);\n}\n\n/* ───────────────────────────── snapshot ───────────────────────────────── */\n\nlet snapshotSeq = 0;\n\nexport async function sendSnapshot(emit: Send) {\n  // The a11y walk is itself lazily imported: a host that only ever declares\n  // PageContext and never lets the agent look at the page never downloads it.\n  const { snapshot } = await import('./dom/snapshot');\n  const { yaml, truncated, visibleRefs } = snapshot();\n  emit({\n    type: 'host.snapshot',\n    snapshot: { yaml: redact(yaml), seq: ++snapshotSeq, truncated },\n  });\n  // The viewport slice rides with the focus context so the agent can tell the few\n  // things on screen from the whole tree it just received.\n  lastFocus = { ...lastFocus, visibleRefs };\n  emit({ type: 'host.focus', focus: lastFocus });\n}\n\n/**\n * Zoom in on one ref — the pull half of the model. The agent asks; we resolve the ref\n * to a live element and return just its sub-tree.\n */\nexport async function sendRegion(ref: string, emit: Send) {\n  const { snapshotRegion, resolveRef } = await import('./dom/snapshot');\n  const el = resolveRef(ref);\n  if (!el) {\n    emit({\n      type: 'host.region',\n      ref,\n      yaml: '(this element is no longer on the page)',\n    });\n    return;\n  }\n  const { yaml } = snapshotRegion(el);\n  emit({ type: 'host.region', ref, yaml: redact(yaml) });\n}\n\n/* ───────────────────────────── tools ──────────────────────────────────── */\n\n/**\n * v1 IS READ-ONLY.\n *\n * The page's content is untrusted — text on it can try to instruct the agent — and\n * the moment the agent can act, a bad answer becomes a bad ACTION. So no tool here\n * mutates the page yet. The call path exists, and the enforcement point is HERE (in\n * the page, where we control what actually happens) rather than in the widget, which\n * can be lied to.\n *\n * When write tools land: anything not `readOnly` gets a user confirmation, on every\n * call. Not \"unless the host opts out\" — every call, because the trigger may have\n * been written by the page.\n */\nexport async function callTool(call: ToolCall, emit: Send) {\n  emit({\n    type: 'host.toolResult',\n    callId: call.callId,\n    ok: false,\n    error: 'Host tools are read-only in this version; no action was taken.',\n  });\n}\n\n/* ───────────────────────────── auth ───────────────────────────────────── */\n\n/**\n * Hosted login, in a POPUP — and the popup is not a UX preference.\n *\n * Our iframe on acme.com gets a PARTITIONED cookie jar: it cannot see the user's\n * existing matterfact session, no matter that it is served from our own origin.\n * A popup, however, is a TOP-LEVEL window on app.matterfact.com — first-party, real\n * cookies, silent SSO if they are already signed in. It hands the token back by\n * postMessage and we forward it into the iframe.\n */\nexport function beginAuth(\n  config: { origin: string; publishableKey: string },\n  emit: Send,\n) {\n  const w = window.open(\n    `${config.origin}/embed/authorize?k=${encodeURIComponent(\n      config.publishableKey,\n    )}&o=${encodeURIComponent(location.origin)}`,\n    'mf_auth',\n    'width=460,height=640',\n  );\n  if (!w) return; // popup blocked; the widget shows its own \"sign in\" affordance\n\n  const onMsg = (event: MessageEvent) => {\n    if (event.origin !== config.origin) return;\n    const d = event.data;\n    if (d?.type !== 'mf:embed:auth') return;\n    window.removeEventListener('message', onMsg);\n    emit({ type: 'host.auth', token: d.token, expiresAt: d.expiresAt });\n  };\n  window.addEventListener('message', onMsg);\n}\n\n/* ───────────────────────────── start ──────────────────────────────────── */\n\nexport function start(emit: Send, origin?: string) {\n  send = emit;\n  widgetOrigin = origin || '';\n  lastUrl = location.pathname;\n\n  publishContext();\n  publishArtifactGrants();\n  watchNavigation();\n\n  // Passive + capture: we observe, we never interfere with the host's own handling.\n  document.addEventListener('click', onClick, { capture: true, passive: true });\n  document.addEventListener('submit', onSubmit, {\n    capture: true,\n    passive: true,\n  });\n  // `change` fires on blur/commit for text inputs and immediately for select/\n  // checkbox/radio — not on every keystroke, which is what we want: a settled\n  // choice, not a stream of partial values.\n  document.addEventListener('change', onChange, {\n    capture: true,\n    passive: true,\n  });\n\n  // Focal context: what the user is attending to. Coalesced (scheduleFocus), because\n  // selectionchange and scroll fire in torrents.\n  document.addEventListener('selectionchange', scheduleFocus, {\n    passive: true,\n  });\n  document.addEventListener('focusin', scheduleFocus, {\n    capture: true,\n    passive: true,\n  });\n  window.addEventListener('scroll', scheduleFocus, {\n    capture: true,\n    passive: true,\n  });\n\n  const theme = matchMedia('(prefers-color-scheme: dark)').matches\n    ? 'dark'\n    : 'light';\n  emit({ type: 'host.theme', mode: theme });\n}\n"]}

package/dist/chunk-F7DLOR7F.js

@@ -0,0 +1,2 @@
+var l="";var f=null,x=0,u=[],y="",S=[/\b[\w.+-]+@[\w-]+\.[\w.]{2,}\b/g,/\b(?:\d[ -]?){13,19}\b/g,/\b\d{3}[- ]?\d{2}[- ]?\d{4}\b/g,/\b\d{9,}\b/g,/(?:\+?\d{1,2}[\s.-]?)?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}\b/g,/\b(?:sk|pk|rk|ak)_(?:live|test)_[A-Za-z0-9]{8,}\b/g,/\beyJ[\w-]+\.[\w-]+\.[\w-]+\b/g];function a(t){let e=t;for(let n of S)e=e.replace(n,"[redacted]");return e}function m(t){if(t.closest("[data-mf-private]"))return!0;if(t.tagName==="INPUT"){let n=t.type;if(n==="password"||n==="hidden")return!0}return!1}function E(t){let e=t.match(/^\/(?:embed\/)?artifacts\/(.+?)\/?$/);return e?decodeURIComponent(e[1]):null}function C(){if(!l)return[];let t=[];for(let e of Array.from(document.querySelectorAll("iframe"))){let n;try{n=new URL(e.getAttribute("src")||"",location.href)}catch{continue}if(n.origin!==l)continue;let r=E(n.pathname);r&&(t.some(o=>o.id===r)||t.push({kind:"artifact",id:r,label:a(e.getAttribute("title")||"")||r}))}return t}function T(){return Array.from(document.querySelectorAll("iframe")).filter(t=>{try{let e=new URL(t.getAttribute("src")||"",location.href);return e.origin!==location.origin&&e.origin!==l}catch{return!1}}).length}function L(){let t=window.matterfact?.context??{},e=C(),n=T();return{url:location.origin+location.pathname,path:location.pathname,title:a(document.title),locale:document.documentElement.lang||void 0,...t,entities:[...t.entities??[],...e],data:{...t.data??{},...n?{opaque_frames:n}:{}}}}function v(){f?.({type:"host.context",context:L()})}function k(t,e){let n=[];for(let r of t){let o;try{o=new URL(r||"",location.href)}catch{continue}if(o.origin!==e)continue;let i=E(o.pathname);if(!i)continue;let s=o.searchParams.get("owner")||"",b=o.searchParams.get("t")||"";!s||!b||n.some(A=>A.id===i)||n.push({id:i,owner:s,token:b})}return n}function I(){if(!l)return[];let t=Array.from(document.querySelectorAll("iframe")).map(e=>e.getAttribute("src")||"");return k(t,l)}function w(){f?.({type:"host.artifactGrants",grants:I()})}function p(t){u.push({...t,seq:++x,ts:Date.now()}),u.length>40&&u.shift(),f?.({type:"host.activity",events:[u[u.length-1]]})}function P(t){let e=t.getAttribute("aria-label");if(e)return e;let n=t.id;if(n){let s=document.querySelector(`label[for="${CSS.escape(n)}"]`)?.textContent?.trim();if(s)return s}let r=t.closest("label")?.textContent?.trim();if(r)return r;let o=t.getAttribute("placeholder");return o||""}var R=new Set(["INPUT","SELECT","TEXTAREA"]);function c(t){let e=t.getAttribute("role")||t.tagName.toLowerCase(),n=t.getAttribute("aria-label")||(R.has(t.tagName)?P(t):t.innerText?.trim().slice(0,60))||t.getAttribute("title")||"";return n?`${e} "${a(n)}"`:e}var $='a[href],button,input,select,textarea,summary,[role="button"],[role="link"],[role="menuitem"],[role="tab"],[role="option"],[role="checkbox"],[role="switch"],[role="radio"],[onclick],[tabindex]';function H(t){let e=t.target;if(!e||!(e instanceof Element))return;let n=e.closest("label"),o=(n?n.getAttribute("for")&&document.getElementById(n.getAttribute("for"))||n.querySelector("input,select,textarea"):null)??e.closest($);!o||m(o)||p({type:"click",summary:`clicked ${c(o)}`})}function M(t){let e=t.target;!e||m(e)||p({type:"submit",summary:`submitted ${c(e)}`})}function q(t){let e=t.target;if(!e||!(e instanceof Element)||m(e))return;let n=e.tagName,r=e.type;if(n==="INPUT"&&(r==="password"||r==="hidden"))return;let o=`changed ${c(e)}`;if(n==="SELECT"){let i=e.selectedOptions[0]?.text;i&&(o=`${c(e)} \u2192 "${a(i)}"`)}else(r==="checkbox"||r==="radio")&&(o=`${e.checked?"checked":"unchecked"} ${c(e)}`);p({type:"input",summary:o})}function N(){let t=()=>{let e=location.pathname;e!==y&&(y=e,p({type:"nav",summary:`navigated to ${e}`}),v(),w())};for(let e of["pushState","replaceState"]){let n=history[e];history[e]=function(...r){let o=n.apply(this,r);return t(),o}}window.addEventListener("popstate",t)}var d={};async function U(){let t={},e=window.getSelection?.();if(e&&!e.isCollapsed){let i=e.anchorNode?.parentElement??null;if(!i||!i.closest("[data-mf-private]")){let s=e.toString().trim().slice(0,500);s&&(t.selection=a(s))}}let n=document.activeElement;if(n&&n!==document.body&&!m(n)&&!n.closest("[data-mf-private]")){let{snapshot:i}=await import("./chunk-33LPVL2R.js");t.focused={label:a(F(n)),role:n.getAttribute("role")||n.tagName.toLowerCase()}}let r=document.documentElement,o=r.scrollHeight-r.clientHeight;return t.scroll=o>0?Math.round(r.scrollTop/o*100)/100:0,t}function F(t){return c(t)}var g=null;function h(){g||(g=setTimeout(async()=>{g=null,d=await U(),f?.({type:"host.focus",focus:d})},250))}var G=0;async function O(t){let{snapshot:e}=await import("./chunk-33LPVL2R.js"),{yaml:n,truncated:r,visibleRefs:o}=e();t({type:"host.snapshot",snapshot:{yaml:a(n),seq:++G,truncated:r}}),d={...d,visibleRefs:o},t({type:"host.focus",focus:d})}async function _(t,e){let{snapshotRegion:n,resolveRef:r}=await import("./chunk-33LPVL2R.js"),o=r(t);if(!o){e({type:"host.region",ref:t,yaml:"(this element is no longer on the page)"});return}let{yaml:i}=n(o);e({type:"host.region",ref:t,yaml:a(i)})}async function X(t,e){e({type:"host.toolResult",callId:t.callId,ok:!1,error:"Host tools are read-only in this version; no action was taken."})}function z(t,e){if(!window.open(`${t.origin}/embed/authorize?k=${encodeURIComponent(t.publishableKey)}&o=${encodeURIComponent(location.origin)}`,"mf_auth","width=460,height=640"))return;let r=o=>{if(o.origin!==t.origin)return;let i=o.data;i?.type==="mf:embed:auth"&&(window.removeEventListener("message",r),e({type:"host.auth",token:i.token,expiresAt:i.expiresAt}))};window.addEventListener("message",r)}function B(t,e){f=t,l=e||"",y=location.pathname,v(),w(),N(),document.addEventListener("click",H,{capture:!0,passive:!0}),document.addEventListener("submit",M,{capture:!0,passive:!0}),document.addEventListener("change",q,{capture:!0,passive:!0}),document.addEventListener("selectionchange",h,{passive:!0}),document.addEventListener("focusin",h,{capture:!0,passive:!0}),window.addEventListener("scroll",h,{capture:!0,passive:!0});let n=matchMedia("(prefers-color-scheme: dark)").matches?"dark":"light";t({type:"host.theme",mode:n})}export{a,m as b,E as c,L as d,k as e,O as f,_ as g,X as h,z as i,B as j};
+//# sourceMappingURL=chunk-F7DLOR7F.js.map

package/dist/chunk-F7DLOR7F.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/context.ts"],
+  "sourcesContent": ["import type {\n  ActivityEvent,\n  FocusContext,\n  HostToWidget,\n  PageContext,\n  PageEntity,\n  ToolCall,\n} from './protocol';\n\n/** The origin serving our chat \u2014 how we tell OUR embedded content from the host's own\n *  iframes. Set by start(); empty until then, which just means we spot nothing. */\nlet widgetOrigin = '';\n\n/**\n * The eye.\n *\n * Everything in this module can see the customer's page. It is a SEPARATE CHUNK,\n * loaded only when someone actually opens the chat \u2014 so a page whose visitors never\n * click the widget pays nothing for any of it, and a security reviewer can read\n * exactly one file to know what we look at.\n *\n * The rules, which are not negotiable:\n *\n *   NEVER captured \u2014 no config enables it: the value of any <input>, <textarea> or\n *   contenteditable; anything inside a password field; cookies; localStorage;\n *   sessionStorage; the raw DOM; screenshots; network traffic; anything inside an\n *   element marked `data-mf-private`.\n *\n *   The agent never gets a selector and never touches the DOM. It gets refs. A ref\n *   is resolved to an element HERE, in the page, by us.\n */\n\ntype Send = (msg: HostToWidget) => void;\n\nconst MAX_ACTIVITY = 40;\n\nlet send: Send | null = null;\nlet activitySeq = 0;\nconst activity: ActivityEvent[] = [];\nlet lastUrl = '';\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 redaction \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\nconst PII = [\n  /\\b[\\w.+-]+@[\\w-]+\\.[\\w.]{2,}\\b/g, // email\n  /\\b(?:\\d[ -]?){13,19}\\b/g, // card-ish\n  /\\b\\d{3}[- ]?\\d{2}[- ]?\\d{4}\\b/g, // ssn \u2014 dashed, spaced, OR bare 9 digits\n  /\\b\\d{9,}\\b/g, // long bare digit runs: account / MRN / routing numbers\n  /(?:\\+?\\d{1,2}[\\s.-]?)?\\(?\\d{3}\\)?[\\s.-]\\d{3}[\\s.-]\\d{4}\\b/g, // us phone\n  /\\b(?:sk|pk|rk|ak)_(?:live|test)_[A-Za-z0-9]{8,}\\b/g, // stripe-style api keys\n  /\\beyJ[\\w-]+\\.[\\w-]+\\.[\\w-]+\\b/g, // jwt\n];\n\n/**\n * Scrub before anything leaves the page \u2014 not after it arrives.\n *\n * A compromised widget, or a bug in ours, must not be able to retroactively obtain\n * a customer's users' email addresses. The only way to guarantee that is to never\n * put them on the wire.\n */\nexport function redact(text: string): string {\n  let out = text;\n  for (const re of PII) out = out.replace(re, '[redacted]');\n  return out;\n}\n\n/** Anything the host has marked private, or that is inherently sensitive, is out. */\nexport function isPrivate(el: Element): boolean {\n  if (el.closest('[data-mf-private]')) return true;\n  const tag = el.tagName;\n  if (tag === 'INPUT') {\n    const t = (el as HTMLInputElement).type;\n    if (t === 'password' || t === 'hidden') return true;\n  }\n  return false;\n}\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 page context \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\n/**\n * What the page says about itself.\n *\n * A host that declares nothing still gets URL + title, which is what every other\n * embeddable assistant on the market offers in total. The interesting fields\n * (`route`, `description`, `entities`) are host-declared, because only the host\n * knows that `/o/8813` is \"the Acme Corp order, 3 items, unpaid\".\n *\n * Declared via a global the host sets before we load:\n *   window.matterfact = { context: { route: '/orders/:id', description: '...', entities: [...] } }\n */\n/**\n * matterfact content embedded IN the host page \u2014 today, artifact iframes.\n *\n * A cross-origin iframe is opaque: `contentDocument` throws, so the DOM snapshot walks\n * straight past an embedded artifact and the agent is blind to the very thing the page\n * is built around. It reads the page as empty and asks which URL you mean.\n *\n * We don't need to see inside, and shouldn't want to. The artifact's ID is right there\n * in the src, and the agent can already resolve `artifacts/<id>/` in its session \u2014 the\n * same path an `@`-mention uses. So we report the ID and let the backend fetch the real\n * thing, which beats scraping a rendering of it: it gets the data, not the picture.\n *\n * Matched by ORIGIN, not by path shape: a customer is perfectly entitled to their own\n * /artifacts/ route, and it isn't ours.\n */\n/** The artifact slug from a matterfact artifact path, or null. Matches both the\n *  chrome-free embed route (/embed/artifacts/<slug>) and the bare /artifacts/<slug>. */\nexport function artifactIdFromPath(pathname: string): string | null {\n  const m = pathname.match(/^\\/(?:embed\\/)?artifacts\\/(.+?)\\/?$/);\n  return m ? decodeURIComponent(m[1]) : null;\n}\n\nfunction embeddedMatterfactEntities(): PageEntity[] {\n  if (!widgetOrigin) return [];\n  const out: PageEntity[] = [];\n  for (const frame of Array.from(document.querySelectorAll('iframe'))) {\n    let u: URL;\n    try {\n      u = new URL(frame.getAttribute('src') || '', location.href);\n    } catch {\n      continue;\n    }\n    if (u.origin !== widgetOrigin) continue;\n    const id = artifactIdFromPath(u.pathname);\n    if (!id) continue;\n    if (out.some((e) => e.id === id)) continue; // same artifact twice = once\n    // No url field: the agent reaches an artifact by ID (`artifacts/<id>/`), never by\n    // fetching the page, and an artifact URL can carry a share token we've no business\n    // forwarding. The id is the whole useful payload.\n    out.push({\n      kind: 'artifact',\n      id,\n      label: redact(frame.getAttribute('title') || '') || id,\n    });\n  }\n  return out;\n}\n\n/**\n * Frames we can see the existence of but nothing inside \u2014 someone else's cross-origin\n * embed. Worth one line: \"there is a thing here I cannot read\" is a true and useful\n * statement, and much better than the agent confidently describing a page while missing\n * the widget the user is actually asking about.\n */\nfunction opaqueFrameCount(): number {\n  return Array.from(document.querySelectorAll('iframe')).filter((f) => {\n    try {\n      const u = new URL(f.getAttribute('src') || '', location.href);\n      return u.origin !== location.origin && u.origin !== widgetOrigin;\n    } catch {\n      return false;\n    }\n  }).length;\n}\n\nexport function readPageContext(): PageContext {\n  const declared =\n    (window as { matterfact?: { context?: PageContext } }).matterfact\n      ?.context ?? {};\n\n  const found = embeddedMatterfactEntities();\n  const opaque = opaqueFrameCount();\n\n  return {\n    // Path only. A query string is where session ids, tokens and email addresses\n    // live; it is not ours to take.\n    url: location.origin + location.pathname,\n    path: location.pathname,\n    title: redact(document.title),\n    locale: document.documentElement.lang || undefined,\n    ...declared,\n    // After the spread: what we FOUND is additive to what the host DECLARED, never a\n    // replacement. A host that declares its own entities still gets the artifacts we\n    // spotted, and vice versa.\n    entities: [...(declared.entities ?? []), ...found],\n    data: {\n      ...(declared.data ?? {}),\n      ...(opaque ? { opaque_frames: opaque } : {}),\n    },\n  };\n}\n\nfunction publishContext() {\n  send?.({ type: 'host.context', context: readPageContext() });\n}\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 artifact grants (backend-only) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\nexport interface ArtifactGrantSrc {\n  id: string;\n  owner: string;\n  token: string;\n}\n\n/** Read-only capability grants from co-embedded artifact iframes, for the backend to\n *  materialize their data. Separate from entities on purpose: the token must never ride\n *  ambient (rendered) context, only this backend-only channel. */\nexport function grantsFromIframeSrcs(\n  srcs: string[],\n  origin: string,\n): ArtifactGrantSrc[] {\n  const out: ArtifactGrantSrc[] = [];\n  for (const raw of srcs) {\n    let u: URL;\n    try {\n      u = new URL(raw || '', location.href);\n    } catch {\n      continue;\n    }\n    if (u.origin !== origin) continue;\n    const id = artifactIdFromPath(u.pathname);\n    if (!id) continue;\n    const owner = u.searchParams.get('owner') || '';\n    const token = u.searchParams.get('t') || '';\n    if (!owner || !token) continue;\n    if (out.some((g) => g.id === id)) continue;\n    out.push({ id, owner, token });\n  }\n  return out;\n}\n\nfunction readArtifactGrants(): ArtifactGrantSrc[] {\n  if (!widgetOrigin) return [];\n  const srcs = Array.from(document.querySelectorAll('iframe')).map(\n    (f) => f.getAttribute('src') || '',\n  );\n  return grantsFromIframeSrcs(srcs, widgetOrigin);\n}\n\nfunction publishArtifactGrants() {\n  send?.({ type: 'host.artifactGrants', grants: readArtifactGrants() });\n}\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 activity \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\nfunction pushActivity(e: Omit<ActivityEvent, 'seq' | 'ts'>) {\n  activity.push({ ...e, seq: ++activitySeq, ts: Date.now() });\n  if (activity.length > MAX_ACTIVITY) activity.shift();\n  send?.({ type: 'host.activity', events: [activity[activity.length - 1]] });\n}\n\n/**\n * A short, human-readable label for what got clicked.\n *\n * Shaped after PostHog's autocapture, not after a session-replay frame: rrweb would\n * give us `{source:2, type:2, id:417, x:210, y:88}` \u2014 no text, no role, no href,\n * meaningless to a model without the full DOM snapshot it deltas against. One line\n * of \"clicked button 'Export CSV'\" is worth more and costs less.\n */\n/**\n * The accessible NAME of a form control \u2014 never its value.\n *\n * A control has no `innerText`, so the generic path below misses it. We look where a\n * control's name actually lives: `aria-label`, then a `<label for>` or a wrapping\n * `<label>`, then `placeholder`. `placeholder` is a LABEL, not a value \u2014 it is the\n * hint shown when the field is empty (\"Order number or customer\"), so it is safe.\n */\nfunction controlLabel(el: Element): string {\n  const aria = el.getAttribute('aria-label');\n  if (aria) return aria;\n\n  const id = el.id;\n  if (id) {\n    const forLabel = document.querySelector(`label[for=\"${CSS.escape(id)}\"]`);\n    const t = forLabel?.textContent?.trim();\n    if (t) return t;\n  }\n  const wrapping = el.closest('label')?.textContent?.trim();\n  if (wrapping) return wrapping;\n\n  const placeholder = el.getAttribute('placeholder');\n  if (placeholder) return placeholder;\n\n  return '';\n}\n\nconst FORM_CONTROLS = new Set(['INPUT', 'SELECT', 'TEXTAREA']);\n\nfunction describe(el: Element): string {\n  const role = el.getAttribute('role') || el.tagName.toLowerCase();\n  const label =\n    el.getAttribute('aria-label') ||\n    (FORM_CONTROLS.has(el.tagName)\n      ? controlLabel(el)\n      : (el as HTMLElement).innerText?.trim().slice(0, 60)) ||\n    el.getAttribute('title') ||\n    '';\n  return label ? `${role} \"${redact(label)}\"` : role;\n}\n\n/**\n * Elements a click is worth recording. Deliberately tight: the point of the activity\n * stream is INTENT (\"the user chose to export\"), and a click on a heading, a label,\n * a card gutter, or blank page is not intent, it is noise. We only log a click that\n * lands on something actionable.\n */\nconst ACTIONABLE =\n  'a[href],button,input,select,textarea,summary,' +\n  '[role=\"button\"],[role=\"link\"],[role=\"menuitem\"],[role=\"tab\"],[role=\"option\"],' +\n  '[role=\"checkbox\"],[role=\"switch\"],[role=\"radio\"],[onclick],[tabindex]';\n\nfunction onClick(ev: Event) {\n  const target = ev.target as Element | null;\n  if (!target || !(target instanceof Element)) return;\n\n  // Clicking a <label> operates the control it labels \u2014 record THAT, not \"clicked\n  // label\", so the event reads as the user's actual intent.\n  const label = target.closest('label');\n  const labelled = label\n    ? (label.getAttribute('for') &&\n        document.getElementById(label.getAttribute('for')!)) ||\n      label.querySelector('input,select,textarea')\n    : null;\n\n  const actionable = labelled ?? target.closest(ACTIONABLE);\n  // No actionable target \u2014 a click on text, a gutter, or blank space. That is not an\n  // action; dropping it is the whole fix for the click-log noise.\n  if (!actionable || isPrivate(actionable)) return;\n\n  pushActivity({ type: 'click', summary: `clicked ${describe(actionable)}` });\n}\n\nfunction onSubmit(ev: Event) {\n  const el = ev.target as Element | null;\n  if (!el || isPrivate(el)) return;\n  // The FORM was submitted \u2014 never its values.\n  pushActivity({ type: 'submit', summary: `submitted ${describe(el)}` });\n}\n\n/**\n * A form field changed.\n *\n * The rule is the same as everywhere else and the temptation here is sharpest:\n * record THAT a field changed and WHICH field (its label), never WHAT it was\n * changed to. `change` fires on exactly the elements whose values are off-limits.\n *\n * One safe exception: a <select>, a checkbox, or a radio chose from a fixed, visible\n * set of options the agent can already see in the snapshot \u2014 \"Unpaid\", \"Shipped\".\n * That is a user *choice*, not typed data, so the chosen option's LABEL is fair to\n * include and is the useful part (\"filtered status to Shipped\"). Free-text and\n * numeric inputs get their label only.\n */\nfunction onChange(ev: Event) {\n  const el = ev.target as (HTMLElement & { type?: string }) | null;\n  if (!el || !(el instanceof Element) || isPrivate(el)) return;\n\n  const tag = el.tagName;\n  const type = (el as HTMLInputElement).type;\n\n  // Never a password/hidden field, and isPrivate already covered data-mf-private.\n  if (tag === 'INPUT' && (type === 'password' || type === 'hidden')) return;\n\n  let summary = `changed ${describe(el)}`;\n\n  if (tag === 'SELECT') {\n    const opt = (el as HTMLSelectElement).selectedOptions[0]?.text;\n    if (opt) summary = `${describe(el)} \u2192 \"${redact(opt)}\"`;\n  } else if (type === 'checkbox' || type === 'radio') {\n    summary = `${(el as HTMLInputElement).checked ? 'checked' : 'unchecked'} ${describe(el)}`;\n  }\n\n  pushActivity({ type: 'input', summary });\n}\n\n/**\n * SPA navigation. There is no event for `pushState`, so we wrap it \u2014 a 20-line job\n * that no library does better.\n */\nfunction watchNavigation() {\n  const fire = () => {\n    const url = location.pathname;\n    if (url === lastUrl) return;\n    lastUrl = url;\n    pushActivity({ type: 'nav', summary: `navigated to ${url}` });\n    publishContext();\n    publishArtifactGrants();\n  };\n\n  for (const name of ['pushState', 'replaceState'] as const) {\n    const orig = history[name];\n    history[name] = function (\n      this: History,\n      ...args: Parameters<History['pushState']>\n    ) {\n      const r = orig.apply(this, args);\n      fire();\n      return r;\n    } as History[typeof name];\n  }\n  window.addEventListener('popstate', fire);\n}\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 focal context \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\n/**\n * Where the user's attention is, right now.\n *\n * This is the \"knows what you're doing\" layer, and it is deliberately small so it can\n * ride on every turn \u2014 where the full snapshot cannot. It is also the most sensitive:\n * `selection` is whatever the user highlighted, which could be their own email, so it\n * is redacted and respects data-mf-private like everything else. Focus and the\n * viewport are labels and refs \u2014 never a value.\n *\n * Held so the last-known focus can travel with a turn even between the (throttled)\n * push updates.\n */\nlet lastFocus: FocusContext = {};\n\nasync function readFocus(): Promise<FocusContext> {\n  const focus: FocusContext = {};\n\n  // Selection \u2014 the single strongest \"this is what I'm asking about\" signal.\n  const sel = window.getSelection?.();\n  if (sel && !sel.isCollapsed) {\n    const anchor = sel.anchorNode?.parentElement ?? null;\n    // Don't lift a selection out of a private region, and cap it \u2014 a user can select\n    // the whole page.\n    if (!anchor || !anchor.closest('[data-mf-private]')) {\n      const text = sel.toString().trim().slice(0, 500);\n      if (text) focus.selection = redact(text);\n    }\n  }\n\n  // The control they're working in \u2014 its label, never its contents.\n  const active = document.activeElement;\n  if (\n    active &&\n    active !== document.body &&\n    !isPrivate(active) &&\n    !active.closest('[data-mf-private]')\n  ) {\n    const { snapshot } = await import('./dom/snapshot');\n    void snapshot; // ensure the chunk that owns refFor is loaded before we describe\n    focus.focused = {\n      label: redact(describeControl(active)),\n      role: active.getAttribute('role') || active.tagName.toLowerCase(),\n    };\n  }\n\n  const doc = document.documentElement;\n  const scrollable = doc.scrollHeight - doc.clientHeight;\n  focus.scroll =\n    scrollable > 0 ? Math.round((doc.scrollTop / scrollable) * 100) / 100 : 0;\n\n  return focus;\n}\n\n/** A label for whatever is focused, reusing the same value-blind rules as activity. */\nfunction describeControl(el: Element): string {\n  return describe(el);\n}\n\nlet focusTimer: ReturnType<typeof setTimeout> | null = null;\n\n/** Coalesce a burst of selection/focus/scroll events into one push. */\nfunction scheduleFocus() {\n  if (focusTimer) return;\n  focusTimer = setTimeout(async () => {\n    focusTimer = null;\n    lastFocus = await readFocus();\n    send?.({ type: 'host.focus', focus: lastFocus });\n  }, 250);\n}\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 snapshot \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\nlet snapshotSeq = 0;\n\nexport async function sendSnapshot(emit: Send) {\n  // The a11y walk is itself lazily imported: a host that only ever declares\n  // PageContext and never lets the agent look at the page never downloads it.\n  const { snapshot } = await import('./dom/snapshot');\n  const { yaml, truncated, visibleRefs } = snapshot();\n  emit({\n    type: 'host.snapshot',\n    snapshot: { yaml: redact(yaml), seq: ++snapshotSeq, truncated },\n  });\n  // The viewport slice rides with the focus context so the agent can tell the few\n  // things on screen from the whole tree it just received.\n  lastFocus = { ...lastFocus, visibleRefs };\n  emit({ type: 'host.focus', focus: lastFocus });\n}\n\n/**\n * Zoom in on one ref \u2014 the pull half of the model. The agent asks; we resolve the ref\n * to a live element and return just its sub-tree.\n */\nexport async function sendRegion(ref: string, emit: Send) {\n  const { snapshotRegion, resolveRef } = await import('./dom/snapshot');\n  const el = resolveRef(ref);\n  if (!el) {\n    emit({\n      type: 'host.region',\n      ref,\n      yaml: '(this element is no longer on the page)',\n    });\n    return;\n  }\n  const { yaml } = snapshotRegion(el);\n  emit({ type: 'host.region', ref, yaml: redact(yaml) });\n}\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 tools \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\n/**\n * v1 IS READ-ONLY.\n *\n * The page's content is untrusted \u2014 text on it can try to instruct the agent \u2014 and\n * the moment the agent can act, a bad answer becomes a bad ACTION. So no tool here\n * mutates the page yet. The call path exists, and the enforcement point is HERE (in\n * the page, where we control what actually happens) rather than in the widget, which\n * can be lied to.\n *\n * When write tools land: anything not `readOnly` gets a user confirmation, on every\n * call. Not \"unless the host opts out\" \u2014 every call, because the trigger may have\n * been written by the page.\n */\nexport async function callTool(call: ToolCall, emit: Send) {\n  emit({\n    type: 'host.toolResult',\n    callId: call.callId,\n    ok: false,\n    error: 'Host tools are read-only in this version; no action was taken.',\n  });\n}\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 auth \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\n/**\n * Hosted login, in a POPUP \u2014 and the popup is not a UX preference.\n *\n * Our iframe on acme.com gets a PARTITIONED cookie jar: it cannot see the user's\n * existing matterfact session, no matter that it is served from our own origin.\n * A popup, however, is a TOP-LEVEL window on app.matterfact.com \u2014 first-party, real\n * cookies, silent SSO if they are already signed in. It hands the token back by\n * postMessage and we forward it into the iframe.\n */\nexport function beginAuth(\n  config: { origin: string; publishableKey: string },\n  emit: Send,\n) {\n  const w = window.open(\n    `${config.origin}/embed/authorize?k=${encodeURIComponent(\n      config.publishableKey,\n    )}&o=${encodeURIComponent(location.origin)}`,\n    'mf_auth',\n    'width=460,height=640',\n  );\n  if (!w) return; // popup blocked; the widget shows its own \"sign in\" affordance\n\n  const onMsg = (event: MessageEvent) => {\n    if (event.origin !== config.origin) return;\n    const d = event.data;\n    if (d?.type !== 'mf:embed:auth') return;\n    window.removeEventListener('message', onMsg);\n    emit({ type: 'host.auth', token: d.token, expiresAt: d.expiresAt });\n  };\n  window.addEventListener('message', onMsg);\n}\n\n/* \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 start \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n\nexport function start(emit: Send, origin?: string) {\n  send = emit;\n  widgetOrigin = origin || '';\n  lastUrl = location.pathname;\n\n  publishContext();\n  publishArtifactGrants();\n  watchNavigation();\n\n  // Passive + capture: we observe, we never interfere with the host's own handling.\n  document.addEventListener('click', onClick, { capture: true, passive: true });\n  document.addEventListener('submit', onSubmit, {\n    capture: true,\n    passive: true,\n  });\n  // `change` fires on blur/commit for text inputs and immediately for select/\n  // checkbox/radio \u2014 not on every keystroke, which is what we want: a settled\n  // choice, not a stream of partial values.\n  document.addEventListener('change', onChange, {\n    capture: true,\n    passive: true,\n  });\n\n  // Focal context: what the user is attending to. Coalesced (scheduleFocus), because\n  // selectionchange and scroll fire in torrents.\n  document.addEventListener('selectionchange', scheduleFocus, {\n    passive: true,\n  });\n  document.addEventListener('focusin', scheduleFocus, {\n    capture: true,\n    passive: true,\n  });\n  window.addEventListener('scroll', scheduleFocus, {\n    capture: true,\n    passive: true,\n  });\n\n  const theme = matchMedia('(prefers-color-scheme: dark)').matches\n    ? 'dark'\n    : 'light';\n  emit({ type: 'host.theme', mode: theme });\n}\n"],
+  "mappings": "AAWA,IAAIA,EAAe,GAyBnB,IAAIC,EAAoB,KACpBC,EAAc,EACZC,EAA4B,CAAC,EAC/BC,EAAU,GAIRC,EAAM,CACV,kCACA,0BACA,iCACA,cACA,6DACA,qDACA,gCACF,EASO,SAASC,EAAOC,EAAsB,CAC3C,IAAIC,EAAMD,EACV,QAAWE,KAAMJ,EAAKG,EAAMA,EAAI,QAAQC,EAAI,YAAY,EACxD,OAAOD,CACT,CAGO,SAASE,EAAUC,EAAsB,CAC9C,GAAIA,EAAG,QAAQ,mBAAmB,EAAG,MAAO,GAE5C,GADYA,EAAG,UACH,QAAS,CACnB,IAAMC,EAAKD,EAAwB,KACnC,GAAIC,IAAM,YAAcA,IAAM,SAAU,MAAO,EACjD,CACA,MAAO,EACT,CAgCO,SAASC,EAAmBC,EAAiC,CAClE,IAAMC,EAAID,EAAS,MAAM,qCAAqC,EAC9D,OAAOC,EAAI,mBAAmBA,EAAE,CAAC,CAAC,EAAI,IACxC,CAEA,SAASC,GAA2C,CAClD,GAAI,CAACC,EAAc,MAAO,CAAC,EAC3B,IAAMT,EAAoB,CAAC,EAC3B,QAAWU,KAAS,MAAM,KAAK,SAAS,iBAAiB,QAAQ,CAAC,EAAG,CACnE,IAAIC,EACJ,GAAI,CACFA,EAAI,IAAI,IAAID,EAAM,aAAa,KAAK,GAAK,GAAI,SAAS,IAAI,CAC5D,MAAQ,CACN,QACF,CACA,GAAIC,EAAE,SAAWF,EAAc,SAC/B,IAAMG,EAAKP,EAAmBM,EAAE,QAAQ,EACnCC,IACDZ,EAAI,KAAMa,GAAMA,EAAE,KAAOD,CAAE,GAI/BZ,EAAI,KAAK,CACP,KAAM,WACN,GAAAY,EACA,MAAOd,EAAOY,EAAM,aAAa,OAAO,GAAK,EAAE,GAAKE,CACtD,CAAC,EACH,CACA,OAAOZ,CACT,CAQA,SAASc,GAA2B,CAClC,OAAO,MAAM,KAAK,SAAS,iBAAiB,QAAQ,CAAC,EAAE,OAAQC,GAAM,CACnE,GAAI,CACF,IAAMJ,EAAI,IAAI,IAAII,EAAE,aAAa,KAAK,GAAK,GAAI,SAAS,IAAI,EAC5D,OAAOJ,EAAE,SAAW,SAAS,QAAUA,EAAE,SAAWF,CACtD,MAAQ,CACN,MAAO,EACT,CACF,CAAC,EAAE,MACL,CAEO,SAASO,GAA+B,CAC7C,IAAMC,EACH,OAAsD,YACnD,SAAW,CAAC,EAEZC,EAAQV,EAA2B,EACnCW,EAASL,EAAiB,EAEhC,MAAO,CAGL,IAAK,SAAS,OAAS,SAAS,SAChC,KAAM,SAAS,SACf,MAAOhB,EAAO,SAAS,KAAK,EAC5B,OAAQ,SAAS,gBAAgB,MAAQ,OACzC,GAAGmB,EAIH,SAAU,CAAC,GAAIA,EAAS,UAAY,CAAC,EAAI,GAAGC,CAAK,EACjD,KAAM,CACJ,GAAID,EAAS,MAAQ,CAAC,EACtB,GAAIE,EAAS,CAAE,cAAeA,CAAO,EAAI,CAAC,CAC5C,CACF,CACF,CAEA,SAASC,GAAiB,CACxB3B,IAAO,CAAE,KAAM,eAAgB,QAASuB,EAAgB,CAAE,CAAC,CAC7D,CAaO,SAASK,EACdC,EACAC,EACoB,CACpB,IAAMvB,EAA0B,CAAC,EACjC,QAAWwB,KAAOF,EAAM,CACtB,IAAIX,EACJ,GAAI,CACFA,EAAI,IAAI,IAAIa,GAAO,GAAI,SAAS,IAAI,CACtC,MAAQ,CACN,QACF,CACA,GAAIb,EAAE,SAAWY,EAAQ,SACzB,IAAMX,EAAKP,EAAmBM,EAAE,QAAQ,EACxC,GAAI,CAACC,EAAI,SACT,IAAMa,EAAQd,EAAE,aAAa,IAAI,OAAO,GAAK,GACvCe,EAAQf,EAAE,aAAa,IAAI,GAAG,GAAK,GACrC,CAACc,GAAS,CAACC,GACX1B,EAAI,KAAM2B,GAAMA,EAAE,KAAOf,CAAE,GAC/BZ,EAAI,KAAK,CAAE,GAAAY,EAAI,MAAAa,EAAO,MAAAC,CAAM,CAAC,CAC/B,CACA,OAAO1B,CACT,CAEA,SAAS4B,GAAyC,CAChD,GAAI,CAACnB,EAAc,MAAO,CAAC,EAC3B,IAAMa,EAAO,MAAM,KAAK,SAAS,iBAAiB,QAAQ,CAAC,EAAE,IAC1DP,GAAMA,EAAE,aAAa,KAAK,GAAK,EAClC,EACA,OAAOM,EAAqBC,EAAMb,CAAY,CAChD,CAEA,SAASoB,GAAwB,CAC/BpC,IAAO,CAAE,KAAM,sBAAuB,OAAQmC,EAAmB,CAAE,CAAC,CACtE,CAIA,SAASE,EAAajB,EAAsC,CAC1DlB,EAAS,KAAK,CAAE,GAAGkB,EAAG,IAAK,EAAEnB,EAAa,GAAI,KAAK,IAAI,CAAE,CAAC,EACtDC,EAAS,OAAS,IAAcA,EAAS,MAAM,EACnDF,IAAO,CAAE,KAAM,gBAAiB,OAAQ,CAACE,EAASA,EAAS,OAAS,CAAC,CAAC,CAAE,CAAC,CAC3E,CAkBA,SAASoC,EAAa5B,EAAqB,CACzC,IAAM6B,EAAO7B,EAAG,aAAa,YAAY,EACzC,GAAI6B,EAAM,OAAOA,EAEjB,IAAMpB,EAAKT,EAAG,GACd,GAAIS,EAAI,CAEN,IAAMR,EADW,SAAS,cAAc,cAAc,IAAI,OAAOQ,CAAE,CAAC,IAAI,GACpD,aAAa,KAAK,EACtC,GAAIR,EAAG,OAAOA,CAChB,CACA,IAAM6B,EAAW9B,EAAG,QAAQ,OAAO,GAAG,aAAa,KAAK,EACxD,GAAI8B,EAAU,OAAOA,EAErB,IAAMC,EAAc/B,EAAG,aAAa,aAAa,EACjD,OAAI+B,GAEG,EACT,CAEA,IAAMC,EAAgB,IAAI,IAAI,CAAC,QAAS,SAAU,UAAU,CAAC,EAE7D,SAASC,EAASjC,EAAqB,CACrC,IAAMkC,EAAOlC,EAAG,aAAa,MAAM,GAAKA,EAAG,QAAQ,YAAY,EACzDmC,EACJnC,EAAG,aAAa,YAAY,IAC3BgC,EAAc,IAAIhC,EAAG,OAAO,EACzB4B,EAAa5B,CAAE,EACdA,EAAmB,WAAW,KAAK,EAAE,MAAM,EAAG,EAAE,IACrDA,EAAG,aAAa,OAAO,GACvB,GACF,OAAOmC,EAAQ,GAAGD,CAAI,KAAKvC,EAAOwC,CAAK,CAAC,IAAMD,CAChD,CAQA,IAAME,EACJ,kMAIF,SAASC,EAAQC,EAAW,CAC1B,IAAMC,EAASD,EAAG,OAClB,GAAI,CAACC,GAAU,EAAEA,aAAkB,SAAU,OAI7C,IAAMJ,EAAQI,EAAO,QAAQ,OAAO,EAO9BC,GANWL,EACZA,EAAM,aAAa,KAAK,GACvB,SAAS,eAAeA,EAAM,aAAa,KAAK,CAAE,GACpDA,EAAM,cAAc,uBAAuB,EAC3C,OAE2BI,EAAO,QAAQH,CAAU,EAGpD,CAACI,GAAczC,EAAUyC,CAAU,GAEvCb,EAAa,CAAE,KAAM,QAAS,QAAS,WAAWM,EAASO,CAAU,CAAC,EAAG,CAAC,CAC5E,CAEA,SAASC,EAASH,EAAW,CAC3B,IAAMtC,EAAKsC,EAAG,OACV,CAACtC,GAAMD,EAAUC,CAAE,GAEvB2B,EAAa,CAAE,KAAM,SAAU,QAAS,aAAaM,EAASjC,CAAE,CAAC,EAAG,CAAC,CACvE,CAeA,SAAS0C,EAASJ,EAAW,CAC3B,IAAMtC,EAAKsC,EAAG,OACd,GAAI,CAACtC,GAAM,EAAEA,aAAc,UAAYD,EAAUC,CAAE,EAAG,OAEtD,IAAM2C,EAAM3C,EAAG,QACT4C,EAAQ5C,EAAwB,KAGtC,GAAI2C,IAAQ,UAAYC,IAAS,YAAcA,IAAS,UAAW,OAEnE,IAAIC,EAAU,WAAWZ,EAASjC,CAAE,CAAC,GAErC,GAAI2C,IAAQ,SAAU,CACpB,IAAMG,EAAO9C,EAAyB,gBAAgB,CAAC,GAAG,KACtD8C,IAAKD,EAAU,GAAGZ,EAASjC,CAAE,CAAC,YAAOL,EAAOmD,CAAG,CAAC,IACtD,MAAWF,IAAS,YAAcA,IAAS,WACzCC,EAAU,GAAI7C,EAAwB,QAAU,UAAY,WAAW,IAAIiC,EAASjC,CAAE,CAAC,IAGzF2B,EAAa,CAAE,KAAM,QAAS,QAAAkB,CAAQ,CAAC,CACzC,CAMA,SAASE,GAAkB,CACzB,IAAMC,EAAO,IAAM,CACjB,IAAMC,EAAM,SAAS,SACjBA,IAAQxD,IACZA,EAAUwD,EACVtB,EAAa,CAAE,KAAM,MAAO,QAAS,gBAAgBsB,CAAG,EAAG,CAAC,EAC5DhC,EAAe,EACfS,EAAsB,EACxB,EAEA,QAAWwB,IAAQ,CAAC,YAAa,cAAc,EAAY,CACzD,IAAMC,EAAO,QAAQD,CAAI,EACzB,QAAQA,CAAI,EAAI,YAEXE,EACH,CACA,IAAMC,EAAIF,EAAK,MAAM,KAAMC,CAAI,EAC/B,OAAAJ,EAAK,EACEK,CACT,CACF,CACA,OAAO,iBAAiB,WAAYL,CAAI,CAC1C,CAgBA,IAAIM,EAA0B,CAAC,EAE/B,eAAeC,GAAmC,CAChD,IAAMC,EAAsB,CAAC,EAGvBC,EAAM,OAAO,eAAe,EAClC,GAAIA,GAAO,CAACA,EAAI,YAAa,CAC3B,IAAMC,EAASD,EAAI,YAAY,eAAiB,KAGhD,GAAI,CAACC,GAAU,CAACA,EAAO,QAAQ,mBAAmB,EAAG,CACnD,IAAM9D,EAAO6D,EAAI,SAAS,EAAE,KAAK,EAAE,MAAM,EAAG,GAAG,EAC3C7D,IAAM4D,EAAM,UAAY7D,EAAOC,CAAI,EACzC,CACF,CAGA,IAAM+D,EAAS,SAAS,cACxB,GACEA,GACAA,IAAW,SAAS,MACpB,CAAC5D,EAAU4D,CAAM,GACjB,CAACA,EAAO,QAAQ,mBAAmB,EACnC,CACA,GAAM,CAAE,SAAAC,CAAS,EAAI,KAAM,QAAO,qBAAgB,EAElDJ,EAAM,QAAU,CACd,MAAO7D,EAAOkE,EAAgBF,CAAM,CAAC,EACrC,KAAMA,EAAO,aAAa,MAAM,GAAKA,EAAO,QAAQ,YAAY,CAClE,CACF,CAEA,IAAMG,EAAM,SAAS,gBACfC,EAAaD,EAAI,aAAeA,EAAI,aAC1C,OAAAN,EAAM,OACJO,EAAa,EAAI,KAAK,MAAOD,EAAI,UAAYC,EAAc,GAAG,EAAI,IAAM,EAEnEP,CACT,CAGA,SAASK,EAAgB7D,EAAqB,CAC5C,OAAOiC,EAASjC,CAAE,CACpB,CAEA,IAAIgE,EAAmD,KAGvD,SAASC,GAAgB,CACnBD,IACJA,EAAa,WAAW,SAAY,CAClCA,EAAa,KACbV,EAAY,MAAMC,EAAU,EAC5BjE,IAAO,CAAE,KAAM,aAAc,MAAOgE,CAAU,CAAC,CACjD,EAAG,GAAG,EACR,CAIA,IAAIY,EAAc,EAElB,eAAsBC,EAAaC,EAAY,CAG7C,GAAM,CAAE,SAAAR,CAAS,EAAI,KAAM,QAAO,qBAAgB,EAC5C,CAAE,KAAAS,EAAM,UAAAC,EAAW,YAAAC,CAAY,EAAIX,EAAS,EAClDQ,EAAK,CACH,KAAM,gBACN,SAAU,CAAE,KAAMzE,EAAO0E,CAAI,EAAG,IAAK,EAAEH,EAAa,UAAAI,CAAU,CAChE,CAAC,EAGDhB,EAAY,CAAE,GAAGA,EAAW,YAAAiB,CAAY,EACxCH,EAAK,CAAE,KAAM,aAAc,MAAOd,CAAU,CAAC,CAC/C,CAMA,eAAsBkB,EAAWC,EAAaL,EAAY,CACxD,GAAM,CAAE,eAAAM,EAAgB,WAAAC,CAAW,EAAI,KAAM,QAAO,qBAAgB,EAC9D3E,EAAK2E,EAAWF,CAAG,EACzB,GAAI,CAACzE,EAAI,CACPoE,EAAK,CACH,KAAM,cACN,IAAAK,EACA,KAAM,yCACR,CAAC,EACD,MACF,CACA,GAAM,CAAE,KAAAJ,CAAK,EAAIK,EAAe1E,CAAE,EAClCoE,EAAK,CAAE,KAAM,cAAe,IAAAK,EAAK,KAAM9E,EAAO0E,CAAI,CAAE,CAAC,CACvD,CAiBA,eAAsBO,EAASC,EAAgBT,EAAY,CACzDA,EAAK,CACH,KAAM,kBACN,OAAQS,EAAK,OACb,GAAI,GACJ,MAAO,gEACT,CAAC,CACH,CAaO,SAASC,EACdC,EACAX,EACA,CAQA,GAAI,CAPM,OAAO,KACf,GAAGW,EAAO,MAAM,sBAAsB,mBACpCA,EAAO,cACT,CAAC,MAAM,mBAAmB,SAAS,MAAM,CAAC,GAC1C,UACA,sBACF,EACQ,OAER,IAAMC,EAASC,GAAwB,CACrC,GAAIA,EAAM,SAAWF,EAAO,OAAQ,OACpC,IAAMG,EAAID,EAAM,KACZC,GAAG,OAAS,kBAChB,OAAO,oBAAoB,UAAWF,CAAK,EAC3CZ,EAAK,CAAE,KAAM,YAAa,MAAOc,EAAE,MAAO,UAAWA,EAAE,SAAU,CAAC,EACpE,EACA,OAAO,iBAAiB,UAAWF,CAAK,CAC1C,CAIO,SAASG,EAAMf,EAAYhD,EAAiB,CACjD9B,EAAO8E,EACP9D,EAAec,GAAU,GACzB3B,EAAU,SAAS,SAEnBwB,EAAe,EACfS,EAAsB,EACtBqB,EAAgB,EAGhB,SAAS,iBAAiB,QAASV,EAAS,CAAE,QAAS,GAAM,QAAS,EAAK,CAAC,EAC5E,SAAS,iBAAiB,SAAUI,EAAU,CAC5C,QAAS,GACT,QAAS,EACX,CAAC,EAID,SAAS,iBAAiB,SAAUC,EAAU,CAC5C,QAAS,GACT,QAAS,EACX,CAAC,EAID,SAAS,iBAAiB,kBAAmBuB,EAAe,CAC1D,QAAS,EACX,CAAC,EACD,SAAS,iBAAiB,UAAWA,EAAe,CAClD,QAAS,GACT,QAAS,EACX,CAAC,EACD,OAAO,iBAAiB,SAAUA,EAAe,CAC/C,QAAS,GACT,QAAS,EACX,CAAC,EAED,IAAMmB,EAAQ,WAAW,8BAA8B,EAAE,QACrD,OACA,QACJhB,EAAK,CAAE,KAAM,aAAc,KAAMgB,CAAM,CAAC,CAC1C",
+  "names": ["widgetOrigin", "send", "activitySeq", "activity", "lastUrl", "PII", "redact", "text", "out", "re", "isPrivate", "el", "t", "artifactIdFromPath", "pathname", "m", "embeddedMatterfactEntities", "widgetOrigin", "frame", "u", "id", "e", "opaqueFrameCount", "f", "readPageContext", "declared", "found", "opaque", "publishContext", "grantsFromIframeSrcs", "srcs", "origin", "raw", "owner", "token", "g", "readArtifactGrants", "publishArtifactGrants", "pushActivity", "controlLabel", "aria", "wrapping", "placeholder", "FORM_CONTROLS", "describe", "role", "label", "ACTIONABLE", "onClick", "ev", "target", "actionable", "onSubmit", "onChange", "tag", "type", "summary", "opt", "watchNavigation", "fire", "url", "name", "orig", "args", "r", "lastFocus", "readFocus", "focus", "sel", "anchor", "active", "snapshot", "describeControl", "doc", "scrollable", "focusTimer", "scheduleFocus", "snapshotSeq", "sendSnapshot", "emit", "yaml", "truncated", "visibleRefs", "sendRegion", "ref", "snapshotRegion", "resolveRef", "callTool", "call", "beginAuth", "config", "onMsg", "event", "d", "start", "theme"]
+}

package/dist/chunk-FBIJZJGL.js

@@ -0,0 +1,2 @@
+import{a,b,c,d,e,f,g,h,i,j}from"./chunk-F7DLOR7F.js";export{c as artifactIdFromPath,i as beginAuth,h as callTool,e as grantsFromIframeSrcs,b as isPrivate,d as readPageContext,a as redact,g as sendRegion,f as sendSnapshot,j as start};
+//# sourceMappingURL=chunk-FBIJZJGL.js.map