@stigmer/react 3.12.6 → 3.12.8

package/src/execution/tool-categories.ts

@@ -32,6 +32,7 @@ export type ToolCategory =
   | "sub-agent"
   | "internal"
   | "mcp"
+  | "memory"
   | "unknown";
 
 /**
@@ -122,6 +123,11 @@ const PREVIEW_CATEGORIES: ReadonlySet<ToolCategory> = new Set<ToolCategory>([
   "mcp",
   "web-search",
   "fetch",
+  // A memory proposal is a decision surface: the verbatim fact and the
+  // Confirm/Reject actions ARE the content — never fold it behind a chevron
+  // (DD-005 D4: a proposal the user scrolled past is caught by the memory
+  // page, but the chip must not hide itself while in view).
+  "memory",
   "unknown",
 ]);
 
@@ -232,6 +238,7 @@ const KIND_DISPLAY: Partial<Record<ToolKind, KindDisplayEntry>> = {
   [ToolKind.THINK]:       { category: "think",     label: "Thinking",  primaryField: "thought" },
   [ToolKind.SUBAGENT]:    { category: "sub-agent", label: "Sub-agent", primaryField: "description", fallbackFields: ["prompt"] },
   [ToolKind.TODO]:        { category: "internal",  label: "Todos",     primaryField: "todos" },
+  [ToolKind.MEMORY]:      { category: "memory",    label: "Remember",  primaryField: "fact" },
 };
 
 /**

package/src/execution/useFileChangeContent.ts

@@ -5,9 +5,14 @@ import type {
   FileChange,
   FileContent,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { execIdFromStorageKey } from "@stigmer/sdk";
 import { useArtifactContent } from "./useArtifactContent.js";
 import { useArtifactDownloadUrl } from "./useArtifactDownloadUrl.js";
 
+// The key-parsing rule lives in @stigmer/sdk with the other shared
+// conversation-assembly rules; re-exported here for existing consumers.
+export { execIdFromStorageKey };
+
 /** Return value of {@link useFileChangeContent}. */
 export interface UseFileChangeContentReturn {
   /**
@@ -135,15 +140,3 @@ function sideText(
   return fetched;
 }
 
-/**
- * Extracts the execution id from an artifact storage key of the form
- * `artifacts/{executionId}/...`. Returns `null` for an unexpected shape so the
- * caller skips the fetch rather than issuing a request the server would reject.
- */
-export function execIdFromStorageKey(storageKey: string): string | null {
-  const parts = storageKey.split("/");
-  if (parts.length >= 3 && parts[0] === "artifacts" && parts[1]) {
-    return parts[1];
-  }
-  return null;
-}

package/src/identity-account/AccountPreferencesPanel.tsx

@@ -18,8 +18,10 @@ import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
 import { useModelRegistry } from "../models/index.js";
 import { HARNESS_META, type HarnessOption } from "../models/harness.js";
 import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
+import { MemoryEnabledRow } from "../internal/MemoryEnabledRow.js";
 import { StandingContextField } from "../internal/StandingContextField.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { Switch } from "../switch/Switch.js";
 
 /** Props for {@link AccountPreferencesPanel}. */
 export interface AccountPreferencesPanelProps {
@@ -32,7 +34,8 @@ export interface AccountPreferencesPanelProps {
 /**
  * Self-contained editor for the current user's declared preferences
  * (`IdentityAccountSpec.preferences`): standing context plus the
- * execution defaults (default harness and per-harness default models).
+ * execution defaults (default harness, per-harness default models, and
+ * the auto-approve default).
  *
  * The declared text is snapshotted into the user's own eligible agent
  * executions and delivered to the agent as background context.
@@ -108,16 +111,26 @@ function AccountPreferencesForm({
     clearError,
   } = useUpdateIdentityAccount();
 
+  // The memory toggle saves instantly (its own hook instance, so a flip's
+  // in-flight/error state never bleeds into the form's Save button).
+  const {
+    update: updateMemoryFlag,
+    isUpdating: isSavingMemoryFlag,
+    error: memoryFlagError,
+  } = useUpdateIdentityAccount();
+
   const [standingContext, setStandingContext] = useState("");
   const [defaultHarness, setDefaultHarness] = useState("");
   const [defaultNativeModel, setDefaultNativeModel] = useState("");
   const [defaultCursorModel, setDefaultCursorModel] = useState("");
+  const [defaultAutoApprove, setDefaultAutoApprove] = useState(false);
 
   const serverPreferences = account?.spec?.preferences;
   const serverStandingContext = serverPreferences?.standingContext ?? "";
   const serverDefaultHarness = serverPreferences?.defaultHarness ?? "";
   const serverDefaultNativeModel = serverPreferences?.defaultNativeModel ?? "";
   const serverDefaultCursorModel = serverPreferences?.defaultCursorModel ?? "";
+  const serverDefaultAutoApprove = serverPreferences?.defaultAutoApprove ?? false;
 
   // Sync the form fields when server data changes.
   useEffect(() => {
@@ -127,6 +140,7 @@ function AccountPreferencesForm({
     setDefaultHarness(prefs?.defaultHarness ?? "");
     setDefaultNativeModel(prefs?.defaultNativeModel ?? "");
     setDefaultCursorModel(prefs?.defaultCursorModel ?? "");
+    setDefaultAutoApprove(prefs?.defaultAutoApprove ?? false);
   }, [account]);
 
   const hasChanges = useMemo(
@@ -134,16 +148,19 @@ function AccountPreferencesForm({
       standingContext.trim() !== serverStandingContext ||
       defaultHarness !== serverDefaultHarness ||
       defaultNativeModel !== serverDefaultNativeModel ||
-      defaultCursorModel !== serverDefaultCursorModel,
+      defaultCursorModel !== serverDefaultCursorModel ||
+      defaultAutoApprove !== serverDefaultAutoApprove,
     [
       standingContext,
       defaultHarness,
       defaultNativeModel,
       defaultCursorModel,
+      defaultAutoApprove,
       serverStandingContext,
       serverDefaultHarness,
       serverDefaultNativeModel,
       serverDefaultCursorModel,
+      serverDefaultAutoApprove,
     ],
   );
 
@@ -154,12 +171,14 @@ function AccountPreferencesForm({
     setDefaultHarness(serverDefaultHarness);
     setDefaultNativeModel(serverDefaultNativeModel);
     setDefaultCursorModel(serverDefaultCursorModel);
+    setDefaultAutoApprove(serverDefaultAutoApprove);
     clearError();
   }, [
     serverStandingContext,
     serverDefaultHarness,
     serverDefaultNativeModel,
     serverDefaultCursorModel,
+    serverDefaultAutoApprove,
     clearError,
   ]);
 
@@ -183,6 +202,7 @@ function AccountPreferencesForm({
             defaultHarness: defaultHarness || undefined,
             defaultNativeModel: defaultNativeModel || undefined,
             defaultCursorModel: defaultCursorModel || undefined,
+            defaultAutoApprove: defaultAutoApprove || undefined,
           },
         });
         refetch();
@@ -198,6 +218,7 @@ function AccountPreferencesForm({
       defaultHarness,
       defaultNativeModel,
       defaultCursorModel,
+      defaultAutoApprove,
       update,
       clearError,
       refetch,
@@ -205,6 +226,30 @@ function AccountPreferencesForm({
     ],
   );
 
+  // The memory consent flag applies instantly (the UX-checkpoint decision):
+  // a consent bit flipped-but-unsaved that silently reverts on navigation is
+  // the failure consent UX must not have. Same wipe-safe double spread.
+  const handleMemoryToggle = useCallback(
+    async (next: boolean) => {
+      if (!account) return;
+      try {
+        const mapped = toIdentityAccountUpdateInput(account);
+        const updated = await updateMemoryFlag({
+          ...mapped,
+          preferences: {
+            ...mapped.preferences,
+            memoryEnabled: next || undefined,
+          },
+        });
+        refetch();
+        onUpdated?.(updated);
+      } catch {
+        // error state is managed by the toggle's own hook instance
+      }
+    },
+    [account, updateMemoryFlag, refetch, onUpdated],
+  );
+
   // -----------------------------------------------------------------------
   // Loading state
   // -----------------------------------------------------------------------
@@ -330,8 +375,50 @@ function AccountPreferencesForm({
             on that harness — even when it isn't your default.
           </p>
         </fieldset>
+
+        {/* Auto-approve default (stigmer/stigmer#816): a client-read seed
+            like the harness/model defaults above — the session panel's
+            Config switch beats it per conversation, and armed sessions
+            always show the "Auto-approving tool calls" strip by the
+            composer. Never applied to guest or observer surfaces. */}
+        <div
+          className={cn(
+            "stg:flex stg:items-start stg:justify-between stg:gap-3 stg:rounded-md stg:border stg:border-input stg:px-3 stg:py-2.5",
+            isUpdating && "stg:opacity-50",
+          )}
+        >
+          <div className="stg:min-w-0">
+            <span
+              id={`${baseId}-default-auto-approve-title`}
+              className="stg:block stg:text-xs stg:font-medium stg:text-foreground"
+            >
+              Auto-approve tool calls
+            </span>
+            <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+              Start your sessions with tool calls running unattended — no
+              approval prompts. Each conversation can turn this off (or on)
+              in its session panel.
+            </p>
+          </div>
+          <Switch
+            checked={defaultAutoApprove}
+            onCheckedChange={setDefaultAutoApprove}
+            disabled={isUpdating}
+            aria-labelledby={`${baseId}-default-auto-approve-title`}
+            className="stg:mt-0.5"
+          />
+        </div>
       </div>
 
+      <MemoryEnabledRow
+        id={`${baseId}-memory-enabled`}
+        checked={account.spec?.preferences?.memoryEnabled ?? false}
+        onToggle={(next) => void handleMemoryToggle(next)}
+        saving={isSavingMemoryFlag}
+        error={memoryFlagError}
+        helperText="When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records. Requires your organization to have memory enabled. Changes apply immediately."
+      />
+
       {updateError && (
         <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
           {getUserMessage(updateError)}

package/src/identity-account/__tests__/AccountPreferencesPanel.test.tsx

@@ -115,6 +115,52 @@ describe("AccountPreferencesPanel", () => {
     expect(input.slug).toBe("ada");
   });
 
+  it("saves the auto-approve default when the toggle is flipped on", async () => {
+    const update = vi.fn(async (_input: IdentityAccountInput) => ACCOUNT);
+    renderPanel(createMockStigmer({ update }));
+
+    await findSyncedField("Keep answers terse.");
+    const toggle = screen.getByRole("switch", { name: "Auto-approve tool calls" });
+    expect(toggle.getAttribute("aria-checked")).toBe("false");
+
+    fireEvent.click(toggle);
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+    expect(input.preferences?.defaultAutoApprove).toBe(true);
+  });
+
+  it("reflects a declared auto-approve default and omits it when turned off", async () => {
+    const armedAccount = create(IdentityAccountSchema, {
+      metadata: { id: "ia-1", name: "Ada Lovelace", slug: "ada", org: "acme" },
+      spec: {
+        idpId: "auth0|abc",
+        email: "ada@acme.example",
+        preferences: { defaultAutoApprove: true },
+      },
+    });
+    const update = vi.fn(async (_input: IdentityAccountInput) => armedAccount);
+    renderPanel(
+      createMockStigmer({ whoAmI: vi.fn(async () => armedAccount), update }),
+    );
+
+    const toggle = await screen.findByRole("switch", {
+      name: "Auto-approve tool calls",
+    });
+    await waitFor(() =>
+      expect(toggle.getAttribute("aria-checked")).toBe("true"),
+    );
+
+    fireEvent.click(toggle);
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    // Only a declared true travels — off is the absent zero value.
+    const input = update.mock.calls[0]![0];
+    expect(input.preferences?.defaultAutoApprove).toBeUndefined();
+  });
+
   it("refetches the account after a successful save", async () => {
     const whoAmI = vi.fn(async () => ACCOUNT);
     renderPanel(createMockStigmer({ whoAmI }));
@@ -137,6 +183,72 @@ describe("AccountPreferencesPanel", () => {
     expect(screen.getByRole("button", { name: "Retry" })).toBeTruthy();
   });
 
+  describe("memory consent (oss#293 Phase 2 Stage 3)", () => {
+    it("memory toggle applies instantly with the full mapped input (wipe-safe)", async () => {
+      const update = vi.fn(async (_input: IdentityAccountInput) => ACCOUNT);
+      renderPanel(createMockStigmer({ update }));
+      await findSyncedField("Keep answers terse.");
+
+      // No Save click: consent applies the moment it is flipped (the
+      // UX-checkpoint decision).
+      fireEvent.click(screen.getByRole("switch", { name: "Memory" }));
+
+      await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+      const input = update.mock.calls[0]![0];
+      expect(input.preferences?.memoryEnabled).toBe(true);
+      // The double spread: the flip preserves every sibling preference…
+      expect(input.preferences?.standingContext).toBe("Keep answers terse.");
+      // …and the identity fields the row never renders.
+      expect(input.id).toBe("ia-1");
+      expect(input.email).toBe("ada@acme.example");
+    });
+
+    it("saving the form preserves memory_enabled (the wipe-hazard regression)", async () => {
+      const accountWithMemoryOn = create(IdentityAccountSchema, {
+        metadata: { id: "ia-1", name: "Ada Lovelace", slug: "ada", org: "acme" },
+        spec: {
+          idpId: "auth0|abc",
+          email: "ada@acme.example",
+          preferences: {
+            standingContext: "Keep answers terse.",
+            memoryEnabled: true,
+          },
+        },
+      });
+      const update = vi.fn(async (_input: IdentityAccountInput) => accountWithMemoryOn);
+      renderPanel(
+        createMockStigmer({ whoAmI: vi.fn(async () => accountWithMemoryOn), update }),
+      );
+
+      const field = await findSyncedField("Keep answers terse.");
+      fireEvent.change(field, { target: { value: "Terser still." } });
+      fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+      await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+      // Update is a full-spec replace: without the nested preferences
+      // spread, this save would silently revoke the memory consent.
+      expect(update.mock.calls[0]![0].preferences?.memoryEnabled).toBe(true);
+    });
+
+    it("reflects the stored flag as the switch state", async () => {
+      const accountWithMemoryOn = create(IdentityAccountSchema, {
+        metadata: { id: "ia-1", name: "Ada", slug: "ada", org: "acme" },
+        spec: {
+          idpId: "auth0|abc",
+          preferences: { memoryEnabled: true },
+        },
+      });
+      renderPanel(createMockStigmer({ whoAmI: vi.fn(async () => accountWithMemoryOn) }));
+      await findSyncedField("");
+
+      await waitFor(() =>
+        expect(
+          screen.getByRole("switch", { name: "Memory" }).getAttribute("aria-checked"),
+        ).toBe("true"),
+      );
+    });
+  });
+
   describe("execution defaults (oss#293 Phase 1.5)", () => {
     const ACCOUNT_WITH_DEFAULTS: IdentityAccount = create(IdentityAccountSchema, {
       metadata: { id: "ia-1", name: "Ada Lovelace", slug: "ada", org: "acme" },

package/src/identity-account/__tests__/useAccountExecutionDefaults.test.tsx

@@ -12,7 +12,7 @@ import { DeploymentModeContext } from "../../deployment-mode";
 import { useAccountExecutionDefaults } from "../useAccountExecutionDefaults";
 
 function accountWithPreferences(
-  preferences: Record<string, string>,
+  preferences: Record<string, string | boolean>,
 ): IdentityAccount {
   return create(IdentityAccountSchema, {
     metadata: { id: "ia-1", name: "Ada", slug: "ada", org: "acme" },
@@ -102,6 +102,39 @@ describe("useAccountExecutionDefaults", () => {
     );
   });
 
+  it("a declared auto-approve default alone counts as a declared default", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({ defaultAutoApprove: true }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() =>
+      expect(result.current).toEqual({
+        harness: undefined,
+        nativeModel: undefined,
+        cursorModel: undefined,
+        autoApprove: true,
+      }),
+    );
+  });
+
+  it("an unset auto-approve bool is no preference, not an explicit false", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({
+        defaultHarness: "native",
+        defaultAutoApprove: false,
+      }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() => expect(result.current?.harness).toBe("native"));
+    expect(result.current?.autoApprove).toBeUndefined();
+  });
+
   it("returns undefined on a whoAmI failure — degrades to platform defaults", async () => {
     const whoAmI = vi.fn(async () => {
       throw new Error("boom");

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -16,6 +16,13 @@ export interface AccountExecutionDefaults {
   readonly nativeModel?: string;
   /** Preferred model for cursor-harness sessions, when declared. */
   readonly cursorModel?: string;
+  /**
+   * Start sessions with "auto-approve tool calls" armed
+   * (`default_auto_approve`, stigmer/stigmer#816). A seed like every other
+   * field here: an explicit in-session flip beats it for that conversation,
+   * and it is never applied to guest/observer surfaces.
+   */
+  readonly autoApprove?: boolean;
 }
 
 /**
@@ -56,8 +63,11 @@ export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefi
         : undefined;
     const nativeModel = prefs.defaultNativeModel || undefined;
     const cursorModel = prefs.defaultCursorModel || undefined;
+    // Only a declared `true` travels — an unset bool is "no preference",
+    // matching the empty-string convention of the fields above.
+    const autoApprove = prefs.defaultAutoApprove || undefined;
 
-    if (!harness && !nativeModel && !cursorModel) return undefined;
-    return { harness, nativeModel, cursorModel };
+    if (!harness && !nativeModel && !cursorModel && !autoApprove) return undefined;
+    return { harness, nativeModel, cursorModel, autoApprove };
   }, [account]);
 }

package/src/index.ts

@@ -139,6 +139,8 @@ export {
   useSessionList,
   useSessionExecutions,
   useSessionConversation,
+  useExportTranscript,
+  TranscriptExportMenu,
   useSessionArtifacts,
   artifactKey,
   useSessionWriteBacks,
@@ -189,6 +191,9 @@ export type {
   UseSessionExecutionsReturn,
   SendFollowUpOptions,
   UseSessionConversationReturn,
+  UseExportTranscriptOptions,
+  UseExportTranscriptReturn,
+  TranscriptExportMenuProps,
   SessionArtifactEntry,
   UseSessionArtifactsReturn,
   SessionWriteBackEntry,
@@ -222,8 +227,14 @@ export type {
   RuntimeEnvProvider,
   SessionAudience,
   SessionPanelMode,
+  // The #664 pinning seam's contract type: SessionViewer/NewSessionViewer/
+  // useNewSessionFlow all accept it, and the docs name it — embedders must
+  // be able to import it from the root (oss#802; the exports map exposes no
+  // ./session subpath on purpose).
+  SessionRunConfig,
   SetupTabProps,
   SetupTabMutationCallbacks,
+  SetupTabAutoApprove,
 } from "./session/index.js";
 
 // Activity — unified recent activity (sessions + workflow executions)
@@ -851,6 +862,32 @@ export type {
   AccountPreferencesPanelProps,
 } from "./identity-account/index.js";
 
+// Memory — agent-proposed, user-confirmed facts: data hook, decision
+// hooks (confirm/reject/delete/edit), grouping helpers, and the list panel
+export {
+  useMemories,
+  useMemory,
+  useConfirmMemory,
+  useRejectMemory,
+  useDeleteMemory,
+  useUpdateMemoryContent,
+  groupMemoriesByLifecycle,
+  formatMemoryProvenance,
+  MemoryListPanel,
+  MemoryProposalCardBody,
+} from "./memory/index.js";
+export type {
+  UseMemoriesReturn,
+  UseMemoryReturn,
+  UseConfirmMemoryReturn,
+  UseRejectMemoryReturn,
+  UseDeleteMemoryReturn,
+  UseUpdateMemoryContentReturn,
+  MemoryGroups,
+  MemoryListPanelProps,
+  MemoryProposalCardBodyProps,
+} from "./memory/index.js";
+
 // IAM Policy — data hooks, behavior hooks, headless hook, and styled components for access management
 export {
   useGrantableRoles,
@@ -1078,6 +1115,7 @@ export { MembersSection } from "./settings/index.js";
 export { OrgProfileSection } from "./settings/index.js";
 export { OrgPreferencesSection } from "./settings/index.js";
 export { AccountPreferencesSection } from "./settings/index.js";
+export { MemorySection } from "./settings/index.js";
 export { EnvironmentsSection } from "./settings/index.js";
 export { InvitationsSection } from "./settings/index.js";
 export { IdentityProvidersSection } from "./settings/index.js";

package/src/internal/MemoryEnabledRow.tsx

@@ -0,0 +1,92 @@
+"use client";
+
+import { cn } from "@stigmer/theme";
+import { getUserMessage } from "@stigmer/sdk";
+import { Switch } from "../switch/Switch.js";
+import { SpinnerIcon } from "./SpinnerIcon.js";
+
+/** Props for {@link MemoryEnabledRow}. */
+export interface MemoryEnabledRowProps {
+  /** Id for the switch control (aria-labelledby wiring). */
+  readonly id: string;
+  /** The stored flag value (server state, or an optimistic pending value). */
+  readonly checked: boolean;
+  /** Fired with the next value when the user flips the switch. */
+  readonly onToggle: (next: boolean) => void;
+  /** `true` while the flip is being saved (switch disabled, spinner shown). */
+  readonly saving: boolean;
+  /** `true` when the caller may not edit the flag (read-only rendering). */
+  readonly readOnly?: boolean;
+  /** Error from the last failed flip, or `null`. */
+  readonly error: Error | null;
+  /**
+   * The scope-specific helper copy (DD-006 D6's transparency statement
+   * belongs here). Rendered under the title, wired as the switch's
+   * accessible description.
+   */
+  readonly helperText: string;
+}
+
+/**
+ * The `memory_enabled` consent toggle — one row, shared verbatim by
+ * {@link OrgPreferencesPanel} and {@link AccountPreferencesPanel} so the
+ * two scopes of the double opt-in (DD-006 D1) present identically.
+ *
+ * INSTANT-APPLY by deliberate exception (UX checkpoint, owner-approved
+ * 2026-08-22): both host panels are save-button forms, but a consent bit
+ * flipped-and-unsaved that silently reverts on navigation is exactly the
+ * failure consent UX must not have — so this row saves the moment it is
+ * flipped, matching the Switch primitive's own contract ("instant binary
+ * changes") and every peer product's memory toggle. The helper copy
+ * states it. Hosts wire `onToggle` to their own full-spec-replace update
+ * and pass the in-flight/error state back down.
+ */
+export function MemoryEnabledRow({
+  id,
+  checked,
+  onToggle,
+  saving,
+  readOnly = false,
+  error,
+  helperText,
+}: MemoryEnabledRowProps) {
+  const titleId = `${id}-title`;
+  const descriptionId = `${id}-description`;
+
+  return (
+    <div className="stg:space-y-1">
+      <div className="stg:flex stg:items-start stg:justify-between stg:gap-3">
+        <div className="stg:min-w-0 stg:flex-1">
+          <span
+            id={titleId}
+            className="stg:block stg:text-xs stg:font-medium stg:text-foreground"
+          >
+            Memory
+          </span>
+          <p
+            id={descriptionId}
+            className="stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground"
+          >
+            {helperText}
+          </p>
+        </div>
+        <span className="stg:flex stg:shrink-0 stg:items-center stg:gap-1.5">
+          {saving && <SpinnerIcon size={12} />}
+          <Switch
+            id={id}
+            checked={checked}
+            onCheckedChange={onToggle}
+            disabled={saving || readOnly}
+            aria-labelledby={titleId}
+            aria-describedby={descriptionId}
+          />
+        </span>
+      </div>
+      {error && (
+        <p className="stg:text-[0.65rem] stg:text-destructive" role="alert">
+          {getUserMessage(error)}
+        </p>
+      )}
+    </div>
+  );
+}

package/src/internal/download.ts

@@ -0,0 +1,29 @@
+// Client-side file download via Blob + object URL + anchor click.
+//
+// The one home of this routine — useExportResource, useExportCSV, and
+// useExportTranscript all download through it. The pattern is proven inside
+// the desktop (Tauri) webview as well as browsers, so SDK components can rely
+// on it without a per-host seam.
+
+/**
+ * Triggers a browser download of `content` as a UTF-8 text file.
+ *
+ * @param mimeType - Bare MIME type (e.g. `"text/markdown"`); the UTF-8
+ * charset is appended here so callers cannot drift on it.
+ */
+export function downloadTextFile(
+  content: string,
+  filename: string,
+  mimeType: string,
+): void {
+  const blob = new Blob([content], { type: `${mimeType};charset=utf-8;` });
+  const url = URL.createObjectURL(blob);
+  const link = document.createElement("a");
+  link.href = url;
+  link.download = filename;
+  link.style.display = "none";
+  document.body.appendChild(link);
+  link.click();
+  document.body.removeChild(link);
+  URL.revokeObjectURL(url);
+}