@tangle-network/agent-app 0.49.38 → 0.50.1

package/dist/{chunk-S3344RBY.js → chunk-RACQDXJ7.js}

@@ -4,13 +4,13 @@ import {
 import {
   persistedPartToWorkProduct
 } from "./chunk-ZVEEWGDK.js";
-import {
-  persistedPartToInteraction
-} from "./chunk-M3K2HVQD.js";
 import {
   persistedPartToPlan,
   planToPersistedPart
 } from "./chunk-YJMCRXQQ.js";
+import {
+  persistedPartToInteraction
+} from "./chunk-M3K2HVQD.js";
 
 // src/chat-store/parts.ts
 function toChatMessageParts(parts) {
@@ -155,4 +155,4 @@ export {
   buildAttachmentPromptBlock,
   historyContentWithAttachments
 };
-//# sourceMappingURL=chunk-S3344RBY.js.map
+//# sourceMappingURL=chunk-RACQDXJ7.js.map

package/dist/{chunk-2WVBGQ2Y.js → chunk-RRWC77YY.js}

@@ -4,7 +4,7 @@ import {
   boundsIntersect,
   elementAabb,
   scaleForPreset
-} from "./chunk-BWQPVS7D.js";
+} from "./chunk-H6XQZFTT.js";
 
 // src/design-canvas-react/engine/snap.ts
 var KIND_PRIORITY = {
@@ -447,4 +447,4 @@ export {
   buildInsertImageOp,
   DEFAULT_INSERT_TEMPLATES
 };
-//# sourceMappingURL=chunk-2WVBGQ2Y.js.map
+//# sourceMappingURL=chunk-RRWC77YY.js.map

package/dist/chunk-TZEEGDHS.js

@@ -0,0 +1,89 @@
+// src/web/message-groups.ts
+function groupConversationMessages(items = []) {
+  let speaker = null;
+  let conversation;
+  let groupId;
+  return items.map((item, index) => {
+    if (item.conversationId !== void 0 && item.conversationId !== conversation) {
+      conversation = item.conversationId;
+      speaker = null;
+      groupId = void 0;
+    }
+    const role = item.kind === "thinking" ? "assistant" : !item.kind || item.kind === "message" ? item.role : void 0;
+    if (role === "user") {
+      speaker = null;
+      groupId = void 0;
+      return { ...item, isContinuation: false };
+    }
+    if (role !== "assistant") return item;
+    const current = item.speakerId ?? "assistant";
+    const isContinuation = speaker === current;
+    if (!isContinuation) groupId = String(item.id ?? `assistant-${index}`);
+    speaker = current;
+    return { ...item, isContinuation, groupId };
+  });
+}
+
+// src/web/api-key-fetch.ts
+function createApiKeyFetch(options) {
+  const origin = new URL(options.origin);
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(origin.hostname);
+  if (origin.username || origin.password || origin.pathname !== "/" || origin.search || origin.hash || origin.protocol !== "https:" && !(origin.protocol === "http:" && loopback && options.allowHttpLoopback)) {
+    throw new TypeError("API origin must be HTTPS without credentials, path, query, or fragment");
+  }
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") throw new TypeError("A fetch implementation is required");
+  const getApiKey = options.getApiKey;
+  return async (path, init = {}) => {
+    if (typeof path !== "string" || !path.startsWith("/") || path.startsWith("//") || /[\\\u0000-\u0020\u007f]/.test(path)) {
+      throw new TypeError("API requests require a root-relative path without whitespace or backslashes");
+    }
+    const target = new URL(path, origin);
+    if (target.origin !== origin.origin || target.username || target.password || target.hash) {
+      throw new TypeError("API requests must stay on the configured origin without a fragment");
+    }
+    const headers = new Headers(init.headers);
+    if (headers.has("authorization") || headers.has("cookie") || headers.has("proxy-authorization")) {
+      throw new TypeError("Authentication headers must come from the configured secret resolver");
+    }
+    init.signal?.throwIfAborted();
+    let apiKey;
+    try {
+      apiKey = await getApiKey();
+    } catch {
+      throw new Error("API credential is unavailable");
+    }
+    if (typeof apiKey !== "string" || !apiKey || /\s|[^\x21-\x7e]/.test(apiKey)) {
+      throw new TypeError("API credential must be a nonempty printable token without whitespace");
+    }
+    init.signal?.throwIfAborted();
+    headers.set("Authorization", `Bearer ${apiKey}`);
+    let response;
+    try {
+      response = await fetchImpl(target.href, {
+        ...init,
+        headers,
+        credentials: "omit",
+        redirect: "manual",
+        referrerPolicy: "no-referrer"
+      });
+    } catch {
+      init.signal?.throwIfAborted();
+      throw new Error("API transport failed; inspect retained state before retrying a write");
+    }
+    if (response.type === "opaqueredirect" || response.redirected || response.status >= 300 && response.status < 400 && response.status !== 304) {
+      try {
+        await response.body?.cancel();
+      } catch {
+      }
+      throw new Error("API redirects are not allowed");
+    }
+    return response;
+  };
+}
+
+export {
+  groupConversationMessages,
+  createApiKeyFetch
+};
+//# sourceMappingURL=chunk-TZEEGDHS.js.map

package/dist/chunk-TZEEGDHS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/web/message-groups.ts","../src/web/api-key-fetch.ts"],"sourcesContent":["/** Renderer-neutral attribution. Not a transcript merger or an execution state machine. */\nexport interface ConversationGroupItem {\n  id?: string | number\n  kind?: string\n  role?: string\n  /** A different assistant/persona must never inherit the previous speaker's label. */\n  speakerId?: string\n  /** Distinct threads must not be grouped if their rows share a viewport. */\n  conversationId?: string\n}\nexport type GroupedConversationItem<T> = T & { isContinuation?: boolean; groupId?: string }\n\n/**\n * Annotate assistant rows until an actual user message, speaker or conversation change.\n * Tool/progress notices do not interrupt the group. The first visible assistant is\n * always labeled, including when a renderer has paged earlier history away.\n * Pass display order; stored content, IDs, timestamps and input objects are untouched.\n */\nexport function groupConversationMessages<T extends ConversationGroupItem>(items: readonly T[] = []): GroupedConversationItem<T>[] {\n  let speaker: string | null = null\n  let conversation: string | undefined\n  let groupId: string | undefined\n  return items.map((item, index) => {\n    if (item.conversationId !== undefined && item.conversationId !== conversation) {\n      conversation = item.conversationId\n      speaker = null\n      groupId = undefined\n    }\n    const role = item.kind === 'thinking' ? 'assistant' : (!item.kind || item.kind === 'message' ? item.role : undefined)\n    if (role === 'user') { speaker = null; groupId = undefined; return { ...item, isContinuation: false } }\n    if (role !== 'assistant') return item\n    const current = item.speakerId ?? 'assistant'\n    const isContinuation = speaker === current\n    if (!isContinuation) groupId = String(item.id ?? `assistant-${index}`)\n    speaker = current\n    return { ...item, isContinuation, groupId }\n  })\n}\n","/** A credential-bearing client for one application origin, not a web fetch tool. */\nexport interface ApiKeyFetchOptions {\n  origin: string\n  /** Resolve from trusted client secret storage; never from an agent's arguments. */\n  getApiKey(): string | Promise<string>\n  fetchImpl?: typeof fetch\n  /** Explicit local-development opt-in; never permits remote plaintext origins. */\n  allowHttpLoopback?: boolean\n}\n\nexport type ApiKeyFetch = (path: string, init?: RequestInit) => Promise<Response>\n\n/** No redirects, cookie fallback, hidden retries, or model-selected credential destination. */\nexport function createApiKeyFetch(options: ApiKeyFetchOptions): ApiKeyFetch {\n  const origin = new URL(options.origin)\n  const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(origin.hostname)\n  if (origin.username || origin.password || origin.pathname !== '/' || origin.search || origin.hash\n    || (origin.protocol !== 'https:' && !(origin.protocol === 'http:' && loopback && options.allowHttpLoopback))) {\n    throw new TypeError('API origin must be HTTPS without credentials, path, query, or fragment')\n  }\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch\n  if (typeof fetchImpl !== 'function') throw new TypeError('A fetch implementation is required')\n  const getApiKey = options.getApiKey\n\n  return async (path, init = {}) => {\n    // Reject URL-parser repairs and authority-relative references before resolving secrets.\n    if (typeof path !== 'string' || !path.startsWith('/') || path.startsWith('//')\n      || /[\\\\\\u0000-\\u0020\\u007f]/.test(path)) {\n      throw new TypeError('API requests require a root-relative path without whitespace or backslashes')\n    }\n    const target = new URL(path, origin)\n    if (target.origin !== origin.origin || target.username || target.password || target.hash) {\n      throw new TypeError('API requests must stay on the configured origin without a fragment')\n    }\n    const headers = new Headers(init.headers)\n    if (headers.has('authorization') || headers.has('cookie') || headers.has('proxy-authorization')) {\n      throw new TypeError('Authentication headers must come from the configured secret resolver')\n    }\n    init.signal?.throwIfAborted()\n    let apiKey: string\n    try {\n      apiKey = await getApiKey()\n    } catch {\n      throw new Error('API credential is unavailable')\n    }\n    if (typeof apiKey !== 'string' || !apiKey || /\\s|[^\\x21-\\x7e]/.test(apiKey)) {\n      throw new TypeError('API credential must be a nonempty printable token without whitespace')\n    }\n    init.signal?.throwIfAborted()\n    headers.set('Authorization', `Bearer ${apiKey}`)\n    let response: Response\n    try {\n      response = await fetchImpl(target.href, {\n        ...init, headers, credentials: 'omit', redirect: 'manual', referrerPolicy: 'no-referrer',\n      })\n    } catch {\n      // A failed transport does not establish that an external action did not run.\n      // Do not forward an adapter's diagnostic, which could include the bearer.\n      init.signal?.throwIfAborted()\n      throw new Error('API transport failed; inspect retained state before retrying a write')\n    }\n    if (response.type === 'opaqueredirect' || response.redirected\n      || (response.status >= 300 && response.status < 400 && response.status !== 304)) {\n      try { await response.body?.cancel() } catch { /* Preserve the redirect refusal. */ }\n      throw new Error('API redirects are not allowed')\n    }\n    return response\n  }\n}\n"],"mappings":";AAkBO,SAAS,0BAA2D,QAAsB,CAAC,GAAiC;AACjI,MAAI,UAAyB;AAC7B,MAAI;AACJ,MAAI;AACJ,SAAO,MAAM,IAAI,CAAC,MAAM,UAAU;AAChC,QAAI,KAAK,mBAAmB,UAAa,KAAK,mBAAmB,cAAc;AAC7E,qBAAe,KAAK;AACpB,gBAAU;AACV,gBAAU;AAAA,IACZ;AACA,UAAM,OAAO,KAAK,SAAS,aAAa,cAAe,CAAC,KAAK,QAAQ,KAAK,SAAS,YAAY,KAAK,OAAO;AAC3G,QAAI,SAAS,QAAQ;AAAE,gBAAU;AAAM,gBAAU;AAAW,aAAO,EAAE,GAAG,MAAM,gBAAgB,MAAM;AAAA,IAAE;AACtG,QAAI,SAAS,YAAa,QAAO;AACjC,UAAM,UAAU,KAAK,aAAa;AAClC,UAAM,iBAAiB,YAAY;AACnC,QAAI,CAAC,eAAgB,WAAU,OAAO,KAAK,MAAM,aAAa,KAAK,EAAE;AACrE,cAAU;AACV,WAAO,EAAE,GAAG,MAAM,gBAAgB,QAAQ;AAAA,EAC5C,CAAC;AACH;;;ACxBO,SAAS,kBAAkB,SAA0C;AAC1E,QAAM,SAAS,IAAI,IAAI,QAAQ,MAAM;AACrC,QAAM,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,OAAO,QAAQ;AAC7E,MAAI,OAAO,YAAY,OAAO,YAAY,OAAO,aAAa,OAAO,OAAO,UAAU,OAAO,QACvF,OAAO,aAAa,YAAY,EAAE,OAAO,aAAa,WAAW,YAAY,QAAQ,oBAAqB;AAC9G,UAAM,IAAI,UAAU,wEAAwE;AAAA,EAC9F;AACA,QAAM,YAAY,QAAQ,aAAa,WAAW;AAClD,MAAI,OAAO,cAAc,WAAY,OAAM,IAAI,UAAU,oCAAoC;AAC7F,QAAM,YAAY,QAAQ;AAE1B,SAAO,OAAO,MAAM,OAAO,CAAC,MAAM;AAEhC,QAAI,OAAO,SAAS,YAAY,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,IAAI,KACxE,0BAA0B,KAAK,IAAI,GAAG;AACzC,YAAM,IAAI,UAAU,6EAA6E;AAAA,IACnG;AACA,UAAM,SAAS,IAAI,IAAI,MAAM,MAAM;AACnC,QAAI,OAAO,WAAW,OAAO,UAAU,OAAO,YAAY,OAAO,YAAY,OAAO,MAAM;AACxF,YAAM,IAAI,UAAU,oEAAoE;AAAA,IAC1F;AACA,UAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,QAAI,QAAQ,IAAI,eAAe,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,qBAAqB,GAAG;AAC/F,YAAM,IAAI,UAAU,sEAAsE;AAAA,IAC5F;AACA,SAAK,QAAQ,eAAe;AAC5B,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,UAAU;AAAA,IAC3B,QAAQ;AACN,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,QAAI,OAAO,WAAW,YAAY,CAAC,UAAU,kBAAkB,KAAK,MAAM,GAAG;AAC3E,YAAM,IAAI,UAAU,sEAAsE;AAAA,IAC5F;AACA,SAAK,QAAQ,eAAe;AAC5B,YAAQ,IAAI,iBAAiB,UAAU,MAAM,EAAE;AAC/C,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,UAAU,OAAO,MAAM;AAAA,QACtC,GAAG;AAAA,QAAM;AAAA,QAAS,aAAa;AAAA,QAAQ,UAAU;AAAA,QAAU,gBAAgB;AAAA,MAC7E,CAAC;AAAA,IACH,QAAQ;AAGN,WAAK,QAAQ,eAAe;AAC5B,YAAM,IAAI,MAAM,sEAAsE;AAAA,IACxF;AACA,QAAI,SAAS,SAAS,oBAAoB,SAAS,cAC7C,SAAS,UAAU,OAAO,SAAS,SAAS,OAAO,SAAS,WAAW,KAAM;AACjF,UAAI;AAAE,cAAM,SAAS,MAAM,OAAO;AAAA,MAAE,QAAQ;AAAA,MAAuC;AACnF,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-KWN5PGXM.js → chunk-YJYPXMDL.js}

@@ -13,13 +13,13 @@ import {
   setPageGuidesCommand,
   setPagePropsCommand,
   ungroupElementCommand
-} from "./chunk-FEVVF6JJ.js";
+} from "./chunk-HQ7R6CGM.js";
 import {
   SIZE_PRESETS,
   findElement,
   matchPreset,
   requirePage
-} from "./chunk-BWQPVS7D.js";
+} from "./chunk-H6XQZFTT.js";
 
 // src/design-canvas-react/components/DesignCanvas.tsx
 import { useCallback as useCallback2, useEffect as useEffect3, useMemo, useRef as useRef5, useState as useState5, useSyncExternalStore } from "react";
@@ -2261,4 +2261,4 @@ export {
   ExportControl,
   DesignCanvas
 };
-//# sourceMappingURL=chunk-KWN5PGXM.js.map
+//# sourceMappingURL=chunk-YJYPXMDL.js.map

package/dist/design-canvas/index.js

@@ -31,12 +31,13 @@ import {
   validateSceneOperation,
   validateSceneOperations,
   validateSlotValue
-} from "../chunk-BWQPVS7D.js";
+} from "../chunk-H6XQZFTT.js";
 import {
   buildScopedMcpServerEntry,
   createMcpToolHandler
 } from "../chunk-6A7MYOUI.js";
-import "../chunk-EA4UVS4T.js";
+import "../chunk-TZEEGDHS.js";
+import "../chunk-3NCPXNBZ.js";
 import "../chunk-TXD5HXLE.js";
 
 // src/design-canvas/operations.ts