@unoverse-platform/studio 0.1.103 → 0.1.104

package/vendor/sdk/lib/connection.tsx

@@ -1,433 +0,0 @@
-/**
- * useUnoverseConnection — the CHANNEL's data-plane connector (MCP stream).
- *
- * Opens the live workflow connection to the Unoverse server's `/stream` MCP endpoint
- * (Streamable-HTTP SSE) for the inbound component stream, and REST `…/execute` for
- * sending messages. Inbound `notifications/unoverse/event` messages feed the single
- * `ComponentStore` via the pure `applyServerMessage` mapper.
- *
- * Per UNOVERSE_MCP_APP_PROTOCOL.md §5/§5a/§5b: the component stream rides MCP
- * (NOT the legacy `/ws/gravity` WS — that's reserved for live audio). The node
- * executes in the same Unoverse process that serves this stream, so there's no
- * gateway relay and no Redis in the component path.
- */
-import { useCallback, useEffect, useRef, useState, useSyncExternalStore } from "react";
-import { emitAnalytics } from "./core/analytics";
-import { applyServerMessage, viewOf, type ComponentStore, type ServerMessage } from "./core";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-// Interpreter-based JSON-schema validator (no `new Function`). The SDK's default Ajv
-// provider compiles schemas with `new Function`, which ChatGPT's widget CSP (no
-// unsafe-eval) blocks — that crashed the in-iframe MCP client on boot and left the
-// widget blank. CfWorker is the SDK's own edge/no-eval provider.
-import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
-import { ElicitRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-
-export interface UnoverseConnectionConfig {
-  /** Gravity API base, e.g. "http://localhost:4100". REST execute lives here. */
-  apiUrl: string;
-  /** Unoverse server base, e.g. "http://localhost:4105" (or the workbench origin in
-   *  dev). The `/stream` MCP data-plane endpoint (§5b) is appended. */
-  streamUrl: string;
-  /** Optional JWT provider — the token rides the MCP transport fetch + REST Authorization header. */
-  getAccessToken?: () => Promise<string | null>;
-}
-
-export interface UnoverseSessionParams {
-  workflowId: string;
-  targetTriggerNode: string;
-  userId: string;
-  conversationId: string;
-  /** Groups one request→response turn. Defaults to conversationId if omitted. */
-  chatId?: string;
-  /** The app this session shows (`<org>/<name>`). The server draws an app that declares places
-   *  from its screen document (docs/unoverse/design/screen/UNOVERSE_SCREEN.md). */
-  appId?: string;
-}
-
-export interface UnoverseConnection {
-  isConnected: boolean;
-  isReady: boolean;
-  /** The server's refusal text when register_session answered isError (public-entry
-   *  gate, requires.role, stale token) — null while unrefused. A refusal is TERMINAL
-   *  for the attempt (the server has answered; retrying the same identity loops), so
-   *  hosts must surface this instead of showing "connecting" forever. Cleared when a
-   *  new connect sequence starts. */
-  refusal: string | null;
-  /** Composer target: optimistic user turn + REST workflow trigger. */
-  sendMessage: (text: string) => void;
-  /** Fire the bound workflow WITHOUT a user turn — the "load → run the workflow" ping
-   *  (its component streams back into the shell). `input` shapes the execute payload per
-   *  the app's `inputSchema`; omit for a bare trigger. (§5b REST `/execute`; the future
-   *  MCP-native form is a `tools/call` on the InputTrigger tool, same call site.) */
-  trigger: (input?: Record<string, unknown>) => void;
-  /** Other component actions (button clicks, etc.) → MCP `user_action` tool. */
-  sendAction: (action: string, data: Record<string, unknown>) => void;
-  /** Answer a pending ELICITATION with the submitted component state (the native
-   *  collection path — §3.3). Returns false when no elicitation is pending (the
-   *  channel then falls back to `sendAction`). */
-  resolveElicitation: (state: Record<string, unknown>, action?: "accept" | "cancel") => boolean;
-  /** The workflow-selected template (MCP app) name, or null. The channel renders
-   *  `unoverse://apps/{activeApp}/definition` when set — the official resources/read load. */
-  activeApp: string | null;
-}
-
-/** The data-plane endpoint on the Unoverse server (§5b). */
-const STREAM_ENDPOINT = "/stream";
-/** Custom notification carrying one ServerMessage as `params` (§5b). */
-const UNOVERSE_EVENT = "notifications/unoverse/event";
-
-/**
- * Guest identity — CONTAINED HERE so hosts never write guest logic. A token-less
- * session is a GUEST to the platform's public-entry gate, which only admits
- * `guest-`-prefixed ids (Run Authorization, docs/auth-security/IDENTITY.md). Minted once per
- * browser and persisted so the visitor's conversation and memory cohere across
- * reloads. A host that supplies its own guest id wins (two apps in one page share
- * one visitor); a host with a token is untouched.
- */
-const GUEST_KEY = "unoverse:guestId";
-export function resolveGuestId(): string {
-  let id: string | null = null;
-  try {
-    id = localStorage.getItem(GUEST_KEY);
-  } catch {
-    /* storage blocked → per-load guest below */
-  }
-  if (!id || !/^guest[-:]/.test(id)) {
-    id = `guest-${crypto.randomUUID()}`;
-    try {
-      localStorage.setItem(GUEST_KEY, id);
-    } catch {
-      /* fine: the id just won't survive a reload */
-    }
-  }
-  return id;
-}
-
-/**
- * THE ONE IDENTITY RULE for every lane the SDK opens: with a token the host's userId passes
- * through; without one the platform sees a guest and requires a guest-prefixed id, so a
- * host-supplied guest id wins and anything else is replaced by the stored guest id. The data
- * plane and the audio lane both call this, so a page never speaks with two names.
- */
-export function sessionUserId(userId: string | undefined, getAccessToken: unknown): string {
-  return getAccessToken || /^guest[-:]/.test(userId ?? "") ? (userId as string) : resolveGuestId();
-}
-
-export function useUnoverseConnection(
-  config: UnoverseConnectionConfig,
-  session: UnoverseSessionParams,
-  store: ComponentStore,
-  options: { enabled?: boolean; onAppSwitch?: (app: string) => void; onJoinCall?: (workflowId?: string) => void } = {},
-): UnoverseConnection {
-  const enabled = options.enabled ?? true;
-  // Read through a ref so a host's inline arrow does not tear down the stream on
-  // every render — the connection effect must not depend on the callback's identity.
-  const onAppSwitchRef = useRef(options.onAppSwitch);
-  onAppSwitchRef.current = options.onAppSwitch;
-  const onAppSwitch = (app: string) => onAppSwitchRef.current?.(app);
-  const onJoinCallRef = useRef(options.onJoinCall);
-  onJoinCallRef.current = options.onJoinCall;
-  // Read through a ref too: the server follows app switches itself, so a new app must not
-  // tear the stream down; the next registration simply names it.
-  const appIdRef = useRef(session.appId);
-  appIdRef.current = session.appId;
-  const { streamUrl, getAccessToken } = config;
-  const { workflowId, targetTriggerNode, conversationId } = session;
-  // No token ⇒ the platform sees a GUEST session and requires a guest-prefixed id —
-  // supply one automatically (host-supplied guest ids win; with a token the host's
-  // real userId passes through untouched). This is the whole guest story for a host.
-  const userId = sessionUserId(session.userId, getAccessToken);
-  const chatId = session.chatId ?? conversationId;
-
-  const [isConnected, setIsConnected] = useState(false);
-  const [isReady, setIsReady] = useState(false);
-  const [refusal, setRefusal] = useState<string | null>(null);
-  const clientRef = useRef<Client | null>(null);
-  // First-seen component keys for this connection (repeat INIT → props merge).
-  const seenRef = useRef<Set<string>>(new Set());
-  // The pending elicitation's resolver (one at a time per session) — set while the
-  // server is asking this session for structured input; the channel's submit branch
-  // answers it via `resolveElicitation`.
-  const pendingElicitRef = useRef<((state: Record<string, unknown>, action: "accept" | "cancel") => void) | null>(null);
-
-  // ---- connection lifecycle (MCP stream) ----
-  useEffect(() => {
-    if (!enabled) return; // mock mode — no live stream
-    // No workflowId is fine: a page app with none still hears its conversation (the server
-    // takes a signed-in session without one; a guest's still needs a public trigger).
-    if (!userId || !conversationId) {
-      console.warn("[unoverse] connection missing userId/conversationId");
-      return;
-    }
-    let cancelled = false;
-    let attempt = 0;
-    let retryTimer: ReturnType<typeof setTimeout> | null = null;
-    // Kept ACROSS reconnects on purpose: after a re-bind the server may re-push
-    // components this session already placed, and a repeat INIT on a seen key merges
-    // props instead of re-placing (applyServerMessage) — the screen never jumps.
-    seenRef.current = new Set();
-
-    /**
-     * SESSION-DEATH RECOVERY (the MCP spec's own rule): a session id the server no
-     * longer knows answers 404, and the client MUST start a NEW session rather than
-     * mourn the old one. Sessions are process memory server-side, so every restart —
-     * a dev edit, a prod deploy — orphans every open channel; before this, the error
-     * was logged once ("stream connect failed" / "client error") and the surface sat
-     * disconnected forever. Now ANY client error recycles the whole client and
-     * re-runs the connect sequence with backoff: register_session is idempotent, a
-     * re-bind emits SESSION_READY, and mount-reads re-hydrate state, so downstream
-     * already copes. Blunt on purpose — a transport error we fail to recognise as
-     * session death costs one spurious reconnect, while one we miss is a dead screen.
-     */
-    const recycle = (dead: Client, why: unknown) => {
-      // Only the CURRENT client may trigger recovery: a dying client's teardown fires
-      // stray errors (observed: four AbortErrors in one restart) and each would
-      // otherwise schedule its own storm of reconnects.
-      if (cancelled || clientRef.current !== dead) return;
-      clientRef.current = null;
-      void dead.close().catch(() => {});
-      setIsConnected(false);
-      setIsReady(false);
-      const delay = Math.min(15_000, 500 * 2 ** Math.min(attempt++, 5));
-      console.warn(`[unoverse] session lost — reconnecting in ${delay}ms (attempt ${attempt})`, why);
-      retryTimer = setTimeout(() => void connect(), delay);
-    };
-
-    const connect = async () => {
-      if (cancelled) return;
-      // Declare the ELICITATION capability (form mode) — the native collection path
-      // (UNOVERSE_MCP_APP_PROTOCOL §3.3): the server pauses inside an app tool
-      // call and asks THIS session for the user's structured input. The interactive
-      // component already on screen IS the form; its `submit` answers the elicitation.
-      const client = new Client(
-        { name: "unoverse-channel", version: "0.0.1" },
-        { capabilities: { elicitation: {} }, jsonSchemaValidator: new CfWorkerJsonSchemaValidator() },
-      );
-      client.setRequestHandler(ElicitRequestSchema, async (req) => {
-        // Pend until the user submits the component (the channel calls resolveElicitation
-        // from its submit branch). The branded UI renders the request — never a generic form.
-        // The accept content MUST match the requestedSchema (spec: flat primitives only) —
-        // project the submitted component state to the REQUESTED keys, or the SDK rejects
-        // the response (view-state like a `courses` array fails the primitive union).
-        const requested =
-          (req.params as unknown as { requestedSchema?: { properties?: Record<string, unknown> } }).requestedSchema?.properties ?? {};
-        return await new Promise((resolve) => {
-          pendingElicitRef.current = (state: Record<string, unknown>, action: "accept" | "cancel") => {
-            pendingElicitRef.current = null;
-            if (action === "cancel") return resolve({ action: "cancel" } as never);
-            const content: Record<string, unknown> = {};
-            for (const k of Object.keys(requested)) if (state[k] !== undefined) content[k] = state[k];
-            resolve({ action: "accept", content } as never);
-          };
-        });
-      });
-      // The SDK fire-and-forgets the standalone GET SSE open on `initialized`; a failure
-      // lands ONLY here. This is also where a dead session surfaces mid-life (the SDK's
-      // own GET reconnect meets the restarted server's 404) — so it feeds recovery.
-      client.onerror = (e) => {
-        // TEARDOWN NOISE, not an error: closing a client aborts its SSE streams and the
-        // SDK reports every abort here. When the close was OURS (effect cleanup on an
-        // app switch, or a recycle that already replaced this client), a red error log
-        // reads as breakage — it made a clean app switch look like a failure (observed
-        // live 2026-08-16). Quiet log, no recovery; a live client's errors still recycle.
-        if (cancelled || clientRef.current !== client) {
-          // eslint-disable-next-line no-console
-          console.debug("[unoverse] client closed:", (e as Error)?.message ?? e);
-          return;
-        }
-        console.error("[unoverse] client error:", e);
-        recycle(client, e);
-      };
-      clientRef.current = client;
-
-      // The server pushes the live stream as `notifications/unoverse/event` over the
-      // GET SSE channel. Custom notification methods land on the fallback handler —
-      // route their `params` (one ServerMessage) into the store.
-      client.fallbackNotificationHandler = async (notification) => {
-        if (notification.method !== UNOVERSE_EVENT) return;
-        const msg = (notification.params ?? {}) as unknown as ServerMessage;
-        if ((msg as { type?: string }).type === "SESSION_READY") {
-          setIsReady(true);
-          return;
-        }
-        // A manifest-declared analytics moment, resolved SERVER-side beside the lifecycle
-        // hook that shares it (componentLifecycle.ts). The SDK adds nothing and decides
-        // nothing here: it hands the event to the same sink every node-attached emit uses,
-        // and the host realm delivers or drops it. News, never instruction — it does not
-        // touch the store.
-        const evt = msg as unknown as { type?: string; event?: string; params?: Record<string, unknown> };
-        if (evt.type === "ANALYTICS_EVENT") {
-          if (typeof evt.event === "string" && evt.event) emitAnalytics(evt.event, evt.params ?? {});
-          return;
-        }
-        // AN APP SWAP IS THE HOST'S CALL, not the renderer's. Handed straight out, like
-        // ANALYTICS_EVENT above and for the same reason: it does not touch the store —
-        // the conversation and everything already on screen survive a swap, which is the
-        // whole point of swapping rather than starting again. The host re-points its one
-        // engine (appEngine.tsx); a host that ignores this simply stays where it is.
-        if (evt.type === "APP_SWITCH") {
-          const next = (msg as unknown as { app?: unknown }).app;
-          if (typeof next === "string" && next) onAppSwitch?.(next);
-          return;
-        }
-        // A VOICE IN THE WORKFLOW ASKS THE PAGE TO JOIN (VOICE_STREAMING_GUIDE.md, "Call
-        // Initialization"). The host's voice service joins; a host without one ignores it.
-        if (evt.type === "JOIN_CALL") {
-          const workflowId = (msg as unknown as { workflowId?: unknown }).workflowId;
-          onJoinCallRef.current?.(typeof workflowId === "string" ? workflowId : undefined);
-          return;
-        }
-        applyServerMessage(store, msg, seenRef.current);
-      };
-
-      // Inject the bearer on every underlying request (fresh per call → refresh-safe).
-      // ALWAYS wrapped: dev tunnels need the ngrok bypass header, token or not
-      // (ngrok free interstitial = 200 HTML no CORS = dead /stream in sandboxed
-      // hosts; header is hostname-gated so prod requests are untouched).
-      const authFetch = async (url: string | URL, init?: RequestInit): Promise<Response> => {
-        const token = getAccessToken ? await getAccessToken() : undefined;
-        const headers = new Headers(init?.headers);
-        if (token) headers.set("Authorization", `Bearer ${token}`);
-        if (String(url).includes("ngrok")) headers.set("ngrok-skip-browser-warning", "true");
-        return fetch(url, { ...init, headers });
-      };
-      try {
-        const transport = new StreamableHTTPClientTransport(
-          new URL(`${streamUrl}${STREAM_ENDPOINT}`),
-          { fetch: authFetch },
-        );
-        await client.connect(transport);
-        if (cancelled || clientRef.current !== client) {
-          await client.close().catch(() => {});
-          return;
-        }
-        setIsConnected(true);
-        setRefusal(null); // a fresh attempt owns a fresh verdict
-        // Bind this stream to the session — the server then pushes the live component
-        // stream and an immediate SESSION_READY.
-        const bind = await client.callTool({
-          name: "register_session",
-          arguments: { userId, conversationId, workflowId, targetTriggerNode, chatId, ...(appIdRef.current ? { appId: appIdRef.current } : {}) },
-        });
-        // A refusal (public-entry gate, requires.role, …) is an isError tool RESULT,
-        // not a thrown error — surface it and STOP, never retry: the server has
-        // answered, and re-asking with the same identity is a polite way to loop
-        // (the server logs the same refusal as REFUSED:). The reason is kept as state,
-        // not just logged: a console.error alone left the host chip on "Connecting…"
-        // forever with the cause visible to nobody (observed live 2026-08-16).
-        if ((bind as { isError?: boolean }).isError) {
-          const c = (bind as { content?: Array<{ type?: string; text?: string }> }).content;
-          const reason = c?.[0]?.text ?? "unauthorized";
-          console.error("[unoverse] session refused:", reason);
-          setRefusal(reason);
-          return;
-        }
-        // A completed re-bind is health — the next death starts its backoff fresh.
-        attempt = 0;
-      } catch (e) {
-        if (cancelled) return;
-        console.error("[unoverse] stream connect failed", e);
-        recycle(client, e);
-      }
-    };
-
-    void connect();
-
-    return () => {
-      cancelled = true;
-      if (retryTimer !== null) clearTimeout(retryTimer);
-      setIsConnected(false);
-      setIsReady(false);
-      setRefusal(null);
-      void clientRef.current?.close().catch(() => {});
-      clientRef.current = null;
-    };
-  }, [enabled, streamUrl, workflowId, targetTriggerNode, userId, conversationId, chatId, getAccessToken, store]);
-
-  // ---- turn identity ----
-  // `conversationId` names the CONVERSATION (session addressing, agent memory,
-  // elicitation); `chatId` names ONE TURN (the store's response identity — every
-  // component of a turn keys `chatId:nodeId`). The channel MINTS a fresh turn id per
-  // outbound send; the `<conversationId>:t…` prefix keeps conversation-scoped waiter
-  // resolution (elicitation accept) matching turn-scoped node waiters.
-  const mintTurn = useCallback(
-    () => `${chatId}:t${Date.now().toString(36)}${Math.floor(Math.random() * 1296).toString(36)}`,
-    [chatId],
-  );
-
-  // ---- outbound: fire the bound workflow over REST (§5b /execute) ----
-  // No user turn — this is the raw trigger. `sendMessage` layers a user turn on top.
-  const trigger = useCallback(
-    (input?: Record<string, unknown>, turnId?: string) => {
-      const turn = turnId ?? mintTurn();
-      (async () => {
-        // NATIVE MCP: fire the run via a `tools/call` on the live /stream session — NOT
-        // the retired REST `/api/workflows/:id/execute` (UNOVERSE_MCP_APP_PROTOCOL
-        // §0.3). Fire-and-forget: the run's UI streams back over this same session; the
-        // caller's token rides the connection (server reads it from extra.authInfo).
-        const client = clientRef.current;
-        if (!client) {
-          console.error("[unoverse] trigger dropped — MCP stream not connected yet");
-          return;
-        }
-        // Same `input` envelope the REST route received (server unwraps it 1:1).
-        const inputEnvelope = { chatId: turn, conversationId, userId, providerId: "gravity-ds", metadata: { targetTriggerNode }, ...input };
-        try {
-          await client.callTool({ name: "trigger", arguments: { workflowId, conversationId, input: inputEnvelope } });
-        } catch (e) {
-          console.error("[unoverse] trigger failed", e);
-        }
-      })();
-    },
-    [workflowId, targetTriggerNode, userId, conversationId, mintTurn],
-  );
-
-  // ---- outbound: send a message (optimistic user turn + trigger) ----
-  const sendMessage = useCallback(
-    (text: string) => {
-      const message = text.trim();
-      if (!message) return;
-      const turn = mintTurn();
-      store.addUserMessage(turn, message); // optimistic user turn
-      // The answer opens under the message that asked for it. What is on screen is the
-      // SERVER's fact (the standing set, the open pages); the send carries nothing about it.
-      const run = turn;
-      // Optimistically open the assistant turn too, so the avatar + thinking dots
-      // appear IMMEDIATELY on send instead of waiting for the backend's
-      // WORKFLOW_STARTED. startResponse is idempotent — the later WORKFLOW_STARTED
-      // (and the first COMPONENT_INIT) reuse this same turn (responseFor by chatId).
-      store.startResponse(run);
-      trigger({ message }, run);
-    },
-    [mintTurn, store, trigger],
-  );
-
-  // ---- outbound: generic component action → MCP `user_action` tool ----
-  const sendAction = useCallback(
-    (action: string, data: Record<string, unknown>) => {
-      void clientRef.current
-        ?.callTool({ name: "user_action", arguments: { action, data, userId, conversationId, chatId } })
-        .catch((e) => console.error("[unoverse] user_action failed", e));
-    },
-    [userId, conversationId, chatId],
-  );
-
-  // The workflow-selected template, reactively (a primitive snapshot so the store
-  // subscription doesn't loop). The channel renders it via resources/read.
-  // Stable subscribe fn — an inline arrow re-subscribes every render.
-  const activeApp = useSyncExternalStore(
-    useCallback((cb) => store.subscribe(cb), [store]),
-    useCallback(() => store.getActiveApp().name, [store]),
-  );
-
-  // Answer a pending elicitation with the submitted component state (native path).
-  const resolveElicitation = useCallback((state: Record<string, unknown>, action: "accept" | "cancel" = "accept"): boolean => {
-    const pending = pendingElicitRef.current;
-    if (!pending) return false;
-    pending(state, action);
-    return true;
-  }, []);
-
-  return { isConnected, isReady, refusal, sendMessage, trigger, sendAction, resolveElicitation, activeApp };
-}

package/vendor/sdk/lib/isolate.tsx

@@ -1,70 +0,0 @@
-/**
- * <IsolatedRoot> — mounts `children` inside an open Shadow DOM for complete CSS isolation.
- *
- * The SDK is the renderer for EVERY consumer (the canvas node preview, the live channel,
- * the workbench, external host apps), so the isolation boundary lives HERE — once — rather
- * than being bolted onto each host (today only the canvas wraps; the channel renders
- * unprotected, so page styles and component styles leak both ways).
- *
- * Why a portal, not a nested React root: `createPortal` renders into the shadow root while
- * keeping the SAME React tree/context, so the SDK's client/store/theme context still flows
- * to the rendered components. A separate `createRoot` would sever that.
- *
- * Web-only — this file lives in `unoverse-react`, never in the framework-agnostic core
- * (Flutter/Swift have no DOM). Token VALUES are already resolved inline by the renderer, so
- * concrete styles work unchanged inside the shadow root; only inherited typography needs the
- * reset below, after which the served `theme.root` is the sole typographic baseline.
- */
-import { useEffect, useRef, useState, type CSSProperties, type ReactNode } from "react";
-import { createPortal } from "react-dom";
-
-// Shadow DOM blocks style SELECTORS but NOT inheritance: inherited properties (font, colour,
-// line-height, letter-spacing) still pierce the boundary, and <button>/<input> fall back to
-// the UA font. `:host { all: initial }` neutralizes the inherited cascade; `display: contents`
-// keeps the host out of layout (the consumer owns the outer box). The themed child the SDK
-// passes in (theme.root) then re-establishes the design-system typography.
-const RESET_CSS = `
-  :host { all: initial; display: contents; }
-  .uno-isolate-root { box-sizing: border-box; }
-  .uno-isolate-root *, .uno-isolate-root *::before, .uno-isolate-root *::after { box-sizing: border-box; }
-  .uno-isolate-root button, .uno-isolate-root input, .uno-isolate-root textarea, .uno-isolate-root select {
-    font: inherit; letter-spacing: inherit; color: inherit; margin: 0;
-  }
-  /* Scrollbars hidden by default across every scroll container — scrolling still works,
-     the bar is just not painted. Generic chrome that design definitions can't author per-node (pseudo-
-     elements), so it lives with the structural reset. */
-  .uno-isolate-root * { scrollbar-width: none; }
-  .uno-isolate-root *::-webkit-scrollbar { width: 0; height: 0; display: none; }
-`;
-
-export function IsolatedRoot({ children, rootStyle }: { children: ReactNode; rootStyle?: CSSProperties }) {
-  const hostRef = useRef<HTMLDivElement>(null);
-  const [shadow, setShadow] = useState<ShadowRoot | null>(null);
-
-  useEffect(() => {
-    const host = hostRef.current;
-    if (!host) return;
-    // Reuse an existing shadow root across re-mounts (attachShadow throws if called twice).
-    setShadow(host.shadowRoot ?? host.attachShadow({ mode: "open" }));
-  }, []);
-
-  return (
-    <div ref={hostRef} style={{ display: "contents" }}>
-      {shadow &&
-        createPortal(
-          <>
-            <style>{RESET_CSS}</style>
-            {/* Apply the served DS render-root (theme.root: font family/size/weight/line-height/
-                colour + smoothing) DIRECTLY to this REAL container — not a `display:contents`
-                wrapper, whose inherited-font cascade is unreliable inside a shadow root. This is
-                the Unoverse equivalent of the legacy `.gravity-component` baseline, so every node
-                in the tree inherits the design-system typography. */}
-            <div className="uno-isolate-root" style={rootStyle}>
-              {children}
-            </div>
-          </>,
-          shadow as unknown as Element,
-        )}
-    </div>
-  );
-}

package/vendor/sdk/lib/orb/ThinkingOrb.tsx

@@ -1,131 +0,0 @@
-// The ThinkingOrb component. One shared clock (performance.now) keeps
-// every mounted orb in phase; each instance runs its own rAF loop but
-// pauses automatically while offscreen (IntersectionObserver) or when
-// the tab is hidden (visibilitychange). Reduced-motion users get a
-// static representative frame that still follows the live theme.
-
-import { useEffect, useRef } from 'react';
-import { MODE_DRAWS } from './engine/registry';
-import { setInk } from './engine/core';
-import { resolvePreset } from './presets';
-import { useReducedMotion, useResolvedDark } from './theme';
-import type { OrbSize, ThinkingOrbProps } from './types';
-
-const LABELS: Record<string, string> = {
-  working: 'Working…',
-  searching: 'Searching…',
-  solving: 'Solving…',
-  listening: 'Listening…',
-  connecting: 'Connecting…',
-  weaving: 'Weaving…',
-  composing: 'Composing…',
-  breathing: 'Thinking…',
-  shaping: 'Shaping…',
-  halo: 'Waiting…',
-  sonar: 'Listening…',
-  shimmer: 'Thinking…',
-  pulse: 'Responding…'
-};
-
-export function ThinkingOrb({
-  state = 'working',
-  size = 64,
-  theme = 'auto',
-  speed = 1,
-  paused = false,
-  ink = null,
-  style,
-  'aria-label': ariaLabel,
-  ...rest
-}: ThinkingOrbProps & { ink?: [number, number, number] | null }) {
-  const ref = useRef<HTMLCanvasElement | null>(null);
-  const dark = useResolvedDark(theme, ref);
-  const reduced = useReducedMotion();
-
-  useEffect(() => {
-    const canvas = ref.current;
-    if (!canvas) return;
-    const dpr = Math.min(2, (typeof devicePixelRatio !== 'undefined' && devicePixelRatio) || 1);
-    canvas.width = Math.round(size * dpr);
-    canvas.height = Math.round(size * dpr);
-    const ctx = canvas.getContext('2d');
-    if (!ctx) return;
-
-    // LOCAL EXTENSION (Unoverse): `size` is any positive number — the canvas and
-    // draw run at the true size (the engine's radiusScale compensates), while the
-    // TUNING snaps to the nearest of the two baked presets (20 inline / 64 avatar).
-    const preset: OrbSize = size <= 32 ? 20 : 64;
-    const { mode, speed: baseSpeed, opts } = resolvePreset(state, preset);
-    const draw = MODE_DRAWS[mode];
-    const effSpeed = baseSpeed * speed;
-
-    const frame = (tSec: number) => {
-      // Ink is a module-level current (frames are synchronous); set per frame so
-      // orbs with different brand tokens on one page never bleed into each other.
-      setInk(ink);
-      ctx.setTransform(dpr, 0, 0, dpr, 0, 0);
-      ctx.clearRect(0, 0, size, size);
-      draw(ctx, size, tSec, dark, opts);
-    };
-
-    // reduced motion → one static, deterministic frame
-    if (reduced) {
-      frame(0.6);
-      return;
-    }
-
-    let raf = 0;
-    let running = false;
-    const loop = () => {
-      frame((performance.now() / 1000) * effSpeed);
-      if (running) raf = requestAnimationFrame(loop);
-    };
-    const start = () => {
-      if (running || paused) return;
-      running = true;
-      raf = requestAnimationFrame(loop);
-    };
-    const stop = () => {
-      running = false;
-      cancelAnimationFrame(raf);
-    };
-
-    // draw at least one frame even when paused/offscreen
-    frame((performance.now() / 1000) * effSpeed);
-
-    // pause offscreen + on hidden tabs — free when not visible
-    let visible = true;
-    const io =
-      typeof IntersectionObserver !== 'undefined'
-        ? new IntersectionObserver(([entry]) => {
-            visible = entry.isIntersecting;
-            if (visible && document.visibilityState !== 'hidden') start();
-            else stop();
-          })
-        : null;
-    io?.observe(canvas);
-    const onVis = () => {
-      if (document.visibilityState === 'hidden') stop();
-      else if (visible) start();
-    };
-    document.addEventListener('visibilitychange', onVis);
-    if (!io) start();
-
-    return () => {
-      stop();
-      io?.disconnect();
-      document.removeEventListener('visibilitychange', onVis);
-    };
-    // eslint-disable-next-line react-hooks/exhaustive-deps -- ink compared by value: a tuple is a fresh identity every render
-  }, [state, size, dark, speed, paused, reduced, ink?.join(",")]);
-
-  return (
-    <canvas
-      ref={ref}
-      role="img"
-      aria-label={ariaLabel ?? LABELS[state]}
-      style={{ width: size, height: size, display: 'block', ...style }}
-      {...rest}
-    />
-  );
-}