@wildo-ai/presets-components 1.1.4 → 1.1.6

package/dist/esm/components/data-display/pdf-viewer/pdf-viewer.js.map

@@ -1 +1 @@
-{"version":3,"file":"pdf-viewer.js","sourceRoot":"","sources":["../../../../../../src/components/data-display/pdf-viewer/pdf-viewer.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAGnC,oEAAoE;AACpE,EAAE;AACF,oFAAoF;AACpF,gFAAgF;AAChF,uCAAuC;AACvC,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,mFAAmF;AACnF,2DAA2D;AAC3D,mFAAmF;AACnF,qFAAqF;AACrF,sFAAsF;AACtF,wEAAwE;AACxE,EAAE;AACF,oFAAoF;AACpF,mFAAmF;AACnF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,mFAAmF;AACnF,qEAAqE;AACrE,sFAAsF;AACtF,OAAO,WAAW,MAAM,4CAA4C,CAAA;AAEpE,KAAK,CAAC,mBAAmB,CAAC,UAAU,GAAG,IAAI,WAAW,EAAE,CAAA;AAExD,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAc7B,MAAM,UAAU,SAAS,CAAC,EACxB,IAAI,EACJ,aAAa,GAAG,KAAK,EACrB,WAAW,EACX,SAAS,EACT,SAAS,GACM;IACf,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAwB,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACrE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAEtD,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,IAAI,SAAS,GAA4B,IAAI,CAAA;QAC7C,IAAI,WAAW,GAAgD,IAAI,CAAA;QACnE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAA;QACtC,IAAI,CAAC,SAAS;YAAE,OAAM;QAEtB,6EAA6E;QAC7E,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE/B,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,SAAS,CAAC,eAAe,EAAE,CAAA;QAE3B,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;gBACpD,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,CAAA;gBACrC,IAAI,SAAS;oBAAE,OAAM;gBACrB,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;gBACrF,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBAE9E,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,IAAI,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC;oBAC9D,IAAI,SAAS;wBAAE,OAAM;oBACrB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;oBAC/C,4EAA4E;oBAC5E,4EAA4E;oBAC5E,yEAAyE;oBACzE,0EAA0E;oBAC1E,0EAA0E;oBAC1E,MAAM,aAAa,GAAG,WAAW,IAAI,SAAS,CAAC,WAAW,CAAA;oBAC1D,MAAM,KAAK,GAAG,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;oBACjF,MAAM,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;oBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,GAAG,EAAE,CAAC,CAAA;oBAEzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;oBACtD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;oBACzC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;oBAC3C,wEAAwE;oBACxE,kDAAkD;oBAClD,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,CAAA;oBAC5D,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAA;oBAC9D,MAAM,CAAC,SAAS,GAAG,8DAA8D,CAAA;oBACjF,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;oBAClC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,UAAU,EAAE,CAAC,CAAA;oBAEvD,0EAA0E;oBAC1E,yEAAyE;oBACzE,2EAA2E;oBAC3E,0DAA0D;oBAC1D,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;oBAE7B,6EAA6E;oBAC7E,4EAA4E;oBAC5E,4EAA4E;oBAC5E,qDAAqD;oBACrD,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAA;oBAC/C,IAAI,SAAS;wBAAE,OAAM;gBACvB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS;oBAAE,QAAQ,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAClF,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,SAAS;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;YAChB,+EAA+E;YAC/E,4EAA4E;YAC5E,6EAA6E;YAC7E,8EAA8E;YAC9E,qEAAqE;YACrE,KAAK,SAAS,EAAE,OAAO,EAAE,CAAA;QAC3B,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAEtC,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,gBAAc,SAAS,eAAa,SAAS,IAAI,SAAS,aAC9F,SAAS,IAAI,KAAC,QAAQ,IAAC,SAAS,EAAC,aAAa,iBAAa,MAAM,GAAG,EACpE,KAAK,IAAI,CACR,KAAC,IAAI,IAAC,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,OAAO,YAAE,KAAK,GAAQ,CACvE,EACD,cAAK,GAAG,EAAE,YAAY,EAAE,SAAS,EAAC,wBAAwB,GAAG,EAC5D,CAAC,aAAa,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,kBAAkB,IAAI;YACzE,8EAA8E;YAC9E,6DAA6D;YAC7D,KAAC,IAAI,IAAC,SAAS,EAAC,uCAAuC,YACpD,qBAAqB,kBAAkB,OAAO,SAAS,SAAS,GAC5D,CACR,IACG,CACP,CAAA;AACH,CAAC;AAED,eAAe,SAAS,CAAA","sourcesContent":["\"use client\"\n\n/**\n * PdfViewer — the PDF.js rendering core.\n *\n * ⚠ HEAVY MODULE — LAZY-BOUNDARY DISCIPLINE ⚠\n * This module (and everything only it depends on: `pdfjs-dist` and its worker) must\n * stay behind the dynamic-import boundary owned by `pdf-viewer.lazy.tsx`. NEVER\n * static-import this file from anywhere except that wrapper (tests may). A module\n * that is both statically and dynamically imported is MERGED into the static\n * importer's chunk by Rollup, with no warning — that is how the ECharts boundary\n * silently rotted. `pnpm check:lazy-boundaries` enforces this.\n *\n * ## Why PDF.js rather than the browser's viewer\n *\n * The previous document display embedded an `<iframe>` on the file URL, which hands\n * the page to the browser's built-in viewer: unstyleable (it ignores the design\n * system entirely), unmeasurable, and blocked outright by a strict `frame-src` CSP.\n * PDF.js renders into our own canvas, so the surrounding chrome is ours.\n *\n * ## Rendering model\n *\n * Pages rasterise to `<canvas>` at device pixel ratio, sequentially, into a plain\n * scroll container. Deliberately NOT virtualised in this first increment: a bounded\n * `maxPages` cap keeps a pathological 900-page document from freezing the tab, and\n * virtualisation can be added behind the same contract when a real document demands\n * it. `THUMBNAIL` presentation renders page 1 only — the cheapest useful signal.\n *\n * ## Worker\n *\n * PDF.js parses on a Web Worker. The URL is resolved through `import.meta.url` so\n * every bundler (the app's Vite, the site's Astro, the docs' Docusaurus) emits and\n * fingerprints it as an asset rather than fetching from a CDN — a CDN worker would\n * both leak document bytes' provenance and require a `worker-src` exception the CSP\n * pipeline should not have to make. The app's CSP must allow `worker-src 'self' blob:`.\n */\n\nimport * as React from \"react\"\nimport { cn, Text, Skeleton } from \"@wildo-ai/saas-frontend-lib\"\nimport * as pdfjs from \"pdfjs-dist\"\nimport type { PDFDocumentProxy } from \"pdfjs-dist\"\n\n// Same-origin, bundler-emitted worker (see the header note on CSP).\n//\n// ⚠️ TWO earlier attempts failed at RENDER time, not build time — which is why they\n// survived typecheck and the lazy-boundary guard. Both are recorded so the next\n// author does not walk back into them:\n//\n//  1. `new URL('pdfjs-dist/build/pdf.worker.min.mjs', import.meta.url)` — `new URL()`\n//     resolves only RELATIVE paths against the module URL; a bare package specifier\n//     is not bundler-resolved, so the browser requested a path that does not exist\n//     and pdf.js reported `Setting up fake worker failed`.\n//  2. `?url` + `GlobalWorkerOptions.workerSrc` — the URL resolved and the file was\n//     served (200), but pdf.js instantiates a `workerSrc` string as a CLASSIC worker\n//     while pdf.js 6 ships the worker as an ES module. The worker never completed its\n//     handshake, so `getDocument()` hung forever with no error to show.\n//\n// `?worker` hands us a bundler-generated constructor that already carries the right\n// worker type, which removes the classic-vs-module question entirely. It is a Vite\n// asset-import suffix: Vite is what the generated application uses, and the\n// alternatives are worse (a relative path into `node_modules` breaks under any\n// hoisting layout; a CDN URL leaks document provenance and needs a `worker-src`\n// exception the CSP pipeline should not have to make). A non-Vite consumer must\n// supply its own worker — tracked as portability work, not papered over here.\n//\n// ONE port for the whole module, assigned to `GlobalWorkerOptions.workerPort`. A\n// per-instance `PDFWorker` was tried first out of a concurrency worry that does not\n// apply: the pdf.js worker multiplexes documents by id, so several viewers mounted at\n// once (a THUMBNAIL in a list plus an overlay, say) share it safely — and the shared\n// port also avoids spawning a worker per rendered thumbnail. The worker is created\n// when this module loads, which is already behind the lazy boundary.\n// @ts-expect-error -- `?worker` is a Vite asset-import suffix with no TS declaration.\nimport PdfJsWorker from 'pdfjs-dist/build/pdf.worker.min.mjs?worker'\n\npdfjs.GlobalWorkerOptions.workerPort = new PdfJsWorker()\n\n/** Hard cap on rasterised pages — a bound, not a product limit. */\nconst MAX_RENDERED_PAGES = 50\n\nexport interface PdfViewerProps {\n  /** Bytes of the PDF. Fetched by the host over the authenticated serve route. */\n  data: ArrayBuffer\n  /** Render only the first page (THUMBNAIL presentation). */\n  firstPageOnly?: boolean\n  /** Target CSS width in px for a rendered page. Height follows the page aspect. */\n  targetWidth?: number\n  className?: string\n  /** Accessible name for the rendered document region. */\n  ariaLabel?: string\n}\n\nexport function PdfViewer({\n  data,\n  firstPageOnly = false,\n  targetWidth,\n  className,\n  ariaLabel,\n}: PdfViewerProps): React.JSX.Element {\n  const containerRef = React.useRef<HTMLDivElement | null>(null)\n  const [pageCount, setPageCount] = React.useState<number | null>(null)\n  const [error, setError] = React.useState<string | null>(null)\n  const [rendering, setRendering] = React.useState(true)\n\n  React.useEffect(() => {\n    let cancelled = false\n    let document_: PDFDocumentProxy | null = null\n    let loadingTask: ReturnType<typeof pdfjs.getDocument> | null = null\n    const container = containerRef.current\n    if (!container) return\n\n    // pdf.js TRANSFERS the buffer it is given, which would detach a caller-owned\n    // ArrayBuffer and make a re-render (or a second consumer) read zero bytes.\n    // Hand it a copy; the host keeps its own.\n    const ownedData = data.slice(0)\n\n    setRendering(true)\n    setError(null)\n    container.replaceChildren()\n\n    void (async () => {\n      try {\n        loadingTask = pdfjs.getDocument({ data: ownedData })\n        document_ = await loadingTask.promise\n        if (cancelled) return\n        setPageCount(document_.numPages)\n\n        const lastPage = firstPageOnly ? 1 : Math.min(document_.numPages, MAX_RENDERED_PAGES)\n        const dpr = typeof window !== 'undefined' ? (window.devicePixelRatio || 1) : 1\n\n        for (let pageNumber = 1; pageNumber <= lastPage; pageNumber++) {\n          if (cancelled) return\n          const page = await document_.getPage(pageNumber)\n          const unscaled = page.getViewport({ scale: 1 })\n          // `??` would NOT rescue a ZERO width: `0 ?? fallback` is 0, and a container\n          // that has not been laid out yet measures exactly 0 — which yields scale 0,\n          // a 0x0 canvas, and a `page.render()` that never settles (observed live:\n          // \"rendering page 1\" logged with no completion and a permanent skeleton).\n          // Fall back on the page's own width whenever the measurement is unusable.\n          const measuredWidth = targetWidth ?? container.clientWidth\n          const width = measuredWidth && measuredWidth > 0 ? measuredWidth : unscaled.width\n          const scale = width / unscaled.width\n          const viewport = page.getViewport({ scale: scale * dpr })\n\n          const canvas = window.document.createElement('canvas')\n          canvas.width = Math.floor(viewport.width)\n          canvas.height = Math.floor(viewport.height)\n          // CSS size stays in layout px; the canvas is oversampled by DPR so text\n          // is crisp on retina without the layout changing.\n          canvas.style.width = `${Math.floor(viewport.width / dpr)}px`\n          canvas.style.height = `${Math.floor(viewport.height / dpr)}px`\n          canvas.className = 'mx-auto max-w-full rounded-md border border-border shadow-xs'\n          canvas.setAttribute('role', 'img')\n          canvas.setAttribute('aria-label', `Page ${pageNumber}`)\n\n          // ATTACH BEFORE RENDERING. Rendering into a detached canvas and appending\n          // afterwards left `page.render()` unsettled indefinitely (observed live:\n          // \"rendering page 1\" with no completion). Attaching first also makes pages\n          // appear progressively instead of all at once at the end.\n          container.appendChild(canvas)\n\n          // pdf.js 6 takes the CANVAS, not a 2D context: `canvasContext` is the legacy\n          // parameter and its own typings state that using it requires `canvas` to be\n          // explicitly null. Passing both (the first attempt here) is not a supported\n          // combination and left the render promise unsettled.\n          await page.render({ canvas, viewport }).promise\n          if (cancelled) return\n        }\n      } catch (cause) {\n        if (!cancelled) setError(cause instanceof Error ? cause.message : String(cause))\n      } finally {\n        if (!cancelled) setRendering(false)\n      }\n    })()\n\n    return () => {\n      cancelled = true\n      // Do NOT call `loadingTask.destroy()`: with an externally-supplied worker port\n      // that also destroys the SHARED worker, and React StrictMode's double-mount\n      // then hits `PDFWorker.create - the worker is being destroyed` on the second\n      // pass (observed live). Releasing the document's own worker-side resources is\n      // what this component actually owns; the port outlives it by design.\n      void document_?.cleanup()\n    }\n  }, [data, firstPageOnly, targetWidth])\n\n  return (\n    <div className={cn('w-full', className)} aria-label={ariaLabel} aria-busy={rendering || undefined}>\n      {rendering && <Skeleton className=\"h-64 w-full\" aria-hidden=\"true\" />}\n      {error && (\n        <Text className=\"text-sm text-destructive\" role=\"alert\">{error}</Text>\n      )}\n      <div ref={containerRef} className=\"flex flex-col gap-item\" />\n      {!firstPageOnly && pageCount !== null && pageCount > MAX_RENDERED_PAGES && (\n        // Say what was NOT rendered rather than silently truncating — a document that\n        // looks complete but is not is worse than an explicit bound.\n        <Text className=\"mt-item text-xs text-muted-foreground\">\n          {`Showing the first ${MAX_RENDERED_PAGES} of ${pageCount} pages.`}\n        </Text>\n      )}\n    </div>\n  )\n}\n\nexport default PdfViewer\n"]}
+{"version":3,"file":"pdf-viewer.js","sourceRoot":"","sources":["../../../../../../src/components/data-display/pdf-viewer/pdf-viewer.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACvF,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AAEnC,OAAO,EAAE,uCAAuC,EAAE,MAAM,qBAAqB,CAAA;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,IAAI,sBAAsB,GAAyB,IAAI,CAAA;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,sBAAsB,KAAK,IAAI,EAAE,CAAC;QACpC,sBAAsB,GAAG,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,UAAU,GAAG,uCAAuC,EAAE,CAAA;YAC5D,MAAM,MAAM,GAAG,UAAU;gBACvB,CAAC,CAAC,UAAU,EAAE;gBACd,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAA;YAC3G,KAAK,CAAC,mBAAmB,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5B,qFAAqF;YACrF,sBAAsB,GAAG,IAAI,CAAA;YAC7B,MAAM,KAAK,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAA;AAC/B,CAAC;AAED,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAA;AA8BhD,MAAM,UAAU,SAAS,CAAC,EACxB,IAAI,EACJ,aAAa,GAAG,KAAK,EACrB,WAAW,EACX,SAAS,EACT,SAAS,EACT,MAAM,GACS;IACf,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAwB,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACrE,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACtD,oFAAoF;IACpF,iFAAiF;IACjF,qEAAqE;IACrE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC9C,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAA;IAElC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE;QACnB,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,IAAI,SAAS,GAA4B,IAAI,CAAA;QAC7C,IAAI,WAAW,GAAgD,IAAI,CAAA;QACnE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAA;QACtC,IAAI,CAAC,SAAS;YAAE,OAAM;QAEtB,6EAA6E;QAC7E,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAE/B,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,eAAe,CAAC,KAAK,CAAC,CAAA;QACtB,SAAS,CAAC,eAAe,EAAE,CAAA;QAE3B,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,MAAM,yBAAyB,EAAE,CAAA;gBACjC,IAAI,SAAS;oBAAE,OAAM;gBACrB,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;gBACpD,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,CAAA;gBACrC,IAAI,SAAS;oBAAE,OAAM;gBACrB,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;gBAEhC,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;gBACrF,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBAE9E,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,IAAI,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC;oBAC9D,IAAI,SAAS;wBAAE,OAAM;oBACrB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;oBAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;oBAC/C,4EAA4E;oBAC5E,4EAA4E;oBAC5E,yEAAyE;oBACzE,0EAA0E;oBAC1E,0EAA0E;oBAC1E,MAAM,aAAa,GAAG,WAAW,IAAI,SAAS,CAAC,WAAW,CAAA;oBAC1D,MAAM,KAAK,GAAG,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAA;oBACjF,MAAM,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;oBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,GAAG,EAAE,CAAC,CAAA;oBAEzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;oBACtD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;oBACzC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;oBAC3C,wEAAwE;oBACxE,kDAAkD;oBAClD,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,GAAG,CAAC,IAAI,CAAA;oBAC5D,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAA;oBAC9D,MAAM,CAAC,SAAS,GAAG,8DAA8D,CAAA;oBACjF,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;oBAClC,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;oBAEnE,0EAA0E;oBAC1E,yEAAyE;oBACzE,2EAA2E;oBAC3E,0DAA0D;oBAC1D,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;oBAE7B,6EAA6E;oBAC7E,4EAA4E;oBAC5E,4EAA4E;oBAC5E,qDAAqD;oBACrD,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAA;oBAC/C,IAAI,SAAS;wBAAE,OAAM;gBACvB,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;wBACxD,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;qBAClC,CAAC,CAAA;oBACF,eAAe,CAAC,IAAI,CAAC,CAAA;gBACvB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,SAAS;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;YAChB,+EAA+E;YAC/E,4EAA4E;YAC5E,6EAA6E;YAC7E,8EAA8E;YAC9E,qEAAqE;YACrE,KAAK,SAAS,EAAE,OAAO,EAAE,CAAA;QAC3B,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAEtC,OAAO,CACL,eAAK,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,gBAAc,SAAS,eAAa,SAAS,IAAI,SAAS,aAC9F,SAAS,IAAI,KAAC,QAAQ,IAAC,SAAS,EAAC,aAAa,iBAAa,MAAM,GAAG,EACpE,YAAY,IAAI,CACf,KAAC,IAAI,IAAC,SAAS,EAAC,0BAA0B,EAAC,IAAI,EAAC,OAAO,YAAE,MAAM,CAAC,YAAY,GAAQ,CACrF,EACD,cAAK,GAAG,EAAE,YAAY,EAAE,SAAS,EAAC,wBAAwB,GAAG,EAC5D,CAAC,aAAa,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,GAAG,kBAAkB,IAAI;YACzE,8EAA8E;YAC9E,6DAA6D;YAC7D,KAAC,IAAI,IAAC,SAAS,EAAC,uCAAuC,YACpD,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,SAAS,CAAC,GAChD,CACR,IACG,CACP,CAAA;AACH,CAAC;AAED,eAAe,SAAS,CAAA","sourcesContent":["\"use client\"\n\n/**\n * PdfViewer — the PDF.js rendering core.\n *\n * ⚠ HEAVY MODULE — LAZY-BOUNDARY DISCIPLINE ⚠\n * This module (and everything only it depends on: `pdfjs-dist` and its worker) must\n * stay behind the dynamic-import boundary owned by `pdf-viewer.lazy.tsx`. NEVER\n * static-import this file from anywhere except that wrapper (tests may). A module\n * that is both statically and dynamically imported is MERGED into the static\n * importer's chunk by Rollup, with no warning — that is how the ECharts boundary\n * silently rotted. `pnpm check:lazy-boundaries` enforces this.\n *\n * ## Why PDF.js rather than the browser's viewer\n *\n * The previous document display embedded an `<iframe>` on the file URL, which hands\n * the page to the browser's built-in viewer: unstyleable (it ignores the design\n * system entirely), unmeasurable, and blocked outright by a strict `frame-src` CSP.\n * PDF.js renders into our own canvas, so the surrounding chrome is ours.\n *\n * ## Rendering model\n *\n * Pages rasterise to `<canvas>` at device pixel ratio, sequentially, into a plain\n * scroll container. Deliberately NOT virtualised in this first increment: a bounded\n * `maxPages` cap keeps a pathological 900-page document from freezing the tab, and\n * virtualisation can be added behind the same contract when a real document demands\n * it. `THUMBNAIL` presentation renders page 1 only — the cheapest useful signal.\n *\n * ## Worker\n *\n * PDF.js parses on a Web Worker. ONE port for the whole module, installed lazily on the\n * first render (`ensurePdfViewerWorkerPort`) and assigned to `GlobalWorkerOptions.workerPort`:\n * the pdf.js worker multiplexes documents by id, so several viewers mounted at once (a\n * THUMBNAIL in a list plus an overlay, say) share it safely, and the shared port avoids\n * spawning a worker per rendered thumbnail. A per-instance `PDFWorker` was tried first\n * out of a concurrency worry that does not apply.\n *\n * WHERE the worker comes from is the host's decision (issue #962, `pdf-viewer-worker.ts`):\n * a factory registered through `configurePdfViewerWorker` wins; otherwise the Vite default\n * in `pdf-viewer-worker.vite.ts` is imported — and only then, so a non-Vite bundler that\n * registered a factory never compiles the `?worker` import. The default is a same-origin\n * file URL, so the `SAAS_APP` CSP baseline needs nothing beyond `script-src 'self'`; the\n * cross-origin (CDN publish) case and its `worker-src blob:` note live with the seam.\n *\n * ## Text\n *\n * The viewer is label-agnostic: every string it shows or announces arrives resolved in\n * `labels` from its host, which owns the component's i18n catalog. A failure is shown\n * as the host's labelled message and the cause is logged — a raw pdf.js exception\n * message is developer text, not something to put in front of a reader.\n */\n\nimport * as React from \"react\"\nimport { cn, Text, Skeleton, LoggerFrontendService } from \"@wildo-ai/saas-frontend-lib\"\nimport * as pdfjs from \"pdfjs-dist\"\nimport type { PDFDocumentProxy } from \"pdfjs-dist\"\nimport { resolveConfiguredPdfViewerWorkerFactory } from \"./pdf-viewer-worker\"\n\nimport { describeCaughtError } from '@wildo-ai/saas-models';\nlet workerPortInstallation: Promise<void> | null = null\n\n/**\n * Install the module-wide worker port once, from the host's factory when one is registered and from\n * the Vite default otherwise (issue #962). Idempotent and memoised: every render awaits the same\n * installation, and a factory registered AFTER it is not consulted. The Vite module is reached\n * through a dynamic import that webpack is told not to follow (`webpackIgnore`), which is what keeps\n * its `?worker` specifier out of a non-Vite graph; a host on such a bundler that registered no\n * factory gets a rejected installation here — surfaced as the viewer's labelled failure with the\n * cause in the log, never a hang.\n */\nexport function ensurePdfViewerWorkerPort(): Promise<void> {\n  if (workerPortInstallation === null) {\n    workerPortInstallation = (async () => {\n      const configured = resolveConfiguredPdfViewerWorkerFactory()\n      const worker = configured\n        ? configured()\n        : (await import(/* webpackIgnore: true */ './pdf-viewer-worker.vite')).createViteDefaultPdfViewerWorker()\n      pdfjs.GlobalWorkerOptions.workerPort = worker\n    })().catch((cause: unknown) => {\n      // A failed installation must not poison every later render: the next one asks again.\n      workerPortInstallation = null\n      throw cause\n    })\n  }\n  return workerPortInstallation\n}\n\n/** Hard cap on rasterised pages — a bound, not a product limit. */\nconst MAX_RENDERED_PAGES = 50\n\nconst logger = LoggerFrontendService.getLogger()\n\n/**\n * Every string the viewer shows or announces, RESOLVED by the host. Functions where\n * the text carries a number, so the host's i18n interpolation — not this module —\n * decides word order.\n */\nexport interface PdfViewerLabels {\n  /** Accessible name of one rendered page image. */\n  page(pageNumber: number): string\n  /** Notice under a document longer than the render cap. */\n  pagesTruncated(shown: number, total: number): string\n  /** Alert shown when the document cannot be rendered. */\n  renderFailed: string\n}\n\nexport interface PdfViewerProps {\n  /** Bytes of the PDF. Fetched by the host over the authenticated serve route. */\n  data: ArrayBuffer\n  /** Render only the first page (THUMBNAIL presentation). */\n  firstPageOnly?: boolean\n  /** Target CSS width in px for a rendered page. Height follows the page aspect. */\n  targetWidth?: number\n  className?: string\n  /** Accessible name for the rendered document region. */\n  ariaLabel?: string\n  /** Resolved text. Required: the viewer invents no words of its own. */\n  labels: PdfViewerLabels\n}\n\nexport function PdfViewer({\n  data,\n  firstPageOnly = false,\n  targetWidth,\n  className,\n  ariaLabel,\n  labels,\n}: PdfViewerProps): React.JSX.Element {\n  const containerRef = React.useRef<HTMLDivElement | null>(null)\n  const [pageCount, setPageCount] = React.useState<number | null>(null)\n  const [renderFailed, setRenderFailed] = React.useState(false)\n  const [rendering, setRendering] = React.useState(true)\n  // Read through a ref inside the render effect: `labels.page` is a function the host\n  // may recreate every render, and re-rasterising a whole document because a label\n  // closure changed identity would be a visible flicker for no reason.\n  const pageLabelRef = React.useRef(labels.page)\n  pageLabelRef.current = labels.page\n\n  React.useEffect(() => {\n    let cancelled = false\n    let document_: PDFDocumentProxy | null = null\n    let loadingTask: ReturnType<typeof pdfjs.getDocument> | null = null\n    const container = containerRef.current\n    if (!container) return\n\n    // pdf.js TRANSFERS the buffer it is given, which would detach a caller-owned\n    // ArrayBuffer and make a re-render (or a second consumer) read zero bytes.\n    // Hand it a copy; the host keeps its own.\n    const ownedData = data.slice(0)\n\n    setRendering(true)\n    setRenderFailed(false)\n    container.replaceChildren()\n\n    void (async () => {\n      try {\n        await ensurePdfViewerWorkerPort()\n        if (cancelled) return\n        loadingTask = pdfjs.getDocument({ data: ownedData })\n        document_ = await loadingTask.promise\n        if (cancelled) return\n        setPageCount(document_.numPages)\n\n        const lastPage = firstPageOnly ? 1 : Math.min(document_.numPages, MAX_RENDERED_PAGES)\n        const dpr = typeof window !== 'undefined' ? (window.devicePixelRatio || 1) : 1\n\n        for (let pageNumber = 1; pageNumber <= lastPage; pageNumber++) {\n          if (cancelled) return\n          const page = await document_.getPage(pageNumber)\n          const unscaled = page.getViewport({ scale: 1 })\n          // `??` would NOT rescue a ZERO width: `0 ?? fallback` is 0, and a container\n          // that has not been laid out yet measures exactly 0 — which yields scale 0,\n          // a 0x0 canvas, and a `page.render()` that never settles (observed live:\n          // \"rendering page 1\" logged with no completion and a permanent skeleton).\n          // Fall back on the page's own width whenever the measurement is unusable.\n          const measuredWidth = targetWidth ?? container.clientWidth\n          const width = measuredWidth && measuredWidth > 0 ? measuredWidth : unscaled.width\n          const scale = width / unscaled.width\n          const viewport = page.getViewport({ scale: scale * dpr })\n\n          const canvas = window.document.createElement('canvas')\n          canvas.width = Math.floor(viewport.width)\n          canvas.height = Math.floor(viewport.height)\n          // CSS size stays in layout px; the canvas is oversampled by DPR so text\n          // is crisp on retina without the layout changing.\n          canvas.style.width = `${Math.floor(viewport.width / dpr)}px`\n          canvas.style.height = `${Math.floor(viewport.height / dpr)}px`\n          canvas.className = 'mx-auto max-w-full rounded-md border border-border shadow-xs'\n          canvas.setAttribute('role', 'img')\n          canvas.setAttribute('aria-label', pageLabelRef.current(pageNumber))\n\n          // ATTACH BEFORE RENDERING. Rendering into a detached canvas and appending\n          // afterwards left `page.render()` unsettled indefinitely (observed live:\n          // \"rendering page 1\" with no completion). Attaching first also makes pages\n          // appear progressively instead of all at once at the end.\n          container.appendChild(canvas)\n\n          // pdf.js 6 takes the CANVAS, not a 2D context: `canvasContext` is the legacy\n          // parameter and its own typings state that using it requires `canvas` to be\n          // explicitly null. Passing both (the first attempt here) is not a supported\n          // combination and left the render promise unsettled.\n          await page.render({ canvas, viewport }).promise\n          if (cancelled) return\n        }\n      } catch (cause) {\n        if (!cancelled) {\n          logger.warn('[PdfViewer] document could not be rendered', {\n            error: describeCaughtError(cause),\n          })\n          setRenderFailed(true)\n        }\n      } finally {\n        if (!cancelled) setRendering(false)\n      }\n    })()\n\n    return () => {\n      cancelled = true\n      // Do NOT call `loadingTask.destroy()`: with an externally-supplied worker port\n      // that also destroys the SHARED worker, and React StrictMode's double-mount\n      // then hits `PDFWorker.create - the worker is being destroyed` on the second\n      // pass (observed live). Releasing the document's own worker-side resources is\n      // what this component actually owns; the port outlives it by design.\n      void document_?.cleanup()\n    }\n  }, [data, firstPageOnly, targetWidth])\n\n  return (\n    <div className={cn('w-full', className)} aria-label={ariaLabel} aria-busy={rendering || undefined}>\n      {rendering && <Skeleton className=\"h-64 w-full\" aria-hidden=\"true\" />}\n      {renderFailed && (\n        <Text className=\"text-sm text-destructive\" role=\"alert\">{labels.renderFailed}</Text>\n      )}\n      <div ref={containerRef} className=\"flex flex-col gap-item\" />\n      {!firstPageOnly && pageCount !== null && pageCount > MAX_RENDERED_PAGES && (\n        // Say what was NOT rendered rather than silently truncating — a document that\n        // looks complete but is not is worse than an explicit bound.\n        <Text className=\"mt-item text-xs text-muted-foreground\">\n          {labels.pagesTruncated(MAX_RENDERED_PAGES, pageCount)}\n        </Text>\n      )}\n    </div>\n  )\n}\n\nexport default PdfViewer\n"]}

package/dist/esm/components/data-display/pdf-viewer/pdf-viewer.lazy.d.ts

@@ -9,6 +9,16 @@
  */
 import * as React from "react";
 import type { PdfViewerProps } from "./pdf-viewer";
-export declare function PdfViewerLazy(props: PdfViewerProps): React.JSX.Element;
-export type { PdfViewerProps } from "./pdf-viewer";
+export interface PdfViewerLazyProps extends PdfViewerProps {
+    /**
+     * The PDF.js chunk could not be loaded (or the viewer threw while rendering). A lazy door throws
+     * during render when its chunk fails to download, and Suspense does not catch that — so the door
+     * catches it and hands the decision to the host, which knows what to show instead (the document
+     * display falls back to its downloadable file card). Nothing is rendered in the viewer's place
+     * until the host reacts.
+     */
+    onUnavailable?: (error: Error) => void;
+}
+export declare function PdfViewerLazy({ onUnavailable, ...props }: PdfViewerLazyProps): React.JSX.Element;
+export type { PdfViewerLabels, PdfViewerProps } from "./pdf-viewer";
 //# sourceMappingURL=pdf-viewer.lazy.d.ts.map

package/dist/esm/components/data-display/pdf-viewer/pdf-viewer.lazy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pdf-viewer.lazy.d.ts","sourceRoot":"","sources":["../../../../../src/components/data-display/pdf-viewer/pdf-viewer.lazy.tsx"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAE9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAIlD,wBAAgB,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAMtE;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"pdf-viewer.lazy.d.ts","sourceRoot":"","sources":["../../../../../../src/components/data-display/pdf-viewer/pdf-viewer.lazy.tsx"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAE9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAKlD,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;CACvC;AAED,wBAAgB,aAAa,CAAC,EAAE,aAAa,EAAE,GAAG,KAAK,EAAE,EAAE,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAQhG;AAED,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA"}

package/dist/esm/components/data-display/pdf-viewer/pdf-viewer.lazy.js

@@ -11,8 +11,9 @@ import { jsx as _jsx } from "react/jsx-runtime";
  */
 import * as React from "react";
 import { Skeleton } from "@wildo-ai/saas-frontend-lib";
+import { LazyDoorErrorBoundary } from "@wildo-ai/saas-frontend-lib";
 const LazyPdfViewerInner = React.lazy(() => import("./pdf-viewer.js"));
-export function PdfViewerLazy(props) {
-    return (_jsx(React.Suspense, { fallback: _jsx(Skeleton, { className: "h-64 w-full", "aria-hidden": "true" }), children: _jsx(LazyPdfViewerInner, { ...props }) }));
+export function PdfViewerLazy({ onUnavailable, ...props }) {
+    return (_jsx(LazyDoorErrorBoundary, { doorName: "PdfViewerLazy", fallback: null, onError: onUnavailable, children: _jsx(React.Suspense, { fallback: _jsx(Skeleton, { className: "h-64 w-full", "aria-hidden": "true" }), children: _jsx(LazyPdfViewerInner, { ...props }) }) }));
 }
 //# sourceMappingURL=pdf-viewer.lazy.js.map

package/dist/esm/components/data-display/pdf-viewer/pdf-viewer.lazy.js.map

@@ -1 +1 @@
-{"version":3,"file":"pdf-viewer.lazy.js","sourceRoot":"","sources":["../../../../../../src/components/data-display/pdf-viewer/pdf-viewer.lazy.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAGtD,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;AAEnE,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,OAAO,CACL,KAAC,KAAK,CAAC,QAAQ,IAAC,QAAQ,EAAE,KAAC,QAAQ,IAAC,SAAS,EAAC,aAAa,iBAAa,MAAM,GAAG,YAC/E,KAAC,kBAAkB,OAAK,KAAK,GAAI,GAClB,CAClB,CAAA;AACH,CAAC","sourcesContent":["\"use client\"\n\n/**\n * PdfViewerLazy — the ONLY public door onto the PDF.js rendering core.\n *\n * Lazy-boundary wrapper (`*.lazy.tsx` convention, ChartView.lazy precedent): owns the\n * `React.lazy(() => import(...))` split point and the layout-reserving Suspense\n * fallback, and re-exports the props type via `import type` so consumers get typing\n * with no runtime edge onto the heavy module. Everything except this wrapper (and\n * tests) must import the viewer from HERE — enforced by `pnpm check:lazy-boundaries`.\n */\n\nimport * as React from \"react\"\nimport { Skeleton } from \"@wildo-ai/saas-frontend-lib\"\nimport type { PdfViewerProps } from \"./pdf-viewer\"\n\nconst LazyPdfViewerInner = React.lazy(() => import(\"./pdf-viewer\"))\n\nexport function PdfViewerLazy(props: PdfViewerProps): React.JSX.Element {\n  return (\n    <React.Suspense fallback={<Skeleton className=\"h-64 w-full\" aria-hidden=\"true\" />}>\n      <LazyPdfViewerInner {...props} />\n    </React.Suspense>\n  )\n}\n\nexport type { PdfViewerProps } from \"./pdf-viewer\"\n"]}
+{"version":3,"file":"pdf-viewer.lazy.js","sourceRoot":"","sources":["../../../../../../src/components/data-display/pdf-viewer/pdf-viewer.lazy.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;GAQG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAEnE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;AAanE,MAAM,UAAU,aAAa,CAAC,EAAE,aAAa,EAAE,GAAG,KAAK,EAAsB;IAC3E,OAAO,CACL,KAAC,qBAAqB,IAAC,QAAQ,EAAC,eAAe,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,YACpF,KAAC,KAAK,CAAC,QAAQ,IAAC,QAAQ,EAAE,KAAC,QAAQ,IAAC,SAAS,EAAC,aAAa,iBAAa,MAAM,GAAG,YAC/E,KAAC,kBAAkB,OAAK,KAAK,GAAI,GAClB,GACK,CACzB,CAAA;AACH,CAAC","sourcesContent":["\"use client\"\n\n/**\n * PdfViewerLazy — the ONLY public door onto the PDF.js rendering core.\n *\n * Lazy-boundary wrapper (`*.lazy.tsx` convention, ChartView.lazy precedent): owns the\n * `React.lazy(() => import(...))` split point and the layout-reserving Suspense\n * fallback, and re-exports the props type via `import type` so consumers get typing\n * with no runtime edge onto the heavy module. Everything except this wrapper (and\n * tests) must import the viewer from HERE — enforced by `pnpm check:lazy-boundaries`.\n */\n\nimport * as React from \"react\"\nimport { Skeleton } from \"@wildo-ai/saas-frontend-lib\"\nimport type { PdfViewerProps } from \"./pdf-viewer\"\nimport { LazyDoorErrorBoundary } from \"@wildo-ai/saas-frontend-lib\"\n\nconst LazyPdfViewerInner = React.lazy(() => import(\"./pdf-viewer\"))\n\nexport interface PdfViewerLazyProps extends PdfViewerProps {\n  /**\n   * The PDF.js chunk could not be loaded (or the viewer threw while rendering). A lazy door throws\n   * during render when its chunk fails to download, and Suspense does not catch that — so the door\n   * catches it and hands the decision to the host, which knows what to show instead (the document\n   * display falls back to its downloadable file card). Nothing is rendered in the viewer's place\n   * until the host reacts.\n   */\n  onUnavailable?: (error: Error) => void\n}\n\nexport function PdfViewerLazy({ onUnavailable, ...props }: PdfViewerLazyProps): React.JSX.Element {\n  return (\n    <LazyDoorErrorBoundary doorName=\"PdfViewerLazy\" fallback={null} onError={onUnavailable}>\n      <React.Suspense fallback={<Skeleton className=\"h-64 w-full\" aria-hidden=\"true\" />}>\n        <LazyPdfViewerInner {...props} />\n      </React.Suspense>\n    </LazyDoorErrorBoundary>\n  )\n}\n\nexport type { PdfViewerLabels, PdfViewerProps } from \"./pdf-viewer\"\n"]}

package/dist/esm/components/data-display/timeline.d.ts

@@ -0,0 +1,3 @@
+import type { TimelineCompound } from "@wildo-ai/saas-frontend-lib";
+export declare const Timeline: TimelineCompound;
+//# sourceMappingURL=timeline.d.ts.map

package/dist/esm/components/data-display/timeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline.d.ts","sourceRoot":"","sources":["../../../../../src/components/data-display/timeline.tsx"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGV,gBAAgB,EAKjB,MAAM,6BAA6B,CAAA;AAiKpC,eAAO,MAAM,QAAQ,kBAMnB,CAAA"}

package/dist/esm/components/data-display/timeline.js

@@ -0,0 +1,92 @@
+"use client";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { IndicatorVariant, SelectableVariant, UIBehavior } from "@wildo-ai/presets-components-models";
+import { cn, createCompoundPreset, useUI } from "@wildo-ai/saas-frontend-lib";
+import { optionGestureHandlers } from "../../components/sections/option-gesture.js";
+/**
+ * DEFAULT preset for `LOW_LEVEL_TIMELINE`: an ordered list along one rail, entries hanging off it
+ * with a marker dot in the entry's tone.
+ *
+ * ## The marker is the STRONG hue, not the subtle chip
+ *
+ * The INDICATOR recipe tints a chip with the `*-subtle` tokens, which is right for a badge with
+ * words in it and invisible on a 12px dot. The dot fills with the tone's own token — `success`,
+ * `warning`, `destructive`, `info`, and the muted foreground for NEUTRAL — total over the
+ * vocabulary by type, so a sixth tone is a compile error here rather than a grey dot. A marker WITH
+ * content (a glyph) keeps the same fill and sizes to its content.
+ *
+ * ## Geometry, once
+ *
+ * The rail is the list's own start border; entries pad past it and the marker sits absolutely on
+ * the rail, so the rail and the dots share one coordinate whatever an entry's body contains. The
+ * dot's `ring-background` is what lifts it off the rail line.
+ */
+const MARKER_FILL = {
+    [IndicatorVariant.SUCCESS]: "bg-success text-success-foreground",
+    [IndicatorVariant.WARNING]: "bg-warning text-warning-foreground",
+    [IndicatorVariant.ERROR]: "bg-destructive text-destructive-foreground",
+    [IndicatorVariant.INFO]: "bg-info text-info-foreground",
+    [IndicatorVariant.NEUTRAL]: "bg-muted-foreground text-background",
+};
+/** Where the marker sits: centred on the rail, which is the list's start border. */
+/* `--spacing-field` is the rail padding below (`ps-field`); 0.4375rem = half the dot (0.375rem) + half the 1px rail. */
+const MARKER_POSITION = "absolute top-1 -start-[calc(var(--spacing-field,1rem)+0.4375rem)]";
+/*
+ * The rail's classes, shared by both of its shapes. A named CONTAINER, so an entry can lay its time
+ * beside its body when the rail is wide and above it when the rail is narrow — measured on the
+ * creation board's split (2026-09-20), where a 200px rail gave the body sixty pixels beside a
+ * fixed-width timestamp and a session id wrapped one character per line. The entry decides by the
+ * rail's width, never the viewport's.
+ */
+const RAIL = "@container/timeline relative ms-1.5 flex flex-col gap-group border-s border-border ps-field";
+function TimelineRoot({ className, selectable = false, ...props }) {
+    /* A rail a person picks from is a `grid` of `row`s — a `div`, since `ol` does not admit the role. */
+    if (selectable) {
+        return _jsx("div", { "data-slot": "timeline", role: "grid", className: cn(RAIL, className), ...props });
+    }
+    return (_jsx("ol", { "data-slot": "timeline", className: cn(RAIL, className), ...props }));
+}
+function TimelineMarker({ tone = IndicatorVariant.NEUTRAL, className, children, ...props }) {
+    return (_jsx("span", { "data-slot": "timeline-marker", "data-tone": tone, "aria-hidden": "true", className: cn("inline-flex items-center justify-center rounded-full ring-2 ring-background", children === undefined || children === null ? "size-3" : "size-5 [&>svg]:size-3", MARKER_FILL[tone], className), ...props, children: children }));
+}
+function TimelineEntry({ tone = IndicatorVariant.NEUTRAL, marker, option, selected = false, className, children, ...props }) {
+    const { getRecipe } = useUI();
+    /*
+     * A PICKABLE entry wears the same selectable treatment a listbox card does — the FILLED "you are
+     * here" tint plus a ring when selected, the theme's focus ring when focusable — so a stream a
+     * person picks from reads like every other pickable list on the surface.
+     */
+    const selectable = option !== undefined || selected ? getRecipe(UIBehavior.SELECTABLE, SelectableVariant.FILLED) : undefined;
+    const entryClassName = cn("relative flex min-w-0 flex-wrap items-start gap-element rounded-md", option !== undefined && cn("cursor-pointer outline-none px-item-sm py-item-xs -mx-item-sm", selectable?.states.focus, selectable?.motion.transition), selected && cn(selectable?.states.selected, "ring-2 ring-ring"), className);
+    const content = (_jsxs(_Fragment, { children: [_jsx("span", { className: cn(MARKER_POSITION, "flex size-3 items-center justify-center"), children: marker ?? _jsx(TimelineMarker, { tone: tone }) }), children] }));
+    /*
+     * A PICKABLE entry is a grid `row` owning one `gridcell`, and the gridcell is the entry — focusable,
+     * `aria-selected`, carrying the caller's attributes — because an entry holds `Timeline.Actions` and
+     * an `option` may not contain a control. The wrapper draws nothing; the rail's flex column lays it out.
+     */
+    if (option !== undefined) {
+        return (_jsx("div", { role: "row", className: "min-w-0", children: _jsx("div", { "data-slot": "timeline-entry", "data-tone": tone, "data-selected": selected, role: "gridcell", "aria-selected": selected, tabIndex: 0, className: entryClassName, ...optionGestureHandlers(option.onSelect), ...props, children: content }) }));
+    }
+    return (_jsx("li", { "data-slot": "timeline-entry", "data-tone": tone, "data-selected": selected, className: entryClassName, ...props, children: content }));
+}
+function TimelineTime({ className, ...props }) {
+    return (_jsx("time", { "data-slot": "timeline-time", 
+        /* Full width on a narrow rail (the body follows beneath); beside the body from 24rem up — see the root. */
+        className: cn("basis-full shrink-0 pt-px text-2xs text-foreground-subtle tabular-nums @sm/timeline:basis-auto", className), ...props }));
+}
+function TimelineBody({ className, ...props }) {
+    return (_jsx("div", { "data-slot": "timeline-body", className: cn("flex min-w-0 flex-1 flex-col gap-element-sm text-sm", className), ...props }));
+}
+function TimelineActions({ className, ...props }) {
+    return (_jsx("div", { "data-slot": "timeline-actions", 
+        /* Its own row on a narrow rail, end-aligned; beside the body, pushed to the end, from 24rem up — see the root. */
+        className: cn("flex basis-full shrink-0 items-center justify-end gap-element-sm @sm/timeline:ms-auto @sm/timeline:basis-auto", className), ...props }));
+}
+export const Timeline = createCompoundPreset(TimelineRoot, {
+    Entry: TimelineEntry,
+    Marker: TimelineMarker,
+    Time: TimelineTime,
+    Body: TimelineBody,
+    Actions: TimelineActions,
+});
+//# sourceMappingURL=timeline.js.map

package/dist/esm/components/data-display/timeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline.js","sourceRoot":"","sources":["../../../../../src/components/data-display/timeline.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAGZ,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAErG,OAAO,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAA;AAWzF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,GAAqC;IACpD,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,oCAAoC;IAChE,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,oCAAoC;IAChE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,4CAA4C;IACtE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,8BAA8B;IACvD,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,qCAAqC;CAClE,CAAA;AAED,oFAAoF;AACpF,wHAAwH;AACxH,MAAM,eAAe,GAAG,mEAAmE,CAAA;AAE3F;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,6FAA6F,CAAA;AAE1G,SAAS,YAAY,CAAC,EAAE,SAAS,EAAE,UAAU,GAAG,KAAK,EAAE,GAAG,KAAK,EAAiB;IAC9E,qGAAqG;IACrG,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,2BAAe,UAAU,EAAC,IAAI,EAAC,MAAM,EAAC,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,KAAO,KAAgD,GAAI,CAAA;IACxI,CAAC;IACD,OAAO,CACL,0BACY,UAAU,EACpB,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,KAC1B,KAAK,GACT,CACH,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,EAAE,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAuB;IAC7G,OAAO,CACL,4BACY,iBAAiB,eAChB,IAAI,iBACH,MAAM,EAClB,SAAS,EAAE,EAAE,CACX,6EAA6E,EAC7E,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,uBAAuB,EAChF,WAAW,CAAC,IAAI,CAAC,EACjB,SAAS,CACV,KACG,KAAK,YAER,QAAQ,GACJ,CACR,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,EAAE,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAsB;IAC7I,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAA;IAC7B;;;;OAIG;IACH,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5H,MAAM,cAAc,GAAG,EAAE,CACvB,oEAAoE,EACpE,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,+DAA+D,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EACpJ,QAAQ,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAC/D,SAAS,CACV,CAAA;IACD,MAAM,OAAO,GAAG,CACd,8BACE,eAAM,SAAS,EAAE,EAAE,CAAC,eAAe,EAAE,yCAAyC,CAAC,YAC5E,MAAM,IAAI,KAAC,cAAc,IAAC,IAAI,EAAE,IAAI,GAAI,GACpC,EACN,QAAQ,IACR,CACJ,CAAA;IAED;;;;OAIG;IACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CACL,cAAK,IAAI,EAAC,KAAK,EAAC,SAAS,EAAC,SAAS,YACjC,2BACY,gBAAgB,eACf,IAAI,mBACA,QAAQ,EACvB,IAAI,EAAC,UAAU,mBACA,QAAQ,EACvB,QAAQ,EAAE,CAAC,EACX,SAAS,EAAE,cAAc,KACrB,qBAAqB,CAAiB,MAAM,CAAC,QAAQ,CAAC,KACrD,KAAgD,YAEpD,OAAO,GACJ,GACF,CACP,CAAA;IACH,CAAC;IAED,OAAO,CACL,0BAAc,gBAAgB,eAAY,IAAI,mBAAiB,QAAQ,EAAE,SAAS,EAAE,cAAc,KAAM,KAAK,YAC1G,OAAO,GACL,CACN,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,EAAqB;IAC9D,OAAO,CACL,4BACY,eAAe;QACzB,2GAA2G;QAC3G,SAAS,EAAE,EAAE,CAAC,gGAAgG,EAAE,SAAS,CAAC,KACtH,KAAK,GACT,CACH,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,EAAqB;IAC9D,OAAO,CACL,2BACY,eAAe,EACzB,SAAS,EAAE,EAAE,CAAC,qDAAqD,EAAE,SAAS,CAAC,KAC3E,KAAK,GACT,CACH,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,EAAwB;IACpE,OAAO,CACL,2BACY,kBAAkB;QAC5B,kHAAkH;QAClH,SAAS,EAAE,EAAE,CAAC,+GAA+G,EAAE,SAAS,CAAC,KACrI,KAAK,GACT,CACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAmB,YAAY,EAAE;IAC3E,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,eAAe;CACzB,CAAC,CAAA","sourcesContent":["\"use client\"\n\nimport * as React from \"react\"\nimport { IndicatorVariant, SelectableVariant, UIBehavior } from \"@wildo-ai/presets-components-models\"\n\nimport { cn, createCompoundPreset, useUI } from \"@wildo-ai/saas-frontend-lib\"\nimport { optionGestureHandlers } from \"~wildo-presets/components/sections/option-gesture\"\nimport type {\n  TimelineActionsProps,\n  TimelineBodyProps,\n  TimelineCompound,\n  TimelineEntryProps,\n  TimelineMarkerProps,\n  TimelineProps,\n  TimelineTimeProps,\n} from \"@wildo-ai/saas-frontend-lib\"\n\n/**\n * DEFAULT preset for `LOW_LEVEL_TIMELINE`: an ordered list along one rail, entries hanging off it\n * with a marker dot in the entry's tone.\n *\n * ## The marker is the STRONG hue, not the subtle chip\n *\n * The INDICATOR recipe tints a chip with the `*-subtle` tokens, which is right for a badge with\n * words in it and invisible on a 12px dot. The dot fills with the tone's own token — `success`,\n * `warning`, `destructive`, `info`, and the muted foreground for NEUTRAL — total over the\n * vocabulary by type, so a sixth tone is a compile error here rather than a grey dot. A marker WITH\n * content (a glyph) keeps the same fill and sizes to its content.\n *\n * ## Geometry, once\n *\n * The rail is the list's own start border; entries pad past it and the marker sits absolutely on\n * the rail, so the rail and the dots share one coordinate whatever an entry's body contains. The\n * dot's `ring-background` is what lifts it off the rail line.\n */\nconst MARKER_FILL: Record<IndicatorVariant, string> = {\n  [IndicatorVariant.SUCCESS]: \"bg-success text-success-foreground\",\n  [IndicatorVariant.WARNING]: \"bg-warning text-warning-foreground\",\n  [IndicatorVariant.ERROR]: \"bg-destructive text-destructive-foreground\",\n  [IndicatorVariant.INFO]: \"bg-info text-info-foreground\",\n  [IndicatorVariant.NEUTRAL]: \"bg-muted-foreground text-background\",\n}\n\n/** Where the marker sits: centred on the rail, which is the list's start border. */\n/* `--spacing-field` is the rail padding below (`ps-field`); 0.4375rem = half the dot (0.375rem) + half the 1px rail. */\nconst MARKER_POSITION = \"absolute top-1 -start-[calc(var(--spacing-field,1rem)+0.4375rem)]\"\n\n/*\n * The rail's classes, shared by both of its shapes. A named CONTAINER, so an entry can lay its time\n * beside its body when the rail is wide and above it when the rail is narrow — measured on the\n * creation board's split (2026-09-20), where a 200px rail gave the body sixty pixels beside a\n * fixed-width timestamp and a session id wrapped one character per line. The entry decides by the\n * rail's width, never the viewport's.\n */\nconst RAIL = \"@container/timeline relative ms-1.5 flex flex-col gap-group border-s border-border ps-field\"\n\nfunction TimelineRoot({ className, selectable = false, ...props }: TimelineProps): React.JSX.Element {\n  /* A rail a person picks from is a `grid` of `row`s — a `div`, since `ol` does not admit the role. */\n  if (selectable) {\n    return <div data-slot=\"timeline\" role=\"grid\" className={cn(RAIL, className)} {...(props as unknown as React.ComponentProps<\"div\">)} />\n  }\n  return (\n    <ol\n      data-slot=\"timeline\"\n      className={cn(RAIL, className)}\n      {...props}\n    />\n  )\n}\n\nfunction TimelineMarker({ tone = IndicatorVariant.NEUTRAL, className, children, ...props }: TimelineMarkerProps): React.JSX.Element {\n  return (\n    <span\n      data-slot=\"timeline-marker\"\n      data-tone={tone}\n      aria-hidden=\"true\"\n      className={cn(\n        \"inline-flex items-center justify-center rounded-full ring-2 ring-background\",\n        children === undefined || children === null ? \"size-3\" : \"size-5 [&>svg]:size-3\",\n        MARKER_FILL[tone],\n        className,\n      )}\n      {...props}\n    >\n      {children}\n    </span>\n  )\n}\n\nfunction TimelineEntry({ tone = IndicatorVariant.NEUTRAL, marker, option, selected = false, className, children, ...props }: TimelineEntryProps): React.JSX.Element {\n  const { getRecipe } = useUI()\n  /*\n   * A PICKABLE entry wears the same selectable treatment a listbox card does — the FILLED \"you are\n   * here\" tint plus a ring when selected, the theme's focus ring when focusable — so a stream a\n   * person picks from reads like every other pickable list on the surface.\n   */\n  const selectable = option !== undefined || selected ? getRecipe(UIBehavior.SELECTABLE, SelectableVariant.FILLED) : undefined\n  const entryClassName = cn(\n    \"relative flex min-w-0 flex-wrap items-start gap-element rounded-md\",\n    option !== undefined && cn(\"cursor-pointer outline-none px-item-sm py-item-xs -mx-item-sm\", selectable?.states.focus, selectable?.motion.transition),\n    selected && cn(selectable?.states.selected, \"ring-2 ring-ring\"),\n    className,\n  )\n  const content = (\n    <>\n      <span className={cn(MARKER_POSITION, \"flex size-3 items-center justify-center\")}>\n        {marker ?? <TimelineMarker tone={tone} />}\n      </span>\n      {children}\n    </>\n  )\n\n  /*\n   * A PICKABLE entry is a grid `row` owning one `gridcell`, and the gridcell is the entry — focusable,\n   * `aria-selected`, carrying the caller's attributes — because an entry holds `Timeline.Actions` and\n   * an `option` may not contain a control. The wrapper draws nothing; the rail's flex column lays it out.\n   */\n  if (option !== undefined) {\n    return (\n      <div role=\"row\" className=\"min-w-0\">\n        <div\n          data-slot=\"timeline-entry\"\n          data-tone={tone}\n          data-selected={selected}\n          role=\"gridcell\"\n          aria-selected={selected}\n          tabIndex={0}\n          className={entryClassName}\n          {...optionGestureHandlers<HTMLDivElement>(option.onSelect)}\n          {...(props as unknown as React.ComponentProps<\"div\">)}\n        >\n          {content}\n        </div>\n      </div>\n    )\n  }\n\n  return (\n    <li data-slot=\"timeline-entry\" data-tone={tone} data-selected={selected} className={entryClassName} {...props}>\n      {content}\n    </li>\n  )\n}\n\nfunction TimelineTime({ className, ...props }: TimelineTimeProps): React.JSX.Element {\n  return (\n    <time\n      data-slot=\"timeline-time\"\n      /* Full width on a narrow rail (the body follows beneath); beside the body from 24rem up — see the root. */\n      className={cn(\"basis-full shrink-0 pt-px text-2xs text-foreground-subtle tabular-nums @sm/timeline:basis-auto\", className)}\n      {...props}\n    />\n  )\n}\n\nfunction TimelineBody({ className, ...props }: TimelineBodyProps): React.JSX.Element {\n  return (\n    <div\n      data-slot=\"timeline-body\"\n      className={cn(\"flex min-w-0 flex-1 flex-col gap-element-sm text-sm\", className)}\n      {...props}\n    />\n  )\n}\n\nfunction TimelineActions({ className, ...props }: TimelineActionsProps): React.JSX.Element {\n  return (\n    <div\n      data-slot=\"timeline-actions\"\n      /* Its own row on a narrow rail, end-aligned; beside the body, pushed to the end, from 24rem up — see the root. */\n      className={cn(\"flex basis-full shrink-0 items-center justify-end gap-element-sm @sm/timeline:ms-auto @sm/timeline:basis-auto\", className)}\n      {...props}\n    />\n  )\n}\n\nexport const Timeline = createCompoundPreset<TimelineCompound>(TimelineRoot, {\n  Entry: TimelineEntry,\n  Marker: TimelineMarker,\n  Time: TimelineTime,\n  Body: TimelineBody,\n  Actions: TimelineActions,\n})\n"]}

package/dist/esm/components/data-display/untrusted-html-content.d.ts

@@ -0,0 +1,55 @@
+/**
+ * UntrustedHtmlContent — renders HTML a STRANGER wrote (the HTML part of a received email, #1600) without letting it
+ * run, reach the network, or restyle the application (#1912).
+ *
+ * ## What a mail client does, and what this does
+ *
+ * Every mainstream mail client refuses remote content in received mail by default: Thunderbird blocks it and shows a
+ * "remote content" bar, Apple Mail's Mail Privacy Protection and Gmail's image proxy exist because a remote image is
+ * a read receipt (it tells the sender WHEN the message was opened and FROM WHICH address). Browser-based clients do it
+ * by rendering the message in a sandboxed frame with a content-security policy that allows no fetch at all. This does
+ * the same, with the browser as the enforcer rather than a rewrite pass:
+ *
+ * - `<iframe sandbox>` WITHOUT `allow-scripts` and WITHOUT `allow-same-origin`: nothing in the message executes, and
+ *   the frame is an opaque origin that can read neither the application's DOM, cookies nor storage;
+ * - a CSP meta as the frame's first element — `default-src 'none'`: no image, stylesheet, font, media or frame is
+ *   fetched from anywhere. Only inline `data:` images and inline `<style>` are allowed;
+ * - `<base target="_blank">` with `allow-popups` / `allow-popups-to-escape-sandbox`: a link the reader CLICKS opens in a
+ *   new tab (a reader's own act, not the message's); a form never submits (no `allow-forms`).
+ *
+ * spec-cite: HTML Living Standard §4.8.5 "The iframe element" — the `sandbox` attribute's flags (`allow-scripts`,
+ * `allow-same-origin`, `allow-popups`, `allow-popups-to-escape-sandbox`, `allow-forms`) and the opaque origin a frame
+ * without `allow-same-origin` receives. https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-sandbox
+ *
+ * ## Rejected: sanitizing into the page (drop `<style>`, strip remote `src`)
+ *
+ * The first reading surface ran the HTML through the markdown pipeline's `rehype-sanitize`, which keeps images and
+ * UNWRAPS a `<style>` element into visible text. Tightening that schema (drop `<style>`, strip every remote `src`,
+ * `srcset`, `background` and CSS `url()`) was considered and rejected: it is a hand-kept list of ways HTML reaches the
+ * network, and it would still inject the message's markup into the application's own DOM, where a missed
+ * vector is a leak and a `position: fixed` rule is a clickjacking overlay. The frame makes the browser enforce
+ * "no fetch" for every vector at once, and scopes the message's styles to itself — which is why they are KEPT rather
+ * than dropped: a styled newsletter stays readable and cannot touch the page around it.
+ *
+ * Remote content has no opt-in here. Blocking it always is the stricter half of what mail clients do; an explicit
+ * "load remote content" action would be a separate, deliberate addition.
+ */
+import * as React from "react";
+/**
+ * The frame's policy. `img-src data:` keeps inline images a message carries in its own body; nothing else loads.
+ * `style-src 'unsafe-inline'` lets the message's own `<style>` apply INSIDE the frame only.
+ */
+export declare const UNTRUSTED_HTML_CONTENT_SECURITY_POLICY = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:";
+/** The sandbox flags: links a reader clicks may open a new tab, and nothing else is granted. */
+export declare const UNTRUSTED_HTML_SANDBOX = "allow-popups allow-popups-to-escape-sandbox";
+/** The document the frame renders: the policy FIRST, so it governs everything after it. */
+export declare function composeUntrustedHtmlDocument(html: string): string;
+export interface UntrustedHtmlContentProps {
+    /** HTML from outside the application. Never trusted, never injected into the page. */
+    value: string;
+    /** Accessible name of the frame (a title the screen reader announces). */
+    title: string;
+    className?: string;
+}
+export declare function UntrustedHtmlContent({ value, title, className }: UntrustedHtmlContentProps): React.JSX.Element;
+//# sourceMappingURL=untrusted-html-content.d.ts.map

package/dist/esm/components/data-display/untrusted-html-content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-html-content.d.ts","sourceRoot":"","sources":["../../../../../src/components/data-display/untrusted-html-content.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAI9B;;;GAGG;AACH,eAAO,MAAM,sCAAsC,iFAAiF,CAAA;AAEpI,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,gDAAgD,CAAA;AAEnF,2FAA2F;AAC3F,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWjE;AAED,MAAM,WAAW,yBAAyB;IACxC,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wBAAgB,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,yBAAyB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAY9G"}

package/dist/esm/components/data-display/untrusted-html-content.js

@@ -0,0 +1,67 @@
+"use client";
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * UntrustedHtmlContent — renders HTML a STRANGER wrote (the HTML part of a received email, #1600) without letting it
+ * run, reach the network, or restyle the application (#1912).
+ *
+ * ## What a mail client does, and what this does
+ *
+ * Every mainstream mail client refuses remote content in received mail by default: Thunderbird blocks it and shows a
+ * "remote content" bar, Apple Mail's Mail Privacy Protection and Gmail's image proxy exist because a remote image is
+ * a read receipt (it tells the sender WHEN the message was opened and FROM WHICH address). Browser-based clients do it
+ * by rendering the message in a sandboxed frame with a content-security policy that allows no fetch at all. This does
+ * the same, with the browser as the enforcer rather than a rewrite pass:
+ *
+ * - `<iframe sandbox>` WITHOUT `allow-scripts` and WITHOUT `allow-same-origin`: nothing in the message executes, and
+ *   the frame is an opaque origin that can read neither the application's DOM, cookies nor storage;
+ * - a CSP meta as the frame's first element — `default-src 'none'`: no image, stylesheet, font, media or frame is
+ *   fetched from anywhere. Only inline `data:` images and inline `<style>` are allowed;
+ * - `<base target="_blank">` with `allow-popups` / `allow-popups-to-escape-sandbox`: a link the reader CLICKS opens in a
+ *   new tab (a reader's own act, not the message's); a form never submits (no `allow-forms`).
+ *
+ * spec-cite: HTML Living Standard §4.8.5 "The iframe element" — the `sandbox` attribute's flags (`allow-scripts`,
+ * `allow-same-origin`, `allow-popups`, `allow-popups-to-escape-sandbox`, `allow-forms`) and the opaque origin a frame
+ * without `allow-same-origin` receives. https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-sandbox
+ *
+ * ## Rejected: sanitizing into the page (drop `<style>`, strip remote `src`)
+ *
+ * The first reading surface ran the HTML through the markdown pipeline's `rehype-sanitize`, which keeps images and
+ * UNWRAPS a `<style>` element into visible text. Tightening that schema (drop `<style>`, strip every remote `src`,
+ * `srcset`, `background` and CSS `url()`) was considered and rejected: it is a hand-kept list of ways HTML reaches the
+ * network, and it would still inject the message's markup into the application's own DOM, where a missed
+ * vector is a leak and a `position: fixed` rule is a clickjacking overlay. The frame makes the browser enforce
+ * "no fetch" for every vector at once, and scopes the message's styles to itself — which is why they are KEPT rather
+ * than dropped: a styled newsletter stays readable and cannot touch the page around it.
+ *
+ * Remote content has no opt-in here. Blocking it always is the stricter half of what mail clients do; an explicit
+ * "load remote content" action would be a separate, deliberate addition.
+ */
+import * as React from "react";
+import { cn } from "@wildo-ai/saas-frontend-lib";
+/**
+ * The frame's policy. `img-src data:` keeps inline images a message carries in its own body; nothing else loads.
+ * `style-src 'unsafe-inline'` lets the message's own `<style>` apply INSIDE the frame only.
+ */
+export const UNTRUSTED_HTML_CONTENT_SECURITY_POLICY = "default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:";
+/** The sandbox flags: links a reader clicks may open a new tab, and nothing else is granted. */
+export const UNTRUSTED_HTML_SANDBOX = "allow-popups allow-popups-to-escape-sandbox";
+/** The document the frame renders: the policy FIRST, so it governs everything after it. */
+export function composeUntrustedHtmlDocument(html) {
+    return [
+        "<!doctype html><html><head>",
+        `<meta http-equiv="Content-Security-Policy" content="${UNTRUSTED_HTML_CONTENT_SECURITY_POLICY}">`,
+        '<meta name="referrer" content="no-referrer">',
+        '<base target="_blank">',
+        "<style>body{margin:0;font-family:system-ui,sans-serif;font-size:14px;line-height:1.5;word-wrap:break-word}img{max-width:100%;height:auto}</style>",
+        "</head><body>",
+        html,
+        "</body></html>",
+    ].join("");
+}
+export function UntrustedHtmlContent({ value, title, className }) {
+    const document = React.useMemo(() => composeUntrustedHtmlDocument(value), [value]);
+    return (_jsx("iframe", { title: title, sandbox: UNTRUSTED_HTML_SANDBOX, srcDoc: document, referrerPolicy: "no-referrer", 
+        // An opaque-origin frame cannot be measured from outside, so it has a reading height and resizes by hand.
+        className: cn("w-full min-h-[12rem] h-[32rem] resize-y rounded-md border border-border bg-background", className) }));
+}
+//# sourceMappingURL=untrusted-html-content.js.map

package/dist/esm/components/data-display/untrusted-html-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-html-content.js","sourceRoot":"","sources":["../../../../../src/components/data-display/untrusted-html-content.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAE9B,OAAO,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAA;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,8EAA8E,CAAA;AAEpI,gGAAgG;AAChG,MAAM,CAAC,MAAM,sBAAsB,GAAG,6CAA6C,CAAA;AAEnF,2FAA2F;AAC3F,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,OAAO;QACL,6BAA6B;QAC7B,uDAAuD,sCAAsC,IAAI;QACjG,8CAA8C;QAC9C,wBAAwB;QACxB,mJAAmJ;QACnJ,eAAe;QACf,IAAI;QACJ,gBAAgB;KACjB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACZ,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAA6B;IACzF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAClF,OAAO,CACL,iBACE,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,QAAQ,EAChB,cAAc,EAAC,aAAa;QAC5B,0GAA0G;QAC1G,SAAS,EAAE,EAAE,CAAC,uFAAuF,EAAE,SAAS,CAAC,GACjH,CACH,CAAA;AACH,CAAC","sourcesContent":["\"use client\"\n\n/**\n * UntrustedHtmlContent — renders HTML a STRANGER wrote (the HTML part of a received email, #1600) without letting it\n * run, reach the network, or restyle the application (#1912).\n *\n * ## What a mail client does, and what this does\n *\n * Every mainstream mail client refuses remote content in received mail by default: Thunderbird blocks it and shows a\n * \"remote content\" bar, Apple Mail's Mail Privacy Protection and Gmail's image proxy exist because a remote image is\n * a read receipt (it tells the sender WHEN the message was opened and FROM WHICH address). Browser-based clients do it\n * by rendering the message in a sandboxed frame with a content-security policy that allows no fetch at all. This does\n * the same, with the browser as the enforcer rather than a rewrite pass:\n *\n * - `<iframe sandbox>` WITHOUT `allow-scripts` and WITHOUT `allow-same-origin`: nothing in the message executes, and\n *   the frame is an opaque origin that can read neither the application's DOM, cookies nor storage;\n * - a CSP meta as the frame's first element — `default-src 'none'`: no image, stylesheet, font, media or frame is\n *   fetched from anywhere. Only inline `data:` images and inline `<style>` are allowed;\n * - `<base target=\"_blank\">` with `allow-popups` / `allow-popups-to-escape-sandbox`: a link the reader CLICKS opens in a\n *   new tab (a reader's own act, not the message's); a form never submits (no `allow-forms`).\n *\n * spec-cite: HTML Living Standard §4.8.5 \"The iframe element\" — the `sandbox` attribute's flags (`allow-scripts`,\n * `allow-same-origin`, `allow-popups`, `allow-popups-to-escape-sandbox`, `allow-forms`) and the opaque origin a frame\n * without `allow-same-origin` receives. https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-sandbox\n *\n * ## Rejected: sanitizing into the page (drop `<style>`, strip remote `src`)\n *\n * The first reading surface ran the HTML through the markdown pipeline's `rehype-sanitize`, which keeps images and\n * UNWRAPS a `<style>` element into visible text. Tightening that schema (drop `<style>`, strip every remote `src`,\n * `srcset`, `background` and CSS `url()`) was considered and rejected: it is a hand-kept list of ways HTML reaches the\n * network, and it would still inject the message's markup into the application's own DOM, where a missed\n * vector is a leak and a `position: fixed` rule is a clickjacking overlay. The frame makes the browser enforce\n * \"no fetch\" for every vector at once, and scopes the message's styles to itself — which is why they are KEPT rather\n * than dropped: a styled newsletter stays readable and cannot touch the page around it.\n *\n * Remote content has no opt-in here. Blocking it always is the stricter half of what mail clients do; an explicit\n * \"load remote content\" action would be a separate, deliberate addition.\n */\n\nimport * as React from \"react\"\n\nimport { cn } from \"@wildo-ai/saas-frontend-lib\"\n\n/**\n * The frame's policy. `img-src data:` keeps inline images a message carries in its own body; nothing else loads.\n * `style-src 'unsafe-inline'` lets the message's own `<style>` apply INSIDE the frame only.\n */\nexport const UNTRUSTED_HTML_CONTENT_SECURITY_POLICY = \"default-src 'none'; img-src data:; style-src 'unsafe-inline'; font-src data:\"\n\n/** The sandbox flags: links a reader clicks may open a new tab, and nothing else is granted. */\nexport const UNTRUSTED_HTML_SANDBOX = \"allow-popups allow-popups-to-escape-sandbox\"\n\n/** The document the frame renders: the policy FIRST, so it governs everything after it. */\nexport function composeUntrustedHtmlDocument(html: string): string {\n  return [\n    \"<!doctype html><html><head>\",\n    `<meta http-equiv=\"Content-Security-Policy\" content=\"${UNTRUSTED_HTML_CONTENT_SECURITY_POLICY}\">`,\n    '<meta name=\"referrer\" content=\"no-referrer\">',\n    '<base target=\"_blank\">',\n    \"<style>body{margin:0;font-family:system-ui,sans-serif;font-size:14px;line-height:1.5;word-wrap:break-word}img{max-width:100%;height:auto}</style>\",\n    \"</head><body>\",\n    html,\n    \"</body></html>\",\n  ].join(\"\")\n}\n\nexport interface UntrustedHtmlContentProps {\n  /** HTML from outside the application. Never trusted, never injected into the page. */\n  value: string\n  /** Accessible name of the frame (a title the screen reader announces). */\n  title: string\n  className?: string\n}\n\nexport function UntrustedHtmlContent({ value, title, className }: UntrustedHtmlContentProps): React.JSX.Element {\n  const document = React.useMemo(() => composeUntrustedHtmlDocument(value), [value])\n  return (\n    <iframe\n      title={title}\n      sandbox={UNTRUSTED_HTML_SANDBOX}\n      srcDoc={document}\n      referrerPolicy=\"no-referrer\"\n      // An opaque-origin frame cannot be measured from outside, so it has a reading height and resizes by hand.\n      className={cn(\"w-full min-h-[12rem] h-[32rem] resize-y rounded-md border border-border bg-background\", className)}\n    />\n  )\n}\n"]}

package/dist/esm/components/feedback/celebration-overlay.d.ts

@@ -8,10 +8,19 @@ import type { CelebrationOverlayProps } from '@wildo-ai/saas-frontend-lib';
  * any engine concepts.
  *
  * Modes:
- * - `overlay`: Full-screen centered overlay with message + confetti emoji
- * - `confetti`: Lightweight confetti burst (no blocking overlay)
- * - `lottie`: Animated TADA icon via the unified icon system (uses `renderIcon` with
- *   `StandardIconReference.TADA`, rendered in a scaled container for visual impact)
+ * - `confetti`: a non-blocking particle burst over the page, `aria-hidden`, purely decorative.
+ * - `overlay`: a blocking Dialog carrying the message, an optional next-step CTA and a dismiss.
+ * - `lottie`: renders EXACTLY as `overlay` in this default preset.
+ *
+ * Both dialog modes draw `StandardIconReference.TADA` from the icon registry, which plays an animated
+ * Lottie when the application ran `registerDefaultAnimations()` and the reader has not asked for
+ * reduced motion — so the dialog DOES animate; `lottie` simply adds nothing to it here. An earlier
+ * version of this comment said "no Lottie animation is played", which stopped being true once both
+ * branches drew the registry icon.
+ *
+ * `lottie` is the mode an application's OWN preset for `LOW_LEVEL_CELEBRATION_OVERLAY` can give a
+ * meaning to — a per-milestone animation chosen from `notificationIdentifier`, for instance. This
+ * default preset keeps it equal to `overlay` rather than inventing an asset it has no way to know.
  *
  * For engine integration, see the celebration-overlay wrapper in saas-frontend-lib
  * which wires NotificationContext and i18n.

package/dist/esm/components/feedback/celebration-overlay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"celebration-overlay.d.ts","sourceRoot":"","sources":["../../../../src/components/feedback/celebration-overlay.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAG9B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AA4B1E;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,gGA4J9B,CAAC"}
+{"version":3,"file":"celebration-overlay.d.ts","sourceRoot":"","sources":["../../../../../src/components/feedback/celebration-overlay.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAA;AAG9B,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AA6B1E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,kBAAkB,gGAuR9B,CAAC"}