@xemahq/ui-kernel 0.9.1 → 0.9.2

package/src/vista/surfaces/index.ts

@@ -0,0 +1,24 @@
+import './register-surfaces';
+
+export { ChartSurface } from './ChartSurface';
+export { FilesSurface } from './FilesSurface';
+export {
+  fileExtMeta,
+  groupFilesByFolder,
+  type VistaFileGroup,
+} from './file-surface-utils';
+export { FormSurface } from './FormSurface';
+export {
+  extractServiceMessage,
+  readElicitationStatus,
+  resolveTrustedElicitationEndpoints,
+  resolveTrustedElicitationLaunchUrl,
+  submitElicitationFields,
+  VistaFormSubmitError,
+  VistaFormTransportConfigError,
+} from './elicitation-transport';
+export { HtmlSurface } from './HtmlSurface';
+export { TableSurface } from './TableSurface';
+export { UrlSurface } from './UrlSurface';
+export { CodeSurface, DiffSurface, JsonSurface } from './text-surfaces';
+export { ImageSurface, MediaSurface, PdfSurface } from './blob-surfaces';

package/src/vista/surfaces/{index.tsx → register-surfaces.tsx}

@@ -29,11 +29,7 @@
  */
 import { SurfaceKind } from '@xemahq/kernel-contracts/surface';
 
-import {
-  ImageSurface,
-  MediaSurface,
-  PdfSurface,
-} from './blob-surfaces';
+import { ImageSurface, MediaSurface, PdfSurface } from './blob-surfaces';
 import { ChartSurface } from './ChartSurface';
 import { FilesSurface } from './FilesSurface';
 import { FormSurface } from './FormSurface';
@@ -139,19 +135,3 @@ vistaSurfaceRegistry.registerFirstParty(SurfaceKind.Form, {
   validate: validateFormPayload,
   render: (payload) => <FormSurface {...payload} />,
 });
-
-export { ChartSurface } from './ChartSurface';
-export { FilesSurface, fileExtMeta, groupFilesByFolder } from './FilesSurface';
-export { FormSurface } from './FormSurface';
-export {
-  submitElicitationFields,
-  readElicitationStatus,
-  extractServiceMessage,
-  VistaFormSubmitError,
-} from './elicitation-transport';
-export { HtmlSurface } from './HtmlSurface';
-export { TableSurface } from './TableSurface';
-export { UrlSurface } from './UrlSurface';
-export { CodeSurface, DiffSurface, JsonSurface } from './text-surfaces';
-export { ImageSurface, MediaSurface, PdfSurface } from './blob-surfaces';
-export type { VistaFileGroup } from './FilesSurface';

package/src/vista/surfaces/text-surfaces.tsx

@@ -9,7 +9,7 @@
  * `plain` tab kind was collapsed into it; one kind, one renderer, no alias).
  */
 
-import { useVistaCodeRenderer } from '../vista-code-renderer';
+import { useVistaCodeRenderer } from '../vista-code-renderer-context';
 import { VistaFileText } from '../vista-file-source';
 
 import type { VistaTextPayload } from '../vista-payloads';

package/src/vista/vista-code-renderer-context.ts

@@ -0,0 +1,16 @@
+import { createContext, useContext } from 'react';
+
+import type { ReactNode } from 'react';
+
+export type VistaCodeRenderer = (args: {
+  readonly content: string;
+  readonly path?: string;
+  readonly language?: string;
+}) => ReactNode;
+
+export const VistaCodeRendererContext =
+  createContext<VistaCodeRenderer | null>(null);
+
+export function useVistaCodeRenderer(): VistaCodeRenderer | null {
+  return useContext(VistaCodeRendererContext);
+}

package/src/vista/vista-code-renderer.tsx

@@ -14,20 +14,13 @@
  * the intended rendering. Neither is an error path.
  */
 import {
-  createContext,
-  useContext,
   type ReactElement,
   type ReactNode,
 } from 'react';
-
-/** Draw a code body. `path` is present for a file-backed surface. */
-export type VistaCodeRenderer = (args: {
-  readonly content: string;
-  readonly path?: string;
-  readonly language?: string;
-}) => ReactNode;
-
-const VistaCodeRendererContext = createContext<VistaCodeRenderer | null>(null);
+import {
+  VistaCodeRendererContext,
+  type VistaCodeRenderer,
+} from './vista-code-renderer-context';
 
 export function VistaCodeRendererProvider({
   renderer,
@@ -39,8 +32,3 @@ export function VistaCodeRendererProvider({
     </VistaCodeRendererContext.Provider>
   );
 }
-
-/** The host's code renderer, or `null` for the built-in mono pane. */
-export function useVistaCodeRenderer(): VistaCodeRenderer | null {
-  return useContext(VistaCodeRendererContext);
-}

package/src/vista/vista-file-context.ts

@@ -0,0 +1,14 @@
+import { createContext, useContext } from 'react';
+
+export interface VistaFileSource {
+  readText(path: string): Promise<string>;
+  resolveUrl(path: string): Promise<string>;
+  readonly revision?: string | number;
+}
+
+export const VistaFileSourceContext =
+  createContext<VistaFileSource | null>(null);
+
+export function useVistaFileSource(): VistaFileSource | null {
+  return useContext(VistaFileSourceContext);
+}

package/src/vista/vista-file-source.tsx

@@ -13,34 +13,16 @@
  * "content unavailable".
  */
 import {
-  createContext,
-  useContext,
   useEffect,
   useState,
   type ReactElement,
   type ReactNode,
 } from 'react';
-
-/** Host-supplied byte access for path-backed surfaces. */
-export interface VistaFileSource {
-  /** Read a workspace-relative path as text. Rejects on failure. */
-  readText(path: string): Promise<string>;
-  /**
-   * Resolve a workspace-relative path to a fetchable URL (`blob:`, `data:`, or
-   * a durable `https:` URL) for binary surfaces. Rejects on failure.
-   *
-   * The host owns the lifetime of anything it creates (e.g. revoking an object
-   * URL); the surface only reads.
-   */
-  resolveUrl(path: string): Promise<string>;
-  /**
-   * Opaque revision token. Change it to make every mounted path-backed surface
-   * re-read (the host bumps it on a workspace file-change event).
-   */
-  readonly revision?: string | number;
-}
-
-const VistaFileSourceContext = createContext<VistaFileSource | null>(null);
+import {
+  VistaFileSourceContext,
+  useVistaFileSource,
+  type VistaFileSource,
+} from './vista-file-context';
 
 export function VistaFileSourceProvider({
   source,
@@ -53,11 +35,6 @@ export function VistaFileSourceProvider({
   );
 }
 
-/** The active file source, or `null` when no provider is mounted. */
-export function useVistaFileSource(): VistaFileSource | null {
-  return useContext(VistaFileSourceContext);
-}
-
 /** Async load state for a path-backed surface. */
 type LoadState =
   | { readonly status: 'loading' }

package/src/vista/vista-form-context.ts

@@ -0,0 +1,20 @@
+import { createContext, useContext } from 'react';
+
+export interface VistaFormOutcome {
+  readonly submitted: true;
+  readonly ref: string;
+  readonly connectionId: string | null;
+}
+
+export interface VistaFormHost {
+  readonly elicitationApiBaseUrl: string;
+  getAccessToken(): Promise<string>;
+  onOutcome(outcome: VistaFormOutcome): void;
+}
+
+export const VistaFormHostContext =
+  createContext<VistaFormHost | null>(null);
+
+export function useVistaFormHost(): VistaFormHost | null {
+  return useContext(VistaFormHostContext);
+}

package/src/vista/vista-form-host.tsx

@@ -18,16 +18,22 @@
  *   2. `getAccessToken` returns the SUBJECT's token. The host binds it to the
  *      logged-in user's session; it is never a service token and never the
  *      agent's token, so the service authorizes the human, not the model.
- *   3. The surface's transport posts to an ABSOLUTE service URL taken from the
- *      validated payload (see `validateFormPayload`, which rejects a relative
- *      URL). There is no host-relative path, so it cannot be pointed at the
- *      app's own BFF/chat transport.
+ *   3. `elicitationApiBaseUrl` is supplied by trusted host configuration, never
+ *      by the agent-controlled payload. The kernel validates its scheme and
+ *      canonical authority/path before deriving the status/submit endpoints.
  *
  * There is deliberately NO default host: a `form` surface mounted without a
  * provider renders a visible refusal and cannot submit. Fail-closed — a form
  * that silently posts nowhere would be worse than one that says it cannot.
  */
-import { createContext, useContext, type ReactElement, type ReactNode } from 'react';
+import {
+  type ReactElement,
+  type ReactNode,
+} from 'react';
+import {
+  VistaFormHostContext,
+  type VistaFormHost,
+} from './vista-form-context';
 
 /**
  * Everything a settled elicitation reports. Closed, scalar-only, and
@@ -35,32 +41,6 @@ import { createContext, useContext, type ReactElement, type ReactNode } from 're
  * persistence layer behind it has no column able to hold a field value, and
  * neither does this type.
  */
-export interface VistaFormOutcome {
-  /** Always `true`: an unsettled elicitation produces no outcome at all. */
-  readonly submitted: true;
-  /** The elicitation reference the agent polls. Opaque, non-secret. */
-  readonly ref: string;
-  /** The connection the submission provisioned, when the service reported one. */
-  readonly connectionId: string | null;
-}
-
-/** Host-supplied capabilities for the `form` surface. */
-export interface VistaFormHost {
-  /**
-   * The SUBJECT's own access token. Called once per request so a refreshed
-   * token is picked up without remounting the surface.
-   */
-  getAccessToken(): Promise<string>;
-  /**
-   * Called exactly once when the elicitation settles. The host relays this to
-   * whatever needs to know (cache invalidation, the agent session). By type it
-   * can carry nothing but the outcome.
-   */
-  onOutcome(outcome: VistaFormOutcome): void;
-}
-
-const VistaFormHostContext = createContext<VistaFormHost | null>(null);
-
 export function VistaFormHostProvider({
   host,
   children,
@@ -71,8 +51,3 @@ export function VistaFormHostProvider({
     </VistaFormHostContext.Provider>
   );
 }
-
-/** The active form host, or `null` when no provider is mounted. */
-export function useVistaFormHost(): VistaFormHost | null {
-  return useContext(VistaFormHostContext);
-}

package/src/vista/vista-open-context.tsx

@@ -12,18 +12,13 @@
  * silently does nothing.
  */
 import {
-  createContext,
-  useContext,
   type ReactElement,
   type ReactNode,
 } from 'react';
-
-import type { VistaTab } from './vista-model';
-
-/** Open (or replace) a tab and focus it. Mirrors `VistaTabsController.open`. */
-export type VistaOpenFn = (surface: VistaTab) => string;
-
-const VistaOpenContext = createContext<VistaOpenFn | null>(null);
+import {
+  VistaOpenContext,
+  type VistaOpenFn,
+} from './vista-open-state';
 
 export function VistaOpenProvider({
   open,
@@ -35,8 +30,3 @@ export function VistaOpenProvider({
     </VistaOpenContext.Provider>
   );
 }
-
-/** The panel's `open`, or `null` when no panel is mounted above. */
-export function useVistaOpen(): VistaOpenFn | null {
-  return useContext(VistaOpenContext);
-}

package/src/vista/vista-open-state.ts

@@ -0,0 +1,11 @@
+import { createContext, useContext } from 'react';
+
+import type { VistaTab } from './vista-model';
+
+export type VistaOpenFn = (surface: VistaTab) => string;
+
+export const VistaOpenContext = createContext<VistaOpenFn | null>(null);
+
+export function useVistaOpen(): VistaOpenFn | null {
+  return useContext(VistaOpenContext);
+}

package/src/vista/vista-payloads.ts

@@ -199,7 +199,8 @@ export interface VistaTablePayload {
 export function validateTablePayload(raw: unknown): VistaTablePayload | null {
   const record = asRecord(raw);
   if (record === null) return null;
-  if (!Array.isArray(record.columns) || !Array.isArray(record.rows)) return null;
+  if (!Array.isArray(record.columns) || !Array.isArray(record.rows))
+    return null;
   if (!record.columns.every((c) => typeof c === 'string')) return null;
   if (!record.rows.every((r) => Array.isArray(r))) return null;
   return {
@@ -244,7 +245,8 @@ export function validateChartPayload(raw: unknown): VistaChartPayload | null {
   if (record === null) return null;
   if (typeof record.kind !== 'string' || !CHART_KINDS.includes(record.kind))
     return null;
-  if (typeof record.title !== 'string' || record.title.length === 0) return null;
+  if (typeof record.title !== 'string' || record.title.length === 0)
+    return null;
   if (!Array.isArray(record.series) || record.series.length === 0) return null;
   const series: VistaChartSeries[] = [];
   for (const entry of record.series) {
@@ -377,37 +379,18 @@ export function validateWebPayload(raw: unknown): VistaWebPayload | null {
     : null;
 }
 
-/**
- * An `http(s)` ABSOLUTE URL, or `null`.
- *
- * Every URL on a {@link VistaFormPayload} must be absolute. That is the
- * structural half of "the value goes browser → service and never through the
- * agent": a relative path would resolve against the HOST app's origin — i.e.
- * its BFF, where the chat transport lives — so a relative submit target is
- * rejected outright rather than normalised.
- */
-function absoluteHttpUrl(value: unknown): string | null {
-  if (typeof value !== 'string' || value.length === 0) return null;
-  let parsed: URL;
-  try {
-    parsed = new URL(value);
-  } catch {
-    return null;
-  }
-  return parsed.protocol === 'https:' || parsed.protocol === 'http:' ? value : null;
-}
-
 /**
  * The consent / install handoff of a {@link VistaFormPayload}.
  *
  * Present when the connector's app auth is `oauth2` or `app_install`: there is
  * no field form to fill, only a link the user follows in another window. It is
- * fully generic — the URL is minted per-provider by the owning service and
- * carried here verbatim, so no provider is special-cased in the renderer.
+ * fully generic — the owning service supplies a path under the host-configured
+ * trusted service origin, so no provider is special-cased in the renderer and
+ * an agent-controlled payload never selects a network authority.
  */
 export interface VistaFormLaunch {
-  /** ABSOLUTE consent / install URL, opened in a new window. */
-  readonly url: string;
+  /** Root-relative consent / install path on the trusted elicitation service. */
+  readonly path: string;
   /** Button copy, e.g. "Install Acme" / "Continue to Acme". */
   readonly label: string;
   /** Optional explanation rendered above the button. */
@@ -421,10 +404,10 @@ export interface VistaFormLaunch {
  * never see. Two mutually-exclusive modes, chosen by the presence of
  * {@link launch}:
  *
- *   • FIELD mode — render `fields`, POST them to `submitUrl` with the user's
- *     own JWT;
+ *   • FIELD mode — render `fields`, POST them through the host's trusted
+ *     elicitation-service base URL with the user's own JWT;
  *   • LAUNCH mode — render the consent/install link, then confirm completion
- *     against `statusUrl`.
+ *     through that same trusted service.
  *
  * Both settle into the same `{ submitted, ref }` shape, so the agent's view of
  * the world does not depend on which mode ran.
@@ -434,10 +417,6 @@ export interface VistaFormPayload {
   readonly ref: string;
   /** Why the credential is being asked for — shown to the user verbatim. */
   readonly purpose: string;
-  /** ABSOLUTE service URL the captured fields are POSTed to. */
-  readonly submitUrl: string;
-  /** ABSOLUTE service URL reporting whether the elicitation has settled. */
-  readonly statusUrl: string;
   /** The onboarding form's fields. MAY be empty — the service is the authority. */
   readonly fields: readonly CaptureFieldSpec[];
   /** Optional heading override (defaults to the tab title). */
@@ -448,16 +427,26 @@ export interface VistaFormPayload {
   readonly launch?: VistaFormLaunch;
 }
 
+const VISTA_FORM_REF_PATTERN = /^[A-Za-z0-9_-]{1,256}$/;
+
+/** Whether a value is one opaque base64url elicitation path segment. */
+export function isValidVistaFormRef(value: unknown): value is string {
+  return typeof value === 'string' && VISTA_FORM_REF_PATTERN.test(value);
+}
+
 export function validateFormPayload(raw: unknown): VistaFormPayload | null {
   const record = asRecord(raw);
   if (record === null) return null;
-  if (typeof record.ref !== 'string' || record.ref.length === 0) return null;
+  // The service generates base64url refs. Keeping the accepted alphabet closed
+  // makes the ref safe as exactly one URL path segment; dot segments, slashes,
+  // percent escapes and Unicode lookalikes are all rejected.
+  if (!isValidVistaFormRef(record.ref)) {
+    return null;
+  }
   if (typeof record.purpose !== 'string') return null;
-
-  const submitUrl = absoluteHttpUrl(record.submitUrl);
-  if (submitUrl === null) return null;
-  const statusUrl = absoluteHttpUrl(record.statusUrl);
-  if (statusUrl === null) return null;
+  // Deliberately reject the old contract rather than silently ignoring its
+  // payload-selected network targets.
+  if ('submitUrl' in record || 'statusUrl' in record) return null;
 
   const fields = validateCaptureFields(record.fields);
   if (fields === null) return null;
@@ -471,24 +460,32 @@ export function validateFormPayload(raw: unknown): VistaFormPayload | null {
   if (record.launch !== undefined) {
     const raw_ = asRecord(record.launch);
     if (raw_ === null) return null;
-    const url = absoluteHttpUrl(raw_.url);
-    if (url === null) return null;
+    if ('url' in raw_) return null;
+    if (
+      typeof raw_.path !== 'string' ||
+      !raw_.path.startsWith('/') ||
+      raw_.path.startsWith('//') ||
+      raw_.path.includes('\\')
+    ) {
+      return null;
+    }
     if (typeof raw_.label !== 'string' || raw_.label.length === 0) return null;
     const hint = optionalString(raw_.hint);
     if (hint === null) return null;
-    launch = hint === undefined ? { url, label: raw_.label } : { url, label: raw_.label, hint };
+    launch =
+      hint === undefined
+        ? { path: raw_.path, label: raw_.label }
+        : { path: raw_.path, label: raw_.label, hint };
   }
 
   const payload: {
     ref: string;
     purpose: string;
-    submitUrl: string;
-    statusUrl: string;
     fields: readonly CaptureFieldSpec[];
     heading?: string;
     submitLabel?: string;
     launch?: VistaFormLaunch;
-  } = { ref: record.ref, purpose: record.purpose, submitUrl, statusUrl, fields };
+  } = { ref: record.ref, purpose: record.purpose, fields };
   if (heading !== undefined) payload.heading = heading;
   if (submitLabel !== undefined) payload.submitLabel = submitLabel;
   if (launch !== undefined) payload.launch = launch;
@@ -505,7 +502,8 @@ export interface VistaAppPayload {
 export function validateAppPayload(raw: unknown): VistaAppPayload | null {
   const record = asRecord(raw);
   if (record === null) return null;
-  if (typeof record.appId !== 'string' || record.appId.length === 0) return null;
+  if (typeof record.appId !== 'string' || record.appId.length === 0)
+    return null;
   const path = optionalString(record.path);
   if (path === null) return null;
   return path === undefined

package/src/vista/vista-tools.ts

@@ -120,7 +120,7 @@ export const VistaToolResultSchema: z.ZodType<VistaToolResult> = z.union([
     error: z.nativeEnum(VistaToolError),
     detail: z.string().optional(),
   }),
-]) as z.ZodType<VistaToolResult>;
+]);
 
 /**
  * Perform a relayed Vista tool call against a mounted panel's controller.
@@ -151,7 +151,7 @@ export function dispatchVistaTool(
       const { tabId, ...patch } = parsed.data;
       const refusal = refusalFor(controller, tabId);
       if (refusal !== null) return refusal;
-      if (!controller.update(tabId, patch as VistaSurfacePatch)) {
+      if (!controller.update(tabId, patch)) {
         // The tab is listed but not opened-tab-owned: it is a HOST tab, and a
         // patch to it would be overwritten by the host's next reconcile.
         return {

package/dist/lib/biome-host/response-envelope.d.ts

@@ -1,3 +0,0 @@
-export declare function unwrapList<T>(value: unknown): T[];
-export declare function unwrapData<T>(value: unknown): T;
-//# sourceMappingURL=response-envelope.d.ts.map

package/dist/lib/biome-host/response-envelope.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"response-envelope.d.ts","sourceRoot":"","sources":["../../../src/lib/biome-host/response-envelope.ts"],"names":[],"mappings":"AA+BA,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,EAAE,CAYjD;AAeD,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,CAU/C"}

package/dist/lib/biome-host/response-envelope.js

@@ -1,21 +0,0 @@
-export function unwrapList(value) {
-    if (Array.isArray(value)) {
-        return value;
-    }
-    if (value !== null &&
-        typeof value === 'object' &&
-        Array.isArray(value.data)) {
-        return value.data;
-    }
-    return [];
-}
-export function unwrapData(value) {
-    if (value !== null &&
-        typeof value === 'object' &&
-        'data' in value &&
-        !('pagination' in value)) {
-        return value.data;
-    }
-    return value;
-}
-//# sourceMappingURL=response-envelope.js.map

package/dist/lib/biome-host/response-envelope.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"response-envelope.js","sourceRoot":"","sources":["../../../src/lib/biome-host/response-envelope.ts"],"names":[],"mappings":"AA+BA,MAAM,UAAU,UAAU,CAAI,KAAc;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAY,CAAC;IACtB,CAAC;IACD,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAE,KAA4B,CAAC,IAAI,CAAC,EACjD,CAAC;QACD,OAAQ,KAAuB,CAAC,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAeD,MAAM,UAAU,UAAU,CAAI,KAAc;IAC1C,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,IAAK,KAAiC;QAC5C,CAAC,CAAC,YAAY,IAAK,KAAiC,CAAC,EACrD,CAAC;QACD,OAAQ,KAAqB,CAAC,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,KAAU,CAAC;AACpB,CAAC"}

package/src/lib/biome-host/response-envelope.ts

@@ -1,69 +0,0 @@
-/**
- * Frontend mirror of the backend `ResponseEnvelopeInterceptor`.
- *
- * Every 2xx body the platform returns is wrapped as `{ data: T }`, or
- * `{ data: T[], pagination }` for a paginated list (single source of truth:
- * `@xemahq/platform-common`'s `ResponseEnvelopeInterceptor`). Orval's
- * `custom-fetch` mutators usually peel that envelope at the HTTP boundary, but
- * spec drift (a controller typed `T[]` that emits `{ data }`), public clients
- * that DON'T peel, and transient partial responses leave a `.data`-wrapped or
- * mis-shaped value where biome code expects a bare value/array — and a raw
- * `.map` on it white-screens the route.
- *
- * These are the ONE shared, pure unwrap helpers — no host context, no fetch.
- * Biomes (and the host shell's own `unwrap-list.ts`) should adopt these instead
- * of re-implementing the guard. This is the shared helper only; adopters are
- * migrated incrementally, not in a blanket rewrite.
- */
-
-/**
- * Resilient list unwrap for DISPLAY surfaces — normalises a React-Query `.data`
- * to an array so the page renders its empty/error state instead of crashing:
- *
- *   - already an array        → returned as-is
- *   - `{ data: T[] }` envelope → `value.data`
- *   - anything else            → `[]`
- *
- * Deliberately NON-throwing: the query's own `isError`/`isLoading` flags drive
- * the visible error/empty UI; this only guards the render path. For
- * mutation/single-resource flows where an unexpected shape is a real bug, use
- * {@link unwrapData} (fail-fast) instead.
- */
-export function unwrapList<T>(value: unknown): T[] {
-  if (Array.isArray(value)) {
-    return value as T[];
-  }
-  if (
-    value !== null &&
-    typeof value === 'object' &&
-    Array.isArray((value as { data?: unknown }).data)
-  ) {
-    return (value as { data: T[] }).data;
-  }
-  return [];
-}
-
-/**
- * Fail-fast single-resource unwrap. Returns `value.data` when the value is a
- * `{ data }` envelope; returns the value unchanged when it is already the
- * unwrapped resource (an Orval client that peeled the envelope at the boundary).
- *
- * Use this on mutation / single-resource flows where the response SHOULD be a
- * concrete object — unlike {@link unwrapList}, it does not silently coerce, so
- * a genuinely-unexpected shape surfaces as the value rather than being masked.
- *
- * A paginated envelope (`{ data, pagination }`) is returned INTACT — callers
- * that need both fields read them off the returned object; peeling only `data`
- * would drop the pagination cursor.
- */
-export function unwrapData<T>(value: unknown): T {
-  if (
-    value !== null &&
-    typeof value === 'object' &&
-    'data' in (value as Record<string, unknown>) &&
-    !('pagination' in (value as Record<string, unknown>))
-  ) {
-    return (value as { data: T }).data;
-  }
-  return value as T;
-}