portal-mojo 0.1.0 → 0.1.1

package/README.md

@@ -13,12 +13,53 @@ Live demos for everything: run `npm run dev:showcase` → **Develop → Componen
 
 ## Subpath surfaces
 
+The `client/runtime`, `ui/shell`, `admin/registry`, and Assistant launcher
+subpaths are stable, narrow package boundaries for first-party portal shells
+and advanced hosts. They intentionally expose only the runtime pieces needed
+at application startup; use the broader compatibility surfaces when those
+additional exports are required.
+
 | Subpath | Surface |
 |---|---|
 | `portal-mojo/client` | Typed django-mojo protocol layer: envelope unwrap at exactly one boundary (a failed save **rejects**), `start`/`size` paging, `'-field'` sort, Django lookups, the URL-synced `useTableParams` store (single source of truth for table state), TanStack Query hooks. Auth client: password / magic-link / passkey login, forgot/reset, cross-origin handoff (`?auth_code=` scrub-before-network), single-flight refresh + pre-request gate (synthetic-401 reject, `/api/token/refresh` recursion guard), `X-Mojo-UID` device header, `getAuthSnapshot`/`subscribeAuth` for React. Auth-challenged realtime transport: `RealtimeProvider`/`RealtimeClient`, refcounted topics, typed event projection, and a deterministic mock. Boot auth with `initAuth()`. The in-memory HTTP mock transport lives here too — it is the wire contract's executable spec and evolves in lockstep with the client (any seeded active user logs in with email + `"mojo"`). |
+| `portal-mojo/client/runtime` | Stable, narrow client boundary for first-party application runtime code. It omits eager mock-test controls; the mock transport itself loads on the first mock request. |
 | `portal-mojo/ui` | Mission-control UI: `ModelTable`, `FilterBar`/`FilterPills`, `SchemaForm`/`formModal`, `DetailView`, `RecordFeed`, `AttachmentQueue`/`UploadQueue`, `ImageEditor`/`imageEditorModal`, awaitable native-`<dialog>` `modal`, `toast`, `ThemeProvider`, `Guarded` (permission slot), `GroupSwitcher` (searchable tree selector), `RequiresGroup`, the sidebar engine (`registerMenus`/`setDefaultMenu` registry + `SidebarNav` — static or searchable accordion with a compact icon rail; global and group scopes are explicit), `Badge`/`MetricCard`/`Spark`, `fmt` formatter namespace. |
+| `portal-mojo/ui/shell` | Stable, narrow boundary for application-shell primitives: theme, guards, menus/sidebar, right panel, modal/toast hosts, password helpers, and formatters. |
 | `portal-mojo/charts` | Dependency-free SVG charts: `SeriesChart` (line/bar/area, stacked bars, legend toggle, crosshair tooltip) and `MetricsChart` (granularity/range/type control bar for `/api/metrics/fetch`). |
-| `portal-mojo/admin` | Global Admin **section bundles**, dual-mount: the standalone back-office portal mounts all of them at root; a product portal embeds them under a global "System" area. `AdminSection` contract + `adminSectionsMenu()` (sections → domain-grouped sidebar menu, mount-point-relative, with section + route permission clauses). Admin scope masks active-group membership even when embedded. Reusable domains include credentials, monitoring, security operations, settings, Bouncer, Members, and the Assistant control plane with narrow realtime streaming plus authoritative REST fallback/reconciliation. |
+| `portal-mojo/admin/core` | Side-effect-light Admin contracts and host: `AdminSection`, the discriminated `AdminRoute` XOR, `adminSectionRoutes`, `adminSectionsMenu`, and `AdminLazyPage`. |
+| `portal-mojo/admin/registry` | Stable, narrow built-in `ADMIN_SECTIONS` roster for first-party hosts, without broad page barrels. It installs the optional Email→DNS adapter synchronously so communications routes work before DNS navigation. |
+| `portal-mojo/admin/assistant/launcher` | Stable, narrow shell launcher boundary without the Assistant page/data barrel. |
+| `portal-mojo/admin/{identity,security,observability,operations,infrastructure,communications,assistant}` | Narrow domain APIs and registry contributions. Built-in routes use leaf-module `loadComponent` loaders; importing `infrastructure` synchronously installs the optional Email→DNS adapter. |
+| `portal-mojo/admin` | Compatibility aggregate containing every historical named export and the stable `ADMIN_SECTIONS` roster. It intentionally installs the DNS adapter and Rule field registration synchronously. New code should prefer `admin/core` plus the domains it consumes. |
+
+### Admin route contract
+
+Routes are an explicit XOR. A host-owned page stays synchronous; a packaged
+page supplies a separately named loader. The host never guesses from whether a
+value is callable.
+
+```tsx
+const extension: AdminSection = {
+  id: 'billing', title: 'Billing', icon: 'bi-receipt',
+  permissions: ['sys.billing'],
+  routes: [{ path: '', component: BillingHome }],
+};
+
+const packaged: AdminSection = {
+  id: 'audit', title: 'Audit', icon: 'bi-journal-text',
+  permissions: ['sys.view_logs'],
+  routes: [{
+    path: '',
+    loadComponent: () => import('./AuditPage').then(({ AuditPage }) => ({ default: AuditPage })),
+  }],
+};
+```
+
+Lazy loading, chunk-error recovery, and retry render inside section and route
+permission guards, so a denied route never invokes its loader. Routes stay
+mount-relative: pass no mount for `#/…`, or `{mount: '/system'}` for the same
+sections under `#/system/…`. Root denial and first-visible fallback semantics
+are identical in both forms.
 
 ## What the consuming app must provide
 

package/docs/admin-assistant.md

@@ -9,20 +9,22 @@ Import from `portal-mojo/admin`.
 - An owned, text-only conversation uses realtime only when the shared transport
   is authenticated and the caller locally has `sys.view_admin`, matching the
   WebSocket handler's narrower server check. The client sends exactly
-  `{type:'assistant_message',message,conversation_id?}`. A caller with only
+  `{type:'assistant_message',message,request_id,conversation_id?}`, with a fresh
+  canonical UUID per turn. A caller with only
   `sys.assistant`, any send with attachments, an unavailable socket, and a
   foreign inspect-only conversation stay on REST. Messages are never
   auto-resubmitted across paths.
 - `POST /api/assistant` sends `{message, conversation_id?, attachments?}`.
   `attachments` is omitted for text-only sends or contains 1–5 unique positive
   ids from completed authoritative queue references.
-- Realtime positively projects only `assistant_thinking`, `assistant_text`,
+- Realtime accepts these Assistant event shapes only as exact direct frames;
+  topic-wrapped or broadcast Assistant-shaped traffic is ignored. It positively
+  projects only `assistant_thinking`, `assistant_text`,
   `assistant_tool_call`, `assistant_plan`, `assistant_plan_update`,
-  `assistant_response`, and `assistant_error`, whether they arrive directly or
-  through the transport's one wrapper boundary. Thinking, text, tool, plan,
-  update, and response events require a positive `conversation_id` and are
-  correlated to the active turn. `assistant_error` alone may omit it; such an
-  uncorrelated server error terminates the active turn. Tool state retains
+  `assistant_response`, and `assistant_error`. Thinking, text, tool, plan,
+  update, response, and error events require the exact `request_id` sent for
+  the active turn. Non-error events also require a positive `conversation_id`;
+  an error may omit only the conversation id. Tool state retains
   bounded name/status/count only; raw input and the terminal `tool_calls_made`
   list never enter UI state, caches, logs, or mock observations. Plans omit
   tool inputs. Terminal duplication is checked only with the backend's
@@ -37,6 +39,11 @@ Import from `portal-mojo/admin`.
   reconnect; locally observed permission loss immediately clears this
   consumer's transient stream/subscriptions without disabling the shared
   provider.
+- Direct-source binding and the echoed `request_id` jointly isolate concurrent
+  turns, including turns in the same conversation. Missing or mismatched IDs
+  are ignored; if no correlated acknowledgement arrives within ten seconds,
+  the outcome is marked unknown, the list is refreshed, and the send is never
+  retried automatically.
 - `POST /api/assistant/context` sends only `{model, pk}`. The returned conversation id is immediately fetched from `/api/assistant/conversation/<id>?graph=detail`; the client never synthesizes or reposts context text.
 - Conversation and Skill lists/details/deletes are imperative and component-local. They do not use `defineModel`, Query cache, `ModelTable`, a `RecordFeed` adapter, persistence, or exports.
 - A foreign conversation visible to an administrator is inspect-only. Only `conversation.user.id === me.id` enables continuation.

package/docs/image-editor.md

@@ -64,6 +64,19 @@ These helpers operate on logical pixels and do not mount UI, upload Files,
 persist state, or initiate a browser download. `decodeImageSource` is the one
 exception that performs the URL fetch described above.
 
+## Browser-work limits
+
+The public low-level constants make the editor's availability boundary explicit:
+`MAX_IMAGE_SOURCE_BYTES` is 25,000,000 bytes, `MAX_IMAGE_DIMENSION` is 8,192
+pixels, `MAX_IMAGE_PIXELS` is 16,000,000 pixels per decoded/intermediate/final
+surface, and `MAX_IMAGE_EDITOR_OPERATIONS` is 20. Every operation output is
+checked before raster allocation. Initial transforms and filters must remain
+inside the same ranges as the controls (scale 0.1–5; brightness, contrast, and
+saturation 0–200; hue 0–360; blur 0–10; grayscale and sepia 0–100). URL bodies
+are streamed to the byte ceiling, and source replacement or unmount aborts the
+fetch and `<img>` fallback where the browser permits; `createImageBitmap` itself
+is not abortable, so a stale result is closed immediately on resolution.
+
 ## Composition and history
 
 Operations are immutable and chronological. Transform creates a logical

package/docs/menus-and-access.md

@@ -58,6 +58,20 @@ Admin section bundles contribute through `adminSectionsMenu`. Use
 experience. Routes remain mount-relative; multiple embedded root sections
 share one `/system` landing instead of emitting duplicate index routes.
 
+Import the route/menu machinery from `portal-mojo/admin/core`, then import only
+the registry domains the shell installs. The stable domains are `identity`,
+`security`, `observability`, `operations`, `infrastructure`, `communications`,
+and `assistant`. `portal-mojo/admin` remains the compatibility aggregate and
+retains every historical export, but deliberately performs the legacy DNS and
+Rule-field setup at import time.
+
+Built-in routes use `loadComponent`; external sections may use `component`.
+These properties are mutually exclusive. Loading and retryable error states
+live inside both permission guards, so access denial performs no page import.
+The infrastructure entry installs the optional managed-DNS adapter
+synchronously, which makes Email-first navigation safe even before any DNS page
+chunk has loaded. `admin/core` performs neither DNS nor field registration.
+
 ## Permissions (A2) — client gates, server authority
 
 `Me.permissions` is a dict; truthy `true` OR `1` grants. Semantics

package/docs/realtime.md

@@ -28,8 +28,10 @@ disable this shared provider.
   separately and is never explicitly subscribed by the client. That automatic
   topic is a delivery scope, not a presence feed.
 - Framework messages, one wrapped `{type:'message',data,topic?,timestamp?}`
-  layer, and direct application events share one dispatch boundary. Malformed
-  frames drop. No generic Query invalidation is performed.
+  layer, and direct application events share one dispatch boundary. Every
+  projected event carries `source: 'wrapped' | 'direct'` so consumers can keep
+  capability-bearing protocols on their exact wire source. Malformed frames
+  drop. No generic Query invalidation is performed.
 
 The transport does not invent application events. Current django-mojo has no
 canonical record-created/updated/deleted stream and no canonical presence

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "portal-mojo",
-    "version": "0.1.0",
+    "version": "0.1.1",
     "description": "React portal toolkit for django-mojo — typed client + params store, mission-control UI, dependency-free SVG charts, admin section bundles.",
     "type": "module",
     "license": "Apache-2.0",
@@ -26,9 +26,21 @@
     },
     "exports": {
         "./client": "./src/client/index.ts",
+        "./client/runtime": "./src/client/runtime.ts",
         "./ui": "./src/ui/index.ts",
+        "./ui/shell": "./src/ui/shell.ts",
         "./charts": "./src/charts/index.ts",
-        "./admin": "./src/admin/index.ts"
+        "./admin": "./src/admin/index.ts",
+        "./admin/core": "./src/admin/core/index.ts",
+        "./admin/registry": "./src/admin/registry.ts",
+        "./admin/identity": "./src/admin/public/identity.ts",
+        "./admin/security": "./src/admin/public/security.ts",
+        "./admin/observability": "./src/admin/public/observability.ts",
+        "./admin/operations": "./src/admin/public/operations.ts",
+        "./admin/infrastructure": "./src/admin/public/infrastructure.ts",
+        "./admin/communications": "./src/admin/public/communications.ts",
+        "./admin/assistant": "./src/admin/public/assistant.ts",
+        "./admin/assistant/launcher": "./src/admin/public/assistant-launcher.ts"
     },
     "scripts": {
         "typecheck": "tsc --noEmit"

package/src/admin/assistant/AssistantLauncher.tsx

@@ -0,0 +1,23 @@
+import { useEffect, useState, type MouseEvent } from 'react';
+import { useCan } from '../../client/runtime';
+import { useRightPanel } from '../../ui/RightPanel';
+import { ASSISTANT_PERMISSIONS } from './permissions';
+
+export function AssistantLauncher() {
+    const { can } = useCan(ASSISTANT_PERMISSIONS);
+    const panel = useRightPanel();
+    const [loading, setLoading] = useState(false);
+    const [error, setError] = useState('');
+    useEffect(() => { if (!can && panel.descriptor?.key.startsWith('assistant:')) panel.close(); }, [can, panel]);
+    if (!can) return null;
+    const open = async (event: MouseEvent<HTMLButtonElement>) => {
+        const launcher = event.currentTarget;
+        setLoading(true); setError('');
+        try {
+            const { AssistantPanel } = await import('./AssistantPanel');
+            panel.open({ key: 'assistant:new', title: 'Assistant', render: (context) => <AssistantPanel context={context} /> }, launcher);
+        } catch { setError('Assistant could not load. Click to retry.'); }
+        finally { setLoading(false); }
+    };
+    return <button type="button" className="btn-icon" title={error || 'Open Assistant'} aria-label={error || 'Open Assistant'} aria-pressed={panel.descriptor?.key === 'assistant:new'} disabled={loading} onClick={(event) => void open(event)}><i className="bi bi-stars" aria-hidden="true" /></button>;
+}

package/src/admin/assistant/AssistantPanel.tsx

@@ -1,13 +1,14 @@
 import { useEffect, useRef, useState } from 'react';
-import { useCan, useMe, useRealtime, useRealtimeStatus } from '../../client';
+import { useCan, useMe, useRealtime, useRealtimeStatus } from '../../client/runtime';
 import type { RightPanelRenderContext } from '../../ui';
 import { AssistantFeed } from './AssistantFeed';
 import { sendAssistantMessage } from './api';
 import type { AssistantConversation, AssistantMessage } from './types';
 import type { FileReference } from '../../client/record-feed';
 import { AssistantOutcomeUnknownError, chooseAssistantTransport, startAssistantRealtimeTurn, type AssistantRealtimeProgress, type AssistantRealtimeTurn } from './streaming';
+import { ASSISTANT_PERMISSIONS } from './permissions';
 
-export const ASSISTANT_PERMISSIONS = ['sys.view_admin', 'sys.assistant'];
+export { ASSISTANT_PERMISSIONS } from './permissions';
 
 export function AssistantPanel({ context, initialConversation = null }: { context: RightPanelRenderContext; initialConversation?: AssistantConversation | null }) {
     const { can } = useCan(ASSISTANT_PERMISSIONS);

package/src/admin/assistant/api.ts

@@ -1,4 +1,4 @@
-import { mojoCall, mojoDelete, mojoList, type Params } from '../../client';
+import { mojoCall, mojoDelete, mojoList, type Params } from '../../client/runtime';
 import { projectConversation, projectConversationSummary, projectReply, projectSkill } from './data';
 import type { AssistantConversation, AssistantConversationSummary, AssistantReply, AssistantSkill } from './types';
 import type { FileReference } from '../../client/record-feed';

package/src/admin/assistant/index.ts

@@ -1,6 +1,3 @@
-import type { AdminSection } from '../index';
-import { ASSISTANT_PERMISSIONS } from './AssistantPanel';
-import { ConversationsPage, MemoriesPage, SkillsPage } from './pages';
 
 export * from './types';
 export * from './data';
@@ -11,11 +8,4 @@ export * from './launchers';
 export * from './pages';
 export * from './streaming';
 
-export const ASSISTANT_ADMIN_SECTION: AdminSection = {
-    id: 'assistant', basePath: 'assistant', title: 'Assistant', icon: 'bi-stars', navigationGroup: 'assistant', permissions: ASSISTANT_PERMISSIONS,
-    routes: [
-        { path: 'conversations', label: 'Conversations', component: ConversationsPage, permissions: ASSISTANT_PERMISSIONS },
-        { path: 'skills', label: 'Skills', component: SkillsPage, permissions: ASSISTANT_PERMISSIONS },
-        { path: 'memories', label: 'Memory', component: MemoriesPage, permissions: ['sys.assistant'] },
-    ],
-};
+export { ASSISTANT_ADMIN_SECTION } from '../domains/assistant';

package/src/admin/assistant/launchers.tsx

@@ -1,17 +1,11 @@
 import { useEffect, useRef, useState, type MouseEvent } from 'react';
-import { useCan } from '../../client';
-import { useRightPanel } from '../../ui';
+import { useCan } from '../../client/runtime';
+import { useRightPanel } from '../../ui/RightPanel';
 import { SECURITY_VIEW_PERMS } from '../security-permissions';
-import { AssistantPanel, ASSISTANT_PERMISSIONS } from './AssistantPanel';
+import { ASSISTANT_PERMISSIONS } from './permissions';
 import { createAssistantContext } from './api';
 
-export function AssistantLauncher() {
-    const { can } = useCan(ASSISTANT_PERMISSIONS);
-    const panel = useRightPanel();
-    useEffect(() => { if (!can && panel.descriptor?.key.startsWith('assistant:')) panel.close(); }, [can, panel]);
-    if (!can) return null;
-    return <button type="button" className="btn-icon" title="Open Assistant" aria-label="Open Assistant" aria-pressed={panel.descriptor?.key === 'assistant:new'} onClick={(event) => panel.open({ key: 'assistant:new', title: 'Assistant', render: (context) => <AssistantPanel context={context} /> }, event.currentTarget)}><i className="bi bi-stars" aria-hidden="true" /></button>;
-}
+export { AssistantLauncher } from './AssistantLauncher';
 
 export function AssistantContextLauncher({ model, pk, label = 'Ask Assistant' }: { model: 'incident.Incident' | 'incident.Ticket'; pk: number; label?: string }) {
     const assistant = useCan(ASSISTANT_PERMISSIONS);
@@ -25,7 +19,7 @@ export function AssistantContextLauncher({ model, pk, label = 'Ask Assistant' }:
     if (!assistant.can || !security.can) return null;
     const launch = async (event: MouseEvent<HTMLButtonElement>) => {
         const launcher = event.currentTarget; const run = ++generation.current; setLoading(true); setError('');
-        try { const conversation = await createAssistantContext(model, pk); if (generation.current !== run) return; panel.open({ key: `assistant:context:${model}:${pk}:${conversation.id}`, title: `Assistant · ${model === 'incident.Incident' ? 'Incident' : 'Ticket'} #${pk}`, render: (context) => <AssistantPanel context={context} initialConversation={conversation} /> }, launcher); }
+        try { const [conversation, { AssistantPanel }] = await Promise.all([createAssistantContext(model, pk), import('./AssistantPanel')]); if (generation.current !== run) return; panel.open({ key: `assistant:context:${model}:${pk}:${conversation.id}`, title: `Assistant · ${model === 'incident.Incident' ? 'Incident' : 'Ticket'} #${pk}`, render: (context) => <AssistantPanel context={context} initialConversation={conversation} /> }, launcher); }
         catch (cause) { if (generation.current === run) setError(cause instanceof Error ? cause.message : 'Could not create context'); }
         finally { if (generation.current === run) setLoading(false); }
     };

package/src/admin/assistant/pages.tsx

@@ -1,5 +1,5 @@
 import { useCallback, useEffect, useRef, useState } from 'react';
-import { mojoList, useCan, useMe, useRealtime, useRealtimeStatus } from '../../client';
+import { mojoList, useCan, useMe, useRealtime, useRealtimeStatus } from '../../client/runtime';
 import { Badge, fmt, modal, toast } from '../../ui';
 import { AssistantFeed } from './AssistantFeed';
 import { deleteAssistantConversation, deleteAssistantMemory, deleteAssistantSkill, getAssistantConversation, getAssistantMemory, getAssistantSkill, listAssistantConversations, listAssistantSkills, saveAssistantMemory, sendAssistantMessage } from './api';

package/src/admin/assistant/permissions.ts

@@ -0,0 +1 @@
+export const ASSISTANT_PERMISSIONS = ['sys.view_admin', 'sys.assistant'];

package/src/admin/assistant/streaming.ts

@@ -9,18 +9,21 @@ const MAX_TEXT = 20_000;
 const MAX_TOOL_NAME = 160;
 const MAX_TOOLS = 32;
 const MAX_PLAN_STEPS = 20;
+const ASSISTANT_ACK_TIMEOUT_MS = 10_000;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const object = (value: unknown): Record<string, unknown> | null => value != null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : null;
 const text = (value: unknown, cap: number): string | null => typeof value === 'string' && value.length > 0 ? value.slice(0, cap) : null;
 const conversationId = (value: unknown): number | null => typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? value : null;
+const requestId = (value: unknown): string | null => typeof value === 'string' && UUID_PATTERN.test(value) ? value : null;
 
-export interface AssistantThinkingEvent { type: 'thinking'; conversationId: number }
-export interface AssistantTextEvent { type: 'text'; conversationId: number; text: string; blocks: AssistantBlock[] }
-export interface AssistantToolEvent { type: 'tool'; conversationId: number; name: string; status: 'running'; count: number }
+export interface AssistantThinkingEvent { type: 'thinking'; conversationId: number; requestId: string }
+export interface AssistantTextEvent { type: 'text'; conversationId: number; requestId: string; text: string; blocks: AssistantBlock[] }
+export interface AssistantToolEvent { type: 'tool'; conversationId: number; requestId: string; name: string; status: 'running'; count: number }
 export interface AssistantPlanStep { id: number; description: string; status: 'pending' | 'in_progress' | 'done' | 'skipped'; summary?: string }
-export interface AssistantPlanEvent { type: 'plan'; conversationId: number; planId: string; title: string; steps: AssistantPlanStep[] }
-export interface AssistantPlanUpdateEvent { type: 'plan_update'; conversationId: number; planId: string; stepId: number; status: AssistantPlanStep['status']; summary?: string }
-export interface AssistantResponseEvent { type: 'response'; conversationId: number; messageId: number | string | null; created: number | string; response: string; blocks: AssistantBlock[]; toolCount: number; durationMs: number }
-export interface AssistantErrorEvent { type: 'error'; conversationId: number | null; error: string }
+export interface AssistantPlanEvent { type: 'plan'; conversationId: number; requestId: string; planId: string; title: string; steps: AssistantPlanStep[] }
+export interface AssistantPlanUpdateEvent { type: 'plan_update'; conversationId: number; requestId: string; planId: string; stepId: number; status: AssistantPlanStep['status']; summary?: string }
+export interface AssistantResponseEvent { type: 'response'; conversationId: number; requestId: string; messageId: number | string | null; created: number | string; response: string; blocks: AssistantBlock[]; toolCount: number; durationMs: number }
+export interface AssistantErrorEvent { type: 'error'; conversationId: number | null; requestId: string; error: string }
 export type AssistantProjectedEvent = AssistantThinkingEvent | AssistantTextEvent | AssistantToolEvent | AssistantPlanEvent | AssistantPlanUpdateEvent | AssistantResponseEvent | AssistantErrorEvent;
 
 function exact(value: unknown, expectedType: string): Record<string, unknown> | null {
@@ -29,18 +32,20 @@ function exact(value: unknown, expectedType: string): Record<string, unknown> |
 }
 
 export function projectAssistantThinking(value: unknown): AssistantThinkingEvent | null {
-    const raw = exact(value, 'assistant_thinking'); const id = raw && conversationId(raw.conversation_id);
-    return id == null ? null : { type: 'thinking', conversationId: id };
+    const raw = exact(value, 'assistant_thinking'); const id = raw && conversationId(raw.conversation_id); const turn = raw && requestId(raw.request_id);
+    return id == null || turn == null ? null : { type: 'thinking', conversationId: id, requestId: turn };
 }
 
 export function projectAssistantText(value: unknown): AssistantTextEvent | null {
-    const raw = exact(value, 'assistant_text'); const id = raw && conversationId(raw.conversation_id); const content = raw && text(raw.text, MAX_TEXT);
-    return id == null || content == null ? null : { type: 'text', conversationId: id, text: content, blocks: projectBlocks(raw.blocks) };
+    const raw = exact(value, 'assistant_text');
+    if (!raw) return null;
+    const id = conversationId(raw.conversation_id); const turn = requestId(raw.request_id); const content = text(raw.text, MAX_TEXT);
+    return id == null || turn == null || content == null ? null : { type: 'text', conversationId: id, requestId: turn, text: content, blocks: projectBlocks(raw.blocks) };
 }
 
 export function projectAssistantToolCall(value: unknown): AssistantToolEvent | null {
-    const raw = exact(value, 'assistant_tool_call'); const id = raw && conversationId(raw.conversation_id); const name = raw && text(raw.tool, MAX_TOOL_NAME);
-    return id == null || name == null ? null : { type: 'tool', conversationId: id, name, status: 'running', count: 1 };
+    const raw = exact(value, 'assistant_tool_call'); const id = raw && conversationId(raw.conversation_id); const turn = raw && requestId(raw.request_id); const name = raw && text(raw.tool, MAX_TOOL_NAME);
+    return id == null || turn == null || name == null ? null : { type: 'tool', conversationId: id, requestId: turn, name, status: 'running', count: 1 };
 }
 
 const PLAN_STATUSES = new Set<AssistantPlanStep['status']>(['pending', 'in_progress', 'done', 'skipped']);
@@ -49,38 +54,40 @@ function planStatus(value: unknown): AssistantPlanStep['status'] | null {
 }
 
 export function projectAssistantPlan(value: unknown): AssistantPlanEvent | null {
-    const raw = exact(value, 'assistant_plan'); const id = raw && conversationId(raw.conversation_id); const plan = raw && object(raw.plan);
+    const raw = exact(value, 'assistant_plan'); const id = raw && conversationId(raw.conversation_id); const turn = raw && requestId(raw.request_id); const plan = raw && object(raw.plan);
     const planId = plan && text(plan.plan_id, 80); const title = plan && text(plan.title, 200);
-    if (id == null || !plan || !planId || !title || !Array.isArray(plan.steps) || plan.steps.length < 1 || plan.steps.length > MAX_PLAN_STEPS) return null;
+    if (id == null || turn == null || !plan || !planId || !title || !Array.isArray(plan.steps) || plan.steps.length < 1 || plan.steps.length > MAX_PLAN_STEPS) return null;
     const steps = plan.steps.map(object).map((step) => {
         const stepId = step && conversationId(step.id); const description = step && text(step.description, 500); const status = step && planStatus(step.status);
         if (stepId == null || !description || !status) return null;
         const summary = text(step.summary, 500);
         return { id: stepId, description, status, ...(summary ? { summary } : {}) };
     });
-    return steps.every(Boolean) ? { type: 'plan', conversationId: id, planId, title, steps: steps as AssistantPlanStep[] } : null;
+    return steps.every(Boolean) ? { type: 'plan', conversationId: id, requestId: turn, planId, title, steps: steps as AssistantPlanStep[] } : null;
 }
 
 export function projectAssistantPlanUpdate(value: unknown): AssistantPlanUpdateEvent | null {
-    const raw = exact(value, 'assistant_plan_update'); const id = raw && conversationId(raw.conversation_id); const planId = raw && text(raw.plan_id, 80);
+    const raw = exact(value, 'assistant_plan_update'); const id = raw && conversationId(raw.conversation_id); const turn = raw && requestId(raw.request_id); const planId = raw && text(raw.plan_id, 80);
     const stepId = raw && conversationId(raw.step_id); const status = raw && planStatus(raw.status); const summary = raw && text(raw.summary, 500);
-    return id == null || !planId || stepId == null || !status ? null : { type: 'plan_update', conversationId: id, planId, stepId, status, ...(summary ? { summary } : {}) };
+    return id == null || turn == null || !planId || stepId == null || !status ? null : { type: 'plan_update', conversationId: id, requestId: turn, planId, stepId, status, ...(summary ? { summary } : {}) };
 }
 
 export function projectAssistantResponse(value: unknown): AssistantResponseEvent | null {
-    const raw = exact(value, 'assistant_response'); const id = raw && conversationId(raw.conversation_id); const response = raw && typeof raw.response === 'string' ? raw.response.slice(0, MAX_TEXT) : null;
-    if (id == null || response == null) return null;
+    const raw = exact(value, 'assistant_response');
+    if (!raw) return null;
+    const id = conversationId(raw.conversation_id); const turn = requestId(raw.request_id); const response = typeof raw.response === 'string' ? raw.response.slice(0, MAX_TEXT) : null;
+    if (id == null || turn == null || response == null) return null;
     const messageId = typeof raw.message_id === 'number' && Number.isSafeInteger(raw.message_id) && raw.message_id > 0
         ? raw.message_id : typeof raw.message_id === 'string' && raw.message_id.length > 0 && raw.message_id.length <= 160 ? raw.message_id : null;
     const created = typeof raw.created === 'number' || typeof raw.created === 'string' ? raw.created : 0;
     const toolCount = Array.isArray(raw.tool_calls_made) ? Math.min(raw.tool_calls_made.length, MAX_TOOLS) : typeof raw.tool_calls_made === 'number' ? Math.min(Math.max(0, raw.tool_calls_made), MAX_TOOLS) : 0;
     const durationMs = typeof raw.duration_ms === 'number' && Number.isFinite(raw.duration_ms) ? Math.max(0, raw.duration_ms) : 0;
-    return { type: 'response', conversationId: id, messageId, created, response, blocks: projectBlocks(raw.blocks), toolCount, durationMs };
+    return { type: 'response', conversationId: id, requestId: turn, messageId, created, response, blocks: projectBlocks(raw.blocks), toolCount, durationMs };
 }
 
 export function projectAssistantError(value: unknown): AssistantErrorEvent | null {
-    const raw = exact(value, 'assistant_error'); const error = raw && text(raw.error, 1_000);
-    return !raw || !error ? null : { type: 'error', conversationId: conversationId(raw.conversation_id), error };
+    const raw = exact(value, 'assistant_error'); const turn = raw && requestId(raw.request_id); const error = raw && text(raw.error, 1_000);
+    return !raw || turn == null || !error ? null : { type: 'error', conversationId: conversationId(raw.conversation_id), requestId: turn, error };
 }
 
 export const ASSISTANT_REALTIME_EVENTS = {
@@ -100,8 +107,8 @@ export function chooseAssistantTransport(input: { owner: boolean; textOnly: bool
 }
 
 export class AssistantOutcomeUnknownError extends Error {
-    constructor() {
-        super('Outcome unknown: the connection ended before the server assigned a conversation. The conversation list was refreshed; the message was not resent.');
+    constructor(message = 'Outcome unknown: the connection ended before the server assigned a conversation. The conversation list was refreshed; the message was not resent.') {
+        super(message);
         this.name = 'AssistantOutcomeUnknownError';
     }
 }
@@ -133,12 +140,15 @@ export function startAssistantRealtimeTurn(
         seenMessageIds: Set<number | string>;
         reconcile?: (conversationId: number) => Promise<AssistantConversation>;
         refreshList?: () => Promise<unknown>;
+        ackTimeoutMs?: number;
     },
     callbacks: AssistantRealtimeTurnCallbacks,
 ): AssistantRealtimeTurn {
+    const turnRequestId = crypto.randomUUID();
     let expected = input.conversationId ?? null;
     let active = true;
     let disconnected = false;
+    let acknowledged = false;
     let interimSequence = 0;
     const tools = new Map<string, { name: string; status: 'running'; count: number }>();
     let plan: AssistantPlanEvent | null = null;
@@ -153,39 +163,48 @@ export function startAssistantRealtimeTurn(
         cleanups.splice(0).forEach((cleanup) => cleanup());
         if (error) rejectPromise(error); else resolvePromise();
     };
-    const correlated = (id: number | null): id is number => id != null && (expected == null || expected === id);
+    const acknowledge = () => {
+        if (!acknowledged) acknowledged = true;
+    };
+    const correlated = (id: number | null, eventRequestId: string): id is number => eventRequestId === turnRequestId && id != null && (expected == null || expected === id);
     const adopt = (id: number) => {
         if (expected == null) { expected = id; callbacks.onConversation(id); }
     };
     const progress = () => callbacks.onProgress({ tools: [...tools.values()].slice(0, MAX_TOOLS), plan });
 
-    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.thinking, ({ data }) => {
-        if (!active || !correlated(data.conversationId)) return;
+    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.thinking, ({ data, source }) => {
+        if (source !== 'direct' || !active || !correlated(data.conversationId, data.requestId)) return;
+        acknowledge();
         adopt(data.conversationId);
     }));
-    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.text, ({ data }) => {
-        if (!active || !correlated(data.conversationId)) return;
+    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.text, ({ data, source }) => {
+        if (source !== 'direct' || !active || !correlated(data.conversationId, data.requestId)) return;
+        acknowledge();
         adopt(data.conversationId);
         callbacks.onText({ id: `stream-${data.conversationId}-${++interimSequence}`, role: 'assistant', content: data.text, created: Math.floor(Date.now() / 1000), blocks: data.blocks });
     }));
-    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.tool, ({ data }) => {
-        if (!active || !correlated(data.conversationId)) return;
+    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.tool, ({ data, source }) => {
+        if (source !== 'direct' || !active || !correlated(data.conversationId, data.requestId)) return;
+        acknowledge();
         adopt(data.conversationId);
         const current = tools.get(data.name);
         tools.set(data.name, { name: data.name, status: 'running', count: Math.min(MAX_TOOLS, (current?.count ?? 0) + 1) });
         progress();
     }));
-    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.plan, ({ data }) => {
-        if (!active || !correlated(data.conversationId)) return;
+    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.plan, ({ data, source }) => {
+        if (source !== 'direct' || !active || !correlated(data.conversationId, data.requestId)) return;
+        acknowledge();
         adopt(data.conversationId); plan = data; progress();
     }));
-    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.planUpdate, ({ data }) => {
-        if (!active || !correlated(data.conversationId) || !plan || plan.planId !== data.planId) return;
+    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.planUpdate, ({ data, source }) => {
+        if (source !== 'direct' || !active || !correlated(data.conversationId, data.requestId) || !plan || plan.planId !== data.planId) return;
+        acknowledge();
         plan = { ...plan, steps: plan.steps.map((step) => step.id === data.stepId ? { ...step, status: data.status, ...(data.summary ? { summary: data.summary } : {}) } : step) };
         progress();
     }));
-    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.response, ({ data }) => {
-        if (!active || !correlated(data.conversationId)) return;
+    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.response, ({ data, source }) => {
+        if (source !== 'direct' || !active || !correlated(data.conversationId, data.requestId)) return;
+        acknowledge();
         adopt(data.conversationId);
         if (data.messageId == null) {
             void (input.reconcile ?? getAssistantConversation)(data.conversationId).then((conversation) => {
@@ -202,8 +221,9 @@ export function startAssistantRealtimeTurn(
         }
         finish();
     }));
-    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.error, ({ data }) => {
-        if (!active || (data.conversationId != null && !correlated(data.conversationId))) return;
+    cleanups.push(client.on(ASSISTANT_REALTIME_EVENTS.error, ({ data, source }) => {
+        if (source !== 'direct' || !active || data.requestId !== turnRequestId || (data.conversationId != null && !correlated(data.conversationId, data.requestId))) return;
+        acknowledge();
         if (data.conversationId != null) adopt(data.conversationId);
         finish(new Error(data.error));
     }));
@@ -229,8 +249,16 @@ export function startAssistantRealtimeTurn(
         }
     }));
 
+    const ackTimer = window.setTimeout(() => {
+        if (!active || acknowledged) return;
+        callbacks.onUnknown();
+        void (input.refreshList ?? listAssistantConversations)().catch(() => undefined);
+        finish(new AssistantOutcomeUnknownError('Outcome unknown: the server did not return a correlated Assistant acknowledgement. The conversation list was refreshed; the message was not resent.'));
+    }, input.ackTimeoutMs ?? ASSISTANT_ACK_TIMEOUT_MS);
+    cleanups.push(() => window.clearTimeout(ackTimer));
+
     try {
-        client.send({ type: 'assistant_message', message: input.message, ...(input.conversationId != null ? { conversation_id: input.conversationId } : {}) });
+        client.send({ type: 'assistant_message', message: input.message, request_id: turnRequestId, ...(input.conversationId != null ? { conversation_id: input.conversationId } : {}) });
     } catch (cause) {
         finish(cause instanceof Error ? cause : new Error('Realtime Assistant send failed'));
     }

package/src/admin/bouncer/index.ts

@@ -1,34 +1,7 @@
-import type { AdminSection } from '../index';
-import { BOUNCER_VIEW_PERMS } from './models';
-import { BouncerSignalsPage } from './signals';
-import { BouncerDevicesPage } from './devices';
-import { BotSignaturesPage } from './signatures';
 
 export * from './models';
 export * from './signals';
 export * from './devices';
 export * from './signatures';
 
-/** Mount-point-relative Bouncer contribution for standalone or embedded admin. */
-export const BOUNCER_ADMIN_SECTION: AdminSection = {
-    id: 'bouncer',
-    basePath: 'security/bouncer',
-    title: 'Bouncer',
-    icon: 'bi-shield-check',
-    navigationGroup: 'security',
-    permissions: BOUNCER_VIEW_PERMS,
-    routes: [
-        {
-            path: 'signals', label: 'Signal Decisions',
-            component: BouncerSignalsPage, permissions: BOUNCER_VIEW_PERMS,
-        },
-        {
-            path: 'devices', label: 'Device Reputation',
-            component: BouncerDevicesPage, permissions: BOUNCER_VIEW_PERMS,
-        },
-        {
-            path: 'signatures', label: 'Bot Signatures',
-            component: BotSignaturesPage, permissions: BOUNCER_VIEW_PERMS,
-        },
-    ],
-};
+export { BOUNCER_ADMIN_SECTION } from '../domains/security';

package/src/admin/bouncer/models.ts

@@ -2,7 +2,7 @@ import { useQuery } from '@tanstack/react-query';
 import {
     defineModel, mojoCall,
     type Params,
-} from '../../client';
+} from '../../client/runtime';
 import { SECURITY_VIEW_PERMS } from '../security-permissions';
 import { sanitizeIncidentRow } from '../incidents/sanitize';
 

package/src/admin/bouncer/signatures.tsx

@@ -4,7 +4,7 @@ import {
     fmt, modal, toast,
     type BatchAction, type Column, type Field, type FilterDef, type FormData,
 } from '../../ui';
-import { useCan } from '../../client';
+import { useCan } from '../../client/runtime';
 import {
     BOUNCER_MANAGE_PERMS, BOUNCER_SIGNATURE_TYPES, BotSignatureModel,
     type BotSignatureRow, type BotSignatureType,

package/src/admin/cloudwatch/CloudWatchChart.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useRef, useState } from 'react';
 import { MetricsChart } from '../../charts';
-import { useAuthSnapshot } from '../../client';
+import { useAuthSnapshot } from '../../client/runtime';
 import { fmt } from '../../ui';
 import {
     CLOUDWATCH_GRANULARITIES, loadCloudWatchSeries,

package/src/admin/cloudwatch/data.ts

@@ -1,5 +1,5 @@
 import { useQuery } from '@tanstack/react-query';
-import { mojoCall, useAuthSnapshot, type MetricsResponse, type Params } from '../../client';
+import { mojoCall, useAuthSnapshot, type MetricsResponse, type Params } from '../../client/runtime';
 import type { MetricsFetchParams } from '../../charts';
 
 export const CLOUDWATCH_PERMISSIONS = ['sys.manage_aws'];