sgiant-ai-widget 1.0.0

package/dist/pane-follow.js

@@ -0,0 +1,61 @@
+/**
+ * TWO DECISIONS THE APP PANE MAKES, extracted so they can be checked.
+ *
+ * Both live inside `createAiChatWidget`'s closure in the real widget, where
+ * they are unreachable from a test — and both are the kind of rule that fails
+ * politely: get them wrong and the pane either never follows a long operation
+ * (the feature silently does nothing) or follows it too eagerly (it yanks a
+ * reader off the page they chose, repeatedly, on every poll). Neither shows up
+ * as an error.
+ */
+/** Same-path test used for both decisions. A query string is a filter within a
+ *  page, not a different destination; a trailing slash is not a destination
+ *  either. */
+export function samePanePath(a, b) {
+    if (!a || !b)
+        return false;
+    const norm = (p) => {
+        const path = p.split("?")[0] ?? "";
+        return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+    };
+    return norm(a) === norm(b);
+}
+/**
+ * Should the pane follow a long operation to its live page?
+ *
+ * Every `false` here is a way this becomes obnoxious rather than helpful, and
+ * the third one is the one that bites hardest: a report card polls every couple
+ * of seconds, so a decision that does not remember it already followed would
+ * reload the page continuously — turning "watch it build" into a surface that
+ * cannot be read at all.
+ */
+export function shouldAutoNavigate(i) {
+    if (!i.advanced || !i.canNavigate)
+        return false;
+    if (!i.userConfirmedThisSession)
+        return false;
+    if (i.userDriven || i.alreadyFollowed)
+        return false;
+    if (!i.path || !i.path.startsWith("/") || i.path.startsWith("//")) {
+        return false;
+    }
+    // Already there: following again would be a pointless full document load.
+    if (samePanePath(i.currentPath, i.path))
+        return false;
+    return true;
+}
+/**
+ * Should the chat column collapse its narration to one line?
+ *
+ * True exactly when the pane is showing the same run — the owner's decision for
+ * advanced mode. The report page owns the detail (it has the stage rail and it
+ * is the authority on stage), and two renderings of one job on one screen is
+ * the divergence advanced view makes visible. When the pane is elsewhere the
+ * chat is the ONLY account of what is happening, so it narrates in full.
+ */
+export function shouldCollapseNarration(i) {
+    if (!i.advanced)
+        return false;
+    return samePanePath(i.currentPath, i.livePath);
+}
+//# sourceMappingURL=pane-follow.js.map

package/dist/pane-follow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-follow.js","sourceRoot":"","sources":["../src/pane-follow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;cAEc;AACd,MAAM,UAAU,YAAY,CAC1B,CAA4B,EAC5B,CAA4B;IAE5B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE;QACjC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AA+BD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAoB;IACrD,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,CAAC,CAAC,wBAAwB;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,0EAA0E;IAC1E,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,CAIvC;IACC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;AACjD,CAAC"}

package/dist/prefix.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The one class prefix every rule and every element in this widget carries.
+ *
+ * Its own module because both `index.ts` and `styles.ts` need it and neither
+ * should import the other: the stylesheet must not pull in the 5800-line
+ * widget closure just to know what to call a class (#320).
+ */
+export declare const PREFIX = "sgiant-aiw";
+//# sourceMappingURL=prefix.d.ts.map

package/dist/prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.d.ts","sourceRoot":"","sources":["../src/prefix.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,eAAe,CAAC"}

package/dist/prefix.js

@@ -0,0 +1,9 @@
+/**
+ * The one class prefix every rule and every element in this widget carries.
+ *
+ * Its own module because both `index.ts` and `styles.ts` need it and neither
+ * should import the other: the stylesheet must not pull in the 5800-line
+ * widget closure just to know what to call a class (#320).
+ */
+export const PREFIX = "sgiant-aiw";
+//# sourceMappingURL=prefix.js.map

package/dist/prefix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefix.js","sourceRoot":"","sources":["../src/prefix.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,YAAY,CAAC"}

package/dist/proposal-summary.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The GENERIC half of a confirm card: describe a tool call nobody has taught us
+ * about, well enough that a person can approve or refuse it.
+ *
+ * The sgiant-specific half — fifteen branches phrasing sgiant's own tools, and
+ * the titles that go with them — moved to `@sgiant/ai-apply` on 2026-09-02.
+ * This package is published for anyone to embed, and a table of one company's
+ * tool names is not something a stranger's users should be reading.
+ *
+ * What is left is what makes the widget SAFE to publish rather than merely safe
+ * for sgiant: every host's own tools land here, and a blank card is a confirm
+ * gate that confirms nothing. the confirm-card tests pin that.
+ *
+ * A host phrases its own tools by passing `proposalSummary` — return a string to
+ * override, or null to fall through to this.
+ */
+/** Render an unknown tool call from its arguments alone. */
+export declare function genericProposalSummary(args: Record<string, unknown>): string;
+//# sourceMappingURL=proposal-summary.d.ts.map

package/dist/proposal-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-summary.d.ts","sourceRoot":"","sources":["../src/proposal-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAK5E"}

package/dist/proposal-summary.js

@@ -0,0 +1,73 @@
+/**
+ * The GENERIC half of a confirm card: describe a tool call nobody has taught us
+ * about, well enough that a person can approve or refuse it.
+ *
+ * The sgiant-specific half — fifteen branches phrasing sgiant's own tools, and
+ * the titles that go with them — moved to `@sgiant/ai-apply` on 2026-09-02.
+ * This package is published for anyone to embed, and a table of one company's
+ * tool names is not something a stranger's users should be reading.
+ *
+ * What is left is what makes the widget SAFE to publish rather than merely safe
+ * for sgiant: every host's own tools land here, and a blank card is a confirm
+ * gate that confirms nothing. the confirm-card tests pin that.
+ *
+ * A host phrases its own tools by passing `proposalSummary` — return a string to
+ * override, or null to fall through to this.
+ */
+/** Render an unknown tool call from its arguments alone. */
+export function genericProposalSummary(args) {
+    return Object.entries(args)
+        .filter(([k]) => k !== "id")
+        .map(([k, v]) => `${k}: ${describeArg(v)}`)
+        .join("\n");
+}
+/**
+ * One argument value, as a person can actually read it.
+ *
+ * `String(v)` on anything structured yields "[object Object]" — and on a list
+ * of them, "[object Object],[object Object],[object Object]". A confirm card
+ * that says that is asking the client to approve something they cannot see,
+ * which is the one thing a confirm card must never do. Seen for real on a
+ * three-scene storyboard: the whole point of the card is that the client
+ * agrees the PLAN, and the plan was invisible.
+ *
+ * Deliberately a SUMMARY, not a JSON dump — a raw blob is technically honest
+ * and just as unreadable. Objects are described by whichever of the handful
+ * of naming fields they carry, so a scene reads as its title.
+ */
+function describeArg(v, depth = 0) {
+    if (v === null || v === undefined)
+        return "—";
+    if (Array.isArray(v)) {
+        if (!v.length)
+            return "(none)";
+        // Nested lists are summarised by count rather than expanded: a card is a
+        // glance, not a document.
+        if (depth > 0)
+            return `${v.length} items`;
+        return v.map((x) => `\n  • ${describeArg(x, depth + 1)}`).join("");
+    }
+    if (typeof v === "object") {
+        const rec = v;
+        // The fields something calls itself by, in the order a human would look.
+        const named = ["title", "name", "label", "key", "id"]
+            .map((k) => (typeof rec[k] === "string" ? rec[k] : ""))
+            .find(Boolean);
+        const detail = typeof rec.prompt === "string"
+            ? rec.prompt
+            : typeof rec.caption === "string"
+                ? rec.caption
+                : typeof rec.description === "string"
+                    ? rec.description
+                    : "";
+        if (named || detail)
+            return [named, detail && `— ${detail.slice(0, 90)}`]
+                .filter(Boolean)
+                .join(" ");
+        // Nothing self-describing: name its shape rather than lie about it.
+        const keys = Object.keys(rec);
+        return keys.length ? `{${keys.slice(0, 4).join(", ")}}` : "{}";
+    }
+    return String(v);
+}
+//# sourceMappingURL=proposal-summary.js.map

package/dist/proposal-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-summary.js","sourceRoot":"","sources":["../src/proposal-summary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,4DAA4D;AAC5D,MAAM,UAAU,sBAAsB,CAAC,IAA6B;IAClE,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,WAAW,CAAC,CAAU,EAAE,KAAK,GAAG,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC;QAC/B,yEAAyE;QACzE,0BAA0B;QAC1B,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,MAAM,QAAQ,CAAC;QAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,WAAW,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,yEAAyE;QACzE,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;aAClD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAClE,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC5B,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;oBACnC,CAAC,CAAC,GAAG,CAAC,WAAW;oBACjB,CAAC,CAAC,EAAE,CAAC;QACb,IAAI,KAAK,IAAI,MAAM;YACjB,OAAO,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;iBACjD,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}

package/dist/replay.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Replaying a saved thread, and the ‹n/m› branch navigation over it.
+ *
+ * Extracted from index.ts (#320). Measured at ZERO leakage: nothing in these
+ * 250 lines reaches a top-level declaration in the file it came from, which is
+ * why it moves as a unit and why the move is reviewable.
+ *
+ * The shape is worth naming, because it is the seam #306 needs: a PURE
+ * TRANSFORM — a server payload in, a list of render items out — with no DOM,
+ * no transport and no host context. `buildThreadReplay` is already documented
+ * as taking a report ID rather than a path for exactly that reason ("a pure
+ * function with no host context, and the widget runs in three shells with
+ * different route shapes"). A published widget needs more regions like this
+ * one and fewer inside the 6000-line closure.
+ */
+/** One item replayed from a past thread: a chat message, or an inline data
+ *  widget (so reopening restores the conversation's charts/tables, not just
+ *  text). The render hooks / fallback handle the actual drawing. */
+export type LoadedThreadItem = {
+    role: "user" | "assistant";
+    content: string;
+    /** Stable message id (branching). Absent on hosts that predate branching. */
+    id?: string;
+    /** The model that produced this message, so a vote cast on REPLAYED
+     *  history is attributable per model like a live one (#299). */
+    model?: string;
+    /** Parent turn in the conversation tree (null on a root message). */
+    parentId?: string | null;
+    /** Persisted per-turn token spend (assistant messages) — replays the
+     *  ↑/↓ tokens caption that the live stream draws, so it survives the
+     *  end-of-turn thread reload and thread reopen. Shown even on the free
+     *  staff lane: not billed there, still worth seeing. */
+    inputTokens?: number;
+    outputTokens?: number;
+    /** ‹n/m› sibling switcher data — present when this turn has siblings. */
+    branch?: {
+        index: number;
+        count: number;
+        prevLeaf?: string;
+        nextLeaf?: string;
+    };
+} | {
+    kind: "widget";
+    spec: unknown;
+    rows: unknown;
+    comparisonRows?: unknown;
+} | {
+    kind: "activity";
+    label: string;
+    status: string;
+    agent?: string;
+    model?: string;
+    /** The REPORT this step produced, if any.
+     *
+     *  An ID and not a path: `buildThreadReplay` is a pure function with no
+     *  host context, and the widget runs in three shells with different route
+     *  shapes. The renderer turns it into a path via `opts.reportHref`. */
+    reportId?: string;
+};
+/** The message variant of a replay item (carries the branch metadata). */
+export type ReplayMessageItem = Extract<LoadedThreadItem, {
+    role: "user" | "assistant";
+}>;
+/** ‹n/m› sibling navigation for one message (mirrors the panel's BranchNav). */
+export interface BranchNav {
+    index: number;
+    count: number;
+    prevLeaf?: string;
+    nextLeaf?: string;
+}
+/** A stored message reduced to what branch navigation needs. */
+export interface BranchMsg {
+    id?: string;
+    parentId?: string | null;
+    createdAt?: string;
+}
+export declare const ROOT_KEY = "__root__";
+/** Deepest leaf under a message, following the most recent child at each step
+ *  (memoised, cycle-guarded) — the target the ‹n/m› switcher jumps to. Mirrors
+ *  the full-page panel's `leafUnder`. */
+export declare function leafUnder(id: string, childrenByParent: Map<string, BranchMsg[]>, memo: Map<string, string>, guard?: number): string;
+/**
+ * Compute the ‹n/m› sibling switcher for every message on the active path.
+ * Siblings share a parent; editing a user turn or regenerating an assistant
+ * reply adds one. The prev/next targets are the deepest leaf under the adjacent
+ * sibling, so switching lands on a full branch. Mirrors the panel's
+ * `computeBranchNav` exactly.
+ */
+export declare function computeBranchNav(messages: BranchMsg[], activePathIds: string[]): Map<string, BranchNav>;
+/**
+ * Map a thread's messages + artifacts (the `/ai/threads/:id/messages` response)
+ * into an ordered replay list — text messages interleaved with their data
+ * widgets by `createdAt`, exactly like the full-page assistant. Pure; hosts pass
+ * it the fetched payload so the widget reopens a conversation WITH its charts.
+ *
+ * Branching: when the server sends a non-empty `activePath`, the visible
+ * transcript is that branch ONLY — messages (and message-scoped artifacts) are
+ * filtered to it, and each surviving message carries its ‹n/m› sibling switcher
+ * (computed over ALL messages). Absent/empty path → behave exactly as before
+ * (back-compat with pre-branching hosts).
+ */
+export declare function buildThreadReplay(payload: {
+    messages?: Array<{
+        id?: string;
+        parentId?: string | null;
+        role: string;
+        content: string;
+        createdAt?: string;
+        /** Persisted per-turn token spend (assistant rows; both read endpoints
+         *  return them) — carried into the replay's tokens caption. */
+        inputTokens?: number | null;
+        outputTokens?: number | null;
+    }>;
+    artifacts?: Array<{
+        kind: string;
+        messageId?: string | null;
+        payload?: unknown;
+        /** proposed | applied | discarded — what tells a replayed proposal card
+         *  whether Apply is still a live decision. */
+        status?: string;
+        createdAt?: string;
+    }>;
+    activePath?: string[];
+}): LoadedThreadItem[];
+//# sourceMappingURL=replay.d.ts.map

package/dist/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;oEAEoE;AACpE,MAAM,MAAM,gBAAgB,GACxB;IACE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;oEACgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;4DAGwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,MAAM,CAAC,EAAE;QACP,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;2EAIuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AACN,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,OAAO,CACrC,gBAAgB,EAChB;IAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAA;CAAE,CAC/B,CAAC;AAEF,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gEAAgE;AAChE,MAAM,WAAW,SAAS;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,QAAQ,aAAa,CAAC;AAEnC;;yCAEyC;AACzC,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAC1C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACzB,KAAK,SAAI,GACR,MAAM,CAcR;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,EAAE,EACrB,aAAa,EAAE,MAAM,EAAE,GACtB,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAoCxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;uEAC+D;QAC/D,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;sDAC8C;QAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB,GAAG,gBAAgB,EAAE,CA+ErB"}

package/dist/replay.js

@@ -0,0 +1,172 @@
+/**
+ * Replaying a saved thread, and the ‹n/m› branch navigation over it.
+ *
+ * Extracted from index.ts (#320). Measured at ZERO leakage: nothing in these
+ * 250 lines reaches a top-level declaration in the file it came from, which is
+ * why it moves as a unit and why the move is reviewable.
+ *
+ * The shape is worth naming, because it is the seam #306 needs: a PURE
+ * TRANSFORM — a server payload in, a list of render items out — with no DOM,
+ * no transport and no host context. `buildThreadReplay` is already documented
+ * as taking a report ID rather than a path for exactly that reason ("a pure
+ * function with no host context, and the widget runs in three shells with
+ * different route shapes"). A published widget needs more regions like this
+ * one and fewer inside the 6000-line closure.
+ */
+export const ROOT_KEY = "__root__";
+/** Deepest leaf under a message, following the most recent child at each step
+ *  (memoised, cycle-guarded) — the target the ‹n/m› switcher jumps to. Mirrors
+ *  the full-page panel's `leafUnder`. */
+export function leafUnder(id, childrenByParent, memo, guard = 0) {
+    const cached = memo.get(id);
+    if (cached)
+        return cached;
+    const kids = childrenByParent.get(id);
+    if (!kids || kids.length === 0 || guard > 1000) {
+        memo.set(id, id);
+        return id;
+    }
+    const last = kids[kids.length - 1];
+    const leaf = last?.id
+        ? leafUnder(last.id, childrenByParent, memo, guard + 1)
+        : id;
+    memo.set(id, leaf);
+    return leaf;
+}
+/**
+ * Compute the ‹n/m› sibling switcher for every message on the active path.
+ * Siblings share a parent; editing a user turn or regenerating an assistant
+ * reply adds one. The prev/next targets are the deepest leaf under the adjacent
+ * sibling, so switching lands on a full branch. Mirrors the panel's
+ * `computeBranchNav` exactly.
+ */
+export function computeBranchNav(messages, activePathIds) {
+    const childrenByParent = new Map();
+    for (const m of messages) {
+        const key = m.parentId ?? ROOT_KEY;
+        const arr = childrenByParent.get(key);
+        if (arr)
+            arr.push(m);
+        else
+            childrenByParent.set(key, [m]);
+    }
+    for (const arr of childrenByParent.values()) {
+        arr.sort((a, b) => (a.createdAt ?? "").localeCompare(b.createdAt ?? ""));
+    }
+    const memo = new Map();
+    const byId = new Map();
+    for (const m of messages)
+        if (m.id)
+            byId.set(m.id, m);
+    const nav = new Map();
+    for (const id of activePathIds) {
+        const m = byId.get(id);
+        if (!m)
+            continue;
+        const siblings = childrenByParent.get(m.parentId ?? ROOT_KEY) ?? [];
+        if (siblings.length < 2)
+            continue;
+        const i = siblings.findIndex((s) => s.id === id);
+        if (i < 0)
+            continue;
+        const prev = siblings[i - 1];
+        const next = siblings[i + 1];
+        nav.set(id, {
+            index: i + 1,
+            count: siblings.length,
+            ...(prev?.id
+                ? { prevLeaf: leafUnder(prev.id, childrenByParent, memo) }
+                : {}),
+            ...(next?.id
+                ? { nextLeaf: leafUnder(next.id, childrenByParent, memo) }
+                : {}),
+        });
+    }
+    return nav;
+}
+/**
+ * Map a thread's messages + artifacts (the `/ai/threads/:id/messages` response)
+ * into an ordered replay list — text messages interleaved with their data
+ * widgets by `createdAt`, exactly like the full-page assistant. Pure; hosts pass
+ * it the fetched payload so the widget reopens a conversation WITH its charts.
+ *
+ * Branching: when the server sends a non-empty `activePath`, the visible
+ * transcript is that branch ONLY — messages (and message-scoped artifacts) are
+ * filtered to it, and each surviving message carries its ‹n/m› sibling switcher
+ * (computed over ALL messages). Absent/empty path → behave exactly as before
+ * (back-compat with pre-branching hosts).
+ */
+export function buildThreadReplay(payload) {
+    const activePathIds = payload.activePath && payload.activePath.length > 0
+        ? payload.activePath
+        : null;
+    const activeSet = activePathIds ? new Set(activePathIds) : null;
+    const branchNav = activePathIds
+        ? computeBranchNav(payload.messages ?? [], activePathIds)
+        : null;
+    const items = [];
+    for (const m of payload.messages ?? []) {
+        // Off-branch messages don't appear in the active transcript.
+        if (activeSet && m.id && !activeSet.has(m.id))
+            continue;
+        if ((m.role === "user" || m.role === "assistant") && m.content.trim()) {
+            const item = {
+                role: m.role,
+                content: m.content,
+                ...(m.id ? { id: m.id } : {}),
+                ...(m.parentId !== undefined ? { parentId: m.parentId } : {}),
+                ...(m.inputTokens ? { inputTokens: m.inputTokens } : {}),
+                ...(m.outputTokens ? { outputTokens: m.outputTokens } : {}),
+                ...(m.id && branchNav?.has(m.id)
+                    ? { branch: branchNav.get(m.id) }
+                    : {}),
+            };
+            items.push({ t: m.createdAt ?? "", item });
+        }
+    }
+    for (const a of payload.artifacts ?? []) {
+        // Branch-scoped artifacts (tied to a message) only belong to the active
+        // branch; artifacts with no messageId are thread-wide and always stay.
+        if (activeSet && a.messageId && !activeSet.has(a.messageId))
+            continue;
+        if (a.kind === "widget") {
+            const p = (a.payload ?? {});
+            if (!p.spec)
+                continue;
+            items.push({
+                t: a.createdAt ?? "",
+                item: {
+                    kind: "widget",
+                    spec: p.spec,
+                    rows: p.rows ?? [],
+                    comparisonRows: p.comparisonRows ?? null,
+                },
+            });
+        }
+        else if (a.kind === "activity") {
+            // A persisted process step — replays the timeline (+ acting agent) on reopen.
+            const p = (a.payload ?? {});
+            if (!p.label)
+                continue;
+            // The report id was persisted on the artifact and DROPPED here, so a
+            // finished report replayed as a chip you could read and not open.
+            const reportId = p.status !== "error" && typeof p.reportId === "string" && p.reportId
+                ? p.reportId
+                : undefined;
+            items.push({
+                t: a.createdAt ?? "",
+                item: {
+                    kind: "activity",
+                    label: p.label,
+                    status: p.status ?? "ok",
+                    agent: p.agent,
+                    model: p.model,
+                    ...(reportId ? { reportId } : {}),
+                },
+            });
+        }
+    }
+    items.sort((x, y) => x.t.localeCompare(y.t));
+    return items.map((s) => s.item);
+}
+//# sourceMappingURL=replay.js.map

package/dist/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../src/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAiEH,MAAM,CAAC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAEnC;;yCAEyC;AACzC,MAAM,UAAU,SAAS,CACvB,EAAU,EACV,gBAA0C,EAC1C,IAAyB,EACzB,KAAK,GAAG,CAAC;IAET,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,EAAE,EAAE;QACnB,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAqB,EACrB,aAAuB;IAEvB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC;QACnC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAChB,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,CAAC,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;YACV,KAAK,EAAE,CAAC,GAAG,CAAC;YACZ,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,GAAG,CAAC,IAAI,EAAE,EAAE;gBACV,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,EAAE,EAAE;gBACV,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAsBjC;IACC,MAAM,aAAa,GACjB,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,OAAO,CAAC,UAAU;QACpB,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,aAAa;QAC7B,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,aAAa,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,KAAK,GAAiD,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACvC,6DAA6D;QAC7D,IAAI,SAAS,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QACxD,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,GAAsB;gBAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9B,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;oBACjC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACxC,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,SAAS,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAS;QACtE,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAIzB,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACtB,KAAK,CAAC,IAAI,CAAC;gBACT,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;gBACpB,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;oBAClB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;iBACzC;aACF,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACjC,8EAA8E;YAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAMzB,CAAC;YACF,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,SAAS;YACvB,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,QAAQ,GACZ,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ;gBAClE,CAAC,CAAC,CAAC,CAAC,QAAQ;gBACZ,CAAC,CAAC,SAAS,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC;gBACT,CAAC,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE;gBACpB,IAAI,EAAE;oBACJ,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;oBACxB,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/safe-url.d.ts

@@ -0,0 +1,47 @@
+/**
+ * What the widget will and will not navigate to.
+ *
+ * Extracted from index.ts (#320) at zero leakage, and kept apart from the
+ * directive shapes next door on purpose: this is the security surface, not the
+ * vocabulary. Model output is untrusted — it can carry text scraped from
+ * third-party sites — so every URL the assistant proposes passes through here.
+ *
+ * It becomes a public surface when the widget publishes (#306): an embedder
+ * pointing the widget at their own backend inherits these rules, so they have
+ * to be findable and readable rather than buried mid-file.
+ */
+/**
+ * Is this an AI-supplied in-app path we're willing to navigate to? Model output
+ * is untrusted (it can carry text scraped from third-party sites), so a path is
+ * only ever a SITE-ROOT-RELATIVE route: it must start with a single `/` and
+ * must not start with `//` or `/\` (both read as protocol-relative, i.e. another
+ * origin) — which also rules out `javascript:`/`data:` payloads.
+ */
+export declare function isSafeRelPath(path: unknown): path is string;
+/**
+ * THE navigation gate — the one the advanced view's frame stands behind.
+ *
+ * Module-level and exported on purpose. `dispatchAction` is a closure over a
+ * live DOM, so with the decision inline there the single check that keeps a
+ * model-authored path out of an un-sandboxed, same-origin, session-bearing
+ * iframe was unreachable by any test: deleting it left the whole suite green.
+ * Here it is exercised directly by the host repo's nav-gate test and the
+ * call site is pinned by source assertion.
+ *
+ * Throws rather than returning a verdict: an undefined return from
+ * `dispatchAction` resolves as SUCCESS, and the chip ticks green over a path we
+ * had just declined.
+ *
+ * `getTargets` is a getter, not an array: `refreshTargets` REPLACES the cache,
+ * and the second read has to see what the first one fetched.
+ */
+export declare function gateNavigationTarget(path: unknown, getTargets: () => readonly {
+    path?: string;
+}[], refreshTargets: () => Promise<void>): Promise<void>;
+/**
+ * Final gate in front of the advanced-view iframe's `src`. That frame is
+ * deliberately un-sandboxed (it hosts our own app with the live session), so
+ * only a same-origin http(s) URL may ever be loaded into it.
+ */
+export declare function isSafeFrameUrl(url: string): boolean;
+//# sourceMappingURL=safe-url.d.ts.map

package/dist/safe-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-url.d.ts","sourceRoot":"","sources":["../src/safe-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAO3D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,MAAM,SAAS;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,EAC9C,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAClC,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAUnD"}

package/dist/safe-url.js

@@ -0,0 +1,80 @@
+/**
+ * What the widget will and will not navigate to.
+ *
+ * Extracted from index.ts (#320) at zero leakage, and kept apart from the
+ * directive shapes next door on purpose: this is the security surface, not the
+ * vocabulary. Model output is untrusted — it can carry text scraped from
+ * third-party sites — so every URL the assistant proposes passes through here.
+ *
+ * It becomes a public surface when the widget publishes (#306): an embedder
+ * pointing the widget at their own backend inherits these rules, so they have
+ * to be findable and readable rather than buried mid-file.
+ */
+import { isKnownNavTarget } from "./host-actions.js";
+/**
+ * Is this an AI-supplied in-app path we're willing to navigate to? Model output
+ * is untrusted (it can carry text scraped from third-party sites), so a path is
+ * only ever a SITE-ROOT-RELATIVE route: it must start with a single `/` and
+ * must not start with `//` or `/\` (both read as protocol-relative, i.e. another
+ * origin) — which also rules out `javascript:`/`data:` payloads.
+ */
+export function isSafeRelPath(path) {
+    return (typeof path === "string" &&
+        path.startsWith("/") &&
+        !path.startsWith("//") &&
+        !path.startsWith("/\\"));
+}
+/**
+ * THE navigation gate — the one the advanced view's frame stands behind.
+ *
+ * Module-level and exported on purpose. `dispatchAction` is a closure over a
+ * live DOM, so with the decision inline there the single check that keeps a
+ * model-authored path out of an un-sandboxed, same-origin, session-bearing
+ * iframe was unreachable by any test: deleting it left the whole suite green.
+ * Here it is exercised directly by the host repo's nav-gate test and the
+ * call site is pinned by source assertion.
+ *
+ * Throws rather than returning a verdict: an undefined return from
+ * `dispatchAction` resolves as SUCCESS, and the chip ticks green over a path we
+ * had just declined.
+ *
+ * `getTargets` is a getter, not an array: `refreshTargets` REPLACES the cache,
+ * and the second read has to see what the first one fetched.
+ */
+export async function gateNavigationTarget(path, getTargets, refreshTargets) {
+    // AI-supplied navigation targets are untrusted: only a root-relative in-app
+    // route is ever followed — in the advanced-view frame OR by the host router.
+    if (!isSafeRelPath(path))
+        throw new Error("that navigation target is not an in-app page");
+    // …and the shape test is not the gate. It admits every path in the app,
+    // including another tenant's: `/accounts/<someone-else>/settings` is
+    // root-relative, and the host's `orgPath`/`adminPath` return an
+    // already-`/accounts/`-prefixed path untouched. The manifest this turn was
+    // built from is the real allow-list; it has been present as `knownNavTargets`
+    // since #111 and nothing but the prose-nav fallback ever read it.
+    //
+    // The cache holds the LAST TURN THIS SESSION SENT, which is not every chip
+    // that can be clicked: `persistKey` restores a transcript across a reload and
+    // its nav chips are live before a word has been sent. Ask the host for its
+    // catalogue rather than refuse a page the manifest declares.
+    if (!getTargets().length)
+        await refreshTargets();
+    if (!isKnownNavTarget(path, getTargets()))
+        throw new Error("that page is not one I can open");
+}
+/**
+ * Final gate in front of the advanced-view iframe's `src`. That frame is
+ * deliberately un-sandboxed (it hosts our own app with the live session), so
+ * only a same-origin http(s) URL may ever be loaded into it.
+ */
+export function isSafeFrameUrl(url) {
+    try {
+        const u = new URL(url, location.origin);
+        return (u.origin === location.origin &&
+            (u.protocol === "http:" || u.protocol === "https:"));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=safe-url.js.map

package/dist/safe-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-url.js","sourceRoot":"","sources":["../src/safe-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACpB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CACxB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAa,EACb,UAA8C,EAC9C,cAAmC;IAEnC,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,wEAAwE;IACxE,qEAAqE;IACrE,gEAAgE;IAChE,2EAA2E;IAC3E,8EAA8E;IAC9E,kEAAkE;IAClE,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM;QAAE,MAAM,cAAc,EAAE,CAAC;IACjD,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAC5B,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}