@8wave/ai-elements 0.112.0 → 0.114.0-beta.14

package/dist-vue/packages/auth/src/social-redirect-plugin.d.ts

@@ -1,22 +1,28 @@
 import { BetterAuthPlugin } from 'better-auth';
 /**
- * Backs the widget social-login OAuth popup flow end to end.
+ * Whether `value` is exactly one of the trusted origins: a bare origin, listed
+ * as it is. better-auth matches its trusted origins as patterns, so an agent
+ * whose trusted origins hold `*` would let any page through; the CORS plugin
+ * (apps/backend/src/plugins/fastifyCors.ts) compares them exactly, and a widget
+ * whose host it refuses cannot run anyway.
+ */
+export declare function isListedOrigin(value: string, trusted: string[]): boolean;
+/**
+ * Backs the social sign-in that runs in a browser window on the backend origin.
  *
  * `socialRedirect` initiates the flow through a top-level GET navigation instead
  * of the default `POST /sign-in/social` XHR call. Better-auth's social sign-in
  * sets a signed `state` cookie that the OAuth callback verifies (CSRF
- * protection). When the flow is started from an XHR on a different origin (e.g.
- * the embeddable widget, or any cross-site context), that `Set-Cookie` is a
- * third-party cookie and modern browsers drop it, so the callback fails with
- * `state_mismatch`. By navigating the browser (popup or full page) directly to
+ * protection). When the flow is started from an XHR on a different origin, that
+ * `Set-Cookie` is a third-party cookie and modern browsers drop it, so the
+ * callback fails with `state_mismatch`. By navigating the browser directly to
  * this endpoint on the backend origin, the `state` cookie is set first-party and
- * survives, both in development and in production on customer domains. It mirrors
- * the redirect branch of core `signInSocial`, reusing `generateState` so the
- * stored state stays compatible with the standard OAuth callback.
+ * survives. It mirrors the redirect branch of core `signInSocial`, reusing
+ * `generateState` so the stored state stays compatible with the standard OAuth
+ * callback. The frontend uses it; the widget's popup uses `oauthPopup`, whose
+ * callback hands back the token of the session it just created, and only to the
+ * origin that started it.
  *
- * `widgetOAuthCallback` is the landing page the popup ends on after the OAuth
- * callback completes (it's the `callbackURL` passed to `socialRedirect`). It runs
- * on the backend origin so it can read the first-party session cookie and post the
- * Bearer token back to the widget opener.
+ * The before hook narrows the origin `oauthPopup` accepts to the listed ones.
  */
 export declare function socialRedirect(): BetterAuthPlugin;

package/dist-vue/packages/components/src/chat/markdownHtml.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Escapes text for the inside of an HTML element.
+ */
+export declare function escapeHtml(text: string): string;
+/**
+ * The placeholder a formula waits in until KaTeX renders it. The formula is
+ * percent-encoded, not entity-encoded: the sanitizer drops an attribute whose
+ * value holds `]>` or `-->`, and a formula can (`[a,b]>0`). The encoding has
+ * no quote either, so the formula cannot close the attribute.
+ */
+export declare function renderKatexPlaceholder(text: string, displayMode: boolean): string;
+/**
+ * Cleans the HTML rendered from a markdown before it reaches `v-html`. The
+ * markdown is written by a model, and through the knowledge base, the tools and
+ * the pages it reads, by whoever wrote those; marked passes the HTML it finds
+ * through untouched, so a handler written in a document ran in the browser of
+ * whoever read the answer. Scripts, handlers, `javascript:` urls, styles and
+ * forms go, the formatting stays.
+ */
+export declare function sanitizeMarkdownHtml(html: string): string;

package/dist-vue/packages/components/src/chat/utils.d.ts

@@ -7,6 +7,15 @@ export { isTextPart, isFilePart, isToolPart, isReasoningPart, hasPartText, hasTe
  * that should logically be a single block of text.
  */
 export declare function mergeConsecutiveTextParts(parts: UIMessage['parts']): UIMessage['parts'];
+/**
+ * Drops a widget call refused for its arguments when a later call of the same
+ * widget in the message was drawn: the turn corrected it (the backend's
+ * `correctableInputRefusals`), and the refusal would sit next to the working
+ * widget, `showForm` drawing its render error above the form. A refusal with
+ * nothing drawn after it stays. Only the feed reads this: the steps timeline
+ * keeps every call, the refused one included.
+ */
+export declare function dropCorrectedWidgetErrors(parts: UIMessage['parts']): UIMessage['parts'];
 export declare function isStreamingPart(part: UIMessage['parts'][number] | null | undefined): part is Extract<UIMessage['parts'][number], {
     streaming?: boolean;
 }>;

package/dist-vue/packages/models/src/schema/AgentApiTool.d.ts

@@ -4,6 +4,59 @@ export declare enum AgentApiToolStatus {
     Active = "active",
     Inactive = "inactive"
 }
+/**
+ * Where a secret parameter goes in the request. Never the path: a path
+ * parameter is filled by the model, and its value ends up in every log line
+ * that prints the URL.
+ */
+export declare enum AgentApiToolSecretPosition {
+    Query = "query",
+    Body = "body"
+}
+/** The methods that send a JSON body, the only ones a `body` secret fits. */
+export declare function isApiToolBodyMethod(method: HttpMethod | string): boolean;
+/**
+ * A secret parameter as the API returns it: whether a value is stored, never
+ * the value, not even encrypted (the same contract as `hasApiKey` on the
+ * organization's model provider).
+ */
+export declare const AgentApiToolSecretParameterSchema: z.ZodObject<{
+    name: z.ZodString;
+    position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+    hasValue: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * A secret parameter as a save sends it. The form is never given the stored
+ * value, so it cannot send it back: on an update an empty or missing value
+ * keeps the one stored under the same name and position. A value that is
+ * needed and missing (any of them on a create) is refused by the service with
+ * a reason the interface translates, not here, where it would read as a bare
+ * validation error.
+ */
+export declare const AgentApiToolSecretParameterDtoSchema: z.ZodObject<{
+    name: z.ZodString;
+    position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+    value: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The public parameters whose name looks like a credential: `apikey`,
+ * `api_key`, `token`, `secret` or `password` as a word of the name, in any
+ * case and spelling (`apiKey`, `x-api-key`, `access_token`, `clientSecret`).
+ * The model fills them, so the value it is given ends up in the schema of
+ * every turn and in the input the turn keeps. A parameter already declared
+ * secret is not public and is left out.
+ */
+export declare function credentialLikeParameters(inputSchema: Record<string, unknown> | null | undefined, secretNames?: Iterable<string>): string[];
+/**
+ * A secret parameter as stored in `agent_api_tools.secret_parameters`, with
+ * `value` encrypted by `encryptSecret`. Backend only: it never reaches a
+ * response.
+ */
+export type AgentApiToolStoredSecretParameter = {
+    name: string;
+    position: AgentApiToolSecretPosition;
+    value: string;
+};
 export declare const AgentApiToolSchema: z.ZodObject<{
     id: z.ZodString;
     agentId: z.ZodString;
@@ -18,6 +71,11 @@ export declare const AgentApiToolSchema: z.ZodObject<{
         key: z.ZodString;
         value: z.ZodString;
     }, z.core.$strip>>>>>;
+    secretParameters: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+        hasValue: z.ZodBoolean;
+    }, z.core.$strip>>>;
     inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     outputSchema: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     timeout: z.ZodDefault<z.ZodNumber>;
@@ -42,6 +100,11 @@ export declare const AgentApiToolCreateSchema: z.ZodObject<{
         key: z.ZodString;
         value: z.ZodString;
     }, z.core.$strip>>>>>;
+    secretParameters: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+        value: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>;
     inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     outputSchema: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     timeout: z.ZodOptional<z.ZodNumber>;
@@ -59,6 +122,11 @@ export declare const AgentApiToolUpdateSchema: z.ZodObject<{
         key: z.ZodString;
         value: z.ZodString;
     }, z.core.$strip>>>>>;
+    secretParameters: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+        value: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>;
     inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     outputSchema: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     timeout: z.ZodOptional<z.ZodNumber>;
@@ -81,4 +149,6 @@ export declare const AgentApiToolQuerystringSchema: z.ZodObject<{
 export type AgentApiTool = z.infer<typeof AgentApiToolSchema>;
 export type AgentApiToolCreate = z.infer<typeof AgentApiToolCreateSchema>;
 export type AgentApiToolUpdate = z.infer<typeof AgentApiToolUpdateSchema>;
+export type AgentApiToolSecretParameter = z.infer<typeof AgentApiToolSecretParameterSchema>;
+export type AgentApiToolSecretParameterDto = z.infer<typeof AgentApiToolSecretParameterDtoSchema>;
 export type AgentApiToolQuerystring = z.infer<typeof AgentApiToolQuerystringSchema>;

package/dist-vue/packages/models/src/schema/Lead.d.ts

@@ -119,6 +119,18 @@ export declare const LeadCreateDtoSchema: z.ZodObject<{
         budget: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/**
+ * What the public lead route answers: the submission's own fields back, and
+ * nothing the server holds. The same answer whether the email was new, was
+ * the caller's, or already held another visitor's lead, so it cannot tell
+ * them apart.
+ */
+export declare const LeadSubmissionSchema: z.ZodObject<{
+    name: z.ZodString;
+    chatId: z.ZodString;
+    agentId: z.ZodString;
+    email: z.ZodEmail;
+}, z.core.$strip>;
 /**
  * Lead update schema for PUT endpoint (private/backoffice)
  */
@@ -200,5 +212,6 @@ export declare const LeadsQuerystringSchema: z.ZodObject<{
  */
 export type Lead = z.infer<typeof LeadSchema>;
 export type LeadCreateDto = z.infer<typeof LeadCreateDtoSchema>;
+export type LeadSubmission = z.infer<typeof LeadSubmissionSchema>;
 export type LeadUpdateDto = z.infer<typeof LeadUpdateDtoSchema>;
 export type LeadsQuerystring = z.infer<typeof LeadsQuerystringSchema>;

package/dist-vue/packages/models/src/schema/Media.d.ts

@@ -2,7 +2,6 @@ import { z } from 'zod';
 export declare const MAX_FILE_SIZE: number;
 export declare const MIME_TYPE_REGEX: RegExp;
 export declare const SUPPORTED_IMAGE_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "image/svg+xml"];
-export declare const SUPPORTED_DOCUMENT_TYPES: readonly ["application/pdf", "application/msword", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "text/plain", "text/markdown"];
 export declare const SUPPORTED_VIDEO_TYPES: readonly ["video/mp4", "video/webm", "video/ogg"];
 export declare const SUPPORTED_AUDIO_TYPES: readonly ["audio/mpeg", "audio/wav", "audio/ogg"];
 export declare enum StoragePolicy {

package/dist-vue/packages/models/src/schema/ModelProvider.d.ts

@@ -109,7 +109,7 @@ export declare const EMBEDDING_MODEL_PAYLOAD_KEY = "embedding_model";
  *
  * gemini is the calibration the platform has run on; the OpenAI row was
  * measured on 2026-09-22 and accepted on 2026-09-24
- * (`docs/specs/organization-byok-embedding.md`, D2 and F0), to be checked on
+ * (`docs/specs/released/organization-byok-embedding.md`, D2 and F0), to be checked on
  * the customer's own knowledge base before it is activated for them.
  */
 export declare const DENSE_SIMILARITY_FLOORS: Record<EmbeddingFamily, {

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@8wave/ai-elements",
     "private": false,
-    "version": "0.112.0",
+    "version": "0.114.0-beta.14",
     "type": "module",
     "scripts": {
         "dev": "vite --port 8082 --open --host",
@@ -60,6 +60,7 @@
         "happy-dom": "^20.14.5",
         "i18n": "workspace:*",
         "icons": "workspace:*",
+        "jsdom": "^30.1.1",
         "katex": "^0.18.9",
         "models": "workspace:*",
         "style": "workspace:*",