@8wave/ai-elements 0.112.0 → 0.114.0-beta.15

package/dist-vue/locales.js

@@ -567,6 +567,14 @@ var e = {
 		feelsLike: "Feels like",
 		dailyForecast: "Daily forecast",
 		airQuality: "Air quality"
+	},
+	turnEvaluation: {
+		cost: "Cost, not charged to the organization: {cost}",
+		title: "Evaluation after the reply",
+		modeHint: "Recorded after the reply, with no effect: nothing reads these probabilities yet.",
+		version: "Questions version {version}",
+		leadFailed: "The evaluation failed or did not answer within {budget} ms: nothing was recorded.",
+		probability: "Probability the evaluation model gives to the question: from 0.5 it leans towards yes"
 	}
 }, t = {
 	agentType: {
@@ -1136,6 +1144,14 @@ var e = {
 		feelsLike: "Percepita",
 		dailyForecast: "Previsioni giornaliere",
 		airQuality: "Qualità dell'aria"
+	},
+	turnEvaluation: {
+		cost: "Costo, non addebitato all'organizzazione: {cost}",
+		title: "Valutazione a fine turno",
+		modeHint: "Registrata dopo la risposta, senza effetti: per ora nessuno legge queste probabilità.",
+		version: "Versione delle domande: {version}",
+		leadFailed: "La valutazione non è riuscita o non ha risposto entro {budget} ms: non è stato registrato niente.",
+		probability: "Probabilità che il modello di valutazione dà alla domanda: da 0,5 in su propende per il sì"
 	}
 };
 //#endregion

package/dist-vue/packages/auth/src/social-redirect-plugin.d.ts

@@ -1,22 +1,28 @@
 import { BetterAuthPlugin } from 'better-auth';
 /**
- * Backs the widget social-login OAuth popup flow end to end.
+ * Whether `value` is exactly one of the trusted origins: a bare origin, listed
+ * as it is. better-auth matches its trusted origins as patterns, so an agent
+ * whose trusted origins hold `*` would let any page through; the CORS plugin
+ * (apps/backend/src/plugins/fastifyCors.ts) compares them exactly, and a widget
+ * whose host it refuses cannot run anyway.
+ */
+export declare function isListedOrigin(value: string, trusted: string[]): boolean;
+/**
+ * Backs the social sign-in that runs in a browser window on the backend origin.
  *
  * `socialRedirect` initiates the flow through a top-level GET navigation instead
  * of the default `POST /sign-in/social` XHR call. Better-auth's social sign-in
  * sets a signed `state` cookie that the OAuth callback verifies (CSRF
- * protection). When the flow is started from an XHR on a different origin (e.g.
- * the embeddable widget, or any cross-site context), that `Set-Cookie` is a
- * third-party cookie and modern browsers drop it, so the callback fails with
- * `state_mismatch`. By navigating the browser (popup or full page) directly to
+ * protection). When the flow is started from an XHR on a different origin, that
+ * `Set-Cookie` is a third-party cookie and modern browsers drop it, so the
+ * callback fails with `state_mismatch`. By navigating the browser directly to
  * this endpoint on the backend origin, the `state` cookie is set first-party and
- * survives, both in development and in production on customer domains. It mirrors
- * the redirect branch of core `signInSocial`, reusing `generateState` so the
- * stored state stays compatible with the standard OAuth callback.
+ * survives. It mirrors the redirect branch of core `signInSocial`, reusing
+ * `generateState` so the stored state stays compatible with the standard OAuth
+ * callback. The frontend uses it; the widget's popup uses `oauthPopup`, whose
+ * callback hands back the token of the session it just created, and only to the
+ * origin that started it.
  *
- * `widgetOAuthCallback` is the landing page the popup ends on after the OAuth
- * callback completes (it's the `callbackURL` passed to `socialRedirect`). It runs
- * on the backend origin so it can read the first-party session cookie and post the
- * Bearer token back to the widget opener.
+ * The before hook narrows the origin `oauthPopup` accepts to the listed ones.
  */
 export declare function socialRedirect(): BetterAuthPlugin;

package/dist-vue/packages/components/src/chat/PkTurnEvaluation.d.ts

@@ -0,0 +1,8 @@
+import { UIChatMessage } from '../../../models/src';
+import { DefineComponent, ComponentOptionsMixin, PublicProps, ComponentProvideOptions } from 'vue';
+type __VLS_Props = {
+    message: UIChatMessage;
+};
+declare const __VLS_export: DefineComponent<__VLS_Props, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {}, string, PublicProps, Readonly<__VLS_Props> & Readonly<{}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+declare const _default: typeof __VLS_export;
+export default _default;

package/dist-vue/packages/components/src/chat/markdownHtml.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Escapes text for the inside of an HTML element.
+ */
+export declare function escapeHtml(text: string): string;
+/**
+ * The placeholder a formula waits in until KaTeX renders it. The formula is
+ * percent-encoded, not entity-encoded: the sanitizer drops an attribute whose
+ * value holds `]>` or `-->`, and a formula can (`[a,b]>0`). The encoding has
+ * no quote either, so the formula cannot close the attribute.
+ */
+export declare function renderKatexPlaceholder(text: string, displayMode: boolean): string;
+/**
+ * Cleans the HTML rendered from a markdown before it reaches `v-html`. The
+ * markdown is written by a model, and through the knowledge base, the tools and
+ * the pages it reads, by whoever wrote those; marked passes the HTML it finds
+ * through untouched, so a handler written in a document ran in the browser of
+ * whoever read the answer. Scripts, handlers, `javascript:` urls, styles and
+ * forms go, the formatting stays.
+ */
+export declare function sanitizeMarkdownHtml(html: string): string;

package/dist-vue/packages/components/src/chat/utils.d.ts

@@ -7,6 +7,15 @@ export { isTextPart, isFilePart, isToolPart, isReasoningPart, hasPartText, hasTe
  * that should logically be a single block of text.
  */
 export declare function mergeConsecutiveTextParts(parts: UIMessage['parts']): UIMessage['parts'];
+/**
+ * Drops a widget call refused for its arguments when a later call of the same
+ * widget in the message was drawn: the turn corrected it (the backend's
+ * `correctableInputRefusals`), and the refusal would sit next to the working
+ * widget, `showForm` drawing its render error above the form. A refusal with
+ * nothing drawn after it stays. Only the feed reads this: the steps timeline
+ * keeps every call, the refused one included.
+ */
+export declare function dropCorrectedWidgetErrors(parts: UIMessage['parts']): UIMessage['parts'];
 export declare function isStreamingPart(part: UIMessage['parts'][number] | null | undefined): part is Extract<UIMessage['parts'][number], {
     streaming?: boolean;
 }>;

package/dist-vue/packages/composable/src/chatbot/useChatbotStore.d.ts

@@ -633,6 +633,16 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
                         failed?: boolean | undefined;
                     } | undefined;
                 } | undefined;
+                turnEvaluation?: {
+                    version: number;
+                    mode: "shadow";
+                    probabilities: Record<string, number>;
+                    latencyMs: number;
+                    budgetMs: number;
+                    cost?: number | undefined;
+                    inputTokens?: number | undefined;
+                    failed?: true | undefined;
+                } | undefined;
             } | undefined;
             parts: ({
                 type: "text";
@@ -1139,6 +1149,16 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
                         failed?: boolean | undefined;
                     } | undefined;
                 } | undefined;
+                turnEvaluation?: {
+                    version: number;
+                    mode: "shadow";
+                    probabilities: Record<string, number>;
+                    latencyMs: number;
+                    budgetMs: number;
+                    cost?: number | undefined;
+                    inputTokens?: number | undefined;
+                    failed?: true | undefined;
+                } | undefined;
             } | undefined;
             parts: ({
                 type: "text";
@@ -2343,6 +2363,16 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
                         failed?: boolean | undefined;
                     } | undefined;
                 } | undefined;
+                turnEvaluation?: {
+                    version: number;
+                    mode: "shadow";
+                    probabilities: Record<string, number>;
+                    latencyMs: number;
+                    budgetMs: number;
+                    cost?: number | undefined;
+                    inputTokens?: number | undefined;
+                    failed?: true | undefined;
+                } | undefined;
             } | undefined;
             parts: ({
                 type: "text";
@@ -2849,6 +2879,16 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
                         failed?: boolean | undefined;
                     } | undefined;
                 } | undefined;
+                turnEvaluation?: {
+                    version: number;
+                    mode: "shadow";
+                    probabilities: Record<string, number>;
+                    latencyMs: number;
+                    budgetMs: number;
+                    cost?: number | undefined;
+                    inputTokens?: number | undefined;
+                    failed?: true | undefined;
+                } | undefined;
             } | undefined;
             parts: ({
                 type: "text";
@@ -4053,6 +4093,16 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
                         failed?: boolean | undefined;
                     } | undefined;
                 } | undefined;
+                turnEvaluation?: {
+                    version: number;
+                    mode: "shadow";
+                    probabilities: Record<string, number>;
+                    latencyMs: number;
+                    budgetMs: number;
+                    cost?: number | undefined;
+                    inputTokens?: number | undefined;
+                    failed?: true | undefined;
+                } | undefined;
             } | undefined;
             parts: ({
                 type: "text";
@@ -4559,6 +4609,16 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
                         failed?: boolean | undefined;
                     } | undefined;
                 } | undefined;
+                turnEvaluation?: {
+                    version: number;
+                    mode: "shadow";
+                    probabilities: Record<string, number>;
+                    latencyMs: number;
+                    budgetMs: number;
+                    cost?: number | undefined;
+                    inputTokens?: number | undefined;
+                    failed?: true | undefined;
+                } | undefined;
             } | undefined;
             parts: ({
                 type: "text";

package/dist-vue/packages/models/src/schema/AgentApiTool.d.ts

@@ -4,6 +4,59 @@ export declare enum AgentApiToolStatus {
     Active = "active",
     Inactive = "inactive"
 }
+/**
+ * Where a secret parameter goes in the request. Never the path: a path
+ * parameter is filled by the model, and its value ends up in every log line
+ * that prints the URL.
+ */
+export declare enum AgentApiToolSecretPosition {
+    Query = "query",
+    Body = "body"
+}
+/** The methods that send a JSON body, the only ones a `body` secret fits. */
+export declare function isApiToolBodyMethod(method: HttpMethod | string): boolean;
+/**
+ * A secret parameter as the API returns it: whether a value is stored, never
+ * the value, not even encrypted (the same contract as `hasApiKey` on the
+ * organization's model provider).
+ */
+export declare const AgentApiToolSecretParameterSchema: z.ZodObject<{
+    name: z.ZodString;
+    position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+    hasValue: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * A secret parameter as a save sends it. The form is never given the stored
+ * value, so it cannot send it back: on an update an empty or missing value
+ * keeps the one stored under the same name and position. A value that is
+ * needed and missing (any of them on a create) is refused by the service with
+ * a reason the interface translates, not here, where it would read as a bare
+ * validation error.
+ */
+export declare const AgentApiToolSecretParameterDtoSchema: z.ZodObject<{
+    name: z.ZodString;
+    position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+    value: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The public parameters whose name looks like a credential: `apikey`,
+ * `api_key`, `token`, `secret` or `password` as a word of the name, in any
+ * case and spelling (`apiKey`, `x-api-key`, `access_token`, `clientSecret`).
+ * The model fills them, so the value it is given ends up in the schema of
+ * every turn and in the input the turn keeps. A parameter already declared
+ * secret is not public and is left out.
+ */
+export declare function credentialLikeParameters(inputSchema: Record<string, unknown> | null | undefined, secretNames?: Iterable<string>): string[];
+/**
+ * A secret parameter as stored in `agent_api_tools.secret_parameters`, with
+ * `value` encrypted by `encryptSecret`. Backend only: it never reaches a
+ * response.
+ */
+export type AgentApiToolStoredSecretParameter = {
+    name: string;
+    position: AgentApiToolSecretPosition;
+    value: string;
+};
 export declare const AgentApiToolSchema: z.ZodObject<{
     id: z.ZodString;
     agentId: z.ZodString;
@@ -18,6 +71,11 @@ export declare const AgentApiToolSchema: z.ZodObject<{
         key: z.ZodString;
         value: z.ZodString;
     }, z.core.$strip>>>>>;
+    secretParameters: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+        hasValue: z.ZodBoolean;
+    }, z.core.$strip>>>;
     inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     outputSchema: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     timeout: z.ZodDefault<z.ZodNumber>;
@@ -42,6 +100,11 @@ export declare const AgentApiToolCreateSchema: z.ZodObject<{
         key: z.ZodString;
         value: z.ZodString;
     }, z.core.$strip>>>>>;
+    secretParameters: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+        value: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>;
     inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     outputSchema: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     timeout: z.ZodOptional<z.ZodNumber>;
@@ -59,6 +122,11 @@ export declare const AgentApiToolUpdateSchema: z.ZodObject<{
         key: z.ZodString;
         value: z.ZodString;
     }, z.core.$strip>>>>>;
+    secretParameters: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        position: z.ZodEnum<typeof AgentApiToolSecretPosition>;
+        value: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>>;
     inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     outputSchema: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
     timeout: z.ZodOptional<z.ZodNumber>;
@@ -81,4 +149,6 @@ export declare const AgentApiToolQuerystringSchema: z.ZodObject<{
 export type AgentApiTool = z.infer<typeof AgentApiToolSchema>;
 export type AgentApiToolCreate = z.infer<typeof AgentApiToolCreateSchema>;
 export type AgentApiToolUpdate = z.infer<typeof AgentApiToolUpdateSchema>;
+export type AgentApiToolSecretParameter = z.infer<typeof AgentApiToolSecretParameterSchema>;
+export type AgentApiToolSecretParameterDto = z.infer<typeof AgentApiToolSecretParameterDtoSchema>;
 export type AgentApiToolQuerystring = z.infer<typeof AgentApiToolQuerystringSchema>;

package/dist-vue/packages/models/src/schema/Chat.d.ts

@@ -492,10 +492,52 @@ export type UIChatMessageMetadata = {
      * organization ({@link withoutToolCatalogue}).
      */
     toolCatalogue?: ToolCatalogueRecord;
+    /**
+     * The evaluation of the turn after the reply (spec post-turn-evaluation):
+     * a probability per question. Written after the answer, and removed from
+     * a public read ({@link withoutTurnEvaluation}).
+     */
+    turnEvaluation?: TurnEvaluationRecord;
+};
+/**
+ * The questions of the post-turn evaluation, in the order they are asked and
+ * listed. The backend's questions are typed against it, so the two cannot
+ * drift. A reader orders by this list and not by the record: jsonb keeps the
+ * keys of an object sorted by length, not in the order they were written.
+ */
+export declare const TURN_EVALUATION_QUESTION_IDS: readonly ["durableFact", "abusive", "manipulation", "asksHuman", "missingInfo", "informationGap"];
+export type TurnEvaluationQuestionId = (typeof TURN_EVALUATION_QUESTION_IDS)[number];
+/**
+ * The evaluation model's answers on a finished turn (spec
+ * post-turn-evaluation, F1). Recorded in shadow only: nothing reads it yet.
+ */
+export type TurnEvaluationRecord = {
+    /**
+     * The wording of the questions: a threshold holds only for the wording
+     * it was measured on, so a record says which one it answered.
+     */
+    version: number;
+    mode: 'shadow';
+    /** Probability per question, two decimals. Empty when the request failed. */
+    probabilities: Record<string, number>;
+    latencyMs: number;
+    budgetMs: number;
+    /** Market cost of the request in USD. */
+    cost?: number;
+    inputTokens?: number;
+    /** The request failed or ran past its budget: no answer was recorded. */
+    failed?: true;
 };
 export type UIChatMessage = UIMessage & {
     metadata?: UIChatMessageMetadata;
 };
+/**
+ * The history without the turn evaluations, for a public read: a probability
+ * of abuse on a user must not reach the widget. Kept apart from
+ * {@link withoutToolCatalogue}, which the data export uses too, because
+ * whether the export includes this judgment is still to be decided.
+ */
+export declare function withoutTurnEvaluation(messages: UIChatMessage[]): UIChatMessage[];
 /**
  * The history without the tool catalogue records, for a reader outside the
  * organization (a public chat read, the data export): a record names every

package/dist-vue/packages/models/src/schema/Lead.d.ts

@@ -119,6 +119,18 @@ export declare const LeadCreateDtoSchema: z.ZodObject<{
         budget: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/**
+ * What the public lead route answers: the submission's own fields back, and
+ * nothing the server holds. The same answer whether the email was new, was
+ * the caller's, or already held another visitor's lead, so it cannot tell
+ * them apart.
+ */
+export declare const LeadSubmissionSchema: z.ZodObject<{
+    name: z.ZodString;
+    chatId: z.ZodString;
+    agentId: z.ZodString;
+    email: z.ZodEmail;
+}, z.core.$strip>;
 /**
  * Lead update schema for PUT endpoint (private/backoffice)
  */
@@ -200,5 +212,6 @@ export declare const LeadsQuerystringSchema: z.ZodObject<{
  */
 export type Lead = z.infer<typeof LeadSchema>;
 export type LeadCreateDto = z.infer<typeof LeadCreateDtoSchema>;
+export type LeadSubmission = z.infer<typeof LeadSubmissionSchema>;
 export type LeadUpdateDto = z.infer<typeof LeadUpdateDtoSchema>;
 export type LeadsQuerystring = z.infer<typeof LeadsQuerystringSchema>;

package/dist-vue/packages/models/src/schema/Media.d.ts

@@ -2,7 +2,6 @@ import { z } from 'zod';
 export declare const MAX_FILE_SIZE: number;
 export declare const MIME_TYPE_REGEX: RegExp;
 export declare const SUPPORTED_IMAGE_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "image/svg+xml"];
-export declare const SUPPORTED_DOCUMENT_TYPES: readonly ["application/pdf", "application/msword", "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "application/vnd.ms-excel", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "text/plain", "text/markdown"];
 export declare const SUPPORTED_VIDEO_TYPES: readonly ["video/mp4", "video/webm", "video/ogg"];
 export declare const SUPPORTED_AUDIO_TYPES: readonly ["audio/mpeg", "audio/wav", "audio/ogg"];
 export declare enum StoragePolicy {

package/dist-vue/packages/models/src/schema/ModelProvider.d.ts

@@ -109,7 +109,7 @@ export declare const EMBEDDING_MODEL_PAYLOAD_KEY = "embedding_model";
  *
  * gemini is the calibration the platform has run on; the OpenAI row was
  * measured on 2026-09-22 and accepted on 2026-09-24
- * (`docs/specs/organization-byok-embedding.md`, D2 and F0), to be checked on
+ * (`docs/specs/released/organization-byok-embedding.md`, D2 and F0), to be checked on
  * the customer's own knowledge base before it is activated for them.
  */
 export declare const DENSE_SIMILARITY_FLOORS: Record<EmbeddingFamily, {