@8wave/ai-elements 0.115.0-beta.34 → 0.115.0-beta.47

package/dist-vue/locales.js

@@ -254,6 +254,9 @@ var e = {
 		monthRateLimit: "Month Rate Limit",
 		trustedOrigins: "Trusted Origins",
 		origin: "Origine",
+		imageHosts: "Image hosts",
+		imageHost: "Host",
+		imageHostsHint: "Answers and cards load images by themselves only from these hosts and from the platform. An image from any other host shows its host and loads on a click, so an answer cannot send the conversation to a site through an image url.",
 		conversations: "Conversations",
 		profile: "Profile",
 		authentication: "Authentication",
@@ -302,6 +305,7 @@ var e = {
 		thinking: "Thinking",
 		enabled: "Enabled",
 		disabled: "Disabled",
+		imageHeld: "Image from {host}: click to load",
 		imageLoadError: "Image not available",
 		toolApprovalBadge: "User confirm",
 		calendarEvent: "Event",
@@ -353,6 +357,8 @@ var e = {
 		askAnything: "Type your message...",
 		noTrustedOrigins: "No trusted origins configured",
 		insertOrigin: "https://example.com",
+		noImageHosts: "No image hosts: images from other hosts wait for a click",
+		insertImageHost: "images.example.com",
 		search: "Search...",
 		comment: "Write your comment...",
 		enterYourQuestion: "Enter your question...",
@@ -847,6 +853,9 @@ var e = {
 		monthRateLimit: "Limite al mese",
 		trustedOrigins: "Origini attendibili",
 		origin: "Origine",
+		imageHosts: "Host delle immagini",
+		imageHost: "Host",
+		imageHostsHint: "Risposte e card caricano da sole solo le immagini di questi host e della piattaforma. Un'immagine di un altro host mostra il suo host e si carica con un clic, così una risposta non può mandare la conversazione a un sito dentro l'url di un'immagine.",
 		conversations: "Conversazioni",
 		profile: "Profilo",
 		authentication: "Autenticazione",
@@ -895,6 +904,7 @@ var e = {
 		thinking: "Pensiero",
 		enabled: "Abilitato",
 		disabled: "Disabilitato",
+		imageHeld: "Immagine da {host}: clicca per caricarla",
 		imageLoadError: "Immagine non disponibile",
 		toolApprovalBadge: "Conferma utente",
 		calendarEvent: "Evento",
@@ -946,6 +956,8 @@ var e = {
 		askAnything: "Scrivi la tua domanda...",
 		noTrustedOrigins: "Nessuna origine attendibile configurata",
 		insertOrigin: "https://example.com",
+		noImageHosts: "Nessun host: le immagini degli altri host aspettano un clic",
+		insertImageHost: "images.example.com",
 		search: "Cerca...",
 		comment: "Scrivi il tuo commento...",
 		enterYourQuestion: "Inserisci la tua domanda...",

package/dist-vue/packages/components/src/chat/PkAgentSettingsPanel.d.ts

@@ -60,6 +60,8 @@ type __VLS_ModelProps = {
     'trustedOrigins'?: {
         origins?: string[];
     };
+    /** Hosts the answers may load images from by themselves (hole 20). */
+    'imageHosts'?: string[] | undefined;
     'disabledTools'?: AgentBuiltInTool[];
     /**
          * Tools that ask the user to confirm before running
@@ -119,9 +121,9 @@ type __VLS_ModelProps = {
     } | undefined;
 };
 type __VLS_PublicProps = __VLS_Props & __VLS_ModelProps;
-declare var __VLS_766: {};
+declare var __VLS_777: {};
 type __VLS_Slots = {} & {
-    default?: (props: typeof __VLS_766) => any;
+    default?: (props: typeof __VLS_777) => any;
 };
 declare const __VLS_base: DefineComponent<__VLS_PublicProps, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
     "update:reasoning": (value: {
@@ -311,6 +313,7 @@ declare const __VLS_base: DefineComponent<__VLS_PublicProps, {}, {}, {}, {}, Com
     "update:trustedOrigins": (value: {
         origins?: string[];
     }) => any;
+    "update:imageHosts": (value: string[] | undefined) => any;
     "update:disabledTools": (value: AgentBuiltInTool[]) => any;
     "update:approvalTools": (value: string[]) => any;
     "update:useAllUserKb": (value: boolean) => any;
@@ -550,6 +553,7 @@ declare const __VLS_base: DefineComponent<__VLS_PublicProps, {}, {}, {}, {}, Com
     "onUpdate:trustedOrigins"?: ((value: {
         origins?: string[];
     }) => any) | undefined;
+    "onUpdate:imageHosts"?: ((value: string[] | undefined) => any) | undefined;
     "onUpdate:disabledTools"?: ((value: AgentBuiltInTool[]) => any) | undefined;
     "onUpdate:approvalTools"?: ((value: string[]) => any) | undefined;
     "onUpdate:useAllUserKb"?: ((value: boolean) => any) | undefined;

package/dist-vue/packages/components/src/chat/PkHeldImage.d.ts

@@ -0,0 +1,21 @@
+import { DefineComponent, ComponentOptionsMixin, PublicProps, ComponentProvideOptions } from 'vue';
+/**
+ * The place of an image a tool card may not load by itself
+ * (chatImagePolicy.ts): it names the host and asks for a click. A span and
+ * not a button, because the cards wrap their images in a link, and a
+ * click here must neither open it nor reach it.
+ */
+type __VLS_Props = {
+    host?: string;
+    /** Fills the slot of a large image, with the words under the icon. */
+    fill?: boolean;
+    /** A video card holds its player the same way. */
+    kind?: 'image' | 'video';
+};
+declare const __VLS_export: DefineComponent<__VLS_Props, {}, {}, {}, {}, ComponentOptionsMixin, ComponentOptionsMixin, {
+    release: () => any;
+}, string, PublicProps, Readonly<__VLS_Props> & Readonly<{
+    onRelease?: (() => any) | undefined;
+}>, {}, {}, {}, {}, string, ComponentProvideOptions, false, {}, any>;
+declare const _default: typeof __VLS_export;
+export default _default;

package/dist-vue/packages/components/src/chat/chatImagePolicy.d.ts

@@ -0,0 +1,55 @@
+import { ComputedRef, InjectionKey } from 'vue';
+/**
+ * Which images a chat loads by itself: hole 20 of
+ * docs/specs/organization-isolation.md.
+ *
+ * The model writes the url of every image in an answer and in the image tool
+ * cards (gallery, products, web pages), and a prompt injected through a
+ * document, a page or a tool result can make it put the conversation in that
+ * url. The browser fetches it as soon as it renders, and the text is gone.
+ * So an image loads by itself only from the media of the platform and from
+ * the hosts the agent lists (`interface.imageHosts`); any other shows its host
+ * and loads on a click, a choice made by whoever reads it.
+ *
+ * Provided by `PkChatbot` (the app and the widget) and by the pages that show
+ * an agent's answers; where nothing is provided, images load as before.
+ */
+export interface ChatImagePolicy {
+    /** Host names the agent lists, normalized (`normalizeImageHost`). */
+    hosts: string[];
+    /** Origins of the platform, which serve the media of a chat. */
+    platformOrigins: string[];
+}
+export declare const ChatImagePolicyKey: InjectionKey<ComputedRef<ChatImagePolicy>>;
+/**
+ * Applies the policy of an agent to the answers rendered below: its listed
+ * hosts, and the backend the page talks to, which serves the chat's media.
+ * The hosts are normalized again because a preview passes them as typed,
+ * before the schema does.
+ */
+export declare function provideChatImagePolicy(hosts: () => string[] | undefined, backendUrl: () => string | undefined): void;
+/**
+ * The host an image url points to, for the placeholder, or `undefined` when
+ * it does not parse.
+ */
+export declare function imageHostOf(src: string, pageUrl: string): string | undefined;
+/**
+ * Whether an image may load without a click. `data:` and `blob:` images never
+ * reach the network; everything else needs the media of the platform or a
+ * listed host, over https. The page's own origin gets no exception: a site,
+ * the platform's included, often redirects wherever its query says.
+ */
+export declare function isImageAllowed(src: string, policy: ChatImagePolicy, pageUrl: string): boolean;
+/**
+ * The policy of the surrounding chat, with the images released by a click.
+ * A release is per url and lasts as long as the component that asked. A
+ * short link of the platform is judged, and named, by the url it stands for:
+ * it waits until the resolver brings that url back.
+ */
+export declare function useChatImageGate(): {
+    /** Whether a policy applies here at all. */
+    isGated: ComputedRef<boolean>;
+    canLoad: (src: string | undefined) => boolean;
+    release: (src: string) => void;
+    hostOf: (src: string) => string | undefined;
+};

package/dist-vue/packages/components/src/chat/index.d.ts

@@ -54,4 +54,5 @@ import { default as PkVoiceOrb } from './PkVoiceOrb';
 import { default as PkChatButton } from './PkChatButton';
 export { MODEL_CATALOG_KEY, provideModelCatalog, useModelCatalogEntry, } from './modelCatalog';
 export { isMcpOAuthReport } from './mcpOAuthReport';
+export { provideChatImagePolicy } from './chatImagePolicy';
 export { PkAgentSelectorInline, PkAgentSettingsPanel, PkAuroraCanvas, PkAvatar, PkChatSidebar, PkChatSidebarConversationItem, PkChatbot, PkChatbotEmptyState, PkChatbotError, PkChatbotFeedbackForm, PkChatbotFilePreview, PkChatbotInput, PkChatbotMessages, PkChatbotSteps, PkChatbotStepToolDetail, PkChatbotStepPayload, PkChatbotViewChat, PkChunkPreview, PkChatbotViewConversations, PkChatbotViewProfile, PkCode, PkCopyBlock, PkDocumentHeader, PkLanguageModel, PkLanguageModelCombobox, PkModelOption, PkMessageParts, PkMessageDetail, PkStreamingMarkdown, PkStreamingMarkdownAutoscroll, PkToolShowForm, PkToolShowArtifact, PkToolApprovalBadge, PkToolShowEmail, PkToolShowMessage, PkToolShowWebPages, PkToolShowProductList, PkToolShowContactForm, PkToolShowCalendarEvent, PkToolShowComparison, PkToolShowLocation, PkToolShowQrCode, PkToolShowImageGallery, PkToolShowSuggestedReply, PkToolShowSources, PkRetryCountdown, PkReasoningChat, PkReasoningSettings, PkWebSearchSettings, PkWelcomePopup, PkChatbotAuth, PkVoiceSession, PkVoiceOrb, PkChatButton, };

package/dist-vue/packages/components/src/chat/markdownHtml.d.ts

@@ -9,6 +9,18 @@ export declare function escapeHtml(text: string): string;
  * no quote either, so the formula cannot close the attribute.
  */
 export declare function renderKatexPlaceholder(text: string, displayMode: boolean): string;
+/**
+ * What the sanitizer does with an image the chat may not load by itself
+ * (see `chatImagePolicy.ts`).
+ */
+export interface HeldImages {
+    canLoad: (src: string) => boolean;
+    hostOf: (src: string) => string | undefined;
+    /** The words on the placeholder, for the host the image points to. */
+    label: (host: string) => string;
+}
+/** The attribute a held image keeps its url in, read back on a click. */
+export declare const HELD_IMAGE_ATTRIBUTE = "data-held-src";
 /**
  * Cleans the HTML rendered from a markdown before it reaches `v-html`. The
  * markdown is written by a model, and through the knowledge base, the tools and
@@ -16,5 +28,9 @@ export declare function renderKatexPlaceholder(text: string, displayMode: boolea
  * through untouched, so a handler written in a document ran in the browser of
  * whoever read the answer. Scripts, handlers, `javascript:` urls, styles and
  * forms go, the formatting stays.
+ *
+ * With `held`, an image the chat may not load by itself becomes a button that
+ * names its host: the url waits in an attribute, which fetches nothing, until
+ * the reader asks for it.
  */
-export declare function sanitizeMarkdownHtml(html: string): string;
+export declare function sanitizeMarkdownHtml(html: string, held?: HeldImages): string;

package/dist-vue/packages/composable/src/chatbot/useChatbotStore.d.ts

@@ -57,6 +57,7 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
         loaderStrategy: AgentLoaderStrategy;
         smoothStream: boolean;
         showExtendedSteps: boolean;
+        imageHosts: string[];
         media?: {
             name: string;
             src: {
@@ -150,6 +151,7 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
         loaderStrategy: AgentLoaderStrategy;
         smoothStream: boolean;
         showExtendedSteps: boolean;
+        imageHosts: string[];
         media?: {
             name: string;
             src: {
@@ -1801,6 +1803,7 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
         loaderStrategy: AgentLoaderStrategy;
         smoothStream: boolean;
         showExtendedSteps: boolean;
+        imageHosts: string[];
         media?: {
             name: string;
             src: {
@@ -1894,6 +1897,7 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
         loaderStrategy: AgentLoaderStrategy;
         smoothStream: boolean;
         showExtendedSteps: boolean;
+        imageHosts: string[];
         media?: {
             name: string;
             src: {
@@ -3545,6 +3549,7 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
         loaderStrategy: AgentLoaderStrategy;
         smoothStream: boolean;
         showExtendedSteps: boolean;
+        imageHosts: string[];
         media?: {
             name: string;
             src: {
@@ -3638,6 +3643,7 @@ export declare function useChatbotStore(agentId: string): Store<`chatbot-${strin
         loaderStrategy: AgentLoaderStrategy;
         smoothStream: boolean;
         showExtendedSteps: boolean;
+        imageHosts: string[];
         media?: {
             name: string;
             src: {

package/dist-vue/packages/models/src/schema/Agent.d.ts

@@ -955,6 +955,12 @@ export declare enum AgentChannel {
     Widget = "widget"
 }
 export declare const ALL_AGENT_CHANNELS: AgentChannel[];
+/**
+ * An image host as an agent lists it: lower case, without scheme, port or
+ * path, so `https://Images.Example.com/a.png` and `images.example.com` are the
+ * same entry and compare equal to `URL.hostname`.
+ */
+export declare function normalizeImageHost(value: string): string;
 export declare const AgentInterfaceSchema: z.ZodObject<{
     media: z.ZodOptional<z.ZodObject<{
         name: z.ZodString;
@@ -1080,6 +1086,7 @@ export declare const AgentInterfaceSchema: z.ZodObject<{
     customCss: z.ZodOptional<z.ZodString>;
     smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
 export type AgentInterface = z.infer<typeof AgentInterfaceSchema>;
 export declare const CHAT_FILE_UPLOAD_DEFAULT_MIME_TYPES: readonly ["image/jpeg", "image/png", "image/gif", "image/webp", "application/pdf", "text/plain", "text/markdown", "text/csv"];
@@ -1517,6 +1524,7 @@ export declare const AgentSettingsSchema: z.ZodObject<{
         customCss: z.ZodOptional<z.ZodString>;
         smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     tools: z.ZodDefault<z.ZodOptional<z.ZodObject<{
         disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AgentBuiltInTool>>>;
@@ -1912,6 +1920,7 @@ export declare const AgentDtoSchema: z.ZodObject<{
             customCss: z.ZodOptional<z.ZodString>;
             smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         tools: z.ZodDefault<z.ZodOptional<z.ZodObject<{
             disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AgentBuiltInTool>>>;
@@ -2308,6 +2317,7 @@ export declare const AgentSchema: z.ZodLazy<z.ZodObject<{
             customCss: z.ZodOptional<z.ZodString>;
             smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         tools: z.ZodDefault<z.ZodOptional<z.ZodObject<{
             disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AgentBuiltInTool>>>;
@@ -2573,6 +2583,7 @@ export declare const AgentPublicSchema: z.ZodObject<{
         customCss: z.ZodOptional<z.ZodString>;
         smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
         showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>;
     createdAt: z.ZodCoercedDate<unknown>;
     updatedAt: z.ZodCoercedDate<unknown>;
@@ -2793,6 +2804,7 @@ export declare const AgentAccessGrantedSchema: z.ZodObject<{
             customCss: z.ZodOptional<z.ZodString>;
             smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         createdAt: z.ZodCoercedDate<unknown>;
         updatedAt: z.ZodCoercedDate<unknown>;
@@ -2973,6 +2985,7 @@ export declare const AgentAccessDecisionSchema: z.ZodDiscriminatedUnion<[z.ZodOb
             customCss: z.ZodOptional<z.ZodString>;
             smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         createdAt: z.ZodCoercedDate<unknown>;
         updatedAt: z.ZodCoercedDate<unknown>;
@@ -3158,6 +3171,7 @@ export declare const AgentAccessSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             customCss: z.ZodOptional<z.ZodString>;
             smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
             showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>;
         createdAt: z.ZodCoercedDate<unknown>;
         updatedAt: z.ZodCoercedDate<unknown>;

package/dist-vue/packages/models/src/schema/ReasoningChat.d.ts

@@ -290,6 +290,7 @@ export declare const ReasoningChatSchema: z.ZodObject<{
                 customCss: z.ZodOptional<z.ZodString>;
                 smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
                 showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
             }, z.core.$strip>;
             tools: z.ZodDefault<z.ZodOptional<z.ZodObject<{
                 disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AgentBuiltInTool>>>;
@@ -737,6 +738,7 @@ export declare const ReasoningChatSchema: z.ZodObject<{
                     customCss: z.ZodOptional<z.ZodString>;
                     smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
                     showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                    imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
                 }, z.core.$strip>;
                 tools: z.ZodDefault<z.ZodOptional<z.ZodObject<{
                     disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AgentBuiltInTool>>>;

package/dist-vue/packages/models/src/schema/SubAgent.d.ts

@@ -290,6 +290,7 @@ export declare const SubAgentSchema: z.ZodObject<{
                 customCss: z.ZodOptional<z.ZodString>;
                 smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
                 showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
             }, z.core.$strip>;
             tools: z.ZodDefault<z.ZodOptional<z.ZodObject<{
                 disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AgentBuiltInTool>>>;
@@ -695,6 +696,7 @@ export declare const SubAgentSchema: z.ZodObject<{
                 customCss: z.ZodOptional<z.ZodString>;
                 smoothStream: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
                 showExtendedSteps: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                imageHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
             }, z.core.$strip>;
             tools: z.ZodDefault<z.ZodOptional<z.ZodObject<{
                 disabled: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AgentBuiltInTool>>>;