@adonis-agora/agent-dashboard 0.7.3 → 0.7.4

package/dist/src/client/api-base.d.ts

@@ -1,14 +1,25 @@
 /**
- * Resolve the base URL of the agent routes the SPA calls. The provider injects the exact base it
- * mounted the agent under as `window.__AGENT_DASHBOARD_BASE__` when it serves `index.html`; when that
- * is absent (e.g. the standalone `vite dev` preview) we derive it from the page's own location by
- * stripping the trailing `/dashboard` mount segment. Either way the SPA never hard-codes `/agent`.
+ * Resolve the base URL of the agent routes the SPA calls. The provider hands the exact base it
+ * mounted the agent under to the page as a JSON data block
+ * (`<script type="application/json" id="agent-dashboard-config">{"apiBase":…}</script>`) when it
+ * serves `index.html`; a `window.__AGENT_DASHBOARD_BASE__` global is honoured after it (tests,
+ * hand-embedding); and when both are absent (e.g. the standalone `vite dev` preview) we derive it
+ * from the page's own location by stripping the trailing `/dashboard` mount segment. Either way the
+ * SPA never hard-codes `/agent`.
+ *
+ * The data block, and not an inline script setting the global, because a host
+ * Content-Security-Policy of `script-src 'self' 'nonce-…'` (shield's `@nonce`) refuses an un-nonced
+ * inline script without a word: the global was never set, the location-derived base took over, and
+ * a console mounted anywhere but the default answered 404 to all of its own requests while rendering
+ * perfectly. A data block is never executed, so no policy can refuse it.
  */
 declare global {
     interface Window {
         __AGENT_DASHBOARD_BASE__?: string;
     }
 }
+/** `id` of the data block the provider injects (`@adonis-agora/agent`'s `CONFIG_ELEMENT_ID`). */
+export declare const CONFIG_ELEMENT_ID = "agent-dashboard-config";
 /**
  * Derive the agent API base from the dashboard's own `pathname`. The dashboard is mounted at
  * `<agentBase>/dashboard`, so we drop that last segment: `/agent/dashboard` → `/agent`,
@@ -16,8 +27,8 @@ declare global {
  * cleaned (trailing slash removed) as a best-effort base.
  */
 export declare function deriveApiBase(pathname: string): string;
-/** The resolved agent API base for this page (injected value wins, else location-derived). */
+/** The resolved agent API base for this page: the data block, else the global, else location-derived. */
 export declare function resolveApiBase(win?: Pick<Window, 'location'> & {
     __AGENT_DASHBOARD_BASE__?: string;
-}): string;
+}, doc?: Pick<Document, 'getElementById'> | undefined): string;
 //# sourceMappingURL=api-base.d.ts.map

package/dist/src/client/api-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-base.d.ts","sourceRoot":"","sources":["../../../src/client/api-base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC;CACF;AAOD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAC5B,GAAG,GAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG;IAAE,wBAAwB,CAAC,EAAE,MAAM,CAAA;CAAW,GAC7E,MAAM,CAIR"}
+{"version":3,"file":"api-base.d.ts","sourceRoot":"","sources":["../../../src/client/api-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd,wBAAwB,CAAC,EAAE,MAAM,CAAC;KACnC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAsB1D;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOtD;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAC5B,GAAG,GAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG;IAAE,wBAAwB,CAAC,EAAE,MAAM,CAAA;CAAW,EAC9E,GAAG,GAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,SAE5B,GACX,MAAM,CAMR"}

package/dist/src/client/api-base.js

@@ -1,9 +1,34 @@
 /**
- * Resolve the base URL of the agent routes the SPA calls. The provider injects the exact base it
- * mounted the agent under as `window.__AGENT_DASHBOARD_BASE__` when it serves `index.html`; when that
- * is absent (e.g. the standalone `vite dev` preview) we derive it from the page's own location by
- * stripping the trailing `/dashboard` mount segment. Either way the SPA never hard-codes `/agent`.
+ * Resolve the base URL of the agent routes the SPA calls. The provider hands the exact base it
+ * mounted the agent under to the page as a JSON data block
+ * (`<script type="application/json" id="agent-dashboard-config">{"apiBase":…}</script>`) when it
+ * serves `index.html`; a `window.__AGENT_DASHBOARD_BASE__` global is honoured after it (tests,
+ * hand-embedding); and when both are absent (e.g. the standalone `vite dev` preview) we derive it
+ * from the page's own location by stripping the trailing `/dashboard` mount segment. Either way the
+ * SPA never hard-codes `/agent`.
+ *
+ * The data block, and not an inline script setting the global, because a host
+ * Content-Security-Policy of `script-src 'self' 'nonce-…'` (shield's `@nonce`) refuses an un-nonced
+ * inline script without a word: the global was never set, the location-derived base took over, and
+ * a console mounted anywhere but the default answered 404 to all of its own requests while rendering
+ * perfectly. A data block is never executed, so no policy can refuse it.
  */
+/** `id` of the data block the provider injects (`@adonis-agora/agent`'s `CONFIG_ELEMENT_ID`). */
+export const CONFIG_ELEMENT_ID = 'agent-dashboard-config';
+/** The `apiBase` carried by the injected data block, or `undefined` when there is none. */
+function readInjectedApiBase(doc) {
+    const element = doc?.getElementById(CONFIG_ELEMENT_ID) ?? null;
+    if (element === null)
+        return undefined;
+    try {
+        const parsed = JSON.parse(element.textContent ?? '');
+        const apiBase = parsed?.apiBase;
+        return typeof apiBase === 'string' && apiBase !== '' ? apiBase : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 /** Strip a trailing `/` (but never reduce `/` itself to `''`). */
 function stripTrailingSlash(path) {
     return path.length > 1 ? path.replace(/\/+$/, '') : path;
@@ -22,8 +47,13 @@ export function deriveApiBase(pathname) {
     }
     return clean === '' ? '/' : clean;
 }
-/** The resolved agent API base for this page (injected value wins, else location-derived). */
-export function resolveApiBase(win = window) {
+/** The resolved agent API base for this page: the data block, else the global, else location-derived. */
+export function resolveApiBase(win = window, doc = typeof document === 'undefined'
+    ? undefined
+    : document) {
+    const fromBlock = readInjectedApiBase(doc);
+    if (fromBlock !== undefined)
+        return stripTrailingSlash(fromBlock);
     const injected = win.__AGENT_DASHBOARD_BASE__;
     if (typeof injected === 'string' && injected !== '')
         return stripTrailingSlash(injected);

package/dist/src/client/api-base.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-base.js","sourceRoot":"","sources":["../../../src/client/api-base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACpC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAC5B,GAAG,GAAqE,MAAM;IAE9E,MAAM,QAAQ,GAAG,GAAG,CAAC,wBAAwB,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzF,OAAO,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"api-base.js","sourceRoot":"","sources":["../../../src/client/api-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,iGAAiG;AACjG,MAAM,CAAC,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAE1D,2FAA2F;AAC3F,SAAS,mBAAmB,CAC1B,GAAiD;IAEjD,MAAM,OAAO,GAAG,GAAG,EAAE,cAAc,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC;IAC/D,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAI,MAAuC,EAAE,OAAO,CAAC;QAClE,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACpC,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAC5B,GAAG,GAAqE,MAAM,EAC9E,GAAG,GAAiD,OAAO,QAAQ,KAAK,WAAW;IACjF,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,QAAQ;IAEZ,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,wBAAwB,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACzF,OAAO,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/agent-dashboard",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Read-only governance console (spend by model/actor, usage trend, recent threads & tool calls, quota) for @adonis-agora/agent — a dependency-light React SPA served by a thin AdonisJS provider. Part of the Agora ecosystem.",
   "license": "MIT",
   "repository": {
@@ -46,7 +46,7 @@
     }
   },
   "devDependencies": {
-    "@adonis-agora/agent": "0.25.4",
+    "@adonis-agora/agent": "0.25.5",
     "@adonisjs/core": "7.5.0",
     "@tanstack/intent": "^0.3.7",
     "@testing-library/react": "16.3.3",