@burtson-labs/bandit-engine 2.0.168 → 2.1.1

package/CHANGELOG.md

@@ -0,0 +1,42 @@
+# Changelog
+
+Notable changes to `@burtson-labs/bandit-engine`. Versions follow semver.
+
+## 2.1.1
+
+### Chat
+
+- Every tool call is now shown on the message as a tool trail ("Searched: …", "Read: example.com", "Created file: …", failed calls marked), while the answer streams and after it finishes. A call shows as running ("Reading: example.com…") from the moment it starts; calls cut off by a stop or error are saved as "Stopped: …". The trail is saved on the history entry (`HistoryEntry.toolsUsed`) and carried through conversation sync (`ConversationTurnDTO.toolsUsed`), so it survives reloads.
+- A page read with `web_fetch` now gets a Sources chip and a citation number, like search results. Chained tool calls (after the first round) also add their sources.
+- The follow-up pass keeps the tool call in the assistant's own turn ("I called web_fetch(…) and got the results below"), so models without native tool messages know they made the call. Later turns get a short tool note on earlier answers, so the model can still say where an answer came from.
+- Prompt: an attribution rule (name the source; never present tool output or provided context as your own knowledge), one citation format matched to the Sources chips, no more "sources are attached automatically" when none are, and the search service's summary placed after the numbered results it was written from.
+- Custom and MCP-server tools are now recognized on the first model turn, not only in chained rounds.
+- Providers can announce context sources the backend attached (`AIChatResponse.contextSources`, read from an optional `context_sources: [{ label, detail? }]` field on stream chunks); they appear in the tool trail.
+
+## 2.1.0
+
+### License
+- Bandit Engine is now licensed under the Apache License, Version 2.0 (see `LICENSE` and `NOTICE`). Versions up to and including 2.0.168 were published under the Business Source License 1.1 and remain under that license; this release and later ones are Apache-2.0. The relicense covers the package's whole history, including outside contributions, with the contributors' consent. `@burtson-labs/bandit-types` 1.1.0 and `@burtson-labs/bandit-themes` 2.1.0, which the engine depends on and bundles, are relicensed to Apache-2.0 at the same time. So is `@burtson-labs/bandit-cli` 1.1.0, the quickstart scaffolder.
+
+### Security
+- Dependency advisories patched in the production tree: axios ^1.21.0 (prototype-pollution credential theft and MITM, SSRF, header injection), react-router-dom ^7.18.5 (open redirect via backslash), @xmldom/xmldom 0.8.15 through mammoth ^1.13.0 (DoS and XML injection reachable through uploaded .docx). `uuid` is no longer a dependency; ids come from `crypto.randomUUID`.
+- Telemetry no longer forwards the signed-in gateway token to a custom collector. Only the Burtson collector receives it by default; your own endpoint receives exactly the headers you configure.
+- `vectorDatabaseService` is no longer attached to `window` at import time.
+
+### Fixed
+- The CommonJS entry (`require("@burtson-labs/bandit-engine")`) could not load since 2.0.161: it imported `@burtson-labs/icons/mui/<icon>` subpaths that the icons package exposes to `import` only (`ERR_PACKAGE_PATH_NOT_EXPORTED`). The icons the engine uses are now bundled into both outputs, and `@burtson-labs/icons` is no longer an install-time dependency. The CJS entry still resolves ESM-only dependencies (react-markdown, rehype-*, lowlight) through Node's `require(esm)`, so it needs Node 22.12 or later; ESM works everywhere. The packed-consumer check used to report success even when this import failed; it now fails on any error before its final assertion.
+- Feature-flag subscription sync sent an empty bearer: it read a token key nothing writes. It now uses the auth service, so memory-mode sessions work too.
+- `parseJwtClaims` returns `null` quietly for API-key credentials instead of logging an error on every authentication check.
+- Two zustand selectors used the deprecated `(selector, shallow)` form; they use `useShallow`.
+
+### Changed
+- `react`, `react-dom`, `@mui/material`, `@emotion/react` and `@emotion/styled` are peer dependencies only (they were also listed as dependencies, which could install a second copy of MUI and emotion).
+- `idb` is pinned to `^8.0.3` (was `latest`).
+- Package contents: a single entry point, source maps without embedded source, the markdown docs instead of the generated API reference. 227 files / 20.2 MB unpacked becomes 42 files / 6.5 MB (the icons the engine uses are now inside).
+- `exports` has `types` conditions for both module formats and exposes `./package.json`; `./types` is types-only.
+
+### Removed
+- 7,463 lines of source nothing imported and 17 MB of unused images, including a stale copy of the CLI scaffolder (use `@burtson-labs/bandit-cli`), example files, the direct-Ollama hook and store, and twelve theme re-export shims that the exports map already blocked. No public export was removed.
+
+## 2.0.168 and earlier
+Published under BUSL-1.1. See the git history for per-version notes.

package/LICENSE

@@ -1,43 +1,201 @@
-Business Source License 1.1
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-Copyright © 2025 Burtson Labs
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-Licensed for:
-- Personal, educational, and non-commercial use
-- 30-day commercial evaluation period (no production deployment)
+   1. Definitions.
 
-NOT licensed for:
-- Commercial use in production environments
-- Integration in SaaS or client-facing products
-- Rebranding, sublicensing, or redistribution
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
 
-This license converts to Apache 2.0 after 2 years.
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
 
-https://burtson.ai/license
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
 
----
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
 
-Parameters
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
 
-Licensor:             Burtson Labs LLC
-Licensed Work:        Bandit Engine UI SDK
-                      The Licensed Work is © 2025 Burtson Labs
-Additional Use Grant: You may make use of the Licensed Work, provided that you do not use
-                      the Licensed Work for a Commercial Use. A "Commercial Use" means use of
-                      the Licensed Work in production, or any other use that is primarily
-                      intended for or directed toward commercial advantage or monetary
-                      compensation.
-Change Date:          April 1, 2027
-Change License:       Apache License, Version 2.0
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
 
-For information about alternative licensing arrangements for the Licensed Work,
-please visit: https://burtson.ai/license
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
 
-Notice
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
 
-The Business Source License (this document, or the "License") is not an Open Source
-license. However, the Licensed Work will eventually be made available under an Open
-Source License, as stated in this License.
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
 
-License text copyright © 2017 MariaDB Corporation Ab, All Rights Reserved.
-"Business Source License" is a trademark of MariaDB Corporation Ab.
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for describing the origin of the Work and
+      reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may accept and charge a
+      fee for acceptance of support, warranty, indemnity, or other liability
+      obligations and/or rights consistent with this License. However, in
+      accepting such obligations, You may act only on Your own behalf
+      and on Your sole responsibility, not on behalf of any other Contributor,
+      and only if You agree to indemnify, defend, and hold each Contributor
+      harmless for any liability incurred by, or claims asserted against,
+      such Contributor by reason of your accepting any such warranty or
+      additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2025-2026 Burtson Labs LLC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,26 @@
+Bandit Engine
+Copyright 2025-2026 Burtson Labs LLC
+
+This product includes software developed by Burtson Labs LLC (https://burtson.ai).
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+Releases of @burtson-labs/bandit-engine up to and including 2.0.168 were
+published under the Business Source License 1.1 and remain under that license.
+From 2.1.0 the package, including the contributions in its history, is
+relicensed under the Apache License, Version 2.0 with its contributors' consent.
+
+"Bandit", "Bandit AI" and "Burtson Labs" are trademarks of Burtson Labs LLC.
+The License does not grant permission to use these names, logos or marks,
+except as required for reasonable and customary use in describing the origin
+of the work.

package/README.md

@@ -14,7 +14,7 @@ An AI chat toolkit built for speed, design, and control. Power branded AI assist
 [![Docs](https://img.shields.io/badge/docs-banditailabs.com%2Fnpm--package-0C7BD4)](https://banditailabs.com/npm-package)
 [![Live Demo](https://img.shields.io/badge/live%20demo-banditailabs.com%2Fchat-7F56D9)](https://banditailabs.com/)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178c6?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
-[![License: BUSL-1.1](https://img.shields.io/badge/License-BUSL--1.1-red)](./LICENSE)
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue)](./LICENSE)
 
 ## Features
 - Plug-and-play React chat, modal, and management surfaces
@@ -1296,71 +1296,27 @@ The new approach provides:
 
 ---
 
-## <img src="https://icons.burtson.ai/svg-accent/shield.svg" width="18" align="center" alt="" /> License & Protection
+## License
 
-This software is protected under the **Business Source License (BUSL) 1.1** by Burtson Labs LLC.
+Bandit Engine is licensed under the [Apache License, Version 2.0](./LICENSE). You may use, modify and distribute it, including in commercial products, under the terms of that license; [NOTICE](./NOTICE) carries the attributions to keep when you redistribute.
 
-### <img src="https://icons.burtson.ai/svg-accent/scale.svg" width="18" align="center" alt="" /> License Summary
+Versions up to and including 2.0.168 were published under the Business Source License 1.1 and remain under that license; 2.1.0 and later are Apache-2.0. "Bandit", "Bandit AI" and "Burtson Labs" are trademarks of Burtson Labs LLC; the license grants no trademark rights.
 
-- <img src="https://icons.burtson.ai/svg-accent/check-circle.svg" width="16" align="center" alt="" /> **Development & Evaluation**: Free for internal development, testing, and evaluation
-- <img src="https://icons.burtson.ai/svg-accent/check-circle.svg" width="16" align="center" alt="" /> **Non-Commercial Use**: Free for educational, research, and personal projects
-- <img src="https://icons.burtson.ai/svg-accent/x-circle.svg" width="16" align="center" alt="" /> **Commercial Production**: Requires commercial license for production deployment
-- <img src="https://icons.burtson.ai/svg-accent/x-circle.svg" width="16" align="center" alt="" /> **Competitive Use**: Cannot be used to create competing AI chat products
-- <img src="https://icons.burtson.ai/svg-accent/x-circle.svg" width="16" align="center" alt="" /> **AI Training**: Cannot be used as training data for AI models
+Commercial support, hosted Bandit plans and custom integrations are available from Burtson Labs separately from the license: team@burtson.ai. See [docs/06_licensing.md](./docs/06_licensing.md).
 
-### <img src="https://icons.burtson.ai/svg-accent/clipboard-list.svg" width="18" align="center" alt="" /> Usage Rights
+### For contributors
 
-**Permitted:**
-- Internal development and testing
-- Educational and research purposes
-- Evaluation for potential commercial licensing
-- Contributions back to the project (under same license)
-
-**Prohibited:**
-- Production use without commercial license
-- Creating derivative commercial products
-- Using as training data for AI/ML models
-- Removing or modifying license notices and watermarks
-
-### <img src="https://icons.burtson.ai/svg-accent/lock.svg" width="18" align="center" alt="" /> Protection Features
-
-This codebase includes multiple protection layers:
-- **Embedded Watermarks**: Visible and stealth fingerprints in all source files
-- **Audit Trails**: Usage tracking and compliance monitoring
-- **License Validation**: Runtime checks for compliance
-- **Honey Pot Files**: Trap files that trigger license violations when accessed
-
-**<img src="https://icons.burtson.ai/svg-accent/alert-triangle.svg" width="16" align="center" alt="" /> Warning**: Removing, modifying, or bypassing these protection mechanisms constitutes a license violation and may result in immediate license termination.
-
-### <img src="https://icons.burtson.ai/svg-accent/briefcase.svg" width="18" align="center" alt="" /> Commercial Licensing
-
-**Production License**: Required for commercial deployment
-- Full production rights
-- Priority support and maintenance
-- Custom integrations and features
-- Enterprise SLA options
-
-**Contact for Licensing:**
-- **Email**: legal@burtson.ai
-- **Website**: https://burtson.ai/license
-- **Sales**: sales@burtson.ai
-
-### <img src="https://icons.burtson.ai/svg-accent/code.svg" width="18" align="center" alt="" /> For Contributors & Developers
-
-Before contributing or publishing a new Pull Request, run the available validation scripts:
+Before opening a pull request, run:
 
 ```bash
-npm run lint               # Static analysis for the src tree
-npm run test               # Vitest suite
-npm run build              # Generate the dist bundle with tsup
-npm run validate-protection # Check source notice presence
+npm run lint            # Static analysis for the src tree
+npm run test            # Vitest suite
+npm run build           # Generate the dist bundle with tsup
+npm run check:consumer  # Install the packed tarball in a clean React 19 + MUI 7 app
 ```
 
-**Developer resources:**
-- [PRE-PUSH-CHECKLIST.md](./PRE-PUSH-CHECKLIST.md) — build, test, and package checks.
-- [PROTECTION-NOTICE.md](./PROTECTION-NOTICE.md) — source notices and deprecated compatibility helpers.
-- [LICENSE](./LICENSE) — the repository's current license terms.
-
-Source notices are attribution, not telemetry or enforcement. They do not track usage or prevent distribution. The legacy helpers with integrity and validation names are deprecated and must not be used as security controls.
+- [CONTRIBUTING.md](./CONTRIBUTING.md): tooling, commit conventions, review expectations.
+- [LICENSE-NOTICE.md](./LICENSE-NOTICE.md): source notices and the deprecated compatibility helpers.
+- [SECURITY.md](./SECURITY.md): how to report a vulnerability.
 
-© 2025 Burtson Labs LLC.
+© 2025-2026 Burtson Labs LLC.

package/dist/aiProviderStore-42S3LW2J.mjs

@@ -0,0 +1,8 @@
+import {
+  useAIProviderStore
+} from "./chunk-5KC42IIR.mjs";
+import "./chunk-NI7BKLC7.mjs";
+export {
+  useAIProviderStore
+};
+//# sourceMappingURL=aiProviderStore-42S3LW2J.mjs.map

package/dist/aiProviderStore-42S3LW2J.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"mappings":"","names":[]}

package/dist/chat-GDC4ZVCF.mjs

@@ -0,0 +1,10 @@
+import {
+  chat_default
+} from "./chunk-7QYA3PAF.mjs";
+import "./chunk-FCQN3LKT.mjs";
+import "./chunk-5KC42IIR.mjs";
+import "./chunk-NI7BKLC7.mjs";
+export {
+  chat_default as default
+};
+//# sourceMappingURL=chat-GDC4ZVCF.mjs.map

package/dist/chat-GDC4ZVCF.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"mappings":"","names":[]}