@chibitek/chibi 0.1.157 → 0.1.160

package/dist-server/shared/emoji.js

@@ -0,0 +1,27 @@
+import data from "./emoji-catalog.json" with { type: "json" };
+// Unicode Emoji 18.0, fully-qualified sequences. Native fonts supply the artwork.
+// Source: https://unicode.org/Public/18.0.0/emoji/emoji-test.txt
+// License: emoji-LICENSE.txt. Keep sequences intact, including ZWJ and modifiers.
+export const emojiCatalog = data;
+export const quickEmoji = ["👍", "👎", "❤️", "😂", "🎉"];
+const known = new Set(emojiCatalog.flatMap(([emoji]) => [emoji, emoji.replaceAll("\uFE0F", "")]));
+export function isReactionEmoji(value) {
+    return typeof value === "string" && value.length <= 64 && known.has(value);
+}
+export function findEmoji(query, category = "") {
+    const words = query.toLocaleLowerCase().trim().split(/\s+/).filter(Boolean);
+    return emojiCatalog.filter(([emoji, name, group]) => (!category || category === group) &&
+        words.every(word => emoji.includes(word) || name.toLocaleLowerCase().includes(word)));
+}
+export const nativeEmojiFont = '"Apple Color Emoji", "Segoe UI Emoji", "Noto Color Emoji", emoji, sans-serif';
+const withoutTone = (emoji) => emoji.replace(/[\u{1F3FB}-\u{1F3FF}]/gu, "");
+const tones = new Map();
+for (const entry of emojiCatalog) {
+    const base = withoutTone(entry[0]);
+    const family = tones.get(base) ?? [];
+    family.push(entry);
+    tones.set(base, family);
+}
+export function emojiSkinTones(emoji) {
+    return tones.get(withoutTone(emoji)) ?? [];
+}

package/dist-server/shared/mascot-bodies.js

@@ -15,7 +15,7 @@
  */
 import { z } from "zod";
 /** Every selectable body id, in the order the picker shows them. */
-export const MASCOT_BODY_IDS = ["cursor", "blob", "circle", "squircle", "capsule", "drop", "shield", "hexagon", "diamond", "star"];
+export const MASCOT_BODY_IDS = ["cursor", "blob", "circle", "squircle", "capsule", "drop", "shield", "hexagon", "diamond", "star", "panes"];
 export const mascotBodySchema = z.enum(MASCOT_BODY_IDS);
 /** The shipped mascot, and the fallback for any unrecognised value. */
 export const DEFAULT_MASCOT_BODY = "cursor";
@@ -100,6 +100,14 @@ export const MASCOT_BODIES = {
         clip: "<path d=\"M100 2C110.56054 20.13133 121.12108 38.26266 131.68163 56.39398C152.18893 60.83477 172.69623 65.27555 193.20354 69.71633C179.22301 85.3629 165.24248 101.00946 151.26195 116.65602C153.37562 137.5319 155.48929 158.40778 157.60295 179.28367C138.40197 170.82244 119.20098 162.36122 100 153.9C80.79902 162.36122 61.59803 170.82244 42.39705 179.28367C44.51071 158.40778 46.62438 137.5319 48.73805 116.65602C34.75752 101.00946 20.77699 85.3629 6.79646 69.71633C27.30377 65.27555 47.81107 60.83477 68.31837 56.39398C78.87892 38.26266 89.43946 20.13133 100 2Z\"/>",
         anchor: { x: 113.82, y: 125.43, scale: 0.791 },
     },
+    panes: {
+        id: "panes",
+        name: "Panes",
+        fit: "translate(-2.3321 -2.3321) scale(1.166026)",
+        body: "<path fill=\"{{GRADIENT}}\" d=\"M42 2C56 2 70 2 84 2C92 2 92 32 100 32C108 32 108 2 116 2C130 2 144 2 158 2C180.09139 2 198 19.90861 198 42C198 56 198 70 198 84C198 92 168 92 168 100C168 108 198 108 198 116C198 130 198 144 198 158C198 180.09139 180.09139 198 158 198C144 198 130 198 116 198C108 198 108 168 100 168C92 168 92 198 84 198C70 198 56 198 42 198C19.90861 198 2 180.09139 2 158C2 144 2 130 2 116C2 108 32 108 32 100C32 92 2 92 2 84C2 70 2 56 2 42C2 19.90861 19.90861 2 42 2Z\"/>",
+        clip: "<path d=\"M42 2C56 2 70 2 84 2C92 2 92 32 100 32C108 32 108 2 116 2C130 2 144 2 158 2C180.09139 2 198 19.90861 198 42C198 56 198 70 198 84C198 92 168 92 168 100C168 108 198 108 198 116C198 130 198 144 198 158C198 180.09139 180.09139 198 158 198C144 198 130 198 116 198C108 198 108 168 100 168C92 168 92 198 84 198C70 198 56 198 42 198C19.90861 198 2 180.09139 2 158C2 144 2 130 2 116C2 108 32 108 32 100C32 92 2 92 2 84C2 70 2 56 2 42C2 19.90861 19.90861 2 42 2Z\"/>",
+        anchor: { x: 113.82, y: 102.65, scale: 0.791 },
+    },
 };
 /** Runtime-safe read of an untrusted persisted or streamed body id. */
 export function botMascotBody(value) {

package/dist-server/shared/model-evidence.js

@@ -0,0 +1,25 @@
+export function modelEvidenceMetrics(rows) {
+    const turns = new Set(rows.map(row => row.logicalTurnId));
+    const fallbacks = new Set(rows.filter(row => row.kind === "fallback").map(row => row.logicalTurnId));
+    const calls = new Map();
+    for (const row of rows)
+        if (row.callId && (row.kind === "call" || row.kind === "evidence")) {
+            const key = `${row.attemptId}:${row.callId}`;
+            const old = calls.get(key);
+            if (!old || row.level === "response-reported" || old.level !== "response-reported")
+                calls.set(key, row);
+        }
+    const confirmed = [...calls.values()].filter(row => row.level === "response-reported" && row.reportedModel);
+    const comparable = confirmed.filter(row => row.model);
+    const mismatches = comparable.filter(row => row.model !== row.reportedModel);
+    const counts = {};
+    for (const row of confirmed) {
+        const key = `${row.provider}: ${row.reportedModel}`;
+        counts[key] = (counts[key] ?? 0) + 1;
+    }
+    return { turns: turns.size, observedCalls: calls.size, confirmedCalls: confirmed.length, counts,
+        confirmationCoverage: calls.size ? confirmed.length / calls.size : null,
+        comparableCalls: comparable.length, mismatches: mismatches.length,
+        mismatchRate: comparable.length ? mismatches.length / comparable.length : null,
+        fallbackTurns: fallbacks.size, fallbackFrequency: turns.size ? fallbacks.size / turns.size : null };
+}

package/dist-server/shared/subscription-bots.js

@@ -88,6 +88,9 @@ export function subscriptionProviderForEngine(engine) {
 export function isProviderModel(provider, model) {
     return provider.ownModels ? provider.ownModels.test(model) : true;
 }
+/** Turns one conversation of a company subscription bot may run on another
+ * provider's subscription when its own has no account free (server/session-fallback.ts). */
+export const SESSION_FALLBACK_TURNS = 50;
 export function isSubscriptionBot(bot) {
     const value = bot?.subscription;
     return Boolean(value && typeof value.instanceId === "string" && subscriptionProvider(value.provider));

package/dist-server/shared/vault.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+/** Only absolute HTTPS origins can receive a saved item. Paths never broaden
+ * authority to sibling domains, frames, ports or subdomains. */
+export function vaultOrigin(raw) {
+    if (raw.length > 2048 || [...raw].some((c) => c.charCodeAt(0) <= 32 || c.charCodeAt(0) === 127) || raw.includes("\\"))
+        return null;
+    try {
+        const url = new URL(raw);
+        if (url.protocol !== "https:" || !url.hostname || url.username || url.password || url.hostname.endsWith("."))
+            return null;
+        return url.origin;
+    }
+    catch {
+        return null;
+    }
+}
+const text = (max) => z.string().max(max);
+const origin = z.string().refine((value) => vaultOrigin(value) !== null).transform((value) => vaultOrigin(value));
+const address = z.object({
+    name: text(200), line1: text(300), line2: text(300), city: text(200),
+    region: text(200), postalCode: text(40), country: text(100),
+}).strict();
+const base = {
+    label: z.string().trim().min(1).max(200), hints: text(1000),
+    botIds: z.array(z.string().uuid()).max(100).refine((ids) => new Set(ids).size === ids.length),
+    expiresAt: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
+};
+/** Reject unknown fields rather than accidentally persisting secrets in
+ * metadata. CVC is deliberately absent: it belongs to a single secure use. */
+export const vaultInputSchema = z.discriminatedUnion("kind", [
+    z.object({ ...base, kind: z.literal("login"), website: origin,
+        username: z.string().min(1).max(320), password: z.string().min(1).max(4096),
+    }).strict(),
+    z.object({ ...base, kind: z.literal("card"), origins: z.array(origin).min(1).max(50),
+        number: z.string().regex(/^\d{12,19}$/), expiryMonth: z.number().int().min(1).max(12),
+        expiryYear: z.number().int().min(2000).max(9999), billing: address,
+    }).strict(),
+    z.object({ ...base, kind: z.literal("contact"), origins: z.array(origin).min(1).max(50),
+        address, email: z.union([z.literal(""), z.string().email().max(320)]), phone: text(80),
+    }).strict(),
+]);
+/** Explicit allowlist. Never spread a stored item into a response. */
+export function vaultMetadata(item) {
+    return {
+        id: item.id, kind: item.kind, label: item.label, hints: item.hints,
+        botIds: [...item.botIds], expiresAt: item.expiresAt,
+        origins: item.kind === "login" ? [item.website] : [...item.origins],
+        ...(item.kind === "login" ? { username: item.username } : {}),
+        ...(item.kind === "card" ? { lastFour: item.number.slice(-4), expiryMonth: item.expiryMonth, expiryYear: item.expiryYear, billing: { ...item.billing } } : {}),
+        ...(item.kind === "contact" ? { address: { ...item.address }, email: item.email, phone: item.phone } : {}),
+        createdAt: item.createdAt, updatedAt: item.updatedAt,
+    };
+}
+export function vaultUseAllowed(item, actor, now) {
+    const destination = vaultOrigin(actor.destination);
+    return Number.isSafeInteger(now) && now >= 0 && item.ownerId === actor.ownerId && item.botIds.includes(actor.botId)
+        && (item.expiresAt === null || now < item.expiresAt) && destination !== null
+        && (item.kind === "login" ? item.website === destination : item.origins.includes(destination));
+}