@epam/ai-dial-chat-hooks 1.2.0-dev.213 → 1.2.0-dev.218

package/api-error/api-error.js

@@ -26,20 +26,22 @@ var e = (e) => typeof e == "object" && !!e, t = (t) => {
 	}
 	return e instanceof Error && e.message ? e.message : null;
 }, d = async (t) => {
-	let r = s(t), i = r?.status, a = null, c, l = !1, u;
+	let r = s(t), i = r?.status, a = null, c, l = !1, u, d, f;
 	if (r) try {
 		let t = await (typeof r.clone == "function" ? r.clone() : r).json();
-		a = n(t), e(t) && (u = typeof t.code == "string" ? t.code : void 0, c = o(t.traceparent));
+		a = n(t), e(t) && (u = typeof t.code == "string" ? t.code : void 0, d = typeof t.upstreamCode == "string" ? t.upstreamCode : void 0, f = typeof t.upstreamMessage == "string" ? t.upstreamMessage : void 0, c = o(t.traceparent));
 	} catch {
 		l = !0;
 	}
 	!l && a === null && t instanceof Error && t.message && (a = t.message);
-	let d = c ?? o(typeof r?.headers?.get == "function" ? r.headers.get("traceparent") : void 0);
+	let p = c ?? o(typeof r?.headers?.get == "function" ? r.headers.get("traceparent") : void 0);
 	return {
 		status: i,
 		message: a,
-		traceId: d,
-		...u ? { code: u } : {}
+		traceId: p,
+		...u ? { code: u } : {},
+		...d ? { upstreamCode: d } : {},
+		...f ? { upstreamMessage: f } : {}
 	};
 };
 //#endregion

package/conversation/useConversationPanelItems/useConversationPanelItems.js

@@ -1,34 +1,53 @@
 import { safeDecodeURIComponent as e } from "../../shared/string-utils.js";
-import { findDeploymentByIdOrReference as t } from "../../catalog/deployment-id.js";
-import { getModelIdFromConversationId as n } from "../get-model-id-from-conversation-id.js";
-import { FilterTab as r } from "@epam/ai-dial-chat-shared";
-import { useMemo as i } from "react";
+import { getModelIdFromConversationId as t } from "../get-model-id-from-conversation-id.js";
+import { FilterTab as n } from "@epam/ai-dial-chat-shared";
+import { useEffect as r, useMemo as i, useRef as a } from "react";
 //#region src/conversation/useConversationPanelItems/useConversationPanelItems.ts
-var a = (e) => e.sharedWithMe ? r.Shared : e.publishedWithMe ? r.Organization : r.MyChats, o = ({ items: r, deployments: o, isDeploymentsLoading: s, toPanelConversationId: c, resolveIconUrl: l, resolveIconTooltip: u, resolveHref: d, resolveTaskPresentation: f }) => i(() => r.map((r) => {
-	let i = c(r.id), p = n(r.id), m = p ? t(o, p) : void 0, h = p ? e(p.split("/").pop() ?? p) : "", g = f?.(r);
-	return {
-		id: i,
-		title: r.title,
-		isPinned: r.isPinned ?? !1,
-		iconUrl: l(m),
-		iconTooltip: u(m, h),
-		isIconLoading: s,
-		source: a(r),
-		href: d(i),
-		...g == null ? {} : {
-			leadingIcon: g.leadingIcon,
-			isUnread: g.isUnread
-		}
-	};
-}), [
-	r,
-	o,
-	s,
-	c,
-	l,
-	u,
-	d,
-	f
-]);
+var o = (e) => e.sharedWithMe ? n.Shared : e.publishedWithMe ? n.Organization : n.MyChats, s = (e) => {
+	let t = /* @__PURE__ */ new Map(), n = /* @__PURE__ */ new Map();
+	for (let r of e) t.has(r.id) || t.set(r.id, r), r.reference && !n.has(r.reference) && n.set(r.reference, r);
+	return (e) => t.get(e) ?? n.get(e);
+}, c = ({ items: n, deployments: c, isDeploymentsLoading: l, toPanelConversationId: u, resolveIconUrl: d, resolveIconTooltip: f, resolveHref: p, resolveTaskPresentation: m }) => {
+	let h = i(() => s(c), [c]), g = i(() => (n) => {
+		let r = u(n.id), i = t(n.id), a = i ? h(i) : void 0, s = i ? e(i.split("/").pop() ?? i) : "", c = m?.(n);
+		return {
+			id: r,
+			title: n.title,
+			isPinned: n.isPinned ?? !1,
+			iconUrl: d(a),
+			iconTooltip: f(a, s),
+			isIconLoading: l,
+			source: o(n),
+			href: p(r),
+			...c == null ? {} : {
+				leadingIcon: c.leadingIcon,
+				isUnread: c.isUnread
+			}
+		};
+	}, [
+		h,
+		l,
+		u,
+		d,
+		f,
+		p,
+		m
+	]), _ = a(null), v = i(() => {
+		let e = _.current, t = e?.mapItem === g ? e.byDto : void 0, r = /* @__PURE__ */ new Map();
+		return {
+			mapped: n.map((e) => {
+				let n = t?.get(e) ?? g(e);
+				return r.set(e, n), n;
+			}),
+			cache: {
+				mapItem: g,
+				byDto: r
+			}
+		};
+	}, [n, g]);
+	return r(() => {
+		_.current = v.cache;
+	}, [v]), v.mapped;
+};
 //#endregion
-export { a as getConversationSource, o as useConversationPanelItems };
+export { o as getConversationSource, c as useConversationPanelItems };

package/conversation.d.ts

@@ -1072,6 +1072,11 @@ export declare interface UseConversationLookupMapsParams {
  * Returns a memoised array whose shape is compatible with the conversation
  * panel's item contract. All app-specific concerns (icon URL resolution,
  * route generation, id normalisation) are injected via resolver callbacks.
+ *
+ * While every input except `items` is unchanged, a DTO that is referentially
+ * the same as in the previous render maps to the same item object, so a list
+ * change (or a navigation that re-derives the list) re-renders only the rows
+ * whose DTO actually changed.
  */
 export declare const useConversationPanelItems: ({ items, deployments, isDeploymentsLoading, toPanelConversationId, resolveIconUrl, resolveIconTooltip, resolveHref, resolveTaskPresentation, }: UseConversationPanelItemsParams) => {
     leadingIcon?: ReactNode;

package/file-manager-canvas.d.ts

@@ -127,10 +127,14 @@ export declare const hasAttachmentTextSource: (attachment: DisplayAttachment, re
 declare interface HtmlCanvasContent {
     /** Discriminates the content type to select the correct renderer. */
     type: AttachmentContentType.Html;
-    /** Full HTML text rendered via `srcdoc` in a sandboxed iframe. Used for file attachments. */
+    /** Full HTML text rendered via `srcdoc` in a sandboxed iframe. Populated only when no `url` is available (local, non-downloadable file attachments); when `url` is set, "View source" instead calls `resolveSourceText`. */
     srcdoc?: string;
-    /** External URL rendered via `src` in a sandboxed iframe. Used for external link sources. */
+    /** URL rendered via `src` in a sandboxed iframe when `srcdoc` is absent, or in preference to `srcdoc` when `isSameOriginUrl` is set. Also used as the download-button/"Open in new tab" target. */
     url?: string;
+    /** True when `url`'s origin matches the embedding document's own origin. Forces the iframe sandbox to omit `allow-same-origin` — granting it would let a same-origin framed document reach this page's own cookies/storage — and makes `src` take precedence over `srcdoc`; also skips the `contentDocument` block-detection check, since the iframe is intentionally opaque-origin either way. */
+    isSameOriginUrl?: boolean;
+    /** Lazily fetches the full HTML source text for the "View source" toggle. Used instead of an eagerly-populated `srcdoc` when `url` is set; absent when `srcdoc` is already populated. */
+    resolveSourceText?: () => Promise<string>;
 }
 
 /** Content payload for image attachments. */
@@ -330,9 +334,16 @@ export declare const resolveGroupedVisualizerCanvasContent: (attachments: Displa
 
 /**
  * Resolves an HTML canvas content payload from a DisplayAttachment.
- * Fetches and inlines the HTML as `srcdoc` when the attachment has a download URL or inline data.
- * Returns `null` if no source is available, or an `ErrorCanvasContent` on fetch failure.
- * Rejects `srcdoc` payloads larger than 1 MiB to prevent browser truncation.
+ * When the attachment has a download URL, that URL is the primary render
+ * target so the preview loads via `src` and gets its own response-level CSP
+ * instead of inheriting the host document's — no HTML text is fetched up
+ * front; `resolveSourceText` fetches it lazily, only when the "View source"
+ * toggle is used, and rejects if that fetch fails. `isSameOriginUrl` reflects
+ * a real comparison against the embedding document's own origin.
+ * With no download URL (local file or inline data), falls back to `srcdoc`
+ * only, rejecting payloads larger than 1 MiB to prevent browser truncation.
+ * Returns `null` if no source is available, or an `ErrorCanvasContent` when
+ * that fallback fetch fails.
  */
 export declare const resolveHtmlCanvasContent: (attachment: DisplayAttachment, resolvers: AttachmentCanvasUrlResolvers) => Promise<HtmlCanvasContent | ErrorCanvasContent | null>;
 

package/files/attachment-canvas.js

@@ -124,18 +124,30 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 		text: i,
 		language: r
 	} : i;
-}, I = async (e, n) => {
-	let r = await k(e, n);
-	if (r == null) return null;
-	if (typeof r != "string") return r;
-	if (r.length > P) return null;
-	let i = n.resolveDialUrl(e) ?? void 0;
-	return {
+}, I = (e) => {
+	try {
+		return new URL(e, window.location.href).origin;
+	} catch {
+		return;
+	}
+}, L = async (e, n) => {
+	let r = n.resolveDialUrl(e) ?? void 0;
+	if (r != null) return {
 		type: t.Html,
-		srcdoc: r,
-		url: i
+		url: r,
+		isSameOriginUrl: I(r) === I(window.location.href),
+		resolveSourceText: async () => {
+			let t = await k(e, n);
+			if (t == null || typeof t != "string") throw Error("Failed to resolve HTML source text");
+			return t;
+		}
 	};
-}, L = (n, r, i) => {
+	let i = await k(e, n);
+	return i == null ? null : typeof i == "string" ? i.length > P ? null : {
+		type: t.Html,
+		srcdoc: i
+	} : i;
+}, R = (n, r, i) => {
 	let a = n.body?.source?.attachment;
 	if (a?.type !== o.PDF) return null;
 	let s = e(a.url) ? i.resolveDialFileDownloadUrl(a.url) : a.url;
@@ -148,7 +160,7 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 		selectedHighlightId: f.some((e) => e.id === m) ? m : void 0,
 		page: p(n)
 	};
-}, R = (e) => {
+}, z = (e) => {
 	switch (e.type) {
 		case "docx_text_anchor": return {
 			kind: i.DocxTableRow,
@@ -184,7 +196,7 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 			end: e.end
 		};
 	}
-}, z = (n, i, o) => {
+}, B = (n, i, o) => {
 	let s = n.body?.source?.attachment;
 	if (s?.url == null) return null;
 	let c = a(s.title ?? s.url, s.type);
@@ -198,7 +210,7 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 		let i = l(e, t);
 		m.push({
 			id: i,
-			locations: r.map(R)
+			locations: r.map(z)
 		}), e === n && (h = i);
 	}), {
 		type: t.Ooxml,
@@ -209,7 +221,7 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 			selectedHighlightId: h
 		} : {}
 	};
-}, B = (n, r) => {
+}, V = (n, r) => {
 	let i = m(n.url);
 	if (i == null) return null;
 	let a = e(i.baseUrl) ? r.resolveDialFileDownloadUrl(i.baseUrl) : i.baseUrl;
@@ -239,38 +251,38 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 		selectedHighlightId: o,
 		page: i.page
 	};
-}, V = (e) => {
+}, H = (e) => {
 	try {
 		let t = new URL(e).protocol;
 		return t === "http:" || t === "https:" || t === "blob:";
 	} catch {
 		return !1;
 	}
-}, H = (t) => t.url != null && !e(t.url) && V(t.url) ? t.url : void 0, U = async (e, n) => {
+}, U = (t) => t.url != null && !e(t.url) && H(t.url) ? t.url : void 0, W = async (e, n) => {
 	let r = await O(e, n);
 	if (r != null) return typeof r == "string" ? {
 		type: t.Pdf,
 		url: r
 	} : r;
-	let i = H(e);
+	let i = U(e);
 	return i == null ? null : {
 		type: t.Pdf,
 		url: i
 	};
-}, W = async (e, n, r) => {
+}, G = async (e, n, r) => {
 	let i = await O(e, n);
 	if (i != null) return typeof i == "string" ? {
 		type: t.Ooxml,
 		url: i,
 		format: r
 	} : i;
-	let a = H(e);
+	let a = U(e);
 	return a == null ? null : {
 		type: t.Ooxml,
 		url: a,
 		format: r
 	};
-}, G = async (e, n) => {
+}, K = async (e, n) => {
 	let r = await k(e, n);
 	if (r == null) return null;
 	if (typeof r != "string") return r;
@@ -286,7 +298,7 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 			text: r
 		};
 	}
-}, K = async (e, n, r, i) => {
+}, q = async (e, n, r, i) => {
 	let a = await k(e, n);
 	if (a == null || typeof a != "string") return null;
 	let o = {};
@@ -308,7 +320,7 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 		visualizerName: r.title,
 		requestTimeout: r.requestTimeout
 	};
-}, q = (e, n, r, i) => {
+}, J = (e, n, r, i) => {
 	let a = {
 		width: r.width,
 		height: r.height,
@@ -338,4 +350,4 @@ var g = (e, t) => URL.createObjectURL(s(e, t)), _ = (e) => {
 	};
 };
 //#endregion
-export { z as annotationToOoxmlCanvasContent, L as annotationToPdfCanvasContent, S as clearAttachmentCache, A as hasAttachmentTextSource, B as referenceAttachmentToPdfCanvasContent, F as resolveCodeCanvasContent, q as resolveGroupedVisualizerCanvasContent, I as resolveHtmlCanvasContent, j as resolveImageCanvasContent, G as resolveJsonCanvasContent, N as resolveMarkdownCanvasContent, W as resolveOoxmlCanvasContent, U as resolvePdfCanvasContent, M as resolveTextCanvasContent, K as resolveVisualizerCanvasContent };
+export { B as annotationToOoxmlCanvasContent, R as annotationToPdfCanvasContent, S as clearAttachmentCache, A as hasAttachmentTextSource, V as referenceAttachmentToPdfCanvasContent, F as resolveCodeCanvasContent, J as resolveGroupedVisualizerCanvasContent, L as resolveHtmlCanvasContent, j as resolveImageCanvasContent, K as resolveJsonCanvasContent, N as resolveMarkdownCanvasContent, G as resolveOoxmlCanvasContent, W as resolvePdfCanvasContent, M as resolveTextCanvasContent, q as resolveVisualizerCanvasContent };

package/files/useDialFileListing/useDialFileListing.js

@@ -15,22 +15,22 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 	}, [T]);
 	let [O, k] = p(() => /* @__PURE__ */ new Map()), [se, A] = p(S), [ce, le] = p(S);
 	ce !== S && (le(S), A(S));
-	let [ue, j] = p(null), [M, de] = p(0), [N, P] = p(void 0), [fe, F] = p(() => /* @__PURE__ */ new Set()), I = f(/* @__PURE__ */ new Map()), [pe, L] = p(!1), [me, R] = p(null), z = f(null), B = f(null), V = f(/* @__PURE__ */ new Set()), H = f(/* @__PURE__ */ new Set()), [U, W] = p(() => /* @__PURE__ */ new Set()), [he, G] = p(() => /* @__PURE__ */ new Set()), [K, q] = p(() => /* @__PURE__ */ new Set()), J = `${b}|${oe ?? ""}`, Y = f(J);
+	let [ue, j] = p(null), [M, N] = p(0), [P, F] = p(void 0), [de, I] = p(() => /* @__PURE__ */ new Set()), L = f(/* @__PURE__ */ new Map()), [fe, R] = p(!1), [pe, z] = p(null), B = f(null), V = f(null), H = f(/* @__PURE__ */ new Set()), U = f(/* @__PURE__ */ new Set()), [W, G] = p(() => /* @__PURE__ */ new Set()), [me, K] = p(() => /* @__PURE__ */ new Set()), [q, J] = p(() => /* @__PURE__ */ new Set()), Y = `${b}|${oe ?? ""}`, X = f(Y);
 	u(() => {
-		Y.current !== J && (Y.current = J, E(/* @__PURE__ */ new Map()), k(/* @__PURE__ */ new Map()), w(""), P(void 0), I.current = /* @__PURE__ */ new Map(), V.current = /* @__PURE__ */ new Set(), H.current = /* @__PURE__ */ new Set(), G(/* @__PURE__ */ new Set()), q(/* @__PURE__ */ new Set()), z.current != null && (clearTimeout(z.current), z.current = null), B.current?.(), B.current = null, R(null), L(!1), W(/* @__PURE__ */ new Set()));
-	}, [J]), u(() => () => {
-		z.current != null && clearTimeout(z.current), B.current?.();
+		X.current !== Y && (X.current = Y, E(/* @__PURE__ */ new Map()), k(/* @__PURE__ */ new Map()), w(""), F(void 0), L.current = /* @__PURE__ */ new Map(), H.current = /* @__PURE__ */ new Set(), U.current = /* @__PURE__ */ new Set(), K(/* @__PURE__ */ new Set()), J(/* @__PURE__ */ new Set()), B.current != null && (clearTimeout(B.current), B.current = null), V.current?.(), V.current = null, z(null), R(!1), G(/* @__PURE__ */ new Set()), N((e) => e + 1));
+	}, [Y]), u(() => () => {
+		B.current != null && clearTimeout(B.current), V.current?.();
 	}, []), u(() => {
 		if (!S) {
 			A(!1);
 			return;
 		}
 		let t = !1;
-		return A(!0), j(null), s(_, b, v, C, I.current).then(({ items: e, permissions: i }) => {
+		return A(!0), j(null), s(_, b, v, C, L.current).then(({ items: e, permissions: i }) => {
 			t || (E((t) => {
 				let n = new Map(t);
 				return n.set(C, e), n;
-			}), k((e) => new Map(e).set(C, i)), b === g.Shared && C === "" && (P(e.map((e) => n(r(e.path, e.bucket ?? ""), y, e.nodeType === m.Folder))), I.current = new Map(e.map((e) => [e.name, {
+			}), k((e) => new Map(e).set(C, i)), b === g.Shared && C === "" && (F(e.map((e) => n(r(e.path, e.bucket ?? ""), y, e.nodeType === m.Folder))), L.current = new Map(e.map((e) => [e.name, {
 				bucket: e.bucket ?? "",
 				dialCorePath: e.path
 			}]))));
@@ -57,14 +57,14 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 		y
 	]), u(() => {
 		if (!S || b !== g.MyFiles) {
-			F(/* @__PURE__ */ new Set());
+			I(/* @__PURE__ */ new Set());
 			return;
 		}
 		let e = !1;
 		return _.listSharedByMe(v).then((t) => {
-			e || F(new Set(t.items.map((e) => n(r(e.path, v), y, e.nodeType === m.Folder))));
+			e || I(new Set(t.items.map((e) => n(r(e.path, v), y, e.nodeType === m.Folder))));
 		}).catch(() => {
-			e || F(/* @__PURE__ */ new Set());
+			e || I(/* @__PURE__ */ new Set());
 		}), () => {
 			e = !0;
 		};
@@ -76,7 +76,7 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 		M,
 		y
 	]);
-	let X = d(() => [{
+	let Z = d(() => [{
 		id: v,
 		name: y,
 		path: `/${y}`,
@@ -90,7 +90,7 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 		O,
 		y,
 		v
-	]), ge = l((e) => {
+	]), he = l((e) => {
 		if (e == null) {
 			w("");
 			return;
@@ -108,11 +108,11 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 			r = t.startsWith(n) ? t.slice(n.length) : t;
 		}
 		w(r && !r.endsWith("/") ? `${r}/` : r);
-	}, [y]), Z = l(() => {
-		de((e) => e + 1);
-	}, []), _e = Z, ve = l((e) => {
+	}, [y]), Q = l(() => {
+		N((e) => e + 1);
+	}, []), ge = Q, _e = l((e) => {
 		if (e.length === 0) return;
-		let n = new Set([...U].map((e) => o(e, y))), r = (e) => e === C || C.startsWith(e) || n.has(e), i = e.filter((e) => !r(e)), a = e.filter((e) => r(e) && e !== C);
+		let n = new Set([...W].map((e) => o(e, y))), r = (e) => e === C || C.startsWith(e) || n.has(e), i = e.filter((e) => !r(e)), a = e.filter((e) => r(e) && e !== C);
 		i.length > 0 && (E((e) => {
 			let t = new Map(e);
 			return i.forEach((e) => t.delete(e)), t;
@@ -122,7 +122,7 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 		})), a.forEach((e) => {
 			(async () => {
 				try {
-					let { items: t, permissions: n } = await s(_, b, v, e, I.current);
+					let { items: t, permissions: n } = await s(_, b, v, e, L.current);
 					E((n) => new Map(n).set(e, t)), n != null && k((t) => new Map(t).set(e, n));
 				} catch {
 					x?.({
@@ -137,40 +137,40 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 		v,
 		_,
 		C,
-		U,
+		W,
 		y,
 		x
-	]), Q = l((e, t, n) => {
+	]), ve = l((e, t, n) => {
 		E((r) => ie(r, e, t, n));
 	}, []), ye = l((e) => {
 		if (!S) return;
 		let n = e == null ? "" : o(e, y), r = e ?? `/${y}`;
-		if (q((e) => {
+		if (J((e) => {
 			if (e.has(r)) return e;
 			let t = new Set(e);
 			return t.add(r), t;
 		}), !D.current.has(n)) {
-			if (V.current.has(n)) {
-				G((e) => {
+			if (H.current.has(n)) {
+				K((e) => {
 					let t = new Set(e);
 					return t.add(r), t;
 				});
 				return;
 			}
-			V.current.add(n), G((e) => {
+			H.current.add(n), K((e) => {
 				let t = new Set(e);
 				return t.add(r), t;
 			}), (async () => {
 				try {
-					let { items: e, permissions: t } = await s(_, b, v, n, I.current);
-					E((t) => new Map(t).set(n, e)), t != null && k((e) => new Map(e).set(n, t)), H.current.delete(n);
+					let { items: e, permissions: t } = await s(_, b, v, n, L.current);
+					E((t) => new Map(t).set(n, e)), t != null && k((e) => new Map(e).set(n, t)), U.current.delete(n);
 				} catch {
 					x?.({
 						variant: h.Error,
 						reason: t.FolderLoadFailed
 					});
 				} finally {
-					V.current.delete(n), G((e) => {
+					H.current.delete(n), K((e) => {
 						let t = new Set(e);
 						return t.delete(r), t;
 					});
@@ -185,36 +185,36 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 		x,
 		y
 	]), be = d(() => {
-		let e = /* @__PURE__ */ new Set(), t = new Set([...U, ...K]);
+		let e = /* @__PURE__ */ new Set(), t = new Set([...W, ...q]);
 		for (let n of t) {
 			let t = o(n, y);
 			T.has(t) && e.add(n);
 		}
 		return e;
 	}, [
-		U,
-		K,
+		W,
+		q,
 		T,
 		y
 	]), xe = l((e) => {
-		S && (U.forEach((t) => {
-			e.has(t) || H.current.delete(o(t, y));
-		}), W(e), [...e].filter((e) => {
+		S && (W.forEach((t) => {
+			e.has(t) || U.current.delete(o(t, y));
+		}), G(e), [...e].filter((e) => {
 			let t = o(e, y);
-			return !D.current.has(t) && !V.current.has(t) && !H.current.has(t);
+			return !D.current.has(t) && !H.current.has(t) && !U.current.has(t);
 		}).forEach((e) => {
 			let n = o(e, y);
-			V.current.add(n), (async () => {
+			H.current.add(n), (async () => {
 				try {
-					let { items: e, permissions: t } = await s(_, b, v, n, I.current);
+					let { items: e, permissions: t } = await s(_, b, v, n, L.current);
 					E((t) => new Map(t).set(n, e)), t != null && k((e) => new Map(e).set(n, t));
 				} catch {
-					H.current.add(n), x?.({
+					U.current.add(n), x?.({
 						variant: h.Error,
 						reason: t.FolderLoadFailed
 					});
 				} finally {
-					V.current.delete(n), G((t) => {
+					H.current.delete(n), K((t) => {
 						let n = new Set(t);
 						return n.delete(e), n;
 					});
@@ -225,35 +225,35 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 		b,
 		v,
 		_,
-		U,
+		W,
 		S,
 		x,
 		y
 	]), Se = l(() => {
-		z.current != null && (clearTimeout(z.current), z.current = null), B.current?.(), B.current = null, R(null), L(!1);
+		B.current != null && (clearTimeout(B.current), B.current = null), V.current?.(), V.current = null, z(null), R(!1);
 	}, []), Ce = l((e, t) => {
 		if (S) {
-			if (z.current != null && (clearTimeout(z.current), z.current = null), B.current?.(), B.current = null, !t.trim()) {
-				R(null), L(!1);
+			if (B.current != null && (clearTimeout(B.current), B.current = null), V.current?.(), V.current = null, !t.trim()) {
+				z(null), R(!1);
 				return;
 			}
-			z.current = setTimeout(() => {
-				if (z.current = null, b === g.Shared && C === "") {
-					B.current?.(), B.current = null, L(!0), R((T.get("") ?? []).map((e) => c(e, e.bucket ?? v, y))), L(!1);
+			B.current = setTimeout(() => {
+				if (B.current = null, b === g.Shared && C === "") {
+					V.current?.(), V.current = null, R(!0), z((T.get("") ?? []).map((e) => c(e, e.bucket ?? v, y))), R(!1);
 					return;
 				}
 				let e = !1;
-				B.current = () => {
+				V.current = () => {
 					e = !0;
-				}, L(!0), (async () => {
+				}, R(!0), (async () => {
 					try {
-						let { items: t } = await ne(_, b, v, C, I.current);
+						let { items: t } = await ne(_, b, v, C, L.current);
 						if (e) return;
-						R(t.map((e) => c(e, e.bucket ?? v, y)));
+						z(t.map((e) => c(e, e.bucket ?? v, y)));
 					} catch {
-						e || R([]);
+						e || z([]);
 					} finally {
-						e || L(!1);
+						e || R(!1);
 					}
 				})();
 			}, 300);
@@ -267,40 +267,40 @@ var _ = ({ filesApi: _, bucket: v, rootLabel: y, activeTab: b, onNotification: x
 		S,
 		y
 	]), $ = C ? `/${y}/${C}` : `/${y}`, we = d(() => {
-		let e = X[0];
+		let e = Z[0];
 		if (e) return a($) === a(`/${y}`) ? e : i(e.items ?? [], $);
 	}, [
-		X,
+		Z,
 		$,
 		y
 	]);
 	return {
-		items: X,
+		items: Z,
 		isLoading: se,
 		error: ue,
 		path: $,
 		folderPath: C,
-		onPathChange: ge,
-		retry: Z,
+		onPathChange: he,
+		retry: Q,
 		onSearchFiles: Ce,
-		isSearching: pe,
-		searchResults: me,
+		isSearching: fe,
+		searchResults: pe,
 		clearSearchResults: Se,
-		expandedPaths: U,
+		expandedPaths: W,
 		loadedPaths: be,
 		onExpandedPathsChange: xe,
 		onFolderPopupPathChange: ye,
-		folderPopupLoadingPaths: he,
-		sharedWithMeIds: d(() => b === g.Shared ? N : void 0, [b, N]),
-		sharedByMePaths: fe,
+		folderPopupLoadingPaths: me,
+		sharedWithMeIds: d(() => b === g.Shared ? P : void 0, [b, P]),
+		sharedByMePaths: de,
 		currentFolder: we,
 		cache: T,
 		listingPermissionsCache: O,
-		sharedRootMetaRef: I,
+		sharedRootMetaRef: L,
 		setFolderPath: w,
-		invalidateFolders: ve,
-		mergeCreatedFolder: Q,
-		bumpRetry: _e
+		invalidateFolders: _e,
+		mergeCreatedFolder: ve,
+		bumpRetry: ge
 	};
 };
 //#endregion

package/index.d.ts

@@ -266,6 +266,16 @@ export declare interface ApiErrorDetails {
     message: string | null;
     /** Extracted W3C trace ID, when the error's response carries a valid `traceparent`. */
     traceId?: string;
+    /**
+     * Error code reported by the service behind the API, when the API forwards one
+     * (`upstreamCode`). Passed through as-is; the host decides whether to act on it.
+     */
+    upstreamCode?: string;
+    /**
+     * Error reason reported by the service behind the API, when the API forwards one
+     * (`upstreamMessage`). Untranslated; the host decides whether to display it.
+     */
+    upstreamMessage?: string;
 }
 
 /** Appends a locale's uppercased code to a field label, e.g. `'Name [EN]'`. */
@@ -1788,7 +1798,7 @@ export declare class GenerationPersistenceError extends Error {
     constructor();
 }
 
-/** Normalizes any API error into a `{ status?, message, traceId?, code? }` shape. */
+/** Normalizes any API error into a `{ status?, message, traceId?, code?, upstreamCode?, upstreamMessage? }` shape. */
 export declare const getApiErrorDetails: (error: unknown) => Promise<ApiErrorDetails>;
 
 /** Resolves a human-readable message from an API error's response body, or falls back to `Error.message`. */
@@ -2072,10 +2082,14 @@ export declare const hasStructuredAnnouncement: ({ title, description, }: Announ
 declare interface HtmlCanvasContent {
     /** Discriminates the content type to select the correct renderer. */
     type: AttachmentContentType.Html;
-    /** Full HTML text rendered via `srcdoc` in a sandboxed iframe. Used for file attachments. */
+    /** Full HTML text rendered via `srcdoc` in a sandboxed iframe. Populated only when no `url` is available (local, non-downloadable file attachments); when `url` is set, "View source" instead calls `resolveSourceText`. */
     srcdoc?: string;
-    /** External URL rendered via `src` in a sandboxed iframe. Used for external link sources. */
+    /** URL rendered via `src` in a sandboxed iframe when `srcdoc` is absent, or in preference to `srcdoc` when `isSameOriginUrl` is set. Also used as the download-button/"Open in new tab" target. */
     url?: string;
+    /** True when `url`'s origin matches the embedding document's own origin. Forces the iframe sandbox to omit `allow-same-origin` — granting it would let a same-origin framed document reach this page's own cookies/storage — and makes `src` take precedence over `srcdoc`; also skips the `contentDocument` block-detection check, since the iframe is intentionally opaque-origin either way. */
+    isSameOriginUrl?: boolean;
+    /** Lazily fetches the full HTML source text for the "View source" toggle. Used instead of an eagerly-populated `srcdoc` when `url` is set; absent when `srcdoc` is already populated. */
+    resolveSourceText?: () => Promise<string>;
 }
 
 /** Content payload for image attachments. */
@@ -3407,9 +3421,16 @@ export declare const resolveGroupedVisualizerCanvasContent: (attachments: Displa
 
 /**
  * Resolves an HTML canvas content payload from a DisplayAttachment.
- * Fetches and inlines the HTML as `srcdoc` when the attachment has a download URL or inline data.
- * Returns `null` if no source is available, or an `ErrorCanvasContent` on fetch failure.
- * Rejects `srcdoc` payloads larger than 1 MiB to prevent browser truncation.
+ * When the attachment has a download URL, that URL is the primary render
+ * target so the preview loads via `src` and gets its own response-level CSP
+ * instead of inheriting the host document's — no HTML text is fetched up
+ * front; `resolveSourceText` fetches it lazily, only when the "View source"
+ * toggle is used, and rejects if that fetch fails. `isSameOriginUrl` reflects
+ * a real comparison against the embedding document's own origin.
+ * With no download URL (local file or inline data), falls back to `srcdoc`
+ * only, rejecting payloads larger than 1 MiB to prevent browser truncation.
+ * Returns `null` if no source is available, or an `ErrorCanvasContent` when
+ * that fallback fetch fails.
  */
 export declare const resolveHtmlCanvasContent: (attachment: DisplayAttachment, resolvers: AttachmentCanvasUrlResolvers) => Promise<HtmlCanvasContent | ErrorCanvasContent | null>;
 
@@ -5077,6 +5098,11 @@ export declare interface UseConversationLookupMapsParams {
  * Returns a memoised array whose shape is compatible with the conversation
  * panel's item contract. All app-specific concerns (icon URL resolution,
  * route generation, id normalisation) are injected via resolver callbacks.
+ *
+ * While every input except `items` is unchanged, a DTO that is referentially
+ * the same as in the previous render maps to the same item object, so a list
+ * change (or a navigation that re-derives the list) re-renders only the rows
+ * whose DTO actually changed.
  */
 export declare const useConversationPanelItems: ({ items, deployments, isDeploymentsLoading, toPanelConversationId, resolveIconUrl, resolveIconTooltip, resolveHref, resolveTaskPresentation, }: UseConversationPanelItemsParams) => {
     leadingIcon?: ReactNode;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@epam/ai-dial-chat-hooks",
   "description": "Framework-level React hooks extracted from AI DIAL Chat for building custom chat interfaces",
-  "version": "1.2.0-dev.213",
+  "version": "1.2.0-dev.218",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./index.js",
@@ -111,7 +111,7 @@
     }
   },
   "dependencies": {
-    "@epam/ai-dial-chat-api-client": "1.2.0-dev.213",
+    "@epam/ai-dial-chat-api-client": "1.2.0-dev.218",
     "dompurify": "3.4.15",
     "fflate": "^0.8.3",
     "lru-cache": "^10.4.3",
@@ -120,21 +120,21 @@
   },
   "peerDependencies": {
     "react": "^19.2.8",
-    "@epam/ai-dial-attachment-canvas": "1.2.0-dev.213",
-    "@epam/ai-dial-attachment-input": "1.2.0-dev.213",
-    "@epam/ai-dial-catalog": "1.2.0-dev.213",
-    "@epam/ai-dial-chat-overlay": "1.2.0-dev.213",
-    "@epam/ai-dial-chat-shared": "1.2.0-dev.213",
-    "@epam/ai-dial-mcp-apps": "1.2.0-dev.213",
-    "@epam/ai-dial-publish-panel": "1.2.0-dev.213",
-    "@epam/ai-dial-quotations": "1.2.0-dev.213",
+    "@epam/ai-dial-attachment-canvas": "1.2.0-dev.218",
+    "@epam/ai-dial-attachment-input": "1.2.0-dev.218",
+    "@epam/ai-dial-catalog": "1.2.0-dev.218",
+    "@epam/ai-dial-chat-overlay": "1.2.0-dev.218",
+    "@epam/ai-dial-chat-shared": "1.2.0-dev.218",
+    "@epam/ai-dial-mcp-apps": "1.2.0-dev.218",
+    "@epam/ai-dial-publish-panel": "1.2.0-dev.218",
+    "@epam/ai-dial-quotations": "1.2.0-dev.218",
     "@epam/ai-dial-react-file-manager": "^0.3.0-dev.19",
-    "@epam/ai-dial-scheduled-tasks": "1.2.0-dev.213",
-    "@epam/ai-dial-share": "1.2.0-dev.213",
-    "@epam/ai-dial-skill-editor": "1.2.0-dev.213",
-    "@epam/ai-dial-source-panel": "1.2.0-dev.213",
+    "@epam/ai-dial-scheduled-tasks": "1.2.0-dev.218",
+    "@epam/ai-dial-share": "1.2.0-dev.218",
+    "@epam/ai-dial-skill-editor": "1.2.0-dev.218",
+    "@epam/ai-dial-source-panel": "1.2.0-dev.218",
     "@epam/ai-dial-ui-kit": "^0.15.0-dev.27",
-    "@epam/ai-dial-usage-dashboard": "1.2.0-dev.213",
+    "@epam/ai-dial-usage-dashboard": "1.2.0-dev.218",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@epam/pdf-highlighter-kit": "^0.0.19",
     "@mcp-ui/client": "^7.1.1"

package/utils.d.ts

@@ -18,6 +18,16 @@ export declare interface ApiErrorDetails {
     message: string | null;
     /** Extracted W3C trace ID, when the error's response carries a valid `traceparent`. */
     traceId?: string;
+    /**
+     * Error code reported by the service behind the API, when the API forwards one
+     * (`upstreamCode`). Passed through as-is; the host decides whether to act on it.
+     */
+    upstreamCode?: string;
+    /**
+     * Error reason reported by the service behind the API, when the API forwards one
+     * (`upstreamMessage`). Untranslated; the host decides whether to display it.
+     */
+    upstreamMessage?: string;
 }
 
 /** Appends a locale's uppercased code to a field label, e.g. `'Name [EN]'`. */
@@ -134,7 +144,7 @@ export declare interface ExportedPrompt {
 /** Formats a Unix timestamp (ms) as a locale-formatted calendar date, e.g. `'22/7/2026'`. */
 export declare const formatCalendarDate: (timestampMs: number) => string;
 
-/** Normalizes any API error into a `{ status?, message, traceId?, code? }` shape. */
+/** Normalizes any API error into a `{ status?, message, traceId?, code?, upstreamCode?, upstreamMessage? }` shape. */
 export declare const getApiErrorDetails: (error: unknown) => Promise<ApiErrorDetails>;
 
 /** Resolves a human-readable message from an API error's response body, or falls back to `Error.message`. */