@eshal-bot/chat-widget 0.2.28 → 0.2.30

package/dist/chat-widget-markdown-chunk.js

@@ -88504,54 +88504,219 @@
   }
 
   /**
-   * Strip internal DB identifiers from an LLM-generated chart/card title before
-   * it's shown to the user (EV pie-chart bug, issue 1). Mirror of the frontend +
-   * agent-sdk helpers - the widget is a separate package.
+   * EV-2850 (WAPT) - the agent's `eshal-ui`/`eshal-chart` fence output can be
+   * influenced by the end user's own message or by prompt-injection planted in
+   * a knowledge-base document. A2uiBlock renders `href`/`src` values straight
+   * from that JSON with no filtering - a `javascript:` action URL renders as a
+   * legitimate-looking button that executes attacker JS in the visitor's page
+   * when clicked (an authenticated victim's session cookie, DOM, etc. are all
+   * in scope; no account needed to trigger it).
    *
-   * The database_query sub-agent writes `title` freeform and sometimes appends how
-   * the value was computed - e.g. "…by department (summed from the employees.salary
-   * field)". The prompt now forbids this; this is the deterministic guarantee a
-   * table/column name never reaches the user.
+   * Every `href`/`src` sink in A2uiBlock must go through this first. Only
+   * absolute http(s) URLs pass; anything else (javascript:, data:, vbscript:,
+   * a bare relative path, non-string) is dropped rather than rendered.
+   *
+   * EV-3956 / EV-4798 MERN-19: this is the ONE implementation. The agent-sdk,
+   * widget and frontend renderers all import this file (the published SDK and
+   * widget bundle it at build time, so their consumers never resolve
+   * @eshal/shared). A fix made here reaches all three surfaces. Do not re-inline.
+   *
+   * Plain JavaScript on purpose: the widget's Rollup/Babel build compiles no
+   * TypeScript from another package. Types live in safeUrl.d.ts.
+   */
+  function safeUrl(u) {
+    return typeof u === 'string' && /^https?:\/\//i.test(u) ? u : undefined;
+  }
+
+  /**
+   * Framework-free A2UI core shared by the three A2uiBlock renderers - the
+   * agent-sdk, the widget and the frontend Testing Lab (EV-4798 MERN-19).
+   *
+   * It owns what the renderers must agree on and that is not presentation:
+   *   - the component registry: which `type` values route to a chart and which
+   *     to a component, and how a type string is normalised;
+   *   - sanitizeChartTitle: no DB/SQL annotation reaches a visible title;
+   *   - toolConfirmationFor: the structured answer of an approval card;
+   *   - linkSegments: which spans of card text become links (every href passes
+   *     safeUrl, so a `javascript:` link stays plain text);
+   *   - matchAnsweredChoice / findNextUserAnswer: the answered state of a
+   *     one-shot card, read from conversation history.
+   *
+   * Each renderer keeps its own components and styling (inline SVG in the SDK,
+   * lucide + inline styles in the widget, Tailwind + shadcn in the frontend).
    *
-   * Conservative: only strips a TRAILING parenthetical, and only when it reads as
-   * a DB/SQL annotation (mentions field/column/table/sum/SQL, or contains a
-   * `table.column` dotted identifier). A legit "(2024)"/"(YoY)" is kept.
+   * Plain JavaScript (types in a2ui.d.ts) because the widget's Rollup/Babel
+   * build compiles no TypeScript from another package; conservative syntax
+   * (no `??`, no `?.`) because that build does not run this file through its
+   * Babel preset either.
    */
+
+  // ── Component registry ─────────────────────────────────────────────────
+
+  /** Chart-family types the dispatchers route into their chart renderer. */
+  const A2UI_CHART_TYPES = Object.freeze(['bar', 'line', 'area', 'pie', 'donut', 'scatter', 'bubble', 'radar', 'radial-bar', 'radial',
+  // alias for radial-bar
+  'radialbar',
+  // alias for radial-bar
+  'treemap', 'funnel', 'sankey', 'composed', 'waterfall', 'gauge', 'histogram', 'kpi']);
+
+  /**
+   * Routing form of a spec's `type`: trimmed, lowercase, underscore to kebab,
+   * so "Bar", " Donut " and `key_observations` all route.
+   */
+  function normalizeA2uiType(type) {
+    return String(type || '').trim().toLowerCase().replace(/_/g, '-');
+  }
+
+  // ── Titles ─────────────────────────────────────────────────────────────
+
   const SQLISH = /\b(?:field|fields|column|columns|table|tables|sql|summed?|aggregat\w*|averaged?|counted)\b/i;
+  // A dotted identifier like `employees.salary` (table.column).
   const DOTTED = /[A-Za-z_]\w*\.[A-Za-z_]\w*/;
+
+  /**
+   * Strip internal DB identifiers from an LLM-generated chart/card title (EV
+   * pie-chart bug, issue 1). The database_query sub-agent sometimes appends how
+   * a value was computed - "... by department (summed from the employees.salary
+   * field)". The prompt forbids this; this is the deterministic guarantee a
+   * table/column name never reaches the user.
+   *
+   * Conservative: only a TRAILING parenthetical that reads as a DB/SQL
+   * annotation is removed (repeatedly, in case several are stacked). A
+   * legitimate "(2024)" or "(YoY)" is kept.
+   */
   function sanitizeChartTitle(title) {
     if (typeof title !== 'string') return '';
     let t = title.trim();
     let prev;
     do {
       prev = t;
-      t = t.replace(/\s*\(([^()]*)\)\s*$/, (match, inner) => SQLISH.test(inner) || DOTTED.test(inner) ? '' : match).trim();
+      t = t.replace(/\s*\(([^()]*)\)\s*$/, function (match, inner) {
+        return SQLISH.test(inner) || DOTTED.test(inner) ? '' : match;
+      }).trim();
     } while (t !== prev);
     return t;
   }
 
+  // ── Approval cards (EV-4798 MERN-12) ───────────────────────────────────
+
+  const APPROVE_VALUES = new Set(['yes', 'approve', 'approved', 'confirm']);
+  const DECLINE_VALUES = new Set(['no', 'decline', 'declined', 'cancel']);
+  const ID_PATTERN = /^[A-Za-z0-9_.:-]{1,128}$/;
+  function cleanId(value) {
+    if (typeof value !== 'string') return null;
+    const id = value.trim();
+    return ID_PATTERN.test(id) ? id : null;
+  }
+  function firstDefined$1(a, b) {
+    return a !== null && a !== undefined ? a : b;
+  }
+
+  /** true / false for a choice the card marks as approve / decline; null when unknown. */
+  function choiceApproves(choice) {
+    if (!choice || typeof choice !== 'object') return null;
+    if (typeof choice.approved === 'boolean') return choice.approved;
+    const value = String(firstDefined$1(choice.value, '')).trim().toLowerCase();
+    if (APPROVE_VALUES.has(value)) return true;
+    if (DECLINE_VALUES.has(value)) return false;
+    return null;
+  }
+
   /**
-   * EV-2850 (WAPT) - the agent's `eshal-ui`/`eshal-chart` fence output can be
-   * influenced by the end user's own message or by prompt-injection planted in
-   * a knowledge-base document. A2uiBlock renders `href`/`src` values straight
-   * from that JSON with no filtering - a `javascript:` action URL renders as a
-   * legitimate-looking button that executes attacker JS in the visitor's page
-   * when clicked (an authenticated victim's session cookie, DOM, etc. are all
-   * in scope; no account needed to trigger it).
-   *
-   * Every `href`/`src` sink in A2uiBlock must go through this first. Only
-   * absolute http(s) URLs pass; anything else (javascript:, data:, vbscript:,
-   * a bare relative path, non-string) is dropped rather than rendered.
+   * The `tool_confirmation` for a pick on an approval card, or null when the
+   * card does not carry the held call's id (the text answer then stands alone).
    *
-   * EV-3956: the canonical copy lives in `@eshal/shared`
-   * (`src/a2ui/safeUrl.ts`). This package is published to npm while
-   * @eshal/shared is private, so it keeps its own copy rather than declaring
-   * a dependency consumers cannot resolve. Parity with the canonical version
-   * is enforced by packages/shared/src/__tests__/safeUrlParity.test.ts - if
-   * you change the logic here, change it there too or the build fails.
+   * A Skill tool that needs approval pauses the turn and the runtime draws a
+   * `confirmation` card. The turn contract carries `tool_confirmation`
+   * ({ tool_call_id, invocation_id, approved }), which the runtime prefers
+   * because it names the exact call. Built only when the card carries the id
+   * and the decision can be read from the choice.
    */
-  function safeUrl(u) {
-    return typeof u === 'string' && /^https?:\/\//i.test(u) ? u : undefined;
+  function toolConfirmationFor(spec, choice) {
+    if (!spec || typeof spec !== 'object') return null;
+    const toolCallId = cleanId(firstDefined$1(spec.tool_call_id, spec.toolCallId));
+    if (!toolCallId) return null;
+    const approved = choiceApproves(choice);
+    if (approved === null) return null;
+    return {
+      tool_call_id: toolCallId,
+      invocation_id: cleanId(firstDefined$1(spec.invocation_id, spec.invocationId)) || '',
+      approved: approved
+    };
+  }
+
+  // ── Links in card text ─────────────────────────────────────────────────
+
+  // `[label](https://...)` or a bare http(s) URL (trailing punctuation is not
+  // part of the URL).
+  const LINK_RE = /\[([^\]\n]+)\]\((https?:\/\/[^\s)]+)\)|(https?:\/\/[^\s<>()]+[^\s<>().,;:!?'"])/g;
+
+  /**
+   * A2UI card text is plain text, but agents put markdown links in it (a
+   * booked meeting's "[Join Google Meet](https://...)"). Splits `text` into
+   * text and link segments, or returns null when nothing in it is a safe link
+   * (the caller then renders the text unchanged). Every href passes safeUrl.
+   */
+  function linkSegments(text) {
+    if (!text) return null;
+    const s = String(text);
+    const out = [];
+    let last = 0;
+    LINK_RE.lastIndex = 0;
+    let m;
+    while ((m = LINK_RE.exec(s)) !== null) {
+      const idx = m.index;
+      const label = m[1] !== undefined ? m[1] : m[3];
+      const href = safeUrl(m[2] !== undefined ? m[2] : m[3]);
+      if (!href) continue;
+      if (idx > last) out.push({
+        type: 'text',
+        value: s.slice(last, idx)
+      });
+      out.push({
+        type: 'link',
+        label: label,
+        href: href
+      });
+      last = idx + m[0].length;
+    }
+    if (out.length === 0) return null;
+    if (last < s.length) out.push({
+      type: 'text',
+      value: s.slice(last)
+    });
+    return out;
+  }
+
+  // ── Answered state of one-shot cards ───────────────────────────────────
+  //
+  // Cards used to hold "already answered" only in component state, so a reload
+  // rendered an answered "Confirm booking" card clickable again and a second
+  // click risked a double booking. The conversation history is the durable
+  // record: a card is consumed once ANY delivered user turn follows the
+  // assistant message that carried it, and that turn is the recorded answer.
+
+  function normAnswer(v) {
+    return String(firstDefined$1(v, '')).trim().toLowerCase();
+  }
+
+  /**
+   * Which choice the recorded answer picked, matched on the choice's `value`
+   * or `label` (surfaces send `value || label`). null when unanswered or when
+   * the user moved on by typing something else.
+   */
+  function matchAnsweredChoice(choices, answer) {
+    if (answer === undefined || answer === null) return null;
+    const a = normAnswer(answer);
+    if (!a) return null;
+    const list = choices || [];
+    for (let i = 0; i < list.length; i += 1) {
+      const c = list[i];
+      if (normAnswer(c ? c.value : undefined) === a || normAnswer(c ? c.label : undefined) === a) {
+        return String(firstDefined$1(firstDefined$1(c.value, c.label), ''));
+      }
+    }
+    return null;
   }
 
   /**
@@ -88569,35 +88734,145 @@
     };
   }
 
-  const LINK_RE = /\[([^\]\n]+)\]\((https?:\/\/[^\s)]+)\)|(https?:\/\/[^\s<>()]+[^\s<>().,;:!?'"])/g;
+  /**
+   * Table-cell and label formatting shared by the three A2UI renderers - the
+   * agent-sdk, the widget and the frontend Testing Lab (EV-4798 MERN-19). Each
+   * used to carry a copy commented "kept in lockstep", so Testing Lab, the
+   * installed widget and the SDK render DB tables identically only for as long
+   * as nobody forgot one.
+   *
+   * Rules: ISO date/datetime -> "Dec 9, 2021"; a BARE numeric string in a
+   * money-named column -> comma-grouped WITHOUT synthesizing a currency symbol
+   * (the DB is the source of truth for "$"); a value already carrying a symbol,
+   * or any non-currency column, passes through verbatim or prettified.
+   *
+   * Plain JavaScript (types in cellFormat.d.ts), conservative syntax: the
+   * widget's Rollup/Babel build compiles neither TypeScript nor this file.
+   */
+
+  const MONTH_NAMES$1 = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+
+  /**
+   * Humanise a key: snake / kebab to spaces, camelCase split, each lower-case
+   * word capitalised ("total_expenses" -> "Total Expenses").
+   *
+   * Only a column-style value is reworded: one with an underscore
+   * (office_supplies), one without capitals (kebab-case, all-lower words) or a
+   * camelCase key. A value written with capitals is a name and stays as written
+   * ("DD Sports", "Republic TV", "GEC"), as does a word written with capitals
+   * inside a key (GRP_pre -> "GRP Pre"). Lower-casing every word but its first
+   * letter read those channels as "Dd Sports", "Republic Tv" and "Gec" (Media
+   * Prowess, Oct 2026).
+   */
+  function prettifyLabel(value) {
+    if (value === null || value === undefined) return '';
+    const s = String(value).replace(/\s+/g, ' ').trim();
+    if (!s) return '';
+    if (!isColumnStyle(s)) return s;
+    return s.replace(/[_\-]+/g, ' ').replace(/([a-z])([A-Z])/g, '$1 $2').replace(/\s+/g, ' ').trim().split(' ').map(function (w) {
+      return w === w.toLowerCase() ? w.charAt(0).toUpperCase() + w.slice(1) : w;
+    }).join(' ');
+  }
+
+  // A camelCase key ("camelCaseKey", "totalSpend"): two lower-case letters
+  // before the first capital, so names such as "iPhone", "eBay" and "kWh" stay
+  // as written.
+  const CAMEL_CASE_KEY_RE = /^[a-z]{2}[a-z0-9]*[A-Z][A-Za-z0-9]*$/;
+  function isColumnStyle(s) {
+    return s.indexOf('_') !== -1 || s === s.toLowerCase() || CAMEL_CASE_KEY_RE.test(s);
+  }
+
+  // The leading `(^|[_\W])` stands in for `\b`, which does not fire next to `_`
+  // (so "total_expenses" still matches "expense").
+  const CURRENCY_KEY_RE = /(^|[_\W])(price|salary|cost|amount|revenue|expense|total|value|budget|spend|income|sale|balance)/i;
+
+  /** Does this column name suggest money? Conservative: false negatives are fine. */
+  function isCurrencyKey(key) {
+    if (typeof key !== 'string') return false;
+    return CURRENCY_KEY_RE.test(key);
+  }
+  const ISO_DATETIME_CELL_RE = /^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}(:\d{2})?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?$/;
+
+  /**
+   * "Dec 9, 2021" for an ISO date, "Dec 9, 2021, 2:30 PM" when a non-midnight
+   * time is present; null when the value is not an ISO date/datetime.
+   */
+  function formatDateCell(value) {
+    if (typeof value !== 'string') return null;
+    const trimmed = value.trim();
+    if (!ISO_DATETIME_CELL_RE.test(trimmed)) return null;
+    // A date-time string with no trailing 'Z'/offset is parsed by `new Date()`
+    // as LOCAL time (ECMA-262), but it is read back below via UTC getters - so a
+    // timezone-less value is normalised to UTC first, or a non-UTC runtime
+    // renders the wrong calendar day/time (EV-2783 follow-up). Date-only
+    // strings are already parsed as UTC midnight per spec.
+    const hasTime = /[T ]\d{2}:\d{2}/.test(trimmed);
+    const hasTz = /(Z|[+-]\d{2}:?\d{2})$/.test(trimmed);
+    const parseable = hasTime && !hasTz ? trimmed.replace(' ', 'T') + 'Z' : trimmed;
+    const d = new Date(parseable);
+    if (isNaN(d.getTime())) return null;
+    const hasNonMidnightTime = hasTime && (d.getUTCHours() !== 0 || d.getUTCMinutes() !== 0 || d.getUTCSeconds() !== 0);
+    const dateStr = MONTH_NAMES$1[d.getUTCMonth()] + ' ' + d.getUTCDate() + ', ' + d.getUTCFullYear();
+    if (!hasNonMidnightTime) return dateStr;
+    const h = d.getUTCHours();
+    const ampm = h >= 12 ? 'PM' : 'AM';
+    const h12 = h % 12 || 12;
+    const mm = String(d.getUTCMinutes()).padStart(2, '0');
+    return dateStr + ', ' + h12 + ':' + mm + ' ' + ampm;
+  }
+
+  // Lowercase ASCII tokens joined by underscores (one or more joins). IDs,
+  // paths, emails, slugs and camelCase do not match and pass through verbatim.
+  const SNAKE_CASE_CATEGORY_RE = /^[a-z]+(_[a-z]+)+$/;
+
+  /**
+   * Show a snake_case category value ("office_supplies") as "Office Supplies";
+   * everything else (and anything over 40 characters) is left as it is.
+   */
+  function prettifyCategoryCell(value) {
+    if (typeof value !== 'string') return String(value === null || value === undefined ? '' : value);
+    if (value.length > 40) return value;
+    if (!SNAKE_CASE_CATEGORY_RE.test(value)) return value;
+    return prettifyLabel(value);
+  }
+
+  /** Comma-group a number for display: integers as-is, others to 2 decimals. */
+  function commaGroup(n) {
+    return Number.isInteger(n) ? n.toLocaleString('en-US') : Number(n.toFixed(2)).toLocaleString('en-US');
+  }
+  const BARE_NUMBER_RE = /^-?\d+(\.\d+)?$/;
+
+  /**
+   * Comma-group a BARE numeric string in a currency-named column, without
+   * adding a currency symbol. null when not applicable (not a string, not a
+   * money column, or the value already carries a symbol), so callers fall
+   * through to their next rule.
+   */
+  function formatCurrencyCellString(value, key) {
+    if (typeof value !== 'string' || !isCurrencyKey(key)) return null;
+    const s = value.trim();
+    if (!BARE_NUMBER_RE.test(s)) return null;
+    const n = Number(s);
+    if (!Number.isFinite(n)) return null;
+    return commaGroup(n);
+  }
+
   const LINK_STYLE = {
     color: '#1d4ed8',
     textDecoration: 'underline',
     overflowWrap: 'anywhere'
   };
   function linkifyText(text) {
-    if (!text) return text;
-    const out = [];
-    let last = 0;
+    const segments = linkSegments(text);
+    if (!segments) return text;
     let key = 0;
-    for (const m of String(text).matchAll(LINK_RE)) {
-      const idx = m.index ?? 0;
-      const label = m[1] ?? m[3];
-      const url = safeUrl(m[2] ?? m[3]);
-      if (!url) continue;
-      if (idx > last) out.push(text.slice(last, idx));
-      out.push(/*#__PURE__*/jsxRuntimeExports.jsx("a", {
-        href: url,
-        target: "_blank",
-        rel: "noopener noreferrer",
-        style: LINK_STYLE,
-        children: label
-      }, key++));
-      last = idx + m[0].length;
-    }
-    if (out.length === 0) return text;
-    if (last < text.length) out.push(text.slice(last));
-    return out;
+    return segments.map(seg => seg.type === 'link' ? /*#__PURE__*/jsxRuntimeExports.jsx("a", {
+      href: seg.href,
+      target: "_blank",
+      rel: "noopener noreferrer",
+      style: LINK_STYLE,
+      children: seg.label
+    }, key++) : seg.value);
   }
 
   // Kept in its own tiny module (not A2uiBlock.jsx): MessageList imports it
@@ -88611,14 +88886,6 @@
   // "Confirm booking". Context rather than a prop so it does not have to be
   // threaded through MessageBubble -> StreamingMarkdown -> MarkdownRenderer.
   const A2uiAnsweredContext = /*#__PURE__*/React.createContext(undefined);
-  const _normAnswer = v => String(v ?? '').trim().toLowerCase();
-  function matchAnsweredChoice(choices, answer) {
-    if (answer === undefined || answer === null) return null;
-    const a = _normAnswer(answer);
-    if (!a) return null;
-    const hit = (choices || []).find(c => _normAnswer(c?.value) === a || _normAnswer(c?.label) === a);
-    return hit ? String(hit.value ?? hit.label ?? '') : null;
-  }
 
   /**
    * A2uiBlock - render `eshal-ui` / `eshal-chart` / `chart` fence JSON as a
@@ -88647,6 +88914,10 @@
    */
 
 
+  // The chart-family types the dispatcher routes to <Chart>, from the shared
+  // A2UI registry (EV-4798 MERN-19).
+  const CHART_TYPES = new Set(A2UI_CHART_TYPES);
+
   // Card images (banner, list item, avatar, gallery) go through the chat image
   // policy too. Unchanged while it is off, which is the default.
   const cardImageSrc = u => policedImageSrc(safeUrl(u));
@@ -88667,10 +88938,10 @@
     };
     // Normalize underscore_case → kebab-case so the agent can emit either
     // form. Both `key_observations` and `key-observations` route here.
-    const t = String(spec.type || '').trim().toLowerCase().replace(/_/g, '-');
+    const t = normalizeA2uiType(spec.type);
 
-    // Charts (incl. graceful fallback for chart-shaped data with unknown type)
-    const CHART_TYPES = new Set(['bar', 'line', 'area', 'pie', 'donut', 'scatter', 'bubble', 'radar', 'radial-bar', 'radial', 'radialbar', 'treemap', 'funnel', 'sankey', 'composed', 'waterfall', 'gauge', 'histogram', 'kpi']);
+    // Charts (incl. graceful fallback for chart-shaped data with unknown type).
+    // CHART_TYPES is the shared chat core's registry (module scope, below the imports).
 
     // ── On-demand analytical insight cards (12-06-2026) ──
     // Six types the database_query agent emits when the user explicitly
@@ -89507,36 +89778,43 @@
     }
     if (field.type === 'radio') {
       const opts = Array.isArray(field.options) ? field.options : [];
-      return /*#__PURE__*/jsxRuntimeExports.jsxs("div", {
-        style: {
-          marginBottom: 10
-        },
-        children: [/*#__PURE__*/jsxRuntimeExports.jsxs("div", {
-          style: labelStyle,
-          children: [field.label, field.required ? ' *' : '']
-        }), opts.map(o => /*#__PURE__*/jsxRuntimeExports.jsxs("label", {
+      return (
+        /*#__PURE__*/
+        // EV-4798 (MERN-21): the visible label names the radio group.
+        jsxRuntimeExports.jsxs("div", {
           style: {
-            display: 'flex',
-            alignItems: 'center',
-            gap: 6,
-            fontSize: 12,
-            marginBottom: 2
-          },
-          children: [/*#__PURE__*/jsxRuntimeExports.jsx("input", {
-            type: "radio",
-            name: autoId,
-            checked: value === o.value,
-            onChange: () => onChange(o.value)
-          }), o.label]
-        }, o.value)), error && /*#__PURE__*/jsxRuntimeExports.jsx("div", {
-          style: {
-            fontSize: 11,
-            color: '#ef4444',
-            marginTop: 2
-          },
-          children: error
-        })]
-      });
+            marginBottom: 10
+          },
+          role: "radiogroup",
+          "aria-labelledby": `${autoId}-label`,
+          children: [/*#__PURE__*/jsxRuntimeExports.jsxs("div", {
+            id: `${autoId}-label`,
+            style: labelStyle,
+            children: [field.label, field.required ? ' *' : '']
+          }), opts.map(o => /*#__PURE__*/jsxRuntimeExports.jsxs("label", {
+            style: {
+              display: 'flex',
+              alignItems: 'center',
+              gap: 6,
+              fontSize: 12,
+              marginBottom: 2
+            },
+            children: [/*#__PURE__*/jsxRuntimeExports.jsx("input", {
+              type: "radio",
+              name: autoId,
+              checked: value === o.value,
+              onChange: () => onChange(o.value)
+            }), o.label]
+          }, o.value)), error && /*#__PURE__*/jsxRuntimeExports.jsx("div", {
+            style: {
+              fontSize: 11,
+              color: '#ef4444',
+              marginTop: 2
+            },
+            children: error
+          })]
+        })
+      );
     }
     if (field.type === 'textarea') {
       return /*#__PURE__*/jsxRuntimeExports.jsxs("div", {
@@ -89769,7 +90047,14 @@
       if (sentRef.current || locked) return;
       sentRef.current = true;
       setLocalChosen(String(value));
-      onButtonClick(value, label);
+      // EV-4798 MERN-12: a card that carries the held call's id is also
+      // answered by that id (utils/toolConfirmation.js); the value text
+      // still goes as the message either way.
+      const choice = buttons.find(b => String(b?.value || b?.label || '') === String(value));
+      const toolConfirmation = toolConfirmationFor(spec, choice);
+      if (toolConfirmation) onButtonClick(value, label, {
+        toolConfirmation
+      });else onButtonClick(value, label);
     } : undefined;
     return /*#__PURE__*/jsxRuntimeExports.jsxs("div", {
       style: card(isDark),
@@ -90525,46 +90810,14 @@
   }
 
   // ── Bug 1 + Bug 3 helpers (2026-06-16) ───────────────────────────────────
-  // PORTED from packages/frontend/src/components/charts/eshal-chart/
-  // chartShared.tsx. Duplicated rather than shared because the widget is
-  // bundle-size-conscious (a separate package import here would pull a
-  // chunk of the frontend with it). The authoritative tests live with
-  // the frontend copy in __tests__/chartShared.test.ts - keep this code
-  // in lockstep with that file when either is touched. Regex boundaries
-  // use `(^|[_\W])` instead of `\b` because JS regex `\b` doesn't fire
-  // next to `_` (underscore is a word char), so "total_expenses" with
-  // `\bexpense\b` would miss the match.
+  // Chart value and axis-tick formatting, ported from packages/frontend/src/
+  // components/charts/eshal-chart/chartShared.tsx. The label and currency-key
+  // helpers they build on (prettifyLabel, isCurrencyKey) are the shared chat
+  // core's (EV-4798 MERN-19); the chart-only rules below stay with the widget.
 
   const MONTH_NAMES = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
-  const CURRENCY_KEY_RE = /(^|[_\W])(price|salary|cost|amount|revenue|expense|total|value|budget|spend|income|sale|balance)/i;
   const MONTH_KEY_RE = /(^|[_\W])month/i;
 
-  // Only a column-style value is reworded: one with an underscore
-  // (office_supplies), one without capitals (kebab-case, all-lower words)
-  // or a camelCase key. A value written with capitals is a name and stays as
-  // written ("DD Sports", "Republic TV", "GEC"), as does a word written with
-  // capitals inside a key (GRP_pre -> "GRP Pre"). Lower-casing every word but
-  // its first letter read those channels as "Dd Sports", "Republic Tv" and
-  // "Gec" (Media Prowess, Oct 2026).
-  function prettifyLabel(value) {
-    if (value === null || value === undefined) return '';
-    const s = String(value).replace(/\s+/g, ' ').trim();
-    if (!s) return '';
-    if (!isColumnStyle(s)) return s;
-    return s.replace(/[_\-]+/g, ' ').replace(/([a-z])([A-Z])/g, '$1 $2').replace(/\s+/g, ' ').trim().split(' ').map(w => w === w.toLowerCase() ? w.charAt(0).toUpperCase() + w.slice(1) : w).join(' ');
-  }
-
-  // A camelCase key ("camelCaseKey", "totalSpend"): two lower-case letters
-  // before the first capital, so names such as "iPhone", "eBay" and "kWh"
-  // stay as written.
-  const CAMEL_CASE_KEY_RE = /^[a-z]{2}[a-z0-9]*[A-Z][A-Za-z0-9]*$/;
-  function isColumnStyle(s) {
-    return s.includes('_') || s === s.toLowerCase() || CAMEL_CASE_KEY_RE.test(s);
-  }
-  function isCurrencyKey(key) {
-    return typeof key === 'string' && CURRENCY_KEY_RE.test(key);
-  }
-
   // ISO date / datetime prefix - matches the typical SQL output the
   // agent's tools produce when GROUP BY-ing by month
   // (`DATE_TRUNC('month', col)` → `YYYY-MM-DD`, or `to_char(..,'YYYY-MM')`
@@ -90597,80 +90850,25 @@
     return prettifyLabel(value);
   }
 
-  // Conservative snake_case detector for table cell category labels
-  // (2026-06-19, EV-1187 follow-up). Mirrors the admin UI's
-  // `prettifyCategoryCell` in `packages/frontend/.../chartShared.tsx` and
-  // the SDK's copy. Self-contained because the widget can't reach across
-  // package boundaries.
-  //
-  // Goal: when a category column shows `office_supplies` next to a chart
-  // whose X-axis (via prettifyLabel) already renders "Office Supplies",
-  // the table should agree. Conservative - only lowercase ASCII tokens
-  // joined by underscores (≤ 40 chars) qualify, so IDs/paths/emails/
-  // slugs/camelCase pass through verbatim.
-  const SNAKE_CASE_CATEGORY_RE = /^[a-z]+(_[a-z]+)+$/;
-  function prettifyCategoryCell(value) {
-    if (typeof value !== 'string') return String(value ?? '');
-    if (value.length > 40) return value;
-    if (!SNAKE_CASE_CATEGORY_RE.test(value)) return value;
-    return prettifyLabel(value);
-  }
-
-  // Numeric string under a money column, e.g. "81,200" / "105444" / "-1,250.50".
-  // Table-cell formatting, kept IN LOCKSTEP with the Testing-Lab (frontend
-  // chartShared.tsx: formatDateCell / formatCurrencyCellString) and SDK copies so
-  // all three surfaces render DB tables identically. Two rules:
-  //   1. ISO date/datetime → "Dec 9, 2021" (parity with Testing Lab).
-  //   2. Bare numeric string in a money-named column → comma-group, and NEVER
-  //      synthesize a currency symbol - the DB is the source of truth for "$".
-  //      A value that already carries a symbol ("$71000", "₹560") fails
-  //      _BARE_NUMBER_RE and is passed through verbatim, so we don't double-format.
-  const _BARE_NUMBER_RE = /^-?\d+(\.\d+)?$/;
-  const _MONTH_NAMES = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
-  const _ISO_DATETIME_CELL_RE = /^\d{4}-\d{2}-\d{2}([T ]\d{2}:\d{2}(:\d{2})?(\.\d+)?(Z|[+-]\d{2}:?\d{2})?)?$/;
-  function _formatDateCell(value) {
-    if (typeof value !== 'string') return null;
-    const trimmed = value.trim();
-    if (!_ISO_DATETIME_CELL_RE.test(trimmed)) return null;
-    // A date-time string with no trailing 'Z'/offset is parsed by `new
-    // Date()` as LOCAL time (ECMA-262), but we read it back below via UTC
-    // getters - so a timezone-less value must be normalized to UTC first,
-    // or a non-UTC runtime renders the wrong calendar day/time (EV-2783
-    // follow-up). Date-only strings (no time part) are already parsed as
-    // UTC midnight per spec and need no change.
-    const hasTime = /[T ]\d{2}:\d{2}/.test(trimmed);
-    const hasTz = /(Z|[+-]\d{2}:?\d{2})$/.test(trimmed);
-    const parseable = hasTime && !hasTz ? `${trimmed.replace(' ', 'T')}Z` : trimmed;
-    const d = new Date(parseable);
-    if (isNaN(d.getTime())) return null;
-    const hasNonMidnightTime = hasTime && (d.getUTCHours() !== 0 || d.getUTCMinutes() !== 0 || d.getUTCSeconds() !== 0);
-    const dateStr = `${_MONTH_NAMES[d.getUTCMonth()]} ${d.getUTCDate()}, ${d.getUTCFullYear()}`;
-    if (!hasNonMidnightTime) return dateStr;
-    const h = d.getUTCHours();
-    const ampm = h >= 12 ? 'PM' : 'AM';
-    const h12 = h % 12 || 12;
-    const mm = String(d.getUTCMinutes()).padStart(2, '0');
-    return `${dateStr}, ${h12}:${mm} ${ampm}`;
-  }
-  function _commaGroup(n) {
-    return Number.isInteger(n) ? n.toLocaleString('en-US') : Number(n.toFixed(2)).toLocaleString('en-US');
-  }
+  // Table cells: the date, money-string and snake_case-category rules are the
+  // shared chat core's (packages/shared/src/chatCore/cellFormat.js, EV-4798
+  // MERN-19), so Testing Lab, the widget and the SDK render DB tables
+  // identically by construction. formatCell keeps the widget's own handling of
+  // raw numbers and objects.
   function formatCell(v, columnKey) {
     if (v == null) return '';
     if (typeof v === 'number') {
       // Comma-group; NEVER synthesize a currency symbol (DB owns symbols).
-      return _commaGroup(v);
+      return commaGroup(v);
     }
     if (typeof v === 'object') return JSON.stringify(v);
     const s = String(v).trim();
     // 1. ISO date/datetime → friendly date.
-    const dateCell = _formatDateCell(s);
+    const dateCell = formatDateCell(s);
     if (dateCell) return dateCell;
     // 2. Bare numeric string in a money column → comma-group, NO "$".
-    if (isCurrencyKey(columnKey) && _BARE_NUMBER_RE.test(s)) {
-      const n = Number(s);
-      if (Number.isFinite(n)) return _commaGroup(n);
-    }
+    const money = formatCurrencyCellString(s, columnKey);
+    if (money !== null) return money;
     // 3. Everything else: prettify snake_case labels; IDs/paths/emails/slugs and
     // any DB value already carrying a symbol pass through verbatim.
     return prettifyCategoryCell(v);
@@ -91648,48 +91846,46 @@
   }
 
   /**
-   * Parse an assistant message body into a mix of TEXT and CITATION-CLUSTER
-   * segments, so the renderer can swap each cluster for an inline
-   * `<CitationPill>` while leaving prose intact.
+   * Inline citation core shared by every chat renderer (EV-4798 MERN-19).
    *
-   * Cluster rule: consecutive `[N]` markers separated only by whitespace
-   * (`[1][2]`, `[1] [2]`, `[1,3]` - same intent) collapse into ONE cluster.
-   * A break in-between (`[1] some text [2]`) yields two separate clusters.
+   * Before this file the same logic lived three times - in the agent-sdk, the
+   * widget and the frontend Testing Lab - each copy headed "keep in sync". It
+   * owns everything about an inline `[N]` citation that is not presentation:
+   *
+   *   - parseCitationClusters: assistant text -> text and citation-cluster
+   *     segments (cluster rule, Devanagari digits, punctuation reorder).
+   *   - rehypeCitations: the rehype plugin that swaps `[N]` markers in HAST
+   *     text nodes for `<span data-eshal-citation="1,3">` placeholders.
+   *   - the CitationPill's source resolution: which source cards a cluster
+   *     points at, de-duplicated, plus the pill's label / file / key rules.
    *
-   * Preserves Markdown links `[label](url)` - the negative lookahead in
-   * the regex skips any `]` immediately followed by `(`.
+   * Each surface keeps its own CitationPill component (lucide icons on the
+   * widget, inline SVG in the SDK, Tailwind in the frontend). The three pills
+   * historically read source ids from slightly different fields (`source_id`
+   * vs `sourceid`), so the id-reading helpers take the surface's field list
+   * rather than silently unifying it - unifying would change which sources a
+   * surface treats as files.
    *
-   * DUPLICATED across three surfaces - copies live at:
-   *   * packages/frontend/src/lib/messages/parseCitationClusters.ts
-   *   * packages/widget/src/utils/parseCitationClusters.js (this file)
-   *   * packages/agent-sdk/src/utils/parseCitationClusters.ts
-   * Regex + cluster rule kept byte-identical across all three; a parity
-   * test asserts the same input → same segment list on every surface.
+   * Plain JavaScript with no imports, on purpose: the widget's Rollup/Babel
+   * build compiles no TypeScript from another package, and the published SDK
+   * and widget bundle this file directly. Types live in citations.d.ts.
+   * Conservative syntax (no `??`, no `?.`): files from another package are not
+   * run through the widget's Babel preset, so they reach its bundle as written.
    */
 
-  // Latin `[N]` / `[N,M]` markers, plus Devanagari digits `[१]` / `[१,२]`.
-  // The negative lookahead `(?!\()` excludes Markdown link syntax
-  // `[label](url)`.
+  // Latin `[N]` / `[N,M]` markers, plus Devanagari digits. The negative
+  // lookahead `(?!\()` excludes Markdown link syntax `[label](url)`.
   const MARKER_RE = /\[([\d०-९][\d०-९\s,]*)\](?!\()/g;
-  const DEV_DIGIT_MAP = {
-    "०": "0",
-    "१": "1",
-    "२": "2",
-    "३": "3",
-    "४": "4",
-    "५": "5",
-    "६": "6",
-    "७": "7",
-    "८": "8",
-    "९": "9"
-  };
   function normalizeDigits(s) {
-    return s.replace(/[०-९]/g, d => DEV_DIGIT_MAP[d] ?? d);
+    return s.replace(/[०-९]/g, function (d) {
+      return String(d.charCodeAt(0) - 0x0966);
+    });
   }
   function parseIndicesInside(inner) {
     const out = [];
-    for (const part of normalizeDigits(inner).split(",")) {
-      const t = part.trim();
+    const parts = normalizeDigits(inner).split(',');
+    for (let i = 0; i < parts.length; i += 1) {
+      const t = parts[i].trim();
       if (/^\d+$/.test(t)) {
         const n = parseInt(t, 10);
         if (n >= 1) out.push(n);
@@ -91700,7 +91896,8 @@
   function dedupPreserveOrder(nums) {
     const seen = new Set();
     const out = [];
-    for (const n of nums) {
+    for (let i = 0; i < nums.length; i += 1) {
+      const n = nums[i];
       if (!seen.has(n)) {
         seen.add(n);
         out.push(n);
@@ -91716,8 +91913,18 @@
   // Markdown links `[label](url)` untouched.
   const CITE_PUNCT_RE = /(\s*)((?:\[[\d०-९][\d०-९\s,]*\](?!\()\s*)+)([.!?])/g;
   function reorderCitationPunctuation(text) {
-    return text.replace(CITE_PUNCT_RE, (_all, _lead, cluster, punct) => punct + " " + cluster.replace(/\s+$/, ""));
+    return text.replace(CITE_PUNCT_RE, function (_all, _lead, cluster, punct) {
+      return punct + ' ' + cluster.replace(/\s+$/, '');
+    });
   }
+
+  /**
+   * Parse an assistant message body into TEXT and CITATION-CLUSTER segments.
+   *
+   * Cluster rule: consecutive `[N]` markers separated only by whitespace
+   * (`[1][2]`, `[1] [2]`, `[1,3]` - same intent) collapse into ONE cluster.
+   * A break in-between (`[1] some text [2]`) yields two separate clusters.
+   */
   function parseCitationClusters(text) {
     if (!text) return [];
     text = reorderCitationPunctuation(text);
@@ -91730,122 +91937,228 @@
       markers.push({
         start: m.index,
         end: MARKER_RE.lastIndex,
-        indices
+        indices: indices
       });
     }
     if (markers.length === 0) {
       return [{
-        type: "text",
+        type: 'text',
         value: text
       }];
     }
 
-    // Merge markers that are separated only by whitespace into a single
-    // cluster. `[1][2]`, `[1] [2]`, and `[1,2]` all read as one citation
-    // cluster attached to the preceding sentence.
+    // Merge markers that are separated only by whitespace into one cluster.
     const clusters = [];
-    for (const cur of markers) {
+    for (let i = 0; i < markers.length; i += 1) {
+      const cur = markers[i];
       const last = clusters.length ? clusters[clusters.length - 1] : null;
       if (last && /^\s*$/.test(text.slice(last.end, cur.start))) {
         last.end = cur.end;
-        last.indices.push(...cur.indices);
+        for (let j = 0; j < cur.indices.length; j += 1) last.indices.push(cur.indices[j]);
       } else {
         clusters.push({
           start: cur.start,
           end: cur.end,
-          indices: [...cur.indices]
+          indices: cur.indices.slice()
         });
       }
     }
     const out = [];
     let cursor = 0;
-    for (const c of clusters) {
+    for (let i = 0; i < clusters.length; i += 1) {
+      const c = clusters[i];
       if (c.start > cursor) {
         out.push({
-          type: "text",
+          type: 'text',
           value: text.slice(cursor, c.start)
         });
       }
       out.push({
-        type: "cite",
+        type: 'cite',
         indices: dedupPreserveOrder(c.indices)
       });
       cursor = c.end;
     }
     if (cursor < text.length) {
       out.push({
-        type: "text",
+        type: 'text',
         value: text.slice(cursor)
       });
     }
     return out;
   }
+
+  /** `[1,3]` -> `"1,3"`, the wire format of the `data-eshal-citation` attribute. */
   function serializeCitationIndices(indices) {
-    return indices.join(",");
+    return indices.join(',');
   }
+
+  /** `"1,3"` -> `[1, 3]`; invalid and repeated entries dropped. */
   function parseCitationIndicesFromAttr(attr) {
     if (!attr) return [];
     const out = [];
-    for (const t of String(attr).split(",")) {
-      const n = parseInt(t.trim(), 10);
+    const parts = String(attr).split(',');
+    for (let i = 0; i < parts.length; i += 1) {
+      const n = parseInt(parts[i].trim(), 10);
       if (Number.isFinite(n) && n >= 1) out.push(n);
     }
     return dedupPreserveOrder(out);
   }
+  function isCodeParent(parent) {
+    return parent.type === 'element' && (parent.tagName === 'code' || parent.tagName === 'pre');
+  }
+
+  // Replace the text node at `parent.children[index]` with its citation
+  // segments. Returns the index to continue from.
+  function replaceCitationText(node, index, parent) {
+    // Text inside <code> / <pre> is not a citation (someone showing example
+    // markdown).
+    if (isCodeParent(parent)) return index + 1;
+    const segments = parseCitationClusters(node.value);
+    // No markers found - leave the text node untouched.
+    if (segments.length === 1 && segments[0].type === 'text') return index + 1;
+
+    // 2026-07-14 - glue the pill to its preceding word: a regular space right
+    // before a cite segment becomes a non-breaking space, so the pill never
+    // wraps alone onto a new line.
+    const replacements = segments.map(function (seg, i) {
+      if (seg.type === 'text') {
+        const nextIsCite = i + 1 < segments.length && segments[i + 1].type === 'cite';
+        const value = nextIsCite ? seg.value.replace(/[ \t]+$/, ' ') : seg.value;
+        return {
+          type: 'text',
+          value: value
+        };
+      }
+      return {
+        type: 'element',
+        tagName: 'span',
+        properties: {
+          dataEshalCitation: serializeCitationIndices(seg.indices)
+        },
+        children: []
+      };
+    });
+    parent.children.splice.apply(parent.children, [index, 1].concat(replacements));
+    return index + replacements.length;
+  }
+  function walkCitationText(parent) {
+    const children = parent.children;
+    if (!Array.isArray(children)) return;
+    let i = 0;
+    while (i < children.length) {
+      const node = children[i];
+      if (node && node.type === 'text') {
+        i = replaceCitationText(node, i, parent);
+        continue;
+      }
+      if (node && Array.isArray(node.children)) walkCitationText(node);
+      i += 1;
+    }
+  }
 
   /**
-   * rehype plugin - walks HAST text nodes emitted by remark and replaces
-   * `[N]` citation markers with `<span data-eshal-citation="1,3">`
-   * placeholders. A `components.span` override in MessageBubble swaps
-   * each placeholder for a `<CitationPill>` React node at render time.
+   * rehype plugin: replaces `[N]` citation markers in HAST text nodes with
+   * `<span data-eshal-citation="1,3">` placeholders, which each surface's
+   * `components.span` override swaps for its CitationPill.
    *
-   * Why a HAST plugin and not a pre-ReactMarkdown string transform:
-   * Markdown spans (bold, italic, links) can wrap the marker text -
-   * pre-splitting the raw string breaks formatting boundaries. HAST-time
-   * replacement only touches text nodes, so `**bold [1]**` stays one
-   * bold span with the pill nested at the right place.
+   * Why a HAST plugin and not a string transform: Markdown spans (bold, links)
+   * can wrap the marker - HAST-time replacement only touches text nodes, so
+   * `**bold [1]**` stays one bold span with the pill nested inside it.
    *
-   * Ported byte-for-byte from packages/agent-sdk/src/utils/rehypeCitations.ts -
-   * keep in sync.
+   * Dependency-free tree walk (no unist-util-visit) so the shared file has no
+   * imports. Same order and the same skip-past-the-replacements rule.
    */
   function rehypeCitations() {
-    return tree => {
-      visit(tree, "text", (node, index, parent) => {
-        if (index == null || parent == null) return;
-        // Skip text inside <code> / <pre> - markers there are not
-        // citations (someone's showing example markdown).
-        if (parent.type === "element" && (parent.tagName === "code" || parent.tagName === "pre")) {
-          return;
+    return function (tree) {
+      if (tree) walkCitationText(tree);
+    };
+  }
+
+  // ── CitationPill source resolution ─────────────────────────────────────
+
+  function firstDefined(src, fields) {
+    for (let i = 0; i < fields.length; i += 1) {
+      const v = src[fields[i]];
+      if (v !== null && v !== undefined) return v;
+    }
+    return undefined;
+  }
+  function firstTruthy(src, fields) {
+    for (let i = 0; i < fields.length; i += 1) {
+      const v = src[fields[i]];
+      if (v) return v;
+    }
+    return undefined;
+  }
+
+  /** Percent-decoded source name; the raw value when it is not valid encoding. */
+  function decodeSourceName(name) {
+    if (!name) return '';
+    try {
+      return decodeURIComponent(String(name));
+    } catch (e) {
+      return String(name);
+    }
+  }
+
+  /** What a pill or popover row shows for a source. */
+  function citationDisplayLabel(src, fallbackIndex) {
+    return decodeSourceName(src.source_name) || src.url || src.source_type || 'Source ' + fallbackIndex;
+  }
+
+  /**
+   * Is this source a file (as opposed to a web page)? `idFields` are the id
+   * fields the surface reads: a source with an id and no url is a file.
+   */
+  function isFileLikeSource$1(src, idFields) {
+    if (!src) return false;
+    const url = src.url;
+    return src.source_type === 'file' || typeof url === 'string' && url.indexOf('/api/v1/sharepoint/file/') !== -1 || !!firstTruthy(src, idFields) && !url;
+  }
+
+  /** The key a surface's download state (`downloadingKey`) is matched on. */
+  function citationSourceKey(src, idFields) {
+    return src.url || firstTruthy(src, idFields) || src.source_name || '';
+  }
+
+  /**
+   * Resolve a cluster's 1-based indices to source cards.
+   *
+   * Prefers each source's backend-emitted `citation_indices` (keeps the LLM's
+   * original chunk position through filter, dedup and ACL), falling back to the
+   * array position for older backends. Out-of-range indices are skipped so a
+   * hallucinated `[99]` cannot blank the pill. Sources are de-duplicated by
+   * identity - url first (unique per web page), then the id fields, then the
+   * name - keeping the first index as the display anchor.
+   */
+  function resolveCitedSources(sources, indices, idFields) {
+    const out = [];
+    if (!Array.isArray(sources)) return out;
+    const keyFields = ['url'].concat(idFields, ['source_name']);
+    const seen = new Set();
+    for (let i = 0; i < indices.length; i += 1) {
+      const n = indices[i];
+      let src;
+      for (let j = 0; j < sources.length; j += 1) {
+        const s = sources[j];
+        if (s && Array.isArray(s.citation_indices) && s.citation_indices.indexOf(n) !== -1) {
+          src = s;
+          break;
         }
-        const segments = parseCitationClusters(node.value);
-        // No markers found - leave the text node untouched.
-        if (segments.length === 1 && segments[0].type === "text") return;
-
-        // 2026-07-14 - glue pill to preceding word (non-breaking space)
-        // so HTML doesn't wrap the pill alone onto a new line. Preserves
-        // the "sentence ending [pill]" reading flow.
-        const replacements = segments.map((seg, i) => {
-          if (seg.type === "text") {
-            const nextIsCite = i + 1 < segments.length && segments[i + 1].type === "cite";
-            const value = nextIsCite ? seg.value.replace(/[ \t]+$/, "\u00a0") : seg.value;
-            return {
-              type: "text",
-              value
-            };
-          }
-          return {
-            type: "element",
-            tagName: "span",
-            properties: {
-              dataEshalCitation: serializeCitationIndices(seg.indices)
-            },
-            children: []
-          };
-        });
-        parent.children.splice(index, 1, ...replacements);
-        return [SKIP, index + replacements.length];
+      }
+      if (src === undefined) src = sources[n - 1];
+      if (!src) continue;
+      const raw = firstDefined(src, keyFields);
+      const key = String(raw === undefined ? '' : raw).toLowerCase();
+      if (key && seen.has(key)) continue;
+      if (key) seen.add(key);
+      out.push({
+        src: src,
+        index: n
       });
-    };
+    }
+    return out;
   }
 
   /**
@@ -91952,25 +92265,17 @@
     return Boolean(source.source_id);
   }
 
-  function decodeName(name) {
-    if (!name) return "";
-    try {
-      return decodeURIComponent(String(name));
-    } catch {
-      return String(name);
-    }
-  }
+  // Label, file and key rules and the cluster -> source resolution are the
+  // shared chat core's (packages/shared/src/chatCore/citations.js, EV-4798
+  // MERN-19), shared with the SDK and frontend pills. The widget reads
+  // `source_id` for "is this a file" and both id spellings for identity.
+  const FILE_ID_FIELDS = ["source_id"];
+  const KEY_ID_FIELDS = ["source_id", "sourceid"];
   function isFileLikeSource(s) {
-    if (!s) return false;
-    const src_type = s.source_type;
-    const url = s.url;
-    return src_type === "file" || typeof url === "string" && url.includes("/api/v1/sharepoint/file/") || !!s.source_id && !url;
-  }
-  function displayLabel(s, fallbackIndex) {
-    return decodeName(s.source_name) || s.url || s.source_type || `Source ${fallbackIndex}`;
+    return isFileLikeSource$1(s, FILE_ID_FIELDS);
   }
   function pillKey(s) {
-    return s.url || s.source_id || s.sourceid || s.source_name || "";
+    return citationSourceKey(s, KEY_ID_FIELDS);
   }
   function CitationPill({
     indices
@@ -92002,26 +92307,7 @@
     // FIRST index encountered as the display anchor.
     const referenced = React.useMemo(() => {
       if (!ctx || !Array.isArray(ctx.sources)) return [];
-      const out = [];
-      const seen = new Set();
-      for (const n of indices) {
-        const byCitationIndex = ctx.sources.find(s => Array.isArray(s?.citation_indices) && s.citation_indices.includes(n));
-        const src = byCitationIndex ?? ctx.sources[n - 1];
-        if (!src) continue;
-        // 2026-07-15 - prioritise URL (unique per web page) over
-        // sourceid (shared across every page of the same Knowledge row).
-        // Website-connector sources emit distinct URLs for distinct
-        // pages but a single Knowledge row id - dedupping on sourceid
-        // first collapsed them to one row in the popover.
-        const key = String(src.url ?? src.source_id ?? src.sourceid ?? src.source_name ?? "").toLowerCase();
-        if (key && seen.has(key)) continue;
-        if (key) seen.add(key);
-        out.push({
-          src,
-          index: n
-        });
-      }
-      return out;
+      return resolveCitedSources(ctx.sources, indices, KEY_ID_FIELDS);
     }, [ctx, indices]);
 
     // Close on Esc / outside click.
@@ -92141,7 +92427,7 @@
     }
     const first = referenced[0];
     const extraCount = referenced.length - 1;
-    const firstLabel = displayLabel(first.src, first.index);
+    const firstLabel = citationDisplayLabel(first.src, first.index);
     // EV-4177: a card only gets the download affordance when a click will
     // actually produce a file. isFileLikeSource alone answers "is this a file",
     // not "can we fetch it" - which is how a download icon ended up on a source
@@ -92163,14 +92449,22 @@
       if (open) setOpen(false);else openPopover();
     };
     const iconSize = 12;
+
+    // EV-4798 (MERN-21): accessible names in the widget locale. `ctx.t` is
+    // optional (a provider from an older bundle may not pass it), so each
+    // string keeps its English form as the fallback.
+    const tr = (key, english) => typeof ctx.t === "function" ? ctx.t(key) : english;
+    const pillName = firstLabel + (extraCount ? ` (${tr("moreSources", "+{count} more").replace("{count}", String(extraCount))})` : "");
     return /*#__PURE__*/jsxRuntimeExports.jsxs(jsxRuntimeExports.Fragment, {
       children: [/*#__PURE__*/jsxRuntimeExports.jsxs("span", {
         ref: anchorRef,
         role: "button",
         tabIndex: 0,
         dir: "ltr",
-        title: firstLabel + (extraCount ? ` (+${extraCount} more)` : ""),
-        "aria-label": firstLabel + (extraCount ? ` (+${extraCount} more)` : ""),
+        title: pillName,
+        "aria-label": pillName,
+        "aria-haspopup": referenced.length > 1 ? "dialog" : undefined,
+        "aria-expanded": referenced.length > 1 ? open : undefined,
         onClick: onPillClick,
         onKeyDown: e => {
           if (e.key === "Enter" || e.key === " ") {
@@ -92265,11 +92559,18 @@
             strokeWidth: 2
           })
         })]
-      }), open && pos && typeof document !== "undefined" && /*#__PURE__*/reactDomExports.createPortal(/*#__PURE__*/jsxRuntimeExports.jsxs("div", {
+      }), open && pos && typeof document !== "undefined" && /*#__PURE__*/reactDomExports.createPortal(
+      /*#__PURE__*/
+      // The click/mousedown handlers below only stop propagation so the
+      // bubble's own handlers do not see clicks inside the popover; the
+      // dialog is not itself a click target, and Escape plus the Tab trap
+      // are handled by the effect above.
+      // eslint-disable-next-line jsx-a11y/no-noninteractive-element-interactions, jsx-a11y/click-events-have-key-events
+      jsxRuntimeExports.jsxs("div", {
         ref: popoverRef,
         role: "dialog",
         dir: "ltr",
-        "aria-label": `${referenced.length} sources cited`,
+        "aria-label": tr("sourcesCited", "{count} sources cited").replace("{count}", String(referenced.length)),
         style: {
           position: "absolute",
           top: pos.top,
@@ -92304,7 +92605,7 @@
           src,
           index
         }) => {
-          const label = displayLabel(src, index);
+          const label = citationDisplayLabel(src, index);
           // EV-4177: same gate as firstIsFile above.
           const rowIsFile = isFileLikeSource(src) && canDownloadSource(src);
           const kBusy = ctx.downloadingKey && ctx.downloadingKey === pillKey(src);