@heroui/agent 0.2.0-beta.6 → 0.2.0-beta.8

package/dist/contracts.js

@@ -2061,12 +2061,13 @@ function renderAgentUICatalogPrompt() {
 // src/contracts/client-tools.ts
 import { z as z2 } from "zod";
 var RESERVED_AGENT_TOOL_NAMES = [
+  "callMcpTool",
   "composeUI",
   "executeSandbox",
   "getComponentSchema",
-  "loadUIRenderers",
   "renderComponent",
   "searchKnowledge",
+  "searchMcpTools",
   "searchWeb"
 ];
 var RESERVED_AGENT_TOOL_PREFIX = "mcp_";
@@ -2095,11 +2096,124 @@ var clientToolsSchema = z2.array(clientToolManifestEntrySchema).max(MAX_CLIENT_T
 });
 
 // src/contracts/identity.ts
-import { z as z4 } from "zod";
-
-// src/contracts/models.schema.ts
 import { z as z3 } from "zod";
 
+// src/contracts/version.ts
+var HEROUI_AGENT_PROTOCOL_VERSION = 6;
+var HEROUI_AGENT_SDK_VERSION = "0.2.0-beta.8";
+
+// src/contracts/identity.ts
+var agentThemeSchema = z3.enum(["light", "dark", "system"]);
+var agentSurfaceVariantSchema = z3.enum([
+  "outline",
+  "plain",
+  "surface",
+  "surface-secondary"
+]);
+var RESERVED_IDENTITY_IDS = /* @__PURE__ */ new Set([
+  "[object object]",
+  "0",
+  "anonymous",
+  "distinct_id",
+  "distinctid",
+  "email",
+  "false",
+  "guest",
+  "id",
+  "nan",
+  "none",
+  "not_authenticated",
+  "null",
+  "true",
+  "undefined"
+]);
+var agentIdentityIdSchema = z3.string().trim().min(1).max(200).refine((value) => !RESERVED_IDENTITY_IDS.has(value.toLowerCase()), {
+  message: "Identity id is reserved"
+});
+var agentAuthIdentitySchema = z3.discriminatedUnion("type", [
+  z3.object({
+    id: agentIdentityIdSchema,
+    type: z3.literal("anonymous")
+  }),
+  z3.object({
+    id: agentIdentityIdSchema,
+    type: z3.literal("user")
+  })
+]);
+var agentAuthProfileSchema = z3.object({
+  avatarUrl: z3.string().trim().pipe(z3.url()).optional(),
+  email: z3.string().trim().max(320).pipe(z3.email()).optional(),
+  name: z3.string().trim().max(120).optional()
+});
+var createAgentAuthTokenRequestSchema = z3.object({
+  /**
+   * Browser-scoped id the SDK passed to the host callback. Sending it together
+   * with an identified `identity` merges that anonymous person's conversations
+   * into the identified user, so history survives login.
+   */
+  anonymousId: agentIdentityIdSchema.optional(),
+  identity: agentAuthIdentitySchema,
+  profile: agentAuthProfileSchema.optional()
+});
+var agentAuthTokenSchema = z3.object({
+  expiresAt: z3.number().int().positive(),
+  token: z3.string().trim().min(1)
+});
+var agentTokenClaimsSchema = z3.object({
+  agentId: z3.string().trim().min(1).max(100),
+  apiKeyId: z3.string().trim().min(1).max(100),
+  aud: z3.literal("heroui-agent"),
+  exp: z3.number().int().positive(),
+  iat: z3.number().int().positive(),
+  iss: z3.literal("https://api.heroui.com"),
+  jti: z3.uuid(),
+  protocolVersion: z3.literal(HEROUI_AGENT_PROTOCOL_VERSION),
+  sub: z3.string().trim().min(1).max(200)
+});
+var AGENT_CONVERSATION_SOURCE = {
+  embed: "embed",
+  preview: "preview"
+};
+var agentProjectConfigSchema = z3.object({
+  agentId: z3.string(),
+  minimumProtocolVersion: z3.literal(HEROUI_AGENT_PROTOCOL_VERSION),
+  name: z3.string().trim().min(1).max(120),
+  protocolVersion: z3.literal(HEROUI_AGENT_PROTOCOL_VERSION),
+  sdkVersion: z3.string().default(HEROUI_AGENT_SDK_VERSION),
+  suggestedPrompts: z3.array(z3.string().trim().min(1).max(160)).max(5),
+  surfaceVariant: agentSurfaceVariantSchema.default("plain"),
+  theme: agentThemeSchema
+});
+
+// src/contracts/messages.ts
+import { z as z4 } from "zod";
+var agentSourceBaseSchema = z4.object({
+  excerpt: z4.string().trim().min(1).max(2e3).optional(),
+  locator: z4.string().trim().min(1).max(160).optional(),
+  sourceId: z4.string().trim().min(1).max(120)
+});
+var safeSourceUrlSchema = z4.string().trim().max(2048).refine((value) => {
+  try {
+    return ["http:", "https:"].includes(new URL(value).protocol);
+  } catch {
+    return false;
+  }
+});
+var agentSourceSchema = z4.union([
+  agentSourceBaseSchema.extend({
+    sourceType: z4.literal("document"),
+    title: z4.string().trim().min(1).max(200)
+  }),
+  agentSourceBaseSchema.extend({
+    sourceType: z4.literal("url").optional(),
+    title: z4.string().trim().min(1).max(200).optional(),
+    url: safeSourceUrlSchema
+  })
+]);
+var agentSourcesSchema = z4.object({
+  items: z4.array(agentSourceSchema).min(1).max(16)
+});
+
 // src/contracts/models.ts
 var AGENT_MODEL_IDS = [
   "moonshotai/Kimi-K3",
@@ -2178,228 +2292,17 @@ function getAgentModelTier(modelId) {
 }
 
 // src/contracts/models.schema.ts
-var agentModelIdSchema = z3.preprocess(
+import { z as z5 } from "zod";
+var agentModelIdSchema = z5.preprocess(
   (value) => typeof value === "string" ? resolveAgentModelId(value) : value,
-  z3.enum(AGENT_MODEL_IDS)
+  z5.enum(AGENT_MODEL_IDS)
 );
 
-// src/contracts/version.ts
-var HEROUI_AGENT_PROTOCOL_VERSION = 5;
-var HEROUI_AGENT_SDK_VERSION = "0.2.0-beta.6";
-var HEROUI_AGENT_TASK_ID = "heroui-agents-runtime";
-var TRUSTED_AGENT_CLIENT_DATA_KEY = "__heroUiAgentApi";
-
-// src/contracts/identity.ts
-var agentThemeSchema = z4.enum(["light", "dark", "system"]);
-var agentSurfaceVariantSchema = z4.enum([
-  "outline",
-  "plain",
-  "surface",
-  "surface-secondary"
-]);
-var pageContextSchema = z4.record(z4.string().max(100), z4.unknown());
-var RESERVED_IDENTITY_IDS = /* @__PURE__ */ new Set([
-  "[object object]",
-  "0",
-  "anonymous",
-  "distinct_id",
-  "distinctid",
-  "email",
-  "false",
-  "guest",
-  "id",
-  "nan",
-  "none",
-  "not_authenticated",
-  "null",
-  "true",
-  "undefined"
-]);
-var agentIdentityIdSchema = z4.string().trim().min(1).max(200).refine((value) => !RESERVED_IDENTITY_IDS.has(value.toLowerCase()), {
-  message: "Identity id is reserved"
-});
-var agentAuthIdentitySchema = z4.discriminatedUnion("type", [
-  z4.object({
-    id: agentIdentityIdSchema,
-    type: z4.literal("anonymous")
-  }),
-  z4.object({
-    id: agentIdentityIdSchema,
-    type: z4.literal("user")
-  })
-]);
-var agentAuthProfileSchema = z4.object({
-  avatarUrl: z4.string().trim().pipe(z4.url()).optional(),
-  email: z4.string().trim().max(320).pipe(z4.email()).optional(),
-  name: z4.string().trim().max(120).optional()
-});
-var createAgentAuthTokenRequestSchema = z4.object({
-  /**
-   * Browser-scoped id the SDK passed to the host callback. Sending it together
-   * with an identified `identity` merges that anonymous person's conversations
-   * into the identified user, so history survives login.
-   */
-  anonymousId: agentIdentityIdSchema.optional(),
-  identity: agentAuthIdentitySchema,
-  profile: agentAuthProfileSchema.optional()
-});
-var agentAuthTokenSchema = z4.object({
-  expiresAt: z4.number().int().positive(),
-  token: z4.string().trim().min(1)
-});
-var agentTokenClaimsSchema = z4.object({
-  agentId: z4.string().trim().min(1).max(100),
-  apiKeyId: z4.string().trim().min(1).max(100),
-  aud: z4.literal("heroui-agent"),
-  exp: z4.number().int().positive(),
-  iat: z4.number().int().positive(),
-  iss: z4.literal("https://api.heroui.com"),
-  jti: z4.uuid(),
-  protocolVersion: z4.literal(HEROUI_AGENT_PROTOCOL_VERSION),
-  sub: z4.string().trim().min(1).max(200)
-});
-var trustedAgentClientDataSchema = z4.object({
-  agentId: z4.string(),
-  billingLicenseId: z4.string().nullable(),
-  billingOwnerUserId: z4.string(),
-  /**
-   * Browser-declared client tools the embed can execute for this turn. The
-   * runtime registers them as model-visible tools without an execute function.
-   */
-  clientTools: clientToolsSchema.default([]),
-  conversationId: z4.uuid(),
-  /**
-   * Pseudonymous identity used by persisted conversations. This is signed by
-   * the API so the runtime can link telemetry without handling a raw identity.
-   */
-  endUserKey: z4.string().trim().min(1).max(200).optional(),
-  /**
-   * When web search is enabled, allow image results via `includeImages`.
-   * Defaults to true at the host when omitted; optional here so signed
-   * payloads without the field stay valid and keep image search on.
-   */
-  imageSearch: z4.boolean().optional(),
-  /**
-   * Optional browser-selected OpenRouter model. The API accepts only the
-   * fixed agent allowlist and signs the value before the runtime sees it.
-   */
-  modelId: agentModelIdSchema.optional(),
-  /**
-   * When web search is enabled, allow recent news results via `includeNews`.
-   * Optional and disabled when omitted so older signed payloads remain valid.
-   */
-  newsSearch: z4.boolean().optional(),
-  pageContext: pageContextSchema.default({}),
-  /**
-   * Set by the API when the session was authorized by a dashboard preview
-   * credential rather than a host API key, so operator traffic can be separated
-   * from real visitors. Optional (not defaulted) to keep older signed payloads
-   * valid.
-   */
-  preview: z4.boolean().optional(),
-  protocolVersion: z4.literal(HEROUI_AGENT_PROTOCOL_VERSION),
-  requestId: z4.uuid(),
-  sdkVersion: z4.string().trim().min(1).max(80),
-  signedAt: z4.number(),
-  subject: z4.string(),
-  /**
-   * Host-enabled public web search. When true the runtime registers the
-   * `searchWeb` tool (if the search backend is configured) so the agent can
-   * look up public information, images, and optionally news. Optional (not defaulted) so schema
-   * parsing never injects a field into an already-signed payload.
-   */
-  webSearch: z4.boolean().optional()
-});
-var signedTrustedAgentClientDataSchema = trustedAgentClientDataSchema.extend({
-  sig: z4.string().min(1)
-});
-var AGENT_CONVERSATION_SOURCE = {
-  embed: "embed",
-  preview: "preview"
-};
-var agentProjectConfigSchema = z4.object({
-  agentId: z4.string(),
-  minimumProtocolVersion: z4.literal(HEROUI_AGENT_PROTOCOL_VERSION),
-  name: z4.string().trim().min(1).max(120),
-  /**
-   * InstantDB app used for ephemeral live-conversation presence. Optional so
-   * newer SDKs remain compatible with older Agent API deployments.
-   */
-  presence: z4.object({ appId: z4.uuid() }).optional(),
-  protocolVersion: z4.literal(HEROUI_AGENT_PROTOCOL_VERSION),
-  sdkVersion: z4.string().default(HEROUI_AGENT_SDK_VERSION),
-  suggestedPrompts: z4.array(z4.string().trim().min(1).max(160)).max(5),
-  surfaceVariant: agentSurfaceVariantSchema.default("plain"),
-  theme: agentThemeSchema
-});
-
-// src/contracts/messages.ts
-import { z as z5 } from "zod";
-var agentSourceBaseSchema = z5.object({
-  excerpt: z5.string().trim().min(1).max(2e3).optional(),
-  locator: z5.string().trim().min(1).max(160).optional(),
-  sourceId: z5.string().trim().min(1).max(120)
-});
-var safeSourceUrlSchema = z5.string().trim().max(2048).refine((value) => {
-  try {
-    return ["http:", "https:"].includes(new URL(value).protocol);
-  } catch {
-    return false;
-  }
-});
-var agentSourceSchema = z5.union([
-  agentSourceBaseSchema.extend({
-    sourceType: z5.literal("document"),
-    title: z5.string().trim().min(1).max(200)
-  }),
-  agentSourceBaseSchema.extend({
-    sourceType: z5.literal("url").optional(),
-    title: z5.string().trim().min(1).max(200).optional(),
-    url: safeSourceUrlSchema
-  })
-]);
-var agentSourcesSchema = z5.object({
-  items: z5.array(agentSourceSchema).min(1).max(16)
-});
-
-// src/contracts/trusted.ts
-function canonicalize(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
-  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key2, entryValue]) => `${JSON.stringify(key2)}:${canonicalize(entryValue)}`);
-  return `{${entries.join(",")}}`;
-}
-function timingSafeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let mismatch = 0;
-  for (let index = 0; index < a.length; index += 1) {
-    mismatch |= a.charCodeAt(index) ^ b.charCodeAt(index);
-  }
-  return mismatch === 0;
-}
-async function hmacHex(secret, input) {
-  const key2 = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { hash: "SHA-256", name: "HMAC" },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", key2, new TextEncoder().encode(input));
-  return Array.from(new Uint8Array(signature), (byte) => byte.toString(16).padStart(2, "0")).join(
-    ""
-  );
-}
-async function signTrustedAgentClientData(secret, data) {
-  return { ...data, sig: await hmacHex(secret, canonicalize(data)) };
-}
-async function verifyTrustedAgentClientData(secret, value) {
-  if (!value || typeof value !== "object") return null;
-  const { sig, ...data } = value;
-  if (typeof sig !== "string" || !sig) return null;
-  const expected = await hmacHex(secret, canonicalize(data));
-  return timingSafeEqual(sig, expected) ? data : null;
-}
+// src/contracts/runtime.ts
+var HEROUI_AGENT_RUNTIME_TIMING_EVENT = "heroui-agent:runtime-timing";
+var HEROUI_AGENT_TURN_ADMITTED_FRAME_TYPE = "heroui_agent_turn_admitted";
+var HEROUI_AGENT_TURN_ADMISSION_STATUS_METHOD = "getTurnAdmissionStatuses";
+var HEROUI_AGENT_TURN_ADMISSION_STATUS_MAX_IDS = 50;
 export {
   AGENT_CONVERSATION_SOURCE,
   AGENT_MODEL_IDS,
@@ -2420,15 +2323,17 @@ export {
   HEROUI_AGENT_MAX_ATTACHMENTS,
   HEROUI_AGENT_PROTOCOL_VERSION,
   HEROUI_AGENT_REMOTE_CONFIG_VERSION,
+  HEROUI_AGENT_RUNTIME_TIMING_EVENT,
   HEROUI_AGENT_SDK_VERSION,
-  HEROUI_AGENT_TASK_ID,
   HEROUI_AGENT_TEXT_ATTACHMENT_CONTENT_TYPES,
+  HEROUI_AGENT_TURN_ADMISSION_STATUS_MAX_IDS,
+  HEROUI_AGENT_TURN_ADMISSION_STATUS_METHOD,
+  HEROUI_AGENT_TURN_ADMITTED_FRAME_TYPE,
   LEGACY_AGENT_MODEL_IDS,
   MAX_CLIENT_TOOLS,
   MAX_CLIENT_TOOLS_BYTES,
   RESERVED_AGENT_TOOL_NAMES,
   RESERVED_AGENT_TOOL_PREFIX,
-  TRUSTED_AGENT_CLIENT_DATA_KEY,
   accordionComponentSchema,
   actionGroupComponentSchema,
   agentAuthIdentitySchema,
@@ -2503,7 +2408,6 @@ export {
   meterListComponentSchema,
   metricGridComponentSchema,
   numberFormatSchema,
-  pageContextSchema,
   parseAgentRemoteConfig,
   pieChartComponentSchema,
   playerCardComponentSchema,
@@ -2525,8 +2429,6 @@ export {
   rowComponentSchema,
   sankeyChartComponentSchema,
   scatterChartComponentSchema,
-  signTrustedAgentClientData,
-  signedTrustedAgentClientDataSchema,
   spacerComponentSchema,
   stepsComponentSchema,
   sunburstChartComponentSchema,
@@ -2535,8 +2437,6 @@ export {
   tagListComponentSchema,
   textComponentSchema,
   toggleGroupComponentSchema,
-  trustedAgentClientDataSchema,
-  verifyTrustedAgentClientData,
   viewEventComponentSchema,
   weatherConditionSchema,
   weatherConditions,