@promptbook/openai 0.112.0-98 → 0.112.0

package/esm/src/collection/agent-collection/constructors/agent-collection-in-supabase/AgentCollectionInSupabase.d.ts

@@ -60,6 +60,28 @@ export declare class AgentCollectionInSupabase {
      * Gets all agents in the collection
      */
     listAgents(): Promise<ReadonlyArray<AgentBasicInformation>>;
+    /**
+     * Finds one active agent profile by its human-readable name or permanent id.
+     *
+     * This keeps route-level lookups from loading the whole agent collection when only
+     * one canonical route identifier is needed.
+     *
+     * @param agentNameOrPermanentId - Agent name or stable permanent identifier.
+     * @returns Matching active agent profile or `null` when not found.
+     *
+     * @public exported from `@promptbook/core`
+     */
+    findAgentBasicInformation(agentNameOrPermanentId: string_agent_name | string_agent_permanent_id): Promise<AgentBasicInformation | null>;
+    /**
+     * Converts one database row into public agent information.
+     *
+     * @param row - Database row carrying the persisted profile snapshot.
+     * @param isVerbose - Whether profile-name mismatches should be logged.
+     * @returns Agent profile with canonical database name and permanent id.
+     *
+     * @private internal helper of `AgentCollectionInSupabase`
+     */
+    private mapAgentBasicInformationRow;
     /**
      * Retrieves the permanent ID of an agent by its name or permanent ID.
      */

package/esm/src/commitments/_common/teamInternalAgentAccess.d.ts

@@ -26,7 +26,15 @@ export type TeamInternalAgentAccessHeadersOptions = {
 /**
  * Resolves the internal token used by same-server TEAM calls.
  *
- * @returns Hashed token, or `null` when the server does not have a private secret.
+ * `PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN` must be a dedicated secret — falling
+ * back to `ADMIN_PASSWORD`, `SUPABASE_SERVICE_ROLE_KEY`, or any other shared
+ * credential would let a leak of one secret compromise both authentication
+ * boundaries (admin login and same-server teammate-agent access). When the
+ * dedicated variable is missing, this function returns `null` so the calling
+ * server fails closed — same-server TEAM access is disabled and no header is
+ * sent — instead of silently authorizing requests with the wrong secret.
+ *
+ * @returns Hashed token, or `null` when the dedicated secret is not configured.
  *
  * @private internal Agents Server access wiring
  */

package/esm/src/llm-providers/_common/register/$provideLlmToolsConfigurationFromEnv.d.ts

@@ -6,7 +6,7 @@ import type { LlmToolsConfiguration } from './LlmToolsConfiguration';
  *
  * It looks for environment variables:
  * - `process.env.OPENAI_API_KEY`
- * - `process.env.ANTHROPIC_CLAUDE_API_KEY`
+ * - `process.env.ANTHROPIC_API_KEY` (or the deprecated `process.env.ANTHROPIC_CLAUDE_API_KEY`)
  * - ...
  *
  * @see Environment variables documentation or .env file for required variables.

package/esm/src/llm-providers/_common/register/$provideLlmToolsFromEnv.d.ts

@@ -13,7 +13,7 @@ import type { CreateLlmToolsFromConfigurationOptions } from './createLlmToolsFro
  *
  * It looks for environment variables:
  * - `process.env.OPENAI_API_KEY`
- * - `process.env.ANTHROPIC_CLAUDE_API_KEY`
+ * - `process.env.ANTHROPIC_API_KEY` (or the deprecated `process.env.ANTHROPIC_CLAUDE_API_KEY`)
  * - ...
  *
  * @param options Configuration options for the LLM tools

package/esm/src/scrapers/website/utils/createShowdownConverter.d.ts

@@ -1,7 +1,7 @@
-import { Converter as ShowdownConverter } from 'showdown';
+import showdown from 'showdown';
 /**
  * Create a new showdown converter instance
  *
  * @private utility of `WebsiteScraper`
  */
-export declare function createShowdownConverter(): ShowdownConverter;
+export declare function createShowdownConverter(): showdown.Converter;

package/esm/src/utils/isTimingSafeEqualString.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Compares two strings in constant time to prevent timing attacks.
+ *
+ * Plain JavaScript `===` / `!==` string comparisons short-circuit on the first
+ * byte that differs, which lets a remote attacker who can measure response
+ * timing recover the expected value one byte at a time. This helper performs
+ * the comparison through Node's `timingSafeEqual`, which always inspects every
+ * byte of the equal-length buffers.
+ *
+ * Returning `false` early when the byte lengths differ does not expose
+ * character content — only length — which is an acceptable trade-off, since
+ * `timingSafeEqual` requires equal-length buffers and length is typically not
+ * secret.
+ *
+ * `null` and `undefined` inputs are treated as non-matching so callers can
+ * forward raw request values (for example `request.headers.get(name)`) without
+ * an extra guard.
+ *
+ * @param candidate - Value supplied by the caller (for example a request header or cookie).
+ * @param expected - Value to compare against (for example a configured secret).
+ * @returns `true` when both values are strings of equal length with identical bytes.
+ *
+ * @private internal helper function
+ */
+export declare function isTimingSafeEqualString(candidate: string | null | undefined, expected: string | null | undefined): boolean;

package/esm/src/utils/validators/url/isValidAgentUrl.d.ts

@@ -8,6 +8,11 @@ import type { really_unknown } from '../../organization/really_unknown';
  * - `isValidAgentUrl` *(this one)* which tests just agent URL
  * - `isValidPipelineUrl` which tests just pipeline URL
  *
+ * Note: This is a pure structural validator and does not block private/internal network
+ * addresses. Callers that fetch the URL server-side from an untrusted network context must
+ * additionally apply the `assertSafeUrl` SSRF guard from the Agents Server before any
+ * outbound request.
+ *
  * @public exported from `@promptbook/utils`
  */
 export declare function isValidAgentUrl(url: really_unknown): url is string_agent_url;

package/esm/src/version.d.ts

@@ -15,7 +15,7 @@ export declare const BOOK_LANGUAGE_VERSION: string_semantic_version;
 export declare const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version;
 /**
  * Represents the version string of the Promptbook engine.
- * It follows semantic versioning (e.g., `0.112.0-97`).
+ * It follows semantic versioning (e.g., `0.112.0-140`).
  *
  * @generated
  */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@promptbook/openai",
-    "version": "0.112.0-98",
+    "version": "0.112.0",
     "description": "Promptbook: Create persistent AI agents that turn your company's scattered knowledge into action",
     "private": false,
     "sideEffects": false,
@@ -106,13 +106,13 @@
     "types": "./esm/src/_packages/openai.index.d.ts",
     "typings": "./esm/src/_packages/openai.index.d.ts",
     "peerDependencies": {
-        "@promptbook/core": "0.112.0-98"
+        "@promptbook/core": "0.112.0"
     },
     "dependencies": {
         "@openai/agents": "0.4.15",
         "bottleneck": "2.19.5",
         "colors": "1.4.0",
-        "crypto": "1.0.1",
+        "crypto-js": "4.2.0",
         "openai": "6.18.0",
         "socket.io-client": "4.7.5",
         "spacetrim": "0.11.60"

package/umd/index.umd.js

@@ -1,11 +1,12 @@
 (function (global, factory) {
-    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('spacetrim'), require('crypto'), require('colors'), require('bottleneck'), require('openai'), require('socket.io-client'), require('@openai/agents')) :
-    typeof define === 'function' && define.amd ? define(['exports', 'spacetrim', 'crypto', 'colors', 'bottleneck', 'openai', 'socket.io-client', '@openai/agents'], factory) :
-    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global["promptbook-openai"] = {}, global.spacetrim, global.crypto, global.colors, global.Bottleneck, global.OpenAI, global.socket_ioClient, global.agents));
-})(this, (function (exports, spacetrim, crypto, colors, Bottleneck, OpenAI, socket_ioClient, agents) { 'use strict';
+    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('spacetrim'), require('crypto-js'), require('colors'), require('bottleneck'), require('openai'), require('socket.io-client'), require('@openai/agents')) :
+    typeof define === 'function' && define.amd ? define(['exports', 'spacetrim', 'crypto-js', 'colors', 'bottleneck', 'openai', 'socket.io-client', '@openai/agents'], factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global["promptbook-openai"] = {}, global.spacetrim, global.CryptoJS, global.colors, global.Bottleneck, global.OpenAI, global.socket_ioClient, global.agents));
+})(this, (function (exports, spacetrim, CryptoJS, colors, Bottleneck, OpenAI, socket_ioClient, agents) { 'use strict';
 
     function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
+    var CryptoJS__default = /*#__PURE__*/_interopDefaultLegacy(CryptoJS);
     var colors__default = /*#__PURE__*/_interopDefaultLegacy(colors);
     var Bottleneck__default = /*#__PURE__*/_interopDefaultLegacy(Bottleneck);
     var OpenAI__default = /*#__PURE__*/_interopDefaultLegacy(OpenAI);
@@ -24,7 +25,7 @@
      * @generated
      * @see https://github.com/webgptorg/promptbook
      */
-    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-98';
+    const PROMPTBOOK_ENGINE_VERSION = '0.112.0';
     /**
      * TODO: string_promptbook_version should be constrained to the all versions of Promptbook engine
      * Note: [💞] Ignore a discrepancy between file name and entity name
@@ -114,7 +115,7 @@
      * @private internal helper function
      */
     function $randomToken(randomness) {
-        return crypto.randomBytes(randomness).toString('hex');
+        return CryptoJS__default["default"].lib.WordArray.random(randomness).toString(CryptoJS__default["default"].enc.Hex);
     }
     // TODO: [🤶] Maybe export through `@promptbook/utils` or `@promptbook/random` package
     // TODO: Maybe use nanoid instead https://github.com/ai/nanoid
@@ -6764,7 +6765,7 @@
                     return { skippedReason: 'invalid_data_url' };
                 }
                 return {
-                    file: new File([parsed.buffer], parsed.filename, {
+                    file: new File([new Uint8Array(parsed.buffer)], parsed.filename, {
                         type: parsed.mimeType,
                     }),
                     sizeBytes: parsed.buffer.length,
@@ -8460,7 +8461,9 @@
             if (!executionTools || !executionTools.script) {
                 throw new PipelineExecutionError(`Model requested tools but no executionTools.script were provided in OpenAiAgentKitExecutionTools options`);
             }
-            return Array.isArray(executionTools.script) ? executionTools.script : [executionTools.script];
+            return Array.isArray(executionTools.script)
+                ? executionTools.script
+                : [executionTools.script];
         }
         /**
          * Resolves the assistant-visible AgentKit tool response while preserving structured tool result data.