@promptbook/utils 0.112.0-133 → 0.112.0-135

package/esm/src/avatars/types/AvatarVisualDefinition.d.ts

@@ -7,7 +7,7 @@ import type { AvatarDefinition } from './AvatarDefinition';
  *
  * @private shared contract for the avatar rendering system
  */
-export type AvatarVisualId = 'pixel-art' | 'octopus' | 'octopus2' | 'octopus3' | 'octopus3d' | 'octopus3d2' | 'octopus3d3' | 'ascii-octopus' | 'minecraft' | 'minecraft2' | 'fractal' | 'orb';
+export type AvatarVisualId = 'pixel-art' | 'octopus' | 'octopus2' | 'octopus3' | 'octopus3d' | 'octopus3d2' | 'octopus3d3' | 'octopus3d4' | 'ascii-octopus' | 'minecraft' | 'minecraft2' | 'fractal' | 'orb';
 /**
  * Derived color palette used by avatar visuals.
  *

package/esm/src/avatars/visuals/octopus3d4AvatarVisual.d.ts

@@ -0,0 +1,7 @@
+import type { AvatarVisualDefinition } from '../types/AvatarVisualDefinition';
+/**
+ * Octopus 3D 4 avatar visual.
+ *
+ * @private built-in avatar visual
+ */
+export declare const octopus3d4AvatarVisual: AvatarVisualDefinition;

package/esm/src/utils/validators/url/isValidAgentUrl.d.ts

@@ -8,6 +8,11 @@ import type { really_unknown } from '../../organization/really_unknown';
  * - `isValidAgentUrl` *(this one)* which tests just agent URL
  * - `isValidPipelineUrl` which tests just pipeline URL
  *
+ * Note: This is a pure structural validator and does not block private/internal network
+ * addresses. Callers that fetch the URL server-side from an untrusted network context must
+ * additionally apply the `assertSafeUrl` SSRF guard from the Agents Server before any
+ * outbound request.
+ *
  * @public exported from `@promptbook/utils`
  */
 export declare function isValidAgentUrl(url: really_unknown): url is string_agent_url;

package/esm/src/version.d.ts

@@ -15,7 +15,7 @@ export declare const BOOK_LANGUAGE_VERSION: string_semantic_version;
 export declare const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version;
 /**
  * Represents the version string of the Promptbook engine.
- * It follows semantic versioning (e.g., `0.112.0-132`).
+ * It follows semantic versioning (e.g., `0.112.0-133`).
  *
  * @generated
  */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@promptbook/utils",
-    "version": "0.112.0-133",
+    "version": "0.112.0-135",
     "description": "Promptbook: Create persistent AI agents that turn your company's scattered knowledge into action",
     "private": false,
     "sideEffects": false,

package/umd/index.umd.js

@@ -23,7 +23,7 @@
      * @generated
      * @see https://github.com/webgptorg/promptbook
      */
-    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-133';
+    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-135';
     /**
      * TODO: string_promptbook_version should be constrained to the all versions of Promptbook engine
      * Note: [💞] Ignore a discrepancy between file name and entity name
@@ -5984,6 +5984,11 @@
      * - `isValidAgentUrl` *(this one)* which tests just agent URL
      * - `isValidPipelineUrl` which tests just pipeline URL
      *
+     * Note: This is a pure structural validator and does not block private/internal network
+     * addresses. Callers that fetch the URL server-side from an untrusted network context must
+     * additionally apply the `assertSafeUrl` SSRF guard from the Agents Server before any
+     * outbound request.
+     *
      * @public exported from `@promptbook/utils`
      */
     function isValidAgentUrl(url) {
@@ -5997,12 +6002,6 @@
             // TODO: [🐠]
             return false;
         }
-        /*
-        Note: [👣][🧠] Is it secure to allow pipeline URLs on private and unsecured networks?
-        if (isUrlOnPrivateNetwork(url)) {
-            return false;
-        }
-        */
         return true;
     }
     // TODO: [🐠] Maybe more info why the URL is invalid