@proveanything/smartlinks 2.0.9 → 2.0.11

package/dist/docs/ai.md

@@ -257,6 +257,85 @@ const response = await ai.chat.responses.create('my-collection', {
 console.log(response.output);
 ```
 
+### Server-side tools (built-in agent loop)
+
+The example above is **client-relayed** tool calling: you define the tools, the model returns
+`tool_call` requests, and *your app* executes them and sends results back. For the common tools —
+reading and searching the web, vision, reading documents, generating images — the platform ships a
+curated, tested **built-in toolset it runs itself**. Opt in with `server_tools` and the server
+executes each tool and feeds the result back automatically, looping until the model has its answer.
+You get one final response; no relay code.
+
+```typescript
+// Enable the whole built-in toolset:
+const res = await ai.chat.responses.create('my-collection', {
+  model: 'balanced',
+  input: 'Research acme.com and summarise what they sell, with their brand colours.',
+  server_tools: true
+});
+console.log(res.output_text);
+console.log(res._agent.toolResults); // trace: which tools ran, with what result
+```
+
+Scope it to specific tools (recommended — smaller blast radius, faster), by name or capability:
+
+```typescript
+import { AI_TOOL_NAMES } from '@proveanything/smartlinks';
+
+const res = await ai.chat.responses.create('my-collection', {
+  input: 'Find the current price of this product and return it as JSON.',
+  server_tools: [AI_TOOL_NAMES.WEB_SEARCH, AI_TOOL_NAMES.DATA_EXTRACT],
+  // or: allowCapabilities: ['web:read'],   exclude: ['image.generate'],
+  maxSteps: 6 // cap model round-trips (1–12, default 8)
+});
+```
+
+**Streaming** surfaces tool progress as it happens — ideal for a "thinking…" UI. You get
+`agent.tool_call` / `agent.tool_result` events, then a final `response.completed`:
+
+```typescript
+const stream = await ai.chat.responses.create('my-collection', {
+  input: 'Research acme.com', server_tools: true, stream: true
+});
+for await (const ev of stream) {
+  if (ev.type === 'agent.tool_call')   showStep(`Running ${ev.name}…`);
+  if (ev.type === 'agent.tool_result') showStep(`${ev.name} done`);
+  if (ev.type === 'response.completed') render(ev.response.output_text);
+}
+```
+
+`server_tools` can't be combined with `previous_response_id`/`conversation` yet — pass prior turns
+in `input`.
+
+#### Built-in tools
+
+| Tool | Does |
+|------|------|
+| `web.search` | Live web search → candidate results (url/title/description). |
+| `web.fetchPage` | Fetch a page → clean markdown + metadata + schema.org JSON-LD. |
+| `web.extractSchema` | Return only a page's schema.org data of a given `@type` (deterministic). |
+| `document.read` | Read a document at a URL — **PDF, deck, doc**, or article — into markdown. |
+| `data.extract` | Page + JSON-schema/prompt → **typed JSON** (turn a page into UI data). |
+| `brand.assets` | Extract a site's logo, colours, and design. |
+| `web.screenshot` | Screenshot a page → hosted image URL (feed to `image.describe`). |
+| `image.describe` | Vision: describe an image / read its text. |
+| `image.generate` | Generate an image from a prompt → hosted URL. |
+| `image.fromReference` | Image-to-image: generate guided by reference image(s). |
+| `image.searchStock` | Search real stock photos (Unsplash). |
+| `image.transform` | Resize / crop / rotate / grayscale / format-convert / compress → hosted URL. |
+| `pdf.create` | Render HTML → PDF → hosted URL. |
+| `pdf.fill` | Fill an AcroForm PDF's fields → hosted URL. |
+| `pdf.merge` | Merge several PDFs into one → hosted URL. |
+| `http.request` | SSRF-guarded outbound HTTP(S) to a public URL (call a REST API). |
+| `translate` | Translate text into one or more languages (generic, model-based). |
+
+Discover tools two ways:
+- **Design time (typed):** import `BUILTIN_AI_TOOLS`, `AI_TOOL_NAMES`, and the per-tool arg types
+  (`WebSearchArgs`, `DataExtractArgs`, …) from the SDK. This is the core set — stable, versioned,
+  documented here.
+- **Runtime (live):** `await ai.catalog(collectionId)` returns the registry as the server sees it,
+  including any future app-contributed tools. The built-in set above is always present.
+
 ### Recommended Models
 
 For agentic workflows on `v1/responses`, GPT-5.6 ships in three tiers. Pass either the full model

package/dist/docs/app-manifest.md

@@ -42,7 +42,7 @@ The manifest is loaded automatically by the platform for every collection page.
     "version": "1.2.0",
     "platformRevision": "R5",
     "moduleFormat": "dual",
-    "sharedDependencies": "v5"
+    "sharedDependencies": "v6"
   },
 
   "admin": "app.admin.json",
@@ -148,7 +148,7 @@ The manifest is loaded automatically by the platform for every collection page.
 | `version` | string | ✅ | SemVer string, e.g. `"1.2.0"` |
 | `platformRevision` | string | ❌ | Platform revision tag this build targets, e.g. `"R5"` (see [host-dependency-contract.md](host-dependency-contract.md)) |
 | `moduleFormat` | `"umd"` \| `"esm"` \| `"dual"` | ❌ | How the host loads this app's bundles. Absent = `"umd"`. See [Module format](#module-format-umd-vs-esm) below. |
-| `sharedDependencies` | string | ❌ | Shared-dependency contract version the bundle was built against, e.g. `"v5"`. Used by the host to pick a compatible ESM import map. |
+| `sharedDependencies` | string | ❌ | Shared-dependency contract version the bundle was built against, e.g. `"v6"`. Used by the host to pick a compatible ESM import map. |
 | `globals` | object | ❌ | Per-app namespaced UMD globals (R4.7+), e.g. `{ "widgets": "MyAppWidgets" }`. UMD-only; ESM bundles don't need it. |
 | `seo.priority` | number | ❌ | Controls which app's `title`/`description`/`ogImage` wins when multiple apps are on the same page. Default `0`; higher wins. See the [Executor guide](executor.md). |
 
@@ -646,6 +646,8 @@ SmartLinks manifests are **AI-discoverable, -configurable, and -importable**: th
 
 When you change your config shape, keep all three in sync: `app.manifest.json` (widget `settings`, containers, executor, linkable), `app.admin.json` (setup / import / tunable), and `ai-guide.md` (prose guidance).
 
+This declarative model is canonical and works today. An app may **optionally** layer agent tools on top — a function that reads the declaration and returns a *context-adapted* result (e.g. "which setup questions for this collection?") — without changing the schema. That's additive and opt-in; see [agent-tools.md](agent-tools.md).
+
 ## Reading the Files at Runtime
 
 ### Manifest — available from the widgets endpoint

package/dist/docs/host-dependency-contract.md

@@ -32,7 +32,7 @@ export default defineConfig({
         'react', 'react-dom', 'react/jsx-runtime',
         '@proveanything/smartlinks',
         'react-router-dom', '@tanstack/react-query',
-        'lucide-react', 'date-fns', 'liquidjs', 'class-variance-authority',
+        'lucide-react', 'date-fns', 'liquidjs', 'marked', 'class-variance-authority',
         '@radix-ui/react-slot', '@radix-ui/react-dialog', '@radix-ui/react-popover',
         '@radix-ui/react-tooltip', '@radix-ui/react-tabs', '@radix-ui/react-accordion',
         '@radix-ui/react-select', '@radix-ui/react-scroll-area', '@radix-ui/react-label',
@@ -44,7 +44,7 @@ export default defineConfig({
           '@proveanything/smartlinks': 'SL',
           'react-router-dom': 'ReactRouterDOM', '@tanstack/react-query': 'ReactQuery',
           'lucide-react': 'LucideReact', 'date-fns': 'dateFns', 'liquidjs': 'LiquidJS',
-          'class-variance-authority': 'CVA',
+          'marked': 'marked', 'class-variance-authority': 'CVA',
           '@radix-ui/react-slot': 'RadixSlot', '@radix-ui/react-dialog': 'RadixDialog',
           '@radix-ui/react-popover': 'RadixPopover', '@radix-ui/react-tooltip': 'RadixTooltip',
           '@radix-ui/react-tabs': 'RadixTabs', '@radix-ui/react-accordion': 'RadixAccordion',
@@ -71,6 +71,7 @@ export default defineConfig({
 | `lucide-react` | `LucideReact` | 1.47 |
 | `date-fns` | `dateFns` | 4.4 |
 | `liquidjs` | `LiquidJS` | 10.27+ |
+| `marked` | `marked` | 12+ |
 | `class-variance-authority` | `CVA` | 0.7 |
 | `@radix-ui/react-slot` | `RadixSlot` | 1.2.4 |
 | `@radix-ui/react-dialog` | `RadixDialog` | 1.1.23 |
@@ -85,7 +86,10 @@ export default defineConfig({
 | `@radix-ui/react-progress` | `RadixProgress` | 1.1.8 |
 | `@radix-ui/react-avatar` | `RadixAvatar` | 1.1.11 |
 
-`liquidjs` is **host-provided** — externalise it, don't ship a second copy (frequently missed).
+`liquidjs` and `marked` are **host-provided** — externalise them, don't ship a second copy
+(frequently missed). `marked` is new in **contract v6**: the portal and hub render markdown in the
+container, so an app should use the host's renderer rather than bundling its own. `marked` does not
+sanitise HTML — if you render untrusted markdown, sanitise the output (e.g. DOMPurify) yourself.
 
 ## Backwards compatibility
 
@@ -111,7 +115,7 @@ app ships the Tailwind 4 CSS-first layout as the default; see its README.)
 
 React **19.3** · Vite **8.3** · react-router-dom **7.18** · Tailwind **4.3** (CSS-first) ·
 TypeScript **6.0** · ESLint **10.11** · `@proveanything/smartlinks` **2.0.5** ·
-`@proveanything/smartlinks-utils-ui` **1.16.4** · liquidjs **10.29**.
+`@proveanything/smartlinks-utils-ui` **1.16.4** · liquidjs **10.29** · marked **12+**.
 
 > **TypeScript 7** (the native/Go compiler) is **deliberately deferred** — tooling hasn't settled.
 > Target **TS 6** for R5; it compiles existing code with no source changes.
@@ -138,8 +142,8 @@ never drift:
 
 ```ts
 import {
-  SHARED_DEPENDENCY_CONTRACT_VERSION, // 'v5'
-  SHARED_DEPENDENCIES,                // [{ specifier, globalName, minVersion, importMapPath }, …] (25)
+  SHARED_DEPENDENCY_CONTRACT_VERSION, // 'v6'
+  SHARED_DEPENDENCIES,                // [{ specifier, globalName, minVersion, importMapPath }, …] (26)
   SHARED_DEPENDENCY_SPECIFIERS,       // bare specifiers — drop straight into a bundler `external` list
   getHostSharedDependencies,          // what the live host advertises at runtime, or null
 } from '@proveanything/smartlinks'

package/dist/docs/overview.md

@@ -60,7 +60,7 @@ The SmartLinks SDK (`@proveanything/smartlinks`) includes comprehensive document
 | **Mobile Admin Container** | `docs/mobile-admin-container.md` | Building a separate Capacitor-aware mobile admin bundle for field operators |
 | **Executors** | `docs/executor.md` | Building executor bundles for SEO, LLM content, programmatic config |
 | **Server Functions** | `docs/server-functions.md` | App-authored server-side functions `(ctx, event) ⇒ result`: security model, runtime surface, invoking |
-| **Agent Tools** | `docs/agent-tools.md` | Exposing your app's actions to the SmartLinks agent — an MCP facade over server functions; declare now, live loop staged; replaces `app.admin.json` AI setup |
+| **Agent Tools** | `docs/agent-tools.md` | Exposing your app's actions to the SmartLinks agent — an MCP facade over server functions; **opt-in per app, additive, no migration**; complements `app.admin.json` (functions serve/adapt it, don't replace it); live loop staged |
 | **Deploying & Registering** | `docs/deploying-apps.md` | Getting your app into the platform: fast dev publish, channels, deploy keys, registering releases |
 | **Host Dependency Contract (R5)** | `docs/host-dependency-contract.md` | The libraries the host provides (React 19, Router 7, Radix, liquidjs, …), the externalise-don't-bundle rule + Vite config, and React-18 backwards-compat |
 | **Deep Linking** | `docs/deep-link-discovery.md` | URL state management, navigable states, portal menus, AI nav |

package/dist/index.d.ts

@@ -8,6 +8,8 @@ export { IframeResponder, isAdminFromRoles, buildIframeSrc, } from './iframeResp
 export * as utils from './utils/index.js';
 export { SHARED_DEPENDENCY_CONTRACT_VERSION, SHARED_DEPENDENCIES, SHARED_DEPENDENCY_SPECIFIERS, importMapPathFor, getHostSharedDependencies, } from './shared-dependencies.js';
 export type { SharedDependency, HostSharedDependencies } from './shared-dependencies.js';
+export { AI_TOOL_NAMES, BUILTIN_AI_TOOLS, getBuiltinAiTool } from './ai-tools.js';
+export type { BuiltinAiToolDescriptor } from './ai-tools.js';
 export type { PortalPathParams, Gs1DigitalLinkParams, ConditionParams, ConditionDebugOptions, ConditionDebugLogger, ConditionSet, Condition, UserInfo, ProductInfo, ProofInfo, CollectionInfo, } from './utils/index.js';
 export type { LoginResponse, VerifyTokenResponse, AccountInfoResponse, AuthLocation, } from "./api/auth.js";
 export type { UserAccountRegistrationRequest, } from "./types/auth.js";

package/dist/index.js

@@ -13,4 +13,6 @@ import * as utils_1 from './utils/index.js';
 export { utils_1 as utils };
 // Shared dependency contract (host↔app) — one source of truth for externalized deps
 export { SHARED_DEPENDENCY_CONTRACT_VERSION, SHARED_DEPENDENCIES, SHARED_DEPENDENCY_SPECIFIERS, importMapPathFor, getHostSharedDependencies, } from './shared-dependencies.js';
+// Built-in AI tool catalog (design-time discovery of the core agentic toolset)
+export { AI_TOOL_NAMES, BUILTIN_AI_TOOLS, getBuiltinAiTool } from './ai-tools.js';
 export { HostCapabilityUnavailableError, HostPermissionDeniedError, HostTimeoutError, } from './mobile-admin/errors.js';