@visma-swno/gaia-chat-ui 5.1.0 → 5.2.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [5.2.0](https://github.com/visma-swno/vsn-assistant/compare/web-component@v5.1.0...web-component@v5.2.0) (2026-06-18)
+
+
+### Features
+
+* **api:** allow profiles to hide welcome message sections ([#3054](https://github.com/visma-swno/vsn-assistant/issues/3054)) ([5a0ccc3](https://github.com/visma-swno/vsn-assistant/commit/5a0ccc3418f74d6f1dc08cb9ab97edc70ef7ccf5))
+* **cross-cutting:** standalone Gaia conversational context flow ([#3025](https://github.com/visma-swno/vsn-assistant/issues/3025)) ([971185a](https://github.com/visma-swno/vsn-assistant/commit/971185a20adb1c1d269bcf51c497632bca85bd4d))
+* **web-component:** attach files via drag-and-drop and paste ([#3076](https://github.com/visma-swno/vsn-assistant/issues/3076)) ([516465f](https://github.com/visma-swno/vsn-assistant/commit/516465fd1d926ee53735f9019e05e0db766b4839)), closes [#3067](https://github.com/visma-swno/vsn-assistant/issues/3067)
+* **web-component:** support multiple attachments with redesigned attachment cards ([#3085](https://github.com/visma-swno/vsn-assistant/issues/3085)) ([f151532](https://github.com/visma-swno/vsn-assistant/commit/f1515321e63e3c17729e2c842c6dd666d4f463e6)), closes [#3069](https://github.com/visma-swno/vsn-assistant/issues/3069)
+
+
+### Bug Fixes
+
+* **web-component:** add more missing translations and regenerate locale bundles ([#3060](https://github.com/visma-swno/vsn-assistant/issues/3060)) ([cdc5d4d](https://github.com/visma-swno/vsn-assistant/commit/cdc5d4df24811678a712a14cd54d57f9d9794afc))
+* **web-component:** align attachment icon across host apps ([#3074](https://github.com/visma-swno/vsn-assistant/issues/3074)) ([7eecd02](https://github.com/visma-swno/vsn-assistant/commit/7eecd0216ce7b8f4c15cea30d751b8a087a1141b)), closes [#3068](https://github.com/visma-swno/vsn-assistant/issues/3068)
+* **web-component:** defer health heartbeat first poll until base-url is applied ([#3088](https://github.com/visma-swno/vsn-assistant/issues/3088)) ([7c7b635](https://github.com/visma-swno/vsn-assistant/commit/7c7b635759c9e4874c4674049342778f96f42cd5)), closes [#3086](https://github.com/visma-swno/vsn-assistant/issues/3086)
+* **web-component:** make bootstrap resilient to config version skew ([#3075](https://github.com/visma-swno/vsn-assistant/issues/3075)) ([#3078](https://github.com/visma-swno/vsn-assistant/issues/3078)) ([19fef3e](https://github.com/visma-swno/vsn-assistant/commit/19fef3ee9244a433e398a648809c70753f7e4adc))
+* **web-component:** sanitize attachment URLs and harden canvas CSP placement ([#3032](https://github.com/visma-swno/vsn-assistant/issues/3032)) ([c127f20](https://github.com/visma-swno/vsn-assistant/commit/c127f202ff8e8ac2736a0e29da6e7e80ce40b9da))
+
 ## [5.1.0](https://github.com/visma-swno/vsn-assistant/compare/web-component@v5.0.1...web-component@v5.1.0) (2026-06-09)
 
 

package/dist/app/app.d.ts

@@ -1,7 +1,7 @@
 import { PropertyValues } from 'lit';
 import { StrategyType } from '../core/store';
 import { TokenFetcher } from '../services/auth-service';
-import { FrontendTool, HostContextProvider } from '../types';
+import { FrontendTool, HostContext, HostContextProvider } from '../types';
 import { BaseElement } from '../components/shared/base-element';
 /**
  * Root chat widget component.
@@ -87,6 +87,10 @@ export declare class ChatApp extends BaseElement {
     private supportSessionEnded;
     private historyOpen;
     private settingsOpen;
+    private attachmentsEnabled;
+    private supportConnected;
+    private isDraggingOver;
+    private dragDepth;
     private disposables;
     private ctx;
     private handleInlineQuestionClick;
@@ -103,10 +107,36 @@ export declare class ChatApp extends BaseElement {
     willUpdate(changedProperties: PropertyValues): void;
     private toggleHostAttribute;
     private handleKeyDown;
+    /**
+     * Retroactively update the host-context snapshot for the most recent user
+     * message. Call this after a mid-run context confirmation (e.g. a frontend
+     * tool) so the "Context changed" divider renders immediately.
+     */
+    patchCurrentMessageHostContext(props: Record<string, unknown>): void;
+    /**
+     * Returns the host-context snapshot persisted for the active conversation,
+     * shaped as a {@link HostContext}, or `null` when none is available.
+     *
+     * The localStorage-backed restore path (`loadHistory`) hydrates this snapshot
+     * but does not emit {@link ConversationRestoredEvent}, so a host app that
+     * supplies context via `hostContextProvider` can read it here to keep
+     * follow-up messages scoped to the restored tenant/company after a refresh.
+     */
+    getActiveHostContext(): HostContext | null;
+    /** Whether a file dragged over the widget can currently be attached. */
+    private get canAcceptDrop();
+    private get composer();
+    private dragContainsFiles;
+    private handleDragEnter;
+    private handleDragOver;
+    private handleDragLeave;
+    private handleDrop;
     /** Clears the current conversation and resets the chat. */
     clearConversation(): void;
     /** Stops any active support session. */
     stopSupport(): void;
+    /** Sends a message programmatically after the chat has initialized. */
+    sendMessage(message: string): Promise<void>;
     /**
      * Inject messages for readonly display. Accepts AG-UI format messages
      * (as returned by the inspect API) and runs them through the full message
@@ -117,6 +147,7 @@ export declare class ChatApp extends BaseElement {
      * @param thumbs - Optional map of messageId → "up" | "down" for feedback indicators.
      */
     setReadonlyMessages(messages: ReadonlyArray<Record<string, unknown>>, thumbs?: Readonly<Record<string, string>>): void;
+    private waitForInitialization;
     render(): import('lit-html').TemplateResult<1>;
 }
 declare global {

package/dist/components/canvas/canvas-workspace/canvas-workspace.d.ts

@@ -14,7 +14,7 @@ export declare class CanvasWorkspace extends BaseElement {
     private ctrl;
     private renderPreview;
     private handleRenderResult;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/composer/message-composer.d.ts

@@ -24,10 +24,9 @@ export declare class GaiaMessageComposer extends BaseElement {
     attachmentInput?: HTMLInputElement;
     private value;
     private invalid;
-    private pendingAttachment;
-    private pendingAttachmentPreviewUrl;
+    private pendingAttachments;
     private attachmentError;
-    private uploadingAttachment;
+    private uploadingCount;
     private isRecording;
     private speechSupported;
     private recognition;
@@ -37,6 +36,8 @@ export declare class GaiaMessageComposer extends BaseElement {
     maxRows: number;
     connectedCallback(): void;
     disconnectedCallback(): void;
+    /** Whether an attachment upload is currently in flight. */
+    private get uploadingAttachment();
     private get notAllowedToSendMessage();
     private get canUseVoiceDictation();
     private isMessageNotAllowed;
@@ -53,13 +54,45 @@ export declare class GaiaMessageComposer extends BaseElement {
     private dispatchToSupport;
     private dispatchToAssistant;
     private handleAttachmentButtonClick;
-    private clearPendingAttachment;
+    private clearPendingAttachments;
+    /** Dismisses the attachment error banner without discarding staged attachments. */
+    private dismissAttachmentError;
+    private removePendingAttachment;
     private handleAttachmentSelected;
+    private processAttachmentFiles;
+    private uploadAttachmentFile;
+    /**
+     * Whether a file can currently be accepted as a pending attachment.
+     *
+     * False when attachments are disabled for the profile, the support channel
+     * is active, or the composer is disabled/loading. Callers should check this
+     * before suppressing native browser behaviour (e.g. paste) so they don't
+     * swallow the event without effect. Multiple attachments may be queued, so
+     * an in-flight upload does not block accepting further files.
+     */
+    get canAcceptAttachment(): boolean;
+    /**
+     * Uploads files dropped anywhere on the chat surface as pending attachments.
+     *
+     * Called by the root chat component, which owns the drag-and-drop overlay so
+     * files can be dropped over the entire widget rather than only the composer.
+     * Guards against uploads while attachments are unavailable for the active
+     * channel/profile.
+     */
+    acceptDroppedFiles(files: File[]): Promise<void>;
+    /**
+     * Uploads a single dropped file as a pending attachment.
+     *
+     * Thin wrapper around {@link acceptDroppedFiles} retained for callers that
+     * only have a single file to hand.
+     */
+    acceptDroppedFile(file: File): Promise<void>;
     private handleSuggestedQuestionClick;
     private handleKeyDown;
+    private handlePaste;
     private maybeEmitTyping;
     private createPreviewUrl;
-    private revokePendingAttachmentPreviewUrl;
+    private revokeAllPreviewUrls;
     protected updated(changed: PropertyValues): Promise<void>;
     /** Sets focus on the textarea. */
     focus(options?: FocusOptions): void;
@@ -68,7 +101,9 @@ export declare class GaiaMessageComposer extends BaseElement {
     /** Selects all the text in the textarea. */
     select(): void;
     render(): import('lit-html').TemplateResult<1>;
-    private getPendingAttachmentPreview;
+    private getPendingAttachmentPreviews;
+    private renderPendingAttachmentPreviews;
+    private renderAttachmentError;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/conversation/activity-indicator/activity-indicator.d.ts

@@ -15,7 +15,7 @@ export declare class GaiaActivityIndicator extends BaseElement {
      * The activity type to display.
      */
     activityType?: SupportSessionActivityType;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
     private getActivityContent;
 }
 declare global {

package/dist/components/feedback/consent-dialog.d.ts

@@ -25,7 +25,7 @@ export declare class GaiaConsentDialog extends BaseElement {
      */
     close(): void;
     private handleConsentConfirmed;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/layout/connection-status-overlay/connection-status-overlay.d.ts

@@ -12,7 +12,7 @@ import { BaseElement } from '../../shared/base-element';
 export declare class GaiaConnectionStatusOverlay extends BaseElement {
     static styles: import('lit').CSSResult[];
     private ctrl;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/message/assistant-message.d.ts

@@ -7,7 +7,7 @@ export declare class GaiaAssistantMessage extends BaseElement {
     isStreaming: boolean;
     private bodyEl;
     private expandedToolCallIds;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
     private renderPart;
     private renderToolCall;
     private toggleToolCall;

package/dist/components/message/message-actions.d.ts

@@ -38,7 +38,7 @@ export declare class GaiaMessageActions extends BaseElement {
     private copyTimeoutId?;
     private get hasVisibleActions();
     disconnectedCallback(): void;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
     private renderCopyButton;
     private renderFeedbackButtons;
     private renderFeedbackIndicator;

package/dist/components/message/message-attachments.d.ts

@@ -6,12 +6,28 @@ export declare class GaiaMessageAttachments extends BaseElement {
     attachments: MessageAttachment[];
     onRemoveAttachment?: (attachment: MessageAttachment) => void;
     fullWidth: boolean;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    compact: boolean;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
+    private renderCompactAttachment;
     private renderAttachment;
     private renderRemoveButton;
     private handleRemoveClick;
     private isImageAttachment;
     private isPdfAttachment;
+    /**
+     * Splits a file name so the tail (extension and a few trailing characters)
+     * stays pinned while the start truncates with an ellipsis, yielding a
+     * middle-truncated name such as `Screens…nal.pdf`.
+     */
+    private splitFileName;
+    /** Formats a byte count into a compact, locale-aware size (e.g. `1.2 MB`). */
+    private formatFileSize;
+    /**
+     * Formats a magnitude and byte unit using the active locale, falling back to
+     * a plain `value unit` string if the runtime lacks `Intl.NumberFormat` unit
+     * support.
+     */
+    private formatSizeNumber;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/message/message.d.ts

@@ -25,7 +25,7 @@ export declare class GaiaMessage extends BaseElement {
     showAvatar: boolean;
     isStreaming: boolean;
     protected willUpdate(changed: PropertyValues): void;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
     private get messageAriaLabel();
     private renderAvatar;
     private renderContent;

package/dist/components/message/renderers/citation-link/citation-link.d.ts

@@ -48,7 +48,7 @@ export declare class GaiaCitationLink extends BaseElement {
      */
     private getPositioningBoundary;
     protected updated(changed: PropertyValues): void;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
     private renderPopover;
     private renderPopoverNav;
     private renderMarkdownSnippet;

package/dist/components/message/renderers/reasoning-block.d.ts

@@ -27,7 +27,7 @@ export declare class GaiaReasoningBlock extends BaseElement {
     private renderDuration;
     private renderStep;
     private renderTimeline;
-    render(): typeof nothing | TemplateResult<1>;
+    render(): TemplateResult<1> | typeof nothing;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/message/renderers/tool-approval-block.d.ts

@@ -25,7 +25,7 @@ export declare class GaiaToolApprovalBlock extends BaseElement {
     private handleConsentChange;
     private handleApprove;
     private handleReject;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/message/renderers/tool-status-block.d.ts

@@ -32,7 +32,7 @@ export declare class GaiaToolStatusBlock extends BaseElement {
     private get statusLabel();
     private get status();
     private toggleExpand;
-    render(): typeof nothing | TemplateResult<1>;
+    render(): TemplateResult<1> | typeof nothing;
     private renderCanvasStatus;
     private renderExpandedContent;
 }

package/dist/components/primitives/icon/icon.d.ts

@@ -17,7 +17,7 @@ export declare class GaiaIcon extends BaseElement {
     label: string;
     size: 'sm' | 'md' | 'lg' | 'xl' | '2xl';
     protected willUpdate(changed: PropertyValues): void;
-    render(): import('lit-html').SVGTemplateResult | typeof nothing;
+    render(): typeof nothing | import('lit-html').SVGTemplateResult;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/primitives/modal/modal.d.ts

@@ -40,7 +40,7 @@ export declare class GaiaModal extends BaseElement {
     private handleClose;
     private handleBackdropClick;
     private handleKeyDown;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/primitives/notification/notification.d.ts

@@ -54,7 +54,7 @@ export declare class GaiaNotification extends BaseElement {
     dismiss(): void;
     private _handleKeyDown;
     private _handleActionsSlotChange;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/components/shared/suggested-question-pills.d.ts

@@ -14,7 +14,7 @@ import { BaseElement } from './base-element';
 export declare class GaiaSuggestedQuestions extends BaseElement {
     static styles: import('lit').CSSResult[][];
     questions: ReadonlyArray<string>;
-    render(): typeof nothing | import('lit-html').TemplateResult<1>;
+    render(): import('lit-html').TemplateResult<1> | typeof nothing;
     private handleClick;
 }
 declare global {

package/dist/core/adapters/tool-utils.d.ts

@@ -28,6 +28,34 @@ export interface UnwrappedApproval {
  * lands in `<a href>` outside the DOMPurify pipeline.
  */
 export declare function sanitizeUrl(url: unknown): string;
+/**
+ * Sanitize URLs used for rendered attachments (`<a href>` / `<img src>`).
+ *
+ * Unlike {@link sanitizeUrl} (link hrefs — http(s) only), attachments are
+ * legitimately delivered as `data:`/`blob:` URLs: the composer previews local
+ * images via `URL.createObjectURL` (blob:), and restored `source.type:'data'`
+ * attachments arrive as `data:<mime>;base64,…`. Those schemes are therefore
+ * allowed in addition to http(s), while dangerous protocols (`javascript:`,
+ * `vbscript:`, …) still collapse to `'#'`.
+ *
+ * `data:` is a content container, not a single protocol, so the scheme alone
+ * is not a sufficient check: the same sanitized value lands in clickable
+ * `<a href>`s, and a forged attachment claiming `mimeType: 'image/png'` could
+ * smuggle `data:text/html,…` past a scheme-only allowlist. The data URL's
+ * media type must therefore be consistent with the attachment's declared
+ * `mimeType` (`image/*` → `data:image/*`, excluding SVG — the one image type
+ * that can carry script; `application/pdf` → `data:application/pdf`).
+ *
+ * Attachment URLs ultimately come from AG-UI message content (including
+ * restored conversation history), which is outside the DOMPurify pipeline, so
+ * the protocol must be checked before binding it into `href`/`src`.
+ *
+ * Detection is purely lexical (scheme prefix) rather than via `new URL()`:
+ * opaque `blob:`/`data:` values and a missing document base both make
+ * `new URL()` throw on otherwise-safe inputs, which would wrongly drop valid
+ * attachments.
+ */
+export declare function sanitizeAttachmentUrl(url: unknown, mimeType: string): string;
 /**
  * Safely parse a value that may be a JSON string or already-parsed object.
  * Returns null for falsy input or unparseable strings.

package/dist/core/store/chat-store.d.ts

@@ -174,6 +174,13 @@ export declare class ChatStore implements ReactiveController {
     setComposerDraft(draft: string): void;
     clearComposerDraft(): void;
     setFrontendTools(tools: FrontendTool[]): void;
+    /**
+     * Retroactively update the host-context snapshot for the most recent user
+     * message. Call this when context is confirmed mid-run (e.g. via a frontend
+     * tool) so the "Context changed" divider appears immediately rather than
+     * waiting for the next message send.
+     */
+    patchCurrentMessageHostContext(props: Record<string, unknown>): void;
     startSupport(baseUrl: string, conversationId: string): Promise<void>;
     stopSupport(): void;
     sendSupportMessage(message: string): Promise<void>;

package/dist/core/store/run-coordinator.d.ts

@@ -80,6 +80,7 @@ export declare class RunCoordinator {
     respondToToolCall(messageId: string, approved: boolean, options?: {
         consentToShareConversation?: boolean;
     }): Promise<void>;
+    mergeHostPropsForContinuation(props: Record<string, unknown>): void;
     /**
      * Execute an agent run with standard tools and error handling.
      *

package/dist/core/types.d.ts

@@ -1,21 +1,29 @@
 import { InternalMessage } from './messages';
+/**
+ * Welcome screen content for a single locale.
+ *
+ * Each section is optional: the backend omits (or sends `null`/empty for) a section that the
+ * active profile has chosen to hide, in which case the UI renders nothing for it. A non-empty
+ * value is rendered as-is. See `WelcomeMessageDto` on the backend for the profile-override semantics.
+ */
 export type WelcomeMessage = {
-    title: string;
-    body?: string;
+    title?: string | null;
+    body?: string | null;
     blocks?: ReadonlyArray<{
         iconName: string;
         headline: string;
         text: string;
         linkText?: string;
         linkUrl?: string;
-    }>;
-    callToAction: string;
+    }> | null;
+    callToAction?: string | null;
 };
 export type BootstrapConfigResponse = {
     welcomeMessages: Readonly<Record<string, WelcomeMessage>>;
     suggestedQuestions: Readonly<Record<string, ReadonlyArray<string>>>;
     maxInputLength: number;
     features: Readonly<Record<string, boolean>>;
+    schemaVersion?: number;
 };
 export type PluginToolSafety = 'safe' | 'unsafe';
 export type AgentPluginTool = {