@eshal-bot/chat-widget 0.1.47 → 0.1.48

package/dist/chat-widget.js

@@ -8454,9 +8454,9 @@
     }
   };
 
-  /**
-   * Initializes the PCM audio player worklet that streams inline PCM chunks
-   * coming from the ADK websocket events.
+  /**
+   * Initializes the PCM audio player worklet that streams inline PCM chunks
+   * coming from the ADK websocket events.
    */
   async function startAudioPlayerWorklet() {
     if (typeof window === 'undefined') {
@@ -8480,9 +8480,9 @@
     return [audioPlayerNode, audioContext];
   }
 
-  /**
-   * Bootstraps the PCM recorder audio worklet, captures mic audio at 16kHz
-   * mono, and forwards buffers through the provided handler.
+  /**
+   * Bootstraps the PCM recorder audio worklet, captures mic audio at 16kHz
+   * mono, and forwards buffers through the provided handler.
    */
   async function startAudioRecorderWorklet(onPcmChunk) {
     if (typeof window === 'undefined') {
@@ -8519,8 +8519,8 @@
     return [audioRecorderNode, audioRecorderContext, micStream];
   }
 
-  /**
-   * Stops all microphone tracks.
+  /**
+   * Stops all microphone tracks.
    */
   function stopMicrophone(stream) {
     if (!stream) {
@@ -8537,24 +8537,24 @@
     return pcm16Array.buffer;
   }
 
-  /**
-   * Client-side Voice-Activity gate for the widget's voice (Bidi) session.
-   *
-   * Ported from packages/agent-sdk/src/voice/audio/vad.ts (`createSpeechGate`),
-   * which was itself originally derived from this widget. The gate sits between
-   * the mic worklet and the WebSocket: it forwards PCM ONLY inside a confirmed
-   * speech turn and fires `onSpeechEnd` when the turn closes, so the caller can
-   * tell the backend the utterance is done (an `audio_end` signal).
-   *
-   * Why the widget needs this: knowledge-api's non-streaming voice path only
-   * transcribes a turn when it receives `audio_end` (or its flaky energy-VAD
-   * backstop trips). Without a client gate the widget streamed mic audio forever
-   * and the backend just buffered it ("Collecting Audio…") without ever
-   * transcribing — so voice connected but never replied. The agent-sdk already
-   * gates this way; this brings the widget to parity.
-   *
-   * Framework-free and side-effect-free (only calls the two callbacks) so it can
-   * be reasoned about / tested in isolation.
+  /**
+   * Client-side Voice-Activity gate for the widget's voice (Bidi) session.
+   *
+   * Ported from packages/agent-sdk/src/voice/audio/vad.ts (`createSpeechGate`),
+   * which was itself originally derived from this widget. The gate sits between
+   * the mic worklet and the WebSocket: it forwards PCM ONLY inside a confirmed
+   * speech turn and fires `onSpeechEnd` when the turn closes, so the caller can
+   * tell the backend the utterance is done (an `audio_end` signal).
+   *
+   * Why the widget needs this: knowledge-api's non-streaming voice path only
+   * transcribes a turn when it receives `audio_end` (or its flaky energy-VAD
+   * backstop trips). Without a client gate the widget streamed mic audio forever
+   * and the backend just buffered it ("Collecting Audio…") without ever
+   * transcribing — so voice connected but never replied. The agent-sdk already
+   * gates this way; this brings the widget to parity.
+   *
+   * Framework-free and side-effect-free (only calls the two callbacks) so it can
+   * be reasoned about / tested in isolation.
    */
 
   const DEFAULT_SPEECH_GATE_CONFIG = {
@@ -8583,16 +8583,16 @@
     return Math.sqrt(sumSquares / samples.length);
   }
 
-  /**
-   * Create a stateful speech gate. Returns `{ process, reset, isSpeaking }`.
-   * `config.sampleRate` is required; everything else falls back to
-   * DEFAULT_SPEECH_GATE_CONFIG.
-   *
-   * @param {{ sampleRate: number, energyThreshold?: number, speechStartMs?: number, hangoverMs?: number, preRollMs?: number }} config
-   * @param {{ onSpeechStart?: () => void, onVoiceFrame: (pcm: ArrayBuffer) => void, onSpeechEnd: () => void }} callbacks
-   *   onSpeechStart fires the instant a turn opens — use it for barge-in
-   *   (stop any assistant TTS still playing). onVoiceFrame emits each voiced
-   *   PCM frame; onSpeechEnd fires when the turn closes after the hangover.
+  /**
+   * Create a stateful speech gate. Returns `{ process, reset, isSpeaking }`.
+   * `config.sampleRate` is required; everything else falls back to
+   * DEFAULT_SPEECH_GATE_CONFIG.
+   *
+   * @param {{ sampleRate: number, energyThreshold?: number, speechStartMs?: number, hangoverMs?: number, preRollMs?: number }} config
+   * @param {{ onSpeechStart?: () => void, onVoiceFrame: (pcm: ArrayBuffer) => void, onSpeechEnd: () => void }} callbacks
+   *   onSpeechStart fires the instant a turn opens — use it for barge-in
+   *   (stop any assistant TTS still playing). onVoiceFrame emits each voiced
+   *   PCM frame; onSpeechEnd fires when the turn closes after the hangover.
    */
   function createSpeechGate(config, callbacks) {
     var _config$energyThresho, _config$speechStartMs, _config$hangoverMs, _config$preRollMs;
@@ -9288,6 +9288,14 @@
           } = await Promise.resolve().then(function () { return index; });
           const tracer = new UserTrace({
             cache: true,
+            // Capture the visitor's precise location via the browser Geolocation
+            // API (behind the native permission prompt) and reverse-geocode it
+            // into profile.geo, so "Traffic by location" reflects the real city
+            // instead of the coarse/wrong IP-gateway city. Granted → accurate
+            // GPS; denied/dismissed/plain-HTTP → graceful IP fallback. Set
+            // explicitly (not relying on the SDK default) so the behavior is
+            // durable even if @eshal-tracker/sdk changes its default later.
+            geoFromBrowser: true,
             onError: () => {/* swallow — fingerprint is best-effort */}
           });
           const profile = await tracer.init();
@@ -59479,8 +59487,8 @@
     });
   };
 
-  /**
-   * Auto-scroll hook that scrolls to bottom when dependencies change
+  /**
+   * Auto-scroll hook that scrolls to bottom when dependencies change
    */
   function useAutoScroll(containerRef) {
     let dependencies = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : [];
@@ -61939,6 +61947,16 @@
       })
     }];
 
+    // Reorder the keyless cascade: freeipapi.com is currently the only one
+    // reliably reachable from a browser — ip-api.com's free tier is HTTP-only
+    // (→ HTTP 403 over HTTPS), ipwho.is → 403, ipapi.co → 429. Trying freeipapi
+    // first avoids three doomed round-trips on every lookup. The rest stay as
+    // fallback in case they recover or behave differently from another network.
+    // NOTE: all IP providers locate the ISP gateway, not the device — for an
+    // accurate end-user position use getBrowserLocation() (GPS + reverseGeocode).
+    const FREE_ORDER = ["freeipapi.com", "ipwho.is", "ipapi.co", "ip-api.com"];
+    freeProviders.sort((a, b) => FREE_ORDER.indexOf(a.name) - FREE_ORDER.indexOf(b.name));
+
     // Key-based providers go first (more reliable, higher limits)
     return [...keyedProviders, ...freeProviders];
   }
@@ -62036,22 +62054,130 @@
     }));
   }
 
+  // Default options for navigator.geolocation.getCurrentPosition.
+  //   enableHighAccuracy → prefer real GPS over coarse network positioning;
+  //   timeout 8s         → don't hang forever waiting for a fix;
+  //   maximumAge 5 min   → accept a recently-cached fix so a silent refresh
+  //                        (permission already granted) resolves instantly.
+  const DEFAULT_GEO_OPTIONS = {
+    enableHighAccuracy: true,
+    timeout: 8000,
+    maximumAge: 5 * 60 * 1000
+  };
+
   /**
-   * Get browser-native geolocation (GPS / network-based, requires user permission)
+   * Get browser-native geolocation (GPS / network-based).
+   * Triggers the native permission prompt on first use for an origin (unless the
+   * user already granted/denied). Resolves null — never rejects — on error,
+   * denial, unsupported, or insecure (plain-HTTP) context, so callers can simply
+   * fall back to IP geo.
+   *
+   * @param {PositionOptions} [options] - merged over DEFAULT_GEO_OPTIONS
+   * @returns {Promise<{latitude:number, longitude:number, accuracy:number}|null>}
    */
-  function getBrowserGeolocation$1(options = {
-    timeout: 8000
-  }) {
+  function getBrowserGeolocation$1(options = {}) {
     return new Promise(resolve => {
-      if (!navigator?.geolocation) return resolve(null);
+      if (typeof navigator === "undefined" || !navigator.geolocation) return resolve(null);
+      // getCurrentPosition only resolves in a secure context (HTTPS or
+      // localhost). Bail early on plain HTTP rather than attempt a doomed prompt.
+      if (typeof window !== "undefined" && window.isSecureContext === false) return resolve(null);
       navigator.geolocation.getCurrentPosition(pos => resolve({
         latitude: pos.coords.latitude,
         longitude: pos.coords.longitude,
         accuracy: pos.coords.accuracy
-      }), () => resolve(null), options);
+      }), () => resolve(null), {
+        ...DEFAULT_GEO_OPTIONS,
+        ...options
+      });
     });
   }
 
+  /**
+   * Query the current geolocation permission WITHOUT triggering a prompt.
+   * Lets the host decide whether to ask: "granted" → fetch silently, "denied" →
+   * skip (IP fallback), "prompt" → show your own pre-ask before getCurrentPosition.
+   * Returns "unsupported" where the Permissions API is unavailable (e.g. older
+   * Safari) so callers can treat it as "not known to be granted".
+   * @returns {Promise<"granted"|"denied"|"prompt"|"unsupported">}
+   */
+  async function getGeolocationPermission$1() {
+    try {
+      if (typeof navigator === "undefined" || !navigator.permissions || !navigator.permissions.query) {
+        return "unsupported";
+      }
+      const status = await navigator.permissions.query({
+        name: "geolocation"
+      });
+      return status.state; // "granted" | "denied" | "prompt"
+    } catch {
+      return "unsupported";
+    }
+  }
+
+  /**
+   * Reverse-geocode latitude/longitude → city / region / country.
+   * Uses BigDataCloud's keyless, CORS-enabled *client* endpoint (no API key,
+   * accurate to the city/state level). Resolves null on network failure or an
+   * unusable response so the caller can keep any prior (IP-based) values.
+   *
+   * @param {number} latitude
+   * @param {number} longitude
+   * @param {Object} [options]
+   * @param {number}  [options.timeoutMs]
+   * @param {string}  [options.localityLanguage="en"]
+   * @returns {Promise<{city,region,regionCode,country,countryCode,latitude,longitude}|null>}
+   */
+  async function reverseGeocode$1(latitude, longitude, options = {}) {
+    if (typeof latitude !== "number" || typeof longitude !== "number") return null;
+    const timeoutMs = options.timeoutMs || _globalConfig.timeoutMs || 5000;
+    const lang = options.localityLanguage || "en";
+    const url = "https://api.bigdatacloud.net/data/reverse-geocode-client" + `?latitude=${latitude}&longitude=${longitude}&localityLanguage=${lang}`;
+    try {
+      const d = await fetchWithTimeout(url, timeoutMs);
+      const city = d.city || d.locality || "";
+      // Treat an empty body (e.g. mid-ocean coords) as a miss, not a result.
+      if (!city && !d.countryName) return null;
+      return {
+        city,
+        region: d.principalSubdivision || "",
+        regionCode: (d.principalSubdivisionCode || "").split("-").pop() || "",
+        country: d.countryName || "",
+        countryCode: d.countryCode || "",
+        latitude,
+        longitude
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * High-level "exact location" helper. Gets the device GPS fix (prompting if
+   * needed) and reverse-geocodes it. Returns a geo-shaped object tagged
+   * source:"gps" when the place resolved; the bare coords (no source tag) when
+   * only the fix succeeded but reverse-geocoding failed; or null when there is no
+   * fix at all (denied / unsupported / insecure). This is the accurate-location
+   * primitive — prefer it over IP geo for the real end-user position.
+   *
+   * @param {PositionOptions} [options]
+   * @returns {Promise<Object|null>}
+   */
+  async function getBrowserLocation$1(options = {}) {
+    const coords = await getBrowserGeolocation$1(options);
+    if (!coords) return null;
+    const place = await reverseGeocode$1(coords.latitude, coords.longitude, options);
+    const hasPlace = !!(place && (place.city || place.country));
+    return {
+      ...(hasPlace ? place : {}),
+      latitude: coords.latitude,
+      longitude: coords.longitude,
+      accuracy: coords.accuracy,
+      ...(hasPlace ? {
+        source: "gps"
+      } : {})
+    };
+  }
+
   /** Build a Google Maps URL from coordinates */
   function toMapsUrl$1(lat, lon) {
     return `https://www.google.com/maps?q=${lat},${lon}`;
@@ -62061,6 +62187,9 @@
     resolveLocation: resolveLocation$1,
     listProviders: listProviders$1,
     getBrowserGeolocation: getBrowserGeolocation$1,
+    getGeolocationPermission: getGeolocationPermission$1,
+    reverseGeocode: reverseGeocode$1,
+    getBrowserLocation: getBrowserLocation$1,
     toMapsUrl: toMapsUrl$1
   };
 
@@ -62244,6 +62373,9 @@
     resolveLocation,
     listProviders,
     getBrowserGeolocation,
+    getGeolocationPermission,
+    reverseGeocode,
+    getBrowserLocation,
     toMapsUrl
   } = location;
   const {
@@ -62276,7 +62408,13 @@
      * @param {Object} [options]
      * @param {Function} [options.onReady]      - Callback when profile is ready
      * @param {Function} [options.onError]      - Callback on error
-     * @param {boolean}  [options.geoFromBrowser=false] - Also request GPS (asks permission)
+     * @param {boolean|"auto"} [options.geoFromBrowser=true] - Capture precise GPS
+     *        and reverse-geocode it into `geo`. DEFAULT true = request on init()
+     *        (shows the native permission prompt unless already granted/denied);
+     *        false = never (IP only); "auto" = use GPS only when permission was
+     *        ALREADY granted (silent, never prompts).
+     * @param {Object}   [options.geoApiKeys]   - API keys for keyed geo providers
+     * @param {PositionOptions} [options.geoOptions] - Override getCurrentPosition opts
      * @param {boolean}  [options.cache=true]   - Use cached profile if < maxAgeMs old
      * @param {number}   [options.maxAgeMs=300000] - Max cache age (default 5 min)
      * @param {boolean}  [options.autoInit=false]   - Auto-init on construction
@@ -62286,7 +62424,13 @@
       this._options = {
         onReady: options.onReady || null,
         onError: options.onError || null,
-        geoFromBrowser: options.geoFromBrowser || false,
+        // Default ON: capture precise GPS on init() behind the browser's native
+        // permission prompt. Use `=== undefined` (not `|| `) so an explicit
+        // `false` opt-out is honored; pass "auto" to use an already-granted
+        // permission silently without ever prompting.
+        geoFromBrowser: options.geoFromBrowser === undefined ? true : options.geoFromBrowser,
+        geoApiKeys: options.geoApiKeys || null,
+        geoOptions: options.geoOptions || null,
         cache: options.cache !== false,
         maxAgeMs: options.maxAgeMs || 5 * 60 * 1000,
         autoInit: options.autoInit || false,
@@ -62336,15 +62480,46 @@
           confidence
         } = generateFingerprint();
 
-        // 3. IP + Geo — run in parallel
-        const [ipResult, browserGeo] = await Promise.all([detectIP(), this._options.geoFromBrowser ? getBrowserGeolocation() : Promise.resolve(null)]);
-        const ip = ipResult?.ip || "unknown";
-        const ipVersion = ipResult ? getIPVersion(ip) : "unknown";
-
-        // 4. Resolve geo from IP
-        let geo = null;
-        if (ip !== "unknown") {
-          geo = await resolveLocation(ip);
+        // 3. IP→geo chain and (optional) precise browser GPS run concurrently.
+        //    GPS is the slow path (permission prompt + satellite fix) so we never
+        //    block the IP lookup on it.
+        const ipApiKeys = this._options.geoApiKeys ? {
+          apiKeys: this._options.geoApiKeys
+        } : {};
+        const [ipBundle, gpsLoc] = await Promise.all([(async () => {
+          const ipResult = await detectIP();
+          const ipAddr = ipResult?.ip || "unknown";
+          const ipGeo = ipAddr !== "unknown" ? await resolveLocation(ipAddr, ipApiKeys) : null;
+          return {
+            ip: ipAddr,
+            ipVersion: ipResult ? getIPVersion(ipAddr) : "unknown",
+            geo: ipGeo
+          };
+        })(), this._collectBrowserLocation()]);
+        const {
+          ip,
+          ipVersion
+        } = ipBundle;
+
+        // 4. Geo: start from the (coarse) IP location, then — when we have a
+        //    precise GPS fix — OVERRIDE city/region/country with the
+        //    reverse-geocoded values. IP geo only locates the ISP gateway, so a
+        //    real device fix always wins. Denied/unavailable → IP value stays.
+        let geo = ipBundle.geo;
+        let browserGeo = null;
+        if (gpsLoc) {
+          browserGeo = {
+            latitude: gpsLoc.latitude,
+            longitude: gpsLoc.longitude,
+            accuracy: gpsLoc.accuracy
+          };
+          if (gpsLoc.source === "gps") {
+            // gpsLoc carries city/region/regionCode/country/countryCode/lat/lng/source
+            geo = {
+              ...(geo || {}),
+              ...gpsLoc
+            };
+          }
         }
 
         // 5. Browser context
@@ -62386,6 +62561,56 @@
       }
     }
 
+    /**
+     * Decide whether to capture browser GPS during init(), honoring geoFromBrowser:
+     *   false  → null (skip)
+     *   "auto" → only when permission is ALREADY granted (silent, never prompts)
+     *   true   → attempt (getCurrentPosition shows the prompt unless denied)
+     * @private
+     * @returns {Promise<Object|null>}
+     */
+    async _collectBrowserLocation() {
+      const mode = this._options.geoFromBrowser;
+      if (!mode) return null;
+      if (mode === "auto") {
+        const perm = await getGeolocationPermission();
+        if (perm !== "granted") return null; // never prompt during a silent init
+      }
+      return getBrowserLocation(this._options.geoOptions || {});
+    }
+
+    /**
+     * Capture precise browser location AFTER your UI has obtained user consent
+     * (e.g. an in-widget "Share your location?" pre-ask). Triggers the native
+     * permission prompt, reverse-geocodes the fix, merges it into the current
+     * profile's `geo` (source:"gps"), re-persists, and fires onReady. No-ops
+     * gracefully when denied/unavailable (keeps the IP fallback) or before init().
+     * @param {PositionOptions} [options]
+     * @returns {Promise<UserProfile|null>}
+     */
+    async captureBrowserLocation(options = {}) {
+      const loc = await getBrowserLocation({
+        ...(this._options.geoOptions || {}),
+        ...options
+      });
+      if (!loc || !this.profile) return this.profile; // denied/unavailable or not init'd yet
+      this.profile.browserGeo = {
+        latitude: loc.latitude,
+        longitude: loc.longitude,
+        accuracy: loc.accuracy
+      };
+      this.profile.mapsUrl = toMapsUrl(loc.latitude, loc.longitude);
+      if (loc.source === "gps") {
+        this.profile.geo = {
+          ...(this.profile.geo || {}),
+          ...loc
+        };
+      }
+      saveSessionMeta(this.profile);
+      if (this._options.onReady) this._options.onReady(this.profile);
+      return this.profile;
+    }
+
     /**
      * Get the current profile (must call init() first)
      * @returns {UserProfile|null}
@@ -62480,6 +62705,9 @@
   src.exports.resolveLocation = resolveLocation;
   src.exports.listProviders = listProviders;
   src.exports.getBrowserGeolocation = getBrowserGeolocation;
+  src.exports.getGeolocationPermission = getGeolocationPermission;
+  src.exports.reverseGeocode = reverseGeocode;
+  src.exports.getBrowserLocation = getBrowserLocation;
   src.exports.getOrCreateUserID = getOrCreateUserID;
   src.exports.getOrCreateSessionID = getOrCreateSessionID;
   src.exports.clearSession = clearSession;