@eshal-bot/chat-widget 0.2.12 → 0.2.13

package/dist/chat-widget-markdown-chunk.js

@@ -88402,6 +88402,26 @@
     return typeof u === 'string' && /^https?:\/\//i.test(u) ? u : undefined;
   }
 
+  // Kept in its own tiny module (not A2uiBlock.jsx): MessageList imports it
+  // eagerly, and A2uiBlock/MarkdownRenderer are lazy-loaded to keep charts and
+  // react-markdown out of the widget's initial bundle.
+
+  // 2026-09-26 (P1, double-booking risk): the delivered user turn that
+  // followed the message carrying a card, derived from conversation history by
+  // MessageList. `undefined` = not answered yet. One-shot cards (confirmation,
+  // form) render locked once answered, so a reload cannot re-arm an answered
+  // "Confirm booking". Context rather than a prop so it does not have to be
+  // threaded through MessageBubble -> StreamingMarkdown -> MarkdownRenderer.
+  const A2uiAnsweredContext = /*#__PURE__*/React.createContext(undefined);
+  const _normAnswer = v => String(v ?? '').trim().toLowerCase();
+  function matchAnsweredChoice(choices, answer) {
+    if (answer === undefined || answer === null) return null;
+    const a = _normAnswer(answer);
+    if (!a) return null;
+    const hit = (choices || []).find(c => _normAnswer(c?.value) === a || _normAnswer(c?.label) === a);
+    return hit ? String(hit.value ?? hit.label ?? '') : null;
+  }
+
   /**
    * A2uiBlock - render `eshal-ui` / `eshal-chart` / `chart` fence JSON as a
    * real visual block inside the embedded chat widget.
@@ -89343,6 +89363,9 @@
     const [values, setValues] = React.useState(initialValues);
     const [errors, setErrors] = React.useState({});
     const [submitted, setSubmitted] = React.useState(false);
+    // A later user turn already answered this form (history), e.g. after a
+    // reload: never re-arm the submit.
+    const consumed = React.useContext(A2uiAnsweredContext) !== undefined;
     if (fields.length === 0) return null;
     const handleChange = (name, value) => {
       setValues(prev => ({
@@ -89356,7 +89379,7 @@
     };
     const handleSubmit = e => {
       e.preventDefault();
-      if (submitted || !onButtonClick) return;
+      if (submitted || consumed || !onButtonClick) return;
       const next = {};
       let firstError = false;
       for (const f of fields) {
@@ -89440,17 +89463,17 @@
           autoId: `a2ui-form-${f.name || i}`
         }, f.name || i)), /*#__PURE__*/jsxRuntimeExports.jsx("button", {
           type: "submit",
-          disabled: !onButtonClick,
+          disabled: !onButtonClick || consumed,
           style: {
             border: '1px solid ' + (isDark ? '#374151' : '#d1d5db'),
-            background: onButtonClick ? '#2563eb' : isDark ? '#1f2937' : '#f3f4f6',
-            color: onButtonClick ? '#ffffff' : isDark ? '#6b7280' : '#9ca3af',
+            background: onButtonClick && !consumed ? '#2563eb' : isDark ? '#1f2937' : '#f3f4f6',
+            color: onButtonClick && !consumed ? '#ffffff' : isDark ? '#6b7280' : '#9ca3af',
             padding: '6px 14px',
             borderRadius: 6,
             fontSize: 12,
-            cursor: onButtonClick ? 'pointer' : 'default'
+            cursor: onButtonClick && !consumed ? 'pointer' : 'default'
           },
-          children: spec.submitLabel || 'Submit'
+          children: consumed ? 'Submitted' : spec.submitLabel || 'Submit'
         })]
       })
     );
@@ -89474,6 +89497,26 @@
       label: 'No',
       value: 'no'
     }];
+    // 2026-09-26 (P1): a confirmation is a one-shot commitment. It used to
+    // stay clickable forever - after the pick AND after a reload - so a second
+    // click re-sent "confirm" (double-booking risk). Lock on the local pick
+    // (ref guard: a double click in one tick cannot send twice) or on the
+    // history-recorded answer, and tick the chosen option.
+    const consumedBy = React.useContext(A2uiAnsweredContext);
+    const [localChosen, setLocalChosen] = React.useState(null);
+    const sentRef = React.useRef(false);
+    const chosen = localChosen ?? matchAnsweredChoice(buttons, consumedBy);
+    const locked = chosen !== null || consumedBy !== undefined;
+    const lockedButtons = locked ? buttons.map(b => String(b?.value ?? b?.label ?? '') === chosen ? {
+      ...b,
+      label: `${String(b.label ?? b.value ?? '')} \u2713`
+    } : b) : buttons;
+    const handleChoose = onButtonClick ? (value, label) => {
+      if (sentRef.current || locked) return;
+      sentRef.current = true;
+      setLocalChosen(String(value));
+      onButtonClick(value, label);
+    } : undefined;
     return /*#__PURE__*/jsxRuntimeExports.jsxs("div", {
       style: card(isDark),
       children: [spec.title && /*#__PURE__*/jsxRuntimeExports.jsx("div", {
@@ -89493,10 +89536,10 @@
         children: String(spec.body)
       }), /*#__PURE__*/jsxRuntimeExports.jsx(ButtonGroup, {
         spec: {
-          buttons
+          buttons: lockedButtons
         },
         isDark: isDark,
-        onButtonClick: onButtonClick
+        onButtonClick: locked ? undefined : handleChoose
       })]
     });
   }
@@ -91573,6 +91616,70 @@
   const globalScope = typeof window !== "undefined" ? window : typeof globalThis !== "undefined" ? globalThis : undefined;
   const WidgetCitationContext = globalScope ? globalScope[GLOBAL_KEY] || (globalScope[GLOBAL_KEY] = /*#__PURE__*/React.createContext(null)) : /*#__PURE__*/React.createContext(null);
 
+  /**
+   * EV-4177 - can this source card actually be downloaded?
+   *
+   * The chat showed a download icon on every `source_type: "file"` card and then
+   * did nothing when it was clicked. QA uploaded books.xlsx, asked about it, got
+   * an answer citing the file, clicked the icon, and nothing happened - no
+   * download, no error, no explanation.
+   *
+   * The download handler has always had preconditions. An attachment card needs
+   * the presigned read URL the backend mints (`source.url`); a SharePoint card
+   * needs its proxy URL; a knowledge-base card needs a `source_id` the
+   * `/file-download` endpoint can resolve. When none of those are present the
+   * handler logged a warning to a console nobody has open and returned.
+   *
+   * The bug is not really the failed download - it is the icon. Offering a
+   * control that cannot work is worse than not offering it: the customer clicks
+   * it repeatedly, assumes the product is broken, and has nothing to report
+   * beyond "it doesn't work".
+   *
+   * So the same conditions the handler checks now decide whether the icon is
+   * drawn at all, in one place used by both the message bubble and the citation
+   * pill. Those two had grown separate copies of "is this a file", which is how
+   * they came to disagree about what is downloadable.
+   */
+
+  /** A SharePoint citation is served through our own proxy endpoint. */
+  function isSharePointProxyUrl(url) {
+    return typeof url === "string" && url.includes("/api/v1/sharepoint/file/");
+  }
+
+  /**
+   * Uploaded chat attachments are keyed `attachment:<storage_key>`, which the
+   * legacy `/file-download` endpoint cannot resolve - they are fetched straight
+   * from the presigned URL instead, so that URL is mandatory for them.
+   */
+  function isAttachmentSource(source) {
+    if (!source) return false;
+    const id = String(source.source_id || source.sourceid || "");
+    return id.startsWith("attachment:");
+  }
+
+  /**
+   * True only when a click will actually produce a file.
+   *
+   * Deliberately mirrors the branches in the download handler. If you add a new
+   * download path there, add it here too - the icon and the action have to agree,
+   * and this function existing is what makes that a single edit rather than a
+   * bug report.
+   */
+  function canDownloadSource(source) {
+    if (!source) return false;
+
+    // Attachment cards: the presigned URL is the only way in.
+    if (isAttachmentSource(source)) {
+      return typeof source.url === "string" && source.url.length > 0;
+    }
+
+    // SharePoint: the proxy URL is the only way in.
+    if (isSharePointProxyUrl(source.url)) return true;
+
+    // Knowledge-base files: resolved server-side from the source id.
+    return Boolean(source.source_id);
+  }
+
   function decodeName(name) {
     if (!name) return "";
     try {
@@ -91763,7 +91870,11 @@
     const first = referenced[0];
     const extraCount = referenced.length - 1;
     const firstLabel = displayLabel(first.src, first.index);
-    const firstIsFile = isFileLikeSource(first.src);
+    // EV-4177: a card only gets the download affordance when a click will
+    // actually produce a file. isFileLikeSource alone answers "is this a file",
+    // not "can we fetch it" - which is how a download icon ended up on a source
+    // that had no URL and no resolvable id behind it.
+    const firstIsFile = isFileLikeSource(first.src) && canDownloadSource(first.src);
     const busy = ctx.downloadingKey && ctx.downloadingKey === pillKey(first.src);
     const activate = s => {
       if (typeof ctx.onSourceActivate === "function") {
@@ -91922,7 +92033,8 @@
           index
         }) => {
           const label = displayLabel(src, index);
-          const rowIsFile = isFileLikeSource(src);
+          // EV-4177: same gate as firstIsFile above.
+          const rowIsFile = isFileLikeSource(src) && canDownloadSource(src);
           const kBusy = ctx.downloadingKey && ctx.downloadingKey === pillKey(src);
           return /*#__PURE__*/jsxRuntimeExports.jsxs("button", {
             type: "button",