@fiodos/web-core 0.1.11 → 0.1.12

package/dist/cjs/config/types.d.ts

@@ -56,6 +56,12 @@ export interface FiodosWebAgentConfig {
     telemetry?: TelemetryAdapter;
     /** Host auth check, required by manifest actions declaring requiresAuth. */
     isAuthenticated?: () => boolean;
+    /**
+     * Host end-user identity. Conversation memory is namespaced per identity
+     * (hashed LOCALLY, never sent by this module): logout/account switches swap
+     * to that identity's own conversation instead of leaking the previous one.
+     */
+    getUserId?: () => string | null;
     messages?: {
         catalogs?: Record<string, MessageCatalog>;
         overrides?: Partial<AgentMessages>;

package/dist/cjs/controller/AgentController.d.ts

@@ -89,7 +89,7 @@ export declare class AgentController {
     private consentModalVisible;
     private readonly sessionId;
     private sessionStarted;
-    private readonly conversation;
+    private conversation;
     private pending;
     private confirmationReasked;
     private confirmationVoiceActive;
@@ -116,6 +116,10 @@ export declare class AgentController {
     /** Persistence scope: internal orbs keep their memory under a separate key
      *  so a public orb sharing the same appId can never read it. */
     private conversationScope;
+    /** Current identity segment (LOCAL hash of the host's getUserId; never sent
+     *  anywhere). The conversation belongs to (app, scope, identity). */
+    private conversationIdentity;
+    private removeIdentityListeners;
     private loadingOlderExchanges;
     private loadOlderTimer;
     private readonly listeners;
@@ -123,6 +127,22 @@ export declare class AgentController {
     constructor(config: FiodosWebAgentConfig);
     private restorePersistedConversation;
     private persistConversation;
+    /**
+     * Re-evaluates the host identity and, when it changed, swaps conversations:
+     * the outgoing identity's session is saved under ITS private key (so a user
+     * who logs back in recovers it, honouring "never clear"), all in-memory
+     * state and UI are wiped, and the incoming identity's own session (usually
+     * empty) is restored. An anonymous visitor after a logout always starts
+     * clean — the previous user's transcript is never inherited.
+     */
+    private syncConversationIdentity;
+    /**
+     * Wipes the CURRENT identity's conversation: live memory, panel and the
+     * persisted blob. Hosts can call it from their logout for a hard wipe (by
+     * default a logout only parks the conversation under the user's private
+     * local key).
+     */
+    resetConversation(): void;
     getState(): AgentState;
     /** Update the REAL live activity and re-render (no-op when unchanged). */
     private setActivity;

package/dist/cjs/controller/AgentController.js

@@ -43,6 +43,7 @@ class AgentController {
         this.consentModalVisible = false;
         this.sessionId = randomSessionId();
         this.sessionStarted = false;
+        // Replaced wholesale on identity swaps / explicit resets.
         this.conversation = (0, core_1.createConversationSession)();
         this.pending = null;
         this.confirmationReasked = false;
@@ -72,6 +73,7 @@ class AgentController {
         /** Persistence scope: internal orbs keep their memory under a separate key
          *  so a public orb sharing the same appId can never read it. */
         this.conversationScope = 'public';
+        this.removeIdentityListeners = null;
         this.loadingOlderExchanges = false;
         this.loadOlderTimer = null;
         this.listeners = new Set();
@@ -131,15 +133,29 @@ class AgentController {
         });
         // Re-emit combined state whenever the speech machine advances.
         this.unsubscribeSpeech = this.speech.subscribe(() => this.emit());
+        this.conversationIdentity = (0, core_1.conversationIdentityKey)(config.getUserId?.());
         // Rehydrate the previous conversation (page reloads): the persisted blob
         // carries its own retention rule, so expiry is decided correctly even
         // before the published config arrives. Best-effort and non-blocking.
         void this.restorePersistedConversation();
+        // Logout/login usually happens on another screen: re-check identity when
+        // the tab regains focus or becomes visible again, besides before every turn.
+        if (typeof window !== 'undefined') {
+            const check = () => void this.syncConversationIdentity();
+            window.addEventListener('focus', check);
+            document.addEventListener('visibilitychange', check);
+            this.removeIdentityListeners = () => {
+                window.removeEventListener('focus', check);
+                document.removeEventListener('visibilitychange', check);
+            };
+        }
     }
     // ── Conversation persistence (survives page reloads) ───────────────────────
     async restorePersistedConversation() {
-        const restored = await (0, core_1.restoreConversationSession)(this.config.storage, this.config.manifest.appId, Date.now(), this.conversationScope);
-        if (!restored)
+        const identityAtStart = this.conversationIdentity;
+        const restored = await (0, core_1.restoreConversationSession)(this.config.storage, this.config.manifest.appId, Date.now(), this.conversationScope, identityAtStart);
+        // The identity may have changed again while the read resolved.
+        if (!restored || this.conversationIdentity !== identityAtStart)
             return;
         // Never clobber turns the user already made while the restore resolved.
         if (this.conversation.turns.length > 0 || this.conversation.uiArchive?.length)
@@ -151,7 +167,43 @@ class AgentController {
         this.emit();
     }
     persistConversation() {
-        void (0, core_1.persistConversationSession)(this.config.storage, this.config.manifest.appId, this.conversation, this.conversationRetentionMinutes, this.conversationScope);
+        void (0, core_1.persistConversationSession)(this.config.storage, this.config.manifest.appId, this.conversation, this.conversationRetentionMinutes, this.conversationScope, this.conversationIdentity);
+    }
+    /**
+     * Re-evaluates the host identity and, when it changed, swaps conversations:
+     * the outgoing identity's session is saved under ITS private key (so a user
+     * who logs back in recovers it, honouring "never clear"), all in-memory
+     * state and UI are wiped, and the incoming identity's own session (usually
+     * empty) is restored. An anonymous visitor after a logout always starts
+     * clean — the previous user's transcript is never inherited.
+     */
+    syncConversationIdentity() {
+        const next = (0, core_1.conversationIdentityKey)(this.config.getUserId?.());
+        if (next === this.conversationIdentity)
+            return false;
+        // 1. Park the outgoing identity's session under its own key.
+        this.persistConversation();
+        // 2. Wipe every trace from memory and the panel.
+        this.conversation = (0, core_1.createConversationSession)();
+        this.conversationIdentity = next;
+        this.lastExchange = null;
+        this.emit();
+        // 3. Bring in the new identity's own session, if any.
+        void this.restorePersistedConversation();
+        return true;
+    }
+    /**
+     * Wipes the CURRENT identity's conversation: live memory, panel and the
+     * persisted blob. Hosts can call it from their logout for a hard wipe (by
+     * default a logout only parks the conversation under the user's private
+     * local key).
+     */
+    resetConversation() {
+        this.cancelAll();
+        this.conversation = (0, core_1.createConversationSession)();
+        this.lastExchange = null;
+        void (0, core_1.clearPersistedConversation)(this.config.storage, this.config.manifest.appId, this.conversationScope, this.conversationIdentity);
+        this.emit();
     }
     // ── Subscription / state ───────────────────────────────────────────────────
     getState() {
@@ -820,6 +872,9 @@ class AgentController {
                 this.setPhase('idle');
             return;
         }
+        // Identity gate: if the host user changed since the last turn (login,
+        // logout, account switch), swap conversations BEFORE recording anything.
+        this.syncConversationIdentity();
         this.setPhase('thinking');
         // REAL activity: the request is genuinely in flight from this moment.
         this.setActivity({ kind: 'thinking' });
@@ -1112,6 +1167,8 @@ class AgentController {
     }
     dispose() {
         this.cancelAll();
+        this.removeIdentityListeners?.();
+        this.removeIdentityListeners = null;
         if (this.loadOlderTimer) {
             clearTimeout(this.loadOlderTimer);
             this.loadOlderTimer = null;

package/dist/cjs/dropin/createFiodosAgent.d.ts

@@ -59,6 +59,11 @@ export interface FiodosAgentHandle {
     orb: MountedOrb | null;
     /** Resolves once the controller is ready (immediately on the manual path). */
     ready: Promise<AgentController | null>;
+    /**
+     * Wipes the current identity's conversation (live memory + persisted blob).
+     * Call it from the app's logout for a hard wipe; no-op until ready.
+     */
+    resetConversation(): void;
     destroy(): void;
 }
 export declare function createFiodosAgent(options: CreateFiodosAgentOptions): FiodosAgentHandle;

package/dist/cjs/dropin/createFiodosAgent.js

@@ -75,6 +75,7 @@ function assemble(options, manifest, baseUrl) {
         storage: (0, webStorageAdapter_1.createWebStorageAdapter)(),
         telemetry,
         isAuthenticated: options.isAuthenticated,
+        getUserId: options.getUserId,
         ttsVoice: options.ttsVoice,
         ...options.configOverrides,
     };
@@ -97,6 +98,9 @@ function createFiodosAgent(options) {
             controller,
             orb,
             ready: Promise.resolve(controller),
+            resetConversation() {
+                controller.resetConversation();
+            },
             destroy() {
                 orb?.unmount();
                 controller.dispose();
@@ -109,6 +113,9 @@ function createFiodosAgent(options) {
         controller: null,
         orb: null,
         ready: Promise.resolve(null),
+        resetConversation() {
+            handle.controller?.resetConversation();
+        },
         destroy() {
             cancelled = true;
             handle.orb?.unmount();

package/dist/cjs/version.d.ts

@@ -5,5 +5,5 @@
  * Auto-generated by scripts/sync-sdk-version.mjs from package.json. Do not edit
  * by hand — change package.json `version` and re-run the sync/release script.
  */
-export declare const SDK_VERSION = "0.1.11";
+export declare const SDK_VERSION = "0.1.12";
 export declare const SDK_PACKAGE = "@fiodos/web-core";

package/dist/cjs/version.js

@@ -8,5 +8,5 @@ exports.SDK_PACKAGE = exports.SDK_VERSION = void 0;
  * Auto-generated by scripts/sync-sdk-version.mjs from package.json. Do not edit
  * by hand — change package.json `version` and re-run the sync/release script.
  */
-exports.SDK_VERSION = '0.1.11';
+exports.SDK_VERSION = '0.1.12';
 exports.SDK_PACKAGE = '@fiodos/web-core';

package/dist/esm/config/types.d.ts

@@ -56,6 +56,12 @@ export interface FiodosWebAgentConfig {
     telemetry?: TelemetryAdapter;
     /** Host auth check, required by manifest actions declaring requiresAuth. */
     isAuthenticated?: () => boolean;
+    /**
+     * Host end-user identity. Conversation memory is namespaced per identity
+     * (hashed LOCALLY, never sent by this module): logout/account switches swap
+     * to that identity's own conversation instead of leaking the previous one.
+     */
+    getUserId?: () => string | null;
     messages?: {
         catalogs?: Record<string, MessageCatalog>;
         overrides?: Partial<AgentMessages>;

package/dist/esm/controller/AgentController.d.ts

@@ -89,7 +89,7 @@ export declare class AgentController {
     private consentModalVisible;
     private readonly sessionId;
     private sessionStarted;
-    private readonly conversation;
+    private conversation;
     private pending;
     private confirmationReasked;
     private confirmationVoiceActive;
@@ -116,6 +116,10 @@ export declare class AgentController {
     /** Persistence scope: internal orbs keep their memory under a separate key
      *  so a public orb sharing the same appId can never read it. */
     private conversationScope;
+    /** Current identity segment (LOCAL hash of the host's getUserId; never sent
+     *  anywhere). The conversation belongs to (app, scope, identity). */
+    private conversationIdentity;
+    private removeIdentityListeners;
     private loadingOlderExchanges;
     private loadOlderTimer;
     private readonly listeners;
@@ -123,6 +127,22 @@ export declare class AgentController {
     constructor(config: FiodosWebAgentConfig);
     private restorePersistedConversation;
     private persistConversation;
+    /**
+     * Re-evaluates the host identity and, when it changed, swaps conversations:
+     * the outgoing identity's session is saved under ITS private key (so a user
+     * who logs back in recovers it, honouring "never clear"), all in-memory
+     * state and UI are wiped, and the incoming identity's own session (usually
+     * empty) is restored. An anonymous visitor after a logout always starts
+     * clean — the previous user's transcript is never inherited.
+     */
+    private syncConversationIdentity;
+    /**
+     * Wipes the CURRENT identity's conversation: live memory, panel and the
+     * persisted blob. Hosts can call it from their logout for a hard wipe (by
+     * default a logout only parks the conversation under the user's private
+     * local key).
+     */
+    resetConversation(): void;
     getState(): AgentState;
     /** Update the REAL live activity and re-render (no-op when unchanged). */
     private setActivity;

package/dist/esm/controller/AgentController.js

@@ -15,7 +15,7 @@
  *    deliberate modal tap; a loose "yes" never confirms them.
  *  - The agent only ever executes actions declared in the manifest.
  */
-import { combineContexts, createActionExecutor, createConsentManager, createSafeTelemetry, createSanitizer, buildBubbleExchangeWindow, BUBBLE_PAGE_EXCHANGES, conversationRetentionOptions, createConversationSession, persistConversationSession, restoreConversationSession, defaultRouteContextText, formatMessage, prepareConversationForTurn, recordConversationExchange, resolveConfirmationLexicon, resolveMessages, validateManifest, } from '@fiodos/core';
+import { combineContexts, createActionExecutor, createConsentManager, createSafeTelemetry, createSanitizer, buildBubbleExchangeWindow, BUBBLE_PAGE_EXCHANGES, clearPersistedConversation, conversationIdentityKey, conversationRetentionOptions, createConversationSession, persistConversationSession, restoreConversationSession, defaultRouteContextText, formatMessage, prepareConversationForTurn, recordConversationExchange, resolveConfirmationLexicon, resolveMessages, validateManifest, } from '@fiodos/core';
 import { AgentApiError } from '../api/errors.js';
 import { formatAgentTurnError } from '../api/formatTurnError.js';
 import { buildManifestPayload } from '../api/backendClient.js';
@@ -40,6 +40,7 @@ export class AgentController {
         this.consentModalVisible = false;
         this.sessionId = randomSessionId();
         this.sessionStarted = false;
+        // Replaced wholesale on identity swaps / explicit resets.
         this.conversation = createConversationSession();
         this.pending = null;
         this.confirmationReasked = false;
@@ -69,6 +70,7 @@ export class AgentController {
         /** Persistence scope: internal orbs keep their memory under a separate key
          *  so a public orb sharing the same appId can never read it. */
         this.conversationScope = 'public';
+        this.removeIdentityListeners = null;
         this.loadingOlderExchanges = false;
         this.loadOlderTimer = null;
         this.listeners = new Set();
@@ -128,15 +130,29 @@ export class AgentController {
         });
         // Re-emit combined state whenever the speech machine advances.
         this.unsubscribeSpeech = this.speech.subscribe(() => this.emit());
+        this.conversationIdentity = conversationIdentityKey(config.getUserId?.());
         // Rehydrate the previous conversation (page reloads): the persisted blob
         // carries its own retention rule, so expiry is decided correctly even
         // before the published config arrives. Best-effort and non-blocking.
         void this.restorePersistedConversation();
+        // Logout/login usually happens on another screen: re-check identity when
+        // the tab regains focus or becomes visible again, besides before every turn.
+        if (typeof window !== 'undefined') {
+            const check = () => void this.syncConversationIdentity();
+            window.addEventListener('focus', check);
+            document.addEventListener('visibilitychange', check);
+            this.removeIdentityListeners = () => {
+                window.removeEventListener('focus', check);
+                document.removeEventListener('visibilitychange', check);
+            };
+        }
     }
     // ── Conversation persistence (survives page reloads) ───────────────────────
     async restorePersistedConversation() {
-        const restored = await restoreConversationSession(this.config.storage, this.config.manifest.appId, Date.now(), this.conversationScope);
-        if (!restored)
+        const identityAtStart = this.conversationIdentity;
+        const restored = await restoreConversationSession(this.config.storage, this.config.manifest.appId, Date.now(), this.conversationScope, identityAtStart);
+        // The identity may have changed again while the read resolved.
+        if (!restored || this.conversationIdentity !== identityAtStart)
             return;
         // Never clobber turns the user already made while the restore resolved.
         if (this.conversation.turns.length > 0 || this.conversation.uiArchive?.length)
@@ -148,7 +164,43 @@ export class AgentController {
         this.emit();
     }
     persistConversation() {
-        void persistConversationSession(this.config.storage, this.config.manifest.appId, this.conversation, this.conversationRetentionMinutes, this.conversationScope);
+        void persistConversationSession(this.config.storage, this.config.manifest.appId, this.conversation, this.conversationRetentionMinutes, this.conversationScope, this.conversationIdentity);
+    }
+    /**
+     * Re-evaluates the host identity and, when it changed, swaps conversations:
+     * the outgoing identity's session is saved under ITS private key (so a user
+     * who logs back in recovers it, honouring "never clear"), all in-memory
+     * state and UI are wiped, and the incoming identity's own session (usually
+     * empty) is restored. An anonymous visitor after a logout always starts
+     * clean — the previous user's transcript is never inherited.
+     */
+    syncConversationIdentity() {
+        const next = conversationIdentityKey(this.config.getUserId?.());
+        if (next === this.conversationIdentity)
+            return false;
+        // 1. Park the outgoing identity's session under its own key.
+        this.persistConversation();
+        // 2. Wipe every trace from memory and the panel.
+        this.conversation = createConversationSession();
+        this.conversationIdentity = next;
+        this.lastExchange = null;
+        this.emit();
+        // 3. Bring in the new identity's own session, if any.
+        void this.restorePersistedConversation();
+        return true;
+    }
+    /**
+     * Wipes the CURRENT identity's conversation: live memory, panel and the
+     * persisted blob. Hosts can call it from their logout for a hard wipe (by
+     * default a logout only parks the conversation under the user's private
+     * local key).
+     */
+    resetConversation() {
+        this.cancelAll();
+        this.conversation = createConversationSession();
+        this.lastExchange = null;
+        void clearPersistedConversation(this.config.storage, this.config.manifest.appId, this.conversationScope, this.conversationIdentity);
+        this.emit();
     }
     // ── Subscription / state ───────────────────────────────────────────────────
     getState() {
@@ -817,6 +869,9 @@ export class AgentController {
                 this.setPhase('idle');
             return;
         }
+        // Identity gate: if the host user changed since the last turn (login,
+        // logout, account switch), swap conversations BEFORE recording anything.
+        this.syncConversationIdentity();
         this.setPhase('thinking');
         // REAL activity: the request is genuinely in flight from this moment.
         this.setActivity({ kind: 'thinking' });
@@ -1109,6 +1164,8 @@ export class AgentController {
     }
     dispose() {
         this.cancelAll();
+        this.removeIdentityListeners?.();
+        this.removeIdentityListeners = null;
         if (this.loadOlderTimer) {
             clearTimeout(this.loadOlderTimer);
             this.loadOlderTimer = null;

package/dist/esm/dropin/createFiodosAgent.d.ts

@@ -59,6 +59,11 @@ export interface FiodosAgentHandle {
     orb: MountedOrb | null;
     /** Resolves once the controller is ready (immediately on the manual path). */
     ready: Promise<AgentController | null>;
+    /**
+     * Wipes the current identity's conversation (live memory + persisted blob).
+     * Call it from the app's logout for a hard wipe; no-op until ready.
+     */
+    resetConversation(): void;
     destroy(): void;
 }
 export declare function createFiodosAgent(options: CreateFiodosAgentOptions): FiodosAgentHandle;

package/dist/esm/dropin/createFiodosAgent.js

@@ -72,6 +72,7 @@ function assemble(options, manifest, baseUrl) {
         storage: createWebStorageAdapter(),
         telemetry,
         isAuthenticated: options.isAuthenticated,
+        getUserId: options.getUserId,
         ttsVoice: options.ttsVoice,
         ...options.configOverrides,
     };
@@ -94,6 +95,9 @@ export function createFiodosAgent(options) {
             controller,
             orb,
             ready: Promise.resolve(controller),
+            resetConversation() {
+                controller.resetConversation();
+            },
             destroy() {
                 orb?.unmount();
                 controller.dispose();
@@ -106,6 +110,9 @@ export function createFiodosAgent(options) {
         controller: null,
         orb: null,
         ready: Promise.resolve(null),
+        resetConversation() {
+            handle.controller?.resetConversation();
+        },
         destroy() {
             cancelled = true;
             handle.orb?.unmount();

package/dist/esm/version.d.ts

@@ -5,5 +5,5 @@
  * Auto-generated by scripts/sync-sdk-version.mjs from package.json. Do not edit
  * by hand — change package.json `version` and re-run the sync/release script.
  */
-export declare const SDK_VERSION = "0.1.11";
+export declare const SDK_VERSION = "0.1.12";
 export declare const SDK_PACKAGE = "@fiodos/web-core";

package/dist/esm/version.js

@@ -5,5 +5,5 @@
  * Auto-generated by scripts/sync-sdk-version.mjs from package.json. Do not edit
  * by hand — change package.json `version` and re-run the sync/release script.
  */
-export const SDK_VERSION = '0.1.11';
+export const SDK_VERSION = '0.1.12';
 export const SDK_PACKAGE = '@fiodos/web-core';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiodos/web-core",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Framework-agnostic browser layer for the Fiodos agent: a vanilla AgentController (orchestrator), DOM adapters (navigation/voice/storage), HTTP client and decision engine over @fiodos/core. Shared base for @fiodos/vue, @fiodos/svelte and @fiodos/angular (no framework imports).",
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": {
@@ -29,7 +29,7 @@
     "prepublishOnly": "node ../../scripts/sync-sdk-version.mjs && npm run build"
   },
   "dependencies": {
-    "@fiodos/core": "^0.1.7"
+    "@fiodos/core": "^0.1.9"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",