@fiodos/web-core 0.1.11 → 0.1.14

package/dist/esm/config/types.d.ts

@@ -3,7 +3,7 @@
  * Mirrors @fiodos/react's FiodosWebAgentConfig (same adapters, same lifecycle).
  * Shared by every framework binding through the AgentController.
  */
-import type { ActionRegistries, AgentBackendClient, AgentMessages, AppManifest, ConfirmationLexicon, MessageCatalog, NavigationAdapter, Sanitizer, StorageAdapter, TelemetryAdapter, VoiceAdapter } from '@fiodos/core';
+import type { ActionRegistries, AgentBackendClient, AgentMessages, AppManifest, ConfirmationLexicon, CredentialAutofillAdapter, MessageCatalog, NavigationAdapter, Sanitizer, StorageAdapter, TelemetryAdapter, VoiceAdapter } from '@fiodos/core';
 import type { ResolveUiMessagesOptions, WebUiMessages } from '../ui/messages.js';
 export type AgentPhase = 'idle' | 'listening' | 'thinking' | 'speaking' | 'confirming';
 export interface AgentTimings {
@@ -55,7 +55,26 @@ export interface FiodosWebAgentConfig {
     storage: StorageAdapter;
     telemetry?: TelemetryAdapter;
     /** Host auth check, required by manifest actions declaring requiresAuth. */
-    isAuthenticated?: () => boolean;
+    isAuthenticated?: () => boolean | null | undefined;
+    /**
+     * Fine-grained session capability flags from the wired session bridge
+     * (audience map: e.g. { has_payment_method: true }). Sent with each turn so
+     * the backend shows this user only THEIR face of the orb. Boolean flags
+     * only — never user data. null/undefined = unknown (nothing is filtered).
+     */
+    getSessionCapabilities?: () => Record<string, boolean> | null | undefined;
+    /**
+     * Platform saved-credential service powering the built-in SMART SIGN-IN
+     * flow (browser password manager). Defaults to the web Credential
+     * Management adapter; pass `null` to disable the feature entirely.
+     */
+    credentialAutofill?: CredentialAutofillAdapter | null;
+    /**
+     * Host end-user identity. Conversation memory is namespaced per identity
+     * (hashed LOCALLY, never sent by this module): logout/account switches swap
+     * to that identity's own conversation instead of leaking the previous one.
+     */
+    getUserId?: () => string | null;
     messages?: {
         catalogs?: Record<string, MessageCatalog>;
         overrides?: Partial<AgentMessages>;

package/dist/esm/controller/AgentController.d.ts

@@ -74,6 +74,7 @@ export declare class AgentController {
     private readonly telemetry;
     private readonly consent;
     private readonly executor;
+    private readonly credentialAutofill;
     private readonly timings;
     private readonly chaining;
     private readonly ttsLocale;
@@ -89,7 +90,7 @@ export declare class AgentController {
     private consentModalVisible;
     private readonly sessionId;
     private sessionStarted;
-    private readonly conversation;
+    private conversation;
     private pending;
     private confirmationReasked;
     private confirmationVoiceActive;
@@ -116,6 +117,10 @@ export declare class AgentController {
     /** Persistence scope: internal orbs keep their memory under a separate key
      *  so a public orb sharing the same appId can never read it. */
     private conversationScope;
+    /** Current identity segment (LOCAL hash of the host's getUserId; never sent
+     *  anywhere). The conversation belongs to (app, scope, identity). */
+    private conversationIdentity;
+    private removeIdentityListeners;
     private loadingOlderExchanges;
     private loadOlderTimer;
     private readonly listeners;
@@ -123,6 +128,22 @@ export declare class AgentController {
     constructor(config: FiodosWebAgentConfig);
     private restorePersistedConversation;
     private persistConversation;
+    /**
+     * Re-evaluates the host identity and, when it changed, swaps conversations:
+     * the outgoing identity's session is saved under ITS private key (so a user
+     * who logs back in recovers it, honouring "never clear"), all in-memory
+     * state and UI are wiped, and the incoming identity's own session (usually
+     * empty) is restored. An anonymous visitor after a logout always starts
+     * clean — the previous user's transcript is never inherited.
+     */
+    private syncConversationIdentity;
+    /**
+     * Wipes the CURRENT identity's conversation: live memory, panel and the
+     * persisted blob. Hosts can call it from their logout for a hard wipe (by
+     * default a logout only parks the conversation under the user's private
+     * local key).
+     */
+    resetConversation(): void;
     getState(): AgentState;
     /** Update the REAL live activity and re-render (no-op when unchanged). */
     private setActivity;
@@ -171,6 +192,19 @@ export declare class AgentController {
     confirmPendingAction(): Promise<void>;
     cancelPendingAction(): void;
     private handleConfirmationTranscript;
+    /**
+     * Device capability flags advertised on each turn (never user data). Fresh
+     * per turn: cheap, and honest if the environment changes mid-session.
+     */
+    private platformCapabilities;
+    /**
+     * Live session verdict advertised on each turn (audience map — never user
+     * data): whether the user is signed in plus the app's boolean capability
+     * flags. Fresh per turn so login/logout mid-session is honest. Undefined
+     * when the host wired neither source (older installs — backend filters
+     * nothing, exactly today's behavior).
+     */
+    private sessionContext;
     private routeLabel;
     private actionLabel;
     /**

package/dist/esm/controller/AgentController.js

@@ -15,7 +15,8 @@
  *    deliberate modal tap; a loose "yes" never confirms them.
  *  - The agent only ever executes actions declared in the manifest.
  */
-import { combineContexts, createActionExecutor, createConsentManager, createSafeTelemetry, createSanitizer, buildBubbleExchangeWindow, BUBBLE_PAGE_EXCHANGES, conversationRetentionOptions, createConversationSession, persistConversationSession, restoreConversationSession, defaultRouteContextText, formatMessage, prepareConversationForTurn, recordConversationExchange, resolveConfirmationLexicon, resolveMessages, validateManifest, } from '@fiodos/core';
+import { combineContexts, createActionExecutor, createConsentManager, createSafeTelemetry, createSanitizer, buildBubbleExchangeWindow, BUBBLE_PAGE_EXCHANGES, clearPersistedConversation, conversationIdentityKey, conversationRetentionOptions, createConversationSession, persistConversationSession, restoreConversationSession, defaultRouteContextText, formatMessage, prepareConversationForTurn, recordConversationExchange, resolveConfirmationLexicon, resolveMessages, validateManifest, } from '@fiodos/core';
+import { createWebCredentialAutofillAdapter } from '../adapters/webCredentialAutofillAdapter.js';
 import { AgentApiError } from '../api/errors.js';
 import { formatAgentTurnError } from '../api/formatTurnError.js';
 import { buildManifestPayload } from '../api/backendClient.js';
@@ -40,6 +41,7 @@ export class AgentController {
         this.consentModalVisible = false;
         this.sessionId = randomSessionId();
         this.sessionStarted = false;
+        // Replaced wholesale on identity swaps / explicit resets.
         this.conversation = createConversationSession();
         this.pending = null;
         this.confirmationReasked = false;
@@ -69,6 +71,7 @@ export class AgentController {
         /** Persistence scope: internal orbs keep their memory under a separate key
          *  so a public orb sharing the same appId can never read it. */
         this.conversationScope = 'public';
+        this.removeIdentityListeners = null;
         this.loadingOlderExchanges = false;
         this.loadOlderTimer = null;
         this.listeners = new Set();
@@ -89,12 +92,19 @@ export class AgentController {
             appId: config.manifest.appId,
             version: config.consentVersion,
         });
+        // SMART SIGN-IN ships by default on web (browser password manager);
+        // hosts can override the adapter or pass null to opt out entirely.
+        this.credentialAutofill =
+            config.credentialAutofill === undefined
+                ? createWebCredentialAutofillAdapter()
+                : config.credentialAutofill;
         this.executor = createActionExecutor({
             manifest: config.manifest,
             registries: config.registries,
             navigation: config.navigation,
             messages: this.messages,
             isAuthenticated: config.isAuthenticated,
+            credentialAutofill: this.credentialAutofill,
         });
         this.timings = { ...DEFAULT_AGENT_TIMINGS, ...config.timings };
         // Chaining OFF by default; clamp to the same safe bounds as react/react-native.
@@ -128,15 +138,29 @@ export class AgentController {
         });
         // Re-emit combined state whenever the speech machine advances.
         this.unsubscribeSpeech = this.speech.subscribe(() => this.emit());
+        this.conversationIdentity = conversationIdentityKey(config.getUserId?.());
         // Rehydrate the previous conversation (page reloads): the persisted blob
         // carries its own retention rule, so expiry is decided correctly even
         // before the published config arrives. Best-effort and non-blocking.
         void this.restorePersistedConversation();
+        // Logout/login usually happens on another screen: re-check identity when
+        // the tab regains focus or becomes visible again, besides before every turn.
+        if (typeof window !== 'undefined') {
+            const check = () => void this.syncConversationIdentity();
+            window.addEventListener('focus', check);
+            document.addEventListener('visibilitychange', check);
+            this.removeIdentityListeners = () => {
+                window.removeEventListener('focus', check);
+                document.removeEventListener('visibilitychange', check);
+            };
+        }
     }
     // ── Conversation persistence (survives page reloads) ───────────────────────
     async restorePersistedConversation() {
-        const restored = await restoreConversationSession(this.config.storage, this.config.manifest.appId, Date.now(), this.conversationScope);
-        if (!restored)
+        const identityAtStart = this.conversationIdentity;
+        const restored = await restoreConversationSession(this.config.storage, this.config.manifest.appId, Date.now(), this.conversationScope, identityAtStart);
+        // The identity may have changed again while the read resolved.
+        if (!restored || this.conversationIdentity !== identityAtStart)
             return;
         // Never clobber turns the user already made while the restore resolved.
         if (this.conversation.turns.length > 0 || this.conversation.uiArchive?.length)
@@ -148,7 +172,43 @@ export class AgentController {
         this.emit();
     }
     persistConversation() {
-        void persistConversationSession(this.config.storage, this.config.manifest.appId, this.conversation, this.conversationRetentionMinutes, this.conversationScope);
+        void persistConversationSession(this.config.storage, this.config.manifest.appId, this.conversation, this.conversationRetentionMinutes, this.conversationScope, this.conversationIdentity);
+    }
+    /**
+     * Re-evaluates the host identity and, when it changed, swaps conversations:
+     * the outgoing identity's session is saved under ITS private key (so a user
+     * who logs back in recovers it, honouring "never clear"), all in-memory
+     * state and UI are wiped, and the incoming identity's own session (usually
+     * empty) is restored. An anonymous visitor after a logout always starts
+     * clean — the previous user's transcript is never inherited.
+     */
+    syncConversationIdentity() {
+        const next = conversationIdentityKey(this.config.getUserId?.());
+        if (next === this.conversationIdentity)
+            return false;
+        // 1. Park the outgoing identity's session under its own key.
+        this.persistConversation();
+        // 2. Wipe every trace from memory and the panel.
+        this.conversation = createConversationSession();
+        this.conversationIdentity = next;
+        this.lastExchange = null;
+        this.emit();
+        // 3. Bring in the new identity's own session, if any.
+        void this.restorePersistedConversation();
+        return true;
+    }
+    /**
+     * Wipes the CURRENT identity's conversation: live memory, panel and the
+     * persisted blob. Hosts can call it from their logout for a hard wipe (by
+     * default a logout only parks the conversation under the user's private
+     * local key).
+     */
+    resetConversation() {
+        this.cancelAll();
+        this.conversation = createConversationSession();
+        this.lastExchange = null;
+        void clearPersistedConversation(this.config.storage, this.config.manifest.appId, this.conversationScope, this.conversationIdentity);
+        this.emit();
     }
     // ── Subscription / state ───────────────────────────────────────────────────
     getState() {
@@ -529,6 +589,57 @@ export class AgentController {
                 this.beginConfirmationVoiceWindow();
         }
     }
+    /**
+     * Device capability flags advertised on each turn (never user data). Fresh
+     * per turn: cheap, and honest if the environment changes mid-session.
+     */
+    platformCapabilities() {
+        let autofill = false;
+        try {
+            autofill = this.credentialAutofill?.isSupported() === true;
+        }
+        catch {
+            autofill = false;
+        }
+        return autofill ? { credentialAutofill: true } : undefined;
+    }
+    /**
+     * Live session verdict advertised on each turn (audience map — never user
+     * data): whether the user is signed in plus the app's boolean capability
+     * flags. Fresh per turn so login/logout mid-session is honest. Undefined
+     * when the host wired neither source (older installs — backend filters
+     * nothing, exactly today's behavior).
+     */
+    sessionContext() {
+        const { isAuthenticated, getSessionCapabilities } = this.config;
+        if (!isAuthenticated && !getSessionCapabilities)
+            return undefined;
+        let authenticated = null;
+        try {
+            const v = isAuthenticated?.();
+            authenticated = v == null ? null : Boolean(v);
+        }
+        catch {
+            authenticated = null;
+        }
+        let capabilities;
+        try {
+            const raw = getSessionCapabilities?.();
+            if (raw && typeof raw === 'object') {
+                const clean = {};
+                for (const [k, v] of Object.entries(raw)) {
+                    if (typeof v === 'boolean')
+                        clean[k] = v;
+                }
+                if (Object.keys(clean).length > 0)
+                    capabilities = clean;
+            }
+        }
+        catch {
+            capabilities = undefined;
+        }
+        return { authenticated, ...(capabilities ? { capabilities } : {}) };
+    }
     routeLabel(intent) {
         return this.config.manifest.routes.find((r) => r.intent === intent)?.label;
     }
@@ -714,6 +825,8 @@ export class AgentController {
                         isContinuation: true,
                         chainStep: step,
                         lastStep,
+                        platformCapabilities: this.platformCapabilities(),
+                        sessionContext: this.sessionContext(),
                         ...buildManifestPayload(this.config.manifest),
                     }, { signal: controller.signal });
                     oc = await this.applyOutcome(turn, routeNow, snap?.context ?? {}, state.userMessage);
@@ -817,6 +930,9 @@ export class AgentController {
                 this.setPhase('idle');
             return;
         }
+        // Identity gate: if the host user changed since the last turn (login,
+        // logout, account switch), swap conversations BEFORE recording anything.
+        this.syncConversationIdentity();
         this.setPhase('thinking');
         // REAL activity: the request is genuinely in flight from this moment.
         this.setActivity({ kind: 'thinking' });
@@ -868,6 +984,8 @@ export class AgentController {
                 conversationHistory: conv.history,
                 conversationSummary: conv.summary ?? undefined,
                 sessionId: this.sessionId,
+                platformCapabilities: this.platformCapabilities(),
+                sessionContext: this.sessionContext(),
                 ...buildManifestPayload(this.config.manifest),
             }, { signal: controller.signal });
             outcome = await this.applyOutcome(turn, currentRoute, snapshot?.context ?? {}, text);
@@ -1109,6 +1227,8 @@ export class AgentController {
     }
     dispose() {
         this.cancelAll();
+        this.removeIdentityListeners?.();
+        this.removeIdentityListeners = null;
         if (this.loadOlderTimer) {
             clearTimeout(this.loadOlderTimer);
             this.loadOlderTimer = null;

package/dist/esm/dropin/createFiodosAgent.d.ts

@@ -13,6 +13,7 @@
  */
 import { type ActionRegistries, type AppManifest } from '@fiodos/core';
 import { AgentController } from '../controller/AgentController.js';
+import type { AgentScreenSnapshot } from '../context/screenContextStore.js';
 import { type MountOrbOptions, type MountedOrb } from '../orb/mountOrb.js';
 import type { FiodosWebAgentConfig } from '../config/types.js';
 export interface CreateFiodosAgentOptions {
@@ -37,8 +38,22 @@ export interface CreateFiodosAgentOptions {
     sttLocale?: string;
     /** Host router navigate delegate. Defaults to location.assign. */
     navigate?: (route: string) => void;
+    /**
+     * Current route/screen resolver for the agent's screen awareness. Defaults
+     * to location.pathname + search. Apps whose screens are CLIENT STATE (no URL
+     * change) pass the generated `fyodosGetCurrentRoute` here so the orb knows
+     * which screen the user is on (see screen-truth wiring).
+     */
+    getCurrentRoute?: () => string | null;
     /** Host auth check for actions requiring auth. */
-    isAuthenticated?: () => boolean;
+    isAuthenticated?: () => boolean | null | undefined;
+    /**
+     * Fine-grained session capability flags (audience map, e.g.
+     * { has_payment_method: true }) from the generated session wiring. Boolean
+     * flags only; sent with each turn so the orb shows this user only THEIR
+     * available actions.
+     */
+    getSessionCapabilities?: () => Record<string, boolean> | null | undefined;
     /** Voice id forwarded to the backend TTS. */
     ttsVoice?: string | (() => string | undefined);
     /** End-user id for rate limiting / telemetry correlation. */
@@ -59,6 +74,22 @@ export interface FiodosAgentHandle {
     orb: MountedOrb | null;
     /** Resolves once the controller is ready (immediately on the manual path). */
     ready: Promise<AgentController | null>;
+    /**
+     * Wipes the current identity's conversation (live memory + persisted blob).
+     * Call it from the app's logout for a hard wipe; no-op until ready.
+     */
+    resetConversation(): void;
+    /**
+     * Publishes WHAT THE USER IS SEEING so 'execute' actions can target it —
+     * the embed-host equivalent of the React `useAgentScreenContext` hook.
+     * Hosts without our SDK on screens (Dynamics web resources, WinCC CWCs)
+     * call this whenever their form/record/view changes. On the auto-fetch
+     * path, calls made before the controller is ready are kept and applied on
+     * ready, so hosts don't need to await `ready` themselves.
+     */
+    setScreenContext(snapshot: AgentScreenSnapshot): void;
+    /** Clears a previously published snapshot (e.g. the record was closed). */
+    clearScreenContext(): void;
     destroy(): void;
 }
 export declare function createFiodosAgent(options: CreateFiodosAgentOptions): FiodosAgentHandle;

package/dist/esm/dropin/createFiodosAgent.js

@@ -65,13 +65,18 @@ function assemble(options, manifest, baseUrl) {
         manifest,
         locale,
         sttLocale,
-        navigation: createWebNavigationAdapter({ navigate: options.navigate ?? defaultNavigate }),
+        navigation: createWebNavigationAdapter({
+            navigate: options.navigate ?? defaultNavigate,
+            getCurrentRoute: options.getCurrentRoute,
+        }),
         registries: options.registries ?? { handlers: {}, idempotencyCheckers: {} },
         backend,
         voice: createWebVoiceAdapter(),
         storage: createWebStorageAdapter(),
         telemetry,
         isAuthenticated: options.isAuthenticated,
+        getSessionCapabilities: options.getSessionCapabilities,
+        getUserId: options.getUserId,
         ttsVoice: options.ttsVoice,
         ...options.configOverrides,
     };
@@ -82,6 +87,9 @@ function assemble(options, manifest, baseUrl) {
 export function createFiodosAgent(options) {
     const baseUrl = (options.baseUrl ?? DEFAULT_WEB_API_URL).replace(/\/$/, '');
     const shouldMount = options.mount !== false;
+    // One stable owner id per handle: the host is "one screen" from the store's
+    // point of view, so consecutive setScreenContext calls replace each other.
+    const contextOwner = Symbol('fiodos-embed-host');
     // ── Manual path: manifest provided → fully synchronous (back-compat). ───────
     if (options.manifest) {
         const controller = assemble(options, options.manifest, baseUrl);
@@ -94,6 +102,15 @@ export function createFiodosAgent(options) {
             controller,
             orb,
             ready: Promise.resolve(controller),
+            resetConversation() {
+                controller.resetConversation();
+            },
+            setScreenContext(snapshot) {
+                controller.screenStore.set(contextOwner, snapshot);
+            },
+            clearScreenContext() {
+                controller.screenStore.clear(contextOwner);
+            },
             destroy() {
                 orb?.unmount();
                 controller.dispose();
@@ -102,10 +119,28 @@ export function createFiodosAgent(options) {
         return handle;
     }
     // ── Auto path (React parity): fetch manifest by apiKey, then assemble. ──────
+    // Context published before the controller resolves is buffered (last one
+    // wins) and applied on ready — hosts fire form events without awaiting us.
+    let pendingSnapshot;
     const handle = {
         controller: null,
         orb: null,
         ready: Promise.resolve(null),
+        resetConversation() {
+            handle.controller?.resetConversation();
+        },
+        setScreenContext(snapshot) {
+            if (handle.controller)
+                handle.controller.screenStore.set(contextOwner, snapshot);
+            else
+                pendingSnapshot = snapshot;
+        },
+        clearScreenContext() {
+            if (handle.controller)
+                handle.controller.screenStore.clear(contextOwner);
+            else
+                pendingSnapshot = null;
+        },
         destroy() {
             cancelled = true;
             handle.orb?.unmount();
@@ -141,6 +176,9 @@ export function createFiodosAgent(options) {
                 return null;
             }
             handle.controller = controller;
+            if (pendingSnapshot)
+                controller.screenStore.set(contextOwner, pendingSnapshot);
+            pendingSnapshot = undefined;
             handle.orb = shouldMount ? mountOrb(controller, options.orb) : null;
             if (shouldMount && options.apiKey) {
                 void sendOrbSeen({ baseUrl, apiKey: options.apiKey });

package/dist/esm/embed/dynamics.d.ts

@@ -0,0 +1,61 @@
+import type { AgentScreenSnapshot } from '../context/screenContextStore.js';
+interface XrmAttributeLike {
+    getName(): string;
+    getValue(): unknown;
+    /** Present on optionset/lookup attributes; preferred over raw values. */
+    getText?(): string | string[] | null;
+}
+interface XrmEntityLike {
+    getEntityName(): string;
+    /** Record GUID, usually brace-wrapped: "{1D2C...}". Empty on create forms. */
+    getId(): string;
+    getPrimaryAttributeValue?(): string | null;
+    attributes?: {
+        forEach(cb: (attribute: XrmAttributeLike) => void): void;
+    };
+    /** Model-driven apps expose save events here (Xrm ≥ 9.x). */
+    addOnPostSave?(handler: () => void): void;
+    removeOnPostSave?(handler: () => void): void;
+}
+export interface DynamicsFormContextLike {
+    data: {
+        entity: XrmEntityLike;
+    };
+    ui?: {
+        getFormType?(): number;
+    };
+}
+/** The subset of FiodosAgentHandle the bridge needs (keeps this module cheap to test). */
+export interface ScreenContextSink {
+    setScreenContext(snapshot: AgentScreenSnapshot): void;
+    clearScreenContext(): void;
+}
+export interface DynamicsSnapshotOptions {
+    /**
+     * Logical names of the attributes to expose to the agent. When omitted, the
+     * first `maxAttributes` non-empty scalar attributes are included.
+     */
+    attributes?: string[];
+    /** Cap when no allowlist is given. Default 12. */
+    maxAttributes?: number;
+}
+/** "{1D2C…}" → "1d2c…" (Web API URLs want bare lowercase GUIDs). */
+export declare function normalizeDynamicsId(rawId: string): string;
+/**
+ * Builds the AgentScreenSnapshot for the current form state, or null when
+ * there is nothing referenceable yet (create form: no record id).
+ */
+export declare function dynamicsFormSnapshot(formContext: DynamicsFormContextLike, options?: DynamicsSnapshotOptions): AgentScreenSnapshot | null;
+export interface DynamicsContextBridge {
+    /** Re-reads the form and republishes the snapshot (wire to OnChange/OnSave). */
+    refresh(): void;
+    /** Stops publishing and clears the agent's screen context. */
+    disconnect(): void;
+}
+/**
+ * Publishes the form snapshot now, republishes after every save (when the
+ * form exposes OnPostSave), and clears the context on disconnect. Call it from
+ * the form's OnLoad handler.
+ */
+export declare function connectDynamicsFormContext(agent: ScreenContextSink, formContext: DynamicsFormContextLike, options?: DynamicsSnapshotOptions): DynamicsContextBridge;
+export {};