@fiodos/web-core 0.1.15 → 0.1.18

package/dist/cjs/api/anonUserId.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Stable per-browser ANONYMOUS caller id, sent as `x-user-id` when the host
+ * app provides no getUserId (public storefronts, marketing sites…).
+ *
+ * Why: the backend's fairness rate-limit buckets anonymous callers by source
+ * IP. Behind shopper NATs / proxies that means MANY real visitors share one
+ * bucket and an active session can starve itself into 429 ("Too many
+ * requests"). A random per-browser id gives each visitor their own fairness
+ * bucket without identifying anyone: it is random, local, never derived from
+ * personal data, and never used for conversation identity (that stays 'anon').
+ */
+/** Returns the stable anonymous caller id for this browser (creates it once). */
+export declare function getAnonCallerId(): string;
+/**
+ * Wraps the host's getUserId so anonymous visitors still send a stable
+ * per-browser caller id for rate-limit fairness. The host's real user id
+ * always wins when present.
+ */
+export declare function withAnonCallerFallback(getUserId?: () => string | null): () => string | null;

package/dist/cjs/api/anonUserId.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * Stable per-browser ANONYMOUS caller id, sent as `x-user-id` when the host
+ * app provides no getUserId (public storefronts, marketing sites…).
+ *
+ * Why: the backend's fairness rate-limit buckets anonymous callers by source
+ * IP. Behind shopper NATs / proxies that means MANY real visitors share one
+ * bucket and an active session can starve itself into 429 ("Too many
+ * requests"). A random per-browser id gives each visitor their own fairness
+ * bucket without identifying anyone: it is random, local, never derived from
+ * personal data, and never used for conversation identity (that stays 'anon').
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAnonCallerId = getAnonCallerId;
+exports.withAnonCallerFallback = withAnonCallerFallback;
+const STORAGE_KEY = 'fyodos:anon-caller:v1';
+let inMemoryId = null;
+function randomId() {
+    try {
+        const c = globalThis.crypto;
+        if (c?.randomUUID)
+            return `anon-${c.randomUUID()}`;
+    }
+    catch {
+        /* fall through */
+    }
+    return `anon-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 12)}`;
+}
+/** Returns the stable anonymous caller id for this browser (creates it once). */
+function getAnonCallerId() {
+    if (inMemoryId)
+        return inMemoryId;
+    try {
+        const stored = window.localStorage.getItem(STORAGE_KEY);
+        if (stored) {
+            inMemoryId = stored;
+            return stored;
+        }
+        const fresh = randomId();
+        window.localStorage.setItem(STORAGE_KEY, fresh);
+        inMemoryId = fresh;
+        return fresh;
+    }
+    catch {
+        // Private mode / storage blocked: keep a per-page-load id (still better
+        // than sharing the IP bucket with every other visitor).
+        inMemoryId = inMemoryId ?? randomId();
+        return inMemoryId;
+    }
+}
+/**
+ * Wraps the host's getUserId so anonymous visitors still send a stable
+ * per-browser caller id for rate-limit fairness. The host's real user id
+ * always wins when present.
+ */
+function withAnonCallerFallback(getUserId) {
+    return () => {
+        const real = getUserId?.();
+        if (real)
+            return real;
+        return getAnonCallerId();
+    };
+}

package/dist/cjs/api/backendClient.js

@@ -145,6 +145,10 @@ function createFiodosBackendClient(options) {
                         intent: request.lastStep.intent,
                         ...(request.lastStep.label ? { label: request.lastStep.label } : {}),
                         success: request.lastStep.success,
+                        // Bounded result payload of the executed step (product search
+                        // results…): the backend renders it so the model can read real
+                        // ids for the NEXT step's parameters.
+                        ...(request.lastStep.data ? { data: request.lastStep.data } : {}),
                     };
                 }
             }

package/dist/cjs/api/clientBootstrap.d.ts

@@ -33,6 +33,7 @@ export declare function fetchClientManifest(opts: {
     baseUrl: string;
     apiKey: string;
 }): Promise<ManifestBootstrapResult>;
+export declare function markEmbedDistribution(): void;
 /**
  * Best-effort heartbeat proving the orb booted. Never throws and never blocks
  * the orb — failures are swallowed (the dashboard simply won't flip to ✓).

package/dist/cjs/api/clientBootstrap.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_WEB_API_URL = void 0;
 exports.fetchClientManifest = fetchClientManifest;
+exports.markEmbedDistribution = markEmbedDistribution;
 exports.sendOrbSeen = sendOrbSeen;
 const version_1 = require("../version");
 /**
@@ -42,11 +43,21 @@ async function fetchClientManifest(opts) {
     }
     return { status: 'ready', manifest: data.manifest };
 }
+/**
+ * Set by the embed bundle entrypoint (dist/embed/fiodos-embed.js). Embeds are
+ * loaded from a CDN `@latest` URL (Shopify themes, Dynamics…), so they update
+ * THEMSELVES — the heartbeat marks them so the dashboard never shows an
+ * "update available / npm install" notice the developer cannot act on.
+ */
+let embedDistribution = false;
+function markEmbedDistribution() {
+    embedDistribution = true;
+}
 function detectPlatform() {
-    if (typeof navigator !== 'undefined' && /Mobi|Android|iPhone|iPad/i.test(navigator.userAgent)) {
-        return 'web-mobile';
-    }
-    return 'web';
+    const mobile = typeof navigator !== 'undefined' && /Mobi|Android|iPhone|iPad/i.test(navigator.userAgent);
+    if (embedDistribution)
+        return mobile ? 'web-embed-mobile' : 'web-embed';
+    return mobile ? 'web-mobile' : 'web';
 }
 /**
  * Best-effort heartbeat proving the orb booted. Never throws and never blocks

package/dist/cjs/controller/AgentController.js

@@ -716,9 +716,22 @@ class AgentController {
                 /* keep the assistant's guiding reply; never speak a refusal. */
             }
             else if (r.message) {
+                // FEEDBACK GUARANTEE: the handler's outcome message (success,
+                // idempotent or failure) is the ground truth that the action ran;
+                // speak it instead of the LLM's optimistic reply.
                 outReply = r.message;
                 outAudio = null;
             }
+            else if (!r.success) {
+                // Same guarantee for a handler that failed WITHOUT setting `message`
+                // (e.g. a declarative Shopify/OData `execution` call that hit a
+                // network/HTTP/template error — apiActions.ts never throws, so
+                // runManifestAction's catch never runs either). Without this, the
+                // LLM's pre-action narration ("Adding X to your cart…") stays on
+                // screen as if it had happened — a silent false success.
+                outReply = this.messages.actionFailed;
+                outAudio = null;
+            }
             // Chain signal: only a cleanly EXECUTED, non-recoverable step may advance,
             // and only when the backend asked to continue (task_status=in_progress).
             if (turn.action &&
@@ -726,11 +739,16 @@ class AgentController {
                 r.success &&
                 !r.recoverable) {
                 const intent = turn.action.intent ?? '';
+                // Feed the step's RESULT DATA back to the next chain turn (bounded):
+                // it is how the model reads real technical values (variant ids, line
+                // numbers) out of a data action instead of inventing them.
+                const chainData = (0, core_1.trimChainStepData)(r.data);
                 lastStep = {
                     type: turn.action.type,
                     intent,
                     label: turn.action.type === 'navigate' ? this.routeLabel(intent) : this.actionLabel(intent),
                     success: true,
+                    ...(chainData ? { data: chainData } : {}),
                 };
                 actionKey = `${turn.action.type}:${intent}`;
                 canContinue = turn.taskStatus === 'in_progress';

package/dist/cjs/dropin/createFiodosAgent.js

@@ -24,6 +24,7 @@ const AgentController_1 = require("../controller/AgentController");
 const mountOrb_1 = require("../orb/mountOrb");
 const devErrorBadge_1 = require("../orb/devErrorBadge");
 const clientBootstrap_1 = require("../api/clientBootstrap");
+const anonUserId_1 = require("../api/anonUserId");
 function defaultNavigate(route) {
     if (typeof window !== 'undefined' && window.location)
         window.location.assign(route);
@@ -63,15 +64,18 @@ function assemble(options, manifest, baseUrl) {
     const fallback = browserLocale();
     const locale = resolveAgentLocale(options);
     const sttLocale = options.sttLocale ?? options.locale ?? fallback.sttLocale;
+    // Rate-limit fairness: anonymous visitors still send a stable per-browser
+    // caller id (never used for conversation identity — that stays 'anon').
+    const callerId = (0, anonUserId_1.withAnonCallerFallback)(options.getUserId);
     const backend = (0, backendClient_1.createFiodosBackendClient)({
         baseUrl,
         apiKey: options.apiKey,
-        getUserId: options.getUserId,
+        getUserId: callerId,
     });
     const telemetry = (0, backendTelemetry_1.createFiodosTelemetry)({
         baseUrl,
         apiKey: options.apiKey,
-        getUserId: options.getUserId,
+        getUserId: callerId,
     });
     const config = {
         manifest,

package/dist/cjs/embed/global.d.ts

@@ -27,7 +27,7 @@ import { createScreenContextStore } from '../context/screenContextStore';
 import { connectDynamicsFormContext, dynamicsFormSnapshot, normalizeDynamicsId } from './dynamics';
 import { buildApiActionRegistries, validateManifest } from '@fiodos/core';
 declare const api: {
-    readonly version: "0.1.15";
+    readonly version: "0.1.18";
     readonly createFiodosAgent: typeof createFiodosAgent;
     readonly mountOrb: typeof mountOrb;
     readonly AgentController: typeof AgentController;

package/dist/cjs/embed/global.js

@@ -28,7 +28,11 @@ const AgentController_1 = require("../controller/AgentController");
 const screenContextStore_1 = require("../context/screenContextStore");
 const dynamics_1 = require("./dynamics");
 const version_1 = require("../version");
+const clientBootstrap_1 = require("../api/clientBootstrap");
 const core_1 = require("@fiodos/core");
+// This bundle is served from a CDN `@latest` URL and updates itself: mark the
+// heartbeat so the dashboard never shows an npm update command for it.
+(0, clientBootstrap_1.markEmbedDistribution)();
 const api = {
     version: version_1.SDK_VERSION,
     createFiodosAgent: createFiodosAgent_1.createFiodosAgent,

package/dist/cjs/orb/mountOrb.js

@@ -710,13 +710,44 @@ function mountOrb(controller, options = {}) {
         // Live-activity line: white (reply color), italic — not the faint gray.
         busyStep.style.color = t.titleColor;
     }
+    // The panel's open state survives FULL PAGE LOADS within the tab session:
+    // on multi-page hosts (Shopify storefronts…) every agent navigation reloads
+    // the document, and without this the conversation panel closed mid-dialogue
+    // on every step. sessionStorage is per-tab and cleared when the tab closes,
+    // so a fresh visit never starts with the panel open.
+    const panelOpenKey = `fyodos:panel-open:${controller.config.manifest.appId}`;
+    function persistPanelOpen(open) {
+        try {
+            if (open)
+                window.sessionStorage.setItem(panelOpenKey, '1');
+            else
+                window.sessionStorage.removeItem(panelOpenKey);
+        }
+        catch {
+            /* storage unavailable (private mode) — persistence is best-effort */
+        }
+    }
+    function wasPanelOpen() {
+        try {
+            return window.sessionStorage.getItem(panelOpenKey) === '1';
+        }
+        catch {
+            return false;
+        }
+    }
     function setBubble(open) {
         bubbleOpen = open;
         bubble.style.display = open ? 'flex' : 'none';
+        persistPanelOpen(open);
         if (open) {
             applyBubbleTheme();
             positionBubble();
             textInput.focus();
+            // Paint the CURRENT conversation immediately: exchanges are only
+            // rendered inside render() while the panel is open, so without this
+            // the restored history stayed invisible (an apparently stuck panel)
+            // until the next controller event — i.e. until the user typed.
+            render(controller.getState());
         }
         else {
             bubbleDictation.stop();
@@ -1159,6 +1190,13 @@ function mountOrb(controller, options = {}) {
     }
     const unsubscribe = controller.subscribe(render);
     render(controller.getState());
+    // Re-open the conversation panel after a full page load when it was open
+    // before (MPA hosts reload on every navigation): the dialogue visually
+    // continues where it was — the persisted conversation restores async in the
+    // controller and repaints via emit → render once loaded.
+    if (enableTextInput && wasPanelOpen()) {
+        setBubble(true);
+    }
     // Track the current route AND the app's live locale so the thought bubble
     // re-resolves its CTA on navigation and on language switches. No universal
     // navigation/i18n event exists, so poll + listen to popstate / visibility

package/dist/cjs/version.d.ts

@@ -5,5 +5,5 @@
  * Auto-generated by scripts/sync-sdk-version.mjs from package.json. Do not edit
  * by hand — change package.json `version` and re-run the sync/release script.
  */
-export declare const SDK_VERSION = "0.1.15";
+export declare const SDK_VERSION = "0.1.18";
 export declare const SDK_PACKAGE = "@fiodos/web-core";

package/dist/cjs/version.js

@@ -8,5 +8,5 @@ exports.SDK_PACKAGE = exports.SDK_VERSION = void 0;
  * Auto-generated by scripts/sync-sdk-version.mjs from package.json. Do not edit
  * by hand — change package.json `version` and re-run the sync/release script.
  */
-exports.SDK_VERSION = '0.1.15';
+exports.SDK_VERSION = '0.1.18';
 exports.SDK_PACKAGE = '@fiodos/web-core';