npm - @marketrix.ai/widget - Versions diffs - 4.0.134 → 4.0.136 - Mend

@marketrix.ai/widget 4.0.134 → 4.0.136

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/README.md +28 -9
package/dist/src/components/views/ChatView.d.ts +5 -1
package/dist/src/context/ChatContext.d.ts +23 -8
package/dist/src/hooks/useWidget.d.ts +1 -1
package/dist/src/sdk/contracts/entities.d.ts +18 -0
package/dist/src/services/StorageService.d.ts +17 -3
package/dist/src/services/StreamClient.d.ts +4 -1
package/dist/src/types/index.d.ts +4 -1
package/dist/src/utils/bootstrap.d.ts +1 -1
package/dist/widget.mjs +64 -64
package/package.json +1 -1

package/README.md CHANGED Viewed

@@ -71,14 +71,15 @@ All modes also accept the common options below.
 These apply to every mode (script attribute → config key):
-| Config key                | Script attribute      | Type          | Description                                                                                                                                           |
-| ------------------------- | --------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `mtxApiHost`              | `mtx-api-host`        | string        | API server URL, e.g. `https://api.marketrix.ai`. The widget has no baked-in API host — you must supply it.                                            |
-| `container`               | —                     | `HTMLElement` | Element to mount inside (programmatic only). Defaults to a container appended to `<body>`.                                                            |
-| `userId`                  | —                     | number        | Associates widget activity with one of your users.                                                                                                    |
-| `widget_position_z_index` | —                     | number        | `z-index` floor for the launcher and panel. Raised to the widget's own layer token if you pass a lower value.                                         |
-| `show_widget`             | —                     | boolean       | When `false`, the widget initializes fully but its UI stays hidden. Default `true`.                                                                   |
-| `use_screenshare`         | `mtx-use-screenshare` | boolean       | When `false`, screen-share requests are auto-denied and the Share Screen button is hidden. Default `true`. Disable via `mtx-use-screenshare="false"`. |
+| Config key                | Script attribute      | Type          | Description                                                                                                                                                                                  |
+| ------------------------- | --------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `mtxApiHost`              | `mtx-api-host`        | string        | API server URL, e.g. `https://api.marketrix.ai`. The widget has no baked-in API host — you must supply it.                                                                                   |
+| `container`               | —                     | `HTMLElement` | Element to mount inside (programmatic only). Defaults to a container appended to `<body>`.                                                                                                   |
+| `userId`                  | —                     | number        | Associates widget activity with one of your users.                                                                                                                                           |
+| `widget_position_z_index` | —                     | number        | `z-index` floor for the launcher and panel. Raised to the widget's own layer token if you pass a lower value.                                                                                |
+| `show_widget`             | —                     | boolean       | When `false`, the widget initializes fully but its UI stays hidden. Default `true`.                                                                                                          |
+| `use_screenshare`         | `mtx-use-screenshare` | boolean       | When `false`, screen-share requests are auto-denied and the Share Screen button is hidden. Default `true`. Disable via `mtx-use-screenshare="false"`.                                        |
+| `styleNonce`              | `mtx-style-nonce`     | string        | A CSP nonce applied to the widget's injected `<style>` element. Required only if your `style-src` policy has no `'unsafe-inline'` — see [Content Security Policy](#content-security-policy). |
 Widget **appearance and behavior** (position, colors, sizing, border radius, animation, enabled Tell/Show/Do features, visibility, greeting toast, optional session recording, header/body/greeting text, and quick-action chips) are configured in the Marketrix dashboard and fetched from the API at init. A hidden widget stays visible in the dashboard preview.
@@ -216,7 +217,7 @@ TypeScript types are bundled with the package:
 - `MarketrixConfig` — full config for `initWidget` / `updateMarketrixConfig` (`mtxId`, `mtxKey`, `mtxApiHost`, `userId`, `show_widget`, `use_screenshare`, plus all widget appearance settings, optional).
 - `AddWidgetConfig` — discriminated config for `mountWidget` (production / preview variants + common options).
-- `ClientOwnedConfig` — the host-supplied options the API never sends (`mtxApiHost`, `userId`, `widget_position_z_index`, `show_widget`, `use_screenshare`).
+- `ClientOwnedConfig` — the host-supplied options the API never sends (`mtxApiHost`, `userId`, `widget_position_z_index`, `show_widget`, `use_screenshare`, `styleNonce`).
 - `MarketrixWidgetPreviewProps` — props for the `MarketrixWidgetPreview` component.
 - `ChatMessage`, `WidgetState`, `InstructionType` (`'tell' | 'show' | 'do'`).
@@ -230,6 +231,24 @@ TypeScript types are bundled with the package:
 ---
+## Content Security Policy
+The widget mounts into a closed Shadow DOM and injects its own stylesheet as an inline `<style>`
+element inside it (there is no external stylesheet to point a `<link>` at). A host page enforcing a
+`style-src` policy with no `'unsafe-inline'` blocks that element, leaving the widget mounted but
+entirely unstyled. If your policy is that strict, either:
+- add `'unsafe-inline'` to `style-src` (simplest, and scoped to styles only), or
+- generate a per-request nonce, add it to your `style-src` policy (`style-src 'nonce-<value>'`), and
+  pass the same value as `styleNonce` (programmatic) or `mtx-style-nonce` (script tag) — the widget
+  applies it to its injected `<style>` element.
+The widget makes network requests only to the configured `mtxApiHost`, with credentials explicitly
+omitted on every request (it authenticates via `mtxId`/`mtxKey`, never a cookie) — no `connect-src`
+entry beyond your own API host is required, and no third-party origin is ever contacted.
+---
 ## License
 Apache License 2.0 — see the `LICENSE` file.

package/dist/src/components/views/ChatView.d.ts CHANGED Viewed

@@ -6,7 +6,11 @@
  * shell's toolbar button fills with a share toggle, and the composer textarea ref. `MODES` pairs the
  * mode chips' display order with the tenant setting enabling each, so the composer offers only what
  * the workspace turned on. `ChatView` owns the draft text; `handleSendMessage` posts the turn and
- * `handleModeChange` announces a mode switch in the transcript before flipping state.
+ * `handleModeChange` announces a mode switch in the transcript before flipping state. A POST failure
+ * restores the composed text to the (now-cleared) composer — `messageDispatch`'s resolved `false` —
+ * unless the visitor already started typing a new message in the meantime, so a resend is one tap on
+ * Send rather than a retype, and the failed turn's own bubble (added optimistically, unconditionally)
+ * still shows what was said either way.
  *
  * The composer is locked both while a reply is outstanding and while a screen-access request is open,
  * since a second turn queued behind an unanswered permission card has nowhere to land. `use_screenshare`

package/dist/src/context/ChatContext.d.ts CHANGED Viewed

@@ -8,15 +8,30 @@
  * defers updaters and loses the effects captured in them, so tool calls never execute. `messageDispatch`
  * POSTs fire-and-forget: the reply arrives over SSE, so only a POST failure resolves the placeholder
  * locally, and a stale-reply watchdog keyed on id AND part count re-arms on every progress line.
+ * `messageDispatch` resolves `false` on that same POST failure (`true` otherwise, including preview
+ * mode) so a caller holding the composed text — `ChatView`'s composer — can restore it instead of the
+ * visitor having to retype a message the widget already dropped from the input box.
  *
  * The stream effect subscribes to the `StreamClient` singleton: `handleMessage` does the bookkeeping the
- * pure reducer cannot hold (`tool_call_id` dedupe in a bounded set, cleared on a terminal status), then
- * each effect runs its browser tool, stamps progress, replies `tool/response` and only then fires
- * `afterResponseAttempt`. `handleError` converts only a `StreamGaveUpError` into a transport failure, as a
- * retriable blip settles when the reply lands on the reconnected stream. `stopTask` sends `chat/stop`,
- * which carries no task id. Every failure on the tool and stop paths reaches `uiActions.setError` as well
- * as the console: an undelivered `tool/response` leaves the agent waiting on a reply that never comes, so
- * the run stalls with nothing on screen unless the visitor is told, and `do` mode may still be clicking.
+ * pure reducer cannot hold (`tool_call_id` dedupe in a bounded set, cleared on a terminal status; the
+ * mirror-shaped `respondedRequestIds` below), then each effect runs its browser tool, stamps progress,
+ * replies `tool/response` and only then fires `afterResponseAttempt`. `handleError` converts only a
+ * `StreamGaveUpError` into a transport failure, as a retriable blip settles when the reply lands on the
+ * reconnected stream. `stopTask` sends `chat/stop`, which carries no task id. Every failure on the tool
+ * and stop paths reaches `uiActions.setError` as well as the console: an undelivered `tool/response`
+ * leaves the agent waiting on a reply that never comes, so the run stalls with nothing on screen unless
+ * the visitor is told, and `do` mode may still be clicking.
+ *
+ * `respondedRequestIds` closes the other half of the reconnect-replay contract `StreamClient.ts`
+ * documents (the api replays a chat_id's whole turn history, not just the tail a client missed):
+ * `reduceText`'s own exact-repeat guard (`sseReducer.ts`) only catches an identical FINAL
+ * `chat/response` replayed after the answer already closed, because it only ever compares against the
+ * message's LAST part. A replayed `chat/delta` fails that same-string check (it's a partial fragment,
+ * not the full closed text) and would otherwise be appended as a brand-new, visibly duplicated text
+ * segment ahead of the closing response that then only overwrites the one it just added — leaving two
+ * copies of the same answer on screen. Scoped by `request_id`, not globally, so an unrelated later
+ * turn's genuinely new `chat/delta`/`chat/response` is untouched; marked closed only once, on the
+ * request's own terminal `chat/response`, since a delta is by definition still open.
  *
  * `lastStreamErrorRef`/`currentErrorRef` close the loop `handleError` alone leaves open: `StreamClient`
  * calls `onError` on every failed dial, not only a terminal give-up, so the visitor sees "Stream
@@ -43,7 +58,7 @@ interface ChatActions {
     removeMessage: (messageId: string) => void;
     setMessages: (messages: ChatMessage[]) => void;
     clearMessages: () => void;
-    messageDispatch: (content: string, mode?: InstructionType, skipUserMessage?: boolean) => Promise<void>;
+    messageDispatch: (content: string, mode?: InstructionType, skipUserMessage?: boolean) => Promise<boolean>;
 }
 interface TaskActions {
     resetTask: () => void;

package/dist/src/hooks/useWidget.d.ts CHANGED Viewed

@@ -21,7 +21,7 @@ export declare const useWidget: () => {
         removeMessage: (messageId: string) => void;
         setMessages: (messages: import("..").ChatMessage[]) => void;
         clearMessages: () => void;
-        messageDispatch: (content: string, mode?: import("..").InstructionType, skipUserMessage?: boolean) => Promise<void>;
+        messageDispatch: (content: string, mode?: import("..").InstructionType, skipUserMessage?: boolean) => Promise<boolean>;
         resetTask: () => void;
         stopTask: () => Promise<void>;
         setActiveView: (view: import("../types").WidgetView) => void;

package/dist/src/sdk/contracts/entities.d.ts CHANGED Viewed

@@ -135,6 +135,12 @@ export declare const WorkspaceSummarySchema: z.ZodObject<{
     notify_all_members_on_question: z.ZodBoolean;
 }, z.core.$strip>;
 export type WorkspaceSummary = z.infer<typeof WorkspaceSummarySchema>;
+export declare const ApplicationSkillDistillationStatusSchema: z.ZodEnum<{
+    failed: "failed";
+    idle: "idle";
+    pending: "pending";
+}>;
+export type ApplicationSkillDistillationStatus = z.infer<typeof ApplicationSkillDistillationStatusSchema>;
 export declare const ApplicationEntitySchema: z.ZodObject<{
     id: z.ZodNumber;
     created_at: z.ZodCoercedDate<unknown>;
@@ -150,6 +156,12 @@ export declare const ApplicationEntitySchema: z.ZodObject<{
     username: z.ZodNullable<z.ZodString>;
     password: z.ZodNullable<z.ZodString>;
     allowed_domains: z.ZodArray<z.ZodString>;
+    skill_distillation_status: z.ZodEnum<{
+        failed: "failed";
+        idle: "idle";
+        pending: "pending";
+    }>;
+    skill_distillation_error: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type ApplicationData = z.infer<typeof ApplicationEntitySchema>;
 /** Used for all API responses; password is write-only and never returned to clients. */
@@ -167,6 +179,12 @@ export declare const ApplicationReadSchema: z.ZodObject<{
     workspace_id: z.ZodNumber;
     username: z.ZodNullable<z.ZodString>;
     allowed_domains: z.ZodArray<z.ZodString>;
+    skill_distillation_status: z.ZodEnum<{
+        failed: "failed";
+        idle: "idle";
+        pending: "pending";
+    }>;
+    skill_distillation_error: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type ApplicationReadData = z.infer<typeof ApplicationReadSchema>;
 export declare const WidgetChipSchema: z.ZodObject<{

package/dist/src/services/StorageService.d.ts CHANGED Viewed

@@ -5,7 +5,12 @@
  * browser-local key shares via `scopedKey`, so the chat-context, drag-position and resize keys all
  * partition by tenant identically. `readLocal`/`writeLocal` are the only `localStorage` access in `src/`;
  * a host page can deny storage outright (third-party cookies off, sandboxed iframe), so both degrade to
- * a warn and the widget keeps working unpersisted.
+ * memory and the widget keeps working unpersisted. `updateContext` calls `writeLocal` on every UI-state
+ * change (a drag, a resize, every chat message), so without `warnOnce` a denied host page would spam one
+ * console line per write for the visitor's whole session; a single warn on first denial says everything
+ * a customer's console needs. `warnOnce` is keyed by read vs. write since `readLocal` also fires once on
+ * its own (`loadContext` at module init, before any write) and both should still surface if a page
+ * somehow denies one and not the other.
  *
  * `loadContext` merges one parsed key over `DEFAULT_CONTEXT`, so an older widget version's payload reads
  * as incomplete rather than corrupt, and discards anything past `CONTEXT_EXPIRY_MS` (7 days).
@@ -14,8 +19,13 @@
  * from it, since without that two applications on one origin would leak one tenant's transcript into
  * another's.
  *
- * The chat snapshot is `{messages, currentMode, isOpen}` — chat_id, config and timestamp are deliberately
- * excluded. `StoredMessage` is the ONE place `content` still exists as a field: a live `ChatMessage` has
+ * `writeChatSnapshot`'s own parameter is `{messages, currentMode, isOpen}` — chat_id, config and
+ * timestamp are deliberately excluded from THAT function's input, though `config` (via `setConfig`)
+ * and `chat_id`/`timestamp` (via `updateContext`) are still part of the one persisted record on disk;
+ * `config` there is the tenant's own `mtxId`/`mtxKey`/`mtxApiHost`/`userId`/rendered settings — no
+ * broader PII, and `mtxId`/`mtxKey` are already fully public in the host page's own script-tag markup,
+ * not a secret this adds exposure to. `StoredMessage` is the ONE place `content` still exists as a
+ * field: a live `ChatMessage` has
  * none (every reader derives `messageText(parts)` instead), but a transcript written before `parts`
  * existed has only `content` on disk, so `readChatSnapshot` backfills a text part from it and
  * `writeChatSnapshot` derives `content` back from `parts` on the way out, keeping the persisted shape
@@ -50,6 +60,10 @@ type MarketrixChatContext = Omit<ChatSnapshot, 'messages'> & {
 };
 export declare function tenantScope(config: MarketrixConfig): string;
 export declare function scopedKey(name: string, config: MarketrixConfig): string;
+/** Test-only: `warned` is module-level so a "denies storage, keeps working" proof isn't the last test in
+ * the file to touch a denied `Storage.prototype`, and a later test in the same `bun test` process (one
+ * process per file, not per test) would otherwise see zero warns instead of one. Never called from `src/`. */
+export declare function resetStorageWarningsForTests(): void;
 export declare function readLocal(key: string): string | null;
 export declare function writeLocal(key: string, value: string): void;
 declare class StorageService {

package/dist/src/services/StreamClient.d.ts CHANGED Viewed

@@ -6,7 +6,10 @@
  *
  * `open` is the transport, `registered` is the chat: only the latter can carry a reply, so `isConnected` reads
  * `registered` and nothing waits on `open`. Backoff counters reset only on `registered` — resetting at `open` would
- * defeat the max-attempts cap if registration never lands and the stream flaps open→closed. Tabs share the
+ * defeat the max-attempts cap if registration never lands and the stream flaps open→closed. `scheduleReconnect`'s
+ * EQUAL JITTER (the doubling delay's own second half, chosen uniformly) keeps every dial within the documented
+ * schedule's bound while stopping every tab across every open customer page from redialing on the exact same
+ * clock tick after a shared outage — a thundering herd the deterministic schedule alone cannot prevent. Tabs share the
  * localStorage chat id, so the server keys SSE by (chat_id, tab_id) and `tabId` stops tabs evicting each other's
  * stream. Credentials are read at connect time, not captured at init, so a reconnect after `updateMarketrixConfig`
  * dials with the current ones.

package/dist/src/types/index.d.ts CHANGED Viewed

@@ -4,7 +4,9 @@
  *
  * `ClientOwnedConfig` holds host-supplied knobs the api never sends (`show_widget: false` still
  * initializes the widget fully and only hides its UI; `use_screenshare: false` auto-denies
- * screen-access requests and hides the Share Screen button; both default true). `MarketrixConfig` is
+ * screen-access requests and hides the Share Screen button; both default true; `styleNonce` reaches
+ * the injected shadow-root `<style>` element for a host running a strict `style-src` CSP with no
+ * `'unsafe-inline'`). `MarketrixConfig` is
  * deliberately FLAT so api settings spread straight in — `mtxId`+`mtxKey` is the credential, while
  * `mtxApp` is stamped internally after validation and never an input, since an application id is
  * guessable and authenticates nothing. `ValidWidgetConfig` is a `MarketrixConfig` run through
@@ -29,6 +31,7 @@ export interface ClientOwnedConfig {
     widget_position_z_index?: number;
     show_widget?: boolean;
     use_screenshare?: boolean;
+    styleNonce?: string;
 }
 export type MarketrixConfig = Partial<WidgetRenderedSettings> & ClientOwnedConfig & {
     mtxId?: string;

package/dist/src/utils/bootstrap.d.ts CHANGED Viewed

@@ -11,7 +11,7 @@ interface WidgetMount {
 export declare const widgetState: {
     mount: WidgetMount | null;
 };
-export declare const createWidgetContainer: (parentContainer?: HTMLElement) => {
+export declare const createWidgetContainer: (parentContainer?: HTMLElement, styleNonce?: string) => {
     container: HTMLElement;
     shadowRoot: ShadowRoot;
     mountEl: HTMLElement;