@mrrocket/sdk 0.15.0 → 0.17.0

package/dist/push-web.d.ts

@@ -1,16 +1,3 @@
-/**
- * Web push in the browser (SDK 0.7.0): signs the signed-in person up for push notifications from the product's Lifecycle
- * journeys. Loaded only when the site calls `push.subscribe()` (a dynamic import in Next.js, `sdk-push.js` for the script
- * tag), so pages that never ask carry none of it.
- *
- * 1. The browser's permission (asked only from a click, and only when the site says so; `ask: false` only re-sends an
- *    existing subscription).
- * 2. The service worker the site hosts (`/mrrocket-sw.js`, a copy of the file MRRocket serves), registered with the
- *    public key and MRRocket's address in its URL, so it can report opened notifications. A site with its own service
- *    worker imports ours there and passes `serviceWorker: false`.
- * 3. The workspace's VAPID key from `GET /api/sdk/push`, the browser's subscription with it, and the subscription sent to
- *    `POST /api/sdk/push` for this person. A subscription made with another key is replaced.
- */
 export type PushStatus = "subscribed" | "denied" | "not-asked" | "unsupported" | "not-signed-in" | "error";
 export interface PushResult {
     status: PushStatus;
@@ -31,6 +18,8 @@ export interface WebPushContext {
     apiKey: string;
     /** The identify() id; push needs a signed-in person. */
     distinctId: string | undefined;
+    /** The identity hash of that id (0.16.0), when the site gave one to identify. */
+    userHash?: string;
     /** The permission, asked synchronously by the caller inside the click (Safari needs that), or the current one. */
     permission?: Promise<NotificationPermission>;
 }

package/dist/push-web.js

@@ -1,4 +1,5 @@
 // src/push-web.ts
+import { warnUnsigned } from "./identity.js";
 var b64urlBytes = (s) => {
   const bin = atob(s.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(s.length / 4) * 4, "="));
   const out = new Uint8Array(bin.length);
@@ -49,8 +50,9 @@ var subscribeWebPush = async (ctx, options = {}) => {
     const saved = await fetch(`${ctx.host}/api/sdk/push`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ key: ctx.apiKey, distinctId: ctx.distinctId, platform: "web", subscription: sub.toJSON(), host: ctx.host })
+      body: JSON.stringify({ key: ctx.apiKey, distinctId: ctx.distinctId, userHash: ctx.userHash, platform: "web", subscription: sub.toJSON(), host: ctx.host })
     });
+    warnUnsigned(saved.status);
     return saved.ok ? { status: "subscribed" } : { status: "error", reason: `MRRocket answered ${saved.status}.` };
   } catch (e) {
     return { status: "error", reason: e instanceof Error ? e.message : String(e) };
@@ -65,7 +67,7 @@ var unsubscribeWebPush = async (ctx) => {
     await fetch(`${ctx.host}/api/sdk/push`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ key: ctx.apiKey, distinctId: ctx.distinctId, platform: "web", remove: true, endpoint: sub.endpoint })
+      body: JSON.stringify({ key: ctx.apiKey, distinctId: ctx.distinctId, userHash: ctx.userHash, platform: "web", remove: true, endpoint: sub.endpoint })
     }).catch(() => null);
     return await sub.unsubscribe();
   } catch {

package/dist/push-web.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/push-web.ts"],"sourcesContent":["/**\n * Web push in the browser (SDK 0.7.0): signs the signed-in person up for push notifications from the product's Lifecycle\n * journeys. Loaded only when the site calls `push.subscribe()` (a dynamic import in Next.js, `sdk-push.js` for the script\n * tag), so pages that never ask carry none of it.\n *\n * 1. The browser's permission (asked only from a click, and only when the site says so; `ask: false` only re-sends an\n *    existing subscription).\n * 2. The service worker the site hosts (`/mrrocket-sw.js`, a copy of the file MRRocket serves), registered with the\n *    public key and MRRocket's address in its URL, so it can report opened notifications. A site with its own service\n *    worker imports ours there and passes `serviceWorker: false`.\n * 3. The workspace's VAPID key from `GET /api/sdk/push`, the browser's subscription with it, and the subscription sent to\n *    `POST /api/sdk/push` for this person. A subscription made with another key is replaced.\n */\nexport type PushStatus = \"subscribed\" | \"denied\" | \"not-asked\" | \"unsupported\" | \"not-signed-in\" | \"error\";\n\nexport interface PushResult {\n    status: PushStatus;\n    /** What went wrong, for \"error\" and \"unsupported\". */\n    reason?: string;\n}\n\nexport interface WebPushOptions {\n    /**\n     * The service worker's path on your site (default \"/mrrocket-sw.js\"), or false when your site already has one that\n     * imports ours (`importScripts(\"/mrrocket-sw.js\")`): the SDK then uses the one that is active.\n     */\n    serviceWorker?: string | false;\n    /** Ask for the permission when it was not given yet (default true). False: only re-send an existing subscription. */\n    ask?: boolean;\n}\n\nexport interface WebPushContext {\n    host: string;\n    apiKey: string;\n    /** The identify() id; push needs a signed-in person. */\n    distinctId: string | undefined;\n    /** The permission, asked synchronously by the caller inside the click (Safari needs that), or the current one. */\n    permission?: Promise<NotificationPermission>;\n}\n\nconst b64urlBytes = (s: string) => {\n    const bin = atob(s.replace(/-/g, \"+\").replace(/_/g, \"/\").padEnd(Math.ceil(s.length / 4) * 4, \"=\"));\n    const out = new Uint8Array(bin.length);\n    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n    return out;\n};\n\nconst sameKey = (a: ArrayBuffer | null | undefined, b: Uint8Array) => {\n    if (!a) return false;\n    const x = new Uint8Array(a);\n    return x.length === b.length && x.every((v, i) => v === b[i]);\n};\n\n/** True where the browser can receive web push (Safari 16.4+ only for sites added to the Home Screen on iOS). */\nexport const webPushSupported = () =>\n    typeof window !== \"undefined\" && \"serviceWorker\" in navigator && \"PushManager\" in window && \"Notification\" in window;\n\n/** The permission, asked right away when `ask` and not given yet. Call it synchronously in the click handler. */\nexport const askPermission = (ask = true): Promise<NotificationPermission> => {\n    if (!webPushSupported()) return Promise.resolve(\"denied\");\n    if (Notification.permission !== \"default\" || !ask) return Promise.resolve(Notification.permission);\n    try {\n        return Promise.resolve(Notification.requestPermission());\n    } catch {\n        return Promise.resolve(\"denied\");\n    }\n};\n\nconst registration = async (host: string, apiKey: string, sw: string | false) => {\n    if (sw !== false) {\n        const url = `${sw}?key=${encodeURIComponent(apiKey)}&host=${encodeURIComponent(host)}`;\n        await navigator.serviceWorker.register(url);\n    }\n    return navigator.serviceWorker.ready;\n};\n\nexport const subscribeWebPush = async (ctx: WebPushContext, options: WebPushOptions = {}): Promise<PushResult> => {\n    if (!webPushSupported()) return { status: \"unsupported\", reason: \"This browser has no web push.\" };\n    if (!ctx.distinctId) return { status: \"not-signed-in\" };\n    const ask = options.ask !== false;\n    const permission = await (ctx.permission ?? askPermission(ask));\n    if (permission === \"denied\") return { status: \"denied\" };\n    if (permission !== \"granted\") return { status: ask ? \"denied\" : \"not-asked\" };\n    try {\n        const r = await fetch(`${ctx.host}/api/sdk/push?key=${encodeURIComponent(ctx.apiKey)}`);\n        const vapid = r.ok ? ((await r.json()) as { web?: { vapidKey?: string } }).web?.vapidKey : undefined;\n        if (!vapid) return { status: \"error\", reason: `MRRocket answered ${r.status} for the push key.` };\n        const key = b64urlBytes(vapid);\n        const reg = await registration(ctx.host, ctx.apiKey, options.serviceWorker ?? \"/mrrocket-sw.js\");\n        let sub = await reg.pushManager.getSubscription();\n        if (sub && !sameKey(sub.options?.applicationServerKey, key)) {\n            await sub.unsubscribe().catch(() => false);\n            sub = null;\n        }\n        sub ??= await reg.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: key });\n        const saved = await fetch(`${ctx.host}/api/sdk/push`, {\n            method: \"POST\",\n            headers: { \"content-type\": \"application/json\" },\n            body: JSON.stringify({ key: ctx.apiKey, distinctId: ctx.distinctId, platform: \"web\", subscription: sub.toJSON(), host: ctx.host }),\n        });\n        return saved.ok ? { status: \"subscribed\" } : { status: \"error\", reason: `MRRocket answered ${saved.status}.` };\n    } catch (e) {\n        return { status: \"error\", reason: e instanceof Error ? e.message : String(e) };\n    }\n};\n\n/** Ends this browser's subscription and tells MRRocket (sign-out, or the person turned push off). */\nexport const unsubscribeWebPush = async (ctx: WebPushContext): Promise<boolean> => {\n    if (!webPushSupported()) return false;\n    try {\n        const reg = await navigator.serviceWorker.getRegistration();\n        const sub = await reg?.pushManager.getSubscription();\n        if (!sub) return false;\n        await fetch(`${ctx.host}/api/sdk/push`, {\n            method: \"POST\",\n            headers: { \"content-type\": \"application/json\" },\n            body: JSON.stringify({ key: ctx.apiKey, distinctId: ctx.distinctId, platform: \"web\", remove: true, endpoint: sub.endpoint }),\n        }).catch(() => null);\n        return await sub.unsubscribe();\n    } catch {\n        return false;\n    }\n};\n"],"mappings":";AAwCA,IAAM,cAAc,CAAC,MAAc;AAC/B,QAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,OAAO,KAAK,KAAK,EAAE,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;AACjG,QAAM,MAAM,IAAI,WAAW,IAAI,MAAM;AACrC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,KAAI,CAAC,IAAI,IAAI,WAAW,CAAC;AAC9D,SAAO;AACX;AAEA,IAAM,UAAU,CAAC,GAAmC,MAAkB;AAClE,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,IAAI,WAAW,CAAC;AAC1B,SAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC;AAChE;AAGO,IAAM,mBAAmB,MAC5B,OAAO,WAAW,eAAe,mBAAmB,aAAa,iBAAiB,UAAU,kBAAkB;AAG3G,IAAM,gBAAgB,CAAC,MAAM,SAA0C;AAC1E,MAAI,CAAC,iBAAiB,EAAG,QAAO,QAAQ,QAAQ,QAAQ;AACxD,MAAI,aAAa,eAAe,aAAa,CAAC,IAAK,QAAO,QAAQ,QAAQ,aAAa,UAAU;AACjG,MAAI;AACA,WAAO,QAAQ,QAAQ,aAAa,kBAAkB,CAAC;AAAA,EAC3D,QAAQ;AACJ,WAAO,QAAQ,QAAQ,QAAQ;AAAA,EACnC;AACJ;AAEA,IAAM,eAAe,OAAO,MAAc,QAAgB,OAAuB;AAC7E,MAAI,OAAO,OAAO;AACd,UAAM,MAAM,GAAG,EAAE,QAAQ,mBAAmB,MAAM,CAAC,SAAS,mBAAmB,IAAI,CAAC;AACpF,UAAM,UAAU,cAAc,SAAS,GAAG;AAAA,EAC9C;AACA,SAAO,UAAU,cAAc;AACnC;AAEO,IAAM,mBAAmB,OAAO,KAAqB,UAA0B,CAAC,MAA2B;AAC9G,MAAI,CAAC,iBAAiB,EAAG,QAAO,EAAE,QAAQ,eAAe,QAAQ,gCAAgC;AACjG,MAAI,CAAC,IAAI,WAAY,QAAO,EAAE,QAAQ,gBAAgB;AACtD,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,aAAa,OAAO,IAAI,cAAc,cAAc,GAAG;AAC7D,MAAI,eAAe,SAAU,QAAO,EAAE,QAAQ,SAAS;AACvD,MAAI,eAAe,UAAW,QAAO,EAAE,QAAQ,MAAM,WAAW,YAAY;AAC5E,MAAI;AACA,UAAM,IAAI,MAAM,MAAM,GAAG,IAAI,IAAI,qBAAqB,mBAAmB,IAAI,MAAM,CAAC,EAAE;AACtF,UAAM,QAAQ,EAAE,MAAO,MAAM,EAAE,KAAK,GAAuC,KAAK,WAAW;AAC3F,QAAI,CAAC,MAAO,QAAO,EAAE,QAAQ,SAAS,QAAQ,qBAAqB,EAAE,MAAM,qBAAqB;AAChG,UAAM,MAAM,YAAY,KAAK;AAC7B,UAAM,MAAM,MAAM,aAAa,IAAI,MAAM,IAAI,QAAQ,QAAQ,iBAAiB,iBAAiB;AAC/F,QAAI,MAAM,MAAM,IAAI,YAAY,gBAAgB;AAChD,QAAI,OAAO,CAAC,QAAQ,IAAI,SAAS,sBAAsB,GAAG,GAAG;AACzD,YAAM,IAAI,YAAY,EAAE,MAAM,MAAM,KAAK;AACzC,YAAM;AAAA,IACV;AACA,YAAQ,MAAM,IAAI,YAAY,UAAU,EAAE,iBAAiB,MAAM,sBAAsB,IAAI,CAAC;AAC5F,UAAM,QAAQ,MAAM,MAAM,GAAG,IAAI,IAAI,iBAAiB;AAAA,MAClD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,IAAI,QAAQ,YAAY,IAAI,YAAY,UAAU,OAAO,cAAc,IAAI,OAAO,GAAG,MAAM,IAAI,KAAK,CAAC;AAAA,IACrI,CAAC;AACD,WAAO,MAAM,KAAK,EAAE,QAAQ,aAAa,IAAI,EAAE,QAAQ,SAAS,QAAQ,qBAAqB,MAAM,MAAM,IAAI;AAAA,EACjH,SAAS,GAAG;AACR,WAAO,EAAE,QAAQ,SAAS,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAE;AAAA,EACjF;AACJ;AAGO,IAAM,qBAAqB,OAAO,QAA0C;AAC/E,MAAI,CAAC,iBAAiB,EAAG,QAAO;AAChC,MAAI;AACA,UAAM,MAAM,MAAM,UAAU,cAAc,gBAAgB;AAC1D,UAAM,MAAM,MAAM,KAAK,YAAY,gBAAgB;AACnD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,GAAG,IAAI,IAAI,iBAAiB;AAAA,MACpC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,IAAI,QAAQ,YAAY,IAAI,YAAY,UAAU,OAAO,QAAQ,MAAM,UAAU,IAAI,SAAS,CAAC;AAAA,IAC/H,CAAC,EAAE,MAAM,MAAM,IAAI;AACnB,WAAO,MAAM,IAAI,YAAY;AAAA,EACjC,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;","names":[]}
+{"version":3,"sources":["../src/push-web.ts"],"sourcesContent":["/**\n * Web push in the browser (SDK 0.7.0): signs the signed-in person up for push notifications from the product's Lifecycle\n * journeys. Loaded only when the site calls `push.subscribe()` (a dynamic import in Next.js, `sdk-push.js` for the script\n * tag), so pages that never ask carry none of it.\n *\n * 1. The browser's permission (asked only from a click, and only when the site says so; `ask: false` only re-sends an\n *    existing subscription).\n * 2. The service worker the site hosts (`/mrrocket-sw.js`, a copy of the file MRRocket serves), registered with the\n *    public key and MRRocket's address in its URL, so it can report opened notifications. A site with its own service\n *    worker imports ours there and passes `serviceWorker: false`.\n * 3. The workspace's VAPID key from `GET /api/sdk/push`, the browser's subscription with it, and the subscription sent to\n *    `POST /api/sdk/push` for this person. A subscription made with another key is replaced.\n */\nimport { warnUnsigned } from \"./identity\";\n\nexport type PushStatus = \"subscribed\" | \"denied\" | \"not-asked\" | \"unsupported\" | \"not-signed-in\" | \"error\";\n\nexport interface PushResult {\n    status: PushStatus;\n    /** What went wrong, for \"error\" and \"unsupported\". */\n    reason?: string;\n}\n\nexport interface WebPushOptions {\n    /**\n     * The service worker's path on your site (default \"/mrrocket-sw.js\"), or false when your site already has one that\n     * imports ours (`importScripts(\"/mrrocket-sw.js\")`): the SDK then uses the one that is active.\n     */\n    serviceWorker?: string | false;\n    /** Ask for the permission when it was not given yet (default true). False: only re-send an existing subscription. */\n    ask?: boolean;\n}\n\nexport interface WebPushContext {\n    host: string;\n    apiKey: string;\n    /** The identify() id; push needs a signed-in person. */\n    distinctId: string | undefined;\n    /** The identity hash of that id (0.16.0), when the site gave one to identify. */\n    userHash?: string;\n    /** The permission, asked synchronously by the caller inside the click (Safari needs that), or the current one. */\n    permission?: Promise<NotificationPermission>;\n}\n\nconst b64urlBytes = (s: string) => {\n    const bin = atob(s.replace(/-/g, \"+\").replace(/_/g, \"/\").padEnd(Math.ceil(s.length / 4) * 4, \"=\"));\n    const out = new Uint8Array(bin.length);\n    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n    return out;\n};\n\nconst sameKey = (a: ArrayBuffer | null | undefined, b: Uint8Array) => {\n    if (!a) return false;\n    const x = new Uint8Array(a);\n    return x.length === b.length && x.every((v, i) => v === b[i]);\n};\n\n/** True where the browser can receive web push (Safari 16.4+ only for sites added to the Home Screen on iOS). */\nexport const webPushSupported = () =>\n    typeof window !== \"undefined\" && \"serviceWorker\" in navigator && \"PushManager\" in window && \"Notification\" in window;\n\n/** The permission, asked right away when `ask` and not given yet. Call it synchronously in the click handler. */\nexport const askPermission = (ask = true): Promise<NotificationPermission> => {\n    if (!webPushSupported()) return Promise.resolve(\"denied\");\n    if (Notification.permission !== \"default\" || !ask) return Promise.resolve(Notification.permission);\n    try {\n        return Promise.resolve(Notification.requestPermission());\n    } catch {\n        return Promise.resolve(\"denied\");\n    }\n};\n\nconst registration = async (host: string, apiKey: string, sw: string | false) => {\n    if (sw !== false) {\n        const url = `${sw}?key=${encodeURIComponent(apiKey)}&host=${encodeURIComponent(host)}`;\n        await navigator.serviceWorker.register(url);\n    }\n    return navigator.serviceWorker.ready;\n};\n\nexport const subscribeWebPush = async (ctx: WebPushContext, options: WebPushOptions = {}): Promise<PushResult> => {\n    if (!webPushSupported()) return { status: \"unsupported\", reason: \"This browser has no web push.\" };\n    if (!ctx.distinctId) return { status: \"not-signed-in\" };\n    const ask = options.ask !== false;\n    const permission = await (ctx.permission ?? askPermission(ask));\n    if (permission === \"denied\") return { status: \"denied\" };\n    if (permission !== \"granted\") return { status: ask ? \"denied\" : \"not-asked\" };\n    try {\n        const r = await fetch(`${ctx.host}/api/sdk/push?key=${encodeURIComponent(ctx.apiKey)}`);\n        const vapid = r.ok ? ((await r.json()) as { web?: { vapidKey?: string } }).web?.vapidKey : undefined;\n        if (!vapid) return { status: \"error\", reason: `MRRocket answered ${r.status} for the push key.` };\n        const key = b64urlBytes(vapid);\n        const reg = await registration(ctx.host, ctx.apiKey, options.serviceWorker ?? \"/mrrocket-sw.js\");\n        let sub = await reg.pushManager.getSubscription();\n        if (sub && !sameKey(sub.options?.applicationServerKey, key)) {\n            await sub.unsubscribe().catch(() => false);\n            sub = null;\n        }\n        sub ??= await reg.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: key });\n        const saved = await fetch(`${ctx.host}/api/sdk/push`, {\n            method: \"POST\",\n            headers: { \"content-type\": \"application/json\" },\n            body: JSON.stringify({ key: ctx.apiKey, distinctId: ctx.distinctId, userHash: ctx.userHash, platform: \"web\", subscription: sub.toJSON(), host: ctx.host }),\n        });\n        warnUnsigned(saved.status);\n        return saved.ok ? { status: \"subscribed\" } : { status: \"error\", reason: `MRRocket answered ${saved.status}.` };\n    } catch (e) {\n        return { status: \"error\", reason: e instanceof Error ? e.message : String(e) };\n    }\n};\n\n/** Ends this browser's subscription and tells MRRocket (sign-out, or the person turned push off). */\nexport const unsubscribeWebPush = async (ctx: WebPushContext): Promise<boolean> => {\n    if (!webPushSupported()) return false;\n    try {\n        const reg = await navigator.serviceWorker.getRegistration();\n        const sub = await reg?.pushManager.getSubscription();\n        if (!sub) return false;\n        await fetch(`${ctx.host}/api/sdk/push`, {\n            method: \"POST\",\n            headers: { \"content-type\": \"application/json\" },\n            body: JSON.stringify({ key: ctx.apiKey, distinctId: ctx.distinctId, userHash: ctx.userHash, platform: \"web\", remove: true, endpoint: sub.endpoint }),\n        }).catch(() => null);\n        return await sub.unsubscribe();\n    } catch {\n        return false;\n    }\n};\n"],"mappings":";AAaA,SAAS,oBAAoB;AA+B7B,IAAM,cAAc,CAAC,MAAc;AAC/B,QAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,OAAO,KAAK,KAAK,EAAE,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;AACjG,QAAM,MAAM,IAAI,WAAW,IAAI,MAAM;AACrC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,KAAI,CAAC,IAAI,IAAI,WAAW,CAAC;AAC9D,SAAO;AACX;AAEA,IAAM,UAAU,CAAC,GAAmC,MAAkB;AAClE,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,IAAI,IAAI,WAAW,CAAC;AAC1B,SAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC;AAChE;AAGO,IAAM,mBAAmB,MAC5B,OAAO,WAAW,eAAe,mBAAmB,aAAa,iBAAiB,UAAU,kBAAkB;AAG3G,IAAM,gBAAgB,CAAC,MAAM,SAA0C;AAC1E,MAAI,CAAC,iBAAiB,EAAG,QAAO,QAAQ,QAAQ,QAAQ;AACxD,MAAI,aAAa,eAAe,aAAa,CAAC,IAAK,QAAO,QAAQ,QAAQ,aAAa,UAAU;AACjG,MAAI;AACA,WAAO,QAAQ,QAAQ,aAAa,kBAAkB,CAAC;AAAA,EAC3D,QAAQ;AACJ,WAAO,QAAQ,QAAQ,QAAQ;AAAA,EACnC;AACJ;AAEA,IAAM,eAAe,OAAO,MAAc,QAAgB,OAAuB;AAC7E,MAAI,OAAO,OAAO;AACd,UAAM,MAAM,GAAG,EAAE,QAAQ,mBAAmB,MAAM,CAAC,SAAS,mBAAmB,IAAI,CAAC;AACpF,UAAM,UAAU,cAAc,SAAS,GAAG;AAAA,EAC9C;AACA,SAAO,UAAU,cAAc;AACnC;AAEO,IAAM,mBAAmB,OAAO,KAAqB,UAA0B,CAAC,MAA2B;AAC9G,MAAI,CAAC,iBAAiB,EAAG,QAAO,EAAE,QAAQ,eAAe,QAAQ,gCAAgC;AACjG,MAAI,CAAC,IAAI,WAAY,QAAO,EAAE,QAAQ,gBAAgB;AACtD,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,aAAa,OAAO,IAAI,cAAc,cAAc,GAAG;AAC7D,MAAI,eAAe,SAAU,QAAO,EAAE,QAAQ,SAAS;AACvD,MAAI,eAAe,UAAW,QAAO,EAAE,QAAQ,MAAM,WAAW,YAAY;AAC5E,MAAI;AACA,UAAM,IAAI,MAAM,MAAM,GAAG,IAAI,IAAI,qBAAqB,mBAAmB,IAAI,MAAM,CAAC,EAAE;AACtF,UAAM,QAAQ,EAAE,MAAO,MAAM,EAAE,KAAK,GAAuC,KAAK,WAAW;AAC3F,QAAI,CAAC,MAAO,QAAO,EAAE,QAAQ,SAAS,QAAQ,qBAAqB,EAAE,MAAM,qBAAqB;AAChG,UAAM,MAAM,YAAY,KAAK;AAC7B,UAAM,MAAM,MAAM,aAAa,IAAI,MAAM,IAAI,QAAQ,QAAQ,iBAAiB,iBAAiB;AAC/F,QAAI,MAAM,MAAM,IAAI,YAAY,gBAAgB;AAChD,QAAI,OAAO,CAAC,QAAQ,IAAI,SAAS,sBAAsB,GAAG,GAAG;AACzD,YAAM,IAAI,YAAY,EAAE,MAAM,MAAM,KAAK;AACzC,YAAM;AAAA,IACV;AACA,YAAQ,MAAM,IAAI,YAAY,UAAU,EAAE,iBAAiB,MAAM,sBAAsB,IAAI,CAAC;AAC5F,UAAM,QAAQ,MAAM,MAAM,GAAG,IAAI,IAAI,iBAAiB;AAAA,MAClD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,IAAI,QAAQ,YAAY,IAAI,YAAY,UAAU,IAAI,UAAU,UAAU,OAAO,cAAc,IAAI,OAAO,GAAG,MAAM,IAAI,KAAK,CAAC;AAAA,IAC7J,CAAC;AACD,iBAAa,MAAM,MAAM;AACzB,WAAO,MAAM,KAAK,EAAE,QAAQ,aAAa,IAAI,EAAE,QAAQ,SAAS,QAAQ,qBAAqB,MAAM,MAAM,IAAI;AAAA,EACjH,SAAS,GAAG;AACR,WAAO,EAAE,QAAQ,SAAS,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAE;AAAA,EACjF;AACJ;AAGO,IAAM,qBAAqB,OAAO,QAA0C;AAC/E,MAAI,CAAC,iBAAiB,EAAG,QAAO;AAChC,MAAI;AACA,UAAM,MAAM,MAAM,UAAU,cAAc,gBAAgB;AAC1D,UAAM,MAAM,MAAM,KAAK,YAAY,gBAAgB;AACnD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,MAAM,GAAG,IAAI,IAAI,iBAAiB;AAAA,MACpC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,IAAI,QAAQ,YAAY,IAAI,YAAY,UAAU,IAAI,UAAU,UAAU,OAAO,QAAQ,MAAM,UAAU,IAAI,SAAS,CAAC;AAAA,IACvJ,CAAC,EAAE,MAAM,MAAM,IAAI;AACnB,WAAO,MAAM,IAAI,YAAY;AAAA,EACjC,QAAQ;AACJ,WAAO;AAAA,EACX;AACJ;","names":[]}

package/dist/react-native/index.d.cts

@@ -1,10 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
 
-/**
- * The SDK's fetch client and the shapes it reads, without React, so the script tag's widgets (src/script) use it too.
- * `./api` re-exports all of it with the `useApi` hook.
- */
 type PostStatus = "review" | "planned" | "progress" | "shipped";
 interface FeedbackBoardInfo {
     id: string;
@@ -180,8 +176,14 @@ interface MessengerLook {
     header?: "plain" | "color";
     /** "Powered by MRRocket" at the bottom; the server sends false only on plans that may hide it (from 0.15). */
     branding?: boolean;
-    /** The product's icon (its favicon) at the top left of Home; without it the title's first letter. */
+    /** The logo at the top left of Home: the one uploaded in MRRocket, else the product's favicon; without it the title's first letter. */
     logo?: string;
+    /** The product's favicon, the round mark in the chat's head (from 0.17; without it the title's first letter). */
+    icon?: string;
+    /** The AI agent's name on its answers (from 0.17; empty or left out: "AI agent"). */
+    agentName?: string;
+    /** The AI agent's picture beside its answers (from 0.17). */
+    agentPhoto?: string;
 }
 /** The visitor's newest chat (open or closed) and its messages. */
 interface ChatThread {
@@ -201,6 +203,11 @@ interface Conn {
         id?: string;
         [key: string]: unknown;
     };
+    /**
+     * The identity hash of `distinctId` (0.16.0, see identity.ts), sent with every request that names the visitor: a
+     * JSON field next to `distinctId`, a query parameter, a form field. Leave it out for any other id.
+     */
+    userHash?: string;
 }
 /** The small fetch client behind the widgets. Every read takes an AbortSignal so unmounting cancels it. */
 declare const createApi: (c: Conn) => {
@@ -273,7 +280,8 @@ type Api = ReturnType<typeof createApi>;
  *   `onCancel`, and only after they succeed is the outcome recorded.
  * - `$onboarding` `{flow, step?, action: "started" | "shown" | "completed" | "dismissed"}`; since 0.11.0 a wait records
  *   "shown" when the person reaches it and "completed" when it is over, a condition `{action: "answered", answer: "yes"
- *   | "no"}` once it is decided.
+ *   | "no"}` once it is decided; since 0.17.0 a tour a checklist task started records `{action: "started", from}` with
+ *   the checklist's id.
  * - `$inapp` `{message, journey, action: "shown" | "clicked" | "dismissed"}`; the journey moves the person on.
  */
 
@@ -343,6 +351,17 @@ interface CancelFlowConfig {
     offersFor: "business";
 }
 type OnboardingStepKind = "tour" | "checklist" | "modal";
+/** 0.17.0: where a tour bubble sits next to its element; "auto" (and no value) puts it below, else above, as before. */
+type TourPlacement = "auto" | "top" | "bottom" | "left" | "right";
+/**
+ * 0.17.0: a picture or a video above a tour step's or a modal's text. A video is a YouTube, Vimeo or Loom link (shown
+ * through their privacy-friendly players, see `videoEmbed`) or a video file (mp4, webm).
+ */
+interface FlowMedia {
+    kind: "image" | "video";
+    url: string;
+    alt?: string;
+}
 interface OnboardingStep {
     id: string;
     kind: OnboardingStepKind;
@@ -353,6 +372,14 @@ interface OnboardingStep {
     target?: string;
     /** Checklist items: the event that ticks them (`track("<event>")`). Without it the person ticks it themselves. */
     event?: string;
+    /** 0.17.0, tour steps: which side of the element the bubble takes (flips when there is no room). */
+    placement?: TourPlacement;
+    /** 0.17.0, tour steps and modals: a picture or a video above the text. */
+    media?: FlowMedia;
+    /** 0.17.0, modals: where the button goes (http(s) or a path of the app). */
+    url?: string;
+    /** 0.17.0, checklist items: the id of a tour (another flow) the item starts; finishing the tour ticks the item. */
+    startsTour?: string;
 }
 /** A pause in a flow (0.11.0): the next step shows this long after the one before was done. */
 interface OnboardingWait {
@@ -378,9 +405,15 @@ type OnboardingNode = OnboardingStep | OnboardingWait | OnboardingCondition;
 /** A live onboarding flow's in-app steps (MRRocket › Conversion › Onboarding); its emails go out from MRRocket. */
 interface OnboardingFlow {
     id: string;
+    /** A checklist's heading; for tours and modals the name MRRocket knows them by. */
     name: string;
-    /** When it starts: an event's words ("Signed up", "First export"), or "First launch" / "First visit". */
+    /**
+     * When it starts: an event's words ("Signed up", "First export"), "First launch" / "First visit", since 0.17.0 a page
+     * of the app ("/settings", "/projects/*"), or "From a checklist" (only a checklist task starts it).
+     */
     trigger: string;
+    /** 0.17.0: "signed_in" starts it on its own only for someone the app identified. */
+    audience?: "signed_in";
     /** What every version shows: with `nodes`, only the in-app steps before the first wait or condition. */
     steps: OnboardingStep[];
     /** 0.11.0+: the whole flow with its waits and conditions. Read instead of `steps` when it is there. */
@@ -459,12 +492,15 @@ type FlowView = {
     index: number;
     total: number;
     last: boolean;
-} | {
+}
+/** `tour`: the tour the item starts (0.17.0), when the config has it. */
+ | {
     type: "checklist";
     flow: OnboardingFlow;
     items: {
         step: OnboardingStep;
         done: boolean;
+        tour?: OnboardingFlow;
     }[];
 } | {
     type: "message";
@@ -492,10 +528,12 @@ interface FlowsController {
         confirm(comment?: string): void;
         close(): void;
     };
+    /** `startTour(stepId)` (0.17.0): the tour a checklist item starts; the checklist comes back when it ends. */
     onboarding: {
         next(): void;
         check(stepId: string): void;
         dismiss(): void;
+        startTour(stepId: string): boolean;
     };
     message: {
         click(): void;
@@ -620,7 +658,7 @@ interface PaywallHost {
 
 type VariantId = string;
 /** This build of the SDK. Sent with the config request so MRRocket knows what the site runs (error tracking, flags). */
-declare const SDK_VERSION = "0.15.0";
+declare const SDK_VERSION = "0.17.0";
 /** One variant of an experiment. `changes` replaces texts that the page marks with `<Text id>`. */
 interface VariantConfig {
     id: VariantId;
@@ -761,6 +799,27 @@ interface AppContext {
     locale?: string;
 }
 
+/**
+ * Identity verification (0.16.0), the browser and app side. After `identify(id)` the SDK's id is your app's own user
+ * id, and that id is no secret (a Clerk id shows in URLs and logs), so on its own it proves nothing: anyone who knows it
+ * could read that person's support chat or post as them. Your server signs the id with the product's server key
+ * (`userHash(user.id)` from `@mrrocket/sdk/next/server`) and you hand the result to `identify(id, props, { hash })`.
+ * From then on every request for that id carries it as `userHash` (a JSON field, a query parameter or a form field), and
+ * MRRocket checks it.
+ *
+ * The hash belongs to one id: it is forgotten on `reset()` (sign-out) and when `identify` is called for another id
+ * without a hash, so it never goes out with someone else's id (MRRocket refuses a hash that does not match with 401).
+ * Shared by the Next.js provider, the script tag and React Native: no React, no browser APIs.
+ */
+/** The third argument of `identify`. */
+interface IdentifyOptions {
+    /**
+     * The id signed by your server: `await userHash(user.id)` from `@mrrocket/sdk/next/server` (or the same HMAC in any
+     * language). Needed when MRRocket › Settings › Products › Sign-in › "Only signed users" is on.
+     */
+    hash?: string;
+}
+
 /**
  * The React Native client without React: the event queue (batched, persisted for offline use, retried with backoff),
  * the app lifecycle (`$app_open`, `$app_background`, a new session after 30 minutes away), screens, identity and
@@ -822,6 +881,13 @@ interface RegisterForPushOptions {
     projectId?: string;
 }
 type NativePushStatus = "registered" | "denied" | "not-asked" | "unavailable" | "not-signed-in" | "error";
+/**
+ * 0.16.0, what `requestReview()` did: "requested" the store's rating dialog was asked for (the store decides whether it
+ * shows; Apple shows it at most three times a year); "not-now" no live review request may ask this person now (not a
+ * customer, asked in the last 120 days, no request live); "unavailable" the device has no dialog or `expo-store-review`
+ * is not installed; "not-signed-in" call `identify` first.
+ */
+type NativeReviewResult = "requested" | "not-now" | "unavailable" | "not-signed-in";
 interface NativePushResult {
     status: NativePushStatus;
     /** The Expo push token, once registered. */
@@ -838,8 +904,14 @@ interface MRRocketClient {
     tap(x: number, y: number): void;
     /** The person's answer to session recordings (`replay` in the options); false stops and forgets what was not sent. */
     setReplay(on: boolean): void;
-    identify(id: string, props?: Record<string, unknown>): void;
-    /** Forgets the signed-in person (sign-out): a new anonymous id and a new session. */
+    /**
+     * Who the person is once they sign in. `{ hash }` (0.16.0) is the id signed by your backend (`userHash(id)` from
+     * `@mrrocket/sdk/next/server`, or the same HMAC in any language), fetched after sign-in; sent with every request for
+     * that id so MRRocket knows it is really them. Needed with "Only signed users" (MRRocket › Settings › Products ›
+     * Sign-in). Not stored on the device: call identify with it on every start.
+     */
+    identify(id: string, props?: Record<string, unknown>, options?: IdentifyOptions): void;
+    /** Forgets the signed-in person and their hash (sign-out): a new anonymous id and a new session. */
     reset(): void;
     setConsent(consent: NativeConsent): void;
     captureError(error: unknown): void;
@@ -886,6 +958,12 @@ interface MRRocketClient {
     registerForPush(options?: RegisterForPushOptions): Promise<NativePushResult>;
     /** Removes this device's token for the signed-in person (sign-out does it on its own in `reset`). */
     unregisterForPush(): Promise<boolean>;
+    /**
+     * 0.16.0: asks for a store review at the moment your app picked (the trigger of a review request in MRRocket ›
+     * Reviews › Requests). MRRocket says whether this signed-in person may be asked now; if so the App Store's or Google
+     * Play's own rating dialog opens (needs `expo-store-review`) and MRRocket counts the request. Never filtered by mood.
+     */
+    requestReview(): Promise<NativeReviewResult>;
     /** The cancel flow, onboarding and messages for a renderer (the provider's, or your own). */
     flows: FlowsController;
     /** Sends what is queued now. */
@@ -998,8 +1076,10 @@ interface NativeMessengerOptions {
     corners?: MessengerCorners;
     /** Home's top: plain like the rest (default), or in the accent color with raised cards. */
     header?: "plain" | "color";
-    /** The product's icon at the top left of Home (MRRocket sends the product's favicon). */
+    /** The logo at the top left of Home (MRRocket sends the uploaded logo, else the product's favicon). */
     logo?: string;
+    /** The AI agent's name on its answers (default "AI agent"). */
+    agentName?: string;
     /** Ask people the app did not identify with an email for an email (optional for them). Default true. */
     askEmail?: boolean;
     /** The Help tab with your published help articles (default true; hidden while there are none). */
@@ -1075,7 +1155,7 @@ declare const MRRocketProvider: ({ client: given, children, consent, flows, appe
 declare const useMRRocket: () => {
     track: (event: string, props?: Record<string, unknown>) => void;
     screen: (name: string, props?: Record<string, unknown>) => void;
-    identify: (id: string, props?: Record<string, unknown>) => void;
+    identify: (id: string, props?: Record<string, unknown>, options?: IdentifyOptions) => void;
     reset: () => void;
     setConsent: (consent: NativeConsent) => void;
     setReplay: (on: boolean) => void;
@@ -1118,6 +1198,17 @@ declare const usePush: () => {
 declare const usePaywall: () => {
     open: MRRocketClient["openPaywall"];
 };
+/**
+ * 0.16.0: store reviews from a review request in MRRocket › Reviews › Requests (needs `expo-store-review`). Call
+ * `request()` at the moment the request names (after the third finished challenge, a 7-day streak …): MRRocket says
+ * whether this signed-in person may be asked now, and the App Store's or Google Play's own rating dialog opens.
+ *
+ *     const review = useReview();
+ *     if (challengesDone === 3) void review.request();
+ */
+declare const useReview: () => {
+    request: MRRocketClient["requestReview"];
+};
 /** Starts an onboarding flow now (the first live one without an id), whatever its trigger. */
 declare const useOnboarding: () => {
     start: (id?: string) => boolean;
@@ -1156,4 +1247,4 @@ declare const useExpoRouterTracking: () => void;
  */
 declare const useNavigationTracking: () => (state: unknown) => void;
 
-export { type AppContext, type CancelFlowConfig, type CancelFlowOptions, type CancelFlowResult, type CancelOffer, type ChatMessage, type ChatThread, type CockpitConfig, type FeedbackPost, type FlagConfig, type FlowView, type InAppMessage, type KeyValueStorage, type MRRocketClient, MRRocketFeedback, MRRocketFlows, MRRocketMask, MRRocketMessenger, type MRRocketOptions, MRRocketProvider, type MRRocketProviderProps, MRRocketSurveys, type NativeAppearance, type NativeConsent, type NativeFeedbackOptions, type NativeMessengerOptions, type NativePushResult, type NativePushStatus, type OnboardingFlow, type OnboardingStep, type PaywallConfig, type PaywallOptions, type PaywallPage, type PaywallPlan, type PaywallResult, type RegisterForPushOptions, SDK_VERSION, type SurveyDefinition, type VariantId, activeRouteName, createMRRocket, getMRRocket, useCancelFlow, useExpoRouterTracking, useFeedback, useFlag, useFlagVariant, useMRRocket, useMessenger, useNavigationTracking, useOnboarding, usePaywall, usePush, useText, useVariant };
+export { type AppContext, type CancelFlowConfig, type CancelFlowOptions, type CancelFlowResult, type CancelOffer, type ChatMessage, type ChatThread, type CockpitConfig, type FeedbackPost, type FlagConfig, type FlowMedia, type FlowView, type IdentifyOptions, type InAppMessage, type KeyValueStorage, type MRRocketClient, MRRocketFeedback, MRRocketFlows, MRRocketMask, MRRocketMessenger, type MRRocketOptions, MRRocketProvider, type MRRocketProviderProps, MRRocketSurveys, type NativeAppearance, type NativeConsent, type NativeFeedbackOptions, type NativeMessengerOptions, type NativePushResult, type NativePushStatus, type NativeReviewResult, type OnboardingFlow, type OnboardingStep, type PaywallConfig, type PaywallOptions, type PaywallPage, type PaywallPlan, type PaywallResult, type RegisterForPushOptions, SDK_VERSION, type SurveyDefinition, type TourPlacement, type VariantId, activeRouteName, createMRRocket, getMRRocket, useCancelFlow, useExpoRouterTracking, useFeedback, useFlag, useFlagVariant, useMRRocket, useMessenger, useNavigationTracking, useOnboarding, usePaywall, usePush, useReview, useText, useVariant };

package/dist/react-native/index.d.ts

@@ -1,10 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
 
-/**
- * The SDK's fetch client and the shapes it reads, without React, so the script tag's widgets (src/script) use it too.
- * `./api` re-exports all of it with the `useApi` hook.
- */
 type PostStatus = "review" | "planned" | "progress" | "shipped";
 interface FeedbackBoardInfo {
     id: string;
@@ -180,8 +176,14 @@ interface MessengerLook {
     header?: "plain" | "color";
     /** "Powered by MRRocket" at the bottom; the server sends false only on plans that may hide it (from 0.15). */
     branding?: boolean;
-    /** The product's icon (its favicon) at the top left of Home; without it the title's first letter. */
+    /** The logo at the top left of Home: the one uploaded in MRRocket, else the product's favicon; without it the title's first letter. */
     logo?: string;
+    /** The product's favicon, the round mark in the chat's head (from 0.17; without it the title's first letter). */
+    icon?: string;
+    /** The AI agent's name on its answers (from 0.17; empty or left out: "AI agent"). */
+    agentName?: string;
+    /** The AI agent's picture beside its answers (from 0.17). */
+    agentPhoto?: string;
 }
 /** The visitor's newest chat (open or closed) and its messages. */
 interface ChatThread {
@@ -201,6 +203,11 @@ interface Conn {
         id?: string;
         [key: string]: unknown;
     };
+    /**
+     * The identity hash of `distinctId` (0.16.0, see identity.ts), sent with every request that names the visitor: a
+     * JSON field next to `distinctId`, a query parameter, a form field. Leave it out for any other id.
+     */
+    userHash?: string;
 }
 /** The small fetch client behind the widgets. Every read takes an AbortSignal so unmounting cancels it. */
 declare const createApi: (c: Conn) => {
@@ -273,7 +280,8 @@ type Api = ReturnType<typeof createApi>;
  *   `onCancel`, and only after they succeed is the outcome recorded.
  * - `$onboarding` `{flow, step?, action: "started" | "shown" | "completed" | "dismissed"}`; since 0.11.0 a wait records
  *   "shown" when the person reaches it and "completed" when it is over, a condition `{action: "answered", answer: "yes"
- *   | "no"}` once it is decided.
+ *   | "no"}` once it is decided; since 0.17.0 a tour a checklist task started records `{action: "started", from}` with
+ *   the checklist's id.
  * - `$inapp` `{message, journey, action: "shown" | "clicked" | "dismissed"}`; the journey moves the person on.
  */
 
@@ -343,6 +351,17 @@ interface CancelFlowConfig {
     offersFor: "business";
 }
 type OnboardingStepKind = "tour" | "checklist" | "modal";
+/** 0.17.0: where a tour bubble sits next to its element; "auto" (and no value) puts it below, else above, as before. */
+type TourPlacement = "auto" | "top" | "bottom" | "left" | "right";
+/**
+ * 0.17.0: a picture or a video above a tour step's or a modal's text. A video is a YouTube, Vimeo or Loom link (shown
+ * through their privacy-friendly players, see `videoEmbed`) or a video file (mp4, webm).
+ */
+interface FlowMedia {
+    kind: "image" | "video";
+    url: string;
+    alt?: string;
+}
 interface OnboardingStep {
     id: string;
     kind: OnboardingStepKind;
@@ -353,6 +372,14 @@ interface OnboardingStep {
     target?: string;
     /** Checklist items: the event that ticks them (`track("<event>")`). Without it the person ticks it themselves. */
     event?: string;
+    /** 0.17.0, tour steps: which side of the element the bubble takes (flips when there is no room). */
+    placement?: TourPlacement;
+    /** 0.17.0, tour steps and modals: a picture or a video above the text. */
+    media?: FlowMedia;
+    /** 0.17.0, modals: where the button goes (http(s) or a path of the app). */
+    url?: string;
+    /** 0.17.0, checklist items: the id of a tour (another flow) the item starts; finishing the tour ticks the item. */
+    startsTour?: string;
 }
 /** A pause in a flow (0.11.0): the next step shows this long after the one before was done. */
 interface OnboardingWait {
@@ -378,9 +405,15 @@ type OnboardingNode = OnboardingStep | OnboardingWait | OnboardingCondition;
 /** A live onboarding flow's in-app steps (MRRocket › Conversion › Onboarding); its emails go out from MRRocket. */
 interface OnboardingFlow {
     id: string;
+    /** A checklist's heading; for tours and modals the name MRRocket knows them by. */
     name: string;
-    /** When it starts: an event's words ("Signed up", "First export"), or "First launch" / "First visit". */
+    /**
+     * When it starts: an event's words ("Signed up", "First export"), "First launch" / "First visit", since 0.17.0 a page
+     * of the app ("/settings", "/projects/*"), or "From a checklist" (only a checklist task starts it).
+     */
     trigger: string;
+    /** 0.17.0: "signed_in" starts it on its own only for someone the app identified. */
+    audience?: "signed_in";
     /** What every version shows: with `nodes`, only the in-app steps before the first wait or condition. */
     steps: OnboardingStep[];
     /** 0.11.0+: the whole flow with its waits and conditions. Read instead of `steps` when it is there. */
@@ -459,12 +492,15 @@ type FlowView = {
     index: number;
     total: number;
     last: boolean;
-} | {
+}
+/** `tour`: the tour the item starts (0.17.0), when the config has it. */
+ | {
     type: "checklist";
     flow: OnboardingFlow;
     items: {
         step: OnboardingStep;
         done: boolean;
+        tour?: OnboardingFlow;
     }[];
 } | {
     type: "message";
@@ -492,10 +528,12 @@ interface FlowsController {
         confirm(comment?: string): void;
         close(): void;
     };
+    /** `startTour(stepId)` (0.17.0): the tour a checklist item starts; the checklist comes back when it ends. */
     onboarding: {
         next(): void;
         check(stepId: string): void;
         dismiss(): void;
+        startTour(stepId: string): boolean;
     };
     message: {
         click(): void;
@@ -620,7 +658,7 @@ interface PaywallHost {
 
 type VariantId = string;
 /** This build of the SDK. Sent with the config request so MRRocket knows what the site runs (error tracking, flags). */
-declare const SDK_VERSION = "0.15.0";
+declare const SDK_VERSION = "0.17.0";
 /** One variant of an experiment. `changes` replaces texts that the page marks with `<Text id>`. */
 interface VariantConfig {
     id: VariantId;
@@ -761,6 +799,27 @@ interface AppContext {
     locale?: string;
 }
 
+/**
+ * Identity verification (0.16.0), the browser and app side. After `identify(id)` the SDK's id is your app's own user
+ * id, and that id is no secret (a Clerk id shows in URLs and logs), so on its own it proves nothing: anyone who knows it
+ * could read that person's support chat or post as them. Your server signs the id with the product's server key
+ * (`userHash(user.id)` from `@mrrocket/sdk/next/server`) and you hand the result to `identify(id, props, { hash })`.
+ * From then on every request for that id carries it as `userHash` (a JSON field, a query parameter or a form field), and
+ * MRRocket checks it.
+ *
+ * The hash belongs to one id: it is forgotten on `reset()` (sign-out) and when `identify` is called for another id
+ * without a hash, so it never goes out with someone else's id (MRRocket refuses a hash that does not match with 401).
+ * Shared by the Next.js provider, the script tag and React Native: no React, no browser APIs.
+ */
+/** The third argument of `identify`. */
+interface IdentifyOptions {
+    /**
+     * The id signed by your server: `await userHash(user.id)` from `@mrrocket/sdk/next/server` (or the same HMAC in any
+     * language). Needed when MRRocket › Settings › Products › Sign-in › "Only signed users" is on.
+     */
+    hash?: string;
+}
+
 /**
  * The React Native client without React: the event queue (batched, persisted for offline use, retried with backoff),
  * the app lifecycle (`$app_open`, `$app_background`, a new session after 30 minutes away), screens, identity and
@@ -822,6 +881,13 @@ interface RegisterForPushOptions {
     projectId?: string;
 }
 type NativePushStatus = "registered" | "denied" | "not-asked" | "unavailable" | "not-signed-in" | "error";
+/**
+ * 0.16.0, what `requestReview()` did: "requested" the store's rating dialog was asked for (the store decides whether it
+ * shows; Apple shows it at most three times a year); "not-now" no live review request may ask this person now (not a
+ * customer, asked in the last 120 days, no request live); "unavailable" the device has no dialog or `expo-store-review`
+ * is not installed; "not-signed-in" call `identify` first.
+ */
+type NativeReviewResult = "requested" | "not-now" | "unavailable" | "not-signed-in";
 interface NativePushResult {
     status: NativePushStatus;
     /** The Expo push token, once registered. */
@@ -838,8 +904,14 @@ interface MRRocketClient {
     tap(x: number, y: number): void;
     /** The person's answer to session recordings (`replay` in the options); false stops and forgets what was not sent. */
     setReplay(on: boolean): void;
-    identify(id: string, props?: Record<string, unknown>): void;
-    /** Forgets the signed-in person (sign-out): a new anonymous id and a new session. */
+    /**
+     * Who the person is once they sign in. `{ hash }` (0.16.0) is the id signed by your backend (`userHash(id)` from
+     * `@mrrocket/sdk/next/server`, or the same HMAC in any language), fetched after sign-in; sent with every request for
+     * that id so MRRocket knows it is really them. Needed with "Only signed users" (MRRocket › Settings › Products ›
+     * Sign-in). Not stored on the device: call identify with it on every start.
+     */
+    identify(id: string, props?: Record<string, unknown>, options?: IdentifyOptions): void;
+    /** Forgets the signed-in person and their hash (sign-out): a new anonymous id and a new session. */
     reset(): void;
     setConsent(consent: NativeConsent): void;
     captureError(error: unknown): void;
@@ -886,6 +958,12 @@ interface MRRocketClient {
     registerForPush(options?: RegisterForPushOptions): Promise<NativePushResult>;
     /** Removes this device's token for the signed-in person (sign-out does it on its own in `reset`). */
     unregisterForPush(): Promise<boolean>;
+    /**
+     * 0.16.0: asks for a store review at the moment your app picked (the trigger of a review request in MRRocket ›
+     * Reviews › Requests). MRRocket says whether this signed-in person may be asked now; if so the App Store's or Google
+     * Play's own rating dialog opens (needs `expo-store-review`) and MRRocket counts the request. Never filtered by mood.
+     */
+    requestReview(): Promise<NativeReviewResult>;
     /** The cancel flow, onboarding and messages for a renderer (the provider's, or your own). */
     flows: FlowsController;
     /** Sends what is queued now. */
@@ -998,8 +1076,10 @@ interface NativeMessengerOptions {
     corners?: MessengerCorners;
     /** Home's top: plain like the rest (default), or in the accent color with raised cards. */
     header?: "plain" | "color";
-    /** The product's icon at the top left of Home (MRRocket sends the product's favicon). */
+    /** The logo at the top left of Home (MRRocket sends the uploaded logo, else the product's favicon). */
     logo?: string;
+    /** The AI agent's name on its answers (default "AI agent"). */
+    agentName?: string;
     /** Ask people the app did not identify with an email for an email (optional for them). Default true. */
     askEmail?: boolean;
     /** The Help tab with your published help articles (default true; hidden while there are none). */
@@ -1075,7 +1155,7 @@ declare const MRRocketProvider: ({ client: given, children, consent, flows, appe
 declare const useMRRocket: () => {
     track: (event: string, props?: Record<string, unknown>) => void;
     screen: (name: string, props?: Record<string, unknown>) => void;
-    identify: (id: string, props?: Record<string, unknown>) => void;
+    identify: (id: string, props?: Record<string, unknown>, options?: IdentifyOptions) => void;
     reset: () => void;
     setConsent: (consent: NativeConsent) => void;
     setReplay: (on: boolean) => void;
@@ -1118,6 +1198,17 @@ declare const usePush: () => {
 declare const usePaywall: () => {
     open: MRRocketClient["openPaywall"];
 };
+/**
+ * 0.16.0: store reviews from a review request in MRRocket › Reviews › Requests (needs `expo-store-review`). Call
+ * `request()` at the moment the request names (after the third finished challenge, a 7-day streak …): MRRocket says
+ * whether this signed-in person may be asked now, and the App Store's or Google Play's own rating dialog opens.
+ *
+ *     const review = useReview();
+ *     if (challengesDone === 3) void review.request();
+ */
+declare const useReview: () => {
+    request: MRRocketClient["requestReview"];
+};
 /** Starts an onboarding flow now (the first live one without an id), whatever its trigger. */
 declare const useOnboarding: () => {
     start: (id?: string) => boolean;
@@ -1156,4 +1247,4 @@ declare const useExpoRouterTracking: () => void;
  */
 declare const useNavigationTracking: () => (state: unknown) => void;
 
-export { type AppContext, type CancelFlowConfig, type CancelFlowOptions, type CancelFlowResult, type CancelOffer, type ChatMessage, type ChatThread, type CockpitConfig, type FeedbackPost, type FlagConfig, type FlowView, type InAppMessage, type KeyValueStorage, type MRRocketClient, MRRocketFeedback, MRRocketFlows, MRRocketMask, MRRocketMessenger, type MRRocketOptions, MRRocketProvider, type MRRocketProviderProps, MRRocketSurveys, type NativeAppearance, type NativeConsent, type NativeFeedbackOptions, type NativeMessengerOptions, type NativePushResult, type NativePushStatus, type OnboardingFlow, type OnboardingStep, type PaywallConfig, type PaywallOptions, type PaywallPage, type PaywallPlan, type PaywallResult, type RegisterForPushOptions, SDK_VERSION, type SurveyDefinition, type VariantId, activeRouteName, createMRRocket, getMRRocket, useCancelFlow, useExpoRouterTracking, useFeedback, useFlag, useFlagVariant, useMRRocket, useMessenger, useNavigationTracking, useOnboarding, usePaywall, usePush, useText, useVariant };
+export { type AppContext, type CancelFlowConfig, type CancelFlowOptions, type CancelFlowResult, type CancelOffer, type ChatMessage, type ChatThread, type CockpitConfig, type FeedbackPost, type FlagConfig, type FlowMedia, type FlowView, type IdentifyOptions, type InAppMessage, type KeyValueStorage, type MRRocketClient, MRRocketFeedback, MRRocketFlows, MRRocketMask, MRRocketMessenger, type MRRocketOptions, MRRocketProvider, type MRRocketProviderProps, MRRocketSurveys, type NativeAppearance, type NativeConsent, type NativeFeedbackOptions, type NativeMessengerOptions, type NativePushResult, type NativePushStatus, type NativeReviewResult, type OnboardingFlow, type OnboardingStep, type PaywallConfig, type PaywallOptions, type PaywallPage, type PaywallPlan, type PaywallResult, type RegisterForPushOptions, SDK_VERSION, type SurveyDefinition, type TourPlacement, type VariantId, activeRouteName, createMRRocket, getMRRocket, useCancelFlow, useExpoRouterTracking, useFeedback, useFlag, useFlagVariant, useMRRocket, useMessenger, useNavigationTracking, useOnboarding, usePaywall, usePush, useReview, useText, useVariant };