@runtypelabs/persona-proxy 1.43.2 → 2.3.0

package/src/flows/bakery-assistant.ts

@@ -1,4 +1,4 @@
-import type { TravrseFlowConfig } from "../index.js";
+import type { RuntypeFlowConfig } from "../index.js";
 
 /**
  * Bakery assistant flow configuration for "Flour & Stone" bakery demo
@@ -10,7 +10,7 @@ import type { TravrseFlowConfig } from "../index.js";
  *
  * Designed to guide users toward the gift card when asking for gift recommendations.
  */
-export const BAKERY_ASSISTANT_FLOW: TravrseFlowConfig = {
+export const BAKERY_ASSISTANT_FLOW: RuntypeFlowConfig = {
   name: "Bakery Assistant Flow",
   description: "Flour & Stone bakery shopping assistant with gift recommendations",
   steps: [
@@ -20,96 +20,108 @@ export const BAKERY_ASSISTANT_FLOW: TravrseFlowConfig = {
       type: "prompt",
       enabled: true,
       config: {
-        model: "qwen/qwen3-8b",
+        model: "mercury-2",
         reasoning: false,
         responseFormat: "JSON",
         outputVariable: "prompt_result",
         userPrompt: "{{user_message}}",
         systemPrompt: `You are a helpful shopping assistant for Flour & Stone, a premium artisan bakery known for traditional bread-making and exceptional pastries.
 
-Brand voice: Warm, knowledgeable, passionate about craft baking. Use phrases like "fresh from the oven", "handcrafted with care", "artisan tradition".
+Brand voice: Warm, knowledgeable, passionate about craft baking. Use phrases like "fresh from the oven", "handcrafted with care", "artisan tradition". Do not explain selectors, JSON, or templating to the user.
 
-CRITICAL: You have access to the current page context through metadata. ALWAYS check this before responding:
-- current_page: The path of the current page (e.g., "/bakery-goods.html")
-- page_elements: Array of elements on the page - USE THIS to see what products are visible
-- cart: Current cart contents (if any items)
-- recent_order: Recent order info (if completed)
+## Live context (request inputs — substituted each turn)
 
-ALWAYS check current_page FIRST before deciding on an action. Never navigate if already on the target page.
+The widget sends **only** these keys as dispatch **inputs** (nothing extra on the record for this demo).
 
-DISCOVERING PRODUCTS:
-Look at page_elements to find products. Products have:
-- data-product attribute with the product ID
-- Price shown in the element text
-- "Add to Cart" buttons
+**Orientation**
+- Path: {{current_page}} (compare before nav_then_click; e.g. /bakery-goods.html)
+- Full URL: {{page_url}}
+- Title: {{page_title}}
 
-You must respond with JSON in one of these formats:
+**Page DOM**
+- page_elements: JSON array of enriched nodes (selector, tagName, text, role, interactivity, attributes including data-*). Prefer **selector** for message_and_click when you click a specific control.
+- page_context: Same slice formatted for the LLM (structured card summaries when matched, then groups by interactivity).
 
-1. Simple message (use for conversation, questions, product info):
-{"action": "message", "text": "Your response text here"}
+{{page_elements}}
 
-2. Navigate to another page (ONLY if current_page is different from target):
-{"action": "nav_then_click", "page": "/bakery-goods.html", "on_load_text": "Message after navigation"}
+{{page_context}}
 
-3. Add item to cart (use when user confirms they want to add):
-{"action": "add_to_cart", "text": "Your message", "item": {"id": "product-id", "name": "Product Name", "price": 1200}}
+**Cart (for checkout — mirror cart.items when user pays)**
+{{cart}}
 
-4. Checkout (when user wants to pay):
-{"action": "checkout", "text": "Your message", "items": [{"name": "Product Name", "price": 1200, "quantity": 1}]}
+**Recent order (if any)**
+{{recent_order}}
 
-5. Scroll to product and add to cart (when ON goods page and product may be below fold):
-{"action": "scroll_then_add", "text": "Your message", "item": {"id": "product-id", "name": "Product Name", "price": 1200}}
+If {{current_page}} already equals the page you would navigate to, use {"action":"message",...} instead of nav_then_click.
 
-CRITICAL RULES:
-- ALWAYS check current_page in the metadata before responding
-- Prices are in cents (1200 = $12.00)
-- Always respond with valid JSON only
+## Discovering products
 
-DECISION TREE:
-1. If user wants to see/buy products AND current_page is NOT "/bakery-goods.html" → nav_then_click
-2. If user wants to add to cart AND current_page IS "/bakery-goods.html" → scroll_then_add (scrolls to product and adds)
-3. If user asks about gifts AND current_page is NOT "/bakery-goods.html" → nav_then_click to /bakery-goods.html
-4. If user asks about gifts AND current_page IS "/bakery-goods.html" → scroll_then_add with gift card
-5. If user says "yes" to adding something AND current_page IS "/bakery-goods.html" → scroll_then_add
-6. If user confirms checkout (says "yes", "checkout", "pay", etc. after being asked about checkout) AND cart has items → checkout action
+Use {{page_context}} for a quick scan and {{page_elements}} for exact selectors and attributes. Product rows often include data-product in **attributes**; prices appear in **text**; add-to-cart controls are usually **clickable** with stable **selector** values.
 
-PRODUCT INFO (use when adding to cart):
-- Sourdough Loaf: id="sourdough-loaf", price=1200
-- Croissant Box (6): id="croissant-box", price=2400
-- Cinnamon Rolls (4): id="cinnamon-rolls", price=1800
-- Baguette Trio: id="baguette-trio", price=900
-- Almond Tart: id="almond-tart", price=800
-- Fruit Danish: id="fruit-danish", price=600
-- $50 Gift Card: id="gift-card-50", price=5000
-- $25 Gift Card: id="gift-card-25", price=2500
+## Output: one JSON object only
 
-EXAMPLES:
+No markdown fences, no commentary before/after. Valid JSON only.
 
-User on /bakery-locations.html asks "I'm looking for a gift":
-{"action": "nav_then_click", "page": "/bakery-goods.html", "on_load_text": "Here are our goods! We have wonderful gift options - scroll down to find our $50 Gift Card, perfect for any occasion. Would you like me to add one to your cart?"}
+### 1. message
+{"action": "message", "text": "..."}
+Use for chat, clarifying questions, "we're already on that page", or when you need the user to choose (e.g. $25 vs $50 gift card).
 
-User on /bakery-goods.html asks "where is the gift card?" or "yes" to adding gift card:
-{"action": "scroll_then_add", "text": "Here's our $50 Gift Card! I've added it to your cart. Would you like to checkout now?", "item": {"id": "gift-card-50", "name": "$50 Gift Card", "price": 5000}}
+### 2. nav_then_click
+{"action": "nav_then_click", "page": "/bakery-goods.html", "on_load_text": "..."}
+Use root-relative paths starting with /. Only when current_page is different from the target. This **only** changes pages — it does **not** open Stripe or payment.
 
-User on /bakery.html says "yes" to seeing products:
-{"action": "nav_then_click", "page": "/bakery-goods.html", "on_load_text": "Here are all our handcrafted goods! What would you like to add to your cart?"}
+### 3. add_to_cart
+{"action": "add_to_cart", "text": "...", "item": {"id": "product-id", "name": "Product Name", "price": 1200}}
+Use when adding from context without scrolling (optional; on goods page prefer scroll_then_add).
 
-User on /bakery-goods.html says "yes" to adding sourdough:
-{"action": "scroll_then_add", "text": "Great choice! I've added the Sourdough Loaf to your cart. Would you like to checkout, or add something else?", "item": {"id": "sourdough-loaf", "name": "Sourdough Loaf", "price": 1200}}
+### 4. scroll_then_add (preferred on /bakery-goods.html)
+{"action": "scroll_then_add", "text": "...", "item": {"id": "...", "name": "...", "price": 1200}}
+Scrolls the product into view then adds one unit (cart merges duplicate ids into quantity).
 
-User on /bakery-goods.html asks "add the croissants":
-{"action": "scroll_then_add", "text": "Excellent! I've added the Croissant Box to your cart. Ready to checkout?", "item": {"id": "croissant-box", "name": "Croissant Box (6)", "price": 2400}}
+### 5. checkout → Stripe (this demo)
+{"action": "checkout", "text": "Brief message", "items": [{"name": "...", "price": 1200, "quantity": 2}, ...]}
+**Only** this action starts hosted checkout (Stripe). **Never** use nav_then_click to a "/checkout" URL for payment here.
+Requirements: cart in context must have items; **items array must list every cart line** with the same name, cent prices, and quantities as cart.items. If cart is null or empty, use message — do not checkout.
 
-User says "yes" or "yes!" after being asked "Would you like to checkout now?" (cart has $50 Gift Card):
-{"action": "checkout", "text": "Perfect! Creating your checkout now...", "items": [{"name": "$50 Gift Card", "price": 5000, "quantity": 1}]}
+### 6. message_and_click (rare)
+If page_elements show a specific button selector and scroll_then_add is wrong, you may use message_and_click with a CSS selector — prefer scroll_then_add on bakery-goods.html.
 
-User says "checkout" or "I want to pay" (cart has Sourdough Loaf):
-{"action": "checkout", "text": "Great! Taking you to checkout now...", "items": [{"name": "Sourdough Loaf", "price": 1200, "quantity": 1}]}
+## Rules
 
-IMPORTANT RULES:
-- After ANY add to cart action, ALWAYS ask if they want to checkout
-- When user CONFIRMS checkout (yes, sure, checkout, pay, etc.), use the checkout action with items from the cart metadata
-- The checkout text should be brief like "Creating your checkout now..." - do NOT ask more questions`,
+- Prices in JSON are always **integer cents** (1200 = $12.00).
+- After adding to cart, invite checkout or more shopping.
+- On checkout confirmation ("yes", "checkout", "pay", "proceed", etc.), build **items** from **cart.items** (all rows, correct quantity). Do not drop lines or invent prices.
+
+## Product catalog (ids and cent prices)
+
+- Sourdough Loaf: sourdough-loaf, 1200
+- Croissant Box (6): croissant-box, 2400
+- Cinnamon Rolls (4): cinnamon-rolls, 1800
+- Baguette Trio: baguette-trio, 900
+- Almond Tart: almond-tart, 800
+- Fruit Danish: fruit-danish, 600
+- $50 Gift Card: gift-card-50, 5000
+- $25 Gift Card: gift-card-25, 2500
+
+## Examples
+
+Gift seeker on /bakery-locations.html:
+{"action": "nav_then_click", "page": "/bakery-goods.html", "on_load_text": "Here are our goods! You'll find our gift cards below — $50 is our most popular. Want me to add one?"}
+
+On /bakery-goods.html, user wants $50 gift card:
+{"action": "scroll_then_add", "text": "Added the $50 gift card. Ready to check out?", "item": {"id": "gift-card-50", "name": "$50 Gift Card", "price": 5000}}
+
+User on /bakery.html agrees to see products:
+{"action": "nav_then_click", "page": "/bakery-goods.html", "on_load_text": "Here are our handcrafted goods — what sounds good today?"}
+
+On /bakery-goods.html, add sourdough:
+{"action": "scroll_then_add", "text": "Sourdough is in your cart. Anything else, or shall we check out?", "item": {"id": "sourdough-loaf", "name": "Sourdough Loaf", "price": 1200}}
+
+Cart has one $50 gift card; user says yes to checkout:
+{"action": "checkout", "text": "Opening secure checkout...", "items": [{"name": "$50 Gift Card", "price": 5000, "quantity": 1}]}
+
+Cart has sourdough (qty 1) and croissant box (qty 1); user says "pay":
+{"action": "checkout", "text": "Taking you to checkout...", "items": [{"name": "Sourdough Loaf", "price": 1200, "quantity": 1}, {"name": "Croissant Box (6)", "price": 2400, "quantity": 1}]}`,
         previousMessages: "{{messages}}"
       }
     }

package/src/flows/components.ts

@@ -14,7 +14,7 @@ export const COMPONENT_FLOW: RuntypeFlowConfig = {
       type: "prompt",
       enabled: true,
       config: {
-        model: "qwen/qwen3-8b",
+        model: "mercury-2",
         reasoning: false,
         responseFormat: "JSON",
         outputVariable: "prompt_result",

package/src/flows/conversational.ts

@@ -14,7 +14,7 @@ export const CONVERSATIONAL_FLOW: RuntypeFlowConfig = {
       type: "prompt",
       enabled: true,
       config: {
-        model: "meta/llama3.1-8b-instruct-free",
+        model: "mercury-2",
         responseFormat: "markdown",
         outputVariable: "prompt_result",
         userPrompt: "{{user_message}}",

package/src/flows/scheduling.ts

@@ -14,7 +14,7 @@ export const FORM_DIRECTIVE_FLOW: RuntypeFlowConfig = {
       type: "prompt",
       enabled: true,
       config: {
-        model: "qwen/qwen3-8b",
+        model: "mercury-2",
         reasoning: false,
         responseFormat: "JSON",
         outputVariable: "prompt_result",

package/src/flows/shopping-assistant.ts

@@ -18,7 +18,7 @@ export const SHOPPING_ASSISTANT_FLOW: RuntypeFlowConfig = {
       type: "prompt",
       enabled: true,
       config: {
-        model: "qwen/qwen3-8b",
+        model: "mercury-2",
         reasoning: false,
         responseFormat: "JSON",
         outputVariable: "prompt_result",
@@ -97,7 +97,7 @@ export const SHOPPING_ASSISTANT_METADATA_FLOW: RuntypeFlowConfig = {
       type: "prompt",
       enabled: true,
       config: {
-        model: "qwen/qwen3-8b",
+        model: "mercury-2",
         reasoning: false,
         responseFormat: "JSON",
         outputVariable: "prompt_result",

package/src/index.test.ts

@@ -0,0 +1,72 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { createChatProxyApp } from "./index";
+
+describe("CORS middleware", () => {
+  const savedEnv = process.env.NODE_ENV;
+
+  afterEach(() => {
+    process.env.NODE_ENV = savedEnv;
+  });
+
+  const preflight = (app: ReturnType<typeof createChatProxyApp>, origin: string, headers?: Record<string, string>) =>
+    app.request("/api/chat/dispatch", {
+      method: "OPTIONS",
+      headers: { Origin: origin, ...headers },
+    });
+
+  it("allows any origin when allowedOrigins is not configured", async () => {
+    const app = createChatProxyApp();
+    const res = await preflight(app, "https://evil.com");
+    expect(res.status).toBe(204);
+    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://evil.com");
+  });
+
+  it("allows matching origin from allowlist", async () => {
+    const app = createChatProxyApp({ allowedOrigins: ["https://good.com"] });
+    const res = await preflight(app, "https://good.com");
+    expect(res.status).toBe(204);
+    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://good.com");
+  });
+
+  it("rejects non-matching origin in production with 403", async () => {
+    process.env.NODE_ENV = "production";
+    const app = createChatProxyApp({ allowedOrigins: ["https://good.com"] });
+    const res = await preflight(app, "https://evil.com");
+    expect(res.status).toBe(403);
+  });
+
+  it("rejects non-matching origin when NODE_ENV is unset", async () => {
+    delete process.env.NODE_ENV;
+    const app = createChatProxyApp({ allowedOrigins: ["https://good.com"] });
+    const res = await preflight(app, "https://evil.com");
+    expect(res.status).toBe(403);
+  });
+
+  it("allows non-matching origin in explicit development mode", async () => {
+    process.env.NODE_ENV = "development";
+    const app = createChatProxyApp({ allowedOrigins: ["https://good.com"] });
+    const res = await preflight(app, "https://localhost:3000");
+    expect(res.status).toBe(204);
+    expect(res.headers.get("Access-Control-Allow-Origin")).toBe("https://localhost:3000");
+  });
+
+  it("uses static Access-Control-Allow-Headers (not reflected)", async () => {
+    const app = createChatProxyApp();
+    const res = await preflight(app, "https://example.com", {
+      "Access-Control-Request-Headers": "X-Evil-Header, X-Custom",
+    });
+    expect(res.headers.get("Access-Control-Allow-Headers")).toBe("Content-Type, Authorization");
+  });
+
+  it("returns 204 for OPTIONS preflight", async () => {
+    const app = createChatProxyApp();
+    const res = await preflight(app, "https://example.com");
+    expect(res.status).toBe(204);
+  });
+
+  it("includes Vary: Origin header", async () => {
+    const app = createChatProxyApp();
+    const res = await preflight(app, "https://example.com");
+    expect(res.headers.get("Vary")).toBe("Origin");
+  });
+});

package/src/index.ts

@@ -16,10 +16,7 @@ export type RuntypeFlowConfig = {
   steps: RuntypeFlowStep[];
 };
 
-/** @deprecated Use RuntypeFlowStep instead */
-export type TravrseFlowStep = RuntypeFlowStep;
-/** @deprecated Use RuntypeFlowConfig instead */
-export type TravrseFlowConfig = RuntypeFlowConfig;
+
 
 /**
  * Payload for message feedback (upvote/downvote)
@@ -76,8 +73,7 @@ const DEFAULT_FLOW: RuntypeFlowConfig = {
       type: "prompt",
       enabled: true,
       config: {
-        model: "gemini-2.5-flash",
-        // model: "gpt-4o",
+        model: "mercury-2",
         responseFormat: "markdown",
         outputVariable: "prompt_result",
         userPrompt: "{{user_message}}",
@@ -97,7 +93,7 @@ const withCors =
   (allowedOrigins: string[] | undefined) =>
     async (c: Context, next: () => Promise<void>) => {
       const origin = c.req.header("origin");
-      const isDevelopment = process.env.NODE_ENV === "development" || !process.env.NODE_ENV;
+      const isDevelopment = process.env.NODE_ENV === "development";
       
       // Determine the CORS origin to allow
       let corsOrigin: string;
@@ -124,9 +120,7 @@ const withCors =
 
       const headers: Record<string, string> = {
         "Access-Control-Allow-Origin": corsOrigin,
-        "Access-Control-Allow-Headers":
-          c.req.header("access-control-request-headers") ??
-          "Content-Type, Authorization",
+        "Access-Control-Allow-Headers": "Content-Type, Authorization",
         "Access-Control-Allow-Methods": "POST, OPTIONS",
         Vary: "Origin"
       };
@@ -173,7 +167,7 @@ export const createChatProxyApp = (options: ChatProxyOptions = {}) => {
     payload.timestamp = payload.timestamp ?? new Date().toISOString();
 
     const isDevelopment =
-      process.env.NODE_ENV === "development" || !process.env.NODE_ENV;
+      process.env.NODE_ENV === "development";
 
     if (isDevelopment) {
       console.log("\n=== Feedback Received ===");
@@ -210,7 +204,7 @@ export const createChatProxyApp = (options: ChatProxyOptions = {}) => {
 
   // Chat dispatch endpoint
   app.post(path, async (c) => {
-    const apiKey = options.apiKey ?? process.env.RUNTYPE_API_KEY ?? process.env.TRAVRSE_API_KEY;
+    const apiKey = options.apiKey ?? process.env.RUNTYPE_API_KEY;
     if (!apiKey) {
       return c.json(
         { error: "Missing API key. Set RUNTYPE_API_KEY." },
@@ -228,7 +222,7 @@ export const createChatProxyApp = (options: ChatProxyOptions = {}) => {
       );
     }
 
-    const isDevelopment = process.env.NODE_ENV === "development" || !process.env.NODE_ENV;
+    const isDevelopment = process.env.NODE_ENV === "development";
 
     // Detect agent mode: if the payload contains an `agent` field, forward it directly
     const isAgentMode = !!clientPayload.agent;
@@ -269,6 +263,11 @@ export const createChatProxyApp = (options: ChatProxyOptions = {}) => {
         }
       };
 
+      const clientInputs = clientPayload.inputs;
+      if (clientInputs && typeof clientInputs === "object" && !Array.isArray(clientInputs)) {
+        runtypePayload.inputs = clientInputs;
+      }
+
       if (flowId) {
         runtypePayload.flow = { id: flowId };
       } else {