@runtypelabs/persona 4.17.0 → 4.18.0

package/src/utils/visitor-store.ts

@@ -0,0 +1,337 @@
+/**
+ * Durable visitor-credential store for per-visitor conversation history
+ * (client-token mode only). Holds the raw `cvt_…` secret under a localStorage
+ * key namespaced by a hash of the client token, degrades to memory after the
+ * first storage throw, and observes cross-tab changes through the `storage`
+ * event. One instance is owned by the controller and injected into every
+ * `AgentWidgetClient` it builds; reuse is keyed on the identity tuple
+ * `(clientToken, keyPrefix, persistDisabled)`.
+ */
+
+export interface VisitorStoreChange {
+  previousToken: string | null;
+  token: string | null;
+  /** "local" = this store's own set/clear; "external" = observed from outside. */
+  source: "local" | "external";
+  revision: number;
+}
+
+export interface VisitorStore {
+  /** Resolves once the hashed storage key exists; every op awaits it. */
+  readonly ready: Promise<void>;
+  get(): Promise<string | null>;
+  set(token: string): Promise<void>;
+  clear(): Promise<void>;
+  /** Monotonic per instance; advances on every observed value change. */
+  revision(): number;
+  subscribe(callback: (change: VisitorStoreChange) => void): () => void;
+  /**
+   * Serialize the empty-store first init across same-origin tabs. Web Locks
+   * when available; otherwise a best-effort localStorage lease (collision
+   * reduction, not proof of exclusivity). Callers must re-read the store
+   * inside `fn` and hold the lock through mint + write + immediate claim.
+   */
+  withFirstInitLock<T>(fn: () => Promise<T>): Promise<T>;
+  matches(
+    clientToken: string,
+    keyPrefix: string,
+    persistDisabled: boolean
+  ): boolean;
+  destroy(): void;
+}
+
+interface LockManagerLike {
+  request<T>(name: string, callback: () => Promise<T> | T): Promise<T>;
+}
+
+interface LeaseRecord {
+  ownerNonce: string;
+  expiresAt: number;
+}
+
+/** Non-crypto fallback for non-secure contexts without `crypto.subtle`. */
+const fnv1aHex = (input: string): string => {
+  let hash = 0x811c9dc5;
+  for (let i = 0; i < input.length; i++) {
+    hash ^= input.charCodeAt(i);
+    hash = Math.imul(hash, 0x01000193) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+};
+
+/**
+ * Namespacing hash only, not a security boundary: it keeps the raw `ct_`
+ * token out of storage keys and separates surfaces sharing an origin.
+ */
+export const hashClientToken = async (clientToken: string): Promise<string> => {
+  const subtle = globalThis.crypto?.subtle;
+  if (subtle) {
+    try {
+      const digest = await subtle.digest(
+        "SHA-256",
+        new TextEncoder().encode(clientToken)
+      );
+      return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+    } catch {
+      // Non-secure context: fall through to the sync hash.
+    }
+  }
+  return fnv1aHex(clientToken);
+};
+
+export const visitorStoreKeys = async (
+  clientToken: string,
+  keyPrefix: string
+): Promise<{ storageKey: string; leaseKey: string; lockName: string }> => {
+  const tokenHash = await hashClientToken(clientToken);
+  return {
+    storageKey: `${keyPrefix}visitor:${tokenHash}`,
+    leaseKey: `${keyPrefix}visitor-init-lock:${tokenHash}`,
+    lockName: `persona-visitor-init:${await hashClientToken(
+      `${clientToken}\0${keyPrefix}`
+    )}`,
+  };
+};
+
+const LEASE_MS = 10_000;
+const LEASE_WAIT_CAP_MS = 15_000;
+
+export const createVisitorStore = (
+  clientToken: string,
+  keyPrefix: string,
+  persistDisabled: boolean
+): VisitorStore => {
+  let storageKey = "";
+  let leaseKey = "";
+  let lockName = "";
+  let blocked = false;
+  let destroyed = false;
+  let currentRevision = 0;
+  let lastKnown: string | null = null;
+  let heldLeaseNonce: string | null = null;
+  const subscribers = new Set<(change: VisitorStoreChange) => void>();
+
+  const localStore = (): Storage | null => {
+    if (persistDisabled || blocked) return null;
+    try {
+      if (typeof window === "undefined" || !window.localStorage) return null;
+      return window.localStorage;
+    } catch {
+      blocked = true;
+      return null;
+    }
+  };
+
+  const readRaw = (): string | null => {
+    const store = localStore();
+    if (!store) return lastKnown;
+    try {
+      return store.getItem(storageKey);
+    } catch {
+      blocked = true;
+      return lastKnown;
+    }
+  };
+
+  const observe = (value: string | null, source: "local" | "external") => {
+    if (destroyed || value === lastKnown) return;
+    const previousToken = lastKnown;
+    lastKnown = value;
+    currentRevision += 1;
+    const change: VisitorStoreChange = {
+      previousToken,
+      token: value,
+      source,
+      revision: currentRevision,
+    };
+    for (const callback of subscribers) callback(change);
+  };
+
+  const onStorage = (event: StorageEvent) => {
+    if (destroyed) return;
+    // key === null is a whole-store clear(); our value is gone with it.
+    if (event.key !== null && event.key !== storageKey) return;
+    observe(event.key === null ? null : (event.newValue ?? null), "external");
+  };
+
+  const ready = (async () => {
+    const keys = await visitorStoreKeys(clientToken, keyPrefix);
+    storageKey = keys.storageKey;
+    leaseKey = keys.leaseKey;
+    lockName = keys.lockName;
+    // Hydrate silently: an existing credential at boot is not a "change".
+    lastKnown = readRaw();
+    if (!persistDisabled && typeof window !== "undefined") {
+      window.addEventListener("storage", onStorage);
+    }
+  })();
+
+  const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
+
+  const readLease = (): LeaseRecord | null => {
+    const store = localStore();
+    if (!store) return null;
+    try {
+      const raw = store.getItem(leaseKey);
+      if (!raw) return null;
+      const parsed = JSON.parse(raw) as LeaseRecord;
+      return typeof parsed?.expiresAt === "number" &&
+        typeof parsed?.ownerNonce === "string"
+        ? parsed
+        : null;
+    } catch {
+      return null;
+    }
+  };
+
+  const removeOwnLease = (nonce: string) => {
+    const store = localStore();
+    if (!store) return;
+    try {
+      if (readLease()?.ownerNonce === nonce) store.removeItem(leaseKey);
+    } catch {
+      // Expiry reclaims an unremovable lease.
+    }
+  };
+
+  /** Storage-change wakeup with a timeout floor; same-tab writers fire no event. */
+  const waitForLeaseChange = (timeoutMs: number) =>
+    new Promise<void>((resolve) => {
+      const timer = setTimeout(done, timeoutMs);
+      function done() {
+        clearTimeout(timer);
+        window.removeEventListener("storage", wake);
+        resolve();
+      }
+      function wake(event: StorageEvent) {
+        if (event.key === null || event.key === leaseKey) done();
+      }
+      window.addEventListener("storage", wake);
+    });
+
+  const leaseLock = async <T>(fn: () => Promise<T>): Promise<T> => {
+    const nonce = `${Date.now().toString(36)}-${Math.random()
+      .toString(36)
+      .slice(2)}`;
+    const deadline = Date.now() + LEASE_WAIT_CAP_MS;
+    while (Date.now() < deadline) {
+      const store = localStore();
+      if (!store) break;
+      const now = Date.now();
+      const lease = readLease();
+      if (lease && lease.expiresAt > now && lease.ownerNonce !== nonce) {
+        await waitForLeaseChange(Math.min(lease.expiresAt - now, 500));
+        continue;
+      }
+      try {
+        store.setItem(
+          leaseKey,
+          JSON.stringify({
+            ownerNonce: nonce,
+            expiresAt: now + LEASE_MS,
+          } satisfies LeaseRecord)
+        );
+      } catch {
+        blocked = true;
+        break;
+      }
+      // localStorage has no compare-and-set: re-read after a randomized
+      // contention window and yield if another writer overwrote us.
+      await sleep(20 + Math.random() * 40);
+      if (readLease()?.ownerNonce !== nonce) {
+        await waitForLeaseChange(500);
+        continue;
+      }
+      heldLeaseNonce = nonce;
+      try {
+        return await fn();
+      } finally {
+        heldLeaseNonce = null;
+        removeOwnLease(nonce);
+      }
+    }
+    // Cap or storage loss: proceed unlocked, the documented rare-race mode.
+    return fn();
+  };
+
+  return {
+    ready,
+
+    async get() {
+      await ready;
+      // Drift from a same-document sibling writer fires no storage event;
+      // reading is the only observation point, so count it as external.
+      observe(readRaw(), "external");
+      return lastKnown;
+    },
+
+    async set(token: string) {
+      await ready;
+      const store = localStore();
+      if (store) {
+        try {
+          store.setItem(storageKey, token);
+        } catch {
+          blocked = true;
+        }
+      }
+      observe(token, "local");
+    },
+
+    async clear() {
+      await ready;
+      const store = localStore();
+      if (store) {
+        try {
+          store.removeItem(storageKey);
+        } catch {
+          blocked = true;
+        }
+      }
+      observe(null, "local");
+    },
+
+    revision() {
+      return currentRevision;
+    },
+
+    subscribe(callback) {
+      subscribers.add(callback);
+      return () => {
+        subscribers.delete(callback);
+      };
+    },
+
+    async withFirstInitLock(fn) {
+      await ready;
+      const locks = (
+        globalThis.navigator as Navigator & { locks?: LockManagerLike }
+      )?.locks;
+      if (locks?.request) {
+        return locks.request(lockName, () => fn());
+      }
+      // No-persistence and degraded-memory modes cannot coordinate tabs.
+      if (!localStore()) return fn();
+      return leaseLock(fn);
+    },
+
+    matches(otherToken, otherPrefix, otherPersistDisabled) {
+      return (
+        otherToken === clientToken &&
+        otherPrefix === keyPrefix &&
+        otherPersistDisabled === persistDisabled
+      );
+    },
+
+    destroy() {
+      destroyed = true;
+      subscribers.clear();
+      if (typeof window !== "undefined") {
+        window.removeEventListener("storage", onStorage);
+      }
+      if (heldLeaseNonce) removeOwnLease(heldLeaseNonce);
+    },
+  };
+};

package/dist/chunk-QJ4LV2KW.js

@@ -1 +0,0 @@
-var Kt=(e,t)=>{let n=document.createElement(e);return t&&(n.className=t),n};var Wt=()=>document.createDocumentFragment(),Ut=(e,t={},...n)=>{let o=document.createElement(e);if(t.className&&(o.className=t.className),t.text!==void 0&&(o.textContent=t.text),t.attrs)for(let[s,a]of Object.entries(t.attrs))o.setAttribute(s,a);if(t.style){let s=o.style,a=t.style;for(let c of Object.keys(a)){let l=a[c];l!=null&&(s[c]=l)}}let r=n.filter(s=>s!=null);return r.length>0&&o.append(...r),o},jt=(...e)=>e.filter(Boolean).join(" ");import{Activity as A,ArrowDown as k,ArrowUp as P,ArrowUpRight as L,Bot as I,ChevronDown as R,ChevronUp as D,ChevronRight as H,ChevronLeft as O,Check as z,Clipboard as B,ClipboardCopy as F,CodeXml as K,Copy as W,File as U,FileCode as j,FileSpreadsheet as $,FileText as q,ImagePlus as V,Loader as X,LoaderCircle as G,Mic as _,Paperclip as Y,RefreshCw as Z,Search as J,Send as Q,ShieldAlert as ee,ShieldCheck as te,ShieldX as ne,Square as oe,ThumbsDown as re,ThumbsUp as ie,Upload as se,Volume2 as ae,X as le,User as ce,Mail as de,Phone as ue,Calendar as me,Clock as pe,Building as ge,MapPin as he,Lock as fe,Key as we,CreditCard as ye,AtSign as be,Hash as ve,Globe as xe,Link as Ce,CircleCheck as Se,CircleX as Ee,TriangleAlert as Te,Info as Me,Ban as Ne,Shield as Ae,ArrowLeft as ke,ArrowRight as Pe,ExternalLink as Le,Ellipsis as Ie,EllipsisVertical as Re,Menu as De,House as He,Plus as Oe,Minus as ze,Pencil as Be,PenLine as Fe,Trash as Ke,Trash2 as We,Save as Ue,Download as je,Share as $e,Funnel as qe,Settings as Ve,RotateCw as Xe,Maximize as Ge,Minimize as _e,ShoppingCart as Ye,ShoppingBag as Ze,Package as Je,Truck as Qe,Tag as et,Gift as tt,Receipt as nt,Wallet as ot,Store as rt,DollarSign as it,Percent as st,Play as at,Pause as lt,VolumeX as ct,Camera as dt,Image as ut,Film as mt,Headphones as pt,MessageCircle as gt,MessageSquare as ht,Bell as ft,Heart as wt,Star as yt,Eye as bt,EyeOff as vt,Bookmark as xt,CalendarDays as Ct,History as St,Timer as Et,Folder as Tt,FolderOpen as Mt,Files as Nt,ChartColumn as At,Sparkles as kt,Zap as Pt,Sun as Lt,Moon as It,Flag as Rt,Lightbulb as Dt,Monitor as Ht,Smartphone as Ot}from"lucide";var zt={activity:A,"arrow-down":k,"arrow-up":P,"arrow-up-right":L,bot:I,"chevron-down":R,"chevron-up":D,"chevron-right":H,"chevron-left":O,check:z,clipboard:B,"clipboard-copy":F,"code-xml":K,copy:W,file:U,"file-code":j,"file-spreadsheet":$,"file-text":q,"image-plus":V,loader:X,"loader-circle":G,mic:_,paperclip:Y,"refresh-cw":Z,search:J,send:Q,"shield-alert":ee,"shield-check":te,"shield-x":ne,square:oe,"thumbs-down":re,"thumbs-up":ie,upload:se,"volume-2":ae,x:le,user:ce,mail:de,phone:ue,calendar:me,clock:pe,building:ge,"map-pin":he,lock:fe,key:we,"credit-card":ye,"at-sign":be,hash:ve,globe:xe,link:Ce,"circle-check":Se,"circle-x":Ee,"triangle-alert":Te,info:Me,ban:Ne,shield:Ae,"arrow-left":ke,"arrow-right":Pe,"external-link":Le,ellipsis:Ie,"ellipsis-vertical":Re,menu:De,house:He,plus:Oe,minus:ze,pencil:Be,"pen-line":Fe,trash:Ke,"trash-2":We,save:Ue,download:je,share:$e,funnel:qe,settings:Ve,"rotate-cw":Xe,maximize:Ge,minimize:_e,"shopping-cart":Ye,"shopping-bag":Ze,package:Je,truck:Qe,tag:et,gift:tt,receipt:nt,wallet:ot,store:rt,"dollar-sign":it,percent:st,play:at,pause:lt,"volume-x":ct,camera:dt,image:ut,film:mt,headphones:pt,"message-circle":gt,"message-square":ht,bell:ft,heart:wt,star:yt,eye:bt,"eye-off":vt,bookmark:xt,"calendar-days":Ct,history:St,timer:Et,folder:Tt,"folder-open":Mt,files:Nt,"chart-column":At,sparkles:kt,zap:Pt,sun:Lt,moon:It,flag:Rt,lightbulb:Dt,monitor:Ht,smartphone:Ot},Vt=(e,t=24,n="currentColor",o=2)=>{let r=zt[e];return r?Bt(r,t,n,o):(console.warn(`Lucide icon "${e}" is not in the Persona registry. Add it to packages/widget/src/utils/icons.ts (see docs/icon-registry-shortlist.md).`),null)};function Bt(e,t,n,o){if(!Array.isArray(e))return null;let r=document.createElementNS("http://www.w3.org/2000/svg","svg");return r.setAttribute("width",String(t)),r.setAttribute("height",String(t)),r.setAttribute("viewBox","0 0 24 24"),r.setAttribute("fill","none"),r.setAttribute("stroke",n),r.setAttribute("stroke-width",String(o)),r.setAttribute("stroke-linecap","round"),r.setAttribute("stroke-linejoin","round"),r.setAttribute("aria-hidden","true"),e.forEach(s=>{if(!Array.isArray(s)||s.length<2)return;let a=s[0],c=s[1];if(!c)return;let l=document.createElementNS("http://www.w3.org/2000/svg",a);Object.entries(c).forEach(([h,f])=>{h!=="stroke"&&l.setAttribute(h,String(f))}),r.appendChild(l)}),r}function Gt(e){let t={trigger:e.trigger??"@",position:e.triggerPosition??"anywhere",allowSpaces:!1,sources:Array.isArray(e.sources)?e.sources:[],searchPlaceholder:e.searchPlaceholder,showButton:e.showButton!==!1,buttonIconName:e.buttonIconName,buttonTooltipText:e.buttonTooltipText},n=(e.triggers??[]).map(o=>({trigger:o.trigger,position:o.triggerPosition??"anywhere",allowSpaces:o.allowSpaces??!1,sources:Array.isArray(o.sources)?o.sources:[],searchPlaceholder:o.searchPlaceholder,showButton:o.showButton===!0,buttonIconName:o.buttonIconName,buttonTooltipText:o.buttonTooltipText}));return[t,...n]}function T(e){let t=e.getRootNode?.();return t instanceof ShadowRoot||t instanceof Document?t:e.ownerDocument??document}function b(e,t,n){let o=e instanceof Document?e.head:e,r=t.replace(/["\\]/g,"\\$&");if(o.querySelector(`style[data-persona-plugin-style="${r}"]`))return;let a=(e instanceof Document?e:e.ownerDocument??document).createElement("style");a.setAttribute("data-persona-plugin-style",t),a.textContent=n,o.appendChild(a)}function Yt(e,t,n){if(e instanceof Document||e instanceof ShadowRoot){b(e,t,n);return}let o=e;if(o.isConnected){b(T(o),t,n);return}let r=o.ownerDocument??document;b(r,t,n),queueMicrotask(()=>{let s=T(o);s!==r&&b(s,t,n)})}function Ft(e){let t=e.getRootNode?.();return t instanceof ShadowRoot?t:(e.ownerDocument??document).body}function Zt(e){let{anchor:t,content:n,placement:o="bottom-start",offset:r=6,matchAnchorWidth:s=!1,horizontalOffset:a,verticalOffset:c,zIndex:l=2147483e3,onOpen:h,onDismiss:f}=e,M=e.container??Ft(t),d=!1,w=null,v=()=>{if(!d)return;let i=t.getBoundingClientRect();n.style.position="fixed",s&&(n.style.minWidth=`${i.width}px`),a&&(n.style.maxWidth=`${i.width}px`);let m=n.getBoundingClientRect(),u=c?.()??null,y=u!=null?i.top+u:i.top,x=o==="top-start"||o==="top-end"?y-r-m.height:i.bottom+r,g=o==="bottom-end"||o==="top-end"?i.right-m.width:i.left,E=a?.()??null;if(E!=null){let N=Math.max(i.left,i.right-m.width);g=Math.min(Math.max(i.left+E,i.left),N)}n.style.top=`${x}px`,n.style.left=`${g}px`},p=()=>{d&&(d=!1,w&&(w(),w=null),n.remove())},S=()=>{if(d)return;d=!0,l!=null&&(n.style.zIndex=String(l)),M.appendChild(n),v();let i=(t.ownerDocument??document).defaultView??window,m=t.ownerDocument??document,u=()=>{if(!t.isConnected){p(),f?.("anchor-removed");return}v()},y=C=>{let g=typeof C.composedPath=="function"?C.composedPath():[];g.includes(n)||g.includes(t)||(p(),f?.("outside"))},x=i.setTimeout(()=>{m.addEventListener("pointerdown",y,!0)},0);i.addEventListener("scroll",u,!0),i.addEventListener("resize",u),w=()=>{i.clearTimeout(x),m.removeEventListener("pointerdown",y,!0),i.removeEventListener("scroll",u,!0),i.removeEventListener("resize",u)},h?.()};return{get isOpen(){return d},open:S,close:p,toggle:()=>d?p():S(),reposition:v,destroy:p}}function Jt(e){return(typeof e.composedPath=="function"?e.composedPath():[]).some(n=>n instanceof HTMLElement&&(n.tagName==="INPUT"||n.tagName==="TEXTAREA"||n.isContentEditable))}export{Kt as a,Wt as b,Ut as c,jt as d,Vt as e,Gt as f,Yt as g,Zt as h,Jt as i};