@runtypelabs/persona 4.22.0 → 4.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/persona",
-  "version": "4.22.0",
+  "version": "4.23.0",
   "description": "Themeable, pluggable streaming agent widget for websites, in plain JS with support for voice input and reasoning / tool output.",
   "type": "module",
   "main": "dist/index.cjs",

package/src/ask-user-question-tool.ts

@@ -5,7 +5,7 @@
  * `clientTools[]` (set `features.askUserQuestion.expose: true`): the same
  * wire surface WebMCP page tools ride. The server registers it as a LOCAL
  * tool under its bare name (`origin: 'sdk'` tools are not `webmcp:`-prefixed),
- * so when the model calls it the execution pauses with a `step_await`, the
+ * so when the model calls it the execution pauses with an `await`, the
  * widget's answer-pill sheet renders, and `session.resolveAskUserQuestion()`
  * resumes the execution with the structured answers. The public await frame
  * for a local-tool pause carries no `awaitReason`; that discriminator is

package/src/client-history-rest.test.ts

@@ -197,6 +197,7 @@ describe('history REST - request shape', () => {
           id: 'conv_1',
           title: 'Placeholder title',
           flowId: 'flow_1',
+          targetId: 'flow_1',
           messageCount: 4,
           createdAt: '2026-08-01T00:00:00.000Z',
           updatedAt: '2026-08-02T00:00:00.000Z',
@@ -222,7 +223,7 @@ describe('history REST - request shape', () => {
     expect(requests[1].method).toBe('GET');
     expect(requests[1].headers['X-Visitor-Token']).toBe('cvt_stored');
     expect(requests[1].headers['X-Persona-Version']).toBeTruthy();
-    // Deprecated flowId is consumed at this boundary and never re-exposed.
+    // The deprecated flowId alias is not re-exposed.
     expect(page.data[0]).toEqual({
       id: 'conv_1',
       title: 'Placeholder title',

package/src/client-visitor-history.test.ts

@@ -203,7 +203,7 @@ describe('client visitor history - init capability shape', () => {
     expect(requests[0].body).not.toHaveProperty('conversationId');
   });
 
-  it('normalizes targetId, preferring the top-level field over flow.id', async () => {
+  it('uses canonical targetId without falling back to flow metadata', async () => {
     installFetch([
       ok({ targetId: 'agent_9' }),
       ok({ sessionId: 'sess_2', targetId: undefined, flow: { id: 'flow_7', name: 'F', description: null } }),
@@ -216,7 +216,23 @@ describe('client visitor history - init capability shape', () => {
 
     expect(a.targetId).toBe('agent_9');
     expect(a.flow.id).toBe('flow_1');
-    expect(b.targetId).toBe('flow_7');
+    expect(b.targetId).toBeUndefined();
+  });
+
+  it('surfaces an init 400 without retrying a different payload', async () => {
+    installFetch([fail(400, { error: 'invalid_token' })]);
+    await expect(makeClient({}).client.initSession()).rejects.toThrow('invalid_token');
+    expect(requests).toHaveLength(1);
+    expect(requests[0].body.durableRecovery).toBe(true);
+  });
+
+  it('accepts a data-only init with no flow or target metadata', async () => {
+    installFetch([() => ({ ok: true, status: 200, json: async () => ({
+      ...initBody(), flow: undefined, targetId: undefined, app: { id: 'app_1' },
+    }) })]);
+    const session = await makeClient({}).client.initSession();
+    expect(session.targetId).toBeUndefined();
+    expect(session.conversationId).toBe('conv_1');
   });
 
   it('uses the exact visitor credential and durable cursor for reconnect', async () => {
@@ -235,14 +251,14 @@ describe('client visitor history - init capability shape', () => {
     const controller = new AbortController();
     const response = await h.client.reconnectClientTokenStream({
       executionId: 'exec_7',
-      after: '12',
+      after: '12.3',
       signal: controller.signal,
     });
 
     expect(response).toBe(events);
     expect(fetchMock.mock.calls[1]?.[0]).toBe(
       `${API_URL}/v1/client/conversations/conv_1/executions/exec_7/events` +
-        '?sessionId=sess_1&after=12'
+        '?sessionId=sess_1&after=12.3'
     );
     expect(fetchMock.mock.calls[1]?.[1]).toMatchObject({
       method: 'GET',
@@ -1064,3 +1080,89 @@ describe('client visitor history - dedupe', () => {
     expect(h.sessionInits).toHaveLength(1);
   });
 });
+
+describe('voice integration visitor credential access', () => {
+  const controllers: ReturnType<typeof createAgentExperience>[] = [];
+  const mountWidget = (config: Partial<AgentWidgetConfig> = {}) => {
+    const mount = document.createElement('div');
+    document.body.appendChild(mount);
+    const controller = createAgentExperience(mount, {
+      apiUrl: API_URL,
+      clientToken: CLIENT_TOKEN,
+      launcher: { enabled: false },
+      ...config,
+    });
+    controllers.push(controller);
+    return controller;
+  };
+
+  afterEach(() => {
+    controllers.forEach((controller) => controller.destroy());
+    controllers.length = 0;
+    document.body.innerHTML = '';
+  });
+
+  it('reads minted proof after the claim response omits it without enriching the callback', async () => {
+    const minted = { id: 'vis_1', token: 'cvt_minted', expiresAt: futureIso(), endUserId: null };
+    installFetch([
+      ok({ sessionId: 'sess_first', visitor: minted }),
+      ok({ sessionId: 'sess_claimed', visitor: { ...minted, token: undefined } }),
+    ]);
+    const onSessionInit = vi.fn();
+    const controller = mountWidget({ persistState: false, onSessionInit });
+    await vi.waitFor(() => expect(onSessionInit).toHaveBeenCalledOnce());
+    expect(onSessionInit.mock.calls[0][0].visitor.token).toBeUndefined();
+    await expect(controller.getVisitorToken()).resolves.toBe('cvt_minted');
+    expect(JSON.stringify(controller.getState())).not.toContain('cvt_minted');
+    expect(window.localStorage.getItem(await storageKeyFor())).toBeNull();
+  });
+
+  it('reads the current persisted credential after reload and after rotation or removal', async () => {
+    await seedToken('cvt_stored');
+    installFetch([ok()]);
+    const controller = mountWidget();
+    await expect(controller.getVisitorToken()).resolves.toBe('cvt_stored');
+    await seedToken('cvt_rotated');
+    await expect(controller.getVisitorToken()).resolves.toBe('cvt_rotated');
+    window.localStorage.removeItem(await storageKeyFor());
+    await expect(controller.getVisitorToken()).resolves.toBeNull();
+  });
+
+  it('does not return credentials from a replaced client-token scope', async () => {
+    await seedToken('cvt_stored');
+    installFetch([ok(), ok()]);
+    const controller = mountWidget();
+    await vi.waitFor(() => expect(requests).toHaveLength(1));
+    const pending = controller.getVisitorToken();
+    controller.update({ clientToken: 'ct_other' });
+    await expect(pending).resolves.toBeNull();
+    await expect(controller.getVisitorToken()).resolves.toBeNull();
+  });
+
+  it('returns null after teardown, including a read already in flight', async () => {
+    await seedToken('cvt_stored');
+    installFetch([ok()]);
+    const controller = mountWidget();
+    await vi.waitFor(() => expect(requests).toHaveLength(1));
+    const pending = controller.getVisitorToken();
+    controller.destroy();
+    controllers.length = 0;
+    await expect(pending).resolves.toBeNull();
+    await expect(controller.getVisitorToken()).resolves.toBeNull();
+  });
+
+  it('returns null when no credential has been minted', async () => {
+    installFetch([ok()]);
+    const controller = mountWidget({ persistState: false });
+    await expect(controller.getVisitorToken()).resolves.toBeNull();
+  });
+
+  it('does not fetch or mint a visitor outside client-token mode', async () => {
+    const fetch = vi.fn();
+    vi.stubGlobal('fetch', fetch);
+    const controller = mountWidget({ clientToken: undefined });
+    await expect(controller.getVisitorToken()).resolves.toBeNull();
+    expect(fetch).not.toHaveBeenCalled();
+    vi.unstubAllGlobals();
+  });
+});

package/src/client.composer-options.test.ts

@@ -22,7 +22,7 @@ const streamResponse = () => {
     body: new ReadableStream({
       start(controller) {
         controller.enqueue(
-          encoder.encode('data: {"type":"flow_complete","success":true}\n\n')
+          encoder.encode('data: {"type":"execution_complete","success":true}\n\n')
         );
         controller.close();
       },

package/src/client.interrupt.test.ts

@@ -120,9 +120,9 @@ describe("client-token turn identity", () => {
     await vi.waitFor(() => expect(index).toBe(2));
 
     const beforeCount = firstEvents.length;
-    first.push('data: {"type":"flow_complete","success":true}\n\n');
+    first.push('data: {"type":"execution_complete","success":true}\n\n');
     first.close();
-    second.push('data: {"type":"flow_complete","success":true}\n\n');
+    second.push('data: {"type":"execution_complete","success":true}\n\n');
     second.close();
     await Promise.all([firstDispatch, secondDispatch]);