@wix/himalaya-cli 0.1445.0 → 0.1446.0

package/templates/branded-lite/himalaya.content.json

@@ -40,6 +40,9 @@
     "himi_branded_home": {
       "displayName": "Home"
     },
+    "himi_business_chat": {
+      "displayName": "Business Chat"
+    },
     "himi_cart": {
       "displayName": "Cart"
     },

package/templates/branded-lite/tier5-src/_shared/branded-lite-hosted.ts

@@ -72,6 +72,7 @@ export const HOSTED_SCREEN_VERTICALS: Readonly<Record<string, readonly BrandedLi
   himi_blog: ["blog"],
   himi_bookings: ["bookings"],
   himi_cart: ["store"],
+  himi_business_chat: ["inbox"],
   himi_chat_thread: ["inbox", "members"],
   himi_cms: ["cms"],
   himi_collection: ["store"],

package/templates/branded-lite/tier5-src/_shared/business-chat-message-model.ts

@@ -0,0 +1,177 @@
+/** Read-only presentation model. HTML stays text; remote actions require a separate dispatcher. */
+export type PartKind = 'text' | 'image' | 'file' | 'audio' | 'video' | 'card' | 'form' | 'system' | 'unsupported';
+export interface MessageButton { id: string; label: string; url: string; interactionId?: string; unavailableReason?: string }
+export interface PartRow {
+  id: string; kind: PartKind; text: string; url: string; fileName: string; caption: string;
+  buttons?: MessageButton[]; fields?: { name: string; value: string }[];
+  mimeType?: string; iconUrl?: string; mediaId?: string; urlExpiration?: string; unavailableReason?: string;
+  mediaProvider?: string; thumbnailUrl?: string;
+}
+export interface MessageRow {
+  id: string; sequence: string; sender: string; senderId: string; when: string; createdDate: string;
+  mine: boolean; status: string; direction: string; parts: PartRow[]; plainText: string;
+}
+type Obj = Record<string, unknown>;
+function obj(value: unknown): Obj { return value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Obj : {}; }
+function str(value: unknown): string { return typeof value === 'string' ? value : typeof value === 'number' && Number.isFinite(value) ? String(value) : ''; }
+function first(...values: unknown[]): string { for (const value of values) { const s = str(value); if (s) return s; } return ''; }
+function stable(value: unknown, ancestors: unknown[] = []): string {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value) ?? String(value);
+  if (ancestors.includes(value)) return '[circular]';
+  const next = [...ancestors, value];
+  return Array.isArray(value) ? '[' + value.map(v => stable(v, next)).join(',') + ']' : '{' + Object.keys(value as Obj).sort().map(k => JSON.stringify(k) + ':' + stable((value as Obj)[k], next)).join(',') + '}';
+}
+function hash(value: unknown): string {
+  const text = stable(value); let a = 2166136261; let b = 5381;
+  for (let i = 0; i < text.length; i++) { a = Math.imul(a ^ text.charCodeAt(i), 16777619); b = Math.imul(b, 33) ^ text.charCodeAt(i); }
+  return (a >>> 0).toString(16).padStart(8, '0') + (b >>> 0).toString(16).padStart(8, '0');
+}
+/** HTTPS only, no credentials/control characters/backslashes. Does not depend on worker URL globals. */
+function safeUrl(value: unknown): string {
+  if (typeof value !== 'string' || /[\s\\\u0000-\u001f\u007f-\u009f]/u.test(value)) return '';
+  const match = /^https:\/\/([^/?#]+)(?:[/?#].*)?$/iu.exec(value);
+  if (!match) return '';
+  const authority = match[1];
+  if (authority.includes('@') || !/^(?:[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?|\[[0-9a-f:]+\])(?::[0-9]{1,5})?$/iu.test(authority)) return '';
+  const port = /:([0-9]+)$/.exec(authority);
+  if (port && Number(port[1]) > 65535) return '';
+  return value;
+}
+function htmlText(value: string): string {
+  // Output is plain text, never markup. No href/src extraction or HTML insertion.
+  return value.replace(/<!--[\s\S]*?-->/g, '').replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, '')
+    .replace(/<\s*br\s*\/?\s*>/gi, '\n').replace(/<\/(p|div|li|h[1-6])\s*>/gi, '\n').replace(/<[^>]*>/g, '')
+    .replace(/&(#x[0-9a-f]+|#[0-9]+|amp|lt|gt|quot|apos|nbsp);/gi, (whole, entity: string) => {
+      const names: Record<string, string> = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ' };
+      if (entity[0] !== '#') return names[entity.toLowerCase()] ?? whole;
+      const n = entity[1]?.toLowerCase() === 'x' ? parseInt(entity.slice(2), 16) : Number(entity.slice(1));
+      return n > 0 && n <= 0x10ffff && !(n >= 0xd800 && n <= 0xdfff) ? String.fromCodePoint(n) : whole;
+    });
+}
+function base(id: string, kind: PartKind, text = ''): PartRow { return { id, kind, text, url: '', fileName: '', caption: '' }; }
+function unsupported(id: string, value: unknown, reason = 'Unsupported message content'): PartRow {
+  return { ...base(id, 'unsupported', typeof value === 'string' ? value : stable(value)), caption: reason, unavailableReason: reason };
+}
+function media(id: string, kind: 'image' | 'file' | 'audio' | 'video', input: unknown): PartRow {
+  const m = obj(input); const candidate = first(m.url, m.uri, m.downloadUrl, m.src, typeof input === 'string' ? input : '');
+  const url = safeUrl(candidate); const mime = first(m.mimeType, m.contentType);
+  const resolvedKind = kind === 'file' && /^audio\//i.test(mime) ? 'audio' : kind === 'file' && /^video\//i.test(mime) ? 'video' : kind;
+  const missing = url ? '' : candidate ? 'Attachment URL is unavailable: only safe HTTPS links are supported.' : 'Attachment requires a download URL.';
+  return { ...base(id, resolvedKind, first(m.text, m.title)), url, fileName: first(m.filename, m.fileName, m.name), caption: first(m.caption, m.alt, missing, resolvedKind === 'image' ? 'Image attachment' : ''), mimeType: mime, mediaId: first(m.mediaFileId, m.id, m._id, m.fileId), mediaProvider: str(m.mediaProvider), thumbnailUrl: safeUrl(m.thumbnailUrl), urlExpiration: str(m.urlExpiration), ...(missing ? { unavailableReason: missing } : {}) };
+}
+function buttons(value: unknown, prefix: string): MessageButton[] {
+  if (!Array.isArray(value)) return [];
+  return value.map((value, i) => {
+    const b = obj(value); const raw = first(b.launchUrl, b.url, b.href, obj(b.action).url); const url = safeUrl(raw);
+    const interactionId = first(obj(b.postbackProperties).interactionId, b.interactionId);
+    return { id: prefix + '-button-' + i, label: first(b.label, b.title, b.text, 'Action'), url,
+      ...(interactionId ? { interactionId } : {}),
+      ...(!url ? { unavailableReason: raw ? 'Only safe HTTPS links are supported.' : interactionId ? 'This interaction requires a supported server action.' : 'Action has no supported link.' } : {}) };
+  });
+}
+function card(id: string, input: unknown, kind: 'card' | 'form' | 'system' = 'card'): PartRow[] {
+  const c = obj(input); const lines = Array.isArray(c.textLines) ? c.textLines.map(str) : [];
+  const text = [first(c.title, c.name), first(c.text, c.description, c.body), ...lines].filter(Boolean).join('\n');
+  const fields = Array.isArray(c.fields) ? c.fields.map(f => ({ name: first(obj(f).name, obj(f).label), value: typeof obj(f).value === 'string' ? obj(f).value as string : stable(obj(f).value) })) : [];
+  const result: PartRow = { ...base(id, kind, text), buttons: buttons(c.buttons, id), ...(fields.length ? { fields } : {}) };
+  const image = first(c.imageUrl, c.iconUrl, obj(c.image).url, obj(c.image).uri);
+  if (image) { result.url = safeUrl(image); if (!result.url) result.unavailableReason = 'Card image requires a safe HTTPS URL.'; }
+  const parts = [result];
+  if (Array.isArray(c.media)) c.media.forEach((v, i) => parts.push(...basicItem(`${id}-media-${i}`, v)));
+  if (!text && !fields.length && !result.buttons?.length && !image && parts.length === 1) return [unsupported(id, input)];
+  return parts;
+}
+function basicItem(id: string, value: unknown): PartRow[] {
+  if (typeof value === 'string') return [base(id, 'text', value)];
+  const v = obj(value); const parts: PartRow[] = [];
+  if (typeof v.text === 'string') parts.push(base(id + '-text', 'text', v.text));
+  for (const kind of ['image', 'file', 'audio', 'video'] as const) if (v[kind] !== undefined && v[kind] !== null) parts.push(media(id + '-' + kind, kind, v[kind]));
+  for (const key of Object.keys(v).filter(k => !['text', 'image', 'file', 'audio', 'video', 'id', '_id', 'type'].includes(k))) parts.push(unsupported(id + '-extra-' + key, { [key]: v[key] }));
+  return parts.length ? parts : [unsupported(id, value)];
+}
+function publicParts(content: Obj, id: string): PartRow[] {
+  const parts: PartRow[] = [];
+  if (content.basic !== undefined) {
+    const items = obj(content.basic).items;
+    if (Array.isArray(items) && items.length) items.forEach((v, i) => parts.push(...basicItem(`${id}-basic-${i}`, v)));
+    else parts.push(unsupported(id + '-basic', content.basic));
+  }
+  for (const key of ['template', 'form', 'system'] as const) if (content[key] !== undefined) parts.push(...card(id + '-' + key, content[key], key === 'template' ? 'card' : key));
+  if (content.minimal !== undefined) {
+    const m = obj(content.minimal); const part = base(id + '-minimal', 'system', str(m.text)); const rawUrl = str(m.url);
+    if (rawUrl) { part.url = safeUrl(rawUrl); if (!part.url) part.unavailableReason = 'Only safe HTTPS links are supported.'; }
+    const icon = str(m.iconUrl);
+    if (icon) { part.iconUrl = safeUrl(icon); if (!part.iconUrl) part.caption = 'Activity icon requires a safe HTTPS URL.'; }
+    parts.push(part.text || part.url ? part : unsupported(part.id, content.minimal));
+  }
+  const unknown = Object.keys(content).filter(k => !['basic', 'template', 'form', 'system', 'minimal', 'title', 'previewText'].includes(k));
+  for (const key of unknown) parts.push(unsupported(id + '-content-' + key, { [key]: content[key] }));
+  return parts;
+}
+function chatPart(id: string, value: unknown): PartRow[] {
+  const v = obj(value); const mime = first(v.mimeType, v.contentType).toLowerCase().split(';')[0].trim(); const d = v.data;
+  const data = obj(d);
+  if (Array.isArray(data.cards)) return data.cards.length ? data.cards.flatMap((item, i) => card(`${id}-card-${i}`, item)) : [unsupported(id, value)];
+  if (mime === 'text/plain') return [base(id, 'text', typeof d === 'string' ? d : first(data.text, v.text))];
+  if (mime === 'text/html') return [{ ...base(id, 'text', htmlText(typeof d === 'string' ? d : first(data.html, data.text, v.text))), caption: 'HTML message shown as plain text' }];
+  // Branded chat separates the outer message-part kind from the file's MIME.
+  // mobile-apps-inbox MIME_TYPE: uri/image, uri/file; actual MIME lives in data.type.
+  if (mime === 'uri/image' || mime === 'uri/file') {
+    return [media(id, mime === 'uri/image' ? 'image' : 'file', typeof d === 'string' ? d : {
+      ...data, mimeType: first(data.type, data.mimeType, data.contentType),
+    })];
+  }
+  if (/^(image|audio|video)\//.test(mime)) {
+    const kind = mime.split('/')[0] as 'image' | 'audio' | 'video';
+    return [media(id, kind, typeof d === 'string' ? d : { ...data, mimeType: mime })];
+  }
+  if (/card|template|form|system/.test(mime)) {
+    let payload: unknown = d;
+    if (typeof payload === 'string') { try { payload = JSON.parse(payload); } catch { return [unsupported(id, payload)]; } }
+    return card(id, payload, /form/.test(mime) ? 'form' : /system/.test(mime) ? 'system' : 'card');
+  }
+  if (typeof d === 'string' && /^application\//.test(mime) && safeUrl(d)) return [media(id, 'file', { url: d, mimeType: mime })];
+  if (first(data.uri, data.url, data.downloadUrl) && (first(data.fileName, data.filename, data.name) || /^(application|text)\//.test(mime))) return [media(id, 'file', { ...data, mimeType: mime })];
+  return [unsupported(id, value, mime ? `Unsupported message part (${mime})` : 'Unsupported message part')];
+}
+function decimal(value: string): { negative: boolean; digits: string } | null {
+  if (!/^-?\d+$/.test(value)) return null;
+  const digits = value.replace(/^-/, '').replace(/^0+(?=\d)/, ''); return { negative: value[0] === '-' && digits !== '0', digits };
+}
+/** Exact decimal ordering, including int64 values beyond JavaScript's safe integer range. */
+export function compareSequence(a: string, b: string): number {
+  const x = decimal(a); const y = decimal(b);
+  if (x && y) { if (x.negative !== y.negative) return x.negative ? -1 : 1; const n = x.digits.length === y.digits.length ? x.digits < y.digits ? -1 : x.digits > y.digits ? 1 : 0 : x.digits.length < y.digits.length ? -1 : 1; return x.negative ? -n : n; }
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function dateText(raw: unknown): string {
+  if (typeof raw === 'string') return raw;
+  if (typeof raw === 'number' && Number.isFinite(raw)) { const date = new Date(raw); return Number.isFinite(date.getTime()) ? date.toISOString() : ''; }
+  return '';
+}
+function normalize(value: unknown, myMemberId?: string): MessageRow {
+  const m = obj(value); const sender = obj(m.sender); const display = obj(m.senderDisplayData);
+  const id = typeof m.id === 'string' && m.id ? m.id : typeof m._id === 'string' && m._id ? m._id : typeof m.id === 'number' && Number.isSafeInteger(m.id) ? String(m.id) : 'local-' + hash(value);
+  const senderId = first(sender.memberId, sender.userId, sender.wixUserId, sender.contactId, sender.anonymousVisitorId, m.senderId);
+  const direction = str(m.direction); const senderName = first(display.name, obj(m.senderDisplayData).displayName, sender.name, typeof m.sender === 'string' ? m.sender : '', sender.type);
+  let parts: PartRow[] = publicParts(obj(m.content), id);
+  if (Array.isArray(m.data)) m.data.forEach((v, i) => parts.push(...chatPart(`${id}-chat-${i}`, v)));
+  if (!parts.length) { // A chat-web template message (a card) keeps its visible text in the top-level templateData.
+    const body = first(m.body, m.text, obj(m.templateData).text, m.summary, obj(m.content).previewText); parts = body ? [base(id + '-text', 'text', body)] : [unsupported(id + '-unknown', m.content ?? m.data ?? { messageType: m.messageType ?? 'unknown' })]; }
+  const sequence = typeof m.sequence === 'string' ? m.sequence : typeof m.sequence === 'number' && Number.isSafeInteger(m.sequence) ? String(m.sequence) : '';
+  const createdDate = dateText(m.createdDate ?? m._createdDate ?? m.createdAt);
+  const mine = !!myMemberId && [sender.memberId, sender.userId, sender.wixUserId, sender.contactId, sender.anonymousVisitorId, m.senderId].includes(myMemberId);
+  const status = first(m.status, m.deliveryStatus, obj(m.transit).status, obj(m.transit).state, 'stored');
+  return { id, sequence, sender: senderName || (senderId ? senderId : 'Unknown sender'), senderId, when: createdDate, createdDate, mine, status, direction, parts, plainText: parts.map(p => [p.text, ...(p.fields ?? []).map(f => `${f.name}: ${f.value}`), p.fileName || p.caption].filter(Boolean).join('\n')).filter(Boolean).join('\n') };
+}
+/** Newest representation replaces the same message ID; deterministic tie ordering never uses wall clock. */
+export function mergeMessages(oldRows: MessageRow[], newRows: MessageRow[]): MessageRow[] {
+  const byId = new Map<string, MessageRow>(); for (const row of [...oldRows, ...newRows]) byId.set(row.id, row);
+  return [...byId.values()].sort((a, b) => {
+    if (!!a.sequence !== !!b.sequence) return a.sequence ? 1 : -1;
+    if (a.sequence && b.sequence) { const order = compareSequence(a.sequence, b.sequence); if (order) return order; }
+    if (a.createdDate !== b.createdDate) return a.createdDate < b.createdDate ? -1 : 1;
+    return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
+  });
+}
+export function normalizeMessages(raw: unknown[], myMemberId?: string): MessageRow[] { return mergeMessages([], raw.map(value => normalize(value, myMemberId))); }

package/templates/branded-lite/tier5-src/_shared/business-chat-model.ts

@@ -0,0 +1,22 @@
+import { formatClock } from './engine-intl.js';
+import { mergeMessages, normalizeMessages, type MessageRow } from './business-chat-message-model.js';
+
+export interface BusinessChatIntent { id:string; text:string; roomId:string; principal:string }
+
+export function newBusinessChatIntent(text:string,roomId:string,principal:string,random=Math.random):BusinessChatIntent{
+ return {id:'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g,c=>{const r=Math.floor(random()*16);return(c==='x'?r:(r&3)|8).toString(16);}),text,roomId,principal};
+}
+export function businessChatSendRejected(error:unknown):boolean{
+ return /\b(400|401|403|404|409|413|422|429)\b|approved first-party|webwix_owner_only|sign_in_required|owner_preview_read_only/i.test(String((error as Error)?.message||error));
+}
+export function draftAfterAcceptedSend(currentDraft:string,sentDraft:string):string{return currentDraft===sentDraft?'':currentDraft;}
+export function pendingIntentWasObserved(messages:MessageRow[],intent:BusinessChatIntent|null):boolean{
+ return !!intent&&messages.some(message=>message.id===intent.id);
+}
+export function messageTimeLabel(value:string):string{
+ const date=new Date(value);
+ return Number.isFinite(date.getTime())?formatClock(date):'';
+}
+export function chronologicalMessages(existing:MessageRow[],raw:unknown[],memberId?:string):MessageRow[]{
+ return mergeMessages(existing,normalizeMessages(raw,memberId)).map(row=>({...row,when:messageTimeLabel(row.createdDate),side:row.mine?'mine':'other'}));
+}

package/templates/branded-lite/tier5-src/_shared/business-chat-presenter.ts

@@ -0,0 +1,427 @@
+import { formatMonthDay } from "./engine-intl.js";
+type RecordValue = Record<string, unknown>;
+
+export type BusinessMessagePart = {
+  kind?: string;
+  text?: string;
+  fileName?: string;
+  caption?: string;
+  url?: string;
+  thumbnailUrl?: string;
+  fields?: { name: string; value: string }[];
+  buttons?: { id: string; label: string; url: string; interactionId?: string; enabled: boolean }[];
+};
+
+export type BusinessTextRun = { text: string; marks?: string[] };
+export type BusinessSuggestion = { id: string; messageId: string; label: string; kind: "postback" | "visitor_option"; appId?: string; interactionId?: string; enabled: boolean; disabled: boolean };
+export type BusinessArticleAction = { id: string; label: string; url: string };
+export type BusinessVisitorOptions = { answerTo: string; labels: string[] };
+
+export type BusinessMessage = {
+  id: string;
+  sender: string;
+  senderName: string;
+  senderId: string;
+  mine: boolean;
+  when: string;
+  createdDate: string;
+  plainText: string;
+  parts: BusinessMessagePart[];
+};
+
+export type BusinessRoomSummary = {
+  id?: unknown;
+  participantId?: unknown;
+  participantCount?: unknown;
+  clientReferenceType?: unknown;
+  businessContext?: unknown;
+};
+
+/** Keep host capability failures visible without exposing runtime error details. */
+export function businessRealtimeStatusLabel(state: string, reason = ""): string {
+  if (state === "connected") return "";
+  if (state === "connecting") return "Connecting to live updates";
+  if (state === "reconnecting") return "Reconnecting live updates";
+  if (reason === "chat_setup_scope_unavailable") return "Live updates unavailable for this session";
+  if (reason === "runtime_unavailable") return "Live updates unavailable in this host";
+  if (reason === "invalid_setup_response") return "Live connection setup failed";
+  if (reason === "firebase_auth_failed") return "Live connection authentication failed";
+  if (reason === "firebase_connection_failed") return "Live connection interrupted";
+  if (reason === "invalid_event") return "Live update could not be read";
+  if (reason === "event_overflow") return "Live updates paused";
+  return "Live updates unavailable";
+}
+
+const object = (value: unknown): RecordValue =>
+  value !== null && typeof value === "object" && !Array.isArray(value) ? value as RecordValue : {};
+
+/** Return the only existing two-party business room; never create one or guess among matches. */
+export function selectExistingBusinessRoom(rooms: unknown[]): { id: string; participantId: string } | undefined {
+  const candidates = rooms.filter((value) => {
+    const room = object(value);
+    return typeof room.id === "string" && !!room.id &&
+      typeof room.participantId === "string" && !!room.participantId &&
+      room.participantCount === 2 && room.clientReferenceType === "contactId" &&
+      Object.keys(object(room.businessContext)).length > 0;
+  });
+  if (candidates.length !== 1) return undefined;
+  const room = object(candidates[0]);
+  return { id: room.id as string, participantId: room.participantId as string };
+}
+
+/** The member's current AI quick replies: the newest assistant answer with real `visitorOptions` that no
+ *  selection has answered yet (typed free text does not consume them, matching the website widget).
+ *  Wix's AI `inboxId` is a different id namespace from the chat-web row id, so these are composer-level,
+ *  not joined to a row. They must belong to the same AI conversation as the newest message in the list;
+ *  `answerTo` is always the exact AI answer id. */
+export function businessVisitorOptionsFromAiMessages(aiMessages: unknown[]): BusinessVisitorOptions | null {
+  const dated = aiMessages.map(object).map((message, index) => ({ message, index, at: Date.parse(String(message.createdDate)) }))
+    .filter(({ at }) => Number.isFinite(at))
+    .sort((left, right) => left.at - right.at || left.index - right.index)
+    .map(({ message }) => message);
+  const conversationId = dated.at(-1)?.conversationId;
+  if (typeof conversationId !== "string" || !conversationId) return null;
+  const answered = new Set(dated.filter((message) => message.messageType === "VISITOR_OPTION_SELECTED" && typeof message.answerTo === "string")
+    .map((message) => message.answerTo as string));
+  for (const message of dated.slice().reverse()) {
+    const id = typeof message.id === "string" ? message.id.trim() : "";
+    const labels = Array.isArray(message.visitorOptions)
+      ? message.visitorOptions.filter((value): value is string => typeof value === "string" && !!value.trim()).map((value) => value.trim())
+      : [];
+    if (message.sender !== "ASSISTANT" || message.messageType !== "ANSWER" || !id || !labels.length) continue;
+    return message.conversationId === conversationId && !answered.has(id) ? { answerTo: id, labels } : null;
+  }
+  return null;
+}
+
+/** Build the observed Wix Smart Chat visitor-option selection only from current,
+ *  identity-scoped AI metadata. The ID is request-local; the answerTo anchors it
+ *  to the exact assistant answer. */
+export function businessVisitorOptionRequest(
+  options: BusinessVisitorOptions | null | undefined,
+  label: string,
+  selectionId: string,
+): { message: { sender: "SITE_VISITOR"; messageType: "VISITOR_OPTION_SELECTED"; answerTo: string; body: { mainText: string; additionalData: { id: string; type: "select_option"; action: string }[] } } } | undefined {
+  if (!options || !options.answerTo || !options.labels.includes(label) || !/^[0-9a-f-]{36}$/i.test(selectionId)) return undefined;
+  return {
+    message: {
+      sender: "SITE_VISITOR",
+      messageType: "VISITOR_OPTION_SELECTED",
+      answerTo: options.answerTo,
+      body: { mainText: label, additionalData: [{ id: selectionId, type: "select_option", action: label }] },
+    },
+  };
+}
+
+export function newBusinessSelectionId(random: () => number = Math.random): string {
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (value) => {
+    const n = Math.floor(random() * 16);
+    return (value === "x" ? n : (n & 0x3) | 0x8).toString(16);
+  });
+}
+
+export function businessVisitorOptionSuggestions(options: BusinessVisitorOptions | null | undefined): BusinessSuggestion[] {
+  if (!options?.answerTo) return [];
+  return options.labels.map((label, index) => ({
+    id: `${options.answerTo}:visitor-option-${index}`,
+    messageId: options.answerTo,
+    label,
+    kind: "visitor_option",
+    enabled: true,
+    disabled: false,
+  }));
+}
+
+/** Wix Chat realtime currently sends `{type, timestamp, summary, message?}` events. */
+export function isBusinessMessageEvent(envelope: unknown, roomId: string): boolean {
+  const event = object(object(envelope).event);
+  if (!roomId || typeof event.type !== "string" || !/^(message|messagesent)$/i.test(event.type)) return false;
+  const message = object(event.message);
+  const data = object(event.data);
+  const nested = object(data.message);
+  const eventRoomId = [event.chatroomId, event.chatRoomId, message.chatroomId, message.chatRoomId, data.chatroomId, nested.chatroomId]
+    .find((value): value is string => typeof value === "string" && value.length > 0);
+  return !eventRoomId || eventRoomId === roomId;
+}
+
+export function shouldRefreshBusinessHistory(
+  envelope: unknown,
+  roomId: string,
+  session: { member: boolean; principal: string; currentPrincipal: string; scope: string; currentScope: string },
+): boolean {
+  return !!session.member && !!roomId && !!session.principal && session.principal === session.currentPrincipal &&
+    session.scope === session.currentScope && isBusinessMessageEvent(envelope, roomId);
+}
+
+function safeAvatar(value: unknown): string {
+  if (typeof value !== "string" || /[\s\\\u0000-\u001f\u007f-\u009f]/u.test(value)) return "";
+  const match = /^https:\/\/([^/?#]+)(?:[/?#].*)?$/iu.exec(value);
+  // No credentials, and no percent escapes in the host: a host is plain letters, digits, dots and hyphens.
+  return match && !/[@%]/.test(match[1]!) ? value : "";
+}
+
+function initials(value: string): string {
+  const words = value.trim().split(/\s+/).filter(Boolean);
+  return words.length > 1 ? `${words[0]![0]}${words[words.length - 1]![0]}`.toUpperCase() : (words[0]?.slice(0, 2) ?? "").toUpperCase();
+}
+
+function decodeHtml(value: string): string {
+  return value.replace(/&(#x[0-9a-f]+|#[0-9]+|amp|lt|gt|quot|apos|nbsp);/gi, (whole, entity: string) => {
+    const names: Record<string, string> = { amp: "&", lt: "<", gt: ">", quot: "\"", apos: "'", nbsp: " " };
+    if (entity[0] !== "#") return names[entity.toLowerCase()] ?? whole;
+    const code = entity[1]?.toLowerCase() === "x" ? parseInt(entity.slice(2), 16) : Number(entity.slice(1));
+    return code > 0 && code <= 0x10ffff && !(code >= 0xd800 && code <= 0xdfff) ? String.fromCodePoint(code) : whole;
+  });
+}
+
+/** Convert Wix's text/html parts into safe inline text marks; HTML is never rendered. */
+function htmlRuns(html: string): BusinessTextRun[] {
+  const source = html.replace(/<!--[\s\S]*?-->/g, "").replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, "");
+  const runs: BusinessTextRun[] = [];
+  const marks = new Set<string>();
+  const append = (text: string) => {
+    if (!text) return;
+    const active = [...marks].sort();
+    const last = runs[runs.length - 1];
+    if (last && JSON.stringify(last.marks ?? []) === JSON.stringify(active)) last.text += text;
+    else runs.push(active.length ? { text, marks: active } : { text });
+  };
+  const tokens = source.match(/<[^>]*>|[^<]+/g) ?? [];
+  for (const token of tokens) {
+    if (!token.startsWith("<")) { append(decodeHtml(token)); continue; }
+    const tag = /^<\s*(\/?)\s*([a-z0-9]+)/i.exec(token);
+    if (!tag) continue;
+    const closing = tag[1] === "/";
+    const name = tag[2]!.toLowerCase();
+    if (name === "br" || name === "p" || name === "div" || name === "li" || /^h[1-6]$/.test(name)) {
+      if (closing || name === "br" || name === "li") append("\n");
+    }
+    const mark = name === "b" || name === "strong" ? "bold" : name === "i" || name === "em" ? "italic" : name === "u" ? "underline" : name === "code" ? "code" : name === "a" ? "link" : "";
+    if (!mark) continue;
+    if (closing) marks.delete(mark); else marks.add(mark);
+  }
+  return runs.map((run) => ({ ...run, text: run.text.replace(/\n{3,}/g, "\n\n") })).filter((run) => run.text.length > 0);
+}
+
+function htmlMessageRuns(message: RecordValue): BusinessTextRun[] | undefined {
+  const parts = Array.isArray(message.data) ? message.data : [];
+  const htmlPart = parts.map(object).find((part) => typeof part.mimeType === "string" && part.mimeType.toLowerCase().split(";")[0] === "text/html");
+  if (!htmlPart) return undefined;
+  const data = typeof htmlPart.data === "string" ? htmlPart.data : object(htmlPart.data).html ?? object(htmlPart.data).text;
+  return typeof data === "string" ? htmlRuns(data) : undefined;
+}
+
+/** Recognize the inline Markdown Wix AI emits in text/plain messages; all other markers stay escaped. */
+function markdownRuns(value: string): BusinessTextRun[] {
+  const runs: BusinessTextRun[] = [];
+  const pattern = /(\*\*[^*\n]+?\*\*|__[^_\n]+?__|`[^`\n]+`|\*[^*\n]+?\*|_[^_\n]+?_)/g;
+  let cursor = 0;
+  for (const match of value.matchAll(pattern)) {
+    const index = match.index ?? 0;
+    const token = match[0];
+    // Underscore emphasis needs a word boundary, so `my_file_name` keeps its underscores (as on Android).
+    if (token.startsWith("_") && (/\w/.test(value[index - 1] ?? "") || /\w/.test(value[index + token.length] ?? ""))) continue;
+    if (index > cursor) runs.push({ text: value.slice(cursor, index) });
+    const double = token.startsWith("**") || token.startsWith("__");
+    const code = token.startsWith("`");
+    const mark = code ? "code" : double ? "bold" : token.startsWith("_") ? "italic" : token.startsWith("*") ? "italic" : "";
+    const delimiter = code ? 1 : double ? 2 : 1;
+    runs.push({ text: token.slice(delimiter, -delimiter), ...(mark ? { marks: [mark] } : {}) });
+    cursor = index + token.length;
+  }
+  if (cursor < value.length) runs.push({ text: value.slice(cursor) });
+  return runs;
+}
+
+function messageButtons(message: RecordValue, messageId: string): BusinessSuggestion[] {
+  const template = object(message.templateData);
+  const candidates: unknown[] = Array.isArray(template.buttons) ? template.buttons : [];
+  const content = object(message.content);
+  const cards = Array.isArray(object(content.template).buttons) ? object(content.template).buttons as unknown[] : [];
+  candidates.push(...cards);
+  for (const raw of Array.isArray(message.data) ? message.data : []) {
+    const data = object(object(raw).data);
+    for (const card of Array.isArray(data.cards) ? data.cards : []) candidates.push(...(Array.isArray(object(card).buttons) ? object(card).buttons as unknown[] : []));
+  }
+  return candidates.flatMap((value, index) => {
+    const button = object(value);
+    const label = [button.label, button.title, button.text].find((value): value is string => typeof value === "string" && !!value.trim())?.trim() ?? "";
+    const payload = object(button.payload);
+    const appId = typeof payload.appId === "string" ? payload.appId.trim() : "";
+    const interactionId = typeof payload.interactionId === "string" ? payload.interactionId.trim() : "";
+    if (button.cta && !appId && !interactionId) return [];
+    const enabled = !!label && !!appId && !!interactionId;
+    return label ? [{ id: `${messageId}:suggestion-${index}`, messageId, label, kind: "postback", ...(appId ? { appId } : {}), ...(interactionId ? { interactionId } : {}), enabled, disabled: !enabled }] : [];
+  });
+}
+
+/** Article links and chat postbacks are different Wix button actions. Only expose
+ *  payload-free HTTPS CTAs here; postbacks remain in messageButtons. */
+function articleActions(message: RecordValue, messageId: string): BusinessArticleAction[] {
+  const buttons = object(message.templateData).buttons;
+  if (!Array.isArray(buttons)) return [];
+  return buttons.flatMap((value, index) => {
+    const button = object(value);
+    const label = typeof button.text === "string" ? button.text.trim() : "";
+    const rawUrl = typeof button.cta === "string" ? button.cta.trim() : "";
+    if (!label || !rawUrl || button.payload != null) return [];
+    // No `URL` global in a worker: accept only a plain https URL whose authority carries no credentials.
+    if (!/^https:\/\/[^\s\\@/?#]+(?:[/?#]\S*)?$/.test(rawUrl)) return [];
+    return [{ id: `${messageId}:article-${index}`, label, url: rawUrl }];
+  });
+}
+
+/** Text renders a limited inline Markdown subset, and Android and web ignore backslash escapes (they would
+ *  print the backslash), so nothing is escaped that way. Link syntax is broken once, on the joined text so
+ *  a `](` split across two runs is caught too, with an invisible character: message text can never become
+ *  a tappable link. A lone marker stays literal on every renderer. */
+function markdownFromRuns(runs: BusinessTextRun[]): string {
+  return runs.map((run) => {
+    let text = run.text;
+    const marks = run.marks ?? [];
+    if (marks.includes("code")) return `\`${text.replace(/`/g, "'")}\``;
+    if (marks.includes("bold")) text = `**${text}**`;
+    if (marks.includes("italic")) text = `*${text}*`;
+    return text;
+  }).join("").replace(/\]\(/g, "]\u200b(");
+}
+
+function hiddenInternalNotice(message: RecordValue): boolean {
+  const template = object(message.templateData);
+  const origin = typeof message.originMethod === "string" ? message.originMethod : "";
+  const summary = typeof message.summary === "string" ? message.summary.trim() : "";
+  const text = typeof template.text === "string" ? template.text.trim() : "";
+  const pauseNotice = "AI RESPONSES ARE PAUSED WHILE YOU TALK TO THIS VISITOR";
+  const isPauseNotice = summary.toUpperCase() === pauseNotice || text.toUpperCase() === pauseNotice;
+  const hasActionsOrMedia = !!template.image || !!template.icon || !!template.link ||
+    [template.buttons, template.fields, template.lines].some((value) => Array.isArray(value) && value.length > 0);
+  const content = object(message.content);
+  return message.messageType === "template/minimal" && !!message.appId && /:AI_SITE_CHAT$/i.test(origin) &&
+    isPauseNotice && (!Array.isArray(message.data) || message.data.length === 0) &&
+    Object.keys(content).length === 0 && !hasActionsOrMedia;
+}
+
+/** Adds only Business business-chat presentation fields to the canonical message rows. */
+export function presentBusinessMessages<T extends Pick<BusinessMessage, "id" | "sender" | "mine" | "createdDate" | "plainText" | "parts">>(
+  rows: T[],
+  raw: unknown[],
+  participantId = "",
+  now = new Date(),
+): (T & {
+  senderAvatar: string;
+  senderName: string;
+  senderInitials: string;
+  senderBadge: string;
+  imageUrl: string;
+  imageDescription: string;
+  noImage: boolean;
+  bodyText: string;
+  bodyRuns: BusinessTextRun[];
+  isAiGenerated: boolean;
+  suggestions: BusinessSuggestion[];
+  articleActions: BusinessArticleAction[];
+  bodyMarkdown: string;
+  dayLabel: string;
+  dayHidden: boolean;
+  startsDay: boolean;
+  scrollAnchor: string;
+  notMine: boolean;
+})[] {
+  const metadata = new Map<string, RecordValue>();
+  for (const value of raw) {
+    const message = object(value);
+    const id = typeof message.id === "string" ? message.id : typeof message._id === "string" ? message._id : "";
+    if (id) metadata.set(id, message);
+  }
+  const dateKey = (date: Date) => `${date.getFullYear()}-${date.getMonth()}-${date.getDate()}`;
+  const today = dateKey(now);
+  const yesterday = new Date(now.getFullYear(), now.getMonth(), now.getDate() - 1);
+  const yesterdayKey = dateKey(yesterday);
+  let previousDay = "";
+
+  return rows.filter((row) => !hiddenInternalNotice(metadata.get(row.id) ?? {})).map((row) => {
+    const message = metadata.get(row.id) ?? {};
+    const display = object(message.senderDisplayData);
+    const image = object(display.image);
+    const sender = object(message.sender);
+    const imagePart = row.parts.find((part) => part.kind === "image");
+    const timestamp = new Date(row.createdDate);
+    const key = Number.isFinite(timestamp.getTime()) ? dateKey(timestamp) : "";
+    const startsDay = !!key && key !== previousDay;
+    const dayLabel = startsDay
+      ? key === today ? "Today" : key === yesterdayKey ? "Yesterday" : formatMonthDay(timestamp)
+      : "";
+    if (key) previousDay = key;
+
+    const imageUrl = imagePart?.url || "";
+    const template = object(message.templateData);
+    const standardEventText = message.messageType === "template/standard-event"
+      ? [template.title, ...(Array.isArray(template.lines) ? template.lines : [])]
+        .filter((value): value is string => typeof value === "string" && !!value.trim())
+        .join("\n")
+      : "";
+    const bodyText = imageUrl
+      ? row.parts.filter((part) => part.kind === "text").map((part) => [part.text, ...(part.fields ?? []).map((field) => `${field.name}: ${field.value}`)].filter(Boolean).join("\n")).filter(Boolean).join("\n")
+      : standardEventText || row.plainText;
+    const senderAvatar = safeAvatar(image.url);
+    const mine = participantId && typeof sender.userId === "string" ? sender.userId === participantId : row.mine;
+    const isAiGenerated = !!participantId && !mine && !!message.appId && typeof message.originMethod === "string" && /:AI_SITE_CHAT$/i.test(message.originMethod) &&
+      (message.messageType === "message" || message.messageType === "template/standard-event" || message.messageType === "template/card");
+    const rawSenderName = typeof display.name === "string" && display.name.trim()
+      ? display.name.trim()
+      : typeof display.displayName === "string" && display.displayName.trim() ? display.displayName.trim() : "";
+    const senderName = !mine && /^visitor(?:\s*#?\d+)?$/i.test(rawSenderName) ? "" : rawSenderName;
+    const plainTextRuns = standardEventText
+      ? markdownRuns(standardEventText)
+      : row.parts.filter((part) => part.kind === "text" && typeof part.text === "string").flatMap((part, at) => [...(at > 0 ? [{ text: "\n" }] : []), ...markdownRuns(part.text as string)]);
+    const bodyRuns = htmlMessageRuns(message) ?? plainTextRuns;
+    const bodyMarkdown = markdownFromRuns(bodyRuns);
+    const buttons = messageButtons(message, row.id);
+    const articles = articleActions(message, row.id);
+
+    return {
+      ...row,
+      mine,
+      side: mine ? "mine" : "other",
+      senderAvatar,
+      senderName,
+      senderInitials: typeof display.initials === "string" && display.initials.trim() ? display.initials.trim() : initials(senderName),
+      senderBadge: participantId && !mine ? isAiGenerated ? "AI assistant" : "Staff Response" : "",
+      imageUrl,
+      imageDescription: imagePart?.caption || "Image attachment",
+      noImage: !imageUrl,
+      bodyText,
+      bodyRuns,
+      bodyMarkdown,
+      isAiGenerated,
+      suggestions: buttons,
+      articleActions: articles,
+      dayLabel,
+      dayHidden: !dayLabel,
+      startsDay,
+      scrollAnchor: `himi_business_chat.message_${row.id}`,
+      notMine: !mine,
+    };
+  });
+}
+
+/** Resolve a suggestion only from the currently normalized rows and only when the server supplied both postback fields. */
+export function findBusinessSuggestion<T extends { suggestions?: BusinessSuggestion[] }>(rows: T[], suggestionId: string): BusinessSuggestion | undefined {
+  if (!suggestionId) return undefined;
+  return rows.flatMap((row) => row.suggestions ?? []).find((suggestion) => suggestion.id === suggestionId && suggestion.enabled &&
+    (suggestion.kind === "visitor_option" || (!!suggestion.appId && !!suggestion.interactionId)));
+}
+
+/** Execute a row's verified semantic button only inside its still-current member room/session. */
+export async function dispatchBusinessSuggestion<T extends { suggestions?: BusinessSuggestion[] }>(
+  rows: T[],
+  suggestionId: string,
+  session: { member: boolean; roomId: string; principal: string; currentPrincipal: string; scope: string; currentScope: string },
+  submit: (suggestion: BusinessSuggestion) => Promise<unknown>,
+): Promise<boolean> {
+  if (!session.member || !session.roomId || !session.principal || session.principal !== session.currentPrincipal || session.scope !== session.currentScope) return false;
+  const suggestion = findBusinessSuggestion(rows, suggestionId);
+  if (!suggestion) return false;
+  // A submit that reports `false` (a stale quick reply nobody posted) is not a send.
+  return (await submit(suggestion)) !== false;
+}