@xuda.io/ai_module 1.1.5613 → 1.1.5614

package/index.mjs

@@ -9178,6 +9178,78 @@ export const is_spam_email = async function (uid, email, subject, account_profil
   } catch (error) {}
 };
 
+// AI screening for a marketplace publish. Receives plain-JSON context from
+// marketplace_module (zod schemas cannot cross the broker, so the prompt +
+// structured schema must live here). Returns a structured verdict across the
+// approval rule dimensions. The caller (marketplace_approval_review) merges
+// this with deterministic account-standing checks and decides the final stat.
+export const marketplace_review_item = async function (req) {
+  const { uid, item_type, item = {}, account_context = {}, account_name = '', model = _conf.default_ai_model, account_profile_info } = req || {};
+
+  const check_schema = z.object({
+    flag: z.boolean().describe('true if this concern is present'),
+    severity: z.enum(['none', 'low', 'medium', 'high']).describe('how serious the concern is'),
+    note: z.string().describe('one short sentence of evidence; empty string if no concern'),
+  });
+
+  const response_format = z.object({
+    decision: z.enum(['approve', 'reject', 'manual_review']).describe('approve = safe to publish; reject = clear violation; manual_review = uncertain, needs a human'),
+    confidence: z.number().min(0).max(100).describe('confidence in the decision, 0-100'),
+    checks: z.object({
+      ai_bot_activity: check_schema.describe('automated/bot publishing: high velocity, near-duplicate items, low-effort generated bulk'),
+      commercial_undisclosed: check_schema.describe('undisclosed commercial intent: external paid links, lead-gen, off-platform payment, advertising inconsistent with declared price/category'),
+      harmful_code: check_schema.describe('destructive ops, data exfiltration, crypto-miners, obfuscation, malicious network calls in the submitted code'),
+      suspicious_activity: check_schema.describe('mismatched metadata, hidden payloads, evasion patterns'),
+      malformed_account_name: check_schema.describe('gibberish, homoglyphs, embedded URLs, or impersonation in the account name'),
+      spam_low_quality: check_schema.describe('spam, filler, or low-quality content with no real utility'),
+      impersonation_trademark: check_schema.describe('impersonates a brand/person or abuses a trademark'),
+      prohibited_content: check_schema.describe('adult, illegal, hateful, or otherwise disallowed content'),
+      plagiarism_duplicate: check_schema.describe('appears copied from or duplicates an existing item'),
+      secrets_pii_leak: check_schema.describe('hardcoded API keys, tokens, credentials, or exposed PII in the code'),
+    }),
+    reasons: z.array(z.string()).describe('short user-facing lines explaining the decision (empty if approved cleanly)'),
+  });
+
+  const prompt = `You are the xuda marketplace moderation reviewer. Decide whether the following ${item_type} should be published to the public marketplace.
+
+Account name: ${account_name}
+Account context (signals): ${JSON.stringify(account_context)}
+
+Item:
+- name: ${item.name || ''}
+- description: ${item.description || ''}
+- category: ${item.category || ''}
+- tags: ${JSON.stringify(item.tags || [])}
+- price: ${item.price ?? 0}
+- code/content summary: ${item.code_summary || '(none provided)'}
+
+Evaluate every check honestly. Set decision to:
+- "approve" when no medium/high concerns and the item is genuine and useful.
+- "reject" when there is a clear high-severity violation (harmful code, leaked secrets, prohibited content, obvious impersonation/spam, or clear bot abuse).
+- "manual_review" when concerns are present but ambiguous, or you are not confident.
+Keep "reasons" concise, factual, and user-facing (no internal jargon).`;
+
+  const ret = await submit_chat_gpt_prompt({
+    uid,
+    prompt,
+    model,
+    response_format,
+    metadata: { func: 'marketplace_review_item', item_type },
+    account_profile_info,
+  });
+
+  if (ret.code < 0) {
+    return { code: ret.code, data: ret.data };
+  }
+
+  try {
+    const verdict = JSON.parse(ret.data);
+    return { code: 1, data: { ...verdict, model } };
+  } catch (err) {
+    return { code: -1, data: `marketplace_review_item parse error: ${err.message}` };
+  }
+};
+
 export const is_business_contact = async function (uid, email, name, subject, body, account_profile_info) {
   let prompt = `detect if the email "${email}", subject "${subject}", name "${name}", or body "${body}" is business  or personal. Return true if it is a business , false otherwise.
   
@@ -14256,7 +14328,7 @@ export const get_widget_embed_snippet = async function (req, job_id, headers) {
 };
 
 const _widget_signup_core = async function (req, job_id, headers, opts) {
-  const { profile_id, email, name, widget_origin, google_sub, signup_method } = req;
+  const { profile_id, email, name, widget_origin, google_sub, signup_method, visitor_lang } = req;
   const [owner_uid_part, pid_part] = String(profile_id || '').split('.');
   if (!owner_uid_part || !pid_part) return { code: -404, data: 'invalid_profile' };
 
@@ -14268,19 +14340,19 @@ const _widget_signup_core = async function (req, job_id, headers, opts) {
   if (ap_doc.widget_enabled === false) return { code: -404, data: 'widget_disabled' };
 
   const visitor_uid = await _widget_find_or_create_visitor(email, name, google_sub);
-  return await _widget_signup_finalize(visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers);
+  return await _widget_signup_finalize(visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers, visitor_lang);
 };
 
 export const widget_signup = async function (req, job_id, headers) {
   try {
-    let { profile_id, email, name, widget_origin } = req;
+    let { profile_id, email, name, widget_origin, visitor_lang } = req;
     if (typeof email !== 'string' || typeof name !== 'string') return { code: -1, data: 'invalid_input' };
     email = email.toLowerCase().trim();
     name = name.trim();
     if (!email || !name) return { code: -1, data: 'invalid_input' };
     if (!WIDGET_EMAIL_RE.test(email)) return { code: -1, data: 'invalid_email' };
 
-    return await _widget_signup_core({ profile_id, email, name, widget_origin, signup_method: 'email' }, job_id, headers);
+    return await _widget_signup_core({ profile_id, email, name, widget_origin, visitor_lang, signup_method: 'email' }, job_id, headers);
   } catch (err) {
     return { code: -1, data: err.message || String(err) };
   }
@@ -14288,7 +14360,7 @@ export const widget_signup = async function (req, job_id, headers) {
 
 export const widget_signup_google = async function (req, job_id, headers) {
   try {
-    const { profile_id, id_token, widget_origin } = req;
+    const { profile_id, id_token, widget_origin, visitor_lang } = req;
     if (!id_token || typeof id_token !== 'string') return { code: -1, data: 'missing_id_token' };
 
     let payload;
@@ -14304,13 +14376,13 @@ export const widget_signup_google = async function (req, job_id, headers) {
     const name = String(payload.name || payload.email?.split('@')[0] || 'Friend').trim();
     if (!email) return { code: -1, data: 'no_email_in_token' };
 
-    return await _widget_signup_core({ profile_id, email, name, widget_origin, google_sub: payload.sub, signup_method: 'google' }, job_id, headers);
+    return await _widget_signup_core({ profile_id, email, name, widget_origin, visitor_lang, google_sub: payload.sub, signup_method: 'google' }, job_id, headers);
   } catch (err) {
     return { code: -1, data: err.message || String(err) };
   }
 };
 
-const _widget_signup_finalize = async function (visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers) {
+const _widget_signup_finalize = async function (visitor_uid, email, name, widget_origin, signup_method, account_profile_info, canonical_owner_uid, canonical_profile_id, ap_doc, job_id, headers, visitor_lang) {
   try {
     let team_req_doc = await _widget_find_existing_team_req(visitor_uid, canonical_profile_id);
     let assigned_uid;
@@ -14374,12 +14446,20 @@ const _widget_signup_finalize = async function (visitor_uid, email, name, widget
 
     const widget_token = `wds_${crypto.randomUUID().replace(/-/g, '')}`;
     const now = Date.now();
+    // Normalize visitor_lang to a short tag (e.g. "ja-JP" → "ja"). The
+    // auto-reply agent reads this from the session to respond in the
+    // visitor's language. Empty / missing → English fallback at reply time.
+    const visitor_lang_base = String(visitor_lang || '')
+      .toLowerCase()
+      .split('-')[0]
+      .slice(0, 8);
     const session_doc = {
       _id: widget_token,
       docType: 'widget_session',
       stat: 2,
       state,
       visitor_uid,
+      visitor_lang: visitor_lang_base || '',
       team_req_id: team_req_doc._id,
       assigned_uid,
       owner_uid: canonical_owner_uid,
@@ -14398,6 +14478,12 @@ const _widget_signup_finalize = async function (visitor_uid, email, name, widget
     const assigned_avatar = assigned_info_ret?.data?.profile_picture || assigned_info_ret?.data?.profile_avatar || '';
     const greeting = ap_doc?.widget_config?.greeting || WIDGET_DEFAULT_GREETING;
 
+    // Surface the visitor's first name so the chat widget can personalize the
+    // greeting on the page ("Hi {visitor_first_name}, I'm Valentina..."). The
+    // widget reads this from the persisted session and replaces the
+    // {visitor_name} placeholder client-side.
+    const visitor_first_name = _widget_split_name(name).first_name || '';
+
     return {
       code: 1,
       data: {
@@ -14407,6 +14493,7 @@ const _widget_signup_finalize = async function (visitor_uid, email, name, widget
         assigned_avatar,
         greeting,
         conversation_id,
+        visitor_first_name,
         signup_method: signup_method || 'email',
         account_active: signup_method === 'google',
         signin_url: signup_method === 'google' ? `https://${_conf.domain || 'xuda.ai'}/dashboard/login` : undefined,

package/index_ms.mjs

@@ -260,3 +260,7 @@ export const widget_send_message = async function (...args) {
 export const widget_get_messages = async function (...args) {
   return await broker.send_to_queue("widget_get_messages", ...args);
 };
+
+export const marketplace_review_item = async function (...args) {
+  return await broker.send_to_queue("marketplace_review_item", ...args);
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/ai_module",
-  "version": "1.1.5613",
+  "version": "1.1.5614",
   "description": "Xuda AI Module",
   "main": "index.mjs",
   "type": "module",