@xuda.io/ai_module 1.1.5634 → 1.1.5636

package/index.mjs

@@ -161,13 +161,59 @@ const get_openai_codex_cli_command = function () {
   return _conf.openai_codex_command || 'codex';
 };
 
+// Cheapest text model in the catalog (lowest input price). Used as the DEFAULT codex
+// model when the user hasn't picked one. Returns a catalog CODE (e.g. 'gpt-1').
+const get_cheapest_ai_model_code = function () {
+  const models = _conf?.ai_models || {};
+  let best = null;
+  for (const [code, e] of Object.entries(models)) {
+    if (!e || e.type !== 'text') continue;
+    const p = Number(e.input);
+    if (!Number.isFinite(p)) continue;
+    if (!best || p < best.p) best = { code, p };
+  }
+  return best?.code || _conf.default_ai_model || null;
+};
+
 const get_openai_codex_model = function () {
-  return _conf.openai_codex_model || _conf.ai_models?.openai_codex_model?.model || null;
+  // Codex is user-selectable per request (req.codex_model); when nothing is picked
+  // the default is the CHEAPEST catalog model. Returns a catalog code (resolved to a
+  // real OpenAI id at exec time by get_openai_codex_exec_args).
+  return _conf.openai_codex_model || get_cheapest_ai_model_code();
+};
+
+// Map a legacy ai_models key still stored on old profiles/agents (e.g. 'gpt-5.4') to
+// its current catalog code (e.g. 'gpt-4') via _conf.ai_model_aliases. Current codes
+// and unknown ids pass through. This makes the gpt-1..gpt-5 recode backward
+// compatible with no data migration.
+const canonical_ai_code = function (m) {
+  return _conf?.ai_model_aliases?.[m] || m;
+};
+
+// Resolve a catalog code (the stable key that profiles/agents store, e.g.
+// active_ai_model / agentConfig.agent_ai_model) to the real OpenAI model id to send
+// to the API. Applies the legacy-key alias first, so old stored values keep working
+// after a recode. Falls back to the input for literal ids that aren't catalog keys
+// (e.g. 'gpt-image-1'). Apply ONLY at the OpenAI/Agent/Codex-CLI call boundary:
+// billing (record_ai_usage) and the model-picker validation must keep the code.
+const resolve_ai_model = function (m) {
+  const code = canonical_ai_code(m);
+  return _conf?.ai_models?.[code]?.model || _conf?.ai_models?.[m]?.model || m;
+};
+
+// A catalog code a user may pick for Codex generation: an OpenAI text model
+// flagged codex:true in ai_models. Guards generate_site_draft's model param so a
+// non-codex pick (image/voice/unknown) falls back to the default rather than
+// failing the codex exec. Codex is OpenAI-only, so only these codes are valid.
+const _is_codex_model = function (code) {
+  if (!code) return false;
+  const e = _conf?.ai_models?.[canonical_ai_code(code)];
+  return !!(e && e.codex === true);
 };
 
 const get_openai_codex_usage_model = function (codex_model, requested_codex_model) {
-  if (requested_codex_model) return codex_model;
-  return _conf.ai_models?.openai_codex_model ? 'openai_codex_model' : codex_model || _conf.openai_codex_command || 'openai_codex_cli';
+  // Bill by the catalog code actually used (requested selection or cheapest default).
+  return codex_model || _conf.openai_codex_command || 'openai_codex_cli';
 };
 
 const get_openai_codex_exec_args = function (codex_model, opts = {}) {
@@ -180,7 +226,9 @@ const get_openai_codex_exec_args = function (codex_model, opts = {}) {
   const bypass_approvals_and_sandbox = opts.sandbox ? false : typeof _conf.openai_codex_bypass_approvals_and_sandbox === 'undefined' ? true : _conf.openai_codex_bypass_approvals_and_sandbox;
 
   if (codex_model) {
-    args.push('--model', codex_model);
+    // codex_model is a catalog code (user pick or cheapest default); the Codex CLI
+    // needs the real OpenAI id.
+    args.push('--model', resolve_ai_model(codex_model));
   }
 
   if (bypass_approvals_and_sandbox) {
@@ -1704,7 +1752,10 @@ export const generate_site_draft = async (req, job_id) => {
 When done, briefly summarize what you built.`;
 
       const built_prompt = `[System]\n${gen_system}\n\n[User request]\n${prompt}`;
-      const codex_ret = await execute_codex_request({ uid, ip: undefined, local_cwd: dir, prompt: built_prompt, stream: false, sandbox: 'workspace-write', codex_timeout: 240000 });
+      // Model pick from the generate screen (UI-13 #4): forward only a codex-eligible
+      // catalog code; anything else (or none) uses the default model.
+      const picked_model = _is_codex_model(data.model || data.codex_model) ? (data.model || data.codex_model) : null;
+      const codex_ret = await execute_codex_request({ uid, ip: undefined, local_cwd: dir, prompt: built_prompt, stream: false, sandbox: 'workspace-write', codex_timeout: 240000, codex_model: picked_model });
       if (!codex_ret || codex_ret.code < 0) {
         // On a non-zero codex exit, codex_ret.data is an object whose real reason
         // lives in `stderr` (not `message`); only the early guards return a plain
@@ -2291,7 +2342,7 @@ const create_image = async function (uid, prompt, model = 'gpt-image-1-mini', si
     let response;
     try {
       response = await client.images.generate({
-        model,
+        model: resolve_ai_model(model),
         prompt,
         size,
         n,
@@ -4312,7 +4363,7 @@ export const submit_chat_gpt_prompt = async function (req) {
     let response;
     try {
       let opt = {
-        model,
+        model: resolve_ai_model(model),
         input: prompt,
         tools,
         text: {
@@ -4893,6 +4944,11 @@ export const submit_chat_conversation = async function (req, job_id, headers) {
             break;
           }
 
+          case 'ticket': {
+            ret = await contact_ticket_conversation(req, job_id, headers);
+            break;
+          }
+
           default:
             ret = { code: -44, data: 'invalid conversation_type ' + conversation_doc.conversation_type };
             break;
@@ -5152,7 +5208,24 @@ const chat_email = async function (req, job_id, headers) {
         email_attachments.push(await save_drive_file_to_disk(attachment));
       }
 
-      sent_email_result = await email_ms.sendEmailFromAccount(email_account_doc, contact_info.email, subject, body, null, email_attachments);
+      // Wrap the body with the profile's selected email template (Email
+      // Template tab). 'plain' or an unset style renders null, keeping the
+      // original raw-text behavior.
+      let template_html = null;
+      try {
+        const profile_doc = account_profile_info.account_profile_obj || {};
+        const render_ret = await email_ms.render_profile_email({
+          style: profile_doc.email_template?.style,
+          body_text: body,
+          profile_name: profile_doc.profile_name,
+          signature: profile_doc.profile_signature,
+          avatar_url: profile_doc.profile_picture || profile_doc.profile_avatar || '',
+          brand_color: profile_doc.widget_config?.color || '',
+        });
+        if (render_ret?.code > 0 && render_ret.data) template_html = render_ret.data;
+      } catch (err) {}
+
+      sent_email_result = await email_ms.sendEmailFromAccount(email_account_doc, contact_info.email, subject, body, template_html, email_attachments);
       if (!sent_email_result.success) {
         throw new Error('error sending email');
       }
@@ -5703,6 +5776,22 @@ const resolve_plugin_action = function (req, dashboard_context, prompt) {
 // answers are specific to THIS project instead of generic. Terse on purpose to stay
 // within the token budget; the snapshot is trusted for grounding only — the agent
 // still calls CPI tools (which re-check ownership) for any actual read/write.
+// The 'ask_ai' access consent ("let the assistant read this server's current status").
+// Gated on the customer's own machines only: app_type 'vps' (full-stack is vps +
+// is_full_stack, so it is covered) and 'external_vps'. MIRRORS
+// app_module.CONSENT_ENFORCED_APP_TYPES — no cpi module imports app_module, so the
+// predicate is duplicated here on purpose; keep the copies in step.
+//
+// Unlike files/metrics/backup this does NOT return -91. This builder never touches the
+// server — it only copies facts off the already-loaded app doc into the system prompt —
+// and the chat does far more than answer server questions, so blocking it would be
+// wrong. Enforcement here is REDACTION: no consent → the assistant simply is not told
+// the server's address/status. Anything that actually reads the box goes through the
+// CPI tools, which carry their own gates (vps_fs_* → 'files').
+const _ASK_AI_CONSENT_TYPES = ['vps', 'external_vps'];
+const _ask_ai_consent_blocked = (o) =>
+  !!o && _ASK_AI_CONSENT_TYPES.includes(o.app_type) && o?.deploy_data?.access_consents?.ask_ai?.granted !== true;
+
 const build_dashboard_state_context = function (app_obj, ctx) {
   const lines = [];
   if (app_obj) {
@@ -5712,7 +5801,7 @@ const build_dashboard_state_context = function (app_obj, ctx) {
     const plan = app_obj.app_uId_plan || app_obj.membership_plan;
     if (plan) lines.push(`- Plan: ${plan}`);
     const vps = app_obj.app_hosting_server;
-    if (vps && (vps.ip || vps.droplet?.id)) {
+    if (vps && (vps.ip || vps.droplet?.id) && !_ask_ai_consent_blocked(app_obj)) {
       lines.push(`- VPS: ${vps.ip || 'provisioned'}${vps.droplet?.status ? ` (${vps.droplet.status})` : ''}${vps.region ? `, ${vps.region}` : ''}`);
     }
     const sw = app_obj.static_website;
@@ -5746,7 +5835,7 @@ const build_dashboard_state_context = function (app_obj, ctx) {
 const pick_dashboard_model = function (prompt, dashboard_context) {
   const models = _conf.ai_models || {};
   const fallback = _conf.default_ai_model;
-  const strong = (_conf.strong_ai_model && models[_conf.strong_ai_model] && _conf.strong_ai_model) || (models['gpt-5.4-mini'] && 'gpt-5.4-mini') || fallback;
+  const strong = (_conf.strong_ai_model && models[_conf.strong_ai_model] && _conf.strong_ai_model) || (models['gpt-3'] && 'gpt-3') || fallback;
   // Intent comes from the PROMPT only — folding in dashboard_context would let a
   // tab named with an action verb (e.g. "deploy") force every question on that
   // tab to the strong tier ("is my site live?" on the deploy tab is still a read).
@@ -6389,7 +6478,7 @@ ${CLARIFYING_QUESTIONS_INSTRUCTION}
 Tab/context: "${dashboard_context || 'unknown'}" · app_id: "${target_app_id}"
 Available CPI methods: ${cpi_tools_ret.selected_methods.join(', ')}${dashboard_state_block ? '\n\n' + dashboard_state_block : ''}${action_steer ? '\n\n' + action_steer : ''}
 `.trim(),
-      model: ai_model,
+      model: resolve_ai_model(ai_model),
       tools: cpi_tools_ret.tools,
     });
 
@@ -7170,7 +7259,7 @@ const ai_chat_conversation = async function (req, job_id, headers) {
   let prompt_suggestion_activated;
   let chat_suggestion_activated;
   let model = ai_model;
-  if (!_conf.ai_models[model]) {
+  if (!_conf.ai_models[canonical_ai_code(model)]) {
     throw new Error('model not supported');
   }
 
@@ -7517,7 +7606,7 @@ const ai_chat_conversation = async function (req, job_id, headers) {
           const agent = new Agent({
             name: agent_name.substring(0, 55),
             instructions: ai_agent_doc.agentConfig.agent_instructions + (reference_type === 'ai_agents' ? get_agent_instructions() : '') + (context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : ''),
-            model,
+            model: resolve_ai_model(model),
             tools,
             metadata: {
               agent_id: ai_agent_doc._id,
@@ -7674,7 +7763,7 @@ const ai_chat_conversation = async function (req, job_id, headers) {
         instructions: get_agent_instructions(),
         // inputGuardrails: [contactGuardrail],
         // outputGuardrails: [contactGuardrail],
-        model,
+        model: resolve_ai_model(model),
         handoffs: agents, // this lets triageAgent forward to other agents
       });
     }
@@ -8002,7 +8091,7 @@ Do not mention that the reply is automated.
 ${conversation_type === 'chat' ? 'Return only the chat message text, ready to send.' : 'Return only the email body, ready to send.'}
 If a signature is available, append it at the end:
 ${account_profile_doc.profile_signature || ''}`.trim(),
-          model,
+          model: resolve_ai_model(model),
           metadata: { auto_response: true, default: true, ts: Date.now() },
         }),
       );
@@ -8047,7 +8136,7 @@ If a signature is available, append it at the end:
 ${account_profile_doc.profile_signature || ''}`
               : ''
           }${context?.has_full_stack_vps ? '\n\n' + get_full_stack_vps_instructions() : ''}`.trim(),
-          model,
+          model: resolve_ai_model(model),
           tools: tools_ret.tools,
           metadata: {
             agent_id: ai_agent_doc._id,
@@ -8075,7 +8164,7 @@ ${account_profile_doc.profile_signature || ''}`
         name: 'Auto Response Triage Agent',
         instructions: `Select the best specialist agent to draft an automatic ${conversation_type === 'chat' ? 'chat' : 'email'} response.
 Return only the final ${conversation_type === 'chat' ? 'chat message text' : 'email body text'}.`,
-        model,
+        model: resolve_ai_model(model),
         handoffs: agents,
       });
     }
@@ -8143,6 +8232,18 @@ Return only the email body.`;
         undefined,
         undefined,
       );
+    } else if (conversation_type === 'ticket') {
+      await contact_ticket_conversation(
+        {
+          profile_id,
+          uid,
+          prompt: response_text,
+          conversation_doc,
+          _auto_response: true,
+        },
+        undefined,
+        undefined,
+      );
     } else {
       await chat_email(
         {
@@ -8792,7 +8893,7 @@ export const get_profile_avatar = async function (profile_picture, uid, prompt,
       let ai_avatar_response;
       try {
         ai_avatar_response = await client.images.edit({
-          model,
+          model: resolve_ai_model(model),
           image: image_blob_ret.image_blob, //base photo
           prompt,
           background: 'transparent',
@@ -8903,7 +9004,7 @@ export const get_profile_avatar = async function (profile_picture, uid, prompt,
             let ai_avatar_response;
             try {
               ai_avatar_response = await client.images.edit({
-                model,
+                model: resolve_ai_model(model),
                 image: image_blob_ret.image_blob, //logo
                 prompt: `
                 Create a transparent PNG profile image for a business account featuring building branded as ${name}.
@@ -9528,7 +9629,7 @@ const create_ai_agent_image = async function (req, job_id, headers) {
     let ai_avatar_response;
     try {
       ai_avatar_response = await client.images.edit({
-        model,
+        model: resolve_ai_model(model),
         image: image_blob_ret.image_blob,
 
         prompt,
@@ -15913,13 +16014,13 @@ const _ai_design = async (uid, src) => {
                 `;
   let resp;
   try {
-    resp = await client.images.edit({ model, image: blob, prompt, background: 'transparent' });
+    resp = await client.images.edit({ model: resolve_ai_model(model), image: blob, prompt, background: 'transparent' });
     report_ai_status(model);
   } catch (err) {
     report_ai_status(model, err);
     if (err?.code === 'moderation_blocked') {
       const soft = 'Create a futuristic metallic humanoid robot portrait with a transparent ' + 'background. Head and shoulders only, centered, forward-facing. Fully robotic and ' + 'non-photorealistic, glowing blue and purple neon accents, advanced reflective materials.';
-      resp = await client.images.edit({ model, image: blob, prompt: soft, background: 'transparent' });
+      resp = await client.images.edit({ model: resolve_ai_model(model), image: blob, prompt: soft, background: 'transparent' });
       report_ai_status(model);
     } else {
       throw err;
@@ -16204,3 +16305,548 @@ export const widget_get_messages = async function (req, job_id, headers) {
     return { code: -1, data: err.message || String(err) };
   }
 };
+
+////////////////////////////// WIDGET SETTINGS (profile setup Chat tab) //////////////////////////////
+
+// Public origin that serves the embed loaders, iframe routes and /cpi for
+// embedded widgets/forms. On dev the config domain still says xuda.ai, so a
+// dev-generated snippet must point at the dev host or the profile lookup 404s.
+const embed_origin = function () {
+  if (_conf.is_debug && process.env.XUDA_HOSTNAME) return `https://${process.env.XUDA_HOSTNAME}`;
+  return `https://${_conf.domain || 'xuda.ai'}`;
+};
+
+const WIDGET_CONFIG_KEYS = ['title', 'color', 'greeting', 'position'];
+const WIDGET_POSITIONS = ['br', 'bl', 'tr', 'tl'];
+
+const _sanitize_widget_config = function (config) {
+  const out = {};
+  if (!config || typeof config !== 'object') return out;
+  if (typeof config.title === 'string') out.title = config.title.replace(/[<>]/g, '').slice(0, 60);
+  if (typeof config.color === 'string' && /^#[0-9a-fA-F]{3,8}$/.test(config.color.trim())) out.color = config.color.trim();
+  if (typeof config.greeting === 'string') out.greeting = config.greeting.replace(/[<>]/g, '').slice(0, 300);
+  if (typeof config.position === 'string' && WIDGET_POSITIONS.includes(config.position)) out.position = config.position;
+  return out;
+};
+
+const _build_widget_snippet = function (widget_profile_id, config = {}) {
+  const origin = embed_origin();
+  const attrs = [`s.setAttribute('data-profile','${widget_profile_id}');`];
+  if (config.position && WIDGET_POSITIONS.includes(config.position)) attrs.push(`s.setAttribute('data-position','${config.position}');`);
+  if (config.color && /^#[0-9a-fA-F]{3,8}$/.test(config.color)) attrs.push(`s.setAttribute('data-color','${config.color}');`);
+  return `<script>(function(){var d=document,s=d.createElement('script');s.src='${origin}/dist/runtime/js/chat-widget-loader.js';s.async=1;${attrs.join('')}d.head.appendChild(s);})();</script>`;
+};
+
+// Read-only view of the profile's chat widget setup for the settings tab.
+// Unlike get_widget_embed_snippet this never mutates the profile doc.
+export const get_widget_settings = async function (req) {
+  try {
+    const { uid, profile_id } = req;
+    const account_profile_info = await get_active_account_profile_info(uid, profile_id);
+    if (account_profile_info.uid !== uid) return { code: -403, data: 'not_profile_owner' };
+    const doc = account_profile_info.account_profile_obj || {};
+    const widget_profile_id = `${account_profile_info.uid}.${account_profile_info.account_profile_id}`;
+    const config = _sanitize_widget_config(doc.widget_config);
+    return {
+      code: 1,
+      data: {
+        enabled: doc.widget_enabled !== false,
+        config,
+        widget_profile_id,
+        iframe_url: `${embed_origin()}/chat-widget/${widget_profile_id}`,
+        snippet: _build_widget_snippet(widget_profile_id, config),
+      },
+    };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// Save the Chat tab: on/off plus skin (title, color, position) and greeting.
+export const update_widget_settings = async function (req) {
+  try {
+    const { uid, profile_id, enabled, config } = req;
+    const account_profile_info = await get_active_account_profile_info(uid, profile_id);
+    if (account_profile_info.uid !== uid) return { code: -403, data: 'not_profile_owner' };
+
+    const doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, account_profile_info.account_profile_id);
+    if (doc.docType !== 'account_profile') return { code: -1, data: 'not_account_profile' };
+
+    if (typeof enabled === 'boolean') doc.widget_enabled = enabled;
+    if (config && typeof config === 'object') {
+      const clean = _sanitize_widget_config(config);
+      doc.widget_config = { ...(doc.widget_config || {}), ...clean };
+      // Explicit empty string clears a key back to the default.
+      for (const key of WIDGET_CONFIG_KEYS) {
+        if (config[key] === '') delete doc.widget_config[key];
+      }
+    }
+    doc.ts = Date.now();
+    await db_module.save_app_couch_doc_native(account_profile_info.app_id, doc);
+
+    return await get_widget_settings({ uid, profile_id });
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+////////////////////////////// CONTACT FORM (embed) //////////////////////////////
+
+// The form is a sibling of the chat widget: an iframe rendered by the router at
+// /contact-form/<uid>.<pid>, a loader script customers paste on their site, and
+// a public submit method. A submission adds the sender as a CONTACT on the
+// profile owner's side (no contact_connection team_request, so NOT a friend)
+// and opens a 'ticket' chat_conversation holding the message.
+
+const CONTACT_FORM_TOKEN_TTL_MS = 2 * 60 * 60 * 1000;
+const CONTACT_FORM_MIN_AGE_MS = 3000;
+const CONTACT_FORM_FIELD_KEYS = ['phone', 'company', 'subject'];
+
+// Human-detection token: HMAC over profile id + mint time. The key derives from
+// a fleet-shared secret so the router-rendered form and this module verify the
+// same signature without distributing a new secret.
+const _contact_form_hmac_key = function () {
+  const seed = String(_conf?.gmail?.clientSecret || _conf?.domain || 'xuda');
+  return crypto.createHash('sha256').update(`xuda_contact_form_v1:${seed}`).digest();
+};
+
+export const mint_contact_form_token = function (widget_profile_id, ts = Date.now()) {
+  const sig = crypto.createHmac('sha256', _contact_form_hmac_key()).update(`${widget_profile_id}.${ts}`).digest('hex').slice(0, 32);
+  return `cft1.${ts}.${sig}`;
+};
+
+const _verify_contact_form_token = function (widget_profile_id, token) {
+  const parts = String(token || '').split('.');
+  if (parts.length !== 3 || parts[0] !== 'cft1') return { ok: false, reason: 'bad_token' };
+  const ts = Number(parts[1]);
+  if (!Number.isFinite(ts)) return { ok: false, reason: 'bad_token' };
+  const expected = crypto.createHmac('sha256', _contact_form_hmac_key()).update(`${widget_profile_id}.${ts}`).digest('hex').slice(0, 32);
+  let sig_ok = false;
+  try {
+    sig_ok = crypto.timingSafeEqual(Buffer.from(parts[2]), Buffer.from(expected));
+  } catch (err) {
+    sig_ok = false;
+  }
+  if (!sig_ok) return { ok: false, reason: 'bad_token' };
+  const age = Date.now() - ts;
+  if (age > CONTACT_FORM_TOKEN_TTL_MS) return { ok: false, reason: 'token_expired' };
+  if (age < CONTACT_FORM_MIN_AGE_MS) return { ok: false, reason: 'too_fast' };
+  return { ok: true };
+};
+
+const _sanitize_contact_form_config = function (config) {
+  const out = {};
+  if (!config || typeof config !== 'object') return out;
+  const text = (v, max) => String(v).replace(/[<>]/g, '').slice(0, max);
+  if (typeof config.title === 'string') out.title = text(config.title, 60);
+  if (typeof config.intro === 'string') out.intro = text(config.intro, 300);
+  if (typeof config.button_text === 'string') out.button_text = text(config.button_text, 40);
+  if (typeof config.success_message === 'string') out.success_message = text(config.success_message, 300);
+  if (typeof config.color === 'string' && /^#[0-9a-fA-F]{3,8}$/.test(config.color.trim())) out.color = config.color.trim();
+  if (config.fields && typeof config.fields === 'object') {
+    out.fields = {};
+    for (const key of CONTACT_FORM_FIELD_KEYS) {
+      const f = config.fields[key];
+      if (f && typeof f === 'object') out.fields[key] = { show: f.show === true, required: f.required === true };
+    }
+  }
+  if (typeof config.notify_email === 'boolean') out.notify_email = config.notify_email;
+  if (typeof config.auto_respond === 'boolean') out.auto_respond = config.auto_respond;
+  return out;
+};
+
+const _build_contact_form_snippet = function (widget_profile_id, config = {}) {
+  const origin = embed_origin();
+  const attrs = [`s.setAttribute('data-profile','${widget_profile_id}');`];
+  if (config.color && /^#[0-9a-fA-F]{3,8}$/.test(config.color)) attrs.push(`s.setAttribute('data-color','${config.color}');`);
+  return `<script>(function(){var d=document,s=d.createElement('script');s.src='${origin}/dist/runtime/js/contact-form-loader.js';s.async=1;${attrs.join('')}d.head.appendChild(s);})();</script>`;
+};
+
+export const get_contact_form_settings = async function (req) {
+  try {
+    const { uid, profile_id } = req;
+    const account_profile_info = await get_active_account_profile_info(uid, profile_id);
+    if (account_profile_info.uid !== uid) return { code: -403, data: 'not_profile_owner' };
+    const doc = account_profile_info.account_profile_obj || {};
+    const widget_profile_id = `${account_profile_info.uid}.${account_profile_info.account_profile_id}`;
+    const config = _sanitize_contact_form_config(doc.contact_form_config);
+    return {
+      code: 1,
+      data: {
+        enabled: doc.contact_form_enabled === true,
+        config,
+        widget_profile_id,
+        iframe_url: `${embed_origin()}/contact-form/${widget_profile_id}`,
+        snippet: _build_contact_form_snippet(widget_profile_id, config),
+        // Inline mount hint for the settings tab to display next to the snippet.
+        container_snippet: '<div data-xuda-contact-form></div>',
+      },
+    };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+export const update_contact_form_settings = async function (req) {
+  try {
+    const { uid, profile_id, enabled, config } = req;
+    const account_profile_info = await get_active_account_profile_info(uid, profile_id);
+    if (account_profile_info.uid !== uid) return { code: -403, data: 'not_profile_owner' };
+
+    const doc = await db_module.get_app_couch_doc_native(account_profile_info.app_id, account_profile_info.account_profile_id);
+    if (doc.docType !== 'account_profile') return { code: -1, data: 'not_account_profile' };
+
+    if (typeof enabled === 'boolean') doc.contact_form_enabled = enabled;
+    if (config && typeof config === 'object') {
+      const clean = _sanitize_contact_form_config(config);
+      doc.contact_form_config = { ...(doc.contact_form_config || {}), ...clean };
+      for (const key of ['title', 'intro', 'button_text', 'success_message', 'color']) {
+        if (config[key] === '') delete doc.contact_form_config[key];
+      }
+    }
+    doc.ts = Date.now();
+    await db_module.save_app_couch_doc_native(account_profile_info.app_id, doc);
+
+    return await get_contact_form_settings({ uid, profile_id });
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// Router-side bootstrap for rendering the form iframe: resolves the profile,
+// enforces the enabled gate and returns display config plus a fresh token.
+// Broker-only (not in cpi_methods); the router calls it via ai_ms.
+export const get_contact_form_bootstrap = async function (req) {
+  try {
+    const { widget_profile_id } = req;
+    const [owner_uid, pid] = String(widget_profile_id || '').split('.');
+    if (!owner_uid || !pid) return { code: -404, data: 'invalid_profile' };
+
+    const account_profile_info = await get_active_account_profile_info(owner_uid, pid);
+    const doc = account_profile_info.account_profile_obj || {};
+    if (doc.contact_form_enabled !== true) return { code: -404, data: 'contact_form_disabled' };
+
+    let avatar_url = '';
+    let owner_name = '';
+    try {
+      const acct_name_ret = await account_ms.get_account_name({ uid_query: account_profile_info.uid });
+      avatar_url = acct_name_ret?.data?.profile_picture || acct_name_ret?.data?.profile_avatar || doc.profile_picture || doc.profile_avatar || '';
+      owner_name = acct_name_ret?.data?.full_name || '';
+    } catch (err) {}
+
+    const canonical_id = `${account_profile_info.uid}.${account_profile_info.account_profile_id}`;
+    return {
+      code: 1,
+      data: {
+        widget_profile_id: canonical_id,
+        config: _sanitize_contact_form_config(doc.contact_form_config),
+        profile_name: doc.profile_name || owner_name || '',
+        avatar_url,
+        token: mint_contact_form_token(canonical_id),
+      },
+    };
+  } catch (err) {
+    return { code: -404, data: err.message || String(err) };
+  }
+};
+
+// In-memory submit throttles. Per-process is fine: the goal is stopping dumb
+// bot floods, not building an accounting-grade limiter.
+const _contact_form_hits = { ip: {}, profile: {} };
+const _contact_form_allow = function (bucket, key, max, window_ms) {
+  const now = Date.now();
+  const store = _contact_form_hits[bucket];
+  store[key] = (store[key] || []).filter((t) => now - t < window_ms);
+  if (store[key].length >= max) return false;
+  store[key].push(now);
+  if (Object.keys(store).length > 5000) {
+    for (const k of Object.keys(store)) {
+      if (!store[k].length || now - store[k][store[k].length - 1] > window_ms) delete store[k];
+    }
+  }
+  return true;
+};
+
+// Open a 'ticket' chat_conversation on the owner's app for a form submission.
+// Every submission opens a fresh ticket (real ticket semantics), carrying the
+// message as the first inbound conversation item.
+const _contact_form_create_ticket = async function (account_profile_info, contact_id, subject, message, origin) {
+  const owner_uid = account_profile_info.uid;
+  const profile_id = account_profile_info.account_profile_id;
+
+  let conversation_obj = null;
+  try {
+    conversation_obj = await create_openai_conversation();
+  } catch (err) {}
+
+  const d = Date.now();
+  const conversation_doc = {
+    _id: await _common.xuda_get_uuid('chat_conversation'),
+    docType: 'chat_conversation',
+    title: subject || getFirstNWords(message, 10),
+    subject: subject || '',
+    date_created_ts: d,
+    ts: d,
+    stat: 3,
+    uid: owner_uid,
+    messages: [],
+    reference_type: 'contacts',
+    reference_id: contact_id,
+    conversation_obj,
+    conversation_type: 'ticket',
+    conversation_source: 'contact_form',
+    contact_form_origin: origin || '',
+    initiator_uid: owner_uid,
+    direction: 'in',
+    reference_conversation_id: conversation_obj?.id,
+    account_profiles: [profile_id],
+    prompt: message,
+    rtl: _common.detectRTL(message),
+    process_stat: 'full',
+  };
+  const conv_save = await db_module.save_app_couch_doc(account_profile_info.app_id, conversation_doc);
+  if (conv_save.code < 0) throw new Error(conv_save.data || 'ticket_create_failed');
+
+  let conversation_item_reference_id;
+  try {
+    conversation_item_reference_id = await add_conversation_item(owner_uid, profile_id, conversation_doc._id, message, 'ticket', contact_id, { direction: 'in' });
+  } catch (err) {}
+
+  const item_doc = {
+    _id: await _common.xuda_get_uuid('chat_conversation_item'),
+    stat: 3,
+    docType: 'chat_conversation_item',
+    uid: owner_uid,
+    conversation_type: 'ticket',
+    type: 'ticket',
+    date_created_ts: d,
+    ts: d,
+    conversation_id: conversation_doc._id,
+    text: message,
+    subject: subject || '',
+    reference_id: contact_id,
+    conversation_item_reference_id,
+    direction: 'in',
+    role: 'user',
+    contact_form_source: true,
+    rtl: _common.detectRTL(message),
+  };
+  await db_module.save_app_couch_doc(account_profile_info.app_id, item_doc);
+
+  return conversation_doc;
+};
+
+// Public endpoint behind the embedded form. Validates the human-detection
+// signals, adds the sender as a contact (not a friend) and opens the ticket.
+export const contact_form_submit = async function (req, job_id, headers) {
+  try {
+    const { profile_id, token, website, origin, visitor_lang } = req;
+    let { name, email, subject, phone, company, message } = req;
+
+    // Honeypot: the hidden 'website' input must stay empty. Bots fill it;
+    // answer with a generic ok so they learn nothing.
+    if (typeof website === 'string' && website.trim() !== '') return { code: 1, data: { ok: true } };
+
+    if (typeof name !== 'string' || typeof email !== 'string' || typeof message !== 'string') return { code: -1, data: 'invalid_input' };
+    name = name.trim().slice(0, 120);
+    email = email.toLowerCase().trim();
+    message = message.trim().slice(0, 5000);
+    subject = typeof subject === 'string' ? subject.trim().slice(0, 200) : '';
+    phone = typeof phone === 'string' ? phone.trim().slice(0, 40) : '';
+    company = typeof company === 'string' ? company.trim().slice(0, 120) : '';
+    if (!name || !email || !message) return { code: -1, data: 'invalid_input' };
+    if (!WIDGET_EMAIL_RE.test(email)) return { code: -1, data: 'invalid_email' };
+
+    const [owner_uid_part, pid_part] = String(profile_id || '').split('.');
+    if (!owner_uid_part || !pid_part) return { code: -404, data: 'invalid_profile' };
+
+    const account_profile_info = await get_active_account_profile_info(owner_uid_part, pid_part);
+    const ap_doc = account_profile_info.account_profile_obj || {};
+    if (ap_doc.contact_form_enabled !== true) return { code: -404, data: 'contact_form_disabled' };
+
+    const canonical_id = `${account_profile_info.uid}.${account_profile_info.account_profile_id}`;
+    const token_check = _verify_contact_form_token(canonical_id, token);
+    if (!token_check.ok) return { code: -401, data: token_check.reason };
+
+    const client_info = extractClientInfo(headers) || {};
+    const client_ip = client_info.ipAddress || 'unknown';
+    if (!_contact_form_allow('ip', client_ip, 5, 10 * 60 * 1000)) return { code: -429, data: 'rate_limited' };
+    if (!_contact_form_allow('profile', canonical_id, 200, 24 * 60 * 60 * 1000)) return { code: -429, data: 'rate_limited' };
+
+    const owner_uid = account_profile_info.uid;
+    const config = _sanitize_contact_form_config(ap_doc.contact_form_config);
+
+    // Field requirements set by the owner are enforced server side too.
+    for (const key of CONTACT_FORM_FIELD_KEYS) {
+      if (config.fields?.[key]?.show && config.fields?.[key]?.required) {
+        const val = key === 'phone' ? phone : key === 'company' ? company : subject;
+        if (!val) return { code: -1, data: `missing_${key}` };
+      }
+    }
+
+    // All human-detection gates passed: ack the visitor immediately and run
+    // the pipeline (contact enrichment, ticket, notification, auto-reply) in
+    // the background. add_contact runs several AI enrichment steps and would
+    // otherwise hold the visitor's spinner for many seconds.
+    (async () => {
+      try {
+        // Contact, not friend: no contact_connection team_request is created.
+        const add_ret = await account_ms.add_contact({
+          uid: owner_uid,
+          profile_id: account_profile_info.account_profile_id,
+          name,
+          email,
+          source: 'contact_form',
+          context: `Contact form submission${origin ? ` from ${String(origin).slice(0, 200)}` : ''}`,
+          metadata: {
+            subject,
+            phone,
+            company,
+            origin: String(origin || '').slice(0, 200),
+            visitor_lang: String(visitor_lang || '').slice(0, 16),
+            contact_form: true,
+            not_junk: true,
+          },
+        });
+        const contact_id = add_ret.code > -1 ? add_ret.data?.id : add_ret.contact_id;
+        if (!contact_id) throw new Error(add_ret.data || 'contact_create_failed');
+
+        const body_parts = [message];
+        const detail_bits = [phone && `Phone: ${phone}`, company && `Company: ${company}`].filter(Boolean);
+        if (detail_bits.length) body_parts.push(detail_bits.join(' | '));
+        await _contact_form_create_ticket(account_profile_info, contact_id, subject, body_parts.join('\n\n'), origin);
+
+        // Owner notification email (platform template).
+        if (config.notify_email !== false) {
+          try {
+            const owner_acct = await db_module.get_couch_doc('xuda_accounts', owner_uid);
+            const owner_email = owner_acct?.data?.account_info?.email || owner_acct?.data?.email;
+            if (owner_email) {
+              const esc = (v) => String(v || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+              const dashboard_url = `${embed_origin()}/dashboard`;
+              const body = `<h2 style="margin:0 0 12px">New contact form message</h2>
+<p style="margin:0 0 16px;color:#475569">Someone reached out through the contact form of your profile <b>${esc(ap_doc.profile_name || '')}</b>.</p>
+<table cellpadding="0" cellspacing="0" style="width:100%;border-collapse:collapse;font-size:14px">
+<tr><td style="padding:6px 12px 6px 0;color:#64748b;white-space:nowrap;vertical-align:top">From</td><td style="padding:6px 0"><b>${esc(name)}</b> &lt;${esc(email)}&gt;</td></tr>
+${subject ? `<tr><td style="padding:6px 12px 6px 0;color:#64748b;vertical-align:top">Subject</td><td style="padding:6px 0">${esc(subject)}</td></tr>` : ''}
+${phone ? `<tr><td style="padding:6px 12px 6px 0;color:#64748b;vertical-align:top">Phone</td><td style="padding:6px 0">${esc(phone)}</td></tr>` : ''}
+${company ? `<tr><td style="padding:6px 12px 6px 0;color:#64748b;vertical-align:top">Company</td><td style="padding:6px 0">${esc(company)}</td></tr>` : ''}
+</table>
+<div style="background:#f8fafc;border:1px solid #e6ebf1;border-radius:10px;padding:14px 16px;margin:14px 0;white-space:pre-wrap">${esc(message)}</div>
+<p style="margin:16px 0 0"><a href="${dashboard_url}" style="display:inline-block;background:#0091FF;color:#fff;text-decoration:none;padding:10px 22px;border-radius:8px;font-weight:600">Open the conversation</a></p>`;
+              await email_ms.send_email({ email: owner_email, subject: `New contact form message from ${name}`, body, display_type: 'info' });
+            }
+          } catch (err) {
+            console.error('[contact_form] owner notification failed', err?.message || err);
+          }
+        }
+
+        // Optional AI auto-reply, reusing the profile's auto-respond setup.
+        if (config.auto_respond !== false && ap_doc.auto_respond === true) {
+          auto_response(owner_uid, account_profile_info.account_profile_id, contact_id, 'ticket');
+        }
+      } catch (err) {
+        console.error('[contact_form_submit] background pipeline failed', err?.message || err);
+      }
+    })();
+
+    return { code: 1, data: { ok: true } };
+  } catch (err) {
+    return { code: -1, data: err.message || String(err) };
+  }
+};
+
+// Owner-side reply to a 'ticket' conversation (submit_chat_conversation case).
+// Appends the outbound item and emails the contact: through the profile's
+// connected mailbox when one exists, otherwise through the platform mail
+// server with Reply-To pointing at the owner. The body is wrapped with the
+// profile's selected email template (Email Template tab) unless it is plain.
+const contact_ticket_conversation = async function (req, job_id, headers) {
+  const { uid, profile_id, _auto_response = false } = req;
+  const account_profile_info = await get_active_account_profile_info(uid, profile_id);
+  let { prompt: body, conversation_doc } = req;
+  try {
+    const conversation_id = conversation_doc._id;
+    const sender_app_id = account_profile_info.app_id;
+    const contact_id = conversation_doc.reference_id;
+    const contact_info = await get_contact_info(uid, null, contact_id);
+    if (!contact_info?.email) throw new Error('empty contact email');
+
+    const subject_base = conversation_doc.subject || conversation_doc.title;
+    const subject = subject_base ? `Re: ${subject_base}` : 'Re: your message';
+
+    const profile_doc = account_profile_info.account_profile_obj || {};
+    let html = null;
+    try {
+      const render_ret = await email_ms.render_profile_email({
+        style: profile_doc.email_template?.style,
+        body_text: body,
+        profile_name: profile_doc.profile_name,
+        signature: profile_doc.profile_signature,
+        avatar_url: profile_doc.profile_picture || profile_doc.profile_avatar || '',
+        brand_color: profile_doc.widget_config?.color || profile_doc.contact_form_config?.color || '',
+      });
+      if (render_ret?.code > 0 && render_ret.data) html = render_ret.data;
+    } catch (err) {}
+
+    let sent = false;
+    if (profile_doc.email_account_id) {
+      try {
+        const email_account_doc = await db_module.get_app_couch_doc_native(sender_app_id, profile_doc.email_account_id);
+        const send_ret = await email_ms.sendEmailFromAccount(email_account_doc, contact_info.email, subject, body, html);
+        sent = !!send_ret?.success;
+      } catch (err) {
+        console.error('[ticket reply] profile mailbox send failed, falling back to platform mail', err?.message || err);
+      }
+    }
+    if (!sent) {
+      const owner_acct = await db_module.get_couch_doc('xuda_accounts', uid);
+      const owner_email = owner_acct?.data?.account_info?.email || owner_acct?.data?.email || '';
+      const send_ret = await email_ms.send_profile_email({
+        to: contact_info.email,
+        subject,
+        body_text: body,
+        html,
+        from_name: profile_doc.profile_name || owner_acct?.data?.account_info?.full_name || 'Xuda user',
+        reply_to: owner_email,
+      });
+      sent = !!send_ret?.success || send_ret?.code > 0;
+      if (!sent) throw new Error('error sending ticket reply email');
+    }
+
+    let conversation_item_reference_id;
+    try {
+      conversation_item_reference_id = await add_conversation_item(uid, profile_id, conversation_id, body, 'ticket', contact_id, { direction: 'out' });
+    } catch (err) {}
+
+    const now = Date.now();
+    const out_conversation_item_obj = {
+      _id: await _common.xuda_get_uuid('chat_conversation_item'),
+      stat: 3,
+      docType: 'chat_conversation_item',
+      uid,
+      conversation_type: 'ticket',
+      type: 'ticket',
+      date_created_ts: now,
+      ts: now,
+      conversation_id,
+      text: body,
+      subject,
+      reference_id: contact_id,
+      conversation_item_reference_id,
+      direction: 'out',
+      role: 'user',
+      auto_response: _auto_response || undefined,
+      rtl: _common.detectRTL(body),
+    };
+    const save_ret = await db_module.save_app_couch_doc(sender_app_id, out_conversation_item_obj);
+
+    const fresh_conv = await db_module.get_app_couch_doc_native(sender_app_id, conversation_id);
+    fresh_conv.ts = Date.now();
+    await db_module.save_app_couch_doc_native(sender_app_id, fresh_conv);
+
+    return save_ret;
+  } catch (err) {
+    return { code: -15, data: err.message };
+  }
+};

package/index_ms.mjs

@@ -320,3 +320,31 @@ export const widget_send_message = async function (...args) {
 export const widget_get_messages = async function (...args) {
   return await broker.send_to_queue("widget_get_messages", ...args);
 };
+
+export const get_widget_settings = async function (...args) {
+  return await broker.send_to_queue("get_widget_settings", ...args);
+};
+
+export const update_widget_settings = async function (...args) {
+  return await broker.send_to_queue("update_widget_settings", ...args);
+};
+
+export const mint_contact_form_token = async function (...args) {
+  return await broker.send_to_queue("mint_contact_form_token", ...args);
+};
+
+export const get_contact_form_settings = async function (...args) {
+  return await broker.send_to_queue("get_contact_form_settings", ...args);
+};
+
+export const update_contact_form_settings = async function (...args) {
+  return await broker.send_to_queue("update_contact_form_settings", ...args);
+};
+
+export const get_contact_form_bootstrap = async function (...args) {
+  return await broker.send_to_queue("get_contact_form_bootstrap", ...args);
+};
+
+export const contact_form_submit = async function (...args) {
+  return await broker.send_to_queue("contact_form_submit", ...args);
+};

package/index_msa.mjs

@@ -320,3 +320,31 @@ export const widget_send_message =  function (...args) {
 export const widget_get_messages =  function (...args) {
    broker.send_to_queue_async("widget_get_messages", ...args);
 };
+
+export const get_widget_settings =  function (...args) {
+   broker.send_to_queue_async("get_widget_settings", ...args);
+};
+
+export const update_widget_settings =  function (...args) {
+   broker.send_to_queue_async("update_widget_settings", ...args);
+};
+
+export const mint_contact_form_token =  function (...args) {
+   broker.send_to_queue_async("mint_contact_form_token", ...args);
+};
+
+export const get_contact_form_settings =  function (...args) {
+   broker.send_to_queue_async("get_contact_form_settings", ...args);
+};
+
+export const update_contact_form_settings =  function (...args) {
+   broker.send_to_queue_async("update_contact_form_settings", ...args);
+};
+
+export const get_contact_form_bootstrap =  function (...args) {
+   broker.send_to_queue_async("get_contact_form_bootstrap", ...args);
+};
+
+export const contact_form_submit =  function (...args) {
+   broker.send_to_queue_async("contact_form_submit", ...args);
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xuda.io/ai_module",
-  "version": "1.1.5634",
+  "version": "1.1.5636",
   "description": "Xuda AI Module",
   "main": "index.mjs",
   "type": "module",