arcy.js 0.1.1 → 0.1.3

package/dist/{chat-BK57WIAA.js → chat-HNE6525R.js}

@@ -1,4 +1,5 @@
-import { CHAT_CONTRACT, CHAT_GLOBAL, FALLBACK_CHROME, carriesFiles, droppedFiles, FONT_KEY_PROPERTY, PANEL_GAP, dragTransform, MOBILE_MARGIN, surfaceWidth, PANEL_MARGIN, clampOffsetX, panelHeight, TOOLTIP_CSS, BAR_TRAY_CLASS, ATTACHABLE_TYPES, POLICY_LINK_CLASS } from './chunk-6HBSGVRN.js';
+import { CHAT_CONTRACT, CHAT_GLOBAL, FALLBACK_CHROME, resolveImageUrl, carriesFiles, droppedFiles, FONT_KEY_PROPERTY, PANEL_GAP, dragTransform, MOBILE_MARGIN, surfaceWidth, PANEL_MARGIN, clampOffsetX, panelHeight, TOOLTIP_CSS, BAR_TRAY_CLASS, ATTACHABLE_TYPES, POLICY_LINK_CLASS } from './chunk-DW3GUQ6J.js';
+export { resolveImageUrl } from './chunk-DW3GUQ6J.js';
 import { normalizeOptionReply, validateFillReply, fetchFlowCatalog } from './chunk-CQ2DESAJ.js';
 import { injectStyles, applyNonce } from './chunk-LGWYJSYX.js';
 
@@ -344,7 +345,7 @@ var TRANSCRIPT_CSS = `
 .${MSG_CLASS}[data-role="system"] {
   align-self: flex-start;
   background: var(--_arcy-assistant-bg, #f2f4f7);
-  color: var(--_arcy-main-text, #101828);
+  color: var(--_arcy-assistant-text, var(--_arcy-main-text, #101828));
 }
 
 /* \u2500\u2500 Rendered markdown inside an answer (D1023, ADR 0129; D1034) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
@@ -399,7 +400,7 @@ var TRANSCRIPT_CSS = `
   font-size: 0.9em;
   padding: 1px 4px;
   border-radius: 4px;
-  background: color-mix(in srgb, var(--_arcy-main-text, #101828) 8%, transparent);
+  background: color-mix(in srgb, currentColor 12%, transparent);
   white-space: pre-wrap;
   overflow-wrap: break-word;
 }
@@ -408,8 +409,8 @@ var TRANSCRIPT_CSS = `
   margin: 0 0 8px;
   padding: 10px 12px;
   border-radius: 8px;
-  background: color-mix(in srgb, var(--_arcy-main-text, #101828) 6%, transparent);
-  border: 1px solid color-mix(in srgb, var(--_arcy-main-text, #101828) 10%, transparent);
+  background: color-mix(in srgb, currentColor 10%, transparent);
+  border: 1px solid color-mix(in srgb, currentColor 16%, transparent);
   overflow-x: auto;
   white-space: pre;
 }
@@ -592,13 +593,14 @@ var TRANSCRIPT_CSS = `
   padding: 12px;
   border-radius: 12px;
   background: var(--_arcy-assistant-bg, #f2f4f7);
+  color: var(--_arcy-assistant-text, var(--_arcy-main-text, #101828));
 }
 
 .${PENDING_CLASS} span {
   width: 6px;
   height: 6px;
   border-radius: 999px;
-  background: color-mix(in srgb, var(--_arcy-main-text, #101828) 45%, transparent);
+  background: color-mix(in srgb, currentColor 55%, transparent);
   animation: arcy-chat-typing 1.2s ease-in-out infinite;
 }
 
@@ -2437,14 +2439,6 @@ var MAIN_CLASS = "arcy-chat-main";
 var MARK_CLASS = "arcy-chat-mark";
 var MARK_LINK_CLASS = "arcy-chat-mark-link";
 var POLICY_CLASS = POLICY_LINK_CLASS;
-function resolveImageUrl(value, apiBase) {
-  if (typeof value !== "string" || value.length === 0) return null;
-  if (/^https:\/\//i.test(value)) return value;
-  if (value.startsWith("/") && !value.startsWith("//")) {
-    return `${(apiBase ?? DEFAULT_API_BASE).replace(/\/+$/, "")}${value}`;
-  }
-  return null;
-}
 var ARCY_HOME_URL = "https://arcyai.com";
 var WELCOME_CLASS = "arcy-chat-welcome";
 var STARTER_CLASS = "arcy-chat-starter";
@@ -3864,4 +3858,4 @@ if (typeof window !== "undefined") {
   }
 }
 
-export { ARCY_HOME_URL, BODY_CLASS, CATALOG_RETRY_MS, CHAT_CSS, CHIPS_CLASS, CHIP_CLASS, HEADER_BUTTON_CLASS, HEADER_CLASS2 as HEADER_CLASS, HEADER_ICON_CLASS, HEADER_NAME_CLASS, MAIN_CLASS, MARK_CLASS, MARK_LINK_CLASS, PANEL_CLASS, POLICY_CLASS, STARTER_CLASS, STARTER_ROW_CLASS, STRIP_CLASS, WELCOME_CLASS, mount, resolveImageUrl };
+export { ARCY_HOME_URL, BODY_CLASS, CATALOG_RETRY_MS, CHAT_CSS, CHIPS_CLASS, CHIP_CLASS, HEADER_BUTTON_CLASS, HEADER_CLASS2 as HEADER_CLASS, HEADER_ICON_CLASS, HEADER_NAME_CLASS, MAIN_CLASS, MARK_CLASS, MARK_LINK_CLASS, PANEL_CLASS, POLICY_CLASS, STARTER_CLASS, STARTER_ROW_CLASS, STRIP_CLASS, WELCOME_CLASS, mount };

package/dist/{chunk-6HBSGVRN.js → chunk-DW3GUQ6J.js}

@@ -216,4 +216,19 @@ function clampOffsetX(x, width, viewportWidth) {
   return Math.min(maxX, Math.max(-maxX, x));
 }
 
-export { ATTACHABLE_TYPES, BAR_TRAY_CLASS, CHAT_CONTRACT, CHAT_GLOBAL, FALLBACK_CHROME, FONT_KEY_PROPERTY, MOBILE_MARGIN, PANEL_GAP, PANEL_MARGIN, POLICY_LINK_CLASS, TOOLTIP_CSS, carriesFiles, clampOffsetX, dragTransform, droppedFiles, panelHeight, readViewport, surfaceWidth };
+// src/shell/image-url.ts
+var DEFAULT_API_BASE = "https://api.arcyai.com";
+var MAX_URL = 2048;
+function isRenderableImageUrl(value) {
+  if (typeof value !== "string") return false;
+  if (value.length === 0 || value.length > MAX_URL) return false;
+  if (/^https:\/\//i.test(value)) return true;
+  return value.startsWith("/") && !value.startsWith("//");
+}
+function resolveImageUrl(value, apiBase) {
+  if (!isRenderableImageUrl(value)) return null;
+  if (/^https:\/\//i.test(value)) return value;
+  return `${(apiBase ?? DEFAULT_API_BASE).replace(/\/+$/, "")}${value}`;
+}
+
+export { ATTACHABLE_TYPES, BAR_TRAY_CLASS, CHAT_CONTRACT, CHAT_GLOBAL, FALLBACK_CHROME, FONT_KEY_PROPERTY, MOBILE_MARGIN, PANEL_GAP, PANEL_MARGIN, POLICY_LINK_CLASS, TOOLTIP_CSS, carriesFiles, clampOffsetX, dragTransform, droppedFiles, isRenderableImageUrl, panelHeight, readViewport, resolveImageUrl, surfaceWidth };

package/dist/index.cjs

@@ -922,6 +922,26 @@ var init_viewport = __esm({
   }
 });
 
+// src/shell/image-url.ts
+function isRenderableImageUrl(value) {
+  if (typeof value !== "string") return false;
+  if (value.length === 0 || value.length > MAX_URL) return false;
+  if (/^https:\/\//i.test(value)) return true;
+  return value.startsWith("/") && !value.startsWith("//");
+}
+function resolveImageUrl(value, apiBase) {
+  if (!isRenderableImageUrl(value)) return null;
+  if (/^https:\/\//i.test(value)) return value;
+  return `${(apiBase ?? DEFAULT_API_BASE2).replace(/\/+$/, "")}${value}`;
+}
+var DEFAULT_API_BASE2, MAX_URL;
+var init_image_url = __esm({
+  "src/shell/image-url.ts"() {
+    DEFAULT_API_BASE2 = "https://api.arcyai.com";
+    MAX_URL = 2048;
+  }
+});
+
 // src/shell/state.ts
 function readPosition(value) {
   if (!value || typeof value !== "object") return null;
@@ -1573,7 +1593,7 @@ var init_transcript = __esm({
 .${MSG_CLASS}[data-role="system"] {
   align-self: flex-start;
   background: var(--_arcy-assistant-bg, #f2f4f7);
-  color: var(--_arcy-main-text, #101828);
+  color: var(--_arcy-assistant-text, var(--_arcy-main-text, #101828));
 }
 
 /* \u2500\u2500 Rendered markdown inside an answer (D1023, ADR 0129; D1034) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
@@ -1628,7 +1648,7 @@ var init_transcript = __esm({
   font-size: 0.9em;
   padding: 1px 4px;
   border-radius: 4px;
-  background: color-mix(in srgb, var(--_arcy-main-text, #101828) 8%, transparent);
+  background: color-mix(in srgb, currentColor 12%, transparent);
   white-space: pre-wrap;
   overflow-wrap: break-word;
 }
@@ -1637,8 +1657,8 @@ var init_transcript = __esm({
   margin: 0 0 8px;
   padding: 10px 12px;
   border-radius: 8px;
-  background: color-mix(in srgb, var(--_arcy-main-text, #101828) 6%, transparent);
-  border: 1px solid color-mix(in srgb, var(--_arcy-main-text, #101828) 10%, transparent);
+  background: color-mix(in srgb, currentColor 10%, transparent);
+  border: 1px solid color-mix(in srgb, currentColor 16%, transparent);
   overflow-x: auto;
   white-space: pre;
 }
@@ -1821,13 +1841,14 @@ var init_transcript = __esm({
   padding: 12px;
   border-radius: 12px;
   background: var(--_arcy-assistant-bg, #f2f4f7);
+  color: var(--_arcy-assistant-text, var(--_arcy-main-text, #101828));
 }
 
 .${PENDING_CLASS} span {
   width: 6px;
   height: 6px;
   border-radius: 999px;
-  background: color-mix(in srgb, var(--_arcy-main-text, #101828) 45%, transparent);
+  background: color-mix(in srgb, currentColor 55%, transparent);
   animation: arcy-chat-typing 1.2s ease-in-out infinite;
 }
 
@@ -2964,7 +2985,7 @@ function headers(sessionToken) {
 }
 async function fetchFlowCatalog(options) {
   const {
-    apiBase = DEFAULT_API_BASE3,
+    apiBase = DEFAULT_API_BASE4,
     sessionToken,
     sessionId,
     setTimeoutImpl = (fn, ms) => setTimeout(fn, ms),
@@ -3001,7 +3022,7 @@ async function fetchFlowCatalog(options) {
 }
 async function fetchFlowRun(flowCvid, options) {
   const {
-    apiBase = DEFAULT_API_BASE3,
+    apiBase = DEFAULT_API_BASE4,
     sessionToken,
     sessionId,
     setTimeoutImpl = (fn, ms) => setTimeout(fn, ms),
@@ -3040,10 +3061,10 @@ async function fetchFlowRun(flowCvid, options) {
     reason: "network"
   });
 }
-var DEFAULT_API_BASE3, FLOW_CATALOG_PATH, FLOW_RUN_PATH, FLOW_FETCH_TIMEOUT_MS;
+var DEFAULT_API_BASE4, FLOW_CATALOG_PATH, FLOW_RUN_PATH, FLOW_FETCH_TIMEOUT_MS;
 var init_api = __esm({
   "src/flow/api.ts"() {
-    DEFAULT_API_BASE3 = "https://api.arcyai.com";
+    DEFAULT_API_BASE4 = "https://api.arcyai.com";
     FLOW_CATALOG_PATH = "/api/v1/sdk/flows/catalog";
     FLOW_RUN_PATH = "/api/v1/sdk/flows";
     FLOW_FETCH_TIMEOUT_MS = 8e3;
@@ -3139,7 +3160,7 @@ function headers2(sessionToken) {
 }
 async function postAgentQuery(options) {
   const {
-    apiBase = DEFAULT_API_BASE4,
+    apiBase = DEFAULT_API_BASE5,
     publicKey,
     sessionId,
     sessionToken,
@@ -3196,10 +3217,10 @@ async function postAgentQuery(options) {
   })();
   return bounded2(attempt, timeoutMs, setTimeoutImpl, { ok: false, reason: "network" });
 }
-var DEFAULT_API_BASE4, AGENT_QUERY_PATH, AGENT_QUERY_TIMEOUT_MS, CAP_DENIAL_REASONS;
+var DEFAULT_API_BASE5, AGENT_QUERY_PATH, AGENT_QUERY_TIMEOUT_MS, CAP_DENIAL_REASONS;
 var init_chat_api = __esm({
   "src/shell/chat-api.ts"() {
-    DEFAULT_API_BASE4 = "https://api.arcyai.com";
+    DEFAULT_API_BASE5 = "https://api.arcyai.com";
     AGENT_QUERY_PATH = "/api/v1/sdk/agent/query";
     AGENT_QUERY_TIMEOUT_MS = 2e4;
     CAP_DENIAL_REASONS = /* @__PURE__ */ new Set([
@@ -3217,14 +3238,14 @@ var init_chat_api = __esm({
 function web(family, fallback = SANS_FALLBACK) {
   return { family, fallback, stack: `"${family}", ${fallback}` };
 }
-function fontFaceCss(key, assetBase = DEFAULT_API_BASE4) {
+function fontFaceCss(key, assetBase = DEFAULT_API_BASE5) {
   const entry = CATALOG[key];
   if (!entry?.family) return "";
   return SUBSETS.map(
     ([subset, range]) => `@font-face{font-family:"${entry.family}";font-style:normal;font-weight:400;font-display:swap;src:url("${assetBase}/fonts/${key}-${subset}.woff2") format("woff2");unicode-range:${range};}`
   ).join("\n");
 }
-function applyFont(host, doc, assetBase = DEFAULT_API_BASE4) {
+function applyFont(host, doc, assetBase = DEFAULT_API_BASE5) {
   try {
     const key = host.style.getPropertyValue(FONT_KEY_PROPERTY).trim();
     const entry = key ? CATALOG[key] : void 0;
@@ -3351,7 +3372,7 @@ function toRows(conversations, imageLabel, currentConversationId) {
 }
 async function fetchConversations(options) {
   const {
-    apiBase = DEFAULT_API_BASE4,
+    apiBase = DEFAULT_API_BASE5,
     sessionToken,
     visitorId,
     setTimeoutImpl = (fn, ms) => setTimeout(fn, ms),
@@ -3453,7 +3474,7 @@ function readMessages(body) {
 }
 async function fetchConversationMessages(options) {
   const {
-    apiBase = DEFAULT_API_BASE4,
+    apiBase = DEFAULT_API_BASE5,
     sessionToken,
     conversationId,
     visitorId,
@@ -3521,7 +3542,7 @@ function feedbackPath(conversationId, messageId) {
 }
 async function postAnswerFeedback(options) {
   const {
-    apiBase = DEFAULT_API_BASE4,
+    apiBase = DEFAULT_API_BASE5,
     sessionToken,
     conversationId,
     messageId,
@@ -3695,7 +3716,7 @@ async function uploadImage(file, alreadyAttached, options) {
   const validation = validateFile(file, alreadyAttached);
   if (!validation.ok) return { ok: false, reason: validation.reason };
   const {
-    apiBase = DEFAULT_API_BASE4,
+    apiBase = DEFAULT_API_BASE5,
     sessionToken,
     env,
     timeoutMs = UPLOAD_TIMEOUT_MS
@@ -3749,7 +3770,7 @@ async function uploadImage(file, alreadyAttached, options) {
   });
 }
 async function discardUpload(objectKey, options) {
-  const { apiBase = DEFAULT_API_BASE4, sessionToken, fetchImpl } = options;
+  const { apiBase = DEFAULT_API_BASE5, sessionToken, fetchImpl } = options;
   if (!fetchImpl || !sessionToken || !objectKey) return false;
   try {
     const response = await fetchImpl(`${apiBase}${DISCARD_PATH}`, {
@@ -3806,14 +3827,6 @@ __export(chat_exports, {
   mount: () => mount,
   resolveImageUrl: () => resolveImageUrl
 });
-function resolveImageUrl(value, apiBase) {
-  if (typeof value !== "string" || value.length === 0) return null;
-  if (/^https:\/\//i.test(value)) return value;
-  if (value.startsWith("/") && !value.startsWith("//")) {
-    return `${(apiBase ?? DEFAULT_API_BASE4).replace(/\/+$/, "")}${value}`;
-  }
-  return null;
-}
 function icon(doc, path, size2 = 17) {
   const svg = doc.createElementNS(SVG_NS5, "svg");
   svg.setAttribute("viewBox", "0 0 24 24");
@@ -3945,7 +3958,7 @@ function mount(context) {
       context.bar.setDisabled(true);
       transcript.setPending(true);
       void postAgentQuery({
-        apiBase: context.apiBase ?? DEFAULT_API_BASE4,
+        apiBase: context.apiBase ?? DEFAULT_API_BASE5,
         publicKey: context.publicKey ?? "",
         sessionId: context.getSessionId?.() ?? "",
         sessionToken: context.getSessionToken?.() ?? "",
@@ -4775,6 +4788,7 @@ var init_chat = __esm({
     init_api();
     init_renderable_flows();
     init_chat_api();
+    init_image_url();
     init_fonts();
     init_conversation_list();
     init_conversation_messages();
@@ -11348,6 +11362,7 @@ init_chat_contract();
 // src/shell/tokens.ts
 init_chat_contract();
 init_host();
+init_image_url();
 init_warn();
 init_storage();
 var HEX = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
@@ -11515,13 +11530,12 @@ function applyTokens(host, tokens) {
 var TOKEN_KEY_PREFIX = "arcy.tokens.";
 var MAX_STORED = 4096;
 var MAX_NAME = 100;
-var MAX_URL = 2048;
 function readIdentity(value) {
   const raw = object(value);
   if (!raw) return null;
   const name = typeof raw.name === "string" ? raw.name.slice(0, MAX_NAME) : "";
   const url = raw.logoUrl;
-  const logoUrl = typeof url === "string" && url.length <= MAX_URL && /^https:\/\//i.test(url) ? url : null;
+  const logoUrl = isRenderableImageUrl(url) ? url : null;
   return { name, logoUrl };
 }
 function createTokenCache(token, raw = browserLocalStorage()) {
@@ -11553,6 +11567,7 @@ function createTokenCache(token, raw = browserLocalStorage()) {
 }
 
 // src/api.ts
+init_image_url();
 init_state2();
 
 // src/session/visit.ts
@@ -12219,22 +12234,34 @@ function createSessionStore({
   fill,
   windowMs = SESSION_WINDOW_MS
 }) {
-  function touch() {
-    const at = now();
+  function alive(at) {
     const existing = readJson(store, key);
-    const alive = existing && typeof existing.id === "string" && existing.id.length > 0 && typeof existing.seen === "number" && at - existing.seen < windowMs;
-    if (alive) {
-      if (at - existing.seen >= TOUCH_WRITE_INTERVAL_MS) {
-        writeJson(store, key, { id: existing.id, seen: at });
-      }
-      return existing.id;
+    if (existing && typeof existing.id === "string" && existing.id.length > 0 && typeof existing.seen === "number" && at - existing.seen < windowMs) {
+      return existing;
     }
+    return null;
+  }
+  function mint(at) {
     const id = ulid(at, fill);
     writeJson(store, key, { id, seen: at });
     return id;
   }
+  function touch() {
+    const at = now();
+    const existing = alive(at);
+    if (!existing) return mint(at);
+    if (at - existing.seen >= TOUCH_WRITE_INTERVAL_MS) {
+      writeJson(store, key, { id: existing.id, seen: at });
+    }
+    return existing.id;
+  }
+  function current() {
+    const at = now();
+    return alive(at)?.id ?? mint(at);
+  }
   return {
     touch,
+    current,
     peek: () => readJson(store, key),
     clear() {
       store.removeItem(key);
@@ -12251,7 +12278,7 @@ var FLUSH_INTERVAL_MS = 5e3;
 var MAX_EVENTS_PER_REQUEST = 100;
 var MAX_REQUEST_BYTES = 64 * 1024;
 var MAX_QUEUED_EVENTS = 1e3;
-var DEFAULT_API_BASE2 = "https://api.arcyai.com";
+var DEFAULT_API_BASE3 = "https://api.arcyai.com";
 var TELEMETRY_PATH = "/api/v1/sdk/telemetry";
 function utf8Length(value) {
   let bytes = 0;
@@ -12287,7 +12314,7 @@ function chunkEvents(events) {
 function createTransport(options) {
   const {
     token,
-    apiBase = DEFAULT_API_BASE2,
+    apiBase = DEFAULT_API_BASE3,
     fetchImpl,
     sendBeacon,
     setTimeoutImpl = (fn, ms) => setTimeout(fn, ms),
@@ -12684,7 +12711,7 @@ function createTelemetry(options) {
     if (typeof raw !== "string") return void 0;
     return normalizeRoute(raw, win?.location?.href) ?? void 0;
   }
-  const ownOrigin = (apiBase ?? DEFAULT_API_BASE2).replace(/\/+$/, "");
+  const ownOrigin = (apiBase ?? DEFAULT_API_BASE3).replace(/\/+$/, "");
   let uninstallNetworkWatch = null;
   return {
     start() {
@@ -12761,7 +12788,7 @@ function createTelemetry(options) {
       capture(name, payload, fields2);
     },
     flush: () => transport.flush(false),
-    sessionId: () => session.touch(),
+    sessionId: () => session.current(),
     resetSession: () => session.clear(),
     stopped: () => transport.stopped(),
     state: () => consent.state()
@@ -13078,16 +13105,12 @@ function createArcyInternals(internalOptions = {}) {
     const chrome = raw?.chrome && typeof raw.chrome === "object" && !Array.isArray(raw.chrome) ? { ...FALLBACK_CHROME, ...raw.chrome } : FALLBACK_CHROME;
     const welcomeIconUrl = raw?.welcomeIconUrl;
     const chatBarIconUrl = raw?.chatBarIconUrl;
+    const apiBase = resolveApiBase();
     return {
       name: identity2.name,
-      logoUrl: identity2.logoUrl,
-      // Re-checked here rather than trusted, same as privacyPolicyUrl below:
-      // a rewritten bootstrap must not be able to point this at a
-      // non-`https` URL (ADR 0050).
-      welcomeIconUrl: typeof welcomeIconUrl === "string" && /^https:\/\//i.test(welcomeIconUrl) ? welcomeIconUrl : null,
-      // Same re-check, same reason: this renders into an `<img src>` on a
-      // page ARCY does not control (ADR 0050).
-      chatBarIconUrl: typeof chatBarIconUrl === "string" && /^https:\/\//i.test(chatBarIconUrl) ? chatBarIconUrl : null,
+      logoUrl: resolveImageUrl(identity2.logoUrl, apiBase),
+      welcomeIconUrl: resolveImageUrl(welcomeIconUrl, apiBase),
+      chatBarIconUrl: resolveImageUrl(chatBarIconUrl, apiBase),
       welcomeMessage: text(raw?.welcomeMessage),
       inputPlaceholder: text(raw?.inputPlaceholder),
       welcomeHeadline: text(raw?.welcomeHeadline),
@@ -13730,7 +13753,8 @@ function createArcyInternals(internalOptions = {}) {
     getConfig: () => bootstrap?.config() ?? null,
     selectLocale,
     getShellState: () => shellState,
-    getTokens: () => tokens
+    getTokens: () => tokens,
+    getWidgetChrome: () => readWidgetChrome()
   };
 }
 

package/dist/index.js

@@ -1,5 +1,5 @@
 import { DESIGN_MODE_PROTOCOL, DESIGN_MODE_EXIT, DESIGN_MODE_SCREENSHOT, DESIGN_MODE_PICK, DESIGN_MODE_READY } from './chunk-7VVKR3AO.js';
-import { FONT_KEY_PROPERTY, FALLBACK_CHROME, readViewport, POLICY_LINK_CLASS, BAR_TRAY_CLASS, ATTACHABLE_TYPES, TOOLTIP_CSS, surfaceWidth, clampOffsetX, dragTransform, carriesFiles, droppedFiles, MOBILE_MARGIN, CHAT_CONTRACT, CHAT_GLOBAL } from './chunk-6HBSGVRN.js';
+import { FALLBACK_CHROME, resolveImageUrl, FONT_KEY_PROPERTY, isRenderableImageUrl, readViewport, POLICY_LINK_CLASS, BAR_TRAY_CLASS, ATTACHABLE_TYPES, TOOLTIP_CSS, surfaceWidth, clampOffsetX, dragTransform, carriesFiles, droppedFiles, MOBILE_MARGIN, CHAT_CONTRACT, CHAT_GLOBAL } from './chunk-DW3GUQ6J.js';
 import { createShellState, safeStore, browserSessionStorage, writeJson, browserLocalStorage, readJson, hasPendingPreview, createFlowRunState, FLOW_CONTRACT, FLOW_GLOBAL } from './chunk-FR6SJSDU.js';
 import { PICKER_CONTRACT, PICKER_GLOBAL } from './chunk-DKYMIAYF.js';
 import { warn, reportCspViolations, releaseHostFocus, Z_INDEX, createShell, injectStyles } from './chunk-LGWYJSYX.js';
@@ -2429,13 +2429,12 @@ function applyTokens(host, tokens) {
 var TOKEN_KEY_PREFIX = "arcy.tokens.";
 var MAX_STORED = 4096;
 var MAX_NAME = 100;
-var MAX_URL = 2048;
 function readIdentity(value) {
   const raw = object(value);
   if (!raw) return null;
   const name = typeof raw.name === "string" ? raw.name.slice(0, MAX_NAME) : "";
   const url = raw.logoUrl;
-  const logoUrl = typeof url === "string" && url.length <= MAX_URL && /^https:\/\//i.test(url) ? url : null;
+  const logoUrl = isRenderableImageUrl(url) ? url : null;
   return { name, logoUrl };
 }
 function createTokenCache(token, raw = browserLocalStorage()) {
@@ -3123,22 +3122,34 @@ function createSessionStore({
   fill,
   windowMs = SESSION_WINDOW_MS
 }) {
-  function touch() {
-    const at = now();
+  function alive(at) {
     const existing = readJson(store, key);
-    const alive = existing && typeof existing.id === "string" && existing.id.length > 0 && typeof existing.seen === "number" && at - existing.seen < windowMs;
-    if (alive) {
-      if (at - existing.seen >= TOUCH_WRITE_INTERVAL_MS) {
-        writeJson(store, key, { id: existing.id, seen: at });
-      }
-      return existing.id;
+    if (existing && typeof existing.id === "string" && existing.id.length > 0 && typeof existing.seen === "number" && at - existing.seen < windowMs) {
+      return existing;
     }
+    return null;
+  }
+  function mint(at) {
     const id = ulid(at, fill);
     writeJson(store, key, { id, seen: at });
     return id;
   }
+  function touch() {
+    const at = now();
+    const existing = alive(at);
+    if (!existing) return mint(at);
+    if (at - existing.seen >= TOUCH_WRITE_INTERVAL_MS) {
+      writeJson(store, key, { id: existing.id, seen: at });
+    }
+    return existing.id;
+  }
+  function current() {
+    const at = now();
+    return alive(at)?.id ?? mint(at);
+  }
   return {
     touch,
+    current,
     peek: () => readJson(store, key),
     clear() {
       store.removeItem(key);
@@ -3662,7 +3673,7 @@ function createTelemetry(options) {
       capture(name, payload, fields2);
     },
     flush: () => transport.flush(false),
-    sessionId: () => session.touch(),
+    sessionId: () => session.current(),
     resetSession: () => session.clear(),
     stopped: () => transport.stopped(),
     state: () => consent.state()
@@ -3978,16 +3989,12 @@ function createArcyInternals(internalOptions = {}) {
     const chrome = raw?.chrome && typeof raw.chrome === "object" && !Array.isArray(raw.chrome) ? { ...FALLBACK_CHROME, ...raw.chrome } : FALLBACK_CHROME;
     const welcomeIconUrl = raw?.welcomeIconUrl;
     const chatBarIconUrl = raw?.chatBarIconUrl;
+    const apiBase = resolveApiBase();
     return {
       name: identity2.name,
-      logoUrl: identity2.logoUrl,
-      // Re-checked here rather than trusted, same as privacyPolicyUrl below:
-      // a rewritten bootstrap must not be able to point this at a
-      // non-`https` URL (ADR 0050).
-      welcomeIconUrl: typeof welcomeIconUrl === "string" && /^https:\/\//i.test(welcomeIconUrl) ? welcomeIconUrl : null,
-      // Same re-check, same reason: this renders into an `<img src>` on a
-      // page ARCY does not control (ADR 0050).
-      chatBarIconUrl: typeof chatBarIconUrl === "string" && /^https:\/\//i.test(chatBarIconUrl) ? chatBarIconUrl : null,
+      logoUrl: resolveImageUrl(identity2.logoUrl, apiBase),
+      welcomeIconUrl: resolveImageUrl(welcomeIconUrl, apiBase),
+      chatBarIconUrl: resolveImageUrl(chatBarIconUrl, apiBase),
       welcomeMessage: text(raw?.welcomeMessage),
       inputPlaceholder: text(raw?.inputPlaceholder),
       welcomeHeadline: text(raw?.welcomeHeadline),
@@ -4630,7 +4637,8 @@ function createArcyInternals(internalOptions = {}) {
     getConfig: () => bootstrap?.config() ?? null,
     selectLocale,
     getShellState: () => shellState,
-    getTokens: () => tokens
+    getTokens: () => tokens,
+    getWidgetChrome: () => readWidgetChrome()
   };
 }
 
@@ -4709,7 +4717,7 @@ var bundledChunks = {
   cdnBase: null,
   loadChat: (win, timeoutMs, setTimeoutImpl) => importChunk(
     win,
-    () => import('./chat-BK57WIAA.js'),
+    () => import('./chat-HNE6525R.js'),
     CHAT_GLOBAL,
     CHAT_CONTRACT,
     "chat panel",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcy.js",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "ARCY — the universal JavaScript utility for embedding an AI agent that talks to, learns from, and acts on behalf of your users.",
   "license": "MIT",
   "type": "module",