dewee-webchat 0.2.0 → 0.4.1-beta.1

package/dist/{chunk-YV6PXYJZ.js → chunk-7WT3JK64.js}

@@ -4,8 +4,12 @@ import {
   HEADER_GATEWAY_TOKEN,
   HEADER_GATEWAY_URL,
   SENSITIVITIES,
+  isAdmissionErrorCode,
+  isIdentityErrorCode,
+  isLinkErrorCode,
+  parseJobAccessLaunch,
   stripPageBlock
-} from "./chunk-JX6AH37X.js";
+} from "./chunk-USXVB3AC.js";
 
 // src/actions/directives.ts
 var DIRECTIVE_LANG = "dewee-action";
@@ -276,36 +280,51 @@ function raceAbort(p, signal) {
 }
 
 // src/widget/api-client.ts
+var RENEW_CODES = /* @__PURE__ */ new Set(["LINK_EXPIRED", "LINK_REVOKED"]);
+var VERIFIED_REFRESH_MS = 6e4;
+var RESERVED_HEADERS = ["content-type", "authorization", HEADER_GATEWAY_URL, HEADER_GATEWAY_TOKEN];
 var ApiError = class extends Error {
-  constructor(message, status, code) {
+  /** `retryAfterMs`: how long to wait before sending again (`RATE_LIMITED`). */
+  constructor(message, status, code, remediation, retryAfterMs) {
     super(message);
     this.status = status;
     this.code = code;
+    this.remediation = remediation;
+    this.retryAfterMs = retryAfterMs;
   }
   status;
   code;
+  remediation;
+  retryAfterMs;
 };
-var store = {
+function retryAfterOf(bodyMs, res) {
+  if (typeof bodyMs === "number" && Number.isFinite(bodyMs) && bodyMs > 0) return bodyMs;
+  const header = Number(res.headers.get("retry-after"));
+  return Number.isFinite(header) && header > 0 ? header * 1e3 : void 0;
+}
+var storage = (pick) => ({
   get(k) {
     try {
-      return localStorage.getItem(k);
+      return pick().getItem(k);
     } catch {
       return null;
     }
   },
   set(k, v) {
     try {
-      localStorage.setItem(k, v);
+      pick().setItem(k, v);
     } catch {
     }
   },
   del(k) {
     try {
-      localStorage.removeItem(k);
+      pick().removeItem(k);
     } catch {
     }
   }
-};
+});
+var store = storage(() => localStorage);
+var tabStore = storage(() => sessionStorage);
 var ApiClient = class {
   constructor(o) {
     this.o = o;
@@ -322,77 +341,220 @@ var ApiClient = class {
   get storageKey() {
     return `dewee-webchat:session:${this.o.endpoint}`;
   }
-  headers(auth = false) {
-    const h = { "content-type": "application/json" };
+  get reuseKey() {
+    return `dewee-webchat:reuse:${this.o.endpoint}`;
+  }
+  /**
+   * The tab's reuse hint for signed-in sessions, or null (none sent by this backend). A logout page can
+   * send it to the backend's logout route, whose `handler.revoke(subject, request, hint)` then ends
+   * exactly that session.
+   */
+  reuseHint() {
+    return tabStore.get(this.reuseKey);
+  }
+  request(url, init) {
+    return (this.o.fetch ?? globalThis.fetch)(url, init);
+  }
+  async headers(auth = false) {
+    const h = {};
+    const extra = typeof this.o.headers === "function" ? await this.o.headers() : this.o.headers;
+    for (const [k, v] of Object.entries(extra ?? {})) {
+      if (typeof v === "string" && !RESERVED_HEADERS.includes(k.toLowerCase())) h[k.toLowerCase()] = v;
+    }
+    h["content-type"] = "application/json";
     if (this.o.gatewayUrl && this.o.gatewayToken) {
       h[HEADER_GATEWAY_URL] = this.o.gatewayUrl;
       h[HEADER_GATEWAY_TOKEN] = this.o.gatewayToken;
     }
-    if (auth && this.session) h.authorization = `Bearer ${this.session.token}`;
+    if (auth) {
+      const s = this.session && this.fresh(this.session) ? this.session : await this.ensureSession();
+      h.authorization = `Bearer ${s.token}`;
+    }
     return h;
   }
   async parse(res) {
     const body = await res.json().catch(() => ({}));
-    if (!res.ok) throw new ApiError(body?.error?.message || `HTTP ${res.status}`, res.status, body?.error?.code);
+    if (!res.ok) {
+      const r = body?.error?.remediation;
+      const remediation = r && typeof r.action === "string" && typeof r.audience === "string" ? { action: r.action, audience: r.audience } : void 0;
+      throw new ApiError(body?.error?.message || `HTTP ${res.status}`, res.status, body?.error?.code, remediation, retryAfterOf(body?.error?.retryAfterMs, res));
+    }
     return body;
   }
   async getConfig(force = false) {
     if (this.config && !force) return this.config;
-    this.config = await this.parse(await fetch(this.url("config"), { headers: this.headers() }));
+    this.config = await this.parse(await this.request(this.url("config"), { headers: await this.headers() }));
     return this.config;
   }
+  /** When each signed-in session should be refreshed, on this browser's clock. */
+  refreshAt = /* @__PURE__ */ new WeakMap();
+  /**
+   * Session reuse. A signed-in session follows its schedule (see `scheduleRefresh`). An anonymous
+   * token is refreshed once less than 10% of its lifetime (at most 24 h, at least 30 s) remains; a
+   * stored token from before `obtainedAt` existed uses the 24 h margin. When the backend reports the
+   * lifetime (`expiresIn`), it is counted from receipt, so a skewed browser clock does not matter.
+   */
+  fresh(s) {
+    if (s.verified) return Date.now() < (this.refreshAt.get(s) ?? 0);
+    const reported = typeof s.expiresIn === "number" && s.expiresIn >= 0 && s.obtainedAt;
+    const end = reported ? s.obtainedAt + s.expiresIn : s.expiresAt;
+    const lifetime = reported ? s.expiresIn : s.obtainedAt ? s.expiresAt - s.obtainedAt : Infinity;
+    const margin = Math.min(864e5, Math.max(3e4, lifetime * 0.1));
+    return end - Date.now() > margin;
+  }
+  /**
+   * A signed-in session is refreshed `min(60s, lifetime/2)` before it ends, with the lifetime the
+   * backend reports (`expiresIn`) counted from receipt, so a short lifetime is not refreshed on every
+   * request and a skewed browser clock does not matter.
+   */
+  scheduleRefresh(s, now) {
+    const life = typeof s.expiresIn === "number" && s.expiresIn > 0 ? s.expiresIn : s.expiresAt - now;
+    this.refreshAt.set(s, now + life - Math.min(VERIFIED_REFRESH_MS, life / 2));
+  }
+  /** The stored anonymous visitor session, if any. Signed-in sessions are never stored. */
+  stored() {
+    const saved = store.get(this.storageKey);
+    if (!saved) return null;
+    try {
+      const s = JSON.parse(saved);
+      return s.verified ? null : s;
+    } catch {
+      return null;
+    }
+  }
   /** Returns a valid visitor session, creating or refreshing it when needed. */
   ensureSession() {
-    if (this.session && this.session.expiresAt - Date.now() > 864e5) return Promise.resolve(this.session);
+    if (this.session && this.fresh(this.session)) return Promise.resolve(this.session);
+    return this.sessionPromise ??= this.loadSession().finally(() => this.sessionPromise = null);
+  }
+  async loadSession() {
     if (!this.session) {
-      const saved = store.get(this.storageKey);
-      if (saved) {
-        try {
-          const s = JSON.parse(saved);
-          if (s.expiresAt - Date.now() > 864e5) return Promise.resolve(this.session = s);
-          this.session = s;
-        } catch {
-        }
+      const s = this.stored();
+      if (s) {
+        if (this.fresh(s) && !(await this.getConfig()).identity) return this.session = s;
+        this.session = s;
       }
     }
-    return this.sessionPromise ??= this.createSession().finally(() => this.sessionPromise = null);
+    return this.createSession();
   }
   async createSession() {
     const cfg = await this.getConfig();
     const body = {};
-    if (this.session?.token) body.token = this.session.token;
-    if (cfg.turnstileSiteKey) {
+    const previous = this.session && !this.session.verified ? this.session : this.stored();
+    if (previous?.token) body.token = previous.token;
+    if (cfg.identity) {
+      const hint = this.session?.verified ? this.session.reuseHint : tabStore.get(this.reuseKey);
+      if (hint) body.reuseHint = hint;
+    }
+    const post = async () => this.parse(await this.request(this.url("session"), { method: "POST", headers: await this.headers(), body: JSON.stringify(body) }));
+    const challenge = async () => {
       if (!this.o.turnstile) throw new ApiError("Verification is required but no Turnstile handler is set", 403, "turnstile_required");
       body.turnstileToken = await this.o.turnstile(cfg.turnstileSiteKey);
+    };
+    let s;
+    try {
+      if (cfg.turnstileSiteKey && !(cfg.refreshWithoutTurnstile && !cfg.identity && body.token && !body.reuseHint)) await challenge();
+      try {
+        s = await post();
+      } catch (e) {
+        if (!(cfg.turnstileSiteKey && !body.turnstileToken && e instanceof ApiError && e.code === "turnstile_failed")) throw e;
+        await challenge();
+        s = await post();
+      }
+    } catch (e) {
+      if (e instanceof ApiError && e.status === 401) tabStore.del(this.reuseKey);
+      throw e;
     }
-    const s = await this.parse(
-      await fetch(this.url("session"), { method: "POST", headers: this.headers(), body: JSON.stringify(body) })
-    );
-    this.session = s;
-    store.set(this.storageKey, JSON.stringify(s));
-    return s;
+    const now = Date.now();
+    const held = { ...s, obtainedAt: now };
+    this.session = held;
+    if (held.verified) {
+      this.scheduleRefresh(held, now);
+      if (typeof held.reuseHint === "string" && held.reuseHint !== "") tabStore.set(this.reuseKey, held.reuseHint);
+      else tabStore.del(this.reuseKey);
+    } else {
+      tabStore.del(this.reuseKey);
+      const { reuseHint: _none, ...anonymous } = held;
+      store.set(this.storageKey, JSON.stringify(anonymous));
+    }
+    return held;
   }
+  /** Drops the session; the next request creates a new one. A stored anonymous visitor is kept for a signed-in session. */
   forgetSession() {
+    if (this.session?.verified) {
+      tabStore.del(this.reuseKey);
+      this.session = null;
+      return;
+    }
     this.session = null;
     store.del(this.storageKey);
   }
+  /**
+   * Asks the backend for a new session now (after a sign-in or sign-out on the host page). The
+   * stored anonymous visitor id is kept, so an anonymous visitor's history survives.
+   */
+  async renewSession() {
+    this.session = null;
+    return this.ensureSession();
+  }
+  /** Requests a single-use launch ticket. Does not refresh or swap the signed-in session after refusal. */
+  async jobAccess(signal) {
+    try {
+      const session = await this.ensureSession();
+      if (!session.verified) throw new ApiError("Sign in to open job access", 401, "IDENTITY_REQUIRED");
+      if (signal.aborted) throw new ApiError("Job access was cancelled", 0, "job_access_unavailable");
+      const response = await this.request(this.url("job-access"), {
+        method: "POST",
+        headers: await this.headers(true),
+        body: "{}",
+        signal,
+        redirect: "error"
+      });
+      return parseJobAccessLaunch(await this.parse(response));
+    } catch (error) {
+      const code = error instanceof ApiError && typeof error.code === "string" && ["IDENTITY_REQUIRED", "LINK_EXPIRED", "LINK_REVOKED", "PERMISSION_DENIED", "SOURCE_UNAVAILABLE"].includes(error.code) ? error.code : "job_access_unavailable";
+      throw new ApiError("Job access is unavailable. Sign in again or retry.", error instanceof ApiError ? error.status : 0, code);
+    }
+  }
+  /** Starts a web-first link of a chat account for the signed-in user (identity backends only). */
+  async link() {
+    const res = await this.signedInRequest(
+      async () => this.request(this.url("link"), { method: "POST", headers: await this.headers(true), body: "{}" })
+    );
+    return this.parse(res);
+  }
   async history(agent, conversationId) {
-    await this.ensureSession();
-    const res = await fetch(this.url("history", { agent, conversationId }), { headers: this.headers(true) });
+    const res = await this.signedInRequest(
+      async () => this.request(this.url("history", { agent, conversationId }), { headers: await this.headers(true) })
+    );
     return (await this.parse(res)).messages;
   }
+  /**
+   * Sends a request with the current session. A signed-in session the backend refuses (expired,
+   * revoked, or another user signed in) is dropped and renewed once, as chat() does. An anonymous
+   * visitor's 401 is final, and its stored visitor is kept.
+   */
+  async signedInRequest(send) {
+    await this.ensureSession();
+    const res = await send();
+    if (res.status !== 401 || !this.session?.verified) return res;
+    this.forgetSession();
+    await this.ensureSession();
+    return send();
+  }
   /** Sends a message and calls `onEvent` for every streamed event. Resolves when the run ends. */
   async chat(input, onEvent, signal) {
     await this.ensureSession();
-    let res = await fetch(this.url("chat"), { method: "POST", headers: this.headers(true), body: JSON.stringify(input), signal });
+    let res = await this.request(this.url("chat"), { method: "POST", headers: await this.headers(true), body: JSON.stringify(input), signal });
     if (res.status === 401) {
       this.forgetSession();
       await this.ensureSession();
-      res = await fetch(this.url("chat"), { method: "POST", headers: this.headers(true), body: JSON.stringify(input), signal });
+      res = await this.request(this.url("chat"), { method: "POST", headers: await this.headers(true), body: JSON.stringify(input), signal });
     }
     if (!res.ok || !res.body) await this.parse(res);
     const reader = res.body.pipeThrough(new TextDecoderStream()).getReader();
     let buf = "";
+    let renew = false;
     while (true) {
       const { done, value } = await reader.read();
       if (done) break;
@@ -403,14 +565,129 @@ var ApiClient = class {
         buf = buf.slice(idx + 2);
         const data = frame.split("\n").filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trimStart()).join("\n");
         if (!data) continue;
+        let event;
+        try {
+          event = JSON.parse(data);
+        } catch {
+          continue;
+        }
+        if (event.type === "error" && event.code && RENEW_CODES.has(event.code)) renew = true;
         try {
-          onEvent(JSON.parse(data));
+          onEvent(event);
         } catch {
         }
       }
     }
+    if (renew && this.session?.verified) {
+      this.forgetSession();
+      await this.ensureSession().catch(() => {
+      });
+    }
+  }
+};
+
+// src/widget/job-access.ts
+var JobAccessPopupError = class extends Error {
+  constructor(code) {
+    super("Job access could not be opened");
+    this.code = code;
   }
+  code;
 };
+async function openJobAccessTicket(load, signal) {
+  const name = `dewee-job-access-${crypto.randomUUID()}`;
+  let popup;
+  try {
+    popup = window.open("about:blank", name, "popup,width=720,height=800");
+  } catch {
+    throw new JobAccessPopupError("popup_blocked");
+  }
+  if (!popup) throw new JobAccessPopupError("popup_blocked");
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  let rejectAbort;
+  const cancelled = new Promise((_resolve, reject) => {
+    rejectAbort = () => reject(new JobAccessPopupError(popup.closed ? "popup_closed" : "job_access_unavailable"));
+  });
+  controller.signal.addEventListener("abort", rejectAbort, { once: true });
+  signal?.addEventListener("abort", cancel, { once: true });
+  const timer = setTimeout(cancel, 3e4);
+  let navigationStarted = false;
+  let finishNavigation;
+  let refuseNavigation;
+  const navigation = new Promise((resolve, reject) => {
+    finishNavigation = resolve;
+    refuseNavigation = () => reject(new JobAccessPopupError("job_access_unavailable"));
+  });
+  const poll = setInterval(() => {
+    if (popup.closed) {
+      cancel();
+      return;
+    }
+    if (!navigationStarted) return;
+    try {
+      if (popup.location.href !== "about:blank") finishNavigation();
+    } catch {
+      finishNavigation();
+    }
+  }, 200);
+  window.addEventListener("pagehide", cancel, { once: true });
+  let form;
+  let input;
+  let launchDocument;
+  const blocked = (event) => {
+    if (event.disposition === "enforce" && (event.effectiveDirective === "form-action" || event.violatedDirective === "form-action")) refuseNavigation();
+  };
+  try {
+    popup.opener = null;
+    if (signal?.aborted) cancel();
+    const ticket = parseJobAccessLaunch(await Promise.race([load(controller.signal), cancelled]));
+    if (popup.closed) throw new JobAccessPopupError("popup_closed");
+    if (controller.signal.aborted) throw new JobAccessPopupError("job_access_unavailable");
+    launchDocument = popup.document;
+    const referrer = launchDocument.createElement("meta");
+    referrer.name = "referrer";
+    referrer.content = "strict-origin";
+    launchDocument.head.append(referrer);
+    form = launchDocument.createElement("form");
+    form.method = "POST";
+    form.action = ticket.bootstrap_url;
+    form.target = "_self";
+    form.hidden = true;
+    input = launchDocument.createElement("input");
+    input.type = "hidden";
+    input.name = "launch_token";
+    input.value = ticket.launch_token;
+    form.append(input);
+    launchDocument.body.append(form);
+    launchDocument.addEventListener("securitypolicyviolation", blocked);
+    HTMLFormElement.prototype.submit.call(form);
+    navigationStarted = true;
+    input.value = "";
+    ticket.launch_token = "";
+    form.remove();
+    await Promise.race([navigation, cancelled]);
+  } catch (error) {
+    const closed = popup.closed;
+    try {
+      popup.close();
+    } catch {
+    }
+    if (closed) throw new JobAccessPopupError("popup_closed");
+    if (error instanceof JobAccessPopupError) throw error;
+    throw error;
+  } finally {
+    if (input) input.value = "";
+    form?.remove();
+    launchDocument?.removeEventListener("securitypolicyviolation", blocked);
+    clearTimeout(timer);
+    clearInterval(poll);
+    window.removeEventListener("pagehide", cancel);
+    signal?.removeEventListener("abort", cancel);
+    controller.signal.removeEventListener("abort", rejectAbort);
+    controller.abort();
+  }
+}
 
 // src/widget/confirm-dialog.ts
 var seq = 0;
@@ -513,7 +790,38 @@ var en = {
   confirmDestructive: "This can't be undone.",
   allow: "Allow",
   deny: "Deny",
-  actionLimit: (n) => `Stopped after ${n} automatic action rounds. Send a message to continue.`
+  actionLimit: (n) => `Stopped after ${n} automatic action rounds. Send a message to continue.`,
+  identityErrors: {
+    IDENTITY_REQUIRED: "Please sign in to chat.",
+    IDENTITY_LINK_REQUIRED: "Link your chat account to continue.",
+    IDENTITY_CONFLICT: "This chat account is already linked to another user. Unlink it there first.",
+    LINK_EXPIRED: "Your session expired. Send your message again.",
+    LINK_REVOKED: "Your access has ended. Sign in again to continue.",
+    PERMISSION_DENIED: "You don't have access to this.",
+    SOURCE_UNAVAILABLE: "We couldn't check your sign-in right now. Please try again shortly."
+  },
+  admissionErrors: {
+    POLICY_DENIED: "This message can't be sent. Try shortening or rephrasing it.",
+    RATE_LIMITED: "You're sending messages too quickly.",
+    CHALLENGE_REQUIRED: "Extra verification is needed. Please try again later."
+  },
+  cooldown: (s) => `You can send again in ${s}s`,
+  cooldownStart: (s) => `Sending is paused. You can send again in ${s} second${s === 1 ? "" : "s"}.`,
+  cooldownOver: "You can send messages again.",
+  linkErrors: {
+    idempotency_key_reused: "This link request was already used. Please try again.",
+    link_in_progress: "A link is already in progress. Use the code you got, or wait for it to expire.",
+    linking_unavailable: "Linking is not available right now. Please try again later."
+  },
+  linkIntro: "Send this code in a direct message from the chat account you want to link:",
+  linkContinueOn: (channel) => `Continue on ${channel}`,
+  linkExpires: (m) => `The code expires in ${m} min.`,
+  linkNoTargets: "No chat app is set up for linking yet.",
+  jobAccess: "Job access",
+  jobAccessOpened: "Job access opened in a new window. Review and confirm any permissions there.",
+  jobAccessUnavailable: "Job access could not be opened. Sign in again or retry.",
+  jobAccessPopupBlocked: "Allow popups for this site, then choose Job access again.",
+  jobAccessPopupClosed: "The window was closed. Choose Job access again to retry."
 };
 var vi = {
   title: "Tr\u1EE3 l\xFD",
@@ -542,13 +850,45 @@ var vi = {
   confirmDestructive: "Thao t\xE1c n\xE0y kh\xF4ng th\u1EC3 ho\xE0n t\xE1c.",
   allow: "Cho ph\xE9p",
   deny: "T\u1EEB ch\u1ED1i",
-  actionLimit: (n) => `\u0110\xE3 d\u1EEBng sau ${n} l\u01B0\u1EE3t thao t\xE1c t\u1EF1 \u0111\u1ED9ng. G\u1EEDi tin nh\u1EAFn \u0111\u1EC3 ti\u1EBFp t\u1EE5c.`
+  actionLimit: (n) => `\u0110\xE3 d\u1EEBng sau ${n} l\u01B0\u1EE3t thao t\xE1c t\u1EF1 \u0111\u1ED9ng. G\u1EEDi tin nh\u1EAFn \u0111\u1EC3 ti\u1EBFp t\u1EE5c.`,
+  identityErrors: {
+    IDENTITY_REQUIRED: "B\u1EA1n \u0111\u0103ng nh\u1EADp \u0111\u1EC3 tr\xF2 chuy\u1EC7n nh\xE9.",
+    IDENTITY_LINK_REQUIRED: "B\u1EA1n c\u1EA7n li\xEAn k\u1EBFt t\xE0i kho\u1EA3n chat \u0111\u1EC3 ti\u1EBFp t\u1EE5c.",
+    IDENTITY_CONFLICT: "T\xE0i kho\u1EA3n chat n\xE0y \u0111\xE3 li\xEAn k\u1EBFt v\u1EDBi ng\u01B0\u1EDDi d\xF9ng kh\xE1c. H\xE3y h\u1EE7y li\xEAn k\u1EBFt \u1EDF \u0111\xF3 tr\u01B0\u1EDBc.",
+    LINK_EXPIRED: "Phi\xEAn \u0111\u0103ng nh\u1EADp \u0111\xE3 h\u1EBFt h\u1EA1n. B\u1EA1n g\u1EEDi l\u1EA1i tin nh\u1EAFn gi\xFAp m\xECnh nh\xE9.",
+    LINK_REVOKED: "Quy\u1EC1n truy c\u1EADp c\u1EE7a b\u1EA1n \u0111\xE3 k\u1EBFt th\xFAc. H\xE3y \u0111\u0103ng nh\u1EADp l\u1EA1i \u0111\u1EC3 ti\u1EBFp t\u1EE5c.",
+    PERMISSION_DENIED: "B\u1EA1n kh\xF4ng c\xF3 quy\u1EC1n th\u1EF1c hi\u1EC7n vi\u1EC7c n\xE0y.",
+    SOURCE_UNAVAILABLE: "Hi\u1EC7n ch\u01B0a ki\u1EC3m tra \u0111\u01B0\u1EE3c \u0111\u0103ng nh\u1EADp c\u1EE7a b\u1EA1n. B\u1EA1n th\u1EED l\u1EA1i sau \xEDt ph\xFAt nh\xE9."
+  },
+  admissionErrors: {
+    POLICY_DENIED: "Kh\xF4ng g\u1EEDi \u0111\u01B0\u1EE3c tin nh\u1EAFn n\xE0y. B\u1EA1n th\u1EED r\xFAt g\u1ECDn ho\u1EB7c di\u1EC5n \u0111\u1EA1t l\u1EA1i nh\xE9.",
+    RATE_LIMITED: "B\u1EA1n \u0111ang g\u1EEDi tin nh\u1EAFn h\u01A1i nhanh.",
+    CHALLENGE_REQUIRED: "C\u1EA7n x\xE1c minh th\xEAm. B\u1EA1n th\u1EED l\u1EA1i sau nh\xE9."
+  },
+  cooldown: (s) => `B\u1EA1n c\xF3 th\u1EC3 g\u1EEDi l\u1EA1i sau ${s} gi\xE2y`,
+  cooldownStart: (s) => `T\u1EA1m d\u1EEBng g\u1EEDi tin nh\u1EAFn. B\u1EA1n c\xF3 th\u1EC3 g\u1EEDi l\u1EA1i sau ${s} gi\xE2y.`,
+  cooldownOver: "B\u1EA1n c\xF3 th\u1EC3 g\u1EEDi tin nh\u1EAFn ti\u1EBFp r\u1ED3i.",
+  linkErrors: {
+    idempotency_key_reused: "Y\xEAu c\u1EA7u li\xEAn k\u1EBFt n\xE0y \u0111\xE3 \u0111\u01B0\u1EE3c d\xF9ng. B\u1EA1n th\u1EED l\u1EA1i nh\xE9.",
+    link_in_progress: "\u0110ang c\xF3 m\u1ED9t li\xEAn k\u1EBFt ch\u01B0a ho\xE0n t\u1EA5t. H\xE3y d\xF9ng m\xE3 \u0111\xE3 nh\u1EADn ho\u1EB7c ch\u1EDD m\xE3 h\u1EBFt h\u1EA1n.",
+    linking_unavailable: "Hi\u1EC7n ch\u01B0a th\u1EC3 li\xEAn k\u1EBFt. B\u1EA1n th\u1EED l\u1EA1i sau nh\xE9."
+  },
+  linkIntro: "G\u1EEDi m\xE3 n\xE0y trong tin nh\u1EAFn ri\xEAng t\u1EEB t\xE0i kho\u1EA3n chat b\u1EA1n mu\u1ED1n li\xEAn k\u1EBFt:",
+  linkContinueOn: (channel) => `Ti\u1EBFp t\u1EE5c tr\xEAn ${channel}`,
+  linkExpires: (m) => `M\xE3 h\u1EBFt h\u1EA1n sau ${m} ph\xFAt.`,
+  linkNoTargets: "Ch\u01B0a c\xF3 \u1EE9ng d\u1EE5ng chat n\xE0o \u0111\u01B0\u1EE3c thi\u1EBFt l\u1EADp \u0111\u1EC3 li\xEAn k\u1EBFt.",
+  jobAccess: "Quy\u1EC1n c\xF4ng vi\u1EC7c",
+  jobAccessOpened: "\u0110\xE3 m\u1EDF c\u1EEDa s\u1ED5 quy\u1EC1n c\xF4ng vi\u1EC7c. H\xE3y xem l\u1EA1i v\xE0 x\xE1c nh\u1EADn quy\u1EC1n t\u1EA1i \u0111\xF3.",
+  jobAccessUnavailable: "Ch\u01B0a m\u1EDF \u0111\u01B0\u1EE3c quy\u1EC1n c\xF4ng vi\u1EC7c. H\xE3y \u0111\u0103ng nh\u1EADp l\u1EA1i ho\u1EB7c th\u1EED l\u1EA1i.",
+  jobAccessPopupBlocked: "Cho ph\xE9p c\u1EEDa s\u1ED5 b\u1EADt l\xEAn cho trang n\xE0y r\u1ED3i ch\u1ECDn Quy\u1EC1n c\xF4ng vi\u1EC7c l\u1EA7n n\u1EEFa.",
+  jobAccessPopupClosed: "C\u1EEDa s\u1ED5 \u0111\xE3 \u0111\xF3ng. Ch\u1ECDn Quy\u1EC1n c\xF4ng vi\u1EC7c l\u1EA7n n\u1EEFa \u0111\u1EC3 th\u1EED l\u1EA1i."
 };
 function pickStrings(locale) {
   const l = (locale || (typeof document !== "undefined" ? document.documentElement.lang : "") || (typeof navigator !== "undefined" ? navigator.language : "") || "en").toLowerCase();
   return l.startsWith("vi") ? vi : en;
 }
 var icons = {
+  jobAccess: `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="m12 3 8 4v5c0 5-8 9-8 9s-8-4-8-9V7l8-4Z"/><path d="m8 12 3 3 5-6"/></svg>`,
   action: `<svg class="ic" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M13 2 4 14h7l-1 8 9-12h-7l1-8Z"/></svg>`,
   chat: `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M21 12a8.5 8.5 0 0 1-12.4 7.6L3 21l1.4-5.1A8.5 8.5 0 1 1 21 12Z"/><path d="M8.5 11h.01M12 11h.01M15.5 11h.01"/></svg>`,
   close: `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>`,
@@ -729,6 +1069,46 @@ function renderMarkdown(doc, src) {
   return frag;
 }
 
+// src/widget/send-cooldown.ts
+var SendCooldown = class {
+  /**
+   * `onTick` runs once a second while cooling down, with the whole seconds left; `onEnd` runs once
+   * when sending is allowed again.
+   */
+  constructor(onTick, onEnd) {
+    this.onTick = onTick;
+    this.onEnd = onEnd;
+  }
+  onTick;
+  onEnd;
+  until = 0;
+  tick;
+  done;
+  get active() {
+    return Date.now() < this.until;
+  }
+  get secondsLeft() {
+    return Math.max(0, Math.ceil((this.until - Date.now()) / 1e3));
+  }
+  /** Starts (or extends) the cooldown; a shorter one never cuts a running one short. */
+  start(ms) {
+    const until = Date.now() + Math.max(0, ms);
+    if (until <= this.until) return;
+    this.until = until;
+    this.clear();
+    this.tick = setInterval(() => this.onTick(this.secondsLeft), 1e3);
+    this.done = setTimeout(() => {
+      this.until = 0;
+      this.clear();
+      this.onEnd();
+    }, until - Date.now());
+  }
+  clear() {
+    clearInterval(this.tick);
+    clearTimeout(this.done);
+  }
+};
+
 // src/widget/styles.ts
 var styles = (
   /* css */
@@ -943,6 +1323,10 @@ details > summary svg.ic { width: 14px; height: 14px; flex: none; }
 .action[data-status="awaiting-confirmation"] .action-state { color: #b06f00; }
 .action[data-status="denied"] .action-state, .action[data-status="error"] .action-state { color: #c2334f; }
 .notice { margin: -6px 0 16px; font-size: 12px; color: var(--dw-muted); text-align: center; }
+.msg.user.refused { flex-direction: column; align-items: flex-end; }
+.refusal { margin-top: 6px; max-width: 86%; font-size: 12.5px; line-height: 1.45; color: #c2334f; text-align: right; }
+.cooldown { margin: 0 2px 8px; font-size: 12px; color: var(--dw-muted); }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
 .confirm-backdrop {
   position: absolute; inset: 0; z-index: 2; display: flex; align-items: flex-end; justify-content: center; padding: 12px;
   background: color-mix(in srgb, var(--dw-fg) 28%, transparent); animation: rise .18s ease both;
@@ -1001,6 +1385,7 @@ textarea::placeholder { color: var(--dw-muted); }
 );
 
 // src/widget/element.ts
+var DEFAULT_COOLDOWN_MS = 5e3;
 var BOOL_ATTRS = ["show-reasoning", "show-tool-calls", "allow-agent-switch", "open", "persist", "hide-branding", "launcher-avatar"];
 var ATTRS = [
   "endpoint",
@@ -1073,6 +1458,7 @@ var DeweeChatElement = class extends ElementBase {
   conversationId = "";
   messages = [];
   running = null;
+  jobAccessLaunch = null;
   activated = false;
   strings = pickStrings();
   mql = null;
@@ -1080,6 +1466,8 @@ var DeweeChatElement = class extends ElementBase {
   propActionNames = /* @__PURE__ */ new Set();
   hooks = {};
   acks = /* @__PURE__ */ new Map();
+  /** Pause after a RATE_LIMITED refusal; send stays disabled until it ends. */
+  cooldown = new SendCooldown((s) => this.renderCooldown(s), () => this.endCooldown());
   els;
   constructor() {
     super();
@@ -1101,11 +1489,13 @@ var DeweeChatElement = class extends ElementBase {
   }
   /** Updates configuration at runtime (wins over attributes). */
   configure(partial) {
-    const { actions, confirm, getPageContext, ...rest } = partial;
+    const { actions, confirm, getPageContext, headers, fetch, ...rest } = partial;
     const has = (k) => Object.prototype.hasOwnProperty.call(partial, k);
     if (has("actions")) this.setPropActions(actions ?? []);
     if (has("confirm")) this.hooks.confirm = confirm;
     if (has("getPageContext")) this.hooks.getPageContext = getPageContext;
+    if (has("headers")) this.hooks.headers = headers;
+    if (has("fetch")) this.hooks.fetch = fetch;
     if (!Object.keys(rest).length) return;
     this.overrides = { ...this.overrides, ...rest };
     if (this.els) this.applyConfig();
@@ -1119,6 +1509,20 @@ var DeweeChatElement = class extends ElementBase {
     this.propActionNames.delete(name);
     return this.registry.unregister(name);
   }
+  /** Extra request headers (property only; same as `configure({ headers })`). */
+  get headers() {
+    return this.hooks.headers;
+  }
+  set headers(v) {
+    this.hooks.headers = v;
+  }
+  /** Custom fetch for widget requests (property only; same as `configure({ fetch })`). */
+  get fetch() {
+    return this.hooks.fetch;
+  }
+  set fetch(v) {
+    this.hooks.fetch = v;
+  }
   /** Names of the currently registered page actions. */
   get actionNames() {
     return this.registry.names();
@@ -1150,7 +1554,7 @@ var DeweeChatElement = class extends ElementBase {
   /** Sends a message programmatically (opens the widget first). */
   async send(text) {
     const message = text.trim();
-    if (!message || this.running) return;
+    if (!message || this.running || this.cooldown.active) return;
     if (this.config.mode !== "inline" && !this.hasAttribute("data-open")) this.open();
     await this.activate();
     this.els.input.value = "";
@@ -1293,6 +1697,101 @@ var DeweeChatElement = class extends ElementBase {
   stop() {
     this.running?.abort();
   }
+  /**
+   * Call after the visitor signs in or out on the host page: the next message uses a session for
+   * the current user, and the conversation is reloaded for them.
+   */
+  async renewSession() {
+    this.stop();
+    try {
+      await this.client().renewSession();
+    } catch (e) {
+      this.showError(null, e);
+      return;
+    }
+    if (this.activated) await this.loadConversation();
+  }
+  /**
+   * The tab's signed-in reuse hint, or null. Not a credential: send it to your logout route for
+   * `handler.revoke(subject, request, hint)`, which then ends exactly that session.
+   */
+  reuseHint() {
+    return this.client().reuseHint();
+  }
+  /**
+   * Web-first linking for a signed-in user: shows a proof code and the chat apps to send it to
+   * ("Continue on Telegram"). The user never types an account id. Resolves null on failure (the
+   * error is shown in the chat and emitted as `dewee:error`).
+   */
+  async startLink() {
+    if (this.config.mode !== "inline" && !this.hasAttribute("data-open")) this.open();
+    await this.activate();
+    try {
+      const link = await this.client().link();
+      this.renderLink(link);
+      this.emit("dewee:link", { expiresAt: link.expiresAt, deepLinks: link.deepLinks });
+      return link;
+    } catch (e) {
+      this.showError(null, e);
+      return null;
+    }
+  }
+  /** Opens the hosted permission review; the verified session stays on the backend. */
+  async openJobAccess() {
+    if (this.jobAccessLaunch) return;
+    const controller = new AbortController();
+    this.jobAccessLaunch = controller;
+    this.els.jobAccess.disabled = true;
+    try {
+      await openJobAccessTicket((signal) => this.client().jobAccess(signal), controller.signal);
+      this.showNotice(this.strings.jobAccessOpened);
+    } catch (error) {
+      if (controller.signal.aborted) return;
+      if (error instanceof JobAccessPopupError) {
+        this.showNotice(error.code === "popup_blocked" ? this.strings.jobAccessPopupBlocked : error.code === "popup_closed" ? this.strings.jobAccessPopupClosed : this.strings.jobAccessUnavailable);
+      } else if (error instanceof ApiError && isIdentityErrorCode(error.code)) {
+        this.showError(null, error);
+      } else this.showNotice(this.strings.jobAccessUnavailable);
+    } finally {
+      this.jobAccessLaunch = null;
+      this.els.jobAccess.disabled = false;
+    }
+  }
+  renderLink(link) {
+    const s = this.strings;
+    const root = document.createElement("div");
+    root.className = "msg assistant link";
+    const bubble = document.createElement("div");
+    bubble.className = "bubble";
+    const md = document.createElement("div");
+    md.className = "md";
+    const p = (text) => {
+      const el2 = document.createElement("p");
+      el2.textContent = text;
+      return el2;
+    };
+    const code = document.createElement("code");
+    code.textContent = link.proofCode;
+    const codeLine = document.createElement("p");
+    codeLine.appendChild(code);
+    md.append(p(s.linkIntro), codeLine);
+    if (link.deepLinks.length) {
+      const list = document.createElement("ul");
+      for (const t of link.deepLinks) {
+        const li = document.createElement("li");
+        const label = t.displayName || t.name;
+        li.textContent = s.linkContinueOn(channelLabel(t.channelType)) + (label ? ` \xB7 ${label}` : "");
+        list.appendChild(li);
+      }
+      md.appendChild(list);
+    } else md.appendChild(p(s.linkNoTargets));
+    md.appendChild(p(s.linkExpires(Math.max(1, Math.round((link.expiresAt - Date.now()) / 6e4)))));
+    bubble.appendChild(md);
+    root.appendChild(bubble);
+    if (!this.messages.length) this.els.log.replaceChildren();
+    this.els.log.appendChild(root);
+    this.scrollToBottom(true);
+  }
   /** Starts a fresh conversation with the current agent. */
   newConversation() {
     this.stop();
@@ -1312,6 +1811,7 @@ var DeweeChatElement = class extends ElementBase {
     }
   }
   disconnectedCallback() {
+    this.jobAccessLaunch?.abort();
     this.stop();
     this.mql?.removeEventListener("change", this.onScheme);
   }
@@ -1331,7 +1831,13 @@ var DeweeChatElement = class extends ElementBase {
         endpoint: c.endpoint,
         gatewayUrl: c.gatewayUrl,
         gatewayToken: c.gatewayToken,
-        turnstile: (siteKey) => this.challenge(siteKey)
+        turnstile: (siteKey) => this.challenge(siteKey),
+        // Read the current hooks on every request so configure({ headers, fetch }) applies at once.
+        headers: () => {
+          const h = this.hooks.headers;
+          return (typeof h === "function" ? h() : h) ?? {};
+        },
+        fetch: (input, init) => (this.hooks.fetch ?? globalThis.fetch)(input, init)
       });
     }
     return this.api;
@@ -1383,6 +1889,8 @@ var DeweeChatElement = class extends ElementBase {
     e.close.title = s.close;
     e.newChat.setAttribute("aria-label", s.newChat);
     e.newChat.title = s.newChat;
+    e.jobAccess.setAttribute("aria-label", s.jobAccess);
+    e.jobAccess.title = s.jobAccess;
     e.input.placeholder = c.placeholder || s.placeholder;
     e.foot.hidden = !!c.hideBranding;
     e.foot.querySelector(".by").textContent = s.poweredBy + " ";
@@ -1410,11 +1918,14 @@ var DeweeChatElement = class extends ElementBase {
             <div class="subtitle"><span class="dot"></span><span class="status"></span><select class="agent-select" hidden></select></div>
           </div>
           <button class="icon-btn new">${icons.newChat}</button>
+          <button class="icon-btn job-access" hidden>${icons.jobAccess}</button>
           <button class="icon-btn close">${icons.close}</button>
         </header>
         <div class="log" part="log" role="log" aria-live="polite"></div>
         <div class="challenge"><slot name="challenge"></slot></div>
         <form class="composer" part="composer">
+          <div class="cooldown" part="cooldown" aria-hidden="true" hidden></div>
+          <div class="sr-only announcer" role="status" aria-live="polite"></div>
           <div class="box">
             <textarea rows="1" maxlength="4000"></textarea>
             <button class="send" type="submit"></button>
@@ -1435,8 +1946,11 @@ var DeweeChatElement = class extends ElementBase {
       input: $("textarea"),
       send: $(".send"),
       newChat: $(".new"),
+      jobAccess: $(".job-access"),
       close: $(".close"),
-      foot: $(".foot")
+      foot: $(".foot"),
+      cooldown: $(".cooldown"),
+      announcer: $(".announcer")
     };
     const e = this.els;
     e.launcher.addEventListener("click", () => this.toggle());
@@ -1445,6 +1959,9 @@ var DeweeChatElement = class extends ElementBase {
       this.following = this.nearBottom();
     }, { passive: true });
     e.newChat.addEventListener("click", () => this.newConversation());
+    e.jobAccess.addEventListener("click", () => {
+      void this.openJobAccess();
+    });
     e.select.addEventListener("change", () => this.switchAgent(e.select.value));
     $("form").addEventListener("submit", (ev) => {
       ev.preventDefault();
@@ -1474,13 +1991,32 @@ var DeweeChatElement = class extends ElementBase {
     b.innerHTML = this.running ? icons.stop : icons.send;
     b.setAttribute("aria-label", this.running ? this.strings.stop : this.strings.send);
     b.title = b.getAttribute("aria-label");
-    b.disabled = !this.running && !this.els.input.value.trim();
+    b.disabled = !this.running && (this.cooldown.active || !this.els.input.value.trim());
+  }
+  /** Disables sending for `ms` and announces it; the visible countdown is not read out every second. */
+  startCooldown(ms) {
+    this.cooldown.start(typeof ms === "number" && Number.isFinite(ms) && ms > 0 ? ms : DEFAULT_COOLDOWN_MS);
+    if (!this.cooldown.active) return;
+    this.renderCooldown(this.cooldown.secondsLeft);
+    this.els.announcer.textContent = this.strings.cooldownStart(this.cooldown.secondsLeft);
+    this.updateSendButton();
+  }
+  renderCooldown(secondsLeft) {
+    this.els.cooldown.hidden = false;
+    this.els.cooldown.textContent = this.strings.cooldown(secondsLeft);
+  }
+  endCooldown() {
+    this.els.cooldown.hidden = true;
+    this.els.cooldown.textContent = "";
+    this.els.announcer.textContent = this.strings.cooldownOver;
+    this.updateSendButton();
   }
   setRunning(ctrl) {
     this.running = ctrl;
     this.updateSendButton();
   }
   renderSubtitle() {
+    this.els.jobAccess.hidden = this.server?.identity !== true;
     const e = this.els;
     const c = this.config;
     const agents = this.server?.agents ?? [];
@@ -1601,6 +2137,15 @@ var DeweeChatElement = class extends ElementBase {
     const c = this.config;
     if (m.role === "user") {
       v.md.textContent = m.content;
+      v.root.classList.toggle("refused", !!m.refusal);
+      let note = v.root.querySelector(".refusal");
+      if (m.refusal && !note) {
+        note = document.createElement("div");
+        note.className = "refusal";
+        v.root.appendChild(note);
+      }
+      if (note && m.refusal) note.textContent = `\u26A0\uFE0F ${m.refusal}`;
+      else note?.remove();
       return;
     }
     v.root.classList.toggle("error", m.status === "error");
@@ -1719,7 +2264,7 @@ var DeweeChatElement = class extends ElementBase {
         break;
       case "error":
         m.status = "error";
-        this.showError(m, new ApiError(e.message, 500, e.code));
+        this.showError(m, new ApiError(e.message, 500, e.code, e.remediation, e.retryAfterMs));
         break;
     }
     this.scheduleUpdate(m);
@@ -1749,8 +2294,12 @@ var DeweeChatElement = class extends ElementBase {
     }
   }
   showError(m, err) {
-    const text = err.message || this.strings.errorGeneric;
-    this.emit("dewee:error", { message: text, code: err.code });
+    const { code, remediation, retryAfterMs } = err;
+    const localized = isIdentityErrorCode(code) ? this.strings.identityErrors[code] : isAdmissionErrorCode(code) ? this.strings.admissionErrors[code] : isLinkErrorCode(code) ? this.strings.linkErrors[code] : "";
+    const text = localized || err.message || this.strings.errorGeneric;
+    this.emit("dewee:error", { message: text, code, ...remediation && { remediation }, ...retryAfterMs && { retryAfterMs } });
+    if (code === "RATE_LIMITED") this.startCooldown(retryAfterMs);
+    if (m && isAdmissionErrorCode(code) && this.refuseInline(m, code, text)) return;
     if (m) {
       m.content = m.content ? `${m.content}
 
@@ -1765,6 +2314,27 @@ var DeweeChatElement = class extends ElementBase {
     div.firstElementChild.textContent = `\u26A0\uFE0F ${text}`;
     this.els.log.appendChild(div);
   }
+  /**
+   * An admission refusal: the visitor's message never reached the agent, so it goes back to an empty
+   * composer to edit or resend. `POLICY_DENIED` is shown next to that message instead of as an empty
+   * reply. Returns true when the error was shown here.
+   */
+  refuseInline(reply, code, text) {
+    const i = this.messages.indexOf(reply);
+    const question = i > 0 ? this.messages[i - 1] : void 0;
+    if (question?.role !== "user" || question.hidden) return false;
+    if (!this.els.input.value.trim()) {
+      this.els.input.value = question.content;
+      this.autosize();
+    }
+    if (code !== "POLICY_DENIED" || reply.content) return false;
+    reply.status = "error";
+    reply.hidden = true;
+    if (reply.view) reply.view.root.hidden = true;
+    question.refusal = text;
+    this.updateMessage(question);
+    return true;
+  }
   /** Renders a Turnstile challenge in light DOM (slotted) and resolves with its token. */
   async challenge(siteKey) {
     await loadTurnstile();
@@ -1807,6 +2377,11 @@ function decorateHistory(messages) {
   });
   return messages;
 }
+var CHANNEL_LABELS = { telegram: "Telegram", discord: "Discord", zalo: "Zalo", slack: "Slack", whatsapp: "WhatsApp", messenger: "Messenger", feishu: "Feishu", line: "LINE" };
+function channelLabel(type) {
+  const key = type.toLowerCase().split(/[_-]/)[0];
+  return CHANNEL_LABELS[key] ?? (type ? type.charAt(0).toUpperCase() + type.slice(1) : "chat");
+}
 function safeJson(s, fallback) {
   try {
     return JSON.parse(s);
@@ -1841,6 +2416,7 @@ function mount(config = {}, target) {
 defineDeweeChat();
 
 export {
+  RESERVED_HEADERS,
   ApiError,
   ApiClient,
   renderMarkdown,