dewee-webchat 0.3.0 → 0.4.1-beta.1

package/dist/server-identity.d.ts

@@ -0,0 +1,6 @@
+import { D as DeweeIdentitySdk } from './handler-DunrbnSD.js';
+import './protocol-CLbGE9Ns.js';
+
+declare const deweeIdentitySdk: DeweeIdentitySdk;
+
+export { DeweeIdentitySdk, deweeIdentitySdk };

package/dist/server-identity.js

@@ -0,0 +1,6 @@
+// src/server/identity.ts
+import { createAssertion, exchangeSession, startLink } from "@dewee/identity";
+var deweeIdentitySdk = { exchangeSession, startLink, createAssertion };
+export {
+  deweeIdentitySdk
+};

package/dist/server.d.ts

@@ -1,74 +1,7 @@
-import { A as AgentInfo, H as HistoryMessage, C as ChatStreamEvent, a as ActionManifestEntry } from './protocol-B72Ry-fY.js';
-export { b as ActionSensitivity, c as ChatRequestBody, P as PublicConfig, S as SessionResponse } from './protocol-B72Ry-fY.js';
+export { A as AuthenticatedUser, C as CcpError, a as CcpOptions, b as DeweeHandler, c as DeweeHandlerOptions, d as DeweeIdentityOptions, D as DeweeIdentitySdk, e as DeweeTransport, I as IdentityPrivateJwk, f as IdentitySigner, M as MemoryRateLimits, R as RateLimitBucket, g as RateLimiter, V as VisitorClaims, h as createDeweeHandler, m as memoryRateLimiter, o as optionsFromEnv, s as signVisitorToken, v as verifyVisitorToken } from './handler-DunrbnSD.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
-
-interface VisitorClaims {
-    /** Visitor id (random, 22 chars). */
-    v: string;
-    /** Expiry, epoch ms. */
-    exp: number;
-}
-declare function signVisitorToken(secret: string, claims: VisitorClaims): Promise<string>;
-declare function verifyVisitorToken(secret: string, token: string): Promise<VisitorClaims | null>;
-/** Returns true when the key may proceed. Implementations may be async (KV, DO, Redis…). */
-type RateLimiter = (key: string, bucket: "session" | "chat") => boolean | Promise<boolean>;
-/**
- * Fixed-window in-memory limiter. Good enough for a single Node process; on serverless
- * runtimes each isolate keeps its own counters, so pass a shared limiter for hard limits.
- */
-declare function memoryRateLimiter(limits: {
-    chat: [number, number];
-    session: [number, number];
-}): RateLimiter;
-
-interface DeweeHandlerOptions {
-    /** Gateway runtime origin. Required unless every request brings its own credentials. */
-    gatewayUrl?: string;
-    /** Gateway token or operator API key (server-side only). */
-    token?: string;
-    tenantId?: string;
-    /** HMAC secret for visitor tokens (>= 32 random chars). */
-    secret?: string;
-    /** Agents visitors may talk to. The first is the default. `"*"` = every active agent. */
-    agents?: Array<string | AgentInfo> | "*";
-    defaultAgent?: string;
-    /** Let the widget switch between allowed agents. Default: true when more than one agent. */
-    allowAgentSwitch?: boolean;
-    /** Cross-origin sites allowed to call this backend. Same-origin is always allowed. */
-    allowedOrigins?: string[] | "*";
-    /**
-     * Let visitors bring their own gateway URL + token (sent per request, never stored).
-     * Meant for playgrounds. `allowedHosts` restricts which gateways may be targeted.
-     */
-    allowClientCredentials?: boolean | {
-        allowedHosts?: string[];
-    };
-    /** Cloudflare Turnstile. When set, issuing a visitor session requires a valid challenge. */
-    turnstile?: {
-        siteKey: string;
-        secretKey: string;
-    };
-    /** Custom limiter, or false to disable. Default: in-memory 20 msgs/min, 10 sessions/10 min per IP. */
-    rateLimit?: RateLimiter | false;
-    maxMessageLength?: number;
-    /** Prefix for the per-visitor gateway user id. */
-    userIdPrefix?: string;
-    sessionTtlMs?: number;
-    /** Max duration of one agent run. */
-    timeoutMs?: number;
-    /** Observe traffic (logging/analytics). Errors thrown here are ignored. */
-    onChat?: (info: {
-        visitorId: string;
-        agent: string;
-        message: string;
-        reply?: string;
-        error?: string;
-    }) => void;
-}
-type Handler = (request: Request) => Promise<Response>;
-declare function createDeweeHandler(options: DeweeHandlerOptions): Handler;
-/** Reads options from environment variables (process.env, Workers env, import.meta.env…). */
-declare function optionsFromEnv(env: Record<string, string | undefined>, overrides?: Partial<DeweeHandlerOptions>): DeweeHandlerOptions;
+import { R as Remediation, H as HistoryMessage, A as AgentInfo, C as ChatStreamEvent, a as ActionManifestEntry, b as AdmissionErrorCode } from './protocol-CLbGE9Ns.js';
+export { c as ADMISSION_ERROR_CODES, d as ActionSensitivity, e as ChatRequestBody, E as ErrorBody, I as IdentityErrorCode, L as LinkResponse, f as LinkTarget, P as PublicConfig, S as SessionResponse, i as isAdmissionErrorCode } from './protocol-CLbGE9Ns.js';
 
 type FetchHandler = (request: Request) => Promise<Response>;
 /** Wraps a fetch-style handler for `http.createServer`, Express (`app.all("/api/dewee/*", ...)`), etc. */
@@ -85,9 +18,19 @@ interface GatewayCredentials {
     /** Optional tenant id/slug for multi-tenant gateways. */
     tenantId?: string;
 }
+/**
+ * Who a connection acts as: a gateway user id chosen by this server (anonymous visitors), or a Dewee
+ * identity session, in which case the gateway derives the user and no `user_id` is sent.
+ */
+type GatewayActor = string | {
+    identitySession: string;
+};
 declare class GatewayError extends Error {
     code?: string | undefined;
-    constructor(message: string, code?: string | undefined);
+    remediation?: Remediation | undefined;
+    retryAfterMs?: unknown | undefined;
+    /** `retryAfterMs` is the gateway's raw value for retryable refusals (`RATE_LIMITED`), unvalidated. */
+    constructor(message: string, code?: string | undefined, remediation?: Remediation | undefined, retryAfterMs?: unknown | undefined);
 }
 /** One authenticated gateway connection. Short-lived: one per chat turn or lookup. */
 declare class GatewayConnection {
@@ -97,7 +40,7 @@ declare class GatewayConnection {
     private listeners;
     private closed;
     private constructor();
-    static connect(creds: GatewayCredentials, userId: string, timeoutMs?: number): Promise<GatewayConnection>;
+    static connect(creds: GatewayCredentials, actor: GatewayActor, timeoutMs?: number): Promise<GatewayConnection>;
     call<T = any>(method: string, params: unknown, timeoutMs?: number): Promise<T>;
     onEvent(cb: (event: string, payload: any) => void): () => void;
     close(): void;
@@ -107,7 +50,12 @@ declare class GatewayConnection {
 declare function buildSessionKey(agent: string, conversationId: string): string;
 interface StreamChatOptions {
     creds: GatewayCredentials;
-    userId: string;
+    /** Gateway user id (anonymous visitors). Ignored when `identitySession` or `connection` is set. */
+    userId?: string;
+    /** Dewee identity session: the gateway derives the user; no `user_id` is sent. */
+    identitySession?: string;
+    /** An already connected connection to use (and close) instead of opening one. */
+    connection?: GatewayConnection;
     agent: string;
     sessionKey: string;
     message: string;
@@ -117,7 +65,7 @@ interface StreamChatOptions {
 /** Runs one chat turn and yields normalized stream events until the run ends. */
 declare function streamChat(opts: StreamChatOptions): AsyncGenerator<ChatStreamEvent>;
 /** Fetches a session transcript and folds tool calls/results into assistant turns. */
-declare function fetchHistory(creds: GatewayCredentials, userId: string, agent: string, sessionKey: string): Promise<HistoryMessage[]>;
+declare function fetchHistory(creds: GatewayCredentials, actor: GatewayActor, agent: string, sessionKey: string): Promise<HistoryMessage[]>;
 declare function foldHistory(raw: any[]): HistoryMessage[];
 /** Lists agents via the gateway REST API. */
 declare function listAgents(creds: GatewayCredentials): Promise<AgentInfo[]>;
@@ -146,4 +94,14 @@ declare function buildPageBlock(p: PageBlockInput): string;
 /** Removes a leading page block from a stored user message (history display). */
 declare function stripPageBlock(content: string): string;
 
-export { ACTION_LIMITS, ActionManifestEntry, AgentInfo, ChatStreamEvent, type DeweeHandlerOptions, GatewayConnection, type GatewayCredentials, GatewayError, HistoryMessage, type RateLimiter, type StreamChatOptions, buildPageBlock, buildSessionKey, createDeweeHandler, fetchHistory, foldHistory, hashManifest, listAgents, memoryRateLimiter, normalizeManifest, optionsFromEnv, signVisitorToken, streamChat, stripPageBlock, toNodeHandler, verifyVisitorToken };
+/** Cooldown when a `RATE_LIMITED` refusal carries no usable `retryAfterMs`. */
+declare const DEFAULT_RETRY_AFTER_MS = 5000;
+/** Upper bound of the cooldown passed to the browser, so a bogus value cannot lock the widget for long. */
+declare const MAX_RETRY_AFTER_MS = 600000;
+type AdmissionErrorEvent = Extract<ChatStreamEvent, {
+    type: "error";
+}>;
+/** The SSE `error` event of an admission refusal. Only `RATE_LIMITED` carries `retryAfterMs`. */
+declare function admissionErrorEvent(code: AdmissionErrorCode, retryAfterMs?: unknown, gatewayReason?: string): AdmissionErrorEvent;
+
+export { ACTION_LIMITS, ActionManifestEntry, AdmissionErrorCode, AgentInfo, ChatStreamEvent, DEFAULT_RETRY_AFTER_MS, type GatewayActor, GatewayConnection, type GatewayCredentials, GatewayError, HistoryMessage, MAX_RETRY_AFTER_MS, Remediation, type StreamChatOptions, admissionErrorEvent, buildPageBlock, buildSessionKey, fetchHistory, foldHistory, hashManifest, listAgents, normalizeManifest, streamChat, stripPageBlock, toNodeHandler };