dewee-webchat 0.5.0-beta.2 → 0.5.0-beta.4

package/dist/{handler-SsDyK0TG.d.ts → handler-_GEhpm1W.d.ts}

@@ -1,4 +1,4 @@
-import { A as AgentInfo } from './protocol-BbjGSfZa.js';
+import { A as AgentInfo } from './protocol-DjEdC6QU.js';
 
 interface VisitorClaims {
     /** Visitor id (random, 22 chars; derived from the principal for a signed-in user). */
@@ -290,6 +290,10 @@ interface DeweeHandlerOptions {
     allowedHeaders?: string[];
     /** HTTPS directory prefixes from which the backend may proxy images; disabled when unset. */
     imageSources?: string[];
+    /** Enable signed-in hosted credential requests, pinning the Dewee form's HTTPS origin. */
+    credentialRequests?: {
+        formOrigin: string;
+    };
     /** Explicitly public directories in this Worker's Assets binding. Bypasses site middleware. */
     cloudflarePublicImageAssets?: {
         binding: {
@@ -297,6 +301,14 @@ interface DeweeHandlerOptions {
         };
         prefixes: string[];
     };
+    /** Public-only service bindings for approved HTTPS image directory prefixes. Bypasses host security rules. */
+    cloudflarePublicImageServices?: Array<{
+        id: string;
+        binding: {
+            fetch(request: Request): Promise<Response>;
+        };
+        prefixes: string[];
+    }>;
     /**
      * Legacy gateway transport: let visitors bring their own gateway URL + token (sent per request, never stored).
      * Meant for playgrounds. `allowedHosts` restricts which gateways may be targeted.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { d as ActionSensitivity, P as PublicConfig, S as SessionResponse, L as LinkResponse, H as HistoryMessage, e as ChatRequestBody, C as ChatStreamEvent, R as Remediation, g as PageContextAttachment } from './protocol-BbjGSfZa.js';
-export { a as ActionManifestEntry, b as AdmissionErrorCode, A as AgentInfo, I as IdentityErrorCode, f as LinkTarget, T as ToolCallView } from './protocol-BbjGSfZa.js';
+import { d as ActionSensitivity, P as PublicConfig, S as SessionResponse, L as LinkResponse, H as HistoryMessage, g as CredentialRequestView, h as CredentialHandoff, e as ChatRequestBody, C as ChatStreamEvent, R as Remediation, j as PageContextAttachment } from './protocol-DjEdC6QU.js';
+export { a as ActionManifestEntry, b as AdmissionErrorCode, A as AgentInfo, I as IdentityErrorCode, f as LinkTarget, T as ToolCallView } from './protocol-DjEdC6QU.js';
 
 type ActionResultStatus = "ok" | "denied" | "error";
 interface ActionResult {
@@ -137,6 +137,12 @@ declare class ApiClient {
     /** Starts a web-first link of a chat account for the signed-in user (identity backends only). */
     link(): Promise<LinkResponse>;
     history(agent: string, conversationId: string): Promise<HistoryMessage[]>;
+    historyDetails(agent: string, conversationId: string): Promise<{
+        messages: HistoryMessage[];
+        credentialRequests: CredentialRequestView[];
+    }>;
+    /** Never retry a credential action under a newly authenticated identity. */
+    credentialRequest(route: "credential-request" | "credential-request-handoff" | "credential-request-cancel", agent: string, conversationId: string, credentialRequestId: string, signal?: AbortSignal): Promise<CredentialRequestView | CredentialHandoff>;
     /**
      * Sends a request with the current session. A signed-in session the backend refuses (expired,
      * revoked, or another user signed in) is dropped and renewed once, as chat() does. An anonymous
@@ -260,6 +266,11 @@ declare class DeweeChatElement extends ElementBase {
     private messages;
     private running;
     private jobAccessLaunch;
+    private credentialCards;
+    private credentialGeneration;
+    private credentialBusy;
+    private credentialPopups;
+    private credentialRequestsInFlight;
     private activated;
     private probedPage;
     private strings;
@@ -365,6 +376,14 @@ declare class DeweeChatElement extends ElementBase {
     private switchAgent;
     private loadConversation;
     private renderLog;
+    private clearCredentials;
+    private closeCredentialPopup;
+    private discardCredential;
+    private credentialButton;
+    private renderCredential;
+    private updateCredential;
+    private openCredential;
+    private resumeCredential;
     private renderWelcome;
     private pushMessage;
     private renderMessage;

package/dist/index.js

@@ -7,8 +7,8 @@ import {
   defineDeweeChat,
   mount,
   renderMarkdown
-} from "./chunk-XCO4TCKF.js";
-import "./chunk-KXW4EWXA.js";
+} from "./chunk-OMRLBPEM.js";
+import "./chunk-4EASDTWO.js";
 export {
   ApiClient,
   ApiError,

package/dist/{protocol-BbjGSfZa.d.ts → protocol-DjEdC6QU.d.ts}

@@ -13,6 +13,34 @@ interface PageContextAttachment {
     };
 }
 
+/** A value-free, server-authorized credential request. Never accept form values here. */
+interface CredentialRequestView {
+    id: string;
+    schema_version: "webchat-credential-request.v1";
+    status: "pending" | "applying" | "resolved" | "cancelled" | "expired" | "failed";
+    title: string;
+    purpose: string;
+    target: {
+        type: string;
+        mode: string;
+    };
+    fields: Array<{
+        key: string;
+        label: string;
+        kind: string;
+        required: boolean;
+    }>;
+    expires_at: string;
+    agent_key: string;
+    completion: "hosted";
+    resumable: boolean;
+}
+interface CredentialHandoff {
+    credential_request_id: string;
+    url: string;
+    expires_at: string;
+}
+
 /** Server-Sent Events emitted by `POST {basePath}/chat`. */
 type ChatStreamEvent = {
     type: "start";
@@ -37,6 +65,9 @@ type ChatStreamEvent = {
     name: string;
     isError: boolean;
     result?: string;
+} | {
+    type: "credential_request";
+    credentialRequest: CredentialRequestView;
 } | {
     type: "done";
     content: string;
@@ -95,6 +126,8 @@ interface PublicConfig {
     pageContextVersions?: number[];
     /** Present (true) when the backend signs users in through Dewee: the widget then asks `/session` on every page load. */
     identity?: boolean;
+    /** Trusted origin of the hosted credential form, present only when explicitly enabled. */
+    credentialFormOrigin?: string;
     /**
      * Present (true) when a returning visitor's `/session` refresh (a valid anonymous `token` in the
      * body) needs no Turnstile token (ccp transport); only new visitors are challenged then. With
@@ -184,6 +217,7 @@ interface ChatRequestBody {
     pageContext?: unknown;
     /** Ephemeral, untrusted content for this turn; distinct from the legacy page-action context. */
     page_context?: PageContextAttachment;
+    credentialRequestId?: string;
 }
 
-export { type AgentInfo as A, type ChatStreamEvent as C, type ErrorBody as E, type HistoryMessage as H, type IdentityErrorCode as I, type LinkResponse as L, type PublicConfig as P, type Remediation as R, type SessionResponse as S, type ToolCallView as T, type ActionManifestEntry as a, type AdmissionErrorCode as b, ADMISSION_ERROR_CODES as c, type ActionSensitivity as d, type ChatRequestBody as e, type LinkTarget as f, type PageContextAttachment as g, isAdmissionErrorCode as i };
+export { type AgentInfo as A, type ChatStreamEvent as C, type ErrorBody as E, type HistoryMessage as H, type IdentityErrorCode as I, type LinkResponse as L, type PublicConfig as P, type Remediation as R, type SessionResponse as S, type ToolCallView as T, type ActionManifestEntry as a, type AdmissionErrorCode as b, ADMISSION_ERROR_CODES as c, type ActionSensitivity as d, type ChatRequestBody as e, type LinkTarget as f, type CredentialRequestView as g, type CredentialHandoff as h, isAdmissionErrorCode as i, type PageContextAttachment as j };

package/dist/react.d.ts

@@ -2,7 +2,7 @@ import * as react from 'react';
 import { CSSProperties } from 'react';
 import { DeweeChatConfig, ActionEventDetail, DeweeChatElement } from './index.js';
 export { ActionConfirmHook, DomActionsRoot, PageAction, PageActionContext, RequestHeadersOption } from './index.js';
-import './protocol-BbjGSfZa.js';
+import './protocol-DjEdC6QU.js';
 
 interface DeweeChatProps extends Partial<DeweeChatConfig> {
     className?: string;

package/dist/react.js

@@ -1,7 +1,7 @@
 import {
   defineDeweeChat
-} from "./chunk-XCO4TCKF.js";
-import "./chunk-KXW4EWXA.js";
+} from "./chunk-OMRLBPEM.js";
+import "./chunk-4EASDTWO.js";
 
 // src/react.ts
 import { createElement, forwardRef, useEffect, useImperativeHandle, useRef } from "react";

package/dist/server-identity.d.ts

@@ -1,5 +1,5 @@
-import { D as DeweeIdentitySdk } from './handler-SsDyK0TG.js';
-import './protocol-BbjGSfZa.js';
+import { D as DeweeIdentitySdk } from './handler-_GEhpm1W.js';
+import './protocol-DjEdC6QU.js';
 
 declare const deweeIdentitySdk: DeweeIdentitySdk;
 

package/dist/server.d.ts

@@ -1,7 +1,7 @@
-export { A as AuthenticatedUser, C as CcpError, a as CcpOptions, b as DeweeHandler, c as DeweeHandlerOptions, d as DeweeIdentityOptions, D as DeweeIdentitySdk, e as DeweeTransport, I as IdentityPrivateJwk, f as IdentitySessionStore, g as IdentitySigner, M as MemoryRateLimits, R as RateLimitBucket, h as RateLimiter, S as StoredIdentitySession, V as VisitorClaims, i as createDeweeHandler, m as memoryIdentitySessionStore, j as memoryRateLimiter, o as optionsFromEnv, s as signVisitorToken, v as verifyVisitorToken } from './handler-SsDyK0TG.js';
+export { A as AuthenticatedUser, C as CcpError, a as CcpOptions, b as DeweeHandler, c as DeweeHandlerOptions, d as DeweeIdentityOptions, D as DeweeIdentitySdk, e as DeweeTransport, I as IdentityPrivateJwk, f as IdentitySessionStore, g as IdentitySigner, M as MemoryRateLimits, R as RateLimitBucket, h as RateLimiter, S as StoredIdentitySession, V as VisitorClaims, i as createDeweeHandler, m as memoryIdentitySessionStore, j as memoryRateLimiter, o as optionsFromEnv, s as signVisitorToken, v as verifyVisitorToken } from './handler-_GEhpm1W.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { R as Remediation, H as HistoryMessage, A as AgentInfo, C as ChatStreamEvent, a as ActionManifestEntry, b as AdmissionErrorCode } from './protocol-BbjGSfZa.js';
-export { c as ADMISSION_ERROR_CODES, d as ActionSensitivity, e as ChatRequestBody, E as ErrorBody, I as IdentityErrorCode, L as LinkResponse, f as LinkTarget, P as PublicConfig, S as SessionResponse, i as isAdmissionErrorCode } from './protocol-BbjGSfZa.js';
+import { R as Remediation, H as HistoryMessage, A as AgentInfo, C as ChatStreamEvent, a as ActionManifestEntry, b as AdmissionErrorCode } from './protocol-DjEdC6QU.js';
+export { c as ADMISSION_ERROR_CODES, d as ActionSensitivity, e as ChatRequestBody, E as ErrorBody, I as IdentityErrorCode, L as LinkResponse, f as LinkTarget, P as PublicConfig, S as SessionResponse, i as isAdmissionErrorCode } from './protocol-DjEdC6QU.js';
 
 type FetchHandler = (request: Request) => Promise<Response>;
 /** Wraps a fetch-style handler for `http.createServer`, Express (`app.all("/api/dewee/*", ...)`), etc. */

package/dist/server.js

@@ -10,10 +10,12 @@ import {
   isAdmissionErrorCode,
   isIdentityErrorCode,
   normalizeManifest,
+  parseCredentialHandoff,
+  parseCredentialRequest,
   parseJobAccessLaunch,
   serializePageContext,
   stripPageBlock
-} from "./chunk-KXW4EWXA.js";
+} from "./chunk-4EASDTWO.js";
 
 // src/server/admission-errors.ts
 var MESSAGES = {
@@ -192,6 +194,9 @@ var GatewayConnection = class _GatewayConnection {
 function buildSessionKey(agent, conversationId) {
   return `agent:${agent}:ws:direct:${conversationId}`;
 }
+function credentialTool(name) {
+  return typeof name === "string" && /(?:^|__)request_credentials$/i.test(name);
+}
 function actorOf(opts) {
   if (opts.identitySession) return { identitySession: opts.identitySession };
   if (opts.userId) return opts.userId;
@@ -202,6 +207,8 @@ async function* streamChat(opts) {
   const queue = [];
   let wake = null;
   let finished = false;
+  const toolNames = /* @__PURE__ */ new Map();
+  const sensitiveToolIds = /* @__PURE__ */ new Set();
   const push = (e) => {
     queue.push(e);
     wake?.();
@@ -225,12 +232,21 @@ async function* streamChat(opts) {
       case "chunk":
         if (p.content) push({ type: "delta", text: p.content });
         break;
-      case "tool.call":
-        push({ type: "tool_call", id: p.id || "", name: p.name || "tool", arguments: p.arguments });
+      case "tool.call": {
+        const id = typeof p.id === "string" ? p.id : "";
+        const name = typeof p.name === "string" ? p.name : "";
+        if (id && credentialTool(name)) sensitiveToolIds.add(id);
+        if (id && name) toolNames.set(id, name);
+        if (name && !sensitiveToolIds.has(id) && !credentialTool(name)) push({ type: "tool_call", id, name, arguments: p.arguments });
         break;
-      case "tool.result":
-        push({ type: "tool_result", id: p.id || "", name: p.name || "tool", isError: !!p.is_error, result: clip(p.result ?? p.content) });
+      }
+      case "tool.result": {
+        const id = typeof p.id === "string" ? p.id : "";
+        const known = toolNames.get(id);
+        const name = typeof p.name === "string" && p.name ? p.name : known;
+        if (id && known && name === known && !sensitiveToolIds.has(id) && !credentialTool(name)) push({ type: "tool_result", id, name, isError: !!p.is_error, result: clip(p.result ?? p.content) });
         break;
+      }
       case "run.failed":
         push({ type: "error", message: p.error || p.message || "Agent run failed", code: "run_failed" });
         end();
@@ -288,6 +304,10 @@ async function fetchHistory(creds, actor, agent, sessionKey) {
 }
 function foldHistory(raw) {
   const out = [];
+  const sensitiveIds = /* @__PURE__ */ new Set();
+  for (const m of raw) for (const tc of Array.isArray(m?.tool_calls) ? m.tool_calls : []) {
+    if (credentialTool(tc?.name ?? tc?.function?.name) && typeof tc?.id === "string") sensitiveIds.add(tc.id);
+  }
   let current = null;
   for (const m of raw) {
     if (m.role === "user") {
@@ -303,12 +323,14 @@ function foldHistory(raw) {
 
 ${m.content}` : String(m.content);
       for (const tc of m.tool_calls ?? []) {
-        const view = { id: tc.id, name: tc.name ?? tc.function?.name ?? "tool", arguments: tc.arguments ?? tc.function?.arguments, status: "done" };
+        const name = tc.name ?? tc.function?.name;
+        if (typeof tc.id !== "string" || !tc.id || !name || sensitiveIds.has(tc.id) || credentialTool(name)) continue;
+        const view = { id: tc.id, name, arguments: tc.arguments ?? tc.function?.arguments, status: "done" };
         (current.toolCalls ??= []).push(view);
       }
     } else if (m.role === "tool" && current?.toolCalls) {
       const tc = current.toolCalls.find((t) => t.id === m.tool_call_id);
-      if (tc) {
+      if (typeof m.tool_call_id === "string" && m.tool_call_id && tc && !sensitiveIds.has(m.tool_call_id)) {
         tc.result = clip(m.content);
         if (m.is_error) {
           tc.isError = true;
@@ -642,6 +664,7 @@ var CcpClient = class {
     if (req.visitorIp && VISITOR_IP_RE.test(req.visitorIp)) headers["x-dewee-visitor-ip"] = req.visitorIp;
     if (req.requestId) headers["x-request-id"] = req.requestId;
     if (req.idempotencyKey) headers["idempotency-key"] = req.idempotencyKey;
+    if (req.credentialRequests) headers["x-dewee-webchat-features"] = "credential-requests";
     let res;
     try {
       res = await this.fetchImpl(url, {
@@ -893,6 +916,13 @@ function browserErrorFor(e, route) {
     if (e.code === "rate_limited" || e.code === "concurrency_limited" || e.status === 429) return { status: 429, code: "RATE_LIMITED", message: "", admission: "RATE_LIMITED", retryAfterMs };
   }
   switch (e.code) {
+    case "credential_requests_unavailable":
+      return { status: 403, code: e.code, message: "Credential requests are unavailable" };
+    case "credential_request_not_found":
+      return { status: 404, code: e.code, message: "Credential request not found" };
+    case "credential_request_not_ready":
+    case "credential_request_resumed":
+      return { status: 409, code: e.code, message: "Credential request cannot be resumed" };
     case "page_context_invalid":
       return { status: 400, code: e.code, message: "Invalid page context" };
     case "page_context_unsupported":
@@ -989,7 +1019,7 @@ function numericUsage(raw) {
   for (const [k, v] of Object.entries(raw).slice(0, 32)) if (typeof v === "number" && Number.isFinite(v) && /^[a-z0-9_]{1,64}$/i.test(k)) out[k] = v;
   return Object.keys(out).length ? out : void 0;
 }
-function createCcpTransport(client, identity) {
+function createCcpTransport(client, identity, credentialRequests = false) {
   let config;
   let pendingConfig;
   const edges = /* @__PURE__ */ new Map();
@@ -1066,16 +1096,17 @@ function createCcpTransport(client, identity) {
         conversation_id: input.conversationId,
         ...withAgent(input.agent),
         ...input.identitySession ? { identity_session: input.identitySession } : {},
-        ...input.pageContext !== void 0 ? { page_context: input.pageContext } : {}
+        ...input.pageContext !== void 0 ? { page_context: input.pageContext } : {},
+        ...input.credentialRequestId ? { credential_request_id: input.credentialRequestId } : {}
       };
-      return withEdge(ctx, visitorId, sealed, (edge) => client.send("chat", { ...base(ctx), body, session: edge.token, accept: "text/event-stream", signal: input.signal }));
+      return withEdge(ctx, visitorId, sealed, (edge) => client.send("chat", { ...base(ctx), body, session: edge.token, accept: "text/event-stream", signal: input.signal, credentialRequests: credentialRequests && !!input.identitySession }));
     },
     /**
      * Browser events of an accepted turn: exactly one `start` first and exactly one terminal event
      * (`done` or `error`) last. Reasoning and tool frames pass only when the integration shows them,
      * tool arguments and results never; unknown frames are dropped.
      */
-    async *chatEvents(res, cfg, conversationId, requestedAgent) {
+    async *chatEvents(res, cfg, conversationId, requestedAgent, verified = false) {
       let started = false;
       const start = (f) => {
         started = true;
@@ -1108,6 +1139,11 @@ function createCcpTransport(client, identity) {
           case "tool_result":
             if (cfg.showToolActivity && typeof f.id === "string" && typeof f.name === "string") yield { type: "tool_result", id: f.id.slice(0, 128), name: f.name.slice(0, 128), isError: f.isError === true };
             break;
+          case "credential_request": {
+            const view = credentialRequests && verified ? parseCredentialRequest(f.credential_request, requestedAgent) : null;
+            if (view) yield { type: "credential_request", credentialRequest: view };
+            break;
+          }
           case "done": {
             const usage = numericUsage(f.usage);
             yield { type: "done", content: typeof f.content === "string" ? f.content : "", ...usage ? { usage } : {} };
@@ -1145,9 +1181,9 @@ function createCcpTransport(client, identity) {
       };
       let data;
       try {
-        data = await withEdge(ctx, visitorId, sealed, (edge) => client.json("history", { ...base(ctx), body, session: edge.token }));
+        data = await withEdge(ctx, visitorId, sealed, (edge) => client.json("history", { ...base(ctx), body, session: edge.token, credentialRequests: credentialRequests && !!input.identitySession }));
       } catch (e) {
-        if (e instanceof CcpError && e.code === "not_found") return [];
+        if (e instanceof CcpError && e.code === "not_found") return { messages: [] };
         throw e;
       }
       const out = [];
@@ -1169,7 +1205,16 @@ function createCcpTransport(client, identity) {
         if (!msg.content && !msg.thinking && !msg.toolCalls) continue;
         out.push(msg);
       }
-      return out;
+      const cards = credentialRequests && input.identitySession && Array.isArray(data.credential_requests) ? data.credential_requests.slice(0, 100).map((view) => parseCredentialRequest(view, input.agent || cfg.defaultAgent)).filter((view) => view !== null) : [];
+      return { messages: out, ...cards.length ? { credentialRequests: cards } : {} };
+    },
+    async credentialRequest(ctx, visitorId, sealed, route, input) {
+      return withEdge(ctx, visitorId, sealed, (edge) => client.json(route, {
+        ...base(ctx),
+        session: edge.token,
+        credentialRequests: true,
+        body: { conversation_id: input.conversationId, credential_request_id: input.requestId, identity_session: input.identitySession, agent: input.agent }
+      }));
     },
     /**
      * Signs a partner assertion for `subject` and exchanges it at CCP for an identity session. `sealed`
@@ -1325,7 +1370,7 @@ async function verifyImageTicket(secret, namespace, ticket) {
     return null;
   }
 }
-function allowedImageSource(raw, prefixes, endpoint, cloudflare, publicAssets = []) {
+function allowedImageSource(raw, prefixes, endpoint, cloudflare, publicAssets = [], publicServices = []) {
   try {
     if (!raw || raw.length > 4096 || /[\u0000-\u0020\u007f\\]/.test(raw)) return null;
     const match = /^https:\/\/[^/?#]+([^?#]*)/i.exec(raw);
@@ -1339,7 +1384,8 @@ function allowedImageSource(raw, prefixes, endpoint, cloudflare, publicAssets =
       const suffix = endpoint.hostname.split(".").slice(-2).join(".");
       const sameZone = source.hostname === suffix || source.hostname.endsWith(`.${suffix}`);
       const isPublicAsset = source.origin === endpoint.origin && publicAssets.some((prefix) => source.pathname.startsWith(prefix));
-      if (sameZone && !isPublicAsset) return null;
+      const isPublicService = publicServices.some((prefix) => prefix.origin === source.origin && source.pathname.startsWith(prefix.pathname));
+      if (sameZone && !isPublicAsset && !isPublicService) return null;
     }
     return prefixes.some((prefix) => prefix.origin === source.origin && source.pathname.startsWith(prefix.pathname)) ? source : null;
   } catch {
@@ -1666,6 +1712,18 @@ function createDeweeHandler(options) {
     ...options
   };
   const transport = resolveTransport(o);
+  let credentialFormOrigin;
+  if (o.credentialRequests) {
+    if (transport !== "ccp" || !o.identity) throw new Error("[dewee-webchat] credentialRequests requires CCP transport and identity");
+    try {
+      if (typeof o.credentialRequests.formOrigin !== "string" || /[^\x21-\x7e]|[\\%]/.test(o.credentialRequests.formOrigin)) throw new Error();
+      const u = new URL(o.credentialRequests.formOrigin);
+      if (u.protocol !== "https:" || u.username || u.password || u.pathname !== "/" || u.search || u.hash) throw new Error();
+      credentialFormOrigin = u.origin;
+    } catch {
+      throw new Error("[dewee-webchat] credentialRequests.formOrigin must be an ASCII HTTPS origin (use punycode for internationalized domains)");
+    }
+  }
   if (o.imageSources !== void 0 && !Array.isArray(o.imageSources)) throw new Error("[dewee-webchat] imageSources must be an array");
   const imageSources = (o.imageSources ?? []).map((origin) => {
     let url;
@@ -1682,6 +1740,35 @@ function createDeweeHandler(options) {
     throw new Error("[dewee-webchat] Public image asset prefixes must be explicit absolute directory paths");
   }
   const assetPrefixes = publicAssets?.prefixes ?? [];
+  if (o.cloudflarePublicImageServices !== void 0 && (!Array.isArray(o.cloudflarePublicImageServices) || o.cloudflarePublicImageServices.length > 16)) {
+    throw new Error("[dewee-webchat] Public image services must be an array");
+  }
+  const publicServices = (o.cloudflarePublicImageServices ?? []).map((service) => {
+    if (!service || typeof service.id !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(service.id) || typeof service.binding?.fetch !== "function" || !Array.isArray(service.prefixes) || !service.prefixes.length) {
+      throw new Error("[dewee-webchat] Public image services require a binding and directory prefixes");
+    }
+    const prefixes = service.prefixes.map((raw) => {
+      let url;
+      if (typeof raw !== "string" || !/^https:\/\/[^/?#]+\/(?:[A-Za-z0-9_-]+\/)+$/.test(raw)) {
+        throw new Error("[dewee-webchat] Invalid public image service prefix");
+      }
+      try {
+        url = new URL(raw);
+      } catch {
+        throw new Error("[dewee-webchat] Invalid public image service prefix");
+      }
+      if (url.protocol !== "https:" || url.username || url.password || url.port || url.search || url.hash || !/^\/(?:[A-Za-z0-9_-]+\/)+$/.test(url.pathname)) {
+        throw new Error("[dewee-webchat] Public image service prefixes must be HTTPS origins with explicit directory paths");
+      }
+      return url;
+    });
+    return { id: service.id, binding: service.binding, prefixes };
+  });
+  const servicePrefixes = publicServices.flatMap((service) => service.prefixes);
+  if (new Set(publicServices.map((service) => service.id)).size !== publicServices.length || servicePrefixes.some((prefix, index) => servicePrefixes.slice(index + 1).some((other) => prefix.origin === other.origin && (prefix.pathname.startsWith(other.pathname) || other.pathname.startsWith(prefix.pathname))))) {
+    throw new Error("[dewee-webchat] Public image service ids and directory prefixes must not overlap");
+  }
+  const serviceFor = (source) => publicServices.find((service) => service.prefixes.some((prefix) => prefix.origin === source.origin && source.pathname.startsWith(prefix.pathname)));
   let activeImages = 0;
   const imageNamespace = `${o.ccp?.chatUrl ?? o.gatewayUrl ?? ""}
 ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
@@ -1703,7 +1790,8 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
   const identityAgent = idn ? checkIdentityOptions(o, staticAgents, transport) : "";
   const ccp = transport === "ccp" ? createCcpTransport(
     new CcpClient(parseCcpOptions(o.ccp)),
-    idn ? { createAssertion: (a) => idn.sdk.createAssertion(a), signer: () => identitySigner(), ttlSeconds: idn.sessionTtlSeconds } : void 0
+    idn ? { createAssertion: (a) => idn.sdk.createAssertion(a), signer: () => identitySigner(), ttlSeconds: idn.sessionTtlSeconds } : void 0,
+    !!credentialFormOrigin
   ) : null;
   function visitorContext(req) {
     const ip = clientIp(req);
@@ -2079,6 +2167,7 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
       ...o.turnstile ? { refreshWithoutTurnstile: true } : {},
       maxMessageLength: Math.min(o.maxMessageLength, cfg.maxMessageChars),
       ...cfg.pageContextVersions.length ? { pageContextVersions: cfg.pageContextVersions } : {},
+      ...credentialFormOrigin ? { credentialFormOrigin } : {},
       version: VERSION
     };
     if (idn) {
@@ -2180,7 +2269,19 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
     if (!input.body || typeof input.body !== "object" || Array.isArray(input.body)) return fail(req, 400, "Invalid request", "bad_request");
     const body = input.body;
     const message = typeof body?.message === "string" ? body.message.trim() : "";
-    if (!message) return fail(req, 400, "Message is required");
+    const resumeId = body?.credentialRequestId;
+    if (resumeId !== void 0) {
+      if (!ccp || !credentialFormOrigin || !claims.ids || typeof resumeId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(resumeId) || body.message !== void 0 && typeof body.message !== "string" || message || body?.actions != null || body?.pageContext != null || body?.page_context != null || typeof body?.conversationId !== "string" || !CCP_ID_RE.test(body.conversationId)) return fail(req, 400, "Invalid request", "bad_request");
+      try {
+        const origin = req.headers.get("origin");
+        const u = new URL(origin ?? "");
+        if (u.protocol !== "https:" || u.origin !== origin) throw new Error();
+      } catch {
+        return fail(req, 403, "Origin not allowed", "forbidden_origin");
+      }
+      const rebound = await rebindRefusal(req, claims, true);
+      if (rebound) return rebound;
+    } else if (!message) return fail(req, 400, "Message is required");
     if (message.length > o.maxMessageLength) return fail(req, 413, `Message exceeds ${o.maxMessageLength} characters`, "too_long");
     const idRe = ccp ? CCP_ID_RE : ID_RE;
     const conversationId = typeof body?.conversationId === "string" && idRe.test(body.conversationId) ? body.conversationId : randomId(9);
@@ -2202,7 +2303,7 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
       if (typeof body.page_context === "object" && Number.isInteger(body.page_context.version) && body.page_context.version !== 1) return fail(req, 400, "Page context is not supported", "page_context_unsupported");
       if (!validPageContext(body.page_context)) return fail(req, 400, "Invalid page context", "page_context_invalid");
     }
-    if (ccp) return ccpChat(req, claims, { message: pageBlock + message, rawMessage: message, conversationId, agent, actionsHash, pageContext: body?.page_context });
+    if (ccp) return ccpChat(req, claims, { message: pageBlock + message, rawMessage: message, conversationId, agent, actionsHash, pageContext: body?.page_context, credentialRequestId: resumeId });
     if (!creds) return fail(req, 500, "Gateway is not configured", "not_configured");
     let connection;
     if (claims.ids || body?.page_context != null) {
@@ -2317,6 +2418,7 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
         agent: turn.agent || void 0,
         identitySession: claims.ids,
         pageContext: turn.pageContext ?? void 0,
+        credentialRequestId: turn.credentialRequestId,
         signal: abort.signal
       });
     } catch (e) {
@@ -2349,7 +2451,7 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
       let errMsg;
       let agent = turn.agent || cfg.defaultAgent;
       try {
-        for await (const ev of ccp.chatEvents(upstream, cfg, turn.conversationId, agent)) {
+        for await (const ev of ccp.chatEvents(upstream, cfg, turn.conversationId, agent, !!claims.ids)) {
           if (ev.type === "start") {
             runId = ev.runId;
             agent = ev.agent;
@@ -2394,7 +2496,7 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
     return new Response(readable, {
       headers: {
         "content-type": "text/event-stream; charset=utf-8",
-        "cache-control": "no-cache, no-transform",
+        "cache-control": "no-store, no-transform",
         "x-accel-buffering": "no",
         ...corsHeaders(req)
       }
@@ -2408,8 +2510,8 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
     if (agent instanceof Response) return agent;
     if (!CCP_ID_RE.test(conversationId)) return json(req, { messages: [] });
     try {
-      const messages = await ccp.history(visitorContext(req), claims.v, sealedEdge(claims), { conversationId, agent: agent || void 0, identitySession: claims.ids });
-      return json(req, { messages });
+      const history = await ccp.history(visitorContext(req), claims.v, sealedEdge(claims), { conversationId, agent: agent || void 0, identitySession: claims.ids });
+      return json(req, history);
     } catch (e) {
       return ccpFail(req, e, "history", claims.ids);
     }
@@ -2470,6 +2572,43 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
       return fail(req, 502, "Job access is unavailable. Try again later.", "job_access_unavailable");
     }
   }
+  async function handleCredentialRequest(req, route) {
+    if (!ccp || !credentialFormOrigin || !idn) return fail(req, 404, "Not found", "not_found");
+    const origin = req.headers.get("origin");
+    try {
+      const u = new URL(origin ?? "");
+      if (u.protocol !== "https:" || u.origin !== origin) throw new Error();
+    } catch {
+      return fail(req, 403, "Origin not allowed", "forbidden_origin");
+    }
+    const claims = await visitorFrom(req);
+    if (!claims?.ids || !claims.ida) return identityFail(req, "IDENTITY_REQUIRED");
+    const refused = await rebindRefusal(req, claims, true);
+    if (refused) return refused;
+    if (limiter && !await limiter(`credential:${claims.v}`, route === "credential-request-handoff" ? "link" : "preauth")) return fail(req, 429, "Too many requests", "rate_limited");
+    const raw = await readImageTicketBody(req);
+    let body;
+    try {
+      body = raw && JSON.parse(raw);
+    } catch {
+      return fail(req, 400, "Invalid request", "bad_request");
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body) || Object.keys(body).some((key) => !["conversationId", "credentialRequestId", "agent"].includes(key)) || typeof body.conversationId !== "string" || !CCP_ID_RE.test(body.conversationId) || typeof body.credentialRequestId !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(body.credentialRequestId)) return fail(req, 400, "Invalid request", "bad_request");
+    const agent = ccpAgentFor(req, claims, body.agent);
+    if (agent instanceof Response) return agent;
+    if (!agent) return fail(req, 403, "Agent not allowed", "agent_not_allowed");
+    try {
+      const result = await ccp.credentialRequest(visitorContext(req), claims.v, sealedEdge(claims), route, { conversationId: body.conversationId, requestId: body.credentialRequestId, agent, identitySession: claims.ids });
+      if (route === "credential-request-handoff") {
+        const handoff = parseCredentialHandoff(result, body.credentialRequestId, credentialFormOrigin);
+        return handoff ? json(req, handoff) : fail(req, 502, "Credential request is unavailable", "credential_request_unavailable");
+      }
+      const view = parseCredentialRequest(result?.credential_request, agent);
+      return view && view.id === body.credentialRequestId ? json(req, { credentialRequest: view }) : fail(req, 502, "Credential request is unavailable", "credential_request_unavailable");
+    } catch (e) {
+      return ccpFail(req, e, route, claims.ids);
+    }
+  }
   async function handleLink(req) {
     const claims = await visitorFrom(req);
     if (!claims?.ids) return identityFail(req, "IDENTITY_REQUIRED");
@@ -2552,32 +2691,43 @@ ${o.ccp?.integrationId ?? o.tenantId ?? ""}`;
         }
         const raw = parsed?.url;
         const worker = globalThis.navigator?.userAgent === "Cloudflare-Workers";
-        const source = typeof raw === "string" ? allowedImageSource(raw, imageSources, new URL(req.url), worker, worker ? assetPrefixes : []) : null;
+        const source = typeof raw === "string" ? allowedImageSource(raw, imageSources, new URL(req.url), worker, worker ? assetPrefixes : [], worker ? servicePrefixes : []) : null;
         if (!source) return fail(req, 403, "Image not allowed", "forbidden_image");
         const endpoint = new URL(req.url);
         const asset = publicAssets && source.origin === endpoint.origin && assetPrefixes.some((prefix) => source.pathname.startsWith(prefix));
+        const service = asset ? void 0 : serviceFor(source);
         const namespace = asset ? `${imageNamespace}
-assets:${endpoint.origin}` : imageNamespace;
-        return json(req, { ticket: await issueImageTicket(secret, namespace, claims.v, source.href) });
+assets:${endpoint.origin}` : service ? `${imageNamespace}
+service:${endpoint.origin}:${service.id}` : imageNamespace;
+        const ticket = await issueImageTicket(secret, namespace, claims.v, source.href);
+        return json(req, { ticket: service ? `s.${service.id}.${ticket}` : ticket });
       }
       if (req.method === "GET" && action === "image" && imageSources.length) {
         const ticket = new URL(req.url).searchParams.get("ticket") ?? "";
         const endpoint = new URL(req.url);
-        const assetClaims = await verifyImageTicket(secret, `${imageNamespace}
+        const tagged = /^s\.([A-Za-z0-9_-]{1,64})\.([A-Za-z0-9_-]{1,8192})$/.exec(ticket);
+        const serviceId = tagged?.[1];
+        if (serviceId && !publicServices.some((service2) => service2.id === serviceId)) return fail(req, 401, "Image ticket expired", "unauthorized");
+        const serviceClaims = tagged ? await verifyImageTicket(secret, `${imageNamespace}
+service:${endpoint.origin}:${serviceId}`, tagged[2]) : null;
+        const assetClaims = tagged ? null : await verifyImageTicket(secret, `${imageNamespace}
 assets:${endpoint.origin}`, ticket);
-        const claims = assetClaims ?? await verifyImageTicket(secret, imageNamespace, ticket);
+        const claims = tagged ? serviceClaims : assetClaims ?? await verifyImageTicket(secret, imageNamespace, ticket);
         if (!claims) return fail(req, 401, "Image ticket expired", "unauthorized");
         const worker = globalThis.navigator?.userAgent === "Cloudflare-Workers";
-        const source = allowedImageSource(claims.source, imageSources, endpoint, worker, worker ? assetPrefixes : []);
+        const source = allowedImageSource(claims.source, imageSources, endpoint, worker, worker ? assetPrefixes : [], worker ? servicePrefixes : []);
         if (!source) return fail(req, 403, "Image not allowed", "forbidden_image");
         const asset = publicAssets && source.origin === endpoint.origin && assetPrefixes.some((prefix) => source.pathname.startsWith(prefix));
         if (Boolean(asset) !== Boolean(assetClaims)) return fail(req, 403, "Image not allowed", "forbidden_image");
+        const service = asset ? void 0 : serviceFor(source);
+        if (service?.id !== serviceId) return fail(req, 403, "Image not allowed", "forbidden_image");
         if (limiter && !await limiter(`image:${claims.visitor}`, "preauth")) return fail(req, 429, "Too many requests, try again later", "rate_limited");
         if (activeImages >= 8) return fail(req, 429, "Too many requests, try again later", "rate_limited");
         activeImages++;
         try {
           const assetFetch = (input, init) => publicAssets.binding.fetch(new Request(new URL(new URL(String(input)).pathname, "https://assets.invalid"), init));
-          const result = await fetchRasterImage(source.href, asset ? assetFetch : worker ? globalThis.fetch : publicImageFetchNode, worker ? "manual" : "error");
+          const serviceFetch = (input, init) => service.binding.fetch(new Request(new URL(new URL(String(input)).pathname, "https://public-images.invalid"), init));
+          const result = await fetchRasterImage(source.href, asset ? assetFetch : service ? serviceFetch : worker ? globalThis.fetch : publicImageFetchNode, worker || service ? "manual" : "error");
           return result ?? fail(req, 502, "Image unavailable", "image_unavailable");
         } finally {
           activeImages--;
@@ -2589,6 +2739,7 @@ assets:${endpoint.origin}`, ticket);
       if (req.method === "GET" && action === "history") return await handleHistory(req);
       if (req.method === "POST" && action === "link" && idn) return await handleLink(req);
       if (req.method === "POST" && action === "job-access" && idn) return await handleJobAccess(req);
+      if (req.method === "POST" && (action === "credential-request" || action === "credential-request-handoff" || action === "credential-request-cancel")) return await handleCredentialRequest(req, action);
       return fail(req, 404, "Not found", "not_found");
     } catch (e) {
       if (e instanceof IdentityStoreError) return identityFail(req, "SOURCE_UNAVAILABLE", { action: "retry_later", audience: "end_user" });