frontpage-host 0.2.1 → 0.2.2

package/CUSTOMER-INBOX.md

@@ -60,7 +60,7 @@ Lock a knowledge note with `locked:true`. The support agent cannot change locked
 | --- | --- | --- |
 | `conversations` | GET | Paginated list; `?limit=50&after=<id>` |
 | `conversations/<id>` | GET | Thread and latest public message |
-| `conversations/<id>/messages` | GET | `?after=0&limit=50&audience=all`; viewers get public history only |
+| `conversations/<id>/messages` | GET | `?timeline=true&limit=50&audience=all`; follow the returned message-ID `nextCursor` with `after`; viewers get public history only |
 | `conversations/<id>/routing` | GET | Current handler/version, People link and delivery states |
 | `conversations/<id>/reply` | POST | `{"text":"Tuesday at 6:30 works. Keep staffing private.","handlerVersion":0,"privateGuidance":true}` |
 | `conversations/<id>/control` | POST | `{"action":"takeover","handlerVersion":0}` or `{"action":"return","handlerVersion":1}` |
@@ -68,6 +68,10 @@ Lock a knowledge note with `locked:true`. The support agent cannot change locked
 | `files?messageId=<id>` | GET | Bound message files; editor/admin only |
 | `files/<id>` | GET | Short-lived download grant; editor/admin only |
 
+One verified customer has one continuous thread per site, across direct email, replies and verified website chat. Email subject changes do not create new cases. Closing reopens that same thread on the next message; Trash needs owner restoration. Inbox joins retained history without moving messages, files or paid receipts. Old conversation links and recipient-bound reply addresses resolve to the current thread. Public chat includes customer-visible email replies and excludes owner guidance and notes.
+
+Use `timeline=true` for combined history. Its opaque `nextCursor` is a message ID, not a sequence or offset; pass it unchanged as `after` or `before`. `latest=true` returns the latest bounded page, and `before=<cursor>` loads older messages. A cursor must belong to that conversation and audience. Sequence-based reads without `timeline=true` remain available for the root segment; use the combined timeline for every linked segment. The CLI export follows the complete combined timeline. The widget opens the latest 50 public messages and offers **Load earlier messages**, so a returning customer does not wait for years of history to download. The support agent's `history_read` tool likewise follows its returned `nextBefore` message ID.
+
 Private guidance stays in the same internal thread. The agent asks by a private email and stores its question in the history. Replying by email or UI gives context and leaves the agent responsible for the customer. The agent uses that context to answer and can update unlocked internal knowledge.
 
 General owner facts, such as support hours and standard policies, update related unlocked knowledge without an explicit save request. One-time customer exceptions and private staffing details stay in the conversation. The agent reads the full note and records verified evidence before changing it. Late private guidance can still update knowledge after the customer has an answer; that work cannot send a duplicate customer reply. Locks, manual handling, paused automation and work limits still apply.
@@ -178,12 +182,14 @@ const identity = encoded + "." + createHmac("sha256", process.env.INBOX_IDENTITY
 
 The service verifies the signature, site, origin and expiry. Assertions can last at most five minutes. They grant customer identity only, never owner or manager authority. Every app-session request must include the current signed identity matching that session's subject and email. Put a server-rendered assertion in `data-identity`, or preferably provide `data-identity-url="/api/support-identity"`. That same-origin HTTPS endpoint authenticates the current app user and returns `{"identity":"<signed assertion>"}`. The widget refreshes it; after logout or account changes, old app sessions cannot be read without the matching identity. Anonymous widgets need no assertion. Each approved origin has its own visitor session; email continues the bound conversation.
 
-Browser access lasts 30 days from creation or successful email verification/recovery. Verification links last one hour and work once; confirming rotates the credential. The widget retains access in that browser's storage and keeps it through temporary network failures. Returning browsers with valid access reopen their history automatically. When access is missing, the ordinary **Continue** and email-confirmation flow can reconnect an empty replacement session to the latest open conversation with a matching verified email on that same website origin. A typed email alone never restores history. Nonempty conversations remain separate; revoked access and authenticated app identities cannot use this path. The developer recovery endpoint remains available, but customers do not need a separate Recover workflow. Email continuation uses an inline email field. An empty unverified saved session with an email requests confirmation automatically; a stable receipt prevents reloads from sending duplicate emails.
+Browser access lasts 30 days from creation or successful email verification/recovery. Verification links last one hour and work once; confirming rotates the credential. The widget retains access in that browser's storage and keeps it through temporary network failures. Returning browsers with valid access reopen their history automatically. When access is missing, ordinary **Continue** and email confirmation select the verified customer's continuous public-support conversation for that site. Both empty and nonempty provisional chats join only after proof; approved public origins can share the customer history through their own verified sessions. Typed email never restores history. Revoked credentials remain revoked; fresh proof does not reactivate an old token. Signed app identities remain separate by site, origin and subject. The recovery endpoint remains available, but customers need no separate Recover workflow. An empty unverified saved session with an email requests confirmation automatically; a receipt prevents duplicate requests during the link's one-hour lifetime, then rotates so an expired link cannot block a fresh confirmation.
 
 The same conversation's customer-visible email and chat messages load together, including owner replies relayed through Inbox. They stay stored after browser access expires. Private guidance, internal notes and system notices never enter that public history. Recovery restores access to the saved conversation rather than starting its history over.
 
 ## Conversation state, exports and shared usage
 
+Use `frontpage-host` 0.2.2 or later to export every linked history segment through message-ID cursors. Update with `npm install -g frontpage-host@latest`.
+
 | Resource | Method | Body or behavior |
 | --- | --- | --- |
 | `conversations?state=active` | GET | Open threads; also `closed`, `trash` or `all` |
@@ -237,6 +243,8 @@ The support agent has its own system prompt plus the versioned private business
 | `wait` | `reason` | Pause safely without sending. |
 | `finish` | None | Complete this bounded job. |
 
+Read tools can run in one batch. Inbox defers `reply_customer`, `ask_owner`, `wait` and `finish` when the model requests them alongside other tools, so it observes the results before taking a terminal action. This does not change business permissions or allow extra work beyond the existing budget and step limits.
+
 Decisions screens malicious customer input and interprets authenticated owner-email intent. It never chooses IDs, recipients, permissions, business answers, support tools or knowledge changes. Owner intent uses bounded labeled context, one primary Luna call, at most one bounded same-Luna control fallback, and the same exact-token, raw-cost, 10× ledger receipt as support. Shared inference utilities provide the existing same-model credential/transport fallback; no expensive model substitution or customer model picker is added.
 
 The installed widget loads two public static scripts: `/customer-inbox/widget.js` and `/customer-inbox/view.js` on `https://app.frontpage.host`. The shared renderer contains no session, owner data or credentials. If your app sets a Content Security Policy, allow those script URLs and connections to `https://frontpage-inbox-api.fly.dev`; keep the existing widget origin and identity checks. Owner Inbox pages remain authenticated.

package/dist/commands/customer-inbox.js

@@ -49,7 +49,7 @@ export async function runCustomerInbox(args) {
                 const prefix = `/api/v1/sites/${encodeURIComponent(slug)}/customer-inbox`;
                 if (operation.method === "DOWNLOAD") {
                     const record = await v1Get(`${prefix}/files/${operation.resource}`);
-                    const response = await fetch(record.data.downloadUrl, {
+                    const response = await fetch(record.downloadUrl, {
                         redirect: "error",
                         signal: AbortSignal.timeout(60000),
                     });
@@ -64,25 +64,25 @@ export async function runCustomerInbox(args) {
                 }
                 else {
                     const conversation = await v1Get(`${prefix}/conversations/${operation.resource}`);
-                    await handle.writeFile(JSON.stringify({ type: "conversation", value: conversation.data }) +
+                    await handle.writeFile(JSON.stringify({ type: "conversation", value: conversation }) +
                         "\n");
-                    let cursor = 0;
+                    let cursor = null;
                     for (;;) {
-                        const page = await v1Get(`${prefix}/conversations/${operation.resource}/messages?after=${cursor}&limit=100&audience=all`);
-                        for (const message of page.data.messages) {
+                        const page = await v1Get(`${prefix}/conversations/${operation.resource}/messages?timeline=true&limit=100&audience=all${cursor ? `&after=${cursor}` : ""}`);
+                        for (const message of page.messages) {
                             const attachments = await v1Get(`${prefix}/files?messageId=${message.id}`);
                             await handle.writeFile(JSON.stringify({
                                 type: "message",
                                 value: message,
-                                attachments: attachments.data,
+                                attachments,
                             }) + "\n");
                             count++;
                         }
-                        if (page.data.nextCursor === null)
+                        if (page.nextCursor === null)
                             break;
-                        if (page.data.nextCursor <= cursor)
+                        if (page.nextCursor === cursor)
                             throw new Error("History cursor did not advance.");
-                        cursor = page.data.nextCursor;
+                        cursor = page.nextCursor;
                     }
                 }
                 await handle.sync();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontpage-host",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Frontpage CLI — manage your site from the terminal",
   "type": "module",
   "bin": {