# @oxpulse/chat-widget — Changelog ## 0.24.2 ### Patch Changes - 3c3885e: fix(sdk): flushOutbox in-flight guard + reconnect flush debounce flushOutbox had no "already running" flag. Two concurrent calls — mount racing a reconnect, or two reconnects — both read the same pending list and both send the same entries (wasted requests, server-deduplicated on msgId). There was also no debounce on the reconnect trigger, so N pending entries over M reconnects was N×M requests. SDK: a per-room in-flight guard (`#flushInFlight` Set) makes a second concurrent `flushOutbox(roomId)` return immediately while the first is still running. "Return immediately" (not "wait") because the widget calls fire-and-forget. The cost of that choice, stated precisely: an entry enqueued AFTER the running flush read its pending list is not picked up by that flush, and the dropped call would have been the one to take it — so it waits for the next reconnect or mount. Nothing is lost; delivery is deferred. The guard releases in a `finally`, on every exit path. Today no exit path can throw: a send rejection is caught inside the loop, and every outbox helper swallows its own error and degrades instead. The `finally` is defence-in-depth for a future where one of them propagates, since a latched guard would be invisible (the widget's caller swallows the rejection) and would kill that room's outbox for the page's lifetime. A test pins the no-reject invariant it rests on. The guard is SEPARATE from `#serializeSend` — feeding a background bulk retry into the foreground serial chain would park the user's next message behind the whole outbox queue (#258's head-of-line problem by another door). Widget: a 500ms debounce on the reconnect-triggered flush collapses rapid reconnects on a flaky network into one flush. The debounce lives in the widget (not the SDK) because the reconnect is a widget concept (Reconnector), and `flushOutbox` is a public SDK method with immediate semantics — a debounce there would change its contract for every caller. The mount trigger is not debounced: it fires once per mount cycle, and a live element can mount more than once (attribute change, token refresh, anon-token re-mint). It needs no debounce because each cycle aborts the previous one, and the SDK's in-flight guard covers a flush still running from the cycle before. Closes #263. - Updated dependencies [3c3885e] - @oxpulse/chat-sdk@3.3.1 ## 0.24.1 ### Patch Changes - 1aa4701: Require a positive plaintext mode before the attachment upload path presigns. The widget's direct-upload path (presignAttachment + PUT, bypassing sendFile) called `assertRoomNotPoisoned` before presign — but that gate only asserts "this room was not PROVEN wrong." It cannot tell a room whose `crypto_mode` is genuinely known from one whose `list()`/`subscribe()` response has not yet arrived. Between mount and that first response the room is neither poisoned nor known, and not-poisoned alone was treated as sufficient — so a plaintext attachment envelope could upload and send into a room the server considers E2EE, silently, with no error on either side. `@oxpulse/chat-sdk` gains a public `getRoomCryptoMode(roomId)` accessor — the smallest seam matching how `assertRoomNotPoisoned` is exposed — so the widget can read the same authoritative `#activeCryptoModeByRoom` the internal gates read. No existing public accessor for the discovered mode existed; a new seam was necessary because `#activeCryptoModeByRoom` is private and the widget must require a POSITIVE plaintext mode, not merely the absence of poison. `@oxpulse/chat-widget` now requires `getRoomCryptoMode(roomId) === 'plaintext'` (positively discovered) before presign, alongside the existing poison check. The error is `crypto_mode_undiscovered` (distinguishable from `crypto_mode_poisoned`: the latter is never retriable, the former is retriable the moment discovery lands) and fires before any outbox entry is created, so `PERMANENT_OUTBOX_FAILURE_CODES` is untouched. The attachment-picker catch path surfaces it as a per-card error with a retry button — the softer composer state — appropriate for a window that closes on its own within ~1s of mount. Closes #259. - 02c64c5: Pressing retry on a failed message no longer queues a second copy alongside it. A send that exhausts its retries deliberately stays queued in the outbox, so a later flushOutbox can still deliver it. The widget's retry button restores the caption to the composer and the user re-picks the attachment, which mints a new msgId — so the original entry was still queued alongside it and the next flush sent both. One user intent, two messages in the room, with no error, counter or log to show for it. Retry now dequeues the original entry first, matching what TDLib and GetStream do. Reusing the msgId instead would be worse here: the user re-picks the attachment, so the content can differ, and the server's dedup would keep the original and silently discard what the user just chose. Scope, stated precisely: this removes the queued duplicate. It does not cancel a send already in flight. flushOutbox calls send() directly rather than through the per-room serial chain, and dequeuing an entry from storage does not stop a request that has already left — so a retry pressed while a background flush is mid-send of the same entry can still produce two messages. That window needs flushOutbox's in-flight guard (#263) to close, and is not claimed here. The failed bubble stays visible after retry, unchanged — it is the only evidence of the lost message until the user has re-staged the attachment. - Updated dependencies [1aa4701] - @oxpulse/chat-sdk@3.3.0 ## 0.24.0 ### Minor Changes - 1081d04: Report the loss of outbox durability instead of degrading in silence. Every storage operation in the outbox caught its own failure and returned as if nothing had happened. The send still went out, so the message was not lost — but retry-after-reload was, and the caller had no way to learn it. On Safari private browsing, under storage-pressure eviction, or with site data blocked, the SDK promised durability it was not providing and said nothing. `@oxpulse/chat-sdk` gains `isOutboxDurable()` and `onOutboxDegraded(fn)`, plus the `OutboxDegradation` and `OutboxOp` types. The signal latches on the first storage failure and replays to late subscribers, so a consumer that subscribes after the failure still learns about it. `@oxpulse/chat-widget` surfaces it as a new `WidgetErrorCode`, `OUTBOX_UNAVAILABLE`, on the existing `oxpulse-chat:error` event and `onError` callback — a degradation notice, not a delivery failure. `WidgetError` gains `outboxOp`, naming the storage operation that failed, so an integrator reads a field instead of parsing the message string. Fired at most once per widget instance. Closes #261. ### Patch Changes - Updated dependencies [1081d04] - @oxpulse/chat-sdk@3.2.0 ## 0.23.0 ### Minor Changes - 70fe423: Fix SDKCatalogClient wire contract to match the finalized server DTOs (#195), rebuild the synthetic-green catalog tests against real server shapes (#198), and make `ProductMeta.price` a JSON number (#207, SDK half). - #195: request bodies are now snake_case (`{ product_ref, product_meta }` for create, `{ product_meta }` for update) — the server rejects camelCase keys. Responses are mapped snake→camel via a `dtoToCatalogProduct` mapper that reuses the rooms-boundary `normalizeProductMeta` (client.ts) instead of blind `as unknown as CatalogProduct` casts that left `productRef` / `createdAt` / `archivedAt` undefined. - `listProducts` now accepts `{ limit?, cursor?, signal? }` and returns `{ products, hasMore, nextCursor }` mapped from the `{ products, has_more, next_cursor }` envelope (cursor-based pagination). A malformed-cursor 400 maps to `validation_error`. - #207: `ProductMeta.price` is now `number` (non-negative JSON number), not a host-pre-formatted display string. Callers own locale-aware formatting at render time. - #198: `catalog.test.ts` rewritten to real snake_case mock payloads with numeric `price`, asserting the request body is snake_case and the response mapping populates camelCase fields. **Breaking (@oxpulse/chat-widget):** `ProductMeta.price` is now `number`, not a host-pre-formatted string. This also changes the shared render-boundary `normalizeProductMeta`, which now rejects a string `price` — so a product-card message from an older client that sends a string price is dropped on receive. See the wire-compat note tracked separately. Note: `price: string → number` and the `listProducts` return-shape change are breaking for consumers of the catalog API; they land within the same unreleased minor as the original `SDKCatalogClient` export (#193), which never shipped a correct form. Closes #195. Closes #198. Closes #207. - 70fe423: ProductPicker UX polish + numeric-price display (Batch C). - #207: the picker item price span and the W9 product-card message now format the numeric `price` via `Intl.NumberFormat(locale, { style: 'currency', currency })` (new `formatPrice` helper in utils/i18n.ts) instead of the raw `${price} ${currency}` string coercion ("19.99 USD"). Graceful fallback to the raw number when `currency` is not a valid ISO-4217 code. - #199: `ProductPicker.#loadProducts` no longer short-circuits on `#allProducts.length > 0` — the Composer reuses one picker instance across opens, so the cached first page froze the list for the widget lifetime (stale after add/edit/delete). Products are refetched on every `show()`; only the in-flight `#loading` guard remains. - #200: `aria-live="polite"` is now set once on the stable list container in `#buildPicker` (not per-branch on fresh child nodes), so loading / error / empty / result-count transitions all announce to assistive tech (WCAG 2.2 SC 4.1.3). - #205: missing `productMeta.title` falls back to a localized `productPickerUntitled` key (en/ru) instead of rendering the literal string "undefined"; the price span is omitted entirely when price/currency are absent. The search filter guards against a missing title. - #204: ArrowDown/ArrowUp keydown handler on the search input (where focus lands on open) forwards to the first / last item button — arrow-key nav is no longer dead until an item is focused. - #201: verified already fixed — `aria-label='Product list'` is routed through `t('productPickerList', lang)` (landed in a prior commit). Closes #199. Closes #200. Closes #202. Closes #204. Closes #205. Closes #207. - 70fe423: Add ProductPicker — searchable dropdown for the seller product catalog. New export: `ProductPicker` class (mirrors EmojiPicker pattern). - Fetches products via `SDKCatalogClient.listProducts()` - Search filter by title/productRef - Arrow key navigation, Escape to close, outside-click dismissal - Loading / empty / error states - A11y: role="dialog", aria-modal, focus trap, aria-label Composer wiring: - New `catalogClient` option on `ComposerOptions` — when present, shows a product picker button in the toolbar - onSelect → `composer.setProductCard(ref, meta)` → existing product-card chip → attached to next outgoing message Widget wiring (#196 — was dead code end-to-end): - New opt-in `seller-catalog` attribute / `sellerCatalog` config option (boolean, default OFF — backward compatible). When ON, the widget constructs an `SDKCatalogClient` from the SAME `jwt` + `base-url` it already uses for its main SDK client and passes it as `catalogClient` to the `Composer`, so the product-picker toolbar button renders. Without the flag, no catalog client is constructed and behaviour is unchanged. ProductPicker + button styles (#197 — previously zero CSS): - `.oxp-product-picker` block in theme.ts mirroring `.oxp-emoji-picker` (container surface/border/radius/shadow, search input, flex list items with `justify-content: space-between` + `text-overflow: ellipsis` so the title and price don't collide, `:hover`/`:focus-visible` rings, styled loading/error/empty states). - `.oxp-composer-product-btn` mirroring `.oxp-composer-emoji-btn`. Closes #194. Closes #196. Closes #197. ### Patch Changes - 70fe423: Seller-catalog SDK — Batch D (final cleanup): shared picker-dismiss helper (#203) + LOW-severity hardening batch (#206). - #203 (reuse): extract `useFloatingDismiss(pickerEl, anchorEl, { onHide, getRestoreFocusEl, signal })` into `utils/floating-dismiss.ts`. EmojiPicker and ProductPicker shared ~60 byte-identical lines of outside-pointerdown dismiss + Escape/Tab focus-trap (same `'input, button:not([disabled])'` selector + shift-tab wrap) + abort-signal wiring, alongside the already-shared `computeFloatingPosition`. Both pickers now call the single helper. Behavior is identical — every existing emoji-picker AND product-picker test (dismiss / focus-trap / escape / outside-click / abort) stays green. - #206a: `catalog.ts` error switch adds an explicit `422 → validation_error` case (a 422 validation error previously fell to `default → server_4xx`, mislabeling it); and `resp.json()` on a 2xx body is guarded so an empty 2xx body returns `null` instead of throwing a raw `SyntaxError` that escapes the `SDKCatalogError` wrapper. - #206b: `SDKCatalogClient` constructor warns (defense-in-depth, non-breaking) when an absolute `baseUrl`'s scheme is not `https:` — the JWT rides as `Authorization: Bearer ` and an `http://` absolute baseUrl leaks it in cleartext (passive MITM). Empty / relative / localhost / 127.0.0.1 baseUrls are allowed (dev + same-origin). - #206c: `product-picker.ts` sets `aria-selected="false"` on each rendered `role="option"` item and flips the keyboard-focused item to `"true"` (listbox APG expectation). Skipped (out of this batch, tracked separately in #206): authoring DESIGN.md; the repo-wide `assertRawJwt` bearer-prefix dedup (11th copy — systemic); the `httpStatusToCode` generalization (deferred until a 3rd `SDK*Client` mapper appears). - Updated dependencies [70fe423] - Updated dependencies [70fe423] - Updated dependencies [70fe423] - Updated dependencies [b974a80] - @oxpulse/chat-sdk@3.1.0 ## 0.22.1 ### Patch Changes - 1de9324: fix(chat-widget): validate refreshed JWT aud_origins in iframe mode (W2.2) applyRefreshedToken in iframe.ts now re-validates the refreshed JWT against the live session before swapping: 1. Decodes the new JWT (rejects malformed / expired tokens). 2. Compares aud_origins set against the original token's set (order-insensitive). Rejects if they differ — prevents a crafted refresh-token from silently re-scoping the session. On validation failure, the live session is left untouched and an error is relayed to the parent via postMessage. ## 0.22.0 ### Minor Changes - 0038931: feat(chat-widget): pinned messages banner with carousel, pin/unpin action, and tap-to-scroll Implements the UI layer for pinned messages on top of the existing SDK pinMessage/unpinMessage/listPins API and the op:"pin"|"unpin" SSE mutation events: - PinnedBanner (ui/pinned-banner.ts): a new zero-dependency UI module mounted above the message list. Shows the current pinned message with preview text + "Pinned by {name}" meta. Carousel navigation when >1 pin. Close button dismisses; a new pin re-shows. Preview text is resolved from the already-decrypted MessageList.#rows store (E2EE-consistent; off-window pins show a "Message not loaded" placeholder). - SSE pin/unpin handling (#229): MessageList.#handleMutation now handles op:"pin"/op:"unpin" (was silently dropped). The pinnedBy field is forwarded through the element.ts SDK-to-widget bridge. The reconnect subscribeFn now wires onMutation (was undefined). - Initial load (#230): listPins() is called on room mount to hydrate the banner with pre-existing pins. - Pin/unpin action (#231): a pin button is added to each bubble footer, feature-detected on client.pinMessage/client.unpinMessage. Optimistic update + rollback on error. - Tap-to-scroll (#232): clicking a pinned message preview scrolls to the source message and briefly highlights it. - i18n (#235): 10 new keys for en + ru. Closes #228, #229, #230, #231, #232, #233, #235. ## 0.21.2 ### Patch Changes - f6d30b1: fix(chat-widget): drop the regex lookbehind that made the bundle unparseable on WebKit `ITALIC_RE` used a negative lookbehind for its Unicode word-boundary guard. A regex literal is parsed when the module is parsed, before any of its code runs, so on an engine without lookbehind support this was not a degraded markdown renderer — it was a `SyntaxError` that aborted evaluation of the entire bundle. The custom element never registered and every embed silently rendered nothing. Lookbehind reached WebKit only in Safari 16.4, and every browser on iOS is WebKit whatever its name, so this took the widget off all older iPhones and older macOS Safari at once, with no console output beyond the parse error. The guard is now a captured group re-emitted by the replacement, which keeps the original behaviour: `_italic_` still renders, and Latin or Cyrillic `snake_case` identifiers are still left alone. Adds `src/__tests__/browser-syntax.test.ts`, which fails if a lookbehind appears anywhere under `src/` — verified to go red against the previous regex. ## 0.21.1 ### Patch Changes - b4e2266: Gate the attachment-upload path on the poisoned-room fail-closed check (SEC-CR-001). `SDKChatClient#assertRoomNotPoisoned` already refuses `send`/`sendText`/`sendFile` for a room poisoned by a prior `crypto_mode_mismatch` (a downgrade tripwire), so no message content leaves a poisoned room. But the widget's direct-upload path (`uploadAttachment` → `presignAttachment` + a raw PUT, which deliberately bypasses `sendFile()` to keep the presigned `attachmentId` for stage-then-send) had no such gate: in a poisoned room it presigned and uploaded the file BYTES to storage before the later, gated `send` — leaking the fail-closed guarantee. - chat-sdk: expose a minimal public `assertRoomNotPoisoned(roomId)` delegate that reads the same authoritative `#poisonedRooms` set as every internal gate (no second poison store). - chat-widget: `uploadAttachment` now calls it before presign, and upload capability requires it — a client that cannot answer poison state gets no upload capability at all (fail closed). Stage-then-send UX is preserved. - 0dd25c1: Fix reconnect tearing down the fresh subscription on success. On a successful reconnect, `notifyReconnected()` called `stopReconnectLoop()`, whose unsubscribe branch immediately tore down the SSE subscription that `#scheduleAttempt` (and the `online`-event retry) had just established — leaving a permanently-dead room behind a false "connected" banner: no frames ever arrived again after any network blip. `stopReconnectLoop()` conflated two responsibilities — cancel the pending retry timer, and tear down the live subscription. `notifyReconnected()` only wanted the former. Extracted a timer-only `#cancelRetryTimer()`; `notifyReconnected()` now calls it instead of `stopReconnectLoop()`. Genuine-teardown callers (clear, destroy, notifyAuthExpired) keep the full `stopReconnectLoop()`. Also fixes the complementary leak the self-teardown had been masking: the two success sites (`#scheduleAttempt`, `#onOnline`) overwrote `#unsubscribe` with the fresh sub without releasing the previous one. On a flap (reconnect → drop → reconnect) the prior subscription's teardown was dropped on the floor, so the SDK decrypt-chain refcount never reached 0 and the orphaned sub kept self-reconnecting (duplicate delivery + request fan-out). Both sites now route through a `#replaceSubscription()` helper that tears down the stale sub before assigning the fresh one (idempotent teardown; the fresh sub is assigned after the release, so it is never the one torn down). The existing suite masked all of this because it mocked the unsubscribe fn as a no-op; added regression tests with a non-noop unsub spy asserting the fresh subscription stays live after a successful reconnect (both the timer and `online` paths), that on a flap the stale sub is torn down before the fresh one replaces it, and that genuine teardown (clear/destroy) still unsubscribes. - a3929a5: Routine bug-hunt batch: theme resolution dedup, dedup-Set eviction sweep, iframe experimental notice - **theme.ts (F8):** `applyTheme()` now calls `resolveTheme()` instead of duplicating the auto/light/dark branch logic inline. `resolveTheme()` was previously dead (zero callers) while `applyTheme()` hand-copied the identical resolution — collapsed to a single `host.setAttribute('data-theme', resolveTheme(themeAttr))` call. Behavior-identical (existing 56 theme tests pass). - **message-list.ts (F12):** `#firedAttachmentErrors` and `#firedDecryptErrors` Sets are now swept in `#evictOldMessages()` (delete entries for evicted msgIds), matching how every sibling per-msgId Map is pruned. Previously these Sets accumulated one entry per failed msgId for the widget's entire lifetime (only cleared in `destroy()`), unbounded in a long-lived busy room, and a msgId recycled after eviction was wrongly suppressed by the stale dedup entry. Two new eviction tests verify the sweep + dedup-contract preservation. - **README + element.ts (F3/F5 INTERIM):** `mode='iframe'` is now marked EXPERIMENTAL / not-production-ready in the README mode documentation, and selecting `mode='iframe'` emits a one-time `console.warn` per page load. The iframe mode is half-built (creates the iframe but constructs no real chat client; in-place JWT refresh writes `liveConfig.jwt` with no consumer — W2.2 TODO). Interim safety notice only; the full build is tracked separately. - **publish-widget-cdn.mjs (F6, ops script — no package bump):** the CDN publish soft-skip (when `CDN_DEPLOY_KEY` is absent) now emits a `::warning::` GHA annotation via the existing `ghaWarning()` helper AND writes a step-summary line to `$GITHUB_STEP_SUMMARY`, so a skipped/misconfigured CDN deploy is visible in the Actions UI instead of indistinguishable from success on a green job. `exit(0)` is preserved (soft-skip is intentional). - Updated dependencies [e5bf0a7] - Updated dependencies [c4ae240] - Updated dependencies [b4e2266] - @oxpulse/chat-sdk@3.0.6 ## 0.21.0 ### Minor Changes - 88e9ec3: Host-visible observability events from the review council (observability lens): - new `oxpulse-chat:decrypt-error` CustomEvent (deduped once per msgId per widget lifetime) fires when a row carrying an `unsealError` is rendered, with detail `{roomId, msgId, seq, reason}` where reason is chat-sdk's classifyUnsealError class `'replay' | 'auth' | 'unknown'` — a replay-attack signature and a benign timeout are no longer indistinguishable to the host; - new `oxpulse-chat:reconnect-exhausted` CustomEvent fires when the Reconnector gives up after MAX_ATTEMPTS (10) retries, with detail `{roomId, attempts}` — a permanently-dead room is no longer invisible to host monitoring (contrast `oxpulse-chat:token-expired` which fires on auth expiry; this is the network-exhaustion counterpart); - README Events section backfilled with the previously-undocumented `oxpulse-chat:write-error` and `oxpulse-chat:message-sent` events plus the two new events, and an events reference table. - e31cb3a: Attachment hydration cluster from the repo review council: - final hydration failure now renders a styled placeholder (`[data-hydrate-failed='true']` selector was shipped without any CSS consumer — the PR #91 placeholder feature was a silent no-op); - permanent 403/404/410 responses no longer burn 3 pointless authed retries before the direct-URL fallback (typed `AttachmentFetchError` carries the HTTP status); - authed download / open-in-tab click handlers now thread the widget's `AbortSignal`, so a click resolving after `destroy()` no longer leaks a `blob:` URL; - a new `oxpulse-chat:attachment-error` CustomEvent (deduped per attachment) fires on final hydration failure, documented in the README; - hydration retry timing now reuses the shared `BackoffStrategy` instead of a third hand-rolled backoff curve. ### Patch Changes - 236e387: `readBlobAsDataUrl` is now exported from `@oxpulse/voice-core`'s public surface; `@oxpulse/chat-widget` consumes it from there instead of carrying a byte-identical private copy (drift-vector dedup). No behavior change. - 1f02d4f: Restore the `offsetHeight || viewportHeight` fallback in `computeFloatingPosition` that the floating-position dedup (PR #157) dropped: with a zero-height (not-yet-laid-out or collapsed) container the below-flip clamp collapsed popover placement to the margin. Real rendered containers are unaffected. - Updated dependencies [236e387] - Updated dependencies [00960c0] - Updated dependencies [e7cfbdf] - @oxpulse/voice-core@0.3.0 - @oxpulse/chat-sdk@3.0.4 ## 0.20.10 ### Patch Changes - 8621959: Fix attachment download link and open-in-new-tab hitting JWT-gated GET unauthenticated. Both the generic file download link and the image open-in-new-tab click handler now intercept the click, do an authed fetch via the hydrate bridge, and trigger download/open via a blob URL. Falls back to direct URL when no hydrate bridge is wired. ## 0.20.9 ### Patch Changes - 57881b3: Fix attachment image hydration failing permanently on transient 429/401. The authed fetch now retries up to 3 times with backoff (500ms/1s/2s) before falling back. On final failure, a data-hydrate-failed attribute is set for CSS placeholder styling, and the element falls back to the direct URL as a last resort. ## 0.20.8 ### Patch Changes - c1800c1: Fix voice preview Send button not showing disabled state when caption exceeds the character limit. The button is now disabled (visual feedback) instead of silently blocking the send on click. ## 0.20.7 ### Patch Changes - 9019765: Fix pre-resolution identity flash — raw epids + grey initials for ~1-2s until /roster resolves. Roster is now fetched in parallel with list() and the first render waits for roster (or a 300ms timeout fallback) before painting, so initial messages show display names immediately. ## 0.20.6 ### Patch Changes - 6683f0a: Add optimistic echo for sent messages. Messages now appear instantly in the chat list when the user hits send, instead of waiting for the server SSE round-trip. The optimistic row is inserted with a client-generated msgId; when the server SSE event arrives with the same msgId, the row is updated in place (seq, createdAt, etc.). Also wires sendTextOptimistic for E2EE consumers (wraps the SDK OptimisticHandle into the Promise<{msgId}> the Composer expects). ## 0.20.5 ### Patch Changes - d624a78: Fix reaction quick bar appearing higher than the heart button. The bar was anchored to the message bubble element (spanning the whole message) instead of the heart button, causing a 75px gap between the bar and the heart on hover. ## 0.20.4 ### Patch Changes - 91e89ed: Refactor: deduplicate floating-element positioning logic into shared computeFloatingPosition utility. EmojiPicker and ReactionQuickBar both had identical fixed-vs-absolute + viewport-clamp code; now both use the single utility. Fixes quick bar positioning jump when selecting a heart reaction — the bar now anchors consistently to the heart button, not the bubble. ## 0.20.3 ### Patch Changes - ea03b00: Hide heart button on hover when caller already has a heart reaction. Previously both the reaction chip ("heart N") and the heart button SVG were visible on hover, showing two heart icons stacked vertically. Now the chip serves as the visible indicator + toggle; the heart button reappears when the reaction is removed. ## 0.20.2 ### Patch Changes - de0bf24: Fix emoji picker clipped by widget root overflow:hidden — picker now mounts to the shadow root host (position:fixed) when a shadowHost is passed, mirroring the ReactionQuickBar MAJOR-5 pattern. Grid with emojis is no longer cut off. Fix voice preview send button showing localized text (\"Отправить\"/\"Send\") instead of the paper-plane SVG icon — now matches the main composer send button. ## 0.20.1 ### Patch Changes - 0a65c41: Fix CSS parsing bug: .oxp-composer-emoji-btn:hover had no closing brace, causing all subsequent CSS to be nested inside it. Add missing --oxp-surface and --oxp-tint tokens. ## 0.20.0 ### Minor Changes - 740f404: Full threads — thread panel with replies (#126) Add a full thread view side panel. Users click a "N replies" indicator on any message with thread replies to open a panel showing the root message, all replies, and an inline composer for sending new replies. Uses existing SDK getThread + sendText(threadRootMsgId) methods. ## 0.19.0 ### Minor Changes - bbed339: Emoji picker — searchable, categorized (#127) Add full emoji picker to the composer toolbar. ~180 emojis across 8 categories with live search by name + keywords. Zero-third-party-dep (no emoji-mart). Keyboard navigation, a11y (role=dialog, Tab trap, Escape), i18n en + ru. ## 0.18.0 ### Minor Changes - b79ac48: Read receipts — checkmarks on own messages (#122) Add WhatsApp-style read receipt checkmarks on own message bubbles, driven by SSE read_receipt events. Delivered (double ✓ gray) → Read (double ✓ accent). Auto-marks incoming messages from others as read. i18n support for en + ru. ## 0.17.0 ### Minor Changes - f3fcab5: Presence overlay — avatar online dots + heartbeat (#121) Add green presence dot on avatars for online users, driven by SSE presence events. Includes 30s heartbeat interval, initial presence snapshot fetch, and 120s freshness window (matches server SDK_PRESENCE_FRESHNESS_SECS). i18n support for en + ru. ## 0.16.0 ### Minor Changes - 0e452c3: Typing indicator UI + composer throttle (#120) Add animated "X is typing…" footer to the chat widget, driven by SSE typing events. The SDK layer (sendTyping, onTyping, SSE routing) was already implemented; this adds the widget UI: typing-indicator component, 2s keystroke throttle in the composer, i18n (en+ru), and CSS with prefers-reduced-motion support. ### Patch Changes - Updated dependencies [0e452c3] - @oxpulse/chat-sdk@3.0.3 ## 0.15.0 ### Minor Changes - 73c08db: Product-card followups (#113, #114, #116, #117): - **chat-widget**: Composer now renders a dismissible "product card attached" chip when a card is staged via `setProductCard`, mirroring the reply-preview bar pattern. The chip's × dismiss calls `clearProductCard()`; the chip is hidden on clear and after a successful send. i18n: `productCardAttached` + `removeProductCard` in en and ru. Theme CSS mirrors the reply-preview classes. - **chat-widget**: New end-to-end test mounts `OxpulseChatElement` with a real `SDKChatClient` + fetch mock, calls `setProductCard` + sends, and asserts the outgoing POST body carries `product_ref` + `product_meta` through the full adapter → SDK → wire path. - **chat-sdk**: `rowToMessageRow` now normalizes `product_meta` at the receive boundary — requires title/price/currency non-empty strings, caps lengths (title 200, price 40, currency 16, urls 2048), coerces bad URLs to '', returns null for non-object or invalid payloads. `MessageRow.productMeta` is now honest for all SDK consumers. - **chat-sdk**: `sendProductCard()` doc-comment documents its role as the public external-integrator convenience API and explains why the in-house widget routes cards through `sendText()` instead. No behavior change. ### Patch Changes - 73c08db: Harden the W9 product card (marketplace) feature — review follow-ups to #52. - **Bare-card send:** a staged product card now enables the send button and rides an empty-text send (the "drop the product in, no caption" marketplace flow). Previously `setProductCard` left the send button disabled with an empty textarea and `#send` early-returned, so a card could not be sent on its own. `setProductCard`/`clearProductCard` now refresh the send state. - **Server `product_meta` validation:** `product_meta` is unsealed opaque JSON any room peer can POST; the widget now validates + caps it before render. A partial (missing title/price/currency), non-object, or oversized value degrades to "no card" instead of rendering "undefined" or a multi-MB title (layout DoS-lite). Core display fields are required; URLs are length-capped. - **Image privacy:** the product-card image now carries `referrerPolicy="no-referrer"`, so a peer-controlled `imageUrl` can no longer leak the viewer's page URL as a referrer on load. - Updated dependencies [73c08db] - @oxpulse/chat-sdk@3.0.2 ## 0.14.0 ### Minor Changes - 26fc181: Voice recording: live waveform + Telegram/WhatsApp hold-to-record gesture (burner-parity). **@oxpulse/voice-core** - `VoiceRecorder` now exposes the live `stream: MediaStream`, so a caller can compose `attachAnalyserTap(recorder.stream)` onto the SAME stream the recorder ships — driving a live composer waveform without a second `getUserMedia` grant. **@oxpulse/chat-widget** - The recording chip now paints a **live waveform** as you speak — an analyser tap off the recorder's stream feeds `sampleLiveBars` → `renderStaticWaveform` at RAF. The chip is redesigned to match the app: pulsing dot, tabular timer, live canvas, slide-hint, and a will-cancel red state. - New **hold-to-record gesture** (`voice-gesture.ts`): hold the mic to record, slide left to lock, slide up to cancel; a quick tap (or mouse click) latches locked recording with on-screen Stop/Cancel (WhatsApp tap-to-lock). Keyboard Enter/Space starts a locked recording (a11y — pointer gestures aren't keyboard-operable). - Teardown ordering is enforced: the analyser tap's AudioContext is closed before the recorder stops its MediaStream tracks; destroy mid-recording releases the mic. - i18n: `voiceSlideHint` / `voiceReleaseToCancelHint` (en + ru). ### Patch Changes - Updated dependencies [26fc181] - @oxpulse/voice-core@0.2.0 ## 0.13.0 ### Minor Changes - d9dc4ae: Voice Phase 2: adopt @oxpulse/voice-core — VoiceBubble playback, waveform peaks on the wire, #102 flake guard + review-council fixes. - **Consume voice-core**: chat-widget now imports `createVoiceRecorder`, `validateVoiceBlob`, `MAX_VOICE_MS`, `extractPeaksFromBlob`, `sanitizePeaks` from `@oxpulse/voice-core`. The duplicate `utils/voice.ts` is deleted; `__tests__/voice.test.ts` (a copy of voice-core's recorder test) is removed. - **VoiceBubble shell** (`ui/voice-bubble.ts`): replaces the bare `