AI agent install packet

Configure AnswerLattice first

• Create the al_* widget key in the dashboard and save the full one-time value in the client app environment.
• If the full key was lost, create a replacement key. Saved key identifiers are only for identifying existing keys.
• Save allowed production and staging origins in the dashboard.
• Save blocked routes in the dashboard.
• Then copy the dashboard-generated packet so the agent receives the current setup.

Copy this prompt

You are integrating AnswerLattice into this product.

Goal:
Install the AnswerLattice v1 support widget, pass safe page context, respect AnswerLattice dashboard route rules, and prove the installation works.

Use these AnswerLattice values:
- Widget key for install: {{ANSWERLATTICE_WIDGET_KEY}}
- Saved key identifier, for dashboard lookup only: (none saved yet)
- Dashboard-saved allowed origins, for verification only:
- (none saved yet)
- Dashboard-saved blocked routes:
- (none saved yet)
- Framework: {{FRAMEWORK}}
- Router: {{ROUTER}}
- Support entry points:
- global widget
- help button
- sidebar
- settings page

Canonical install contract:
- Contract version: answerlattice-widget-v1
- Script URL: https://answerlattice.com/widget/v1/answerlattice-widget.js
- Browser global: window.AnswerlatticeWidget
- Context methods:
  - window.AnswerlatticeWidget.setContext(context)
  - window.AnswerlatticeWidget.page(context)
- Optional visitor method:
  - window.AnswerlatticeWidget.identify({ id, name, email })
- Optional server-verified visitor method:
  - window.AnswerlatticeWidget.identifySigned(token)
  - window.AnswerlatticeWidget.clearIdentity()
- Optional support-safe evidence method:
  - window.AnswerlatticeWidget.setEvidenceLinks([{ label, url }])

Implementation rules:
1. Find the app root, global layout, document shell, or main client entry point.
2. Install the AnswerLattice script exactly once.
3. Prefer an environment variable for the widget key when the framework supports it.
4. If the packet shows al_full_widget_key_shown_once, replace it with the full one-time al_* value saved from key creation. Do not use the saved key identifier or identifier + ellipsis as the widget key.
5. Do not install the widget separately on each page.
6. Do not expose tenantId, storeId, internal user IDs, billing data, tokens, cookies, secrets, or private account metadata.
7. Pass only safe page context: path, title, feature, workflow, role, and locale.
8. Do not put customer emails, phone numbers, internal account IDs, tenant IDs, store IDs, or private records in page context.
9. If the product has a signed-in customer and the product owner wants requester tracking, call identify with only a support-safe customer id, display name, and email after auth state is known.
10. If support behavior depends on a trusted plan or role, use the Access & Security signing key only from server code and call identifySigned with a short-lived token. Never put the private key in browser code.
11. Attach external diagnostic links only from dashboard-allowed HTTPS hosts, only when useful for the current question, and never treat them as answer truth.
12. Update AnswerLattice context after client-side route changes.
13. Do not create app settings for allowed origins or blocked routes. AnswerLattice dashboard owns those values.
14. If this repository has a central third-party-script guard, use the dashboard-saved blocked routes above to avoid mounting AnswerLattice on sensitive screens.
15. Also avoid routes containing token, invite, reset-password, payment, secret, api-key, or webhook setup screens.
16. Add a short code comment explaining that this is the AnswerLattice v1 widget contract.
17. Run lint, typecheck, and build commands available in the repository.
18. Report changed files, where the script was installed, how route context updates, visitor identity handling if added, test commands run, and assumptions.

Acceptance criteria:
- The app builds.
- The AnswerLattice script is loaded once.
- The widget key is not hardcoded when env vars are available.
- The saved key identifier is not used as the install key.
- Dashboard-owned allowed origins and blocked routes are not duplicated as product settings.
- The widget is absent on blocked routes when a local route guard is present; otherwise AnswerLattice dashboard route rules control runtime visibility.
- Safe page context updates on route changes.
- Optional visitor identity is sent only through identify, never through page context.
- No forbidden identifiers or secrets are sent to AnswerLattice.
- The browser console has no AnswerLattice integration errors.