@ada-support/embed2 1.14.3 → 1.14.4

package/dist/npm-entry/client/components/ChatFrame/chatFrameEvents/chatterEvent/index.d.ts

@@ -1,3 +1,8 @@
 import type { Client } from "common/models/client";
+import type { AdaCluster } from "common/types";
 import type { MessagePayload } from "common/types/events";
-export declare function storeChatterEventDataInBrowser(client: Client, payload: MessagePayload): void;
+export declare function storeChatterEventDataInBrowser(client: Client, payload: MessagePayload, { cluster, domain, privateMode, }?: {
+    cluster?: AdaCluster;
+    domain?: string;
+    privateMode?: boolean;
+}): void;

package/dist/npm-entry/common/helpers/messaging-auth-state.d.ts

@@ -0,0 +1,34 @@
+import type { AdaCluster } from "common/types";
+export interface MessagingAuthState {
+    messagingToken: string;
+    messagingTokenExpiresAt: number;
+    sessionRefreshToken: string;
+    refreshGeneration: number;
+}
+type MessagingAuthStatePersistence = "normal" | "session" | "private" | string | null | undefined;
+declare const MESSAGING_AUTH_STATE_STORAGE_KEY: "messagingAuthState";
+export declare function buildMessagingAuthStateStorageKey({ handle, cluster, domain, }: {
+    handle: string | null | undefined;
+    cluster?: AdaCluster;
+    domain?: string;
+}): typeof MESSAGING_AUTH_STATE_STORAGE_KEY | null;
+export declare function parseMessagingAuthState(value: unknown): MessagingAuthState | null;
+export declare function readMessagingAuthStateFromStorage({ handle, cluster, domain, }: {
+    handle: string | null | undefined;
+    cluster?: AdaCluster;
+    domain?: string;
+}): MessagingAuthState | undefined;
+export declare function writeMessagingAuthStateToStorage({ handle, cluster, domain, persistence, state, }: {
+    handle: string | null | undefined;
+    cluster?: AdaCluster;
+    domain?: string;
+    persistence: MessagingAuthStatePersistence;
+    state: MessagingAuthState | null | undefined;
+}): boolean;
+export declare function clearAllMessagingAuthStatesFromStorage(): void;
+export declare function clearMessagingAuthStateFromStorage({ handle, cluster, domain, }: {
+    handle: string | null | undefined;
+    cluster?: AdaCluster;
+    domain?: string;
+}): void;
+export {};

package/dist/npm-entry/common/types/store-state.d.ts

@@ -1,11 +1,13 @@
 import type { Modality, StartOptions } from "@ada-support/embed-types";
 import type { ConnectionState } from "common/constants/events";
+import type { MessagingAuthState } from "common/helpers/messaging-auth-state";
 import type { Client } from "common/models/client";
 import type { AdaCluster } from "common/types";
 export interface StoreState extends StartOptionsNoFunction {
     chatterCreated: string | undefined;
     chatterToken: string | undefined;
     sessionToken: string | undefined;
+    messagingAuthState?: MessagingAuthState;
     client?: Client;
     enabledLanguages: string[];
     isDrawerOpen: boolean;

package/dist/npm-entry/index.js

@@ -15919,7 +15919,7 @@ const client = new BrowserClient({
     return event;
   },
   environment: "production",
-  release: "1.14.3-00422f5",
+  release: "1.14.4-57d2690",
   sampleRate: 0.25,
   autoSessionTracking: false,
   // Integrations don't seem to work with Sentry: https://github.com/getsentry/sentry-javascript/issues/2541
@@ -16543,7 +16543,7 @@ function getEmbedURL(_ref) {
   } else {
     host = `http://${handle}.localhost:${ports.localhost.default}`;
   }
-  return `${host}/embed/${frameName}/${"00422f5"}/index.html`;
+  return `${host}/embed/${frameName}/${"57d2690"}/index.html`;
 }
 function constructQueryString(query) {
   return Object.keys(query).map(key => {
@@ -17037,11 +17037,192 @@ const ZD_MESSAGING_CHATTER_CREATED_STORAGE_KEY = "ada-embed_zd-messaging-chatter
 
 /** @deprecated - Use CHATTER_TOKEN_STORAGE_KEY */
 const CHATTER_STORAGE_KEY = (/* unused pure expression or super */ null && (CHATTER_TOKEN_STORAGE_KEY));
+;// CONCATENATED MODULE: ./src/common/helpers/messaging-auth-state.ts
+
+
+// Single static key, shared verbatim with messaging + chat and disclosed by
+// @ada-support/web-storage. Per-bot scoping is implicit in the bot-subdomain
+// storage origin this runs on, so no apiOrigin/handle-scoped key is needed.
+const MESSAGING_AUTH_STATE_STORAGE_KEY = "messagingAuthState";
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// Typed @ada-support/web-storage wrapper for the chosen persistence provider, or
+// null when persistence is disabled / there is no window. The wrapper is what
+// puts `messagingAuthState` on the published web-storage disclosure list and
+// serializes the value, so callers pass/get a typed object rather than a string.
+function getMessagingAuthStorage(persistence) {
+  if (persistence === "private" || typeof window === "undefined") {
+    return null;
+  }
+  return persistence === "session" ? dist/* adaSessionStorage */.ad : dist/* adaLocalStorage */.BB;
+}
+function getApiOrigin(_ref) {
+  let {
+    handle,
+    cluster,
+    domain
+  } = _ref;
+  try {
+    return new window.URL(getURL({
+      name: "api",
+      handle,
+      cluster,
+      domain
+    }), window.location.origin).origin;
+  } catch (error) {
+    return null;
+  }
+}
+function buildMessagingAuthStateStorageKey(_ref2) {
+  let {
+    handle,
+    cluster,
+    domain
+  } = _ref2;
+  // The key itself is static; the handle/origin now only gate whether there is a
+  // resolvable session to read/write (preserving the previous no-op behavior
+  // before a handle/origin is known) rather than scoping the key.
+  if (!handle || !getApiOrigin({
+    handle,
+    cluster,
+    domain
+  })) {
+    return null;
+  }
+  return MESSAGING_AUTH_STATE_STORAGE_KEY;
+}
+function parseMessagingAuthState(value) {
+  let parsedValue = value;
+  if (typeof value === "string") {
+    try {
+      parsedValue = JSON.parse(value);
+    } catch (error) {
+      return null;
+    }
+  }
+  if (!isRecord(parsedValue)) {
+    return null;
+  }
+  const {
+    messagingToken,
+    messagingTokenExpiresAt,
+    sessionRefreshToken,
+    refreshGeneration
+  } = parsedValue;
+  if (typeof messagingToken !== "string" || !messagingToken || typeof messagingTokenExpiresAt !== "number" || !Number.isFinite(messagingTokenExpiresAt) || messagingTokenExpiresAt <= 0 || typeof sessionRefreshToken !== "string" || !sessionRefreshToken || typeof refreshGeneration !== "number" || !Number.isFinite(refreshGeneration)) {
+    return null;
+  }
+  return {
+    messagingToken,
+    messagingTokenExpiresAt,
+    sessionRefreshToken,
+    refreshGeneration
+  };
+}
+
+// Storage-blocked browsers can throw on the storage methods, so each access is
+// wrapped to fall back gracefully rather than throw into callers.
+function safeReadMessagingAuthState(persistence) {
+  try {
+    var _getMessagingAuthStor;
+    return parseMessagingAuthState(((_getMessagingAuthStor = getMessagingAuthStorage(persistence)) === null || _getMessagingAuthStor === void 0 ? void 0 : _getMessagingAuthStor.getItem(MESSAGING_AUTH_STATE_STORAGE_KEY)) ?? null);
+  } catch (error) {
+    return null;
+  }
+}
+function readMessagingAuthStateFromStorage(_ref3) {
+  let {
+    handle,
+    cluster,
+    domain
+  } = _ref3;
+  if (!buildMessagingAuthStateStorageKey({
+    handle,
+    cluster,
+    domain
+  })) {
+    return undefined;
+  }
+  const persistedAuthStates = ["normal", "session"].map(persistence => safeReadMessagingAuthState(persistence)).filter(authState => authState !== null);
+  return persistedAuthStates.reduce((highestState, authState) => !highestState || authState.refreshGeneration > highestState.refreshGeneration ? authState : highestState, undefined);
+}
+function writeMessagingAuthStateToStorage(_ref4) {
+  let {
+    handle,
+    cluster,
+    domain,
+    persistence,
+    state
+  } = _ref4;
+  const storageKey = buildMessagingAuthStateStorageKey({
+    handle,
+    cluster,
+    domain
+  });
+  const storage = getMessagingAuthStorage(persistence);
+  if (!storageKey || !storage || !state) {
+    return false;
+  }
+  try {
+    const existing = readMessagingAuthStateFromStorage({
+      handle,
+      cluster,
+      domain
+    });
+    if (existing && existing.refreshGeneration >= state.refreshGeneration) {
+      return false;
+    }
+    storage.setItem(storageKey, state);
+    return true;
+  } catch (error) {
+    return false;
+  }
+}
+function clearAllMessagingAuthStatesFromStorage() {
+  ["normal", "session"].forEach(persistence => {
+    try {
+      var _getMessagingAuthStor2;
+      (_getMessagingAuthStor2 = getMessagingAuthStorage(persistence)) === null || _getMessagingAuthStor2 === void 0 ? void 0 : _getMessagingAuthStor2.removeItem(MESSAGING_AUTH_STATE_STORAGE_KEY);
+    } catch (error) {
+      // Storage blocked; nothing to clear.
+    }
+  });
+}
+
+// Removes the messaging auth state (across both persistence providers). Used when
+// a bot rotates to a new chatter. With the bot-subdomain storage origin there is a
+// single auth state per origin, so this and `clearAllMessagingAuthStatesFromStorage`
+// now clear the same key.
+function clearMessagingAuthStateFromStorage(_ref5) {
+  let {
+    handle,
+    cluster,
+    domain
+  } = _ref5;
+  if (!buildMessagingAuthStateStorageKey({
+    handle,
+    cluster,
+    domain
+  })) {
+    return;
+  }
+  ["normal", "session"].forEach(persistence => {
+    try {
+      var _getMessagingAuthStor3;
+      (_getMessagingAuthStor3 = getMessagingAuthStorage(persistence)) === null || _getMessagingAuthStor3 === void 0 ? void 0 : _getMessagingAuthStor3.removeItem(MESSAGING_AUTH_STATE_STORAGE_KEY);
+    } catch (error) {
+      // Storage blocked; nothing to clear.
+    }
+  });
+}
 ;// CONCATENATED MODULE: ./src/client/store/state.ts
 
 
 
 
+
 function getValueFromStorage(key) {
   return dist/* adaLocalStorage */.BB.getItem(key) || dist/* adaSessionStorage */.ad.getItem(key);
 }
@@ -17076,6 +17257,11 @@ const getInitialState = adaSettings => ({
   chatterToken: getValueFromStorage(CHATTER_TOKEN_STORAGE_KEY) || undefined,
   chatterCreated: getValueFromStorage(CHATTER_CREATED_STORAGE_KEY) || undefined,
   sessionToken: getValueFromStorage(SESSION_AUTH_TOKEN_STORAGE_KEY) || undefined,
+  messagingAuthState: readMessagingAuthStateFromStorage({
+    handle: adaSettings.handle,
+    cluster: adaSettings.cluster,
+    domain: adaSettings.domain
+  }),
   zdSessionId: getValueFromStorage(ZD_SESSION_STORAGE_KEY) || undefined,
   zdPreviousTags: getValueFromStorage(ZD_PREVIOUS_TAGS_STORAGE_KEY) || undefined,
   zdMessagingExternalUserId: getValueFromStorage(ZD_MESSAGING_EXTERNAL_USER_ID_STORAGE_KEY) || null,
@@ -17143,9 +17329,9 @@ async function log(message, extra, options) {
       service: "embed",
       env: "production",
       embedVersion: 2,
-      version: "1.14.3",
+      version: "1.14.4",
       isNpm: true,
-      commitHash: "00422f5"
+      commitHash: "57d2690"
     }))
   });
 }
@@ -19465,20 +19651,72 @@ function shouldDeliverTranscriptEvent(eventKey, adaSettings) {
 ;// CONCATENATED MODULE: ./src/client/components/ChatFrame/chatFrameEvents/chatterEvent/index.ts
 
 
+
 function storeChatterEventDataInBrowser(client, payload) {
-  const {
-    persistence
-  } = client;
+  let {
+    cluster,
+    domain,
+    privateMode
+  } = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
   const {
     chatter,
     created,
-    sessionToken
+    sessionToken,
+    messagingAuthState
   } = payload;
+  if (privateMode) {
+    return;
+  }
+  const {
+    persistence
+  } = client;
+
+  // A new chatter resets refreshGeneration back to 1, so the generation guard in
+  // writeMessagingAuthStateToStorage would otherwise refuse to overwrite a previous
+  // chatter's higher-generation (now-dead) auth state — leaving the host-page copy
+  // stuck on a refresh token the backend has rotated away. Whenever the persisted
+  // chatter token does not match the incoming one — including when it is absent or in
+  // the other persistence provider, leaving the auth state orphaned — drop the stale
+  // auth state first so the new chatter's credentials persist.
+  const previousChatter = retrieveStorage(CHATTER_TOKEN_STORAGE_KEY, client, privateMode);
+  if (previousChatter !== chatter) {
+    clearMessagingAuthStateFromStorage({
+      handle: client.handle,
+      cluster,
+      domain
+    });
+  }
   setBrowserStorageItem(CHATTER_TOKEN_STORAGE_KEY, chatter, persistence);
   setBrowserStorageItem(CHATTER_CREATED_STORAGE_KEY, created, persistence);
   if (sessionToken) {
     setBrowserStorageItem(SESSION_AUTH_TOKEN_STORAGE_KEY, sessionToken, persistence);
   }
+
+  // embed-2 only PERSISTS / mirrors the chat auth state here; it is the relay that
+  // lets the chat iframe restore the JWT (e.g. across reloads). embed-2 deliberately
+  // never attaches `Authorization` to its own XHR requests — adding headers to
+  // embed-2's cross-origin XHR trips CORS preflight (see common/helpers/http.ts) — so
+  // the chat iframe, not embed-2, is what sends `Bearer <messagingToken>`.
+  const parsedAuthState = parseMessagingAuthState(messagingAuthState);
+  if (parsedAuthState) {
+    writeMessagingAuthStateToStorage({
+      handle: client.handle,
+      cluster,
+      domain,
+      persistence,
+      state: parsedAuthState
+    });
+  } else {
+    // chat published no usable auth state for this chatter (e.g. it cleared a dead
+    // refresh token on unrecoverable invalid_refresh_token). Drop the host-side copy so
+    // a stale token can't be resurrected on reload — a null write would otherwise no-op
+    // and leave it in place.
+    clearMessagingAuthStateFromStorage({
+      handle: client.handle,
+      cluster,
+      domain
+    });
+  }
 }
 ;// CONCATENATED MODULE: ./src/client/components/ChatFrame/chatFrameEvents/index.ts
 
@@ -19706,7 +19944,7 @@ class ChatFrame extends preact_module_d {
     log("Chat frame mount", {
       handle,
       chatUrl: this.url,
-      embedVersion: "00422f5".slice(0, 7),
+      embedVersion: "57d2690".slice(0, 7),
       embedSettings: adaSettings
     });
 
@@ -19794,7 +20032,7 @@ class ChatFrame extends preact_module_d {
     const hostPageUrlParams = new URL(window.location.href).searchParams;
     const smsToken = hostPageUrlParams.get("adaSMSToken");
     const queryParams = {
-      embedVersion: "00422f5".slice(0, 7),
+      embedVersion: "57d2690".slice(0, 7),
       greeting,
       language,
       skipGreeting,
@@ -20132,12 +20370,16 @@ class ChatFrame extends preact_module_d {
       case CHATTER_EVENT:
         {
           const {
-            client
+            client,
+            cluster,
+            domain,
+            privateMode
           } = this.props;
           const {
             chatter,
             created,
-            sessionToken
+            sessionToken,
+            messagingAuthState
           } = payload;
           const {
             chatterTokenCallback
@@ -20145,14 +20387,19 @@ class ChatFrame extends preact_module_d {
           if (!client) {
             throw new AdaEmbedError("`client` is undefined");
           }
-          storeChatterEventDataInBrowser(client, payload);
+          storeChatterEventDataInBrowser(client, payload, {
+            cluster,
+            domain,
+            privateMode
+          });
           if (chatterTokenCallback) {
             chatterTokenCallback(chatter);
           }
           await setGlobalState({
             chatterToken: chatter,
             chatterCreated: created,
-            sessionToken
+            sessionToken,
+            messagingAuthState
           });
           break;
         }
@@ -20824,6 +21071,7 @@ function Container_objectSpread(e) { for (var r = 1; r < arguments.length; r++)
 
 
 
+
 
 
 class Container extends preact_module_d {
@@ -21478,11 +21726,20 @@ class Container extends preact_module_d {
             dist/* adaSessionStorage */.ad.removeItem(CHATTER_TOKEN_STORAGE_KEY);
             dist/* adaLocalStorage */.BB.removeItem(CHATTER_CREATED_STORAGE_KEY);
             dist/* adaSessionStorage */.ad.removeItem(CHATTER_CREATED_STORAGE_KEY);
+            // Scope the clear to this bot so a sibling Ada bot on the same origin keeps its
+            // own messaging auth state. adaSettings.{handle,cluster,domain} matches the key
+            // storeChatterEventDataInBrowser wrote under.
+            clearMessagingAuthStateFromStorage({
+              handle: adaSettings.handle,
+              cluster: adaSettings.cluster,
+              domain: adaSettings.domain
+            });
 
             // And from state
             newState = Container_objectSpread(Container_objectSpread({}, newState), {}, {
               chatterToken: undefined,
-              chatterCreated: undefined
+              chatterCreated: undefined,
+              messagingAuthState: undefined
             });
           }
           await setGlobalState(newState);
@@ -21512,11 +21769,19 @@ class Container extends preact_module_d {
           dist/* adaSessionStorage */.ad.removeItem(CHATTER_TOKEN_STORAGE_KEY);
           dist/* adaLocalStorage */.BB.removeItem(CHATTER_CREATED_STORAGE_KEY);
           dist/* adaSessionStorage */.ad.removeItem(CHATTER_CREATED_STORAGE_KEY);
+          // Scope the clear to this bot so a sibling Ada bot on the same origin keeps its
+          // own messaging auth state (see RESET above).
+          clearMessagingAuthStateFromStorage({
+            handle: adaSettings.handle,
+            cluster: adaSettings.cluster,
+            domain: adaSettings.domain
+          });
 
           // And from state
           await setGlobalState({
             chatterToken: undefined,
-            chatterCreated: undefined
+            chatterCreated: undefined,
+            messagingAuthState: undefined
           });
           xStorageChannel.postMessage(DELETE_HISTORY_EVENT, undefined);
           localChannel.postMessage(DELETE_HISTORY_RESPONSE, null, id);
@@ -21747,6 +22012,15 @@ class Container extends preact_module_d {
         adaSettings: Container_objectSpread(Container_objectSpread({}, adaSettings), {}, {
           handle: assignedClient.handle
         }),
+        // Re-read the handle-scoped messaging auth blob under the assigned bot handle.
+        // getInitialState read it under the original adaSettings.handle, which differs
+        // from assignedClient.handle under alternative-bot rollout, so without this the
+        // host-side JWT fallback would miss the assigned bot's persisted token on reload.
+        messagingAuthState: readMessagingAuthStateFromStorage({
+          handle: assignedClient.handle,
+          cluster: cluster,
+          domain
+        }),
         chatterInLiveChat
       }));
     } catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ada-support/embed2",
-  "version": "1.14.3",
+  "version": "1.14.4",
   "description": "",
   "main": "dist/npm-entry",
   "typings": "dist/npm-entry/index-npm.d.ts",
@@ -91,7 +91,7 @@
   },
   "dependencies": {
     "@ada-support/embed-types": "^1.9.2",
-    "@ada-support/web-storage": "^1.2.9",
+    "@ada-support/web-storage": "^1.3.0",
     "@babel/runtime-corejs3": "^7.26.10",
     "@sentry/browser": "^8.33.0",
     "@sentry/types": "^8.33.1",