@exotel-npm-dev/exotel-ai-assist 1.0.0 → 1.0.1

package/dist/controller/index.js

@@ -398,13 +398,21 @@ class BroadcastChannelTransport {
     if (this.socket) {
       this.socket.close(1000, "reconnecting");
     }
-    // authToken is passed as a subprotocol so it is sent in the
-    // Sec-WebSocket-Protocol header — the only way to include auth
-    // credentials in a browser WebSocket handshake.
     this.socket = new WebSocket(url);
     this.socket.onopen = () => {
       var _a;
       this.socketConnected = true;
+      // First-message auth protocol: send the JWT before any other message.
+      // The server does not send an auth_required prompt; the client is
+      // responsible for sending this immediately after the socket opens.
+      console.log('Sending token', {
+        type: "auth",
+        access_token: authToken
+      });
+      this.socket.send(JSON.stringify({
+        type: "auth",
+        access_token: authToken
+      }));
       const msg = {
         type: "CONNECTED"
       };
@@ -429,11 +437,12 @@ class BroadcastChannelTransport {
       (_a = this.handler) === null || _a === void 0 ? void 0 : _a.call(this, msg);
       this.channel.postMessage(msg);
     };
-    this.socket.onclose = () => {
+    this.socket.onclose = ev => {
       var _a;
       this.socketConnected = false;
       const msg = {
-        type: "DISCONNECTED"
+        type: "DISCONNECTED",
+        code: ev.code
       };
       (_a = this.handler) === null || _a === void 0 ? void 0 : _a.call(this, msg);
       this.channel.postMessage(msg);
@@ -1534,12 +1543,14 @@ class Utils {
   }
   static constructQueryParams(params) {
     // Keys consumed by the library — never forwarded to the server.
+    // authToken is intentionally excluded: authentication is done via the
+    // first WebSocket text message (first-message auth protocol), not the URL.
     const INTERNAL_KEYS = new Set(["authToken", "accountId", "wssBaseUrl", "reconnectInterval", "maxReconnectAttempts"]);
-    // Mandatory server params remapped to the names the API expects.
+    // Stream-key resolution params sent as query parameters.
     // accountId is embedded in the URL path — never sent as a query param.
-    const mandatory = [["access_token", String(params.authToken)]];
+    const pairs = [];
     if (params.call_sid !== undefined && params.call_sid !== null) {
-      mandatory.push(["call_sid", String(params.call_sid)]);
+      pairs.push(["call_sid", String(params.call_sid)]);
     }
     // Extra caller-supplied params, excluding internals and already-mapped keys.
     const extra = Object.entries(params).filter(([k, v]) => !INTERNAL_KEYS.has(k) && k !== "call_sid" && v !== undefined && v !== null).map(([k, v]) => [k, String(v)]);
@@ -1549,7 +1560,7 @@ class Utils {
     // array as a plain object, turning index 0 into a key and the inner
     // array's toString() (comma-joined) into the value.
     const query = new URLSearchParams();
-    [...mandatory, ...extra].forEach(([k, v]) => query.append(k, v));
+    [...pairs, ...extra].forEach(([k, v]) => query.append(k, v));
     return query.toString();
   }
   /**
@@ -1645,7 +1656,11 @@ class ExotelAIAssistController extends EventEmitter {
       case "DISCONNECTED":
         this._setStatus("disconnected");
         this.emit("onCallEnd");
-        this._scheduleReconnect();
+        // Close codes 4001 (auth_failed) and 4002 (auth_timeout) are permanent
+        // auth failures — reconnecting with the same token would fail again.
+        if (msg.code !== 4001 && msg.code !== 4002) {
+          this._scheduleReconnect();
+        }
         break;
       case "ERROR":
         this._setStatus("error");
@@ -1657,14 +1672,26 @@ class ExotelAIAssistController extends EventEmitter {
     }
   }
   _handleServerPayload(raw) {
+    var _a;
     let parsed;
     try {
       parsed = JSON.parse(raw);
-    } catch (_a) {
+    } catch (_b) {
       this.emit("error", new Error(`Failed to parse server message: ${raw}`));
       return;
     }
     this.emit("raw", parsed);
+    // Auth error messages arrive before the server closes the connection.
+    // Treat both as fatal — the server will follow up with a 4001/4002 close.
+    const msgType = parsed.type;
+    if (msgType === "auth_failed" || msgType === "auth_timeout") {
+      const detail = (_a = parsed.error) !== null && _a !== void 0 ? _a : msgType;
+      const err = new Error(detail);
+      err.code = msgType.toUpperCase();
+      this._setStatus("error");
+      this.emit("error", err);
+      return;
+    }
     if (parsed.config) {
       this.emit("botConfig", parsed.config);
     }

package/dist/index.js

@@ -19816,13 +19816,21 @@ class BroadcastChannelTransport {
     if (this.socket) {
       this.socket.close(1000, "reconnecting");
     }
-    // authToken is passed as a subprotocol so it is sent in the
-    // Sec-WebSocket-Protocol header — the only way to include auth
-    // credentials in a browser WebSocket handshake.
     this.socket = new WebSocket(url);
     this.socket.onopen = () => {
       var _a;
       this.socketConnected = true;
+      // First-message auth protocol: send the JWT before any other message.
+      // The server does not send an auth_required prompt; the client is
+      // responsible for sending this immediately after the socket opens.
+      console.log('Sending token', {
+        type: "auth",
+        access_token: authToken
+      });
+      this.socket.send(JSON.stringify({
+        type: "auth",
+        access_token: authToken
+      }));
       const msg = {
         type: "CONNECTED"
       };
@@ -19847,11 +19855,12 @@ class BroadcastChannelTransport {
       (_a = this.handler) === null || _a === void 0 ? void 0 : _a.call(this, msg);
       this.channel.postMessage(msg);
     };
-    this.socket.onclose = () => {
+    this.socket.onclose = ev => {
       var _a;
       this.socketConnected = false;
       const msg = {
-        type: "DISCONNECTED"
+        type: "DISCONNECTED",
+        code: ev.code
       };
       (_a = this.handler) === null || _a === void 0 ? void 0 : _a.call(this, msg);
       this.channel.postMessage(msg);
@@ -20952,12 +20961,14 @@ class Utils {
   }
   static constructQueryParams(params) {
     // Keys consumed by the library — never forwarded to the server.
+    // authToken is intentionally excluded: authentication is done via the
+    // first WebSocket text message (first-message auth protocol), not the URL.
     const INTERNAL_KEYS = new Set(["authToken", "accountId", "wssBaseUrl", "reconnectInterval", "maxReconnectAttempts"]);
-    // Mandatory server params remapped to the names the API expects.
+    // Stream-key resolution params sent as query parameters.
     // accountId is embedded in the URL path — never sent as a query param.
-    const mandatory = [["access_token", String(params.authToken)]];
+    const pairs = [];
     if (params.call_sid !== undefined && params.call_sid !== null) {
-      mandatory.push(["call_sid", String(params.call_sid)]);
+      pairs.push(["call_sid", String(params.call_sid)]);
     }
     // Extra caller-supplied params, excluding internals and already-mapped keys.
     const extra = Object.entries(params).filter(([k, v]) => !INTERNAL_KEYS.has(k) && k !== "call_sid" && v !== undefined && v !== null).map(([k, v]) => [k, String(v)]);
@@ -20967,7 +20978,7 @@ class Utils {
     // array as a plain object, turning index 0 into a key and the inner
     // array's toString() (comma-joined) into the value.
     const query = new URLSearchParams();
-    [...mandatory, ...extra].forEach(([k, v]) => query.append(k, v));
+    [...pairs, ...extra].forEach(([k, v]) => query.append(k, v));
     return query.toString();
   }
   /**
@@ -21063,7 +21074,11 @@ class ExotelAIAssistController extends EventEmitter {
       case "DISCONNECTED":
         this._setStatus("disconnected");
         this.emit("onCallEnd");
-        this._scheduleReconnect();
+        // Close codes 4001 (auth_failed) and 4002 (auth_timeout) are permanent
+        // auth failures — reconnecting with the same token would fail again.
+        if (msg.code !== 4001 && msg.code !== 4002) {
+          this._scheduleReconnect();
+        }
         break;
       case "ERROR":
         this._setStatus("error");
@@ -21075,14 +21090,26 @@ class ExotelAIAssistController extends EventEmitter {
     }
   }
   _handleServerPayload(raw) {
+    var _a;
     let parsed;
     try {
       parsed = JSON.parse(raw);
-    } catch (_a) {
+    } catch (_b) {
       this.emit("error", new Error(`Failed to parse server message: ${raw}`));
       return;
     }
     this.emit("raw", parsed);
+    // Auth error messages arrive before the server closes the connection.
+    // Treat both as fatal — the server will follow up with a 4001/4002 close.
+    const msgType = parsed.type;
+    if (msgType === "auth_failed" || msgType === "auth_timeout") {
+      const detail = (_a = parsed.error) !== null && _a !== void 0 ? _a : msgType;
+      const err = new Error(detail);
+      err.code = msgType.toUpperCase();
+      this._setStatus("error");
+      this.emit("error", err);
+      return;
+    }
     if (parsed.config) {
       this.emit("botConfig", parsed.config);
     }

package/dist/react/index.js

@@ -5102,13 +5102,21 @@ class BroadcastChannelTransport {
     if (this.socket) {
       this.socket.close(1000, "reconnecting");
     }
-    // authToken is passed as a subprotocol so it is sent in the
-    // Sec-WebSocket-Protocol header — the only way to include auth
-    // credentials in a browser WebSocket handshake.
     this.socket = new WebSocket(url);
     this.socket.onopen = () => {
       var _a;
       this.socketConnected = true;
+      // First-message auth protocol: send the JWT before any other message.
+      // The server does not send an auth_required prompt; the client is
+      // responsible for sending this immediately after the socket opens.
+      console.log('Sending token', {
+        type: "auth",
+        access_token: authToken
+      });
+      this.socket.send(JSON.stringify({
+        type: "auth",
+        access_token: authToken
+      }));
       const msg = {
         type: "CONNECTED"
       };
@@ -5133,11 +5141,12 @@ class BroadcastChannelTransport {
       (_a = this.handler) === null || _a === void 0 ? void 0 : _a.call(this, msg);
       this.channel.postMessage(msg);
     };
-    this.socket.onclose = () => {
+    this.socket.onclose = ev => {
       var _a;
       this.socketConnected = false;
       const msg = {
-        type: "DISCONNECTED"
+        type: "DISCONNECTED",
+        code: ev.code
       };
       (_a = this.handler) === null || _a === void 0 ? void 0 : _a.call(this, msg);
       this.channel.postMessage(msg);
@@ -6238,12 +6247,14 @@ class Utils {
   }
   static constructQueryParams(params) {
     // Keys consumed by the library — never forwarded to the server.
+    // authToken is intentionally excluded: authentication is done via the
+    // first WebSocket text message (first-message auth protocol), not the URL.
     const INTERNAL_KEYS = new Set(["authToken", "accountId", "wssBaseUrl", "reconnectInterval", "maxReconnectAttempts"]);
-    // Mandatory server params remapped to the names the API expects.
+    // Stream-key resolution params sent as query parameters.
     // accountId is embedded in the URL path — never sent as a query param.
-    const mandatory = [["access_token", String(params.authToken)]];
+    const pairs = [];
     if (params.call_sid !== undefined && params.call_sid !== null) {
-      mandatory.push(["call_sid", String(params.call_sid)]);
+      pairs.push(["call_sid", String(params.call_sid)]);
     }
     // Extra caller-supplied params, excluding internals and already-mapped keys.
     const extra = Object.entries(params).filter(([k, v]) => !INTERNAL_KEYS.has(k) && k !== "call_sid" && v !== undefined && v !== null).map(([k, v]) => [k, String(v)]);
@@ -6253,7 +6264,7 @@ class Utils {
     // array as a plain object, turning index 0 into a key and the inner
     // array's toString() (comma-joined) into the value.
     const query = new URLSearchParams();
-    [...mandatory, ...extra].forEach(([k, v]) => query.append(k, v));
+    [...pairs, ...extra].forEach(([k, v]) => query.append(k, v));
     return query.toString();
   }
   /**
@@ -6349,7 +6360,11 @@ class ExotelAIAssistController extends EventEmitter {
       case "DISCONNECTED":
         this._setStatus("disconnected");
         this.emit("onCallEnd");
-        this._scheduleReconnect();
+        // Close codes 4001 (auth_failed) and 4002 (auth_timeout) are permanent
+        // auth failures — reconnecting with the same token would fail again.
+        if (msg.code !== 4001 && msg.code !== 4002) {
+          this._scheduleReconnect();
+        }
         break;
       case "ERROR":
         this._setStatus("error");
@@ -6361,14 +6376,26 @@ class ExotelAIAssistController extends EventEmitter {
     }
   }
   _handleServerPayload(raw) {
+    var _a;
     let parsed;
     try {
       parsed = JSON.parse(raw);
-    } catch (_a) {
+    } catch (_b) {
       this.emit("error", new Error(`Failed to parse server message: ${raw}`));
       return;
     }
     this.emit("raw", parsed);
+    // Auth error messages arrive before the server closes the connection.
+    // Treat both as fatal — the server will follow up with a 4001/4002 close.
+    const msgType = parsed.type;
+    if (msgType === "auth_failed" || msgType === "auth_timeout") {
+      const detail = (_a = parsed.error) !== null && _a !== void 0 ? _a : msgType;
+      const err = new Error(detail);
+      err.code = msgType.toUpperCase();
+      this._setStatus("error");
+      this.emit("error", err);
+      return;
+    }
     if (parsed.config) {
       this.emit("botConfig", parsed.config);
     }

package/dist/types/index.d.ts

@@ -82,6 +82,7 @@ export type WorkerInboundMessage = {
     type: "CONNECTED";
 } | {
     type: "DISCONNECTED";
+    code?: number;
 } | {
     type: "ERROR";
     message: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exotel-npm-dev/exotel-ai-assist",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "AI-powered real-time suggestions, transcript, and sentiment for agent calls",
   "license": "Apache-2.0",
   "main": "dist/index.js",