@microsoft/omnichannel-chat-widget 1.8.4-main.4478bbf → 1.8.4-main.4515f87

package/README.md

@@ -177,7 +177,7 @@ Header's and Footer's child components consist of three parts:
 1. "middleGroup" - adding child components in the middle of the Header/Footer
 1. "rightGroup" - adding child components at the right of the Header/Footer
 
-By default Header has the header icon and title on the left and minimize and close buttons on the right, and Footer has Download Transcript and Email Transcript buttons on the left and audio notification button on the right. These components can be overriden with [ComponentOverrides](#ComponentOverrides). In addition, other custom child components can be added to both Header and Footer by creating custom react nodes and adding them to attributes "leftGroup", "middleGroup" or "rightGroup" of "controlProps".
+By default Header has the header icon and title on the left and minimize and close buttons on the right, and Footer has Download Transcript and Email Transcript buttons on the left and audio notification button on the right. These components can be overriden with [ComponentOverrides](#componentoverrides). In addition, other custom child components can be added to both Header and Footer by creating custom react nodes and adding them to attributes "leftGroup", "middleGroup" or "rightGroup" of "controlProps".
 
 ```js
 const buttonStyleProps: IButtonStyles = {
@@ -224,8 +224,10 @@ const customizedFooterProp: IFooterProps = {
 > :pushpin: Note that [WebChat hooks](https://github.com/microsoft/BotFramework-WebChat/blob/main/docs/HOOKS.md) can also be used in any custom components.
 
 #### Bidirectional Custom Events
+
 - Sending events from a hosting web page to bots/agents
-    - Register a function to post event
+  - Register a function to post event
+
         ```js
         //define sendCustomEvent function
         const sendCustomEvent = (payload) => {
@@ -253,7 +255,9 @@ const customizedFooterProp: IFooterProps = {
             }
         })
         ```
-    - Receiving events from bots/agents
+
+  - Receiving events from bots/agents
+
         ```js
         //define setOnCustomEvent function
         const setOnCustomEvent = (callback) => {
@@ -268,6 +272,38 @@ const customizedFooterProp: IFooterProps = {
         setOnCustomEvent((event) => console.log(event));
         ```
 
+#### Trigger initiateEndChat event
+
+Customer can trigger the initiateEndChat event via BroadcastService to end a chat session.
+When needed, the payload below could be triggered:
+
+```js
+const endChatEvent = {
+    eventName: "InitiateEndChat",
+    payload: {
+        skipSessionCloseForPersistentChat: true
+    } //optional payload
+};
+BroadcastService.postMessage(endChatEvent);
+```
+
+The payload of the event is optional, only needed when force closing of a persistent chat session is not required.
+When chat widget receives the event without any payload, it will:
+
+1. set the widget to closed state, the widget panel will be minimized. Post chat survey will not be displayed.
+2. trigger a sessionclose service network request to OmniChannel services.
+
+If skipSessionCloseForPersistentChat is set to true. The session close network request will not be triggered, instead, if postChat survey is available, post chat survey will be displayed.
+
+After successfully processed initiateEndChat event. The CloseChat event is broadcasted.
+
+```js
+BroadcastService.getMessageByEventName("CloseChat").subscribe(async (msg) => {
+    console.log("close chat received: ", msg);
+    //more actions to unmount component and resources
+})
+```
+
 ## See Also
 
 [Customizations Dev Guide](https://github.com/microsoft/omnichannel-chat-widget/blob/main/docs/customizations/getstarted.md)\

package/lib/cjs/common/Constants.js

@@ -82,6 +82,8 @@ _defineProperty(Constants, "audioMediaRegex", /(\.)(aac|aiff|alac|amr|flac|mp2|m
 _defineProperty(Constants, "videoMediaRegex", /(\.)(avchd|avi|flv|mpe|mpeg|mpg|mpv|mp4|m4p|m4v|mov|qt|swf|webm|wmv)$/i);
 _defineProperty(Constants, "chromeSupportedInlineMediaRegex", /(\.)(aac|mp3|wav|mp4)$/i);
 _defineProperty(Constants, "firefoxSupportedInlineMediaRegex", /(\.)(aac|flac|mp3|wav|mp4|mov)$/i);
+_defineProperty(Constants, "AdaptiveCardType", "adaptivecard");
+_defineProperty(Constants, "SuggestedActionsType", "suggestedactions");
 // calling container event names
 _defineProperty(Constants, "CallAdded", "callAdded");
 _defineProperty(Constants, "LocalVideoStreamAdded", "localVideoStreamAdded");
@@ -143,6 +145,7 @@ _defineProperty(Constants, "customEventName", "customEventName");
 _defineProperty(Constants, "customEventValue", "customEventValue");
 _defineProperty(Constants, "Hidden", "Hidden");
 _defineProperty(Constants, "EndConversationDueToOverflow", "endconversationduetooverflow");
+_defineProperty(Constants, "SkipSessionCloseForPersistentChatFlag", "skipSessionCloseForPersistentChat");
 const Regex = (_class = /*#__PURE__*/_createClass(function Regex() {
   _classCallCheck(this, Regex);
 }), _defineProperty(_class, "EmailRegex", "^(?:[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"[^\"\\\\]*(?:\\\\.[^\"\\\\]*)*\")@(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)*|\\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\])$"), _class);
@@ -378,6 +381,7 @@ _defineProperty(PrepareEndChatDescriptionConstants, "ConversationEndedBy", "Conv
 _defineProperty(PrepareEndChatDescriptionConstants, "PrepareEndChatError", "There's an error while preparing to end chat. Closing chat widget.");
 _defineProperty(PrepareEndChatDescriptionConstants, "WidgetLoadFailedAfterSessionInit", "SessionInit was successful, but widget load failed. Ending chat to avoid ghost chats in OC.");
 _defineProperty(PrepareEndChatDescriptionConstants, "InitiateEndChatReceived", "Received InitiateEndChat BroadcastEvent while conversation state is not Active. Ending chat.");
+_defineProperty(PrepareEndChatDescriptionConstants, "InitiateEndChatReceivedActiveChat", "Received InitiateEndChat BroadcastEvent while conversation state is Active. Updating conversation states.");
 _defineProperty(PrepareEndChatDescriptionConstants, "EndChatReceivedFromOtherTabs", "Received EndChat BroadcastEvent from other tabs. Closing this chat.");
 _defineProperty(PrepareEndChatDescriptionConstants, "CustomerCloseChatOnFailureOrPostChat", "Customer is trying to close chat widget on start chat failure or post chat pane.");
 _defineProperty(PrepareEndChatDescriptionConstants, "CustomerCloseInactiveChat", "Chat was Inactive and customer is trying to close chat widget or refreshing the page.");

package/lib/cjs/common/telemetry/AppInsightsEvents.js

@@ -6,8 +6,11 @@ Object.defineProperty(exports, "__esModule", {
 exports.AppInsightsEventMapping = void 0;
 const AppInsightsEventMapping = {
   "LCWChatButtonClicked": "LCWChatButtonActionStarted",
-  "PrechatSubmitted": "PrechatSubmitCompleted",
-  "StartChatEventRecevied": "StartChatEventReceivedCompleted",
+  "UXLCWChatButtonLoadingStart": "LiveChatWidgetChatButtonLoadingStarted",
+  "UXLCWChatButtonLoadingCompleted": "LiveChatWidgetChatButtonLoadingCompleted",
+  "UXPrechatPaneStart": "PrechatSurveyStarted",
+  "UXPrechatPaneCompleted": "PrechatSurveyCompleted",
+  "PrechatSubmitted": "PrechatSurveySubmitCompleted",
   "EndChatEventReceived": "EndChatEventReceivedCompleted",
   "EmailTranscriptSent": "EmailTranscriptActionCompleted",
   "EmailTranscriptFailed": "EmailTranscriptActionFailed",
@@ -15,8 +18,6 @@ const AppInsightsEventMapping = {
   "HeaderMinimizeButtonClicked": "MinimizeChatActionStarted",
   "DownloadTranscriptButtonClicked": "DownloadTranscriptActionStarted",
   "EmailTranscriptButtonClicked": "EmailTranscriptButtonActionStarted",
-  "CustomerVoiceFormResponseSubmitted": "CustomerVoiceFormResponseSubmitCompleted",
-  "StartProactiveChatEventReceived": "StartProactiveChatEventReceivedCompleted",
   "ProactiveChatRejected": "ProactiveChatTimeOutCompleted",
   "MessageSent": "MessageSentCompleted",
   "MessageReceived": "MessageReceivedCompleted",
@@ -25,6 +26,11 @@ const AppInsightsEventMapping = {
   "CustomContextReceived": "CustomContextReceivedCompleted",
   "NewTokenValidationStarted": "AuthTokenValidationStarted",
   "NewTokenValidationCompleted": "AuthTokenValidationCompleted",
-  "NewTokenValidationFailed": "AuthTokenValidationFailed"
+  "NewTokenValidationFailed": "AuthTokenValidationFailed",
+  "UXPostChatPaneStarted": "PostChatSurveyStarted",
+  "UXPostChatPaneCompleted": "PostChatSurveyCompleted",
+  "WidgetLoadStarted": "ChatSessionInitializationStarted",
+  "WidgetLoadComplete": "ChatSessionInitializationCompleted",
+  "WidgetLoadFailed": "ChatSessionInitializationFailed"
 };
 exports.AppInsightsEventMapping = AppInsightsEventMapping;

package/lib/cjs/common/telemetry/TelemetryConstants.js

@@ -124,6 +124,7 @@ exports.TelemetryEvent = TelemetryEvent;
   TelemetryEvent["EndChatFailed"] = "EndChatFailed";
   TelemetryEvent["SettingCustomContext"] = "SettingCustomContext";
   TelemetryEvent["WebChatLoaded"] = "WebChatLoaded";
+  TelemetryEvent["PersistentChatHistoryEnabled"] = "PersistentChatHistoryEnabled";
   TelemetryEvent["LCWChatButtonActionCompleted"] = "LCWChatButtonActionCompleted";
   TelemetryEvent["LCWChatButtonClicked"] = "LCWChatButtonClicked";
   TelemetryEvent["LCWChatButtonShow"] = "LCWChatButtonShow";
@@ -305,6 +306,7 @@ exports.TelemetryEvent = TelemetryEvent;
   TelemetryEvent["LCWPersistentConversationHandlerInitialized"] = "LCWPersistentConversationHandlerInitialized";
   TelemetryEvent["LCWPersistentHistoryPullBlocked"] = "LCWPersistentHistoryPullBlocked";
   TelemetryEvent["LCWPersistentHistoryPullCompleted"] = "LCWPersistentHistoryPullCompleted";
+  TelemetryEvent["LCWPersistentHistoryReturnedNull"] = "LCWPersistentHistoryReturnedNull";
   TelemetryEvent["LCWLazyLoadInitializationStarted"] = "LCWLazyLoadInitializationStarted";
   TelemetryEvent["LCWLazyLoadContainerNotFound"] = "LCWLazyLoadContainerNotFound";
   TelemetryEvent["LCWLazyLoadInitializationCompleted"] = "LCWLazyLoadInitializationCompleted";
@@ -314,7 +316,12 @@ exports.TelemetryEvent = TelemetryEvent;
   TelemetryEvent["LCWLazyLoadActivityMounted"] = "LCWLazyLoadActivityMounted";
   TelemetryEvent["LCWLazyLoadReset"] = "LCWLazyLoadReset";
   TelemetryEvent["LCWLazyLoadNoMoreHistory"] = "LCWLazyLoadNoMoreHistory";
+  TelemetryEvent["LCWLazyLoadHistoryError"] = "LCWLazyLoadHistoryError";
   TelemetryEvent["LCWLazyLoadDestroyed"] = "LCWLazyLoadDestroyed";
+  TelemetryEvent["LCWLazyLoadTriggerFired"] = "LCWLazyLoadTriggerFired";
+  TelemetryEvent["LCWLazyLoadBatchReceived"] = "LCWLazyLoadBatchReceived";
+  TelemetryEvent["LCWLazyLoadInitialLoadComplete"] = "LCWLazyLoadInitialLoadComplete";
+  TelemetryEvent["LCWLazyLoadScrollAnchorApplied"] = "LCWLazyLoadScrollAnchorApplied";
   TelemetryEvent["SecureEventBusUnauthorizedDispatch"] = "SecureEventBusUnauthorizedDispatch";
   TelemetryEvent["SecureEventBusListenerError"] = "SecureEventBusListenerError";
   TelemetryEvent["SecureEventBusDispatchError"] = "SecureEventBusDispatchError";

package/lib/cjs/common/telemetry/TelemetryManager.js

@@ -50,7 +50,7 @@ const RegisterLoggers = () => {
       loggers.push((0, _consoleLogger.consoleLogger)());
     }
     if (((_TelemetryManager$Int9 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int9 === void 0 ? void 0 : (_TelemetryManager$Int10 = _TelemetryManager$Int9.telemetryConfig) === null || _TelemetryManager$Int10 === void 0 ? void 0 : _TelemetryManager$Int10.telemetryDisabled) === false) {
-      var _TelemetryManager$Int11, _TelemetryManager$Int20, _TelemetryManager$Int21, _TelemetryManager$Int22, _TelemetryManager$Int23;
+      var _TelemetryManager$Int11, _TelemetryManager$Int20, _TelemetryManager$Int21, _TelemetryManager$Int22, _TelemetryManager$Int23, _TelemetryManager$Int24, _TelemetryManager$Int25, _TelemetryManager$Int26;
       if ((_TelemetryManager$Int11 = TelemetryManager.InternalTelemetryData) !== null && _TelemetryManager$Int11 !== void 0 && _TelemetryManager$Int11.ariaConfig) {
         var _TelemetryManager$Int12, _TelemetryManager$Int13, _TelemetryManager$Int14, _TelemetryManager$Int15, _TelemetryManager$Int16, _TelemetryManager$Int17, _TelemetryManager$Int18, _TelemetryManager$Int19;
         loggers.push((0, _ariaTelemetryLogger.ariaTelemetryLogger)(((_TelemetryManager$Int12 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int12 === void 0 ? void 0 : (_TelemetryManager$Int13 = _TelemetryManager$Int12.ariaConfig) === null || _TelemetryManager$Int13 === void 0 ? void 0 : _TelemetryManager$Int13.ariaTelemetryKey) ?? _defaultAriaConfig.defaultAriaConfig.ariaTelemetryKey, ((_TelemetryManager$Int14 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int14 === void 0 ? void 0 : (_TelemetryManager$Int15 = _TelemetryManager$Int14.ariaConfig) === null || _TelemetryManager$Int15 === void 0 ? void 0 : _TelemetryManager$Int15.disableCookieUsage) ?? _defaultAriaConfig.defaultAriaConfig.disableCookieUsage, ((_TelemetryManager$Int16 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int16 === void 0 ? void 0 : (_TelemetryManager$Int17 = _TelemetryManager$Int16.ariaConfig) === null || _TelemetryManager$Int17 === void 0 ? void 0 : _TelemetryManager$Int17.collectorUriForTelemetry) ?? _defaultAriaConfig.defaultAriaConfig.collectorUriForTelemetry, ((_TelemetryManager$Int18 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int18 === void 0 ? void 0 : (_TelemetryManager$Int19 = _TelemetryManager$Int18.ariaConfig) === null || _TelemetryManager$Int19 === void 0 ? void 0 : _TelemetryManager$Int19.ariaTelemetryApplicationName) ?? _defaultAriaConfig.defaultAriaConfig.ariaTelemetryApplicationName));
@@ -61,12 +61,15 @@ const RegisterLoggers = () => {
           loggers.push(logger);
         });
       }
-      if (((_TelemetryManager$Int22 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int22 === void 0 ? void 0 : (_TelemetryManager$Int23 = _TelemetryManager$Int22.appInsightsConfig) === null || _TelemetryManager$Int23 === void 0 ? void 0 : _TelemetryManager$Int23.appInsightsDisabled) === false) {
-        var _TelemetryManager$Int24;
-        if ((_TelemetryManager$Int24 = TelemetryManager.InternalTelemetryData) !== null && _TelemetryManager$Int24 !== void 0 && _TelemetryManager$Int24.appInsightsConfig.appInsightsKey) {
-          var _TelemetryManager$Int25;
-          loggers.push((0, _appInsightsLogger.appInsightsLogger)((_TelemetryManager$Int25 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int25 === void 0 ? void 0 : _TelemetryManager$Int25.appInsightsConfig.appInsightsKey));
-        }
+      const chatConfigAppInsightsKey = (_TelemetryManager$Int22 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int22 === void 0 ? void 0 : _TelemetryManager$Int22.chatConfigAppInsightsKey;
+      const appInsightsKeyFromUser = (_TelemetryManager$Int23 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int23 === void 0 ? void 0 : (_TelemetryManager$Int24 = _TelemetryManager$Int23.appInsightsConfig) === null || _TelemetryManager$Int24 === void 0 ? void 0 : _TelemetryManager$Int24.appInsightsKey;
+      // when chatConfig has AppInsightsInstrumentationKey
+      if (chatConfigAppInsightsKey) {
+        loggers.push((0, _appInsightsLogger.appInsightsLogger)(chatConfigAppInsightsKey));
+      }
+      // when key set through appInsightsConfig
+      else if (appInsightsKeyFromUser && ((_TelemetryManager$Int25 = TelemetryManager.InternalTelemetryData) === null || _TelemetryManager$Int25 === void 0 ? void 0 : (_TelemetryManager$Int26 = _TelemetryManager$Int25.appInsightsConfig) === null || _TelemetryManager$Int26 === void 0 ? void 0 : _TelemetryManager$Int26.appInsightsDisabled) === false) {
+        loggers.push((0, _appInsightsLogger.appInsightsLogger)(appInsightsKeyFromUser));
       }
     }
   };

package/lib/cjs/common/telemetry/loggers/appInsightsLogger.js

@@ -14,11 +14,11 @@ function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "functio
 function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
 var AllowedKeys;
 (function (AllowedKeys) {
-  AllowedKeys["OrganizationId"] = "OrganizationId";
-  AllowedKeys["ConversationId"] = "LiveWorkItemId";
+  AllowedKeys["OrganizationId"] = "powerplatform.analytics.resource.organization.id";
+  AllowedKeys["ConversationId"] = "powerplatform.analytics.resource.id";
   AllowedKeys["ElapsedTimeInMilliseconds"] = "Duration";
-  AllowedKeys["Description"] = "Description";
-  AllowedKeys["ChannelId"] = "ChannelType";
+  AllowedKeys["Description"] = "omnichannel.description";
+  AllowedKeys["ChannelId"] = "omnichannel.channel.type";
   AllowedKeys["LCWRuntimeId"] = "ClientSessionId";
 })(AllowedKeys || (AllowedKeys = {}));
 let initializationPromise = null;
@@ -95,8 +95,8 @@ const appInsightsLogger = appInsightsKey => {
         if (eventName) {
           const trackingEventName = getTrackingEventName(logLevel, eventName);
           const eventProperties = setEventProperties(trackingEventName, telemetryInfo);
-          _logger.trackEvent({
-            name: trackingEventName,
+          _logger.trackTrace({
+            message: trackingEventName,
             properties: eventProperties
           });
         }
@@ -142,7 +142,7 @@ const appInsightsLogger = appInsightsKey => {
     // Additional properties
     eventProperties["ConversationStage"] = customProperties.ConversationStage ?? _TelemetryConstants.ConversationStage.CSREngagement;
     eventProperties["Scenario"] = "Conversation Diagnostics";
-    eventProperties["OperationName"] = eventName.includes(": ") ? eventName.split(": ")[1] : eventName;
+    eventProperties["powerplatform.analytics.subscenario"] = eventName.includes(": ") ? eventName.split(": ")[1] : eventName;
     return eventProperties;
   }
   function getTrackingEventName(logLevel, eventName) {

package/lib/cjs/common/utils/xssUtils.js

@@ -7,70 +7,42 @@ exports.detectAndCleanXSS = void 0;
 var _dompurify = _interopRequireDefault(require("dompurify"));
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 /**
- * Detects potential Cross-Site Scripting (XSS) attacks in text input and sanitizes the content.
+ * Sanitizes text input and detects XSS attack patterns.
  * 
- * This function performs comprehensive XSS detection using pattern matching for common attack vectors
- * and then sanitizes the input using DOMPurify with strict configuration. It's designed to protect
- * against various XSS techniques including script injection, event handler injection, style-based
- * attacks, and encoded payloads.
+ * Sanitizes first with DOMPurify, then checks for malicious patterns in both
+ * the original and sanitized text to catch mutation XSS attacks.
  * 
- * Security patterns detected:
- * - JavaScript protocol URLs (javascript:)
- * - HTML event handlers (onmouseover, onclick, etc.)
- * - Script tags (<script>)
- * - CSS expression() functions
- * - CSS url() functions
- * - Position-based CSS attacks (position: fixed/absolute)
- * - VBScript protocol URLs
- * - Data URLs with HTML content
- * - Fragment identifiers with escaped quotes
- * - HTML entity-encoded angle brackets
- * 
- * @param text - The input text to be analyzed and sanitized
- * @returns An object containing:
- *   - cleanText: The sanitized version of the input text with all HTML tags and attributes removed
- *   - isXSSDetected: Boolean flag indicating whether potential XSS patterns were found in the original text
+ * @param text - Input text to sanitize
+ * @returns Object with cleanText (sanitized) and isXSSDetected flag
  */
 const detectAndCleanXSS = text => {
-  // Comprehensive array of regular expressions to detect common XSS attack patterns
-  const xssPatterns = [/javascript\s*:/gi,
-  // JavaScript protocol URLs (with optional spaces)
-  /vbscript\s*:/gi,
-  // VBScript protocol URLs (with optional spaces)
-  /on\w+\s*=/gi,
-  // HTML event handlers (onmouseover, onclick, onload, etc.)
-  /<\s*script/gi,
-  // Script tag opening (with optional spaces)
-  /expression\s*\(/gi,
-  // CSS expression() function (IE-specific)
-  /url\s*\(/gi,
-  // CSS url() function
-  /style\s*=.*position\s*:\s*fixed/gi,
-  // CSS position fixed attacks
-  /style\s*=.*position\s*:\s*absolute/gi,
-  // CSS position absolute attacks
-  /data\s*:\s*text\s*\/\s*html/gi,
-  // Data URLs containing HTML
-  /#.*\\"/gi,
-  // Fragment identifiers with escaped quotes
-  /&gt;.*&lt;/gi // HTML entity-encoded angle brackets indicating tag structure
-  ];
-
-  // Check if any XSS patterns are detected in the input text
-  const isXSSDetected = xssPatterns.some(pattern => pattern.test(text));
-
-  // Clean the text using DOMPurify with strict config
+  // Sanitize first to prevent mutation XSS (e.g., "s<iframe></iframe>tyle" → "style")
   const cleanText = _dompurify.default.sanitize(text, {
     ALLOWED_TAGS: [],
-    // No HTML tags allowed in title
     ALLOWED_ATTR: [],
     KEEP_CONTENT: true,
-    // Keep text content
     ALLOW_DATA_ATTR: false,
     ALLOW_UNKNOWN_PROTOCOLS: false,
     SANITIZE_DOM: true,
     FORCE_BODY: false
   });
+  const contentChanged = text !== cleanText;
+
+  // Non-global regex patterns to avoid stateful .test() issues
+  const xssPatterns = [/javascript\s*:/i, /vbscript\s*:/i, /on\w+\s*=/i,
+  // Event handlers
+  /<\s*script/i, /<\s*iframe/i, /<\s*object/i, /<\s*embed/i, /<\s*svg/i, /expression\s*\(/i,
+  // IE CSS expressions
+  /style\s*=.*position\s*:\s*(fixed|absolute)/i, /data\s*:\s*text\s*\/\s*html/i, /#.*\\"/i, /&(lt|gt|#x3c|#60|#x3e|#62);/i,
+  // HTML entities
+  /&#x?[0-9a-f]+;.*</i, /\u003c.*\u003e/i,
+  // Unicode escapes
+  /src\s*=\s*["']?\s*javascript:/i, /href\s*=\s*["']?\s*javascript:/i];
+  const hasXSSPattern = xssPatterns.some(pattern => {
+    return pattern.test(text) || pattern.test(cleanText);
+  });
+  const hasHTMLStructure = /<[^>]+>/.test(text) && !/<[^>]+>/.test(cleanText);
+  const isXSSDetected = contentChanged || hasXSSPattern || hasHTMLStructure;
   return {
     cleanText,
     isXSSDetected

package/lib/cjs/common/utils.js

@@ -7,7 +7,9 @@ exports.getCustomEventValue = exports.getConversationDetailsCall = exports.getBr
 exports.getDeviceType = getDeviceType;
 exports.getWidgetEndChatEventName = exports.getWidgetCacheIdfromProps = exports.getWidgetCacheId = exports.getTimestampHourMinute = exports.getStateFromCache = exports.getLocaleDirection = exports.getIconText = exports.getDomain = void 0;
 exports.isEndConversationDueToOverflowActivity = isEndConversationDueToOverflowActivity;
-exports.setTabIndices = exports.setOcUserAgent = exports.setFocusOnSendBox = exports.setFocusOnElement = exports.preventFocusToMoveOutOfElement = exports.parseLowerCaseString = exports.parseAdaptiveCardPayload = exports.newGuid = exports.isValidCustomEvent = exports.isUndefinedOrEmpty = exports.isThisSessionPopout = exports.isNullOrUndefined = exports.isNullOrEmptyString = void 0;
+exports.parseAdaptiveCardPayload = exports.newGuid = exports.isValidCustomEvent = exports.isUndefinedOrEmpty = exports.isThisSessionPopout = exports.isNullOrUndefined = exports.isNullOrEmptyString = void 0;
+exports.parseBooleanFromConfig = parseBooleanFromConfig;
+exports.setTabIndices = exports.setOcUserAgent = exports.setFocusOnSendBox = exports.setFocusOnElement = exports.preventFocusToMoveOutOfElement = exports.parseLowerCaseString = void 0;
 var _Constants = require("./Constants");
 var _TelemetryConstants = require("./telemetry/TelemetryConstants");
 var _omnichannelChatComponents = require("@microsoft/omnichannel-chat-components");
@@ -478,7 +480,7 @@ const setOcUserAgent = chatSDK => {
   // eslint-disable-line @typescript-eslint/no-explicit-any
   if ((_chatSDK$OCClient = chatSDK.OCClient) !== null && _chatSDK$OCClient !== void 0 && _chatSDK$OCClient.ocUserAgent && !((_chatSDK$OCClient2 = chatSDK.OCClient) !== null && _chatSDK$OCClient2 !== void 0 && _chatSDK$OCClient2.ocUserAgent.join(" ").includes("omnichannel-chat-widget/"))) {
     try {
-      const version = require("../../../package.json").version; // eslint-disable-line @typescript-eslint/no-var-requires
+      const version = require("../../package.json").version; // eslint-disable-line @typescript-eslint/no-var-requires
       const userAgent = `omnichannel-chat-widget/${version}`;
       chatSDK.OCClient.ocUserAgent = [userAgent, ...chatSDK.OCClient.ocUserAgent];
     } catch (error) {
@@ -519,4 +521,15 @@ exports.getCustomEventValue = getCustomEventValue;
 function isEndConversationDueToOverflowActivity(activity) {
   var _activity$channelData, _activity$channelData2;
   return (activity === null || activity === void 0 ? void 0 : (_activity$channelData = activity.channelData) === null || _activity$channelData === void 0 ? void 0 : _activity$channelData.tags) && Array.isArray(activity === null || activity === void 0 ? void 0 : (_activity$channelData2 = activity.channelData) === null || _activity$channelData2 === void 0 ? void 0 : _activity$channelData2.tags) && activity.channelData.tags.includes(_Constants.Constants.EndConversationDueToOverflow);
+}
+
+/**
+ * Parses a value that can be boolean or string ("true"/"false") into a boolean.
+ * Handles null/undefined by returning false.
+ * 
+ * @param value - The value to parse (can be boolean, string, null, or undefined)
+ * @returns true if value is true or "true" (case-insensitive), false otherwise
+ */
+function parseBooleanFromConfig(value) {
+  return value === true || (value === null || value === void 0 ? void 0 : value.toString().toLowerCase()) === "true";
 }

package/lib/cjs/components/citationpanestateful/CitationPaneStateful.js

@@ -42,7 +42,7 @@ const CitationPaneStateful = props => {
   const [paneStyle, setPaneStyle] = (0, _react.useState)(null);
   const [isReady, setIsReady] = (0, _react.useState)(false);
 
-  // Move focus to the container
+  // Initial focus pattern (mirrors ConfirmationPaneStateful): focus first focusable element (will re-attempt after visibility becomes true)
   (0, _react.useEffect)(() => {
     (0, _utils.preventFocusToMoveOutOfElement)(controlId);
     const focusableElements = (0, _utils.findAllFocusableElement)(`#${controlId}`);
@@ -64,6 +64,25 @@ const CitationPaneStateful = props => {
     });
   }, []);
 
+  // Retry focus once pane is actually visible (isReady) in case initial attempt occurred while wrapper was visibility:hidden
+  (0, _react.useEffect)(() => {
+    if (!isReady) return;
+    const focusableElements = (0, _utils.findAllFocusableElement)(`#${controlId}`);
+    if (focusableElements && focusableElements.length > 0) {
+      const first = focusableElements[0];
+      // If focused element is not already inside the pane, move focus
+      if (!first.contains(document.activeElement) && !(document.activeElement && document.activeElement.id.startsWith(controlId))) {
+        requestAnimationFrame(() => {
+          if (first.isConnected) {
+            first.focus({
+              preventScroll: true
+            });
+          }
+        });
+      }
+    }
+  }, [isReady, controlId]);
+
   // Compute the widget bounds and set pane style accordingly (95% of widget size
   // and centered inside the widget). If the widget container can't be found,
   // fall back to the default pane styles from defaultCitationPaneProps.

package/lib/cjs/components/errorboundary/ErrorBoundary.js

@@ -19,11 +19,12 @@ function _possibleConstructorReturn(self, call) { if (call && (typeof call === "
 function _assertThisInitialized(self) { if (self === void 0) { throw new ReferenceError("this hasn't been initialised - super() hasn't been called"); } return self; }
 function _isNativeReflectConstruct() { if (typeof Reflect === "undefined" || !Reflect.construct) return false; if (Reflect.construct.sham) return false; if (typeof Proxy === "function") return true; try { Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {})); return true; } catch (e) { return false; } }
 function _getPrototypeOf(o) { _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf.bind() : function _getPrototypeOf(o) { return o.__proto__ || Object.getPrototypeOf(o); }; return _getPrototypeOf(o); }
+// eslint-disable-next-line @typescript-eslint/ban-types
 const RenderChildrenFunction = _ref => {
   let {
     children
   } = _ref;
-  return typeof children === 'function' ? children() : children;
+  return typeof children === "function" ? children() : children;
 };
 let ErrorBoundary = /*#__PURE__*/function (_Component) {
   _inherits(ErrorBoundary, _Component);

package/lib/cjs/components/livechatwidget/common/ActivitySubscriber/BotAuthActivitySubscriber.js

@@ -44,7 +44,7 @@ const extractSasUrl = async attachment => {
   }
   return sasUrl;
 };
-const fetchBotAuthConfig = async (retries, interval) => {
+const fetchBotAuthConfig = async (retries, interval, fallback) => {
   _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
     Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderFetchConfig
   });
@@ -60,13 +60,23 @@ const fetchBotAuthConfig = async (retries, interval) => {
   });
   if (retries === 1) {
     // Base Case
-    throw new Error();
+    if (response !== undefined) {
+      return response;
+    }
+    if (fallback !== undefined) {
+      _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.WARN, {
+        Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderNotFound,
+        Description: `Failed to fetch bot auth config after maximum retries. Using fallback value: ${fallback}`
+      });
+      return fallback;
+    }
+    throw new Error("Failed to fetch bot auth config after maximum retries");
   }
   await delay(interval);
   if (response !== undefined) {
     return response;
   }
-  return await fetchBotAuthConfig(--retries, interval);
+  return await fetchBotAuthConfig(--retries, interval, fallback);
 };
 let BotAuthActivitySubscriber = /*#__PURE__*/function () {
   function BotAuthActivitySubscriber() {
@@ -76,6 +86,7 @@ let BotAuthActivitySubscriber = /*#__PURE__*/function () {
     _defineProperty(this, "signInCardSeen", void 0);
     _defineProperty(this, "fetchBotAuthConfigRetries", void 0);
     _defineProperty(this, "fetchBotAuthConfigRetryInterval", void 0);
+    _defineProperty(this, "fallbackShowSignInCard", void 0);
     this.signInCardSeen = new Set();
     this.fetchBotAuthConfigRetries = 3;
     this.fetchBotAuthConfigRetryInterval = 1000;
@@ -85,6 +96,11 @@ let BotAuthActivitySubscriber = /*#__PURE__*/function () {
     if (optionalParams.fetchBotAuthConfigRetryInterval) {
       this.fetchBotAuthConfigRetryInterval = optionalParams.fetchBotAuthConfigRetryInterval;
     }
+    this.fallbackShowSignInCard = optionalParams.fallbackShowSignInCard;
+    _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
+      Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderFetchConfig,
+      Description: `BotAuthActivitySubscriber initialized with fallbackShowSignInCard: ${optionalParams.fallbackShowSignInCard}`
+    });
   }
   _createClass(BotAuthActivitySubscriber, [{
     key: "applicable",
@@ -129,7 +145,7 @@ let BotAuthActivitySubscriber = /*#__PURE__*/function () {
         _omnichannelChatComponents.BroadcastService.postMessage(event);
       }
       try {
-        const response = await fetchBotAuthConfig(this.fetchBotAuthConfigRetries, this.fetchBotAuthConfigRetryInterval);
+        const response = await fetchBotAuthConfig(this.fetchBotAuthConfigRetries, this.fetchBotAuthConfigRetryInterval, this.fallbackShowSignInCard);
         if (response === false) {
           _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
             Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderHideCard
@@ -140,9 +156,10 @@ let BotAuthActivitySubscriber = /*#__PURE__*/function () {
           });
           return activity;
         }
-      } catch {
+      } catch (e) {
         _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
-          Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderNotFound
+          Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderNotFound,
+          ExceptionDetails: e instanceof Error ? e.message : JSON.stringify(e)
         });
         //this is to ensure listener continues waiting for response
         if (this.signInCardSeen.has(signInId)) {

package/lib/cjs/components/livechatwidget/common/ChatWidgetEvents.js

@@ -9,7 +9,8 @@ var ChatWidgetEvents;
   ChatWidgetEvents["ADD_ACTIVITY"] = "CHAT_WIDGET/ADD_ACTIVITY";
   ChatWidgetEvents["FETCH_PERSISTENT_CHAT_HISTORY"] = "CHAT_WIDGET/FETCH_PERSISTENT_CHAT_HISTORY";
   ChatWidgetEvents["NO_MORE_HISTORY_AVAILABLE"] = "CHAT_WIDGET/NO_MORE_HISTORY_AVAILABLE";
-  ChatWidgetEvents["HIDE_LOADING_BANNER"] = "CHAT_WIDGET/HIDE_LOADING_BANNER";
+  ChatWidgetEvents["HISTORY_LOAD_ERROR"] = "CHAT_WIDGET/HISTORY_LOAD_ERROR";
+  ChatWidgetEvents["HISTORY_BATCH_LOADED"] = "CHAT_WIDGET/HISTORY_BATCH_LOADED";
 })(ChatWidgetEvents || (ChatWidgetEvents = {}));
 var _default = ChatWidgetEvents;
 exports.default = _default;

package/lib/cjs/components/livechatwidget/common/PersistentConversationHandler.js

@@ -36,7 +36,7 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
     _defineProperty(this, "facadeChatSDK", void 0);
     _defineProperty(this, "lastMessage", null);
     _defineProperty(this, "count", 0);
-    _defineProperty(this, "pageSize", 4);
+    _defineProperty(this, "pageSize", _defaultPersistentChatHistoryProps.defaultPersistentChatHistoryProps.pageSize);
     _defineProperty(this, "isCurrentlyPulling", false);
     _defineProperty(this, "pageTokenInTransitSet", new Set());
     _defineProperty(this, "resetEventListener", _omnichannelChatComponents.BroadcastService.getMessageByEventName(_TelemetryConstants.BroadcastEvent.PersistentConversationReset).subscribe(() => {
@@ -48,18 +48,21 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
       Event: _TelemetryConstants.TelemetryEvent.LCWPersistentConversationHandlerInitialized,
       Description: "PersistentConversationHandler initialized",
       CustomProperties: {
-        pageSize: this.pageSize
+        pageSize: _defaultPersistentChatHistoryProps.defaultPersistentChatHistoryProps.pageSize
       }
     });
   }
   _createClass(PersistentConversationHandler, [{
     key: "appliedPropsHandler",
     value: function appliedPropsHandler(props) {
+      var _this$appliedProps;
       this.appliedProps = {
         ..._defaultPersistentChatHistoryProps.defaultPersistentChatHistoryProps,
         ...props
       };
-      this.pageSize = this.appliedProps.pageSize || 4;
+
+      // if the props is not existent or is not a number then default to defaultPersistentChatHistoryProps.pageSize
+      this.pageSize = ((_this$appliedProps = this.appliedProps) === null || _this$appliedProps === void 0 ? void 0 : _this$appliedProps.pageSize) !== undefined && !isNaN(this.appliedProps.pageSize) ? this.appliedProps.pageSize : _defaultPersistentChatHistoryProps.defaultPersistentChatHistoryProps.pageSize;
     }
   }, {
     key: "reset",
@@ -104,12 +107,23 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
       try {
         var _ref;
         const messages = await this.fetchHistoryMessages();
-        if (messages === null || (messages === null || messages === void 0 ? void 0 : messages.length) === 0) {
+
+        // Handle error case - null indicates an error occurred
+        // Don't mark as last pull to allow retry on next attempt
+        if (messages == null) {
+          _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.WARN, {
+            Event: _TelemetryConstants.TelemetryEvent.LCWPersistentHistoryReturnedNull,
+            Description: "History pull returned null - Possible error occurred, will retry on next scroll",
+            ElapsedTimeInMilliseconds: pullTimer.milliSecondsElapsed
+          });
+          return;
+        }
+
+        // Handle legitimate end of history - empty array
+        if (messages.length === 0) {
           this.isLastPull = true;
           // Dispatch event to notify UI that no more history is available
           (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.NO_MORE_HISTORY_AVAILABLE);
-          // Also hide the loading banner
-          (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HIDE_LOADING_BANNER);
           _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.INFO, {
             Event: _TelemetryConstants.TelemetryEvent.LCWPersistentHistoryPullCompleted,
             Description: "History pull completed - no more messages",
@@ -120,8 +134,11 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
         const messagesDescOrder = (_ref = [...messages]) === null || _ref === void 0 ? void 0 : _ref.reverse();
         this.processHistoryMessages(messagesDescOrder);
 
-        // Dispatch event to hide the loading banner after messages are processed
-        (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HIDE_LOADING_BANNER);
+        // Signal that a batch of history messages has been added to the store.
+        // LazyLoadActivity subscribes to this to apply scroll anchoring after render.
+        (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HISTORY_BATCH_LOADED, {
+          messageCount: messages.length
+        });
         _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.INFO, {
           Event: _TelemetryConstants.TelemetryEvent.LCWPersistentHistoryPullCompleted,
           Description: "History pull completed successfully",
@@ -177,7 +194,6 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
       if (!this.shouldPull()) {
         // Dispatch event to ensure banner is hidden when no more pulls are needed
         (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.NO_MORE_HISTORY_AVAILABLE);
-        (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HIDE_LOADING_BANNER);
         return [];
       }
       const options = {
@@ -203,24 +219,20 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
           this.isLastPull = true;
           // Dispatch event when we reach the end of available history
           (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.NO_MORE_HISTORY_AVAILABLE);
-          // Also hide the loading banner
-          (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HIDE_LOADING_BANNER);
           return [];
         }
-        (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HIDE_LOADING_BANNER);
         return messages;
       } catch (error) {
         _TelemetryHelper.TelemetryHelper.logSDKEvent(_TelemetryConstants.LogLevel.ERROR, {
           Event: _TelemetryConstants.TelemetryEvent.FetchPersistentChatHistoryFailed,
           ExceptionDetails: error
         });
-        this.isLastPull = true;
-        this.pageToken = null;
-        // Dispatch event when there's an error to stop loading banner
-        (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.NO_MORE_HISTORY_AVAILABLE);
-        // Also hide the loading banner
-        (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HIDE_LOADING_BANNER);
-        return [];
+
+        // On error, dispatch HISTORY_LOAD_ERROR to hide loading banner without marking conversation as ended
+        // This allows recovery on the next attempt (e.g., transient network errors)
+        // Return null to distinguish error from legitimate empty history
+        (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HISTORY_LOAD_ERROR);
+        return null;
       }
     }
   }, {
@@ -235,6 +247,9 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
     value: function processMessageToActivity(message) {
       try {
         const activity = (0, _convertPersistentChatHistoryMessageToActivity.default)(message);
+        if (!activity) {
+          return null;
+        }
         activity.id = activity.id || `activity-${this.count}`;
         activity.channelData = {
           ...activity.channelData,