@microsoft/omnichannel-chat-widget 1.8.4-main.cbab5fc → 1.8.4-main.cc63f01

package/lib/cjs/common/utils/xssUtils.js

@@ -7,70 +7,42 @@ exports.detectAndCleanXSS = void 0;
 var _dompurify = _interopRequireDefault(require("dompurify"));
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 /**
- * Detects potential Cross-Site Scripting (XSS) attacks in text input and sanitizes the content.
+ * Sanitizes text input and detects XSS attack patterns.
  * 
- * This function performs comprehensive XSS detection using pattern matching for common attack vectors
- * and then sanitizes the input using DOMPurify with strict configuration. It's designed to protect
- * against various XSS techniques including script injection, event handler injection, style-based
- * attacks, and encoded payloads.
+ * Sanitizes first with DOMPurify, then checks for malicious patterns in both
+ * the original and sanitized text to catch mutation XSS attacks.
  * 
- * Security patterns detected:
- * - JavaScript protocol URLs (javascript:)
- * - HTML event handlers (onmouseover, onclick, etc.)
- * - Script tags (<script>)
- * - CSS expression() functions
- * - CSS url() functions
- * - Position-based CSS attacks (position: fixed/absolute)
- * - VBScript protocol URLs
- * - Data URLs with HTML content
- * - Fragment identifiers with escaped quotes
- * - HTML entity-encoded angle brackets
- * 
- * @param text - The input text to be analyzed and sanitized
- * @returns An object containing:
- *   - cleanText: The sanitized version of the input text with all HTML tags and attributes removed
- *   - isXSSDetected: Boolean flag indicating whether potential XSS patterns were found in the original text
+ * @param text - Input text to sanitize
+ * @returns Object with cleanText (sanitized) and isXSSDetected flag
  */
 const detectAndCleanXSS = text => {
-  // Comprehensive array of regular expressions to detect common XSS attack patterns
-  const xssPatterns = [/javascript\s*:/gi,
-  // JavaScript protocol URLs (with optional spaces)
-  /vbscript\s*:/gi,
-  // VBScript protocol URLs (with optional spaces)
-  /on\w+\s*=/gi,
-  // HTML event handlers (onmouseover, onclick, onload, etc.)
-  /<\s*script/gi,
-  // Script tag opening (with optional spaces)
-  /expression\s*\(/gi,
-  // CSS expression() function (IE-specific)
-  /url\s*\(/gi,
-  // CSS url() function
-  /style\s*=.*position\s*:\s*fixed/gi,
-  // CSS position fixed attacks
-  /style\s*=.*position\s*:\s*absolute/gi,
-  // CSS position absolute attacks
-  /data\s*:\s*text\s*\/\s*html/gi,
-  // Data URLs containing HTML
-  /#.*\\"/gi,
-  // Fragment identifiers with escaped quotes
-  /&gt;.*&lt;/gi // HTML entity-encoded angle brackets indicating tag structure
-  ];
-
-  // Check if any XSS patterns are detected in the input text
-  const isXSSDetected = xssPatterns.some(pattern => pattern.test(text));
-
-  // Clean the text using DOMPurify with strict config
+  // Sanitize first to prevent mutation XSS (e.g., "s<iframe></iframe>tyle" → "style")
   const cleanText = _dompurify.default.sanitize(text, {
     ALLOWED_TAGS: [],
-    // No HTML tags allowed in title
     ALLOWED_ATTR: [],
     KEEP_CONTENT: true,
-    // Keep text content
     ALLOW_DATA_ATTR: false,
     ALLOW_UNKNOWN_PROTOCOLS: false,
     SANITIZE_DOM: true,
     FORCE_BODY: false
   });
+  const contentChanged = text !== cleanText;
+
+  // Non-global regex patterns to avoid stateful .test() issues
+  const xssPatterns = [/javascript\s*:/i, /vbscript\s*:/i, /on\w+\s*=/i,
+  // Event handlers
+  /<\s*script/i, /<\s*iframe/i, /<\s*object/i, /<\s*embed/i, /<\s*svg/i, /expression\s*\(/i,
+  // IE CSS expressions
+  /style\s*=.*position\s*:\s*(fixed|absolute)/i, /data\s*:\s*text\s*\/\s*html/i, /#.*\\"/i, /&(lt|gt|#x3c|#60|#x3e|#62);/i,
+  // HTML entities
+  /&#x?[0-9a-f]+;.*</i, /\u003c.*\u003e/i,
+  // Unicode escapes
+  /src\s*=\s*["']?\s*javascript:/i, /href\s*=\s*["']?\s*javascript:/i];
+  const hasXSSPattern = xssPatterns.some(pattern => {
+    return pattern.test(text) || pattern.test(cleanText);
+  });
+  const hasHTMLStructure = /<[^>]+>/.test(text) && !/<[^>]+>/.test(cleanText);
+  const isXSSDetected = contentChanged || hasXSSPattern || hasHTMLStructure;
   return {
     cleanText,
     isXSSDetected

package/lib/cjs/common/utils.js

@@ -3,11 +3,13 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.getCustomEventValue = exports.getConversationDetailsCall = exports.getBroadcastChannelName = exports.formatTemplateString = exports.findParentFocusableElementsWithoutChildContainer = exports.findAllFocusableElement = exports.extractPreChatSurveyResponseValues = exports.escapeHtml = exports.debounceLeading = exports.createTimer = exports.createFileAndDownload = exports.checkContactIdError = exports.changeLanguageCodeFormatForWebChat = exports.addDelayInMs = void 0;
+exports.getCustomEventValue = exports.getConversationDetailsCall = exports.getBroadcastChannelName = exports.formatTemplateString = exports.findParentFocusableElementsWithoutChildContainer = exports.findAllFocusableElement = exports.extractPreChatSurveyResponseValues = exports.escapeHtml = exports.debounceLeading = exports.createTimer = exports.createFileAndDownload = exports.checkContactIdError = exports.changeLanguageCodeFormatForWebChat = exports.announceMessageImmediately = exports.addDelayInMs = void 0;
 exports.getDeviceType = getDeviceType;
 exports.getWidgetEndChatEventName = exports.getWidgetCacheIdfromProps = exports.getWidgetCacheId = exports.getTimestampHourMinute = exports.getStateFromCache = exports.getLocaleDirection = exports.getIconText = exports.getDomain = void 0;
 exports.isEndConversationDueToOverflowActivity = isEndConversationDueToOverflowActivity;
-exports.setTabIndices = exports.setOcUserAgent = exports.setFocusOnSendBox = exports.setFocusOnElement = exports.preventFocusToMoveOutOfElement = exports.parseLowerCaseString = exports.parseAdaptiveCardPayload = exports.newGuid = exports.isValidCustomEvent = exports.isUndefinedOrEmpty = exports.isThisSessionPopout = exports.isNullOrUndefined = exports.isNullOrEmptyString = void 0;
+exports.parseAdaptiveCardPayload = exports.newGuid = exports.isValidCustomEvent = exports.isUndefinedOrEmpty = exports.isThisSessionPopout = exports.isNullOrUndefined = exports.isNullOrEmptyString = void 0;
+exports.parseBooleanFromConfig = parseBooleanFromConfig;
+exports.setTabIndices = exports.setOcUserAgent = exports.setFocusOnSendBox = exports.setFocusOnElement = exports.setAriaHiddenForSiblings = exports.preventFocusToMoveOutOfElement = exports.parseLowerCaseString = void 0;
 var _Constants = require("./Constants");
 var _TelemetryConstants = require("./telemetry/TelemetryConstants");
 var _omnichannelChatComponents = require("@microsoft/omnichannel-chat-components");
@@ -83,28 +85,69 @@ exports.findAllFocusableElement = findAllFocusableElement;
 const preventFocusToMoveOutOfElement = elementId => {
   const container = document.getElementById(elementId);
   if (!container) {
-    return;
+    return () => {/* no-op */};
   }
   const focusableElements = findAllFocusableElement(container);
   if (!focusableElements) {
-    return;
+    return () => {/* no-op */};
   }
   const firstFocusableElement = focusableElements[0];
   const lastFocusableElement = focusableElements[focusableElements.length - 1];
-  firstFocusableElement.onkeydown = e => {
-    if (e.shiftKey && e.key === _KeyCodes.KeyCodes.TAB) {
-      e.preventDefault();
-      lastFocusableElement === null || lastFocusableElement === void 0 ? void 0 : lastFocusableElement.focus();
-    }
-  };
-  lastFocusableElement.onkeydown = e => {
-    if (!e.shiftKey && e.key === _KeyCodes.KeyCodes.TAB) {
-      e.preventDefault();
-      firstFocusableElement === null || firstFocusableElement === void 0 ? void 0 : firstFocusableElement.focus();
-    }
-  };
+  const cleanups = [];
+  if (firstFocusableElement === lastFocusableElement) {
+    const handler = e => {
+      if (e.key === _KeyCodes.KeyCodes.TAB && !e.shiftKey) {
+        e.preventDefault();
+        firstFocusableElement.focus();
+      } else if (e.key === _KeyCodes.KeyCodes.TAB && e.shiftKey) {
+        e.preventDefault();
+        firstFocusableElement.focus();
+      }
+    };
+    firstFocusableElement.addEventListener("keydown", handler);
+    cleanups.push(() => firstFocusableElement.removeEventListener("keydown", handler));
+  } else {
+    const firstHandler = e => {
+      if (e.shiftKey && e.key === _KeyCodes.KeyCodes.TAB) {
+        e.preventDefault();
+        lastFocusableElement === null || lastFocusableElement === void 0 ? void 0 : lastFocusableElement.focus();
+      }
+    };
+    firstFocusableElement.addEventListener("keydown", firstHandler);
+    cleanups.push(() => firstFocusableElement.removeEventListener("keydown", firstHandler));
+    const lastHandler = e => {
+      if (!e.shiftKey && e.key === _KeyCodes.KeyCodes.TAB) {
+        e.preventDefault();
+        firstFocusableElement === null || firstFocusableElement === void 0 ? void 0 : firstFocusableElement.focus();
+      }
+    };
+    lastFocusableElement.addEventListener("keydown", lastHandler);
+    cleanups.push(() => lastFocusableElement.removeEventListener("keydown", lastHandler));
+  }
+  return () => cleanups.forEach(fn => fn());
 };
 exports.preventFocusToMoveOutOfElement = preventFocusToMoveOutOfElement;
+const setAriaHiddenForSiblings = (elementId, shouldHide, stateMap) => {
+  const element = document.getElementById(elementId);
+  if (!(element !== null && element !== void 0 && element.parentElement)) return;
+  Array.from(element.parentElement.children).forEach(sibling => {
+    if (sibling !== element) {
+      if (shouldHide) {
+        stateMap.set(sibling, sibling.getAttribute("aria-hidden"));
+        sibling.setAttribute("aria-hidden", "true");
+      } else if (stateMap.has(sibling)) {
+        const original = stateMap.get(sibling);
+        if (original === null) {
+          sibling.removeAttribute("aria-hidden");
+        } else {
+          sibling.setAttribute("aria-hidden", original);
+        }
+        stateMap.delete(sibling);
+      }
+    }
+  });
+};
+exports.setAriaHiddenForSiblings = setAriaHiddenForSiblings;
 const setFocusOnSendBox = () => {
   const sendBoxSelector = "textarea[data-id=\"webchat-sendbox-input\"]";
   setFocusOnElement(sendBoxSelector);
@@ -115,6 +158,41 @@ const setFocusOnElement = selector => {
   element === null || element === void 0 ? void 0 : element.focus();
 };
 exports.setFocusOnElement = setFocusOnElement;
+const IMMEDIATE_ANNOUNCEMENT_REGION_ID = "oc-lcw-immediate-announcement";
+
+// Announces a message to screen readers via an aria-live="assertive" region
+// attached to document.body — outside the chat widget's DOM subtree — so the
+// screen reader does not have to traverse chat content to reach it.
+const announceMessageImmediately = message => {
+  if (!message || typeof document === "undefined") {
+    return;
+  }
+  let region = document.getElementById(IMMEDIATE_ANNOUNCEMENT_REGION_ID);
+  if (!region) {
+    region = document.createElement("div");
+    region.id = IMMEDIATE_ANNOUNCEMENT_REGION_ID;
+    region.setAttribute("aria-live", "assertive");
+    region.setAttribute("role", "alert");
+    region.setAttribute("aria-atomic", "true");
+    region.style.position = "absolute";
+    region.style.width = "1px";
+    region.style.height = "1px";
+    region.style.overflow = "hidden";
+    region.style.clip = "rect(0 0 0 0)";
+    region.style.clipPath = "inset(50%)";
+    region.style.whiteSpace = "nowrap";
+    document.body.appendChild(region);
+  }
+  region.textContent = "";
+  // Re-set on the next tick so screen readers detect the change even when
+  // the same message is announced twice in a row.
+  setTimeout(() => {
+    if (region) {
+      region.textContent = message;
+    }
+  }, 50);
+};
+exports.announceMessageImmediately = announceMessageImmediately;
 const escapeHtml = inputString => {
   const entityMap = {
     "<": "&lt;",
@@ -478,7 +556,7 @@ const setOcUserAgent = chatSDK => {
   // eslint-disable-line @typescript-eslint/no-explicit-any
   if ((_chatSDK$OCClient = chatSDK.OCClient) !== null && _chatSDK$OCClient !== void 0 && _chatSDK$OCClient.ocUserAgent && !((_chatSDK$OCClient2 = chatSDK.OCClient) !== null && _chatSDK$OCClient2 !== void 0 && _chatSDK$OCClient2.ocUserAgent.join(" ").includes("omnichannel-chat-widget/"))) {
     try {
-      const version = require("../../../package.json").version; // eslint-disable-line @typescript-eslint/no-var-requires
+      const version = require("../../package.json").version; // eslint-disable-line @typescript-eslint/no-var-requires
       const userAgent = `omnichannel-chat-widget/${version}`;
       chatSDK.OCClient.ocUserAgent = [userAgent, ...chatSDK.OCClient.ocUserAgent];
     } catch (error) {
@@ -519,4 +597,15 @@ exports.getCustomEventValue = getCustomEventValue;
 function isEndConversationDueToOverflowActivity(activity) {
   var _activity$channelData, _activity$channelData2;
   return (activity === null || activity === void 0 ? void 0 : (_activity$channelData = activity.channelData) === null || _activity$channelData === void 0 ? void 0 : _activity$channelData.tags) && Array.isArray(activity === null || activity === void 0 ? void 0 : (_activity$channelData2 = activity.channelData) === null || _activity$channelData2 === void 0 ? void 0 : _activity$channelData2.tags) && activity.channelData.tags.includes(_Constants.Constants.EndConversationDueToOverflow);
+}
+
+/**
+ * Parses a value that can be boolean or string ("true"/"false") into a boolean.
+ * Handles null/undefined by returning false.
+ * 
+ * @param value - The value to parse (can be boolean, string, null, or undefined)
+ * @returns true if value is true or "true" (case-insensitive), false otherwise
+ */
+function parseBooleanFromConfig(value) {
+  return value === true || (value === null || value === void 0 ? void 0 : value.toString().toLowerCase()) === "true";
 }

package/lib/cjs/components/citationpanestateful/CitationPaneStateful.js

@@ -44,7 +44,7 @@ const CitationPaneStateful = props => {
 
   // Initial focus pattern (mirrors ConfirmationPaneStateful): focus first focusable element (will re-attempt after visibility becomes true)
   (0, _react.useEffect)(() => {
-    (0, _utils.preventFocusToMoveOutOfElement)(controlId);
+    const cleanup = (0, _utils.preventFocusToMoveOutOfElement)(controlId);
     const focusableElements = (0, _utils.findAllFocusableElement)(`#${controlId}`);
     requestAnimationFrame(() => {
       if (focusableElements && focusableElements.length > 0 && focusableElements[0]) {
@@ -62,6 +62,13 @@ const CitationPaneStateful = props => {
       Event: _TelemetryConstants.TelemetryEvent.UXCitationPaneCompleted,
       ElapsedTimeInMilliseconds: uiTimer.milliSecondsElapsed
     });
+    return () => {
+      // internal tracking: restore parent tab indices on unmount so focus
+      // can escape the widget even if the pane is dismissed by an
+      // external state change rather than a user button click.
+      (0, _utils.setTabIndices)(elements, initialTabIndexMap, true);
+      cleanup();
+    };
   }, []);
 
   // Retry focus once pane is actually visible (isReady) in case initial attempt occurred while wrapper was visibility:hidden

package/lib/cjs/components/confirmationpanestateful/ConfirmationPaneStateful.js

@@ -82,7 +82,7 @@ const ConfirmationPaneStateful = props => {
 
   // Move focus to the first button
   (0, _react.useEffect)(() => {
-    (0, _utils.preventFocusToMoveOutOfElement)(controlProps.id);
+    const cleanup = (0, _utils.preventFocusToMoveOutOfElement)(controlProps.id);
     const focusableElements = (0, _utils.findAllFocusableElement)(`#${controlProps.id}`);
     requestAnimationFrame(() => {
       if (focusableElements && focusableElements.length > 0 && focusableElements[0]) {
@@ -100,6 +100,17 @@ const ConfirmationPaneStateful = props => {
       Event: _TelemetryConstants.TelemetryEvent.UXConfirmationPaneCompleted,
       ElapsedTimeInMilliseconds: uiTimer.milliSecondsElapsed
     });
+    return () => {
+      // internal tracking: when the confirmation pane unmounts (page reload,
+      // parent state change, or any path that bypasses onConfirm /
+      // onCancel) the tab indices that were forced to -1 on sibling
+      // focusable elements must be restored, otherwise Tab order
+      // remains broken and focus can be trapped inside the widget.
+      // setTabIndices is a no-op when initialTabIndexMap is already
+      // empty (onConfirm / onCancel already restored).
+      (0, _utils.setTabIndices)(elements, initialTabIndexMap, true);
+      cleanup();
+    };
   }, []);
   return /*#__PURE__*/_react.default.createElement(_react.default.Fragment, null, /*#__PURE__*/_react.default.createElement(_DimLayer.DimLayer, {
     brightness: (controlProps === null || controlProps === void 0 ? void 0 : controlProps.brightnessValueOnDim) ?? "0.2"

package/lib/cjs/components/emailtranscriptpanestateful/EmailTranscriptPaneStateful.js

@@ -35,16 +35,23 @@ const EmailTranscriptPaneStateful = props => {
   const [state, dispatch] = (0, _useChatContextStore.default)();
   const [facadeChatSDK] = (0, _useFacadeChatSDKStore.default)();
   const [initialEmail, setInitialEmail] = (0, _react.useState)("");
-  const closeEmailTranscriptPane = () => {
+  // restoreFocus=false is used on the submit path: the notification banner
+  // (success or error) takes focus via NotificationHandler.setFocusOnNotificationCloseButton,
+  // so an intermediate restore to the chat-widget shell would otherwise cause SRs to
+  // announce "Enter <widget>" in between the dialog and the banner.
+  const closeEmailTranscriptPane = function () {
+    let restoreFocus = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : true;
     dispatch({
       type: _LiveChatWidgetActionType.LiveChatWidgetActionType.SET_SHOW_EMAIL_TRANSCRIPT_PANE,
       payload: false
     });
-    const previousFocusedElementId = state.appStates.previousElementIdOnFocusBeforeModalOpen;
-    if (previousFocusedElementId) {
-      (0, _utils.setFocusOnElement)("#" + previousFocusedElementId);
-    } else {
-      (0, _utils.setFocusOnSendBox)();
+    if (restoreFocus) {
+      const previousFocusedElementId = state.appStates.previousElementIdOnFocusBeforeModalOpen;
+      if (previousFocusedElementId) {
+        (0, _utils.setFocusOnElement)("#" + previousFocusedElementId);
+      } else {
+        (0, _utils.setFocusOnSendBox)();
+      }
     }
     dispatch({
       type: _LiveChatWidgetActionType.LiveChatWidgetActionType.SET_PREVIOUS_FOCUSED_ELEMENT_ID,
@@ -55,23 +62,31 @@ const EmailTranscriptPaneStateful = props => {
   const onSend = (0, _react.useCallback)(async email => {
     var _state$domainStates;
     const liveChatContext = state === null || state === void 0 ? void 0 : (_state$domainStates = state.domainStates) === null || _state$domainStates === void 0 ? void 0 : _state$domainStates.liveChatContext;
-    closeEmailTranscriptPane();
+    closeEmailTranscriptPane(false);
     const chatTranscriptBody = {
       emailAddress: email,
       attachmentMessage: (props === null || props === void 0 ? void 0 : props.attachmentMessage) ?? "The following attachment was uploaded during the conversation:"
     };
     try {
-      var _state$domainStates2, _state$domainStates2$;
+      var _state$domainStates2, _state$domainStates2$, _state$domainStates3, _state$domainStates3$;
       await (facadeChatSDK === null || facadeChatSDK === void 0 ? void 0 : facadeChatSDK.emailLiveChatTranscript(chatTranscriptBody, {
         liveChatContext
       }));
-      _NotificationHandler.NotificationHandler.notifySuccess(_NotificationScenarios.NotificationScenarios.EmailAddressSaved, (state === null || state === void 0 ? void 0 : (_state$domainStates2 = state.domainStates) === null || _state$domainStates2 === void 0 ? void 0 : (_state$domainStates2$ = _state$domainStates2.middlewareLocalizedTexts) === null || _state$domainStates2$ === void 0 ? void 0 : _state$domainStates2$.MIDDLEWARE_BANNER_FILE_EMAIL_ADDRESS_RECORDED_SUCCESS) ?? (_defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts === null || _defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts === void 0 ? void 0 : _defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts.MIDDLEWARE_BANNER_FILE_EMAIL_ADDRESS_RECORDED_SUCCESS));
+      const successMessage = (state === null || state === void 0 ? void 0 : (_state$domainStates2 = state.domainStates) === null || _state$domainStates2 === void 0 ? void 0 : (_state$domainStates2$ = _state$domainStates2.middlewareLocalizedTexts) === null || _state$domainStates2$ === void 0 ? void 0 : _state$domainStates2$.MIDDLEWARE_BANNER_FILE_EMAIL_ADDRESS_RECORDED_SUCCESS) ?? (_defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts === null || _defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts === void 0 ? void 0 : _defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts.MIDDLEWARE_BANNER_FILE_EMAIL_ADDRESS_RECORDED_SUCCESS);
+      // Announce from a live region at document.body level so the
+      // screen reader speaks the confirmation immediately, without
+      // traversing the chat transcript on the way to the banner.
+      // Prefix with the explicit state word so SR users hear the outcome
+      // (visual users already see a success icon on the banner).
+      const successSrPrefix = (state === null || state === void 0 ? void 0 : (_state$domainStates3 = state.domainStates) === null || _state$domainStates3 === void 0 ? void 0 : (_state$domainStates3$ = _state$domainStates3.middlewareLocalizedTexts) === null || _state$domainStates3$ === void 0 ? void 0 : _state$domainStates3$.MIDDLEWARE_SR_PREFIX_SUCCESS) ?? _defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts.MIDDLEWARE_SR_PREFIX_SUCCESS;
+      (0, _utils.announceMessageImmediately)(`${successSrPrefix}${successMessage}`);
+      _NotificationHandler.NotificationHandler.notifySuccess(_NotificationScenarios.NotificationScenarios.EmailAddressSaved, successMessage);
       _TelemetryHelper.TelemetryHelper.logActionEventToAllTelemetry(_TelemetryConstants.LogLevel.INFO, {
         Event: _TelemetryConstants.TelemetryEvent.EmailTranscriptSent,
         Description: "Transcript sent to email successfully."
       });
     } catch (ex) {
-      var _state$domainStates3, _state$domainStates3$;
+      var _state$domainStates4, _state$domainStates4$, _state$domainStates5, _state$domainStates5$;
       _TelemetryHelper.TelemetryHelper.logActionEventToAllTelemetry(_TelemetryConstants.LogLevel.ERROR, {
         Event: _TelemetryConstants.TelemetryEvent.EmailTranscriptFailed,
         Description: "Email transcript failed.",
@@ -79,8 +94,11 @@ const EmailTranscriptPaneStateful = props => {
           exception: ex
         }
       });
-      const message = (0, _utils.formatTemplateString)((state === null || state === void 0 ? void 0 : (_state$domainStates3 = state.domainStates) === null || _state$domainStates3 === void 0 ? void 0 : (_state$domainStates3$ = _state$domainStates3.middlewareLocalizedTexts) === null || _state$domainStates3$ === void 0 ? void 0 : _state$domainStates3$.MIDDLEWARE_BANNER_FILE_EMAIL_ADDRESS_RECORDED_ERROR) ?? _defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts.MIDDLEWARE_BANNER_FILE_EMAIL_ADDRESS_RECORDED_ERROR, [email]);
-      _NotificationHandler.NotificationHandler.notifyError(_NotificationScenarios.NotificationScenarios.EmailTranscriptError, (props === null || props === void 0 ? void 0 : props.bannerMessageOnError) ?? message);
+      const message = (0, _utils.formatTemplateString)((state === null || state === void 0 ? void 0 : (_state$domainStates4 = state.domainStates) === null || _state$domainStates4 === void 0 ? void 0 : (_state$domainStates4$ = _state$domainStates4.middlewareLocalizedTexts) === null || _state$domainStates4$ === void 0 ? void 0 : _state$domainStates4$.MIDDLEWARE_BANNER_FILE_EMAIL_ADDRESS_RECORDED_ERROR) ?? _defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts.MIDDLEWARE_BANNER_FILE_EMAIL_ADDRESS_RECORDED_ERROR, [email]);
+      const bannerMessage = (props === null || props === void 0 ? void 0 : props.bannerMessageOnError) ?? message;
+      const errorSrPrefix = (state === null || state === void 0 ? void 0 : (_state$domainStates5 = state.domainStates) === null || _state$domainStates5 === void 0 ? void 0 : (_state$domainStates5$ = _state$domainStates5.middlewareLocalizedTexts) === null || _state$domainStates5$ === void 0 ? void 0 : _state$domainStates5$.MIDDLEWARE_SR_PREFIX_ERROR) ?? _defaultMiddlewareLocalizedTexts.defaultMiddlewareLocalizedTexts.MIDDLEWARE_SR_PREFIX_ERROR;
+      (0, _utils.announceMessageImmediately)(`${errorSrPrefix}${bannerMessage}`);
+      _NotificationHandler.NotificationHandler.notifyError(_NotificationScenarios.NotificationScenarios.EmailTranscriptError, bannerMessage);
     }
   }, [props.attachmentMessage, props.bannerMessageOnError, facadeChatSDK, state.domainStates.liveChatContext]);
   const controlProps = {
@@ -103,7 +121,7 @@ const EmailTranscriptPaneStateful = props => {
 
   // Move focus to the first button
   (0, _react.useEffect)(() => {
-    (0, _utils.preventFocusToMoveOutOfElement)(controlProps.id);
+    const cleanup = (0, _utils.preventFocusToMoveOutOfElement)(controlProps.id);
     const focusableElements = (0, _utils.findAllFocusableElement)(`#${controlProps.id}`);
     if (focusableElements) {
       focusableElements[0].focus();
@@ -118,6 +136,11 @@ const EmailTranscriptPaneStateful = props => {
       Event: _TelemetryConstants.TelemetryEvent.UXEmailTranscriptPaneCompleted,
       ElapsedTimeInMilliseconds: uiTimer.milliSecondsElapsed
     });
+    return () => {
+      // internal tracking: restore parent tab indices on unmount.
+      (0, _utils.setTabIndices)(elements, initialTabIndexMap, true);
+      cleanup();
+    };
   }, [initialEmail]);
   return /*#__PURE__*/_react.default.createElement(_react.default.Fragment, null, /*#__PURE__*/_react.default.createElement(_DimLayer.DimLayer, {
     brightness: (controlProps === null || controlProps === void 0 ? void 0 : controlProps.brightnessValueOnDim) ?? "0.2"

package/lib/cjs/components/errorboundary/ErrorBoundary.js

@@ -19,11 +19,12 @@ function _possibleConstructorReturn(self, call) { if (call && (typeof call === "
 function _assertThisInitialized(self) { if (self === void 0) { throw new ReferenceError("this hasn't been initialised - super() hasn't been called"); } return self; }
 function _isNativeReflectConstruct() { if (typeof Reflect === "undefined" || !Reflect.construct) return false; if (Reflect.construct.sham) return false; if (typeof Proxy === "function") return true; try { Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {})); return true; } catch (e) { return false; } }
 function _getPrototypeOf(o) { _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf.bind() : function _getPrototypeOf(o) { return o.__proto__ || Object.getPrototypeOf(o); }; return _getPrototypeOf(o); }
+// eslint-disable-next-line @typescript-eslint/ban-types
 const RenderChildrenFunction = _ref => {
   let {
     children
   } = _ref;
-  return typeof children === 'function' ? children() : children;
+  return typeof children === "function" ? children() : children;
 };
 let ErrorBoundary = /*#__PURE__*/function (_Component) {
   _inherits(ErrorBoundary, _Component);

package/lib/cjs/components/livechatwidget/LiveChatWidget.js

@@ -35,8 +35,16 @@ const LiveChatWidget = props => {
     throw new Error("chatConfig is required");
   }
 
+  // Check configuration flags
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const isAuthenticatedChat = !!((_props$chatConfig = props.chatConfig) !== null && _props$chatConfig !== void 0 && (_props$chatConfig$Liv = _props$chatConfig.LiveChatConfigAuthSettings) !== null && _props$chatConfig$Liv !== void 0 && _props$chatConfig$Liv.msdyn_javascriptclientfunction) || (0, _liveChatConfigUtils.isPersistentChatEnabled)((_props$chatConfig2 = props.chatConfig) === null || _props$chatConfig2 === void 0 ? void 0 : (_props$chatConfig2$Li = _props$chatConfig2.LiveWSAndLiveChatEngJoin) === null || _props$chatConfig2$Li === void 0 ? void 0 : _props$chatConfig2$Li.msdyn_conversationmode);
+  const hasAuthClientFn = !!((_props$chatConfig = props.chatConfig) !== null && _props$chatConfig !== void 0 && (_props$chatConfig$Liv = _props$chatConfig.LiveChatConfigAuthSettings) !== null && _props$chatConfig$Liv !== void 0 && _props$chatConfig$Liv.msdyn_javascriptclientfunction);
+  const persistentChatEnabled = (0, _liveChatConfigUtils.isPersistentChatEnabled)((_props$chatConfig2 = props.chatConfig) === null || _props$chatConfig2 === void 0 ? void 0 : (_props$chatConfig2$Li = _props$chatConfig2.LiveWSAndLiveChatEngJoin) === null || _props$chatConfig2$Li === void 0 ? void 0 : _props$chatConfig2$Li.msdyn_conversationmode);
+
+  // isAuthenticatedChat determines if FacadeChatSDK should require authentication:
+  // REGULAR AUTH FLOW (config-based):
+  // - Persistent chat enabled ? always authenticated
+  // - Auth settings exist ? authenticated from start
+  const isAuthenticatedChat = persistentChatEnabled || hasAuthClientFn;
   if (!facadeChatSDK) {
     var _props$mock;
     setFacadeChatSDK(new _FacadeChatSDK.FacadeChatSDK({

package/lib/cjs/components/livechatwidget/common/ActivitySubscriber/BotAuthActivitySubscriber.js

@@ -44,7 +44,7 @@ const extractSasUrl = async attachment => {
   }
   return sasUrl;
 };
-const fetchBotAuthConfig = async (retries, interval) => {
+const fetchBotAuthConfig = async (retries, interval, fallback) => {
   _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
     Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderFetchConfig
   });
@@ -60,13 +60,23 @@ const fetchBotAuthConfig = async (retries, interval) => {
   });
   if (retries === 1) {
     // Base Case
-    throw new Error();
+    if (response !== undefined) {
+      return response;
+    }
+    if (fallback !== undefined) {
+      _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.WARN, {
+        Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderNotFound,
+        Description: `Failed to fetch bot auth config after maximum retries. Using fallback value: ${fallback}`
+      });
+      return fallback;
+    }
+    throw new Error("Failed to fetch bot auth config after maximum retries");
   }
   await delay(interval);
   if (response !== undefined) {
     return response;
   }
-  return await fetchBotAuthConfig(--retries, interval);
+  return await fetchBotAuthConfig(--retries, interval, fallback);
 };
 let BotAuthActivitySubscriber = /*#__PURE__*/function () {
   function BotAuthActivitySubscriber() {
@@ -76,6 +86,7 @@ let BotAuthActivitySubscriber = /*#__PURE__*/function () {
     _defineProperty(this, "signInCardSeen", void 0);
     _defineProperty(this, "fetchBotAuthConfigRetries", void 0);
     _defineProperty(this, "fetchBotAuthConfigRetryInterval", void 0);
+    _defineProperty(this, "fallbackShowSignInCard", void 0);
     this.signInCardSeen = new Set();
     this.fetchBotAuthConfigRetries = 3;
     this.fetchBotAuthConfigRetryInterval = 1000;
@@ -85,6 +96,11 @@ let BotAuthActivitySubscriber = /*#__PURE__*/function () {
     if (optionalParams.fetchBotAuthConfigRetryInterval) {
       this.fetchBotAuthConfigRetryInterval = optionalParams.fetchBotAuthConfigRetryInterval;
     }
+    this.fallbackShowSignInCard = optionalParams.fallbackShowSignInCard;
+    _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
+      Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderFetchConfig,
+      Description: `BotAuthActivitySubscriber initialized with fallbackShowSignInCard: ${optionalParams.fallbackShowSignInCard}`
+    });
   }
   _createClass(BotAuthActivitySubscriber, [{
     key: "applicable",
@@ -129,7 +145,7 @@ let BotAuthActivitySubscriber = /*#__PURE__*/function () {
         _omnichannelChatComponents.BroadcastService.postMessage(event);
       }
       try {
-        const response = await fetchBotAuthConfig(this.fetchBotAuthConfigRetries, this.fetchBotAuthConfigRetryInterval);
+        const response = await fetchBotAuthConfig(this.fetchBotAuthConfigRetries, this.fetchBotAuthConfigRetryInterval, this.fallbackShowSignInCard);
         if (response === false) {
           _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
             Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderHideCard
@@ -140,9 +156,10 @@ let BotAuthActivitySubscriber = /*#__PURE__*/function () {
           });
           return activity;
         }
-      } catch {
+      } catch (e) {
         _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
-          Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderNotFound
+          Event: _TelemetryConstants.TelemetryEvent.SetBotAuthProviderNotFound,
+          ExceptionDetails: e instanceof Error ? e.message : JSON.stringify(e)
         });
         //this is to ensure listener continues waiting for response
         if (this.signInCardSeen.has(signInId)) {

package/lib/cjs/components/livechatwidget/common/ChatWidgetEvents.js

@@ -10,6 +10,7 @@ var ChatWidgetEvents;
   ChatWidgetEvents["FETCH_PERSISTENT_CHAT_HISTORY"] = "CHAT_WIDGET/FETCH_PERSISTENT_CHAT_HISTORY";
   ChatWidgetEvents["NO_MORE_HISTORY_AVAILABLE"] = "CHAT_WIDGET/NO_MORE_HISTORY_AVAILABLE";
   ChatWidgetEvents["HISTORY_LOAD_ERROR"] = "CHAT_WIDGET/HISTORY_LOAD_ERROR";
+  ChatWidgetEvents["HISTORY_BATCH_LOADED"] = "CHAT_WIDGET/HISTORY_BATCH_LOADED";
 })(ChatWidgetEvents || (ChatWidgetEvents = {}));
 var _default = ChatWidgetEvents;
 exports.default = _default;

package/lib/cjs/components/livechatwidget/common/PersistentConversationHandler.js

@@ -133,6 +133,12 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
         }
         const messagesDescOrder = (_ref = [...messages]) === null || _ref === void 0 ? void 0 : _ref.reverse();
         this.processHistoryMessages(messagesDescOrder);
+
+        // Signal that a batch of history messages has been added to the store.
+        // LazyLoadActivity subscribes to this to apply scroll anchoring after render.
+        (0, _dispatchCustomEvent.default)(_ChatWidgetEvents.default.HISTORY_BATCH_LOADED, {
+          messageCount: messages.length
+        });
         _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.INFO, {
           Event: _TelemetryConstants.TelemetryEvent.LCWPersistentHistoryPullCompleted,
           Description: "History pull completed successfully",
@@ -241,6 +247,9 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
     value: function processMessageToActivity(message) {
       try {
         const activity = (0, _convertPersistentChatHistoryMessageToActivity.default)(message);
+        if (!activity) {
+          return null;
+        }
         activity.id = activity.id || `activity-${this.count}`;
         activity.channelData = {
           ...activity.channelData,