@microsoft/omnichannel-chat-widget 1.8.4-main.cbab5fc → 1.8.4-main.cc63f01

package/lib/cjs/components/livechatwidget/common/authHelper.js

@@ -3,11 +3,22 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.removeAuthTokenProvider = exports.handleAuthentication = exports.getAuthClientFunction = void 0;
+exports.removeAuthTokenProvider = exports.isMidAuthEnabled = exports.handleAuthentication = exports.getAuthClientFunction = void 0;
 var _TelemetryConstants = require("../../../common/telemetry/TelemetryConstants");
 var _TelemetryHelper = require("../../../common/telemetry/TelemetryHelper");
 var _Constants = require("../../../common/Constants");
 var _utils = require("../../../common/utils");
+/**
+ * Check if mid-auth is enabled based on chatConfig.
+ * Mid-auth flag lives under LiveWSAndLiveChatEngJoin.msdyn_authenticatedsigninoptional.
+ */
+const isMidAuthEnabled = chatConfig => {
+  var _chatConfig$LiveWSAnd, _value$toString, _value$toString$call$, _value$toString$call;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const value = chatConfig === null || chatConfig === void 0 ? void 0 : (_chatConfig$LiveWSAnd = chatConfig.LiveWSAndLiveChatEngJoin) === null || _chatConfig$LiveWSAnd === void 0 ? void 0 : _chatConfig$LiveWSAnd.msdyn_authenticatedsigninoptional;
+  return (value === null || value === void 0 ? void 0 : (_value$toString = value.toString) === null || _value$toString === void 0 ? void 0 : (_value$toString$call$ = (_value$toString$call = _value$toString.call(value)).toLowerCase) === null || _value$toString$call$ === void 0 ? void 0 : _value$toString$call$.call(_value$toString$call)) === "true";
+};
+exports.isMidAuthEnabled = isMidAuthEnabled;
 const getAuthClientFunction = chatConfig => {
   let authClientFunction = undefined;
   if (chatConfig !== null && chatConfig !== void 0 && chatConfig.LiveChatConfigAuthSettings) {
@@ -19,12 +30,17 @@ const getAuthClientFunction = chatConfig => {
 exports.getAuthClientFunction = getAuthClientFunction;
 const handleAuthentication = async (chatSDK, chatConfig, getAuthToken) => {
   var _chatSDK$chatSDKConfi;
+  const midAuthEnabled = isMidAuthEnabled(chatConfig);
   const authClientFunction = getAuthClientFunction(chatConfig);
   if (getAuthToken && authClientFunction) {
     _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.INFO, {
       Event: _TelemetryConstants.TelemetryEvent.GetAuthTokenCalled
     });
-    const token = await getAuthToken(authClientFunction);
+
+    // Only pass isMidAuthEnabled option when mid-auth is enabled.
+    const token = midAuthEnabled ? await getAuthToken(authClientFunction, {
+      isMidAuthEnabled: midAuthEnabled
+    }) : await getAuthToken(authClientFunction);
     if (!(0, _utils.isNullOrEmptyString)(token)) {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       chatSDK.setAuthTokenProvider(async () => {
@@ -35,8 +51,21 @@ const handleAuthentication = async (chatSDK, chatConfig, getAuthToken) => {
         "token": token
       };
     } else {
-      // instead of returning false, it's more appropiate to thrown an error to force error handling on the caller side
-      // this will help to avoid the error to be ignored and the chat to be started
+      // For mid-auth scenarios, empty token means "user not signed in" - this is expected behavior.
+      // Return result: true with empty token so caller can decide to proceed unauthenticated.
+      if (midAuthEnabled) {
+        // Expected behavior for mid-auth: user not signed in
+        _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.INFO, {
+          Event: _TelemetryConstants.TelemetryEvent.GetAuthTokenCalled,
+          Description: "Mid-auth: token provider returned empty; user not signed in"
+        });
+        return {
+          "result": true,
+          "token": null
+        };
+      }
+
+      // For non-mid-auth scenarios, empty token is an error
       _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.ERROR, {
         Event: _TelemetryConstants.TelemetryEvent.ReceivedNullOrEmptyToken
       });
@@ -46,6 +75,17 @@ const handleAuthentication = async (chatSDK, chatConfig, getAuthToken) => {
     var _chatSDK$chatSDKConfi2;
     const token = await ((_chatSDK$chatSDKConfi2 = chatSDK.chatSDKConfig) === null || _chatSDK$chatSDKConfi2 === void 0 ? void 0 : _chatSDK$chatSDKConfi2.getAuthToken());
     if ((0, _utils.isNullOrEmptyString)(token)) {
+      // For mid-auth scenarios, empty token from SDK's getAuthToken is also expected
+      if (midAuthEnabled) {
+        _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.INFO, {
+          Event: _TelemetryConstants.TelemetryEvent.GetAuthTokenCalled,
+          Description: "Mid-auth: SDK getAuthToken returned empty; user not signed in"
+        });
+        return {
+          "result": true,
+          "token": null
+        };
+      }
       _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.ERROR, {
         Event: _TelemetryConstants.TelemetryEvent.ReceivedNullOrEmptyToken,
         Description: "getAuthToken in chat SDK returns empty string"

package/lib/cjs/components/livechatwidget/common/createAdapter.js

@@ -45,10 +45,11 @@ const createAdapter = async (facadeChatSDK, props) => {
   //so far, there is no need to convert to the shim adapter when using visual tests
   const isMocked = facadeChatSDK.getChatSDK() instanceof _mockchatsdk.MockChatSDK;
   if (isMocked !== true) {
-    var _props$webChatContain, _props$webChatContain2, _props$webChatContain3, _props$webChatContain4;
+    var _props$webChatContain, _props$webChatContain2, _props$webChatContain3, _props$webChatContain4, _props$webChatContain5, _props$webChatContain6;
     const botAuthActivitySubscriberOptionalParams = {
       fetchBotAuthConfigRetries: (props === null || props === void 0 ? void 0 : (_props$webChatContain = props.webChatContainerProps) === null || _props$webChatContain === void 0 ? void 0 : (_props$webChatContain2 = _props$webChatContain.botAuthConfig) === null || _props$webChatContain2 === void 0 ? void 0 : _props$webChatContain2.fetchBotAuthConfigRetries) || defaultBotAuthConfig.fetchBotAuthConfigRetries,
-      fetchBotAuthConfigRetryInterval: (props === null || props === void 0 ? void 0 : (_props$webChatContain3 = props.webChatContainerProps) === null || _props$webChatContain3 === void 0 ? void 0 : (_props$webChatContain4 = _props$webChatContain3.botAuthConfig) === null || _props$webChatContain4 === void 0 ? void 0 : _props$webChatContain4.fetchBotAuthConfigRetryInterval) || defaultBotAuthConfig.fetchBotAuthConfigRetryInterval
+      fetchBotAuthConfigRetryInterval: (props === null || props === void 0 ? void 0 : (_props$webChatContain3 = props.webChatContainerProps) === null || _props$webChatContain3 === void 0 ? void 0 : (_props$webChatContain4 = _props$webChatContain3.botAuthConfig) === null || _props$webChatContain4 === void 0 ? void 0 : _props$webChatContain4.fetchBotAuthConfigRetryInterval) || defaultBotAuthConfig.fetchBotAuthConfigRetryInterval,
+      fallbackShowSignInCard: props === null || props === void 0 ? void 0 : (_props$webChatContain5 = props.webChatContainerProps) === null || _props$webChatContain5 === void 0 ? void 0 : (_props$webChatContain6 = _props$webChatContain5.botAuthConfig) === null || _props$webChatContain6 === void 0 ? void 0 : _props$webChatContain6.fallbackShowSignInCard
     };
     adapter = new _ChatAdapterShim.ChatAdapterShim(adapter);
     adapter.addSubscriber(new _AddActivitySubscriber.AddActivitySubscriber());

package/lib/cjs/components/livechatwidget/common/createMarkdown.js

@@ -42,10 +42,8 @@ const createMarkdown = (disableMarkdownMessageFormatting, disableNewLineMarkdown
 
   markdown.disable(["strikethrough"]);
 
-  // Custom plugin to fix numbered list continuity
+  // Custom plugin to fix numbered list continuity and merge adjacent markdown links with the same href.
   markdown.use(function (md) {
-    const originalRender = md.render.bind(md);
-    const originalRenderInline = md.renderInline.bind(md);
     function preprocessText(text) {
       // Handle numbered lists that come with double line breaks (knowledge article format)
       // This ensures proper continuous numbering instead of separate lists
@@ -80,16 +78,111 @@ const createMarkdown = (disableMarkdownMessageFormatting, disableNewLineMarkdown
       return result;
     }
 
+    // Accessibility fix: when a bot emits content like "[1.](url) [View details](url)",
+    // markdown-it renders two sibling links that screen readers announce as two separate
+    // focusable links. Merge consecutive markdown link tokens with identical attributes so
+    // the number and label form one combined focusable link without discarding metadata.
+    md.core.ruler.after("inline", "merge_adjacent_same_href_links", function (state) {
+      const sortedAttrs = token => (token.attrs || []).map(attr => `${attr[0]}=${attr[1]}`).sort();
+      const hasSameAttributes = (first, second) => {
+        const firstAttrs = sortedAttrs(first);
+        const secondAttrs = sortedAttrs(second);
+        return firstAttrs.length === secondAttrs.length && firstAttrs.every((attr, index) => attr === secondAttrs[index]);
+      };
+      const collectLink = (children, index) => {
+        var _open$attrGet;
+        const open = children[index];
+        if (!open || open.type !== "link_open") {
+          return undefined;
+        }
+        const href = (_open$attrGet = open.attrGet) === null || _open$attrGet === void 0 ? void 0 : _open$attrGet.call(open, "href");
+        if (!href) {
+          return undefined;
+        }
+        let depth = 0;
+        for (let currentIndex = index; currentIndex < children.length; currentIndex++) {
+          const token = children[currentIndex];
+          if (token.type === "link_open") {
+            depth++;
+          } else if (token.type === "link_close") {
+            depth--;
+            if (depth === 0) {
+              return {
+                closeIndex: currentIndex,
+                href,
+                open
+              };
+            }
+          }
+        }
+        return undefined;
+      };
+      const getNextAdjacentLink = (children, startIndex) => {
+        const separatorTokens = [];
+        let index = startIndex;
+        while (index < children.length && children[index].type === "text" && /^\s*$/.test(children[index].content || "")) {
+          separatorTokens.push(children[index]);
+          index++;
+        }
+        const link = collectLink(children, index);
+        if (!link) {
+          return undefined;
+        }
+        return {
+          ...link,
+          openIndex: index,
+          separatorTokens
+        };
+      };
+      state.tokens.forEach(blockToken => {
+        if (blockToken.type !== "inline" || !blockToken.children) {
+          return;
+        }
+        const mergedChildren = [];
+        const children = blockToken.children;
+        let index = 0;
+        while (index < children.length) {
+          const firstLink = collectLink(children, index);
+          if (!firstLink) {
+            mergedChildren.push(children[index]);
+            index++;
+            continue;
+          }
+          const linkTokens = [firstLink.open, ...children.slice(index + 1, firstLink.closeIndex)];
+          let nextIndex = firstLink.closeIndex + 1;
+          let mergedAnyLink = false;
+          let nextLink = getNextAdjacentLink(children, nextIndex);
+          while (nextLink && nextLink.href === firstLink.href && hasSameAttributes(firstLink.open, nextLink.open)) {
+            linkTokens.push(...nextLink.separatorTokens);
+            linkTokens.push(...children.slice(nextLink.openIndex + 1, nextLink.closeIndex));
+            nextIndex = nextLink.closeIndex + 1;
+            mergedAnyLink = true;
+            nextLink = getNextAdjacentLink(children, nextIndex);
+          }
+          if (mergedAnyLink) {
+            mergedChildren.push(...linkTokens, children[firstLink.closeIndex]);
+            index = nextIndex;
+          } else {
+            mergedChildren.push(children[index]);
+            index++;
+          }
+        }
+        blockToken.children = mergedChildren;
+      });
+    });
+
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     md.render = function (text, env) {
+      const safeEnv = env ?? {};
       const processedText = preprocessText(text);
-      return originalRender(processedText, env);
+      return md.renderer.render(md.parse(processedText, safeEnv), md.options, safeEnv);
     };
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     md.renderInline = function (text, env) {
+      const safeEnv = env ?? {};
       const processedText = preprocessText(text);
-      return originalRenderInline(processedText, env);
+      return md.renderer.render(md.parseInline(processedText, safeEnv), md.options, safeEnv);
     };
   });
 

package/lib/cjs/components/livechatwidget/common/endChat.js

@@ -11,6 +11,7 @@ var _renderSurveyHelpers = require("./renderSurveyHelpers");
 var _omnichannelChatComponents = require("@microsoft/omnichannel-chat-components");
 var _ConversationState = require("../../../contexts/common/ConversationState");
 var _LazyLoadActivity = require("../../webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activities/LazyLoadActivity");
+var _activityMiddleware = require("../../webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activityMiddleware");
 var _LiveChatWidgetActionType = require("../../../contexts/common/LiveChatWidgetActionType");
 var _NotificationHandler = require("../../webchatcontainerstateful/webchatcontroller/notification/NotificationHandler");
 var _NotificationScenarios = require("../../webchatcontainerstateful/webchatcontroller/enums/NotificationScenarios");
@@ -249,6 +250,7 @@ const endChat = async (props, facadeChatSDK, state, dispatch, setAdapter, setWeb
 
       // Call direct reset to ensure LazyLoadHandler gets reset regardless of broadcast timing
       _LazyLoadActivity.LazyLoadHandler.directReset();
+      (0, _activityMiddleware.resetActivityMiddlewareCache)();
       _omnichannelChatComponents.BroadcastService.postMessage({
         eventName: _TelemetryConstants.BroadcastEvent.PersistentConversationReset
       });
@@ -344,6 +346,10 @@ const closeChatStateCleanUp = dispatch => {
     type: _LiveChatWidgetActionType.LiveChatWidgetActionType.SET_CITATIONS,
     payload: {}
   });
+  dispatch({
+    type: _LiveChatWidgetActionType.LiveChatWidgetActionType.SET_SHOW_EMAIL_TRANSCRIPT_PANE,
+    payload: false
+  });
 
   // Dismiss the chat disconnect notification banner if it was shown
   _NotificationHandler.NotificationHandler.dismissNotification(_NotificationScenarios.NotificationScenarios.ChatDisconnect);

package/lib/cjs/components/livechatwidget/common/initWebChatComposer.js

@@ -16,6 +16,7 @@ var _LiveChatWidgetActionType = require("../../../contexts/common/LiveChatWidget
 var _TelemetryHelper = require("../../../common/telemetry/TelemetryHelper");
 var _WebChatStoreLoader = require("../../webchatcontainerstateful/webchatcontroller/WebChatStoreLoader");
 var _attachmentProcessingMiddleware = _interopRequireDefault(require("../../webchatcontainerstateful/webchatcontroller/middlewares/storemiddlewares/attachmentProcessingMiddleware"));
+var _attachmentSentAnnouncementMiddleware = _interopRequireDefault(require("../../webchatcontainerstateful/webchatcontroller/middlewares/storemiddlewares/attachmentSentAnnouncementMiddleware"));
 var _channelDataMiddleware = _interopRequireDefault(require("../../webchatcontainerstateful/webchatcontroller/middlewares/storemiddlewares/channelDataMiddleware"));
 var _activityMiddleware = require("../../webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activityMiddleware");
 var _activityStatusMiddleware = require("../../webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activityStatusMiddleware");
@@ -125,7 +126,7 @@ const initWebChatComposer = (props, state, dispatch, facadeChatSDK, endChat) =>
     };
     webChatStore = (0, _botframeworkWebchat.createStore)({},
     //initial state
-    _preProcessingMiddleware.default, _attachmentProcessingMiddleware.default, (0, _attachmentUploadValidatorMiddleware.default)((_state$domainStates$l = state.domainStates.liveChatConfig) === null || _state$domainStates$l === void 0 ? void 0 : _state$domainStates$l.allowedFileExtensions, (_state$domainStates$l2 = state.domainStates.liveChatConfig) === null || _state$domainStates$l2 === void 0 ? void 0 : _state$domainStates$l2.maxUploadFileSize, localizedTexts), (0, _customEventMiddleware.default)(_omnichannelChatComponents.BroadcastService), (0, _queueOverflowHandlerMiddleware.createQueueOverflowMiddleware)(state, dispatch), (0, _channelDataMiddleware.default)(addConversationalSurveyTagsCallback), (0, _conversationEndMiddleware.default)(conversationEndCallback, startConversationalSurveyCallback, endConversationalSurveyCallback), (0, _dataMaskingMiddleware.default)((_state$domainStates$l3 = state.domainStates.liveChatConfig) === null || _state$domainStates$l3 === void 0 ? void 0 : _state$domainStates$l3.DataMaskingInfo), _messageTimestampMiddleware.createMessageTimeStampMiddleware, _messageSequenceIdOverrideMiddleware.createMessageSequenceIdOverrideMiddleware, (0, _citationsMiddleware.createCitationsMiddleware)(state, dispatch), _gifUploadMiddleware.default, _htmlPlayerMiddleware.default, (0, _htmlTextMiddleware.default)(honorsTargetInHTMLLinks), (0, _maxMessageSizeValidator.default)(localizedTexts), _sanitizationMiddleware.default, (0, _callActionMiddleware.default)(),
+    _preProcessingMiddleware.default, _attachmentProcessingMiddleware.default, (0, _attachmentUploadValidatorMiddleware.default)((_state$domainStates$l = state.domainStates.liveChatConfig) === null || _state$domainStates$l === void 0 ? void 0 : _state$domainStates$l.allowedFileExtensions, (_state$domainStates$l2 = state.domainStates.liveChatConfig) === null || _state$domainStates$l2 === void 0 ? void 0 : _state$domainStates$l2.maxUploadFileSize, localizedTexts), _attachmentSentAnnouncementMiddleware.default, (0, _customEventMiddleware.default)(_omnichannelChatComponents.BroadcastService), (0, _queueOverflowHandlerMiddleware.createQueueOverflowMiddleware)(state, dispatch), (0, _channelDataMiddleware.default)(addConversationalSurveyTagsCallback), (0, _conversationEndMiddleware.default)(conversationEndCallback, startConversationalSurveyCallback, endConversationalSurveyCallback), (0, _dataMaskingMiddleware.default)((_state$domainStates$l3 = state.domainStates.liveChatConfig) === null || _state$domainStates$l3 === void 0 ? void 0 : _state$domainStates$l3.DataMaskingInfo), _messageTimestampMiddleware.createMessageTimeStampMiddleware, _messageSequenceIdOverrideMiddleware.createMessageSequenceIdOverrideMiddleware, (0, _citationsMiddleware.createCitationsMiddleware)(state, dispatch), _gifUploadMiddleware.default, _htmlPlayerMiddleware.default, (0, _htmlTextMiddleware.default)(honorsTargetInHTMLLinks), (0, _maxMessageSizeValidator.default)(localizedTexts), _sanitizationMiddleware.default, (0, _callActionMiddleware.default)(),
     // Pass a callback so middleware can push initials into React context for reactivity
     (0, _localizedStringsBotInitialsMiddleware.localizedStringsBotInitialsMiddleware)(initials => {
       dispatch({
@@ -151,14 +152,198 @@ const initWebChatComposer = (props, state, dispatch, facadeChatSDK, endChat) =>
     markdownRenderers.forEach(renderer => {
       text = renderer.render(text);
     });
+
+    // EXISTING sanitization (continues to work as before)
     const config = {
       FORBID_TAGS: ["form", "button", "script", "div", "input"],
       FORBID_ATTR: ["action"],
       ADD_ATTR: ["target"]
     };
     text = _dompurify.default.sanitize(text, config);
+
+    // MONITOR-ONLY: Test what the stricter allowlist would remove (Phase 1)
+    // This does NOT modify the text, only logs telemetry
+    // Run during browser idle time to avoid blocking message flow and adding latency
+    const textToMonitor = text; // Capture current text value
+
+    // Schedule monitoring to run during browser idle time
+    const scheduleMonitoring = () => {
+      try {
+        monitorStrictSanitization(textToMonitor, state);
+      } catch (error) {
+        // Silently catch errors to prevent blocking message flow
+        if (process.env.NODE_ENV === "development") {
+          console.error("[Monitor] HTML sanitization monitoring failed:", error);
+        }
+      }
+    };
+
+    // Use requestIdleCallback for truly idle execution, fallback to setTimeout for older browsers
+    if (typeof window !== "undefined" && "requestIdleCallback" in window) {
+      window.requestIdleCallback(scheduleMonitoring);
+    } else {
+      setTimeout(scheduleMonitoring, 0);
+    }
     return text;
   };
+
+  /**
+   * Monitor-only sanitization (Phase 1: Gather telemetry)
+   * Tests what a stricter allowlist-based sanitization would remove
+   * WITHOUT actually removing it. Logs telemetry for analysis.
+   *
+   * IMPORTANT: This function is wrapped in try-catch and runs asynchronously
+   * to ensure failures don't block message flow or add latency.
+   *
+   * ISOLATION: Uses a separate DOMPurify instance to completely isolate
+   * monitoring hooks from other sanitization paths (e.g., postDomPurifyActivities).
+   * The instance is garbage collected after use, no cleanup needed.
+   *
+   * @param html - The HTML text that was already sanitized with existing config
+   * @param state - Widget state containing orgId and chatId
+   */
+  const monitorStrictSanitization = (html, state) => {
+    // Early exit for empty content
+    if (!html) return;
+
+    // Track execution time for performance monitoring
+    const startTime = performance.now();
+    try {
+      // Create a separate DOMPurify instance for monitoring
+      // This completely isolates monitoring from other sanitization paths
+      const monitorDOMPurify = (0, _dompurify.default)(window);
+
+      // Strict allowlist configuration (proposed new rules)
+      // Note: DOMPurify blocks event handlers (onclick, onerror, etc.) by default
+      const strictConfig = {
+        ALLOWED_TAGS: ["b", "strong",
+        // Bold text
+        "i", "em", "u",
+        // Italic, emphasis, underline
+        "br", "p",
+        // Line breaks and paragraphs
+        "ul", "ol", "li",
+        // Lists
+        "a" // Links (with restricted attributes)
+        ],
+
+        ALLOWED_ATTR: ["href",
+        // For links (will be restricted to http/https)
+        "target",
+        // For link behavior
+        "rel" // For security (noopener, noreferrer)
+        ],
+
+        FORBID_TAGS: ["img", "video", "audio",
+        // Media (tracking beacons)
+        "iframe", "object", "embed",
+        // Embedded content
+        "script", "style",
+        // Script and styling
+        "form", "input", "textarea", "button",
+        // Form elements
+        "link", "meta", "base",
+        // Document metadata
+        "div", "span" // Layout elements
+        ],
+
+        FORBID_ATTR: ["style",
+        // Inline CSS
+        "action" // Form action attribute (event handlers blocked by default)
+        ],
+
+        ALLOWED_URI_REGEXP: /^https?:/i,
+        ALLOW_DATA_ATTR: false,
+        ALLOW_UNKNOWN_PROTOCOLS: false
+      };
+
+      // Track what would be removed
+      const removedTags = [];
+      const removedAttributes = [];
+
+      // Add hooks to the isolated monitoring instance
+      monitorDOMPurify.addHook("uponSanitizeElement", (node, data) => {
+        try {
+          const tagName = data.tagName.toLowerCase();
+          // Filter out "body" tag which is DOMPurify's internal wrapper
+          if (node.nodeType === 1 && !strictConfig.ALLOWED_TAGS.includes(tagName) && tagName !== "body") {
+            removedTags.push(tagName);
+          }
+        } catch (hookError) {
+          // Silently ignore hook errors
+        }
+      });
+      monitorDOMPurify.addHook("uponSanitizeAttribute", (node, data) => {
+        try {
+          const attrName = data.attrName.toLowerCase();
+          if (!strictConfig.ALLOWED_ATTR.includes(attrName) && attrName !== "class" && attrName !== "id") {
+            removedAttributes.push(attrName);
+          }
+        } catch (hookError) {
+          // Silently ignore hook errors
+        }
+      });
+
+      // Run sanitization on the isolated instance (we discard the result)
+      // No cleanup needed - the instance will be garbage collected with its hooks
+      monitorDOMPurify.sanitize(html, strictConfig);
+
+      // Log telemetry if content would be affected by strict rules
+      if (removedTags.length > 0 || removedAttributes.length > 0) {
+        try {
+          var _state$domainStates, _state$domainStates$t, _state$domainStates2, _state$domainStates2$;
+          const uniqueTags = [...new Set(removedTags)];
+          const uniqueAttrs = [...new Set(removedAttributes)];
+
+          // Calculate execution time
+          const endTime = performance.now();
+          const executionTimeMs = Math.round((endTime - startTime) * 100) / 100; // Round to 2 decimal places
+
+          // Get context for telemetry (with safe fallbacks)
+          const orgId = (state === null || state === void 0 ? void 0 : (_state$domainStates = state.domainStates) === null || _state$domainStates === void 0 ? void 0 : (_state$domainStates$t = _state$domainStates.telemetryInternalData) === null || _state$domainStates$t === void 0 ? void 0 : _state$domainStates$t.orgId) || "unknown";
+          const conversationId = (state === null || state === void 0 ? void 0 : (_state$domainStates2 = state.domainStates) === null || _state$domainStates2 === void 0 ? void 0 : (_state$domainStates2$ = _state$domainStates2.chatToken) === null || _state$domainStates2$ === void 0 ? void 0 : _state$domainStates2$.chatId) || "unknown";
+          _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.INFO, {
+            Event: _TelemetryConstants.TelemetryEvent.HTMLSanitized,
+            Description: JSON.stringify({
+              message: "HTML content would be sanitized by stricter allowlist (monitor-only)",
+              removedTags: uniqueTags,
+              removedAttributes: uniqueAttrs,
+              phase: "Monitor",
+              organizationId: orgId,
+              conversationId: conversationId
+            }),
+            ElapsedTimeInMilliseconds: executionTimeMs
+          });
+
+          // Log to console in development for debugging
+          if (process.env.NODE_ENV === "development") {
+            console.warn("[Monitor] Stricter HTML sanitization telemetry:", {
+              description: JSON.parse(JSON.stringify({
+                message: "HTML content would be sanitized by stricter allowlist (monitor-only)",
+                removedTags: uniqueTags,
+                removedAttributes: uniqueAttrs,
+                phase: "Monitor"
+              })),
+              orgId,
+              conversationId,
+              executionTimeMs
+            });
+          }
+        } catch (telemetryError) {
+          // Silently ignore telemetry errors to prevent blocking
+          if (process.env.NODE_ENV === "development") {
+            console.error("[Monitor] Telemetry logging failed:", telemetryError);
+          }
+        }
+      }
+    } catch (error) {
+      // Catch-all for any unexpected errors
+      // Silently fail to ensure monitoring never blocks message flow
+      if (process.env.NODE_ENV === "development") {
+        console.error("[Monitor] Monitoring failed:", error);
+      }
+    }
+  };
   function postDomPurifyActivities() {
     _dompurify.default.addHook("afterSanitizeAttributes", function (node) {
       const target = node.getAttribute(_Constants.Constants.Target);

package/lib/cjs/components/livechatwidget/common/liveChatConfigUtils.js

@@ -3,15 +3,17 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.isPostChatSurveyEnabled = exports.isPersistentChatEnabled = exports.getPostChatSurveyConfig = void 0;
-var _Constants = require("../../../common/Constants");
+exports.shouldLoadPersistentChatHistory = exports.isPostChatSurveyEnabled = exports.isPersistentChatEnabled = exports.getPostChatSurveyConfig = void 0;
 var _utils = require("../../../common/utils");
+var _Constants = require("../../../common/Constants");
 const isPostChatSurveyEnabled = async facadeChatSDK => {
   var _chatConfig$LiveWSAnd;
   const chatConfig = await facadeChatSDK.getLiveChatConfig();
   const postChatEnabled = (_chatConfig$LiveWSAnd = chatConfig.LiveWSAndLiveChatEngJoin) === null || _chatConfig$LiveWSAnd === void 0 ? void 0 : _chatConfig$LiveWSAnd.msdyn_postconversationsurveyenable.toString().toLowerCase();
   return postChatEnabled === "true";
 };
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
 exports.isPostChatSurveyEnabled = isPostChatSurveyEnabled;
 const getPostChatSurveyConfig = async facadeChatSDK => {
   var _chatConfig$LiveWSAnd2, _chatConfig$LiveWSAnd3, _chatConfig$LiveWSAnd4, _chatConfig$LiveWSAnd5, _chatConfig$LiveWSAnd6, _chatConfig$LiveWSAnd7, _chatConfig$LiveWSAnd8, _chatConfig$LiveWSAnd9, _chatConfig$LiveWSAnd10;
@@ -34,6 +36,36 @@ const isPersistentChatEnabled = conversationMode => {
   if ((0, _utils.isNullOrUndefined)(conversationMode)) {
     return false;
   }
-  return (conversationMode === null || conversationMode === void 0 ? void 0 : conversationMode.toString().toLowerCase()) === _Constants.ConversationMode.Persistent;
+  return (conversationMode === null || conversationMode === void 0 ? void 0 : conversationMode.toString()) === _Constants.ConversationMode.Persistent;
+};
+
+/**
+ * Determines if persistent chat history should be loaded based on all required conditions.
+ * 
+ * @param extendedChatConfig - The extended chat configuration object
+ * @returns true if ALL conditions are met:
+ *   1. Conversation mode must be Persistent ("192350001")
+ *   2. History is enabled in admin config (msdyn_enablepersistentchatpreviousconversations)
+ *   3. History is enabled via feature flag (lcwPersistentChatHistoryEnabled)
+ */
+exports.isPersistentChatEnabled = isPersistentChatEnabled;
+const shouldLoadPersistentChatHistory = extendedChatConfig => {
+  var _extendedChatConfig$L, _extendedChatConfig$L2, _extendedChatConfig$L3;
+  // CRITICAL: First check if conversation mode is persistent
+  // Only persistent mode ("192350001") should allow history loading
+  const isPersistentChatEnabledForWidget = isPersistentChatEnabled(extendedChatConfig === null || extendedChatConfig === void 0 ? void 0 : (_extendedChatConfig$L = extendedChatConfig.LiveWSAndLiveChatEngJoin) === null || _extendedChatConfig$L === void 0 ? void 0 : _extendedChatConfig$L.msdyn_conversationmode);
+  if (!isPersistentChatEnabledForWidget) {
+    return false;
+  }
+
+  // Check if history is enabled in admin config (handles both boolean and string "true"/"false")
+  const isHistoryEnabledInConfig = (0, _utils.parseBooleanFromConfig)(extendedChatConfig === null || extendedChatConfig === void 0 ? void 0 : (_extendedChatConfig$L2 = extendedChatConfig.LiveWSAndLiveChatEngJoin) === null || _extendedChatConfig$L2 === void 0 ? void 0 : _extendedChatConfig$L2.msdyn_enablepersistentchatpreviousconversations);
+  if (!isHistoryEnabledInConfig) {
+    return false;
+  }
+
+  // Check if history is enabled via feature flag (handles both boolean and string "true"/"false")
+  const isHistoryEnabledViaFCB = (0, _utils.parseBooleanFromConfig)(extendedChatConfig === null || extendedChatConfig === void 0 ? void 0 : (_extendedChatConfig$L3 = extendedChatConfig.LcwFcbConfiguration) === null || _extendedChatConfig$L3 === void 0 ? void 0 : _extendedChatConfig$L3.lcwPersistentChatHistoryEnabled);
+  return isHistoryEnabledViaFCB;
 };
-exports.isPersistentChatEnabled = isPersistentChatEnabled;
+exports.shouldLoadPersistentChatHistory = shouldLoadPersistentChatHistory;