@microsoft/omnichannel-chat-widget 1.8.4-main.cbab5fc → 1.8.4-main.cd79f08

package/lib/esm/common/facades/FacadeChatSDK.js

@@ -5,7 +5,7 @@ function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key i
 function _toPropertyKey(arg) { var key = _toPrimitive(arg, "string"); return typeof key === "symbol" ? key : String(key); }
 function _toPrimitive(input, hint) { if (typeof input !== "object" || input === null) return input; var prim = input[Symbol.toPrimitive]; if (prim !== undefined) { var res = prim.call(input, hint || "default"); if (typeof res !== "object") return res; throw new TypeError("@@toPrimitive must return a primitive value."); } return (hint === "string" ? String : Number)(input); }
 import { BroadcastEvent, LogLevel, TelemetryEvent } from "../telemetry/TelemetryConstants";
-import { getAuthClientFunction, handleAuthentication } from "../../components/livechatwidget/common/authHelper";
+import { getAuthClientFunction, handleAuthentication, isMidAuthEnabled } from "../../components/livechatwidget/common/authHelper";
 import { BroadcastService } from "@microsoft/omnichannel-chat-components";
 import { TelemetryHelper } from "../telemetry/TelemetryHelper";
 import { isNullOrEmptyString } from "../utils";
@@ -20,6 +20,8 @@ export let FacadeChatSDK = /*#__PURE__*/function () {
     _defineProperty(this, "getAuthToken", void 0);
     _defineProperty(this, "sdkMocked", void 0);
     _defineProperty(this, "disableReauthentication", void 0);
+    // Stays true so CASE 1 re-triggers on every startChat to set deferInitialAuth
+    _defineProperty(this, "pendingMidAuthUnauthenticatedState", false);
     this.chatSDK = input.chatSDK;
     this.chatConfig = input.chatConfig;
     this.getAuthToken = input.getAuthToken;
@@ -44,6 +46,12 @@ export let FacadeChatSDK = /*#__PURE__*/function () {
     value: function destroy() {
       this.token = null;
       this.expiration = 0;
+      if (isMidAuthEnabled(this.chatConfig)) {
+        this.pendingMidAuthUnauthenticatedState = false;
+        this.isAuthenticated = true;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        this.chatSDK.deferInitialAuth = false;
+      }
     }
   }, {
     key: "isTokenSet",
@@ -208,6 +216,10 @@ export let FacadeChatSDK = /*#__PURE__*/function () {
           message: "Token is valid"
         };
       }
+
+      // Token missing or expired - need to get a new one via getAuthToken
+      // For mid-auth: getAuthToken receives { isMidAuthEnabled: true } so customer implementations
+      // can check portal state and return null for logged-out users
       TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.INFO, {
         Event: TelemetryEvent.NewTokenValidationStarted,
         Description: "Token validation started."
@@ -228,6 +240,7 @@ export let FacadeChatSDK = /*#__PURE__*/function () {
       this.token = "";
       this.expiration = 0;
       try {
+        var _ring$error, _ring$error2;
         const ring = await handleAuthentication(this.chatSDK, this.chatConfig, this.getAuthToken);
         if ((ring === null || ring === void 0 ? void 0 : ring.result) === true && ring !== null && ring !== void 0 && ring.token) {
           await this.setToken(ring.token);
@@ -242,18 +255,35 @@ export let FacadeChatSDK = /*#__PURE__*/function () {
             result: true,
             message: "New Token obtained"
           };
-        } else {
-          var _ring$error, _ring$error2;
-          TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.ERROR, {
-            Event: TelemetryEvent.NewTokenValidationFailed,
-            Description: (_ring$error = ring.error) === null || _ring$error === void 0 ? void 0 : _ring$error.message,
-            ExceptionDetails: ring === null || ring === void 0 ? void 0 : ring.error
+        }
+
+        // Mid-auth: no token available - set pending flag for startChat to handle
+        const isEmptyTokenWithoutError = isNullOrEmptyString(ring === null || ring === void 0 ? void 0 : ring.token) && ((ring === null || ring === void 0 ? void 0 : ring.result) === true || (ring === null || ring === void 0 ? void 0 : ring.result) === false && !(ring !== null && ring !== void 0 && ring.error));
+        if (isMidAuthEnabled(this.chatConfig) && isEmptyTokenWithoutError) {
+          // Clear Facade and SDK token state so API calls use unauthenticated endpoints
+          this.token = "";
+          this.expiration = 0;
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          this.chatSDK.authenticatedUserToken = null;
+          this.pendingMidAuthUnauthenticatedState = true;
+          TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.INFO, {
+            Event: TelemetryEvent.NewTokenValidationCompleted,
+            Description: "Mid-auth enabled: no token returned; proceeding as unauthenticated"
           });
           return {
-            result: false,
-            message: (ring === null || ring === void 0 ? void 0 : (_ring$error2 = ring.error) === null || _ring$error2 === void 0 ? void 0 : _ring$error2.message) || "Failed to get token"
+            result: true,
+            message: "Mid-auth: proceeding as unauthenticated"
           };
         }
+        TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.ERROR, {
+          Event: TelemetryEvent.NewTokenValidationFailed,
+          Description: (_ring$error = ring.error) === null || _ring$error === void 0 ? void 0 : _ring$error.message,
+          ExceptionDetails: ring === null || ring === void 0 ? void 0 : ring.error
+        });
+        return {
+          result: false,
+          message: (ring === null || ring === void 0 ? void 0 : (_ring$error2 = ring.error) === null || _ring$error2 === void 0 ? void 0 : _ring$error2.message) || "Failed to get token"
+        };
       } catch (e) {
         console.error("Unexpected error while getting token", e);
         TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.ERROR, {
@@ -267,6 +297,155 @@ export let FacadeChatSDK = /*#__PURE__*/function () {
         };
       }
     }
+
+    /**
+     * Sets unauthenticated state for mid-auth flow.
+     * Clears SDK internal state to prevent reconnection to previous authenticated session.
+     */
+  }, {
+    key: "setMidAuthUnauthenticatedState",
+    value: function setMidAuthUnauthenticatedState() {
+      var _sdk$chatToken, _sdk$chatToken2;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const sdk = this.chatSDK;
+      const hadExistingChat = !!((_sdk$chatToken = sdk.chatToken) !== null && _sdk$chatToken !== void 0 && _sdk$chatToken.chatId);
+      const previousChatId = (_sdk$chatToken2 = sdk.chatToken) === null || _sdk$chatToken2 === void 0 ? void 0 : _sdk$chatToken2.chatId;
+      this.clearAuthState();
+
+      // Clear SDK internal state for fresh unauthenticated chat
+      sdk.chatToken = {};
+      sdk.reconnectId = null;
+      sdk.requestId = null;
+      sdk.sessionId = null;
+      sdk.conversation = null;
+      TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.INFO, {
+        Event: TelemetryEvent.MidConversationAuthReset,
+        Description: hadExistingChat ? "Mid-auth without token: local state cleared" : "Mid-auth: initialized as unauthenticated (no prior chat)",
+        Data: hadExistingChat ? {
+          previousChatId
+        } : undefined
+      });
+    }
+
+    /** Clears authentication state in both FacadeChatSDK and underlying SDK */
+  }, {
+    key: "clearAuthState",
+    value: function clearAuthState() {
+      this.token = "";
+      this.expiration = 0;
+      this.isAuthenticated = false;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      this.chatSDK.authenticatedUserToken = null;
+    }
+
+    /**
+     * Migrates conversation from unauthenticated to authenticated via authenticateChat.
+     * Called after startChat() when user has a valid token but the backend conversation
+     * was started as unauthenticated.
+     */
+  }, {
+    key: "migrateConversationToAuthenticated",
+    value: async function migrateConversationToAuthenticated() {
+      try {
+        await this.chatSDK.authenticateChat(this.token, {
+          refreshChatToken: true
+        });
+        this.isAuthenticated = true;
+        TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.INFO, {
+          Event: TelemetryEvent.MidConversationAuthSucceeded,
+          Description: "Mid-auth: authenticateChat completed, conversation migrated to authenticated"
+        });
+      } catch (e) {
+        // Non-fatal: Chat is already active via startChat, will retry on next reconnect
+        TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.WARN, {
+          Event: TelemetryEvent.MidConversationAuthFailed,
+          Description: "Mid-auth: authenticateChat returned error after startChat, chat still active",
+          ExceptionDetails: {
+            message: e === null || e === void 0 ? void 0 : e.message
+          }
+        });
+      }
+    }
+
+    /**
+     * Configures SDK auth state before startChat.
+     * CASE 1: Pending unauthenticated (no token) - sets deferInitialAuth=true
+     * CASE 2: Authenticated with valid token - sets SDK token and deferInitialAuth based on scenario
+     */
+  }, {
+    key: "configureMidAuthState",
+    value: function configureMidAuthState(isReconnect, wasPreviousSessionAuthenticated) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const sdk = this.chatSDK;
+
+      // CASE 1: No token available (user not logged in)
+      // pendingMidAuthUnauthenticatedState stays true until user logs in (cleared in tokenRing)
+      if (this.pendingMidAuthUnauthenticatedState) {
+        const shouldClear = this.handlePendingUnauthenticatedState(wasPreviousSessionAuthenticated);
+        sdk.deferInitialAuth = true;
+        TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.INFO, {
+          Event: TelemetryEvent.MidConversationAuthReset,
+          Description: "Mid-auth configureMidAuthState: CASE 1 - unauthenticated, deferInitialAuth=true",
+          Data: {
+            isReconnect: String(isReconnect),
+            wasPreviousSessionAuthenticated: String(wasPreviousSessionAuthenticated),
+            shouldClearReconnectParams: String(shouldClear)
+          }
+        });
+        return {
+          shouldClearReconnectParams: shouldClear
+        };
+      }
+
+      // CASE 2: Authenticated with valid token
+      if (this.isTokenSet() && !this.isTokenExpired()) {
+        this.handleAuthenticatedState(isReconnect, wasPreviousSessionAuthenticated);
+      }
+      return {
+        shouldClearReconnectParams: false
+      };
+    }
+
+    /**
+     * CASE 1 handler: Returns true if reconnect params should be cleared (Auth -> Unauth transition)
+     */
+  }, {
+    key: "handlePendingUnauthenticatedState",
+    value: function handlePendingUnauthenticatedState(wasPreviousSessionAuthenticated) {
+      if (wasPreviousSessionAuthenticated) {
+        // Auth -> Unauth: user logged out, clear state for fresh chat
+        this.setMidAuthUnauthenticatedState();
+        return true;
+      }
+
+      // Unauth -> Unauth: keep liveChatContext for reconnection
+      this.isAuthenticated = false;
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      this.chatSDK.authenticatedUserToken = null;
+      return false;
+    }
+
+    /**
+     * CASE 2 handler: Sets deferInitialAuth only for reconnects to unauthenticated sessions (need migration).
+     * For new chats or reconnects to authenticated sessions, SDK handles auth internally.
+     */
+  }, {
+    key: "handleAuthenticatedState",
+    value: function handleAuthenticatedState(isReconnect, wasPreviousSessionAuthenticated) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const sdk = this.chatSDK;
+      sdk.authenticatedUserToken = this.token;
+      if (isReconnect && !wasPreviousSessionAuthenticated) {
+        sdk.deferInitialAuth = true;
+        TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.INFO, {
+          Event: TelemetryEvent.MidConversationAuthSucceeded,
+          Description: "Mid-auth handleAuthenticatedState: CASE 2 - reconnect to unauth session, deferInitialAuth=true (migration needed)"
+        });
+      } else {
+        // Reset to prevent inheriting deferInitialAuth=true from a previous unauthenticated chat
+        sdk.deferInitialAuth = false;
+      }
+    }
   }, {
     key: "validateAndExecuteCall",
     value: async function validateAndExecuteCall(functionName, fn) {
@@ -301,7 +480,53 @@ export let FacadeChatSDK = /*#__PURE__*/function () {
     key: "startChat",
     value: async function startChat() {
       let optionalParams = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
-      return this.validateAndExecuteCall("startChat", () => this.chatSDK.startChat(optionalParams));
+      const midAuthEnabled = isMidAuthEnabled(this.chatConfig);
+      const isReconnect = !!optionalParams.liveChatContext || !!optionalParams.reconnectId;
+      const wasPreviousSessionAuthenticated = optionalParams.wasAuthenticated === true;
+      return this.validateAndExecuteCall("startChat", async () => {
+        if (midAuthEnabled) {
+          const {
+            shouldClearReconnectParams
+          } = this.configureMidAuthState(isReconnect, wasPreviousSessionAuthenticated);
+          if (shouldClearReconnectParams) {
+            delete optionalParams.liveChatContext;
+            delete optionalParams.reconnectId;
+          }
+        }
+        await this.chatSDK.startChat(optionalParams);
+
+        // Migrate to authenticated if needed (reconnects to unauthenticated sessions only)
+        if (midAuthEnabled) {
+          const shouldMigrateToAuth = isReconnect && this.isTokenSet() && !this.isTokenExpired() && !wasPreviousSessionAuthenticated;
+          if (shouldMigrateToAuth) {
+            TelemetryHelper.logFacadeChatSDKEventToAllTelemetry(LogLevel.INFO, {
+              Event: TelemetryEvent.MidConversationAuthSucceeded,
+              Description: "Mid-auth startChat: initiating migration to authenticated",
+              Data: {
+                isReconnect: String(isReconnect),
+                wasPreviousSessionAuthenticated: String(wasPreviousSessionAuthenticated)
+              }
+            });
+            await this.migrateConversationToAuthenticated();
+          }
+        }
+
+        // Broadcast final auth state after startChat completes (only on state change)
+        if (midAuthEnabled) {
+          const isAuthenticatedAfterStart = this.isTokenSet() && !this.isTokenExpired();
+          const authStateChanged = !isReconnect || isAuthenticatedAfterStart !== wasPreviousSessionAuthenticated;
+          if (authStateChanged) {
+            BroadcastService.postMessage({
+              eventName: isAuthenticatedAfterStart ? BroadcastEvent.MidConversationAuthSucceeded : BroadcastEvent.MidConversationAuthReset,
+              payload: {
+                isAuthenticated: isAuthenticatedAfterStart,
+                isStartChatComplete: true,
+                isReconnect
+              }
+            });
+          }
+        }
+      });
     }
   }, {
     key: "endChat",
@@ -439,6 +664,7 @@ export let FacadeChatSDK = /*#__PURE__*/function () {
       let optionalParams = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
       return this.validateAndExecuteCall("getAgentAvailability", () => this.chatSDK.getAgentAvailability(optionalParams));
     }
+
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
   }, {
     key: "getReconnectableChats",

package/lib/esm/common/telemetry/TelemetryConstants.js

@@ -69,6 +69,8 @@ export let BroadcastEvent;
   BroadcastEvent["FMLTrackingCompletedAck"] = "FMLTrackingCompletedAck";
   BroadcastEvent["FMLTrackingCompleted"] = "FMLTrackingCompleted";
   BroadcastEvent["PersistentConversationReset"] = "PersistentConversationReset";
+  BroadcastEvent["MidConversationAuthSucceeded"] = "MidConversationAuthSucceeded";
+  BroadcastEvent["MidConversationAuthReset"] = "MidConversationAuthReset";
 })(BroadcastEvent || (BroadcastEvent = {}));
 export let TelemetryEvent;
 (function (TelemetryEvent) {
@@ -102,6 +104,9 @@ export let TelemetryEvent;
   TelemetryEvent["CallingSDKInitFailed"] = "CallingSDKInitFailed";
   TelemetryEvent["CallingSDKLoadSuccess"] = "CallingSDKLoadSuccess";
   TelemetryEvent["CallingSDKLoadFailed"] = "CallingSDKLoadFailed";
+  TelemetryEvent["MidConversationAuthSucceeded"] = "MidConversationAuthSucceeded";
+  TelemetryEvent["MidConversationAuthFailed"] = "MidConversationAuthFailed";
+  TelemetryEvent["MidConversationAuthReset"] = "MidConversationAuthReset";
   TelemetryEvent["GetConversationDetailsCallStarted"] = "GetConversationDetailsCallStarted";
   TelemetryEvent["GetConversationDetailsCallFailed"] = "GetConversationDetailsCallFailed";
   TelemetryEvent["EndChatSDKCallFailed"] = "EndChatSDKCallFailed";
@@ -312,10 +317,16 @@ export let TelemetryEvent;
   TelemetryEvent["LCWLazyLoadNoMoreHistory"] = "LCWLazyLoadNoMoreHistory";
   TelemetryEvent["LCWLazyLoadHistoryError"] = "LCWLazyLoadHistoryError";
   TelemetryEvent["LCWLazyLoadDestroyed"] = "LCWLazyLoadDestroyed";
+  TelemetryEvent["LCWLazyLoadTriggerFired"] = "LCWLazyLoadTriggerFired";
+  TelemetryEvent["LCWLazyLoadBatchReceived"] = "LCWLazyLoadBatchReceived";
+  TelemetryEvent["LCWLazyLoadInitialLoadComplete"] = "LCWLazyLoadInitialLoadComplete";
+  TelemetryEvent["LCWLazyLoadScrollAnchorApplied"] = "LCWLazyLoadScrollAnchorApplied";
   TelemetryEvent["SecureEventBusUnauthorizedDispatch"] = "SecureEventBusUnauthorizedDispatch";
   TelemetryEvent["SecureEventBusListenerError"] = "SecureEventBusListenerError";
   TelemetryEvent["SecureEventBusDispatchError"] = "SecureEventBusDispatchError";
   TelemetryEvent["StartChatComplete"] = "StartChatComplete";
+  TelemetryEvent["AgentJoinedConversation"] = "AgentJoinedConversation";
+  TelemetryEvent["BrowserTabHidden"] = "BrowserTabHidden";
 })(TelemetryEvent || (TelemetryEvent = {}));
 export let TelemetryConstants = /*#__PURE__*/function () {
   function TelemetryConstants() {
@@ -386,6 +397,8 @@ export let TelemetryConstants = /*#__PURE__*/function () {
         case TelemetryEvent.SecureEventBusUnauthorizedDispatch:
         case TelemetryEvent.SecureEventBusListenerError:
         case TelemetryEvent.SecureEventBusDispatchError:
+        case TelemetryEvent.AgentJoinedConversation:
+        case TelemetryEvent.BrowserTabHidden:
           return ScenarioType.ACTIONS;
         case TelemetryEvent.StartChatSDKCall:
         case TelemetryEvent.StartChatEventReceived:

package/lib/esm/common/telemetry/loggers/appInsightsLogger.js

@@ -5,11 +5,11 @@ import { AppInsightsTelemetryMessage } from "../../Constants";
 import { AppInsightsEventMapping } from "../AppInsightsEvents";
 var AllowedKeys;
 (function (AllowedKeys) {
-  AllowedKeys["OrganizationId"] = "OrganizationId";
-  AllowedKeys["ConversationId"] = "LiveWorkItemId";
+  AllowedKeys["OrganizationId"] = "powerplatform.analytics.resource.organization.id";
+  AllowedKeys["ConversationId"] = "powerplatform.analytics.resource.id";
   AllowedKeys["ElapsedTimeInMilliseconds"] = "Duration";
-  AllowedKeys["Description"] = "Description";
-  AllowedKeys["ChannelId"] = "ChannelType";
+  AllowedKeys["Description"] = "omnichannel.description";
+  AllowedKeys["ChannelId"] = "omnichannel.channel.type";
   AllowedKeys["LCWRuntimeId"] = "ClientSessionId";
 })(AllowedKeys || (AllowedKeys = {}));
 let initializationPromise = null;
@@ -86,8 +86,8 @@ export const appInsightsLogger = appInsightsKey => {
         if (eventName) {
           const trackingEventName = getTrackingEventName(logLevel, eventName);
           const eventProperties = setEventProperties(trackingEventName, telemetryInfo);
-          _logger.trackEvent({
-            name: trackingEventName,
+          _logger.trackTrace({
+            message: trackingEventName,
             properties: eventProperties
           });
         }
@@ -133,7 +133,7 @@ export const appInsightsLogger = appInsightsKey => {
     // Additional properties
     eventProperties["ConversationStage"] = customProperties.ConversationStage ?? ConversationStage.CSREngagement;
     eventProperties["Scenario"] = "Conversation Diagnostics";
-    eventProperties["OperationName"] = eventName.includes(": ") ? eventName.split(": ")[1] : eventName;
+    eventProperties["powerplatform.analytics.subscenario"] = eventName.includes(": ") ? eventName.split(": ")[1] : eventName;
     return eventProperties;
   }
   function getTrackingEventName(logLevel, eventName) {

package/lib/esm/common/utils/xssUtils.js

@@ -1,70 +1,42 @@
 import DOMPurify from "dompurify";
 
 /**
- * Detects potential Cross-Site Scripting (XSS) attacks in text input and sanitizes the content.
+ * Sanitizes text input and detects XSS attack patterns.
  * 
- * This function performs comprehensive XSS detection using pattern matching for common attack vectors
- * and then sanitizes the input using DOMPurify with strict configuration. It's designed to protect
- * against various XSS techniques including script injection, event handler injection, style-based
- * attacks, and encoded payloads.
+ * Sanitizes first with DOMPurify, then checks for malicious patterns in both
+ * the original and sanitized text to catch mutation XSS attacks.
  * 
- * Security patterns detected:
- * - JavaScript protocol URLs (javascript:)
- * - HTML event handlers (onmouseover, onclick, etc.)
- * - Script tags (<script>)
- * - CSS expression() functions
- * - CSS url() functions
- * - Position-based CSS attacks (position: fixed/absolute)
- * - VBScript protocol URLs
- * - Data URLs with HTML content
- * - Fragment identifiers with escaped quotes
- * - HTML entity-encoded angle brackets
- * 
- * @param text - The input text to be analyzed and sanitized
- * @returns An object containing:
- *   - cleanText: The sanitized version of the input text with all HTML tags and attributes removed
- *   - isXSSDetected: Boolean flag indicating whether potential XSS patterns were found in the original text
+ * @param text - Input text to sanitize
+ * @returns Object with cleanText (sanitized) and isXSSDetected flag
  */
 export const detectAndCleanXSS = text => {
-  // Comprehensive array of regular expressions to detect common XSS attack patterns
-  const xssPatterns = [/javascript\s*:/gi,
-  // JavaScript protocol URLs (with optional spaces)
-  /vbscript\s*:/gi,
-  // VBScript protocol URLs (with optional spaces)
-  /on\w+\s*=/gi,
-  // HTML event handlers (onmouseover, onclick, onload, etc.)
-  /<\s*script/gi,
-  // Script tag opening (with optional spaces)
-  /expression\s*\(/gi,
-  // CSS expression() function (IE-specific)
-  /url\s*\(/gi,
-  // CSS url() function
-  /style\s*=.*position\s*:\s*fixed/gi,
-  // CSS position fixed attacks
-  /style\s*=.*position\s*:\s*absolute/gi,
-  // CSS position absolute attacks
-  /data\s*:\s*text\s*\/\s*html/gi,
-  // Data URLs containing HTML
-  /#.*\\"/gi,
-  // Fragment identifiers with escaped quotes
-  /&gt;.*&lt;/gi // HTML entity-encoded angle brackets indicating tag structure
-  ];
-
-  // Check if any XSS patterns are detected in the input text
-  const isXSSDetected = xssPatterns.some(pattern => pattern.test(text));
-
-  // Clean the text using DOMPurify with strict config
+  // Sanitize first to prevent mutation XSS (e.g., "s<iframe></iframe>tyle" → "style")
   const cleanText = DOMPurify.sanitize(text, {
     ALLOWED_TAGS: [],
-    // No HTML tags allowed in title
     ALLOWED_ATTR: [],
     KEEP_CONTENT: true,
-    // Keep text content
     ALLOW_DATA_ATTR: false,
     ALLOW_UNKNOWN_PROTOCOLS: false,
     SANITIZE_DOM: true,
     FORCE_BODY: false
   });
+  const contentChanged = text !== cleanText;
+
+  // Non-global regex patterns to avoid stateful .test() issues
+  const xssPatterns = [/javascript\s*:/i, /vbscript\s*:/i, /on\w+\s*=/i,
+  // Event handlers
+  /<\s*script/i, /<\s*iframe/i, /<\s*object/i, /<\s*embed/i, /<\s*svg/i, /expression\s*\(/i,
+  // IE CSS expressions
+  /style\s*=.*position\s*:\s*(fixed|absolute)/i, /data\s*:\s*text\s*\/\s*html/i, /#.*\\"/i, /&(lt|gt|#x3c|#60|#x3e|#62);/i,
+  // HTML entities
+  /&#x?[0-9a-f]+;.*</i, /\u003c.*\u003e/i,
+  // Unicode escapes
+  /src\s*=\s*["']?\s*javascript:/i, /href\s*=\s*["']?\s*javascript:/i];
+  const hasXSSPattern = xssPatterns.some(pattern => {
+    return pattern.test(text) || pattern.test(cleanText);
+  });
+  const hasHTMLStructure = /<[^>]+>/.test(text) && !/<[^>]+>/.test(cleanText);
+  const isXSSDetected = contentChanged || hasXSSPattern || hasHTMLStructure;
   return {
     cleanText,
     isXSSDetected

package/lib/esm/common/utils.js

@@ -436,7 +436,7 @@ export const setOcUserAgent = chatSDK => {
   // eslint-disable-line @typescript-eslint/no-explicit-any
   if ((_chatSDK$OCClient = chatSDK.OCClient) !== null && _chatSDK$OCClient !== void 0 && _chatSDK$OCClient.ocUserAgent && !((_chatSDK$OCClient2 = chatSDK.OCClient) !== null && _chatSDK$OCClient2 !== void 0 && _chatSDK$OCClient2.ocUserAgent.join(" ").includes("omnichannel-chat-widget/"))) {
     try {
-      const version = require("../../../package.json").version; // eslint-disable-line @typescript-eslint/no-var-requires
+      const version = require("../../package.json").version; // eslint-disable-line @typescript-eslint/no-var-requires
       const userAgent = `omnichannel-chat-widget/${version}`;
       chatSDK.OCClient.ocUserAgent = [userAgent, ...chatSDK.OCClient.ocUserAgent];
     } catch (error) {
@@ -474,4 +474,15 @@ export const getCustomEventValue = customEventPayload => {
 export function isEndConversationDueToOverflowActivity(activity) {
   var _activity$channelData, _activity$channelData2;
   return (activity === null || activity === void 0 ? void 0 : (_activity$channelData = activity.channelData) === null || _activity$channelData === void 0 ? void 0 : _activity$channelData.tags) && Array.isArray(activity === null || activity === void 0 ? void 0 : (_activity$channelData2 = activity.channelData) === null || _activity$channelData2 === void 0 ? void 0 : _activity$channelData2.tags) && activity.channelData.tags.includes(Constants.EndConversationDueToOverflow);
+}
+
+/**
+ * Parses a value that can be boolean or string ("true"/"false") into a boolean.
+ * Handles null/undefined by returning false.
+ * 
+ * @param value - The value to parse (can be boolean, string, null, or undefined)
+ * @returns true if value is true or "true" (case-insensitive), false otherwise
+ */
+export function parseBooleanFromConfig(value) {
+  return value === true || (value === null || value === void 0 ? void 0 : value.toString().toLowerCase()) === "true";
 }

package/lib/esm/components/errorboundary/ErrorBoundary.js

@@ -10,12 +10,14 @@ function _possibleConstructorReturn(self, call) { if (call && (typeof call === "
 function _assertThisInitialized(self) { if (self === void 0) { throw new ReferenceError("this hasn't been initialised - super() hasn't been called"); } return self; }
 function _isNativeReflectConstruct() { if (typeof Reflect === "undefined" || !Reflect.construct) return false; if (Reflect.construct.sham) return false; if (typeof Proxy === "function") return true; try { Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function () {})); return true; } catch (e) { return false; } }
 function _getPrototypeOf(o) { _getPrototypeOf = Object.setPrototypeOf ? Object.getPrototypeOf.bind() : function _getPrototypeOf(o) { return o.__proto__ || Object.getPrototypeOf(o); }; return _getPrototypeOf(o); }
-import React, { Component } from 'react';
+import React, { Component } from "react";
+
+// eslint-disable-next-line @typescript-eslint/ban-types
 const RenderChildrenFunction = _ref => {
   let {
     children
   } = _ref;
-  return typeof children === 'function' ? children() : children;
+  return typeof children === "function" ? children() : children;
 };
 let ErrorBoundary = /*#__PURE__*/function (_Component) {
   _inherits(ErrorBoundary, _Component);

package/lib/esm/components/livechatwidget/LiveChatWidget.js

@@ -26,8 +26,16 @@ export const LiveChatWidget = props => {
     throw new Error("chatConfig is required");
   }
 
+  // Check configuration flags
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const isAuthenticatedChat = !!((_props$chatConfig = props.chatConfig) !== null && _props$chatConfig !== void 0 && (_props$chatConfig$Liv = _props$chatConfig.LiveChatConfigAuthSettings) !== null && _props$chatConfig$Liv !== void 0 && _props$chatConfig$Liv.msdyn_javascriptclientfunction) || isPersistentChatEnabled((_props$chatConfig2 = props.chatConfig) === null || _props$chatConfig2 === void 0 ? void 0 : (_props$chatConfig2$Li = _props$chatConfig2.LiveWSAndLiveChatEngJoin) === null || _props$chatConfig2$Li === void 0 ? void 0 : _props$chatConfig2$Li.msdyn_conversationmode);
+  const hasAuthClientFn = !!((_props$chatConfig = props.chatConfig) !== null && _props$chatConfig !== void 0 && (_props$chatConfig$Liv = _props$chatConfig.LiveChatConfigAuthSettings) !== null && _props$chatConfig$Liv !== void 0 && _props$chatConfig$Liv.msdyn_javascriptclientfunction);
+  const persistentChatEnabled = isPersistentChatEnabled((_props$chatConfig2 = props.chatConfig) === null || _props$chatConfig2 === void 0 ? void 0 : (_props$chatConfig2$Li = _props$chatConfig2.LiveWSAndLiveChatEngJoin) === null || _props$chatConfig2$Li === void 0 ? void 0 : _props$chatConfig2$Li.msdyn_conversationmode);
+
+  // isAuthenticatedChat determines if FacadeChatSDK should require authentication:
+  // REGULAR AUTH FLOW (config-based):
+  // - Persistent chat enabled ? always authenticated
+  // - Auth settings exist ? authenticated from start
+  const isAuthenticatedChat = persistentChatEnabled || hasAuthClientFn;
   if (!facadeChatSDK) {
     var _props$mock;
     setFacadeChatSDK(new FacadeChatSDK({

package/lib/esm/components/livechatwidget/common/ActivitySubscriber/BotAuthActivitySubscriber.js

@@ -40,7 +40,7 @@ const extractSasUrl = async attachment => {
   }
   return sasUrl;
 };
-const fetchBotAuthConfig = async (retries, interval) => {
+const fetchBotAuthConfig = async (retries, interval, fallback) => {
   TelemetryHelper.logLoadingEvent(LogLevel.INFO, {
     Event: TelemetryEvent.SetBotAuthProviderFetchConfig
   });
@@ -56,13 +56,23 @@ const fetchBotAuthConfig = async (retries, interval) => {
   });
   if (retries === 1) {
     // Base Case
-    throw new Error();
+    if (response !== undefined) {
+      return response;
+    }
+    if (fallback !== undefined) {
+      TelemetryHelper.logLoadingEvent(LogLevel.WARN, {
+        Event: TelemetryEvent.SetBotAuthProviderNotFound,
+        Description: `Failed to fetch bot auth config after maximum retries. Using fallback value: ${fallback}`
+      });
+      return fallback;
+    }
+    throw new Error("Failed to fetch bot auth config after maximum retries");
   }
   await delay(interval);
   if (response !== undefined) {
     return response;
   }
-  return await fetchBotAuthConfig(--retries, interval);
+  return await fetchBotAuthConfig(--retries, interval, fallback);
 };
 export let BotAuthActivitySubscriber = /*#__PURE__*/function () {
   function BotAuthActivitySubscriber() {
@@ -72,6 +82,7 @@ export let BotAuthActivitySubscriber = /*#__PURE__*/function () {
     _defineProperty(this, "signInCardSeen", void 0);
     _defineProperty(this, "fetchBotAuthConfigRetries", void 0);
     _defineProperty(this, "fetchBotAuthConfigRetryInterval", void 0);
+    _defineProperty(this, "fallbackShowSignInCard", void 0);
     this.signInCardSeen = new Set();
     this.fetchBotAuthConfigRetries = 3;
     this.fetchBotAuthConfigRetryInterval = 1000;
@@ -81,6 +92,11 @@ export let BotAuthActivitySubscriber = /*#__PURE__*/function () {
     if (optionalParams.fetchBotAuthConfigRetryInterval) {
       this.fetchBotAuthConfigRetryInterval = optionalParams.fetchBotAuthConfigRetryInterval;
     }
+    this.fallbackShowSignInCard = optionalParams.fallbackShowSignInCard;
+    TelemetryHelper.logLoadingEvent(LogLevel.INFO, {
+      Event: TelemetryEvent.SetBotAuthProviderFetchConfig,
+      Description: `BotAuthActivitySubscriber initialized with fallbackShowSignInCard: ${optionalParams.fallbackShowSignInCard}`
+    });
   }
   _createClass(BotAuthActivitySubscriber, [{
     key: "applicable",
@@ -125,7 +141,7 @@ export let BotAuthActivitySubscriber = /*#__PURE__*/function () {
         BroadcastService.postMessage(event);
       }
       try {
-        const response = await fetchBotAuthConfig(this.fetchBotAuthConfigRetries, this.fetchBotAuthConfigRetryInterval);
+        const response = await fetchBotAuthConfig(this.fetchBotAuthConfigRetries, this.fetchBotAuthConfigRetryInterval, this.fallbackShowSignInCard);
         if (response === false) {
           TelemetryHelper.logLoadingEvent(LogLevel.INFO, {
             Event: TelemetryEvent.SetBotAuthProviderHideCard
@@ -136,9 +152,10 @@ export let BotAuthActivitySubscriber = /*#__PURE__*/function () {
           });
           return activity;
         }
-      } catch {
+      } catch (e) {
         TelemetryHelper.logLoadingEvent(LogLevel.INFO, {
-          Event: TelemetryEvent.SetBotAuthProviderNotFound
+          Event: TelemetryEvent.SetBotAuthProviderNotFound,
+          ExceptionDetails: e instanceof Error ? e.message : JSON.stringify(e)
         });
         //this is to ensure listener continues waiting for response
         if (this.signInCardSeen.has(signInId)) {

package/lib/esm/components/livechatwidget/common/ChatWidgetEvents.js

@@ -4,5 +4,6 @@ var ChatWidgetEvents;
   ChatWidgetEvents["FETCH_PERSISTENT_CHAT_HISTORY"] = "CHAT_WIDGET/FETCH_PERSISTENT_CHAT_HISTORY";
   ChatWidgetEvents["NO_MORE_HISTORY_AVAILABLE"] = "CHAT_WIDGET/NO_MORE_HISTORY_AVAILABLE";
   ChatWidgetEvents["HISTORY_LOAD_ERROR"] = "CHAT_WIDGET/HISTORY_LOAD_ERROR";
+  ChatWidgetEvents["HISTORY_BATCH_LOADED"] = "CHAT_WIDGET/HISTORY_BATCH_LOADED";
 })(ChatWidgetEvents || (ChatWidgetEvents = {}));
 export default ChatWidgetEvents;

package/lib/esm/components/livechatwidget/common/PersistentConversationHandler.js

@@ -127,6 +127,12 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
         }
         const messagesDescOrder = (_ref = [...messages]) === null || _ref === void 0 ? void 0 : _ref.reverse();
         this.processHistoryMessages(messagesDescOrder);
+
+        // Signal that a batch of history messages has been added to the store.
+        // LazyLoadActivity subscribes to this to apply scroll anchoring after render.
+        dispatchCustomEvent(ChatWidgetEvents.HISTORY_BATCH_LOADED, {
+          messageCount: messages.length
+        });
         TelemetryHelper.logActionEvent(LogLevel.INFO, {
           Event: TelemetryEvent.LCWPersistentHistoryPullCompleted,
           Description: "History pull completed successfully",
@@ -235,6 +241,9 @@ let PersistentConversationHandler = /*#__PURE__*/function () {
     value: function processMessageToActivity(message) {
       try {
         const activity = convertPersistentChatHistoryMessageToActivity(message);
+        if (!activity) {
+          return null;
+        }
         activity.id = activity.id || `activity-${this.count}`;
         activity.channelData = {
           ...activity.channelData,