@qualified-salesforce/web 0.0.1-oidc-bootstrap → 0.1.1

package/packs/widget/esm/index.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Public TypeScript declarations for `@qualified-salesforce/web`.
+ *
+ * The curated public contract: the symbols the package exports and the types they reference. See
+ * `CAPABILITY-REFERENCE.md` (shipped in this package) for what each capability unlocks, the data
+ * egress it permits, and its default.
+ */
+
+/**
+ * The optional features a self-hosted consumer can enroll via `setup({ capabilities })`.
+ * Default-deny: a capability not listed stays off, and Qualified cannot turn it on. Voice is
+ * intentionally absent — this build ships text-only and cannot activate a call.
+ *
+ * A literal union rather than `string`, so a typo'd key is a compile error and an editor offers the
+ * valid keys. `CAPABILITY_KEYS` is the same set as a runtime value.
+ *
+ * See `CAPABILITY-REFERENCE.md` (shipped in this package) for what each key unlocks, the data
+ * egress it permits, and its default.
+ */
+export type Capability =
+  | "pardot"
+  | "liveView"
+  | "agentNavigation"
+  | "analytics"
+  | "slidePerception"
+  | "formCapture"
+  | "marketingIdentity";
+
+/**
+ * Every capability key, as a runtime value — the same set the boundary enforces. Enumerate it to
+ * build a settings UI or validate consumer input before passing `capabilities` to `setup()`.
+ */
+export declare const CAPABILITY_KEYS: readonly Capability[];
+
+/**
+ * Host/CDN/websocket origins and versions for a Qualified environment.
+ *
+ * Normally the runtime-config endpoint serves this; pass it to `setup({ environment })` only to pin
+ * it explicitly. Public because it is part of the `setup()` option surface, so it is a SemVer
+ * contract rather than an internal shape.
+ */
+export interface EnvironmentConfig {
+  version: string;
+  host: string;
+  cdnHost: string;
+  wsHost: string;
+  assetsHost?: string;
+  frontendVersion: string;
+  meetingLinkHost: string;
+  heartbeatPingDivisor?: number;
+  staleThresholdSeconds?: number;
+}
+
+/**
+ * The widget's full runtime configuration, as the CORS-enabled endpoint serves it: the environment
+ * origins, the opaque team config, and the Sentry proxy URL.
+ */
+export interface RuntimeConfig {
+  /** Host/CDN/WS origins and versions. Overridden by `setup({ environment })` when passed. */
+  environment?: EnvironmentConfig;
+  /**
+   * Team settings, exactly as `q("initialize", token, config)` takes them. Deliberately opaque —
+   * this stays Qualified's contract with its own server, not a public interface.
+   */
+  config: Record<string, unknown>;
+  /** Where the widget's Sentry clients POST envelopes; null on localhost. */
+  sentryProxyUrl?: string | null;
+}
+
+/**
+ * The `q(...)` command function `setup()` resolves to — the same interface a CDN consumer gets, so
+ * `teardown`, `identify` and the rest are called as `qualified("teardown")`.
+ */
+export type QualifiedFunction = (command: string, ...args: unknown[]) => unknown;
+
+/** Options for {@link setup}. */
+export interface QualifiedSetupOptions {
+  /** Team credential. The consumer decides where this comes from. */
+  token: string;
+  /**
+   * Qualified's API origin — where the runtime-config endpoint lives and where the widget talks.
+   * Required unless `runtimeConfigUrl` points somewhere self-contained: `setup()` fetches the
+   * runtime config from `${apiHost}/w/1/${token}/runtime_config`.
+   */
+  apiHost?: string;
+  /**
+   * Full environment config, when the consumer would rather pin it than take what the endpoint
+   * returns. When set, it wins over the fetched `environment`.
+   */
+  environment?: EnvironmentConfig;
+  /**
+   * Base URL the package's own assets (stylesheet, fonts) are served from. Omit when the consumer
+   * bundles the package (the bundler rewrites the asset URLs); pass the served directory when the
+   * consumer instead copies `dist/` to a static path — required for web fonts to resolve.
+   */
+  packageBase?: string;
+  /**
+   * Fetch the runtime config from this URL instead of the `/w/1/:token/runtime_config` endpoint.
+   * Must serve the same JSON shape. Intended for offline test harnesses.
+   */
+  runtimeConfigUrl?: string;
+  /**
+   * Default-deny allowlist of optional features this consumer permits. A capability not
+   * listed stays off and Qualified cannot turn it on. **Omitting this installs an empty allowlist —
+   * every gated feature off**; pass the ones you want enabled.
+   */
+  capabilities?: readonly Capability[];
+}
+
+/**
+ * Boots Qualified from the consumer's own bundle. Nothing runs until this is called: importing the
+ * package has no side effects, so the consumer decides when and with which credential Qualified
+ * starts.
+ *
+ * Resolves to the `q(...)` command function. Rejects loudly — booting nothing — if the runtime
+ * config cannot be fetched (bad token, unreachable host, CORS not granted).
+ *
+ * Awaiting is optional. Boot begins as soon as `setup()` is called and completes on its own, so the
+ * widget starts and renders whether or not the returned promise is awaited. Await it (or use
+ * `.then()`) only when you need the resolved `q(...)` command function — to call `identify`,
+ * `teardown`, etc. — or want to handle a boot failure.
+ */
+export declare function setup(options: QualifiedSetupOptions): Promise<QualifiedFunction>;
+
+/**
+ * Fetches the widget's runtime configuration from the CORS-enabled JSON endpoint, without booting
+ * the widget. `setup()` calls this internally; it is exported so the fetch and its failure modes
+ * are testable in isolation. Most consumers call {@link setup} instead.
+ */
+export declare function fetchRuntimeConfig(options: {
+  host?: string;
+  token: string;
+  runtimeConfigUrl?: string;
+}): Promise<RuntimeConfig>;

package/packs/widget/esm/index.js

@@ -1,6 +1,7 @@
 import "../../../widget/multimodal_v2/index.split-css.panda.js";
 import "../../../widget/widget.split-css.js";
 import "../../../widget/multimodal_v2/host.split-css.js";
+import { filterRuntimeConfig, installCapabilityBoundary } from "../../../widget/capabilities.js";
 import { default as LinkedWidgetV2 } from "../../../widget/widget/linked_widget_v2.js";
 import { Sentry } from "../../../widget/widget/sentry.js";
 import { widgetBootstrap } from "../../../widget/widget_bootstrap.js";
@@ -30,6 +31,12 @@ import { _extends } from "../../../js/4101.js";
 
 
 
+
+// Re-exported so a consumer can enumerate the allowlist keys at runtime and get a compile-time
+// error on a typo'd capability (QAI-5919): `import { CAPABILITY_KEYS, type Capability } from
+// "@qualified-salesforce/web"`. Sourced from the same module the boundary enforces, so the value
+// a consumer reads and the set `setup()` installs can never drift apart.
+
 /** Those URLs, or null in any build that is not the npm packaging (the hosted widget, Jest). */ function packagedAssetUrls() {
     if (false) {}
     return _extends({
@@ -112,7 +119,7 @@ let bootPromise = null;
     }
     if (bootPromise) return bootPromise;
     const promise = (async ()=>{
-        var _options_apiHost, _options_environment;
+        var _options_apiHost, _options_environment, _options_capabilities;
         var _globalThis_location, _options_environment1;
         // npm-native telemetry origin (QAI-5770). Our code is inlined into the consumer's
         // content-hashed chunk, so `script_time_to_start_ms` has no `qualified.js` resource entry to
@@ -147,6 +154,12 @@ let bootPromise = null;
         if (!(environment == null ? void 0 : environment.host)) {
             throw new Error("Qualified setup(): the runtime config carried no `environment`, and none was passed. " + "The widget will not boot.");
         }
+        // Install the consumer's allowlist now that the boot is actually proceeding — after the fetch,
+        // before any dispatch or the config filter below. Installing here (not before the fetch) means
+        // a failed boot never locks the boundary, so a retry may pass a different allowlist (QAI-5862).
+        // Sourced from `options.capabilities` alone, so the fetched config is narrowed against a
+        // boundary our server had no say in.
+        installCapabilityBoundary((_options_capabilities = options.capabilities) != null ? _options_capabilities : []);
         // The classic entry's import-time side effects, performed here instead.
         // The base `call_store.ts` resolves the call machine against when it has nothing better — a
         // filename appended to a directory. That works for a tarball served as laid out, but not when
@@ -167,7 +180,9 @@ let bootPromise = null;
         // — the widget's own shadow-root mirror picks it up once applied.
         injectStylesheet(stylesheetUrl);
         const qualified = LinkedWidgetV2.start(environment);
-        qualified("initialize", options.token, runtime.config);
+        // Narrow the server config against the allowlist before the widget sees it (QAI-5862): the
+        // filter only deletes denied enablers, so the server can't switch on a disallowed capability.
+        qualified("initialize", options.token, filterRuntimeConfig(runtime.config));
         return qualified;
     })();
     // A rejected boot must not stay cached: a transient failure (a network blip during the config
@@ -181,3 +196,4 @@ let bootPromise = null;
 }
 
 export { fetchRuntimeConfig, setup };
+export { CAPABILITY_KEYS } from "../../../widget/capabilities.js";

package/packs/widget/esm/qualified.css

@@ -737,8 +737,8 @@
     padding: 0 16px 0 8px;
   }
 
-  .q-eUlsAQ {
-    padding: 0 8px;
+  .q-dqRdNH {
+    padding: 0;
   }
 
   .q-ffAOcM {
@@ -795,10 +795,6 @@
     border: 1.5px solid #d7dde2;
   }
 
-  .q-dqRdNH {
-    padding: 0;
-  }
-
   .q-kgRGeM {
     margin: -1px;
   }
@@ -999,6 +995,10 @@
     border: 1px solid \$colors\.border;
   }
 
+  .q-kWIjhW {
+    font: inherit;
+  }
+
   .q-gPyWWT {
     border: 1px solid;
   }
@@ -1284,6 +1284,16 @@
     gap: 10px;
   }
 
+  .q-cfDrIW {
+    border-radius: 16px;
+    border-radius: var(--q-dxfumK);
+  }
+
+  .q-iainBx {
+    gap: 16px;
+    gap: var(--q-jugHdA);
+  }
+
   .q-hMIFSa {
     transition: background-color .2s;
   }
@@ -1441,11 +1451,6 @@
     gap: 24px;
   }
 
-  .q-iainBx {
-    gap: 16px;
-    gap: var(--q-jugHdA);
-  }
-
   .q-bMcXFr {
     border-radius: 8px;
     border-radius: var(--q-control-border-radius, 8px);
@@ -1618,6 +1623,23 @@
     transition: opacity .2s, box-shadow .2s, transform .2s;
   }
 
+  .q-bkgpAA {
+    inset-inline: 16px;
+  }
+
+  .q-NGWtr {
+    inset-inline: 8px;
+  }
+
+  .q-DHTGQ {
+    inset-inline: -20px;
+  }
+
+  .q-fNJrUv {
+    border-radius: 8px;
+    border-radius: var(--q-bewZvn);
+  }
+
   .q-brKOqO {
     overscroll-behavior: contain;
   }
@@ -2212,6 +2234,18 @@
     resize: none;
   }
 
+  .q-kGHEMe {
+    align-self: flex-start;
+  }
+
+  .q-cOEFXT {
+    transform: rotate(180deg);
+  }
+
+  .q-kTBjet {
+    align-items: stretch;
+  }
+
   .q-bSTPIv {
     box-shadow: 0 8px 32px #0000004d;
   }
@@ -2233,14 +2267,27 @@
     transform-origin: bottom;
   }
 
-  .q-loatqo {
-    background-color: #fff6;
+  .q-jcVpEa {
+    line-height: 22px;
   }
 
   .q-iCfjvi {
     flex-grow: 1;
   }
 
+  .q-gasSYy {
+    flex-wrap: wrap;
+  }
+
+  .q-loatqo {
+    background-color: #fff6;
+  }
+
+  .q-hdUyV {
+    background-color: #e6e9ec;
+    background-color: var(--q-gjomaU);
+  }
+
   .q-eIsAcC {
     -webkit-user-select: none;
     user-select: none;
@@ -2263,18 +2310,10 @@
     transform: translateY(8px);
   }
 
-  .q-gasSYy {
-    flex-wrap: wrap;
-  }
-
   .q-hxBzcr {
     align-items: flex-end;
   }
 
-  .q-kTBjet {
-    align-items: stretch;
-  }
-
   .q-hYhvQY {
     box-shadow: none;
     box-shadow: var(--q-jLtLHp);
@@ -2337,10 +2376,6 @@
     container-name: bookerPanel;
   }
 
-  .q-cOEFXT {
-    transform: rotate(180deg);
-  }
-
   .q-hBOzJB {
     color: #e4251b;
   }
@@ -2592,10 +2627,6 @@
     background-color: #2dd272;
   }
 
-  .q-kGHEMe {
-    align-self: flex-start;
-  }
-
   .q-iMVOnP {
     align-self: center;
   }
@@ -2608,10 +2639,6 @@
     line-height: 14px;
   }
 
-  .q-jcVpEa {
-    line-height: 22px;
-  }
-
   .q-krbBcV {
     white-space: normal;
   }
@@ -2714,6 +2741,45 @@
     justify-content: flex-start;
   }
 
+  .q-bGTgkg {
+    appearance: none;
+  }
+
+  .q-vNRpm {
+    -webkit-appearance: none;
+  }
+
+  .q-jKfYXo {
+    text-align: inherit;
+  }
+
+  .q-irWrst {
+    background-color: #66a8eb;
+    background-color: var(--q-btpljM);
+  }
+
+  .q-gXqRpG {
+    opacity: .45;
+  }
+
+  .q-bMGTxJ {
+    opacity: .75;
+  }
+
+  .q-cqCfxu {
+    -o-object-position: top;
+    object-position: top;
+  }
+
+  .q-boLblZ {
+    filter: blur(12px);
+  }
+
+  .q-hwlKiV {
+    background-color: #152229;
+    background-color: var(--q-ckoJkw);
+  }
+
   .q-fLVKVB {
     scrollbar-width: none;
   }
@@ -2965,6 +3031,10 @@
     height: 48px;
   }
 
+  .q-eRLSQw {
+    width: 48px;
+  }
+
   .q-iWjbPW {
     width: 24px;
   }
@@ -3010,6 +3080,10 @@
     height: 64px;
   }
 
+  .q-cCoqvZ {
+    max-width: 100%;
+  }
+
   .q-dxbJmu {
     min-height: 0;
   }
@@ -3018,14 +3092,52 @@
     width: auto;
   }
 
-  .q-cCoqvZ {
-    max-width: 100%;
-  }
-
   .q-jJlZBc {
     max-height: 100%;
   }
 
+  .q-niSFv {
+    border-bottom-left-radius: 0;
+  }
+
+  .q-gqcmcs {
+    border-bottom-right-radius: 0;
+  }
+
+  .q-hnYqHC {
+    max-height: calc(100% - 124px);
+  }
+
+  .q-dQsKWZ {
+    max-height: calc(100% - 172px);
+  }
+
+  .q-dQrOvv {
+    border-bottom-left-radius: 16px;
+    border-bottom-left-radius: var(--q-dxfumK);
+  }
+
+  .q-kZnTsk {
+    border-bottom-right-radius: 16px;
+    border-bottom-right-radius: var(--q-dxfumK);
+  }
+
+  .q-fSNeID {
+    border-top-left-radius: 0;
+  }
+
+  .q-lmIybk {
+    border-top-right-radius: 0;
+  }
+
+  .q-kEmBGl {
+    min-height: 124px;
+  }
+
+  .q-eeWvqi {
+    min-height: 172px;
+  }
+
   .q-ipiJSk {
     width: 8px;
   }
@@ -3520,6 +3632,41 @@
     border-top-left-radius: 4px;
   }
 
+  .q-cBlWNH {
+    min-height: 32px;
+  }
+
+  .q-kJvXpK {
+    padding-top: 12px;
+    padding-top: var(--q-cXTyBO);
+  }
+
+  .q-dlHacb {
+    top: 6px;
+  }
+
+  .q-iHDoAO {
+    top: -20px;
+  }
+
+  .q-bYDZOv {
+    width: calc(100% + 40px);
+  }
+
+  .q-jQmYcu {
+    height: calc(100% + 40px);
+  }
+
+  .q-lnCtVe {
+    right: 8px;
+    right: var(--q-cSaSxh);
+  }
+
+  .q-jgAsJt {
+    bottom: 8px;
+    bottom: var(--q-cSaSxh);
+  }
+
   .q-ilCorh {
     line-clamp: 1;
   }
@@ -3789,10 +3936,19 @@
     color: var(--q-ekJvRZ);
   }
 
+  .q-eHRSUh:empty {
+    display: none;
+  }
+
   .q-ldTxnm[data-active="true"] {
     background-color: #fffffff2;
   }
 
+  .q-hmyJss[data-active="true"] {
+    background-color: #0070d2;
+    background-color: var(--q-bebYds);
+  }
+
   .q-bEFJjx:disabled {
     opacity: .6;
   }
@@ -4487,6 +4643,12 @@
     background: #e6e9ec;
   }
 
+  .q-kEebOH:is(:hover, :focus-visible) [data-component-name="Button.StyledButton"] {
+    background: #fff linear-gradient(#0070d2e6, #0070d2e6);
+    background: linear-gradient(var(--q-bQGTFq),var(--q-bQGTFq)) #fff;
+    background: linear-gradient(var(--q-bQGTFq),var(--q-bQGTFq)) var(--q-button-hover-background-layer, #fff);
+  }
+
   .q-fRIQMO:focus-visible {
     outline: 2px solid #0070d2;
     outline: 2px solid var(--q-bebYds);
@@ -4549,6 +4711,11 @@
     outline: none;
   }
 
+  .q-hHgwIf:is(:hover, :focus-visible) [data-component-name="Button.StyledButton"] {
+    border-color: #0000;
+    border-color: var(--q-eBDiUw);
+  }
+
   .q-jtPCJn:has(select:focus-visible) {
     outline: 2px solid #0070d2;
     outline: 2px solid var(--q-bebYds);
@@ -4626,6 +4793,10 @@
     visibility: visible;
   }
 
+  .q-kELdYL:is(:hover, :focus-visible) [data-component-name="Button.StyledButton"] {
+    color: var(--q-kHrcNZ);
+  }
+
   .q-iayYaR:has(select:focus-visible) {
     outline-offset: -2px;
   }
@@ -4636,11 +4807,16 @@
     background: linear-gradient(var(--q-bQGTFq),var(--q-bQGTFq)) var(--q-button-hover-background-layer, #fff);
   }
 
+  .q-hnauCG:hover {
+    background: none;
+    background: var(--q-cWcXnW);
+  }
+
   .q-jjvLow:hover {
     background: #e6e9ec;
   }
 
-  .q-hKPjHd:hover, .q-ixOhNh:hover:not(:disabled) {
+  .q-ixOhNh:hover:not(:disabled), .q-hKPjHd:hover {
     background: #0000000f;
   }
 
@@ -4689,6 +4865,10 @@
     color: var(--q-kHrcNZ);
   }
 
+  .q-crUTNY:hover {
+    box-shadow: none;
+  }
+
   .q-MuFSQ:hover {
     color: var(--q-ckoJkw);
   }
@@ -4880,10 +5060,6 @@
       height: 100%;
     }
 
-    .q-gfNJoW {
-      height: 40%;
-    }
-
     .q-jMeGMD {
       height: 50%;
     }
@@ -4914,7 +5090,7 @@
       height: 24px;
     }
 
-    .q-cAmJVr > [part="multimodal"], .q-kSIGpb > [part="multimodal"] {
+    .q-kSIGpb > [part="multimodal"], .q-cAmJVr > [part="multimodal"] {
       padding: 0;
     }
 
@@ -4926,7 +5102,28 @@
       z-index: 1001;
     }
 
-    .q-cEUyLT > [part="toolbar"], .q-kxvSgE > [part="chat"], .q-kxvSgE > [part="input"], .q-kxvSgE > [part="privacy"] {
+    .q-kxvSgE > [part="chat"], .q-kxvSgE > [part="input"], .q-kxvSgE > [part="privacy"] {
+      display: none;
+    }
+
+    .q-iNDLkz > [part="artifact"] {
+      background-color: #00000080;
+    }
+
+    .q-isJuhH > [part="artifact"] {
+      -webkit-backdrop-filter: blur(2px);
+      backdrop-filter: blur(2px);
+    }
+
+    .q-cbBLhX > [part="artifact"] {
+      z-index: 2;
+    }
+
+    .q-gTaxHS > [part="multimodal"] {
+      z-index: 3;
+    }
+
+    .q-cEUyLT > [part="toolbar"] {
       display: none;
     }
 
@@ -5007,13 +5204,30 @@
       width: 100%;
     }
 
-    .q-kdQNtG > [part="artifact"] {
-      height: 60%;
+    .q-xjpwZ > [part="artifact"] {
+      height: 100%;
     }
 
     .q-gZeTFg > [part="artifact"] {
       height: 80%;
     }
+
+    .q-hSCbuw > [part="multimodal"] {
+      bottom: 24px;
+      bottom: calc(24px + var(--q-bottom-offset, 0px));
+    }
+
+    .q-iWYrFM > [part="multimodal"] {
+      right: 24px;
+    }
+
+    .q-gUeaVj > [part="multimodal"] {
+      width: fit-content;
+    }
+
+    .q-bEbKWC > [part="multimodal"] {
+      height: auto;
+    }
   }
 
   @container bookerPanel (width <= 720px) {
@@ -5178,7 +5392,7 @@
       transform: translateY(calc(-100% - 8px));
     }
 
-    .q-eQFZen > [data-chat-controls], .q-lgmAsb > [part="controls"] {
+    .q-lgmAsb > [part="controls"], .q-eQFZen > [data-chat-controls] {
       opacity: 1;
     }
 
@@ -5235,6 +5449,10 @@
     .q-iLwSqI {
       opacity: .14;
     }
+
+    .q-bfvFLs:hover {
+      transform: none;
+    }
   }
 }