@qualified-salesforce/web 0.0.1-oidc-bootstrap

package/packs/widget/esm/index.js

@@ -0,0 +1,183 @@
+import "../../../widget/multimodal_v2/index.split-css.panda.js";
+import "../../../widget/widget.split-css.js";
+import "../../../widget/multimodal_v2/host.split-css.js";
+import { default as LinkedWidgetV2 } from "../../../widget/widget/linked_widget_v2.js";
+import { Sentry } from "../../../widget/widget/sentry.js";
+import { widgetBootstrap } from "../../../widget/widget_bootstrap.js";
+import { _extends } from "../../../js/4101.js";
+
+
+/**
+ * Public entry point for the unbundled ESM npm package.
+ *
+ * The npm packaging of the *same source* the self-hosted zip ships, differing in one respect that
+ * matters to a consumer: **nothing runs at import time.** The classic entry
+ * (`packs/widget/self-hosted-v2-only/qualified.js`) sets `window.__qualifiedSplitCss`, calls
+ * `Sentry.init()` and `widgetBootstrap.startSlowTimeout()` at module scope; this one performs the
+ * same three inside `setup()`, so the consumer decides when and with which credential Qualified
+ * starts.
+ *
+ * This is source the zip build can consume, not a third parallel build:
+ * `WidgetStablePackageController#render_bootstrapped_js` already emits a thin wrapper whose steps
+ * each map onto a `setup()` option below, so cutting the zip over to this is a wrapper change, not
+ * a rewrite.
+ */ // CSS imports — extracted to a paired CSS artifact by rsbuild, exactly as the zip entry does.
+// The consumer loads the stylesheet as a <link>; runtime style injection is incompatible with
+// a strict CSP.
+
+
+
+
+
+
+/** Those URLs, or null in any build that is not the npm packaging (the hosted widget, Jest). */ function packagedAssetUrls() {
+    if (false) {}
+    return _extends({
+        stylesheet: new URL("./qualified.css", import.meta.url).href
+    }, typeof __QUALIFIED_ESM_CALL_MACHINE_URL__ === "undefined" ? {} : {
+        callMachine: __QUALIFIED_ESM_CALL_MACHINE_URL__
+    });
+}
+let bootPromise = null;
+/**
+ * Adds the widget stylesheet to the document as a non-render-blocking preload that flips to a
+ * live stylesheet once it loads.
+ *
+ * `data-q-stylesheet` is load-bearing and is also the dedupe key. In split-CSS mode — which
+ * `setup()` turns on — the widget mirrors document stylesheets into its shadow root by querying
+ * exactly `link[rel="stylesheet"][data-q-stylesheet]` (`multimodal.ts:559-561`, and again in
+ * `inline_meeting_booker.ts:183`). Shadow DOM does not inherit document styles, so without the
+ * attribute the mirror loop matches nothing and the widget renders **completely unstyled**.
+ * The self-hosted zip's README calls it out for the same reason.
+ *
+ * Injected as `rel="preload"` (`as="style"`) so it does not block first paint, then flipped to
+ * `rel="stylesheet"` on load so the browser applies it — which is also what makes the mirror
+ * query match it.
+ */ function injectStylesheet(href) {
+    if (document.querySelector("link[data-q-stylesheet]")) return;
+    const link = document.createElement("link");
+    link.rel = "preload";
+    link.as = "style";
+    link.href = href;
+    link.setAttribute("data-q-stylesheet", "");
+    link.addEventListener("load", ()=>{
+        link.rel = "stylesheet";
+    }, {
+        once: true
+    });
+    document.head.appendChild(link);
+}
+/**
+ * Fetches the widget's runtime configuration from the CORS-enabled JSON endpoint (QAI-5700).
+ *
+ * D2 Option A: the package takes a credential and fetches the rest at runtime, so one artifact
+ * serves every environment. This replaces the POC-era stopgap that scraped the server-rendered
+ * snippet — a consumer cannot `fetch()` that route cross-origin at all, and its one-byte,
+ * HTTP-200 answer for a bad token failed open. The endpoint answers non-2xx for a bad token, so
+ * an unusable credential fails loudly here rather than booting a broken widget.
+ *
+ * Exported so the fetch and its failure modes are testable without booting the widget; declaring
+ * a plain function runs nothing at import time, so "nothing runs on import" still holds.
+ */ async function fetchRuntimeConfig(options) {
+    var _globalThis_location;
+    const url = options.runtimeConfigUrl ? new URL(options.runtimeConfigUrl, (_globalThis_location = globalThis.location) == null ? void 0 : _globalThis_location.href).href : options.host + "/w/1/" + encodeURIComponent(options.token) + "/runtime_config";
+    const response = await fetch(url, {
+        credentials: "omit"
+    });
+    if (!response.ok) {
+        throw new Error("Qualified setup(): runtime config fetch failed with HTTP " + response.status + " from " + url + ". " + "The widget will not boot. Check the `token` and that the endpoint is reachable and " + "CORS-enabled for this origin.");
+    }
+    const payload = await response.json();
+    if (!payload || typeof payload !== "object" || !payload.config) {
+        throw new Error("Qualified setup(): the runtime config at " + url + " carried no `config`. Refusing to boot a " + "widget from an incomplete configuration rather than fall back to a scraped default.");
+    }
+    return payload;
+}
+/**
+ * Boots Qualified from the consumer's own bundle. Nothing runs until this is called.
+ *
+ * The order below is load-bearing: the globals must all be assigned before any call object is
+ * created — `call_store.ts` gates the sibling call-machine path on `__qualifiedSplitCss`, and
+ * reads both `__qualifiedCallMachineUrl` and (via `stable_bundle_src.ts`)
+ * `__qualifiedBundleBaseUrl` on demand precisely so these assignments are not too late. The
+ * team-specific Sentry proxy URL is derived by the widget itself during init
+ * (`widget.ts` → `resourceUrl("sentry/proxy")`), so it needs no `setup()` option.
+ *
+ * Returns the `q(...)` command function — the same interface a CDN consumer gets, so `teardown`,
+ * `identify` and the rest are called as `qualified("teardown")` rather than through a
+ * package-specific wrapper.
+ */ async function setup(options) {
+    if (!(options == null ? void 0 : options.token)) {
+        throw new Error("Qualified setup(): `token` is required.");
+    }
+    if (bootPromise) return bootPromise;
+    const promise = (async ()=>{
+        var _options_apiHost, _options_environment;
+        var _globalThis_location, _options_environment1;
+        // npm-native telemetry origin (QAI-5770). Our code is inlined into the consumer's
+        // content-hashed chunk, so `script_time_to_start_ms` has no `qualified.js` resource entry to
+        // time from; this stands in for it. Written at runtime inside setup() (never at import time),
+        // so it honours the package's import-purity contract. Its presence also marks an npm consumer
+        // for `widgetConsumer()`.
+        window._q_setupCalledAt = performance.now();
+        // Where the two companion assets are. Two independent sources, and `packageBase` wins because
+        // it is explicit consumer intent — and because it is the only form that keeps the stylesheet
+        // beside its fonts (see `packageBase` above).
+        const packaged = packagedAssetUrls();
+        const explicitBase = options.packageBase ? new URL(options.packageBase, (_globalThis_location = globalThis.location) == null ? void 0 : _globalThis_location.href).href : null;
+        const stylesheetUrl = explicitBase ? new URL("qualified.css", explicitBase).href : packaged == null ? void 0 : packaged.stylesheet;
+        if (!stylesheetUrl) {
+            throw new Error("Qualified setup(): could not resolve where the package's own assets are served " + "from, and refuses to guess. Pass `packageBase`.");
+        }
+        const host = (_options_apiHost = options.apiHost) != null ? _options_apiHost : (_options_environment1 = options.environment) == null ? void 0 : _options_environment1.host;
+        if (!host && !options.runtimeConfigUrl) {
+            throw new Error("Qualified setup(): `apiHost` or `environment.host` is required.");
+        }
+        // Fetch the runtime config before anything boots. A failure here — bad credential,
+        // unreachable host, CORS not granted — must reject rather than leave a half-initialised
+        // widget behind, so this precedes every side effect below.
+        const runtime = await fetchRuntimeConfig({
+            host,
+            token: options.token,
+            runtimeConfigUrl: options.runtimeConfigUrl
+        });
+        // The consumer's pinned environment wins; otherwise take what the endpoint served. Fail loud
+        // if neither yields a host, rather than start the widget against nothing.
+        const environment = (_options_environment = options.environment) != null ? _options_environment : runtime.environment;
+        if (!(environment == null ? void 0 : environment.host)) {
+            throw new Error("Qualified setup(): the runtime config carried no `environment`, and none was passed. " + "The widget will not boot.");
+        }
+        // The classic entry's import-time side effects, performed here instead.
+        // The base `call_store.ts` resolves the call machine against when it has nothing better — a
+        // filename appended to a directory. That works for a tarball served as laid out, but not when
+        // a bundler re-emitted the asset under a content-hashed name, so the exact URL is passed
+        // separately and wins there. Trimming to the last "/" keeps the base truthful; it's a string
+        // op precisely so no bundler tries to resolve it.
+        globalThis.__qualifiedBundleBaseUrl = explicitBase != null ? explicitBase : stylesheetUrl.replace(/[^/]*(?:[?#].*)?$/, "");
+        // Only advertise a call-machine URL when the build actually shipped one. A text-only package
+        // ships none, so this stays unset and `call_store.ts` throws rather than fetching a remote
+        // bundle — the enforceable half of "voice cannot activate in this package shape".
+        if (!explicitBase && (packaged == null ? void 0 : packaged.callMachine)) {
+            globalThis.__qualifiedCallMachineUrl = packaged.callMachine;
+        }
+        window.__qualifiedSplitCss = true;
+        Sentry.init();
+        widgetBootstrap.startSlowTimeout();
+        // Preloaded without blocking first paint; it flips to a live stylesheet on load. Not awaited
+        // — the widget's own shadow-root mirror picks it up once applied.
+        injectStylesheet(stylesheetUrl);
+        const qualified = LinkedWidgetV2.start(environment);
+        qualified("initialize", options.token, runtime.config);
+        return qualified;
+    })();
+    // A rejected boot must not stay cached: a transient failure (a network blip during the config
+    // fetch, say) would otherwise be handed back to every later `setup()` call until a full page
+    // reload. Clear it so a retry re-runs the boot.
+    bootPromise = promise;
+    promise.catch(()=>{
+        if (bootPromise === promise) bootPromise = null;
+    });
+    return promise;
+}
+
+export { fetchRuntimeConfig, setup };