@xapp/chat-widget 1.105.5 → 1.105.6

package/dist/index.js

@@ -4177,6 +4177,85 @@ function isTransportFailure(error) {
     return !(Number.isFinite(status) && status >= 100 && status <= 599);
 }
 
+/**
+ * Rate limiting, as agent-server reports it.
+ *
+ * On 2026-10-07 the XAPP API's WAF rate-limited agent-server and every chat failed. The widget told
+ * visitors the chat was offline and to check their connection, and retried each message twice more —
+ * adding load to the thing that was already over its limit. Rate limiting is the server answering:
+ * it is not offline, an immediate retry will not help, and the visitor should be told what is going on.
+ *
+ * agent-server signals it two ways:
+ * - before the stream: HTTP 429, `Retry-After`, body `{ error, code: "RATE_LIMITED", retryAfter }`
+ * - after the stream starts: SSE `error` event `{ error, code: "RATE_LIMITED", retryAfter }`
+ */
+var RATE_LIMITED_CODE = "RATE_LIMITED";
+var RATE_LIMITED_STATUS = 429;
+/** Shown when the server did not send a message of its own (e.g. a bare 429 from a WAF). */
+var RATE_LIMITED_FALLBACK_MESSAGE = "We're getting more requests than usual right now. Please try again in a few minutes.";
+function isRateLimitError(error) {
+    return (error === null || error === void 0 ? void 0 : error.code) === RATE_LIMITED_CODE;
+}
+function createRateLimitError(serverMessage, retryAfter) {
+    var message = serverMessage || RATE_LIMITED_FALLBACK_MESSAGE;
+    var error = new Error(message);
+    error.statusCode = RATE_LIMITED_STATUS;
+    error.code = RATE_LIMITED_CODE;
+    if (retryAfter !== undefined) {
+        error.retryAfter = retryAfter;
+    }
+    if (serverMessage) {
+        error.serverMessage = serverMessage;
+    }
+    return error;
+}
+/** Seconds from a `retryAfter` body field or a `Retry-After` header. HTTP-date values are ignored. */
+function parseRetryAfter(value) {
+    if (value === null || value === undefined || value === "") {
+        return undefined;
+    }
+    var seconds = Number(value);
+    return Number.isFinite(seconds) && seconds >= 0 ? seconds : undefined;
+}
+/**
+ * Builds the error for a 429 response, reading the agent-server JSON body when there is one. The body
+ * is optional: a 429 from a WAF or proxy in front of agent-server will not carry it.
+ */
+function rateLimitErrorFromResponse(response) {
+    return __awaiter$1(this, void 0, void 0, function () {
+        var body, text, _a, parsed, serverMessage, retryAfter;
+        var _c, _d;
+        return __generator$1(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    _e.trys.push([0, 4, , 5]);
+                    if (!response.text) return [3 /*break*/, 2];
+                    return [4 /*yield*/, response.text()];
+                case 1:
+                    _a = _e.sent();
+                    return [3 /*break*/, 3];
+                case 2:
+                    _a = "";
+                    _e.label = 3;
+                case 3:
+                    text = _a;
+                    parsed = text ? JSON.parse(text) : undefined;
+                    if (parsed && typeof parsed === "object") {
+                        body = parsed;
+                    }
+                    return [3 /*break*/, 5];
+                case 4:
+                    _e.sent();
+                    return [3 /*break*/, 5];
+                case 5:
+                    serverMessage = typeof (body === null || body === void 0 ? void 0 : body.error) === "string" && body.error.trim() ? body.error : undefined;
+                    retryAfter = (_c = parseRetryAfter(body === null || body === void 0 ? void 0 : body.retryAfter)) !== null && _c !== void 0 ? _c : parseRetryAfter((_d = response.headers) === null || _d === void 0 ? void 0 : _d.get("Retry-After"));
+                    return [2 /*return*/, createRateLimitError(serverMessage, retryAfter)];
+            }
+        });
+    });
+}
+
 /**
  * Default configuration messages
  * @returns
@@ -4575,6 +4654,13 @@ var MCPChat = /** @class */ (function () {
                     case 3:
                         error_1 = _a.sent();
                         err("Failed to validate session: ".concat(error_1));
+                        if (isRateLimitError(error_1)) {
+                            // Starting a new session would be a second request into the same limit, and would
+                            // throw away a session that is still good. Keep it and tell the visitor.
+                            this.stopTyping();
+                            this.sendFailureMessage(0, 0, this.getErrorMessage(error_1, RATE_LIMITED_STATUS));
+                            return [2 /*return*/];
+                        }
                         // If validation fails (network error, etc.), clear session and start fresh
                         clearStoredSession(this._sessionId);
                         this._sessionId = "";
@@ -4801,6 +4887,13 @@ var MCPChat = /** @class */ (function () {
      * Determines a user-friendly error message based on the error type.
      */
     MCPChat.prototype.getErrorMessage = function (error, statusCode) {
+        // Rate limited: the server's own message when it sent one
+        if (isRateLimitError(error)) {
+            return error.serverMessage || RATE_LIMITED_FALLBACK_MESSAGE;
+        }
+        if (statusCode === RATE_LIMITED_STATUS) {
+            return RATE_LIMITED_FALLBACK_MESSAGE;
+        }
         // Auth errors
         if (statusCode === 401) {
             return "Authentication failed. Please check your credentials.";
@@ -5300,16 +5393,26 @@ var MCPChat = /** @class */ (function () {
                             onopen: function (response) { return __awaiter$1(_this, void 0, void 0, function () {
                                 var error;
                                 return __generator$1(this, function (_a) {
-                                    httpStatusCode = response.status;
-                                    if (!response.ok) {
-                                        error = new Error("HTTP error! status: ".concat(response.status));
-                                        error.statusCode = response.status;
-                                        throw error;
+                                    switch (_a.label) {
+                                        case 0:
+                                            httpStatusCode = response.status;
+                                            if (!(response.status === RATE_LIMITED_STATUS)) return [3 /*break*/, 2];
+                                            return [4 /*yield*/, rateLimitErrorFromResponse(response)];
+                                        case 1: 
+                                        // Rate limited: carry the server's message and Retry-After. Not retried (4xx)
+                                        // and not offline (it has a status code) -- see rateLimit.ts.
+                                        throw _a.sent();
+                                        case 2:
+                                            if (!response.ok) {
+                                                error = new Error("HTTP error! status: ".concat(response.status));
+                                                error.statusCode = response.status;
+                                                throw error;
+                                            }
+                                            log("SSE connection opened");
+                                            // Connection successful - ensure we're marked as online
+                                            this.setConnectionStatus("online");
+                                            return [2 /*return*/];
                                     }
-                                    log("SSE connection opened");
-                                    // Connection successful - ensure we're marked as online
-                                    this.setConnectionStatus("online");
-                                    return [2 /*return*/];
                                 });
                             }); },
                             onmessage: function (event) {
@@ -5586,6 +5689,12 @@ var MCPChat = /** @class */ (function () {
                                         _this.stopTyping();
                                         _this.stopStreamThrottle();
                                         err("SSE error: ".concat(data.error));
+                                        if (data.code === RATE_LIMITED_CODE) {
+                                            // Carries statusCode 429, so postMessage neither retries it nor
+                                            // marks the connection offline.
+                                            reject(createRateLimitError(data.error, parseRetryAfter(data.retryAfter)));
+                                            break;
+                                        }
                                         // Server-side errors should not retry - reject immediately with the error
                                         reject(new Error(data.error || "Server error during processing"));
                                         break;