cometchat-visual-builder-no-code 1.0.20-authtest52 → 1.0.20-authtest53

package/dist/src/sdkStyleMarker.d.ts

@@ -1,27 +1,64 @@
 /**
- * Monkeypatch document.createElement to auto-stamp all <style> elements
- * created after the CometChat bundle loads with a `data-cometchat-sdk` attribute.
+ * Marks every <style> element created/inserted after the CometChat bundle loads
+ * with a `data-cometchat-sdk` attribute.
  *
  * This MUST be imported as the very first import in the bundle entry point (index.tsx).
  *
- * How it works:
- * - Before the bundle loads, the host page may have already created <style> elements.
- *   Those won't have the marker.
- * - After this script runs, every new <style> element created via document.createElement
- *   will automatically get `data-cometchat-sdk="true"`.
- * - This covers: webpack style-loader injections, MUI/JSS runtime styles, CometChat Calls
- *   SDK styles (goober, .ccccn, .awssld), and any other SDK-created styles.
- * - Host page styles added dynamically AFTER the bundle loads will also get the marker,
- *   but that's acceptable because host pages rarely create <style> elements after load.
- *   The key insight: host styles that exist BEFORE the bundle loads are the ones that
- *   cause CSS conflicts, and those won't have the marker.
- *
- * The IframePortal then uses this marker to decide what to copy into the iframe:
- * - Has `data-cometchat-sdk` or `data-cometchat` → copy (SDK/widget style)
- * - Doesn't have either → block (host page style)
+ * Why the marker exists:
+ * - Before the bundle loads, the host page may already have <style> elements.
+ *   Those must NOT be marked — they are host styles and cause CSS conflicts.
+ * - Everything marked after that point is treated as ours: webpack style-loader
+ *   injections, MUI/JSS runtime styles, CometChat Calls SDK styles (goober, .ccccn,
+ *   .awssld), and any other runtime styles.
+ *
+ * IframePortal uses this marker to decide what to copy into the iframe:
+ * - Has `data-cometchat-sdk` or `data-cometchat` -> copy (SDK/widget style)
+ * - Has neither -> block (host page style)
+ *
+ * Two strategies, in order of preference:
+ *
+ * 1. Monkeypatch `document.createElement`, marking at creation time. This is the
+ *    primary path and leaves behaviour byte-identical on hosts that permit it.
+ *
+ * 2. MutationObserver fallback, marking at insertion time. Required because some
+ *    hosts harden the document and make `createElement` non-writable and
+ *    non-configurable:
+ *
+ *      Object.getOwnPropertyDescriptor(document, "createElement")
+ *        -> { writable: false, configurable: false }
+ *
+ *    The assignment then throws in strict mode and, before this fallback existed,
+ *    took the whole bundle down with it, so the widget never initialised at all.
+ *
+ * KNOWN TRADE-OFF (fallback path only)
+ * The fallback is NOT equivalent to the monkeypatch — it is strictly more
+ * permissive. The patch only observed `document.createElement`, whereas the
+ * observer also catches innerHTML/insertAdjacentHTML, cloned and adopted nodes,
+ * and <style> nested inside inserted subtrees. Host styles injected at runtime
+ * therefore get marked and copied into the iframe, weakening the isolation
+ * guarantee in `design.md` Property 3 / Req 1.4 on these hosts.
+ *
+ * This is an accepted trade-off, not an oversight: the marking is purely
+ * time-based, so there is no reliable way to tell a host's runtime <style> from
+ * ours. The original monkeypatch already had a narrower version of this hole
+ * (host styles created via createElement after load were marked too — see the
+ * note in the original implementation). Losing isolation on some runtime styles
+ * is preferable to the widget not rendering at all.
+ *
+ * KNOWN GAP: the strategy is chosen once, at module evaluation. A host that
+ * hardens or re-wraps `createElement` afterwards silently disables marking with
+ * no fallback armed.
+ */
+/**
+ * Synchronously apply any marks the observer has queued but not yet delivered.
+ *
+ * MutationObserver callbacks are microtasks, so a <style> inserted earlier in
+ * the same task is still unmarked when a synchronous reader looks at the DOM.
+ * IframePortal does exactly that: it sweeps `document.querySelectorAll("style")`
+ * once, synchronously, and registers its own observer only afterwards — so a
+ * style missed by that sweep is blocked permanently, because nothing re-reads it.
+ *
+ * Callers that synchronously read style marks must call this first. It is a
+ * no-op on the monkeypatch path, where marking already happened at creation.
  */
-declare const _origCreateElement: {
-    <K extends keyof HTMLElementTagNameMap>(tagName: K, options?: ElementCreationOptions | undefined): HTMLElementTagNameMap[K];
-    <K_1 extends keyof HTMLElementDeprecatedTagNameMap>(tagName: K_1, options?: ElementCreationOptions | undefined): HTMLElementDeprecatedTagNameMap[K_1];
-    (tagName: string, options?: ElementCreationOptions | undefined): HTMLElement;
-};
+export declare function flushStyleMarks(): void;

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "cometchat-visual-builder-no-code",
-  "version": "1.0.20-authtest52",
+  "version": "1.0.20-authtest53",
   "description": "CometChat Widget Builder No-Code Integration",
   "cometChatCustomConfig": {
-    "prodVersion": "1.0.34",
-    "devStagingVersion": "1.0.20-authtest51",
+    "prodVersion": "1.0.36",
+    "devStagingVersion": "1.0.20-authtest49",
     "prodName": "@cometchat/chat-embed",
     "devName": "cometchat-visual-builder-no-code",
     "name": "cometchat-visual-builder-react-no-code",
-    "version": "1.0.34",
+    "version": "1.0.36",
     "production": true
   },
   "author": "CometChat",