{"version":3,"sources":["../../orbit-errors/src/index.ts","../src/api-client.ts","../src/event-stream.ts","../src/styles.ts","../src/storage.ts","../src/icons.ts","../src/orbit-chat.ts","../src/softphone.ts","../src/voice-agent/index.ts","../src/salesforce-opencti-adapter.ts","../src/cdp-analytics.ts","../src/web-analytics.ts","../src/cdp-analytics-queue.ts"],"sourcesContent":["/**\n * Canonical, zero-dependency error types for the Orbit *client* SDKs.\n *\n * `OrbitApiError` was previously declared byte-for-byte in BOTH the web SDK\n * (`@devotel/orbit-web-sdk`) and the React-Native SDK\n * (`@devotel/orbit-react-native-sdk`). Because the two packages share no common\n * dependency there was no forcing function to keep the shapes in sync, so the\n * duplicate definitions were free to drift apart over time (dead-code finding\n * act_mqyty69u_be459d45bba7). This package is the single source of truth both\n * SDKs now re-export.\n *\n * It is intentionally dependency-free and runtime-agnostic (only `Error`,\n * `number`, and `string`): the consuming SDKs are tsup-bundled, so this source\n * is inlined into their `dist` output and their published artifacts stay\n * zero-dependency and browser/Hermes-safe — exactly the constraint that ruled\n * out importing the Node-flavoured `@devotel/shared/errors`.\n *\n * NOTE: the Node SDK (`@devotel/orbit-sdk`) and the CLI (`@devotel/cli`) keep\n * their own richer `OrbitApiError` (a `code`/`details`/`docsUrl`/`requestId`\n * field set plus a status-coded subclass hierarchy). They are `tsc`-built\n * published packages with an incompatible constructor signature, so folding\n * them in here would be a breaking, multi-package change rather than this safe\n * dead-duplicate removal.\n */\n\n/**\n * Typed error thrown by the Orbit client SDKs when an HTTP request to the\n * conversations API returns a non-OK response. Callers can branch reliably on\n * `status` (e.g. a 429 throttle vs a 401 token expiry vs a 5xx) instead of\n * regex-parsing a free-text message.\n *\n * - `status` is the literal HTTP status code.\n * - `responseExcerpt` is the (truncated) response body, kept for diagnostics.\n * - `retryAfterSeconds` is parsed from the `Retry-After` header when present\n * (RFC 7231 delta-seconds or HTTP-date), so a UI can render a live\n * countdown / disable the offending action for the throttle window.\n */\nexport class OrbitApiError extends Error {\n readonly status: number;\n readonly responseExcerpt: string;\n // `declare` keeps this type-only so no class-field initializer is emitted\n // (target ES2024 => useDefineForClassFields). That way the property is a\n // genuine own-property ONLY when the constructor assigns it, so callers can\n // rely on `\"retryAfterSeconds\" in err` to detect a parsed `Retry-After`.\n declare readonly retryAfterSeconds?: number;\n constructor(\n status: number,\n responseExcerpt: string,\n message: string,\n retryAfterSeconds?: number,\n ) {\n super(message);\n this.name = \"OrbitApiError\";\n this.status = status;\n this.responseExcerpt = responseExcerpt;\n if (retryAfterSeconds !== undefined) {\n this.retryAfterSeconds = retryAfterSeconds;\n }\n }\n}\n","import { OrbitApiError } from \"@devotel/orbit-errors\";\nimport type {\n ChatMessage,\n ApiListResponse,\n ApiResponse,\n Conversation,\n} from \"./types\";\n\n/**\n * SCAN sdk-web-edge-02 — typed error so OrbitChat (and any other legacy\n * ApiClient consumer) can branch reliably on the HTTP status instead of\n * regex-parsing a free-text message. Before this, every non-OK response\n * threw a bare `new Error(\"Orbit API error 429: …\")`, so a 429 throttle,\n * a 401 token expiry, and a 500 were all indistinguishable to the UI.\n *\n * The class itself now lives once in the zero-dependency\n * `@devotel/orbit-errors` package and is re-exported here so existing\n * consumers keep importing `OrbitApiError` from this module. Previously it\n * was redefined byte-for-byte in both this SDK and the React-Native SDK with\n * no forcing function to keep them in sync (dead-code finding\n * act_mqyty69u_be459d45bba7). tsup bundles the shared source inline, so the\n * published web bundle stays zero-dependency and browser-safe — the same\n * constraint that ruled out importing the Node-flavoured\n * `@devotel/shared/errors`.\n */\nexport { OrbitApiError };\n\n/**\n * Parse a `Retry-After` header into delta-seconds. Per RFC 7231 the value\n * is either an integer number of seconds or an HTTP-date; we accept both\n * and ignore anything non-positive or unparseable. Returns `undefined`\n * when the header is absent or invalid so callers can fall back cleanly.\n */\nfunction parseRetryAfterSeconds(\n headerValue: string | null,\n): number | undefined {\n if (!headerValue) return undefined;\n const asNumber = Number(headerValue);\n if (Number.isFinite(asNumber) && asNumber > 0) {\n return Math.ceil(asNumber);\n }\n const asDate = Date.parse(headerValue);\n if (Number.isFinite(asDate)) {\n const diffMs = asDate - Date.now();\n if (diffMs > 0) return Math.ceil(diffMs / 1000);\n }\n return undefined;\n}\n\n/**\n * Lightweight HTTP client for the Orbit conversations API.\n * Handles authentication, conversation lifecycle, and message exchange.\n */\nexport class ApiClient {\n private baseUrl: string;\n private apiKey: string;\n private conversationId: string | null = null;\n\n constructor(baseUrl: string, apiKey: string) {\n this.baseUrl = baseUrl.replace(/\\/+$/, \"\");\n this.apiKey = apiKey;\n }\n\n /** Returns the active conversation ID (if any). */\n getConversationId(): string | null {\n return this.conversationId;\n }\n\n /** Sets the active conversation ID (restored from storage). */\n setConversationId(id: string): void {\n this.conversationId = id;\n }\n\n /**\n * Create a new chat conversation via the widget endpoint.\n * Falls back to finding an existing open conversation for the visitor.\n */\n async createConversation(\n visitorId?: string,\n metadata?: Record,\n ): Promise {\n const payload: Record = {\n channel: \"web_chat\",\n metadata: {\n ...metadata,\n source: \"orbit-chat-widget\",\n visitor_id: visitorId ?? this.generateVisitorId(),\n user_agent: typeof navigator !== \"undefined\" ? navigator.userAgent : \"\",\n page_url: typeof location !== \"undefined\" ? location.href : \"\",\n },\n };\n\n const resp = await this.request>(\n \"POST\",\n \"/conversations\",\n payload,\n );\n this.conversationId = resp.data.id;\n return resp.data;\n }\n\n /**\n * List conversations for the current visitor.\n * The API filters by the API key's tenant.\n */\n async listConversations(status?: string): Promise {\n const params = new URLSearchParams();\n if (status) params.set(\"status\", status);\n params.set(\"channel\", \"web_chat\");\n params.set(\"limit\", \"1\");\n\n const resp = await this.request>(\n \"GET\",\n `/conversations?${params.toString()}`,\n );\n return resp.data;\n }\n\n /** Fetch messages for the current conversation. */\n async getMessages(limit = 50): Promise {\n if (!this.conversationId) return [];\n\n const resp = await this.request>(\n \"GET\",\n `/conversations/${this.conversationId}/messages?limit=${limit}`,\n );\n // API returns newest-first; reverse for chronological display\n return resp.data.reverse();\n }\n\n /** Send a text message in the current conversation. */\n async sendMessage(body: string): Promise {\n if (!this.conversationId) {\n throw new Error(\n \"No active conversation. Call createConversation() first.\",\n );\n }\n\n const resp = await this.request>(\n \"POST\",\n `/conversations/${this.conversationId}/reply`,\n { body },\n );\n return resp.data;\n }\n\n /** Upload a file attachment and send it as a message. */\n async sendAttachment(file: File): Promise {\n if (!this.conversationId) {\n throw new Error(\n \"No active conversation. Call createConversation() first.\",\n );\n }\n\n // First upload the file\n const formData = new FormData();\n formData.append(\"file\", file);\n formData.append(\"conversation_id\", this.conversationId);\n\n const uploadResp = await this.uploadFile(formData);\n const uploadData = uploadResp[\"data\"] as\n | Record\n | undefined;\n const mediaUrl = (uploadResp[\"url\"] ?? uploadData?.[\"url\"]) as\n | string\n | undefined;\n\n // Then send a message referencing the uploaded file\n const resp = await this.request>(\n \"POST\",\n `/conversations/${this.conversationId}/reply`,\n {\n body: file.name,\n media_url: mediaUrl,\n metadata: {\n file_name: file.name,\n file_type: file.type,\n file_size: String(file.size),\n },\n },\n );\n return resp.data;\n }\n\n /** Returns the configured widget API key (used by EventStream for header auth on polling fallback). */\n getApiKey(): string {\n return this.apiKey;\n }\n\n /**\n * Audit #SDK-004 — Server-backed session exchange. Swaps the long-\n * lived widget public key (`dv_live_pk_…`) for a short-lived event-\n * stream token. The widget calls this before opening SSE so the\n * long-lived key NEVER appears on the SSE URL (and therefore never\n * lands in CDN / proxy / browser-history logs).\n *\n * Returns null when the server doesn't implement `/events/session`\n * so the EventStream can fall back to the polling transport (which\n * uses `X-API-Key` on a header, not the URL).\n */\n async exchangeEventStreamToken(): Promise {\n try {\n const resp = await this.request<\n { data?: { token?: string } } | { token?: string }\n >(\"POST\", \"/events/session\");\n const tok =\n (resp as { data?: { token?: string } }).data?.token ??\n (resp as { token?: string }).token;\n return tok ?? null;\n } catch {\n return null;\n }\n }\n\n /** Generic JSON request helper with a 30-second safety timeout. */\n private async request(\n method: string,\n path: string,\n body?: unknown,\n ): Promise {\n const url = `${this.baseUrl}${path}`;\n const headers: Record = {\n \"X-API-Key\": this.apiKey,\n Accept: \"application/json\",\n };\n if (body) headers[\"Content-Type\"] = \"application/json\";\n\n const resp = await fetch(url, {\n method,\n headers,\n body: body ? JSON.stringify(body) : undefined,\n // Without this, a hung server keeps the widget spinner forever;\n // 30s covers legit slow routes without leaving requests dangling.\n signal: AbortSignal.timeout(30_000),\n });\n\n if (!resp.ok) {\n const errorText = await resp.text().catch(() => \"Unknown error\");\n // Preserve the legacy message format for backward compat, but throw a\n // typed OrbitApiError carrying status + Retry-After so callers can\n // branch on a 429 throttle vs a 401 expiry vs a 500.\n throw new OrbitApiError(\n resp.status,\n errorText.slice(0, 200),\n `Orbit API error ${resp.status}: ${errorText}`,\n parseRetryAfterSeconds(resp.headers.get(\"Retry-After\")),\n );\n }\n\n return resp.json() as Promise;\n }\n\n /** Upload file via multipart form. 60-second timeout for larger uploads. */\n private async uploadFile(\n formData: FormData,\n ): Promise> {\n const url = `${this.baseUrl}/files`;\n const resp = await fetch(url, {\n method: \"POST\",\n headers: {\n \"X-API-Key\": this.apiKey,\n },\n body: formData,\n signal: AbortSignal.timeout(60_000),\n });\n\n if (!resp.ok) {\n const errorText = await resp.text().catch(() => \"Unknown error\");\n throw new OrbitApiError(\n resp.status,\n errorText.slice(0, 200),\n `File upload failed: ${resp.status}`,\n parseRetryAfterSeconds(resp.headers.get(\"Retry-After\")),\n );\n }\n\n return resp.json() as Promise>;\n }\n\n /**\n * Generate a random visitor ID for anonymous users. Uses\n * `crypto.getRandomValues` so the id is unguessable — a predictable\n * `Math.random()`-derived id would let one visitor enumerate other\n * visitor sessions for the same widget. Browser support is universal\n * on every target we ship to (Chrome/Firefox/Safari/Edge — IE is not\n * supported by sdk-web).\n */\n private generateVisitorId(): string {\n const bytes = new Uint8Array(8);\n crypto.getRandomValues(bytes);\n let id = \"vis_\";\n for (const b of bytes) {\n id += b.toString(16).padStart(2, \"0\");\n }\n return id;\n }\n}\n","/**\n * Real-time event stream via Server-Sent Events (SSE).\n * Connects to the Orbit /events/stream endpoint and dispatches\n * typed events to registered listeners.\n *\n * Falls back to polling when SSE is unavailable.\n *\n * Audit #SDK-004 — On `connect()`, the stream first POSTs to the API to\n * swap the long-lived widget API key for a short-lived stream token,\n * then opens SSE with `?token=`. The long-lived API key\n * never appears on the SSE URL (and therefore never lands in CDN /\n * proxy / browser-history logs). If the swap endpoint returns null\n * (older API server), the stream falls back to polling — we no longer\n * silently accept a long-lived `?token=` on the SSE URL.\n */\n\nimport type { ApiClient } from \"./api-client\";\n\ntype EventHandler = (data: Record) => void;\n\nexport class EventStream {\n private baseSseUrl: string;\n private eventSource: EventSource | null = null;\n private listeners = new Map>();\n private reconnectAttempts = 0;\n private maxReconnectAttempts = 10;\n private reconnectTimer: ReturnType | null = null;\n private connected = false;\n private apiClient: ApiClient;\n\n /** Polling fallback state. */\n private pollingTimer: ReturnType | null = null;\n private usePolling = false;\n private pollUrl: string;\n private pollHeaders: Record;\n private lastPollTimestamp: string | null = null;\n\n constructor(sseBaseUrl: string, pollBaseUrl: string, apiClient: ApiClient) {\n // The SSE base URL is constructed without any `?token=` shortcut —\n // a short-lived token is appended later via `connectSSEWithSwap()`.\n this.baseSseUrl = `${pollBaseUrl}/events/stream`;\n this.pollUrl = `${pollBaseUrl}/events`;\n this.apiClient = apiClient;\n this.pollHeaders = {\n \"X-API-Key\": apiClient.getApiKey(),\n Accept: \"application/json\",\n };\n }\n\n /**\n * Start the event stream. Tries SSE first (after swapping the long-\n * lived widget key for a short-lived token), falls back to polling.\n */\n connect(): void {\n if (typeof EventSource !== \"undefined\") {\n void this.connectSSEWithSwap();\n } else {\n this.startPolling();\n }\n }\n\n /**\n * Audit #SDK-004 — swap the widget's long-lived API key for a short-\n * lived stream token before opening SSE. The short-lived token is OK\n * to put on the URL because it expires quickly + is scoped to the\n * visitor session. If the server doesn't implement the swap, fall\n * back to polling — the long-lived key never lands in URL logs.\n */\n private async connectSSEWithSwap(): Promise {\n let shortLived: string | null = null;\n try {\n shortLived = await this.apiClient.exchangeEventStreamToken();\n } catch {\n shortLived = null;\n }\n if (!shortLived) {\n // Server doesn't expose the swap endpoint or it failed. Fall back\n // to the polling transport (which uses `X-API-Key` on a header,\n // not a URL token). We deliberately do NOT fall back to long-lived\n // `?token=` SSE — that's the leak we're fixing.\n this.startPolling();\n return;\n }\n this.connectSSE(\n `${this.baseSseUrl}?token=${encodeURIComponent(shortLived)}`,\n );\n }\n\n /** Close the event stream and clean up. */\n disconnect(): void {\n this.connected = false;\n if (this.eventSource) {\n this.eventSource.close();\n this.eventSource = null;\n }\n if (this.reconnectTimer) {\n clearTimeout(this.reconnectTimer);\n this.reconnectTimer = null;\n }\n if (this.pollingTimer) {\n clearInterval(this.pollingTimer);\n this.pollingTimer = null;\n }\n }\n\n /** Register a handler for a specific event type. */\n on(eventType: string, handler: EventHandler): void {\n let handlers = this.listeners.get(eventType);\n if (!handlers) {\n handlers = new Set();\n this.listeners.set(eventType, handlers);\n }\n handlers.add(handler);\n\n // If SSE is already connected, add the event listener on the source\n if (\n this.eventSource &&\n eventType !== \"connected\" &&\n eventType !== \"error\"\n ) {\n this.eventSource.addEventListener(eventType, ((e: MessageEvent) => {\n try {\n const data = JSON.parse(e.data) as Record;\n handler(data);\n } catch (_err) {\n /* non-JSON payload */\n }\n }) as EventListener);\n }\n }\n\n /** Remove a handler for a specific event type. */\n off(eventType: string, handler: EventHandler): void {\n const handlers = this.listeners.get(eventType);\n if (handlers) {\n handlers.delete(handler);\n }\n }\n\n /** Whether the stream is currently connected. */\n isConnected(): boolean {\n return this.connected;\n }\n\n /* ── SSE implementation ── */\n\n private connectSSE(url?: string): void {\n try {\n // Caller passes the freshly-swapped short-lived token URL; on\n // reconnect (no arg) we re-swap and start over rather than\n // re-using a possibly-expired short-lived token.\n if (!url) {\n void this.connectSSEWithSwap();\n return;\n }\n this.eventSource = new EventSource(url);\n\n this.eventSource.addEventListener(\"connected\", ((e: MessageEvent) => {\n this.connected = true;\n this.reconnectAttempts = 0;\n this.emit(\"connected\", this.safeParse(e.data));\n }) as EventListener);\n\n // Listen for generic 'message' events\n this.eventSource.addEventListener(\"message\", ((e: MessageEvent) => {\n const data = this.safeParse(e.data);\n const eventType = (data.type as string) ?? \"message\";\n this.emit(eventType, data);\n }) as EventListener);\n\n // Register listeners for common event types\n const commonEvents = [\n \"message.created\",\n \"message.updated\",\n \"message.delivered\",\n \"conversation.updated\",\n \"conversation.assigned\",\n \"typing.start\",\n \"typing.stop\",\n ];\n\n for (const eventType of commonEvents) {\n this.eventSource.addEventListener(eventType, ((e: MessageEvent) => {\n this.emit(eventType, this.safeParse(e.data));\n }) as EventListener);\n }\n\n this.eventSource.onerror = () => {\n this.connected = false;\n this.emit(\"error\", { message: \"SSE connection error\" });\n\n if (this.eventSource?.readyState === EventSource.CLOSED) {\n this.scheduleReconnect();\n }\n };\n } catch (_err) {\n // SSE failed, fall back to polling\n this.startPolling();\n }\n }\n\n private scheduleReconnect(): void {\n if (this.reconnectAttempts >= this.maxReconnectAttempts) {\n // Switch to polling after too many SSE failures\n this.startPolling();\n return;\n }\n\n // Exponential backoff: 1s, 2s, 4s, 8s... capped at 30s\n const delay = Math.min(1000 * Math.pow(2, this.reconnectAttempts), 30_000);\n this.reconnectAttempts++;\n\n this.reconnectTimer = setTimeout(() => {\n this.connectSSE();\n }, delay);\n }\n\n /* ── Polling fallback ── */\n\n private startPolling(): void {\n this.usePolling = true;\n this.pollingTimer = setInterval(() => {\n void this.poll();\n }, 3000); // Poll every 3 seconds\n // Immediately do a first poll\n void this.poll();\n }\n\n private async poll(): Promise {\n try {\n const url = this.lastPollTimestamp\n ? `${this.pollUrl}?since=${encodeURIComponent(this.lastPollTimestamp)}`\n : this.pollUrl;\n\n // Polling fallback runs every 3 s — bound the per-request wait to\n // 10 s so a hung connection doesn't let the next tick stack up\n // behind the previous one. AbortError is swallowed by the catch\n // below, mirroring network-error handling.\n const resp = await fetch(url, {\n headers: this.pollHeaders,\n signal: AbortSignal.timeout(10_000),\n });\n if (!resp.ok) return;\n\n const json = (await resp.json()) as {\n data?: Array>;\n };\n const events = json.data ?? [];\n\n // First successful poll (HTTP 200) means the polling fallback is\n // working — flip `connected` so consumers can stop showing a\n // \"reconnecting…\" state. The previous `events.length >= 0` guard\n // was always true, but the intent is just \"we got a successful\n // response back\", which is what reaching this line implies.\n if (!this.connected) {\n this.connected = true;\n this.emit(\"connected\", {});\n }\n\n for (const event of events) {\n const eventType = (event.type as string) ?? \"message\";\n this.emit(eventType, event);\n // Track the latest timestamp for delta polling\n if (event.created_at) {\n this.lastPollTimestamp = event.created_at as string;\n }\n }\n } catch (_err) {\n // Polling errors are non-fatal; we just try again next interval\n }\n }\n\n /* ── Internal helpers ── */\n\n private emit(eventType: string, data: Record): void {\n const handlers = this.listeners.get(eventType);\n if (handlers) {\n for (const handler of handlers) {\n try {\n handler(data);\n } catch (_err) {\n /* handler errors should not break the stream */\n }\n }\n }\n\n // Also fire wildcard listeners\n const wildcardHandlers = this.listeners.get(\"*\");\n if (wildcardHandlers) {\n for (const handler of wildcardHandlers) {\n try {\n handler({ ...data, _eventType: eventType });\n } catch (_err) {\n /* swallow handler errors */\n }\n }\n }\n }\n\n private safeParse(raw: string): Record {\n try {\n return JSON.parse(raw) as Record;\n } catch (_err) {\n return { raw };\n }\n }\n}\n","/**\n * Audit #SDK-006 — `primaryColor` is template-interpolated raw into the\n * Shadow DOM CSS at multiple sites. A malformed value can:\n * - break the CSS parse (token-escape into `}…{` and rewrite host\n * selectors inside the shadow root, which still influences ::part /\n * ::slotted)\n * - smuggle a `url('https://attacker.example.com/track.png')` payload\n * that fires an outbound request every time the chat icon paints,\n * bypassing the embedding page's `img-src` CSP (it travels through\n * `background:` which is governed by `style-src` on the host site).\n *\n * The allowed shape is intentionally narrow: hex colours with 3/4/6/8\n * digits. Anything else falls back to the widget default. `console.warn`\n * makes the rejection observable for the integrator.\n */\nconst HEX_COLOR_REGEX = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;\nconst DEFAULT_PRIMARY_COLOR_FALLBACK = \"#6366f1\";\n\n/**\n * Validates a candidate primaryColor and returns either the safe input\n * or the safe default. Warns when an invalid value is rejected.\n *\n * @internal Exposed for tests and constructor-time validation.\n */\nexport function sanitizePrimaryColor(candidate: string | undefined): string {\n if (typeof candidate !== \"string\") return DEFAULT_PRIMARY_COLOR_FALLBACK;\n if (HEX_COLOR_REGEX.test(candidate)) return candidate;\n if (typeof console !== \"undefined\" && console.warn) {\n // eslint-disable-next-line no-console\n console.warn(\n `OrbitChat: primaryColor \"${candidate}\" is not a #RGB / #RGBA / #RRGGBB / #RRGGBBAA hex string — falling back to ${DEFAULT_PRIMARY_COLOR_FALLBACK}. See https://docs.orbit.devotel.io/widget/styling.`,\n );\n }\n return DEFAULT_PRIMARY_COLOR_FALLBACK;\n}\n\n/**\n * Generates all CSS for the Orbit Chat widget.\n * Styles are injected into a Shadow DOM to avoid conflicts with host page styles.\n */\nexport function generateStyles(options: {\n position: \"bottom-right\" | \"bottom-left\";\n theme: \"light\" | \"dark\";\n primaryColor: string;\n}): string {\n const { position, theme } = options;\n // Audit #SDK-006 — re-sanitize at the generator boundary as a\n // defense-in-depth measure; the constructor sanitizes too, but a\n // direct call into generateStyles from another integration point\n // should also be protected.\n const primaryColor = sanitizePrimaryColor(options.primaryColor);\n // `position` and `theme` are typed unions — narrow them again at\n // runtime so a JS caller (no TS) can't smuggle a non-matching value\n // through. Anything off-spec falls back to the safe default.\n const isLeft = position === \"bottom-left\";\n const isDark = theme === \"dark\";\n\n // Theme tokens\n const bg = isDark ? \"#1a1b2e\" : \"#ffffff\";\n const bgSecondary = isDark ? \"#252640\" : \"#f3f4f6\";\n const bgTertiary = isDark ? \"#2d2e4a\" : \"#e5e7eb\";\n const text = isDark ? \"#e4e5f1\" : \"#1a1a2e\";\n const textSecondary = isDark ? \"#9ca3b0\" : \"#6b7280\";\n const border = isDark ? \"#3a3b5c\" : \"#e5e7eb\";\n const inputBg = isDark ? \"#252640\" : \"#f9fafb\";\n const inputBorder = isDark ? \"#3a3b5c\" : \"#d1d5db\";\n const shadowColor = isDark ? \"rgba(0,0,0,0.4)\" : \"rgba(0,0,0,0.15)\";\n\n const positionRule = isLeft\n ? \"left: 20px; right: auto;\"\n : \"right: 20px; left: auto;\";\n\n return /* css */ `\n :host {\n all: initial;\n font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;\n font-size: 14px;\n line-height: 1.5;\n color: ${text};\n direction: ltr;\n }\n\n *, *::before, *::after {\n box-sizing: border-box;\n margin: 0;\n padding: 0;\n }\n\n /* ── Toggle button ── */\n .orbit-toggle {\n position: fixed;\n bottom: 20px;\n ${positionRule}\n width: 56px;\n height: 56px;\n border-radius: 50%;\n background: ${primaryColor};\n color: #ffffff;\n border: none;\n cursor: pointer;\n font-size: 24px;\n box-shadow: 0 4px 14px ${shadowColor};\n z-index: 2147483647;\n transition: transform 0.2s ease, box-shadow 0.2s ease;\n display: flex;\n align-items: center;\n justify-content: center;\n outline: none;\n }\n .orbit-toggle:hover {\n transform: scale(1.08);\n box-shadow: 0 6px 20px ${shadowColor};\n }\n .orbit-toggle:focus-visible {\n outline: 2px solid ${primaryColor};\n outline-offset: 2px;\n }\n .orbit-toggle svg {\n width: 28px;\n height: 28px;\n fill: #ffffff;\n transition: transform 0.2s ease;\n }\n .orbit-toggle.open svg {\n transform: rotate(90deg);\n }\n\n /* Unread badge */\n .orbit-badge {\n position: absolute;\n top: -2px;\n right: -2px;\n width: 20px;\n height: 20px;\n border-radius: 50%;\n background: #ef4444;\n color: #ffffff;\n font-size: 11px;\n font-weight: 700;\n display: none;\n align-items: center;\n justify-content: center;\n line-height: 1;\n }\n .orbit-badge.visible {\n display: flex;\n }\n\n /* ── Chat panel ── */\n .orbit-panel {\n position: fixed;\n bottom: 88px;\n ${positionRule}\n width: 380px;\n height: 560px;\n max-height: calc(100vh - 110px);\n border-radius: 16px;\n background: ${bg};\n box-shadow: 0 8px 40px ${shadowColor};\n z-index: 2147483647;\n overflow: hidden;\n display: none;\n flex-direction: column;\n opacity: 0;\n transform: translateY(12px) scale(0.96);\n transition: opacity 0.2s ease, transform 0.2s ease;\n }\n .orbit-panel.open {\n display: flex;\n }\n .orbit-panel.visible {\n opacity: 1;\n transform: translateY(0) scale(1);\n }\n\n /* ── Header ── */\n .orbit-header {\n padding: 16px 20px;\n background: ${primaryColor};\n color: #ffffff;\n display: flex;\n align-items: center;\n gap: 12px;\n flex-shrink: 0;\n }\n .orbit-header-avatar {\n width: 36px;\n height: 36px;\n border-radius: 50%;\n background: rgba(255,255,255,0.2);\n display: flex;\n align-items: center;\n justify-content: center;\n flex-shrink: 0;\n overflow: hidden;\n }\n .orbit-header-avatar img {\n width: 100%;\n height: 100%;\n object-fit: cover;\n border-radius: 50%;\n }\n .orbit-header-avatar svg {\n width: 20px;\n height: 20px;\n fill: #ffffff;\n }\n .orbit-header-info {\n flex: 1;\n min-width: 0;\n }\n .orbit-header-title {\n font-weight: 600;\n font-size: 15px;\n white-space: nowrap;\n overflow: hidden;\n text-overflow: ellipsis;\n }\n .orbit-header-status {\n font-size: 12px;\n opacity: 0.85;\n display: flex;\n align-items: center;\n gap: 4px;\n }\n .orbit-status-dot {\n width: 7px;\n height: 7px;\n border-radius: 50%;\n background: #34d399;\n display: inline-block;\n }\n .orbit-close {\n background: none;\n border: none;\n color: #ffffff;\n cursor: pointer;\n font-size: 20px;\n padding: 4px;\n border-radius: 4px;\n line-height: 1;\n opacity: 0.8;\n transition: opacity 0.15s;\n }\n .orbit-close:hover {\n opacity: 1;\n }\n\n /* ── Messages area ── */\n .orbit-messages {\n flex: 1;\n padding: 16px;\n overflow-y: auto;\n overflow-x: hidden;\n display: flex;\n flex-direction: column;\n gap: 8px;\n scroll-behavior: smooth;\n }\n .orbit-messages::-webkit-scrollbar {\n width: 4px;\n }\n .orbit-messages::-webkit-scrollbar-track {\n background: transparent;\n }\n .orbit-messages::-webkit-scrollbar-thumb {\n background: ${bgTertiary};\n border-radius: 2px;\n }\n\n /* Greeting message */\n .orbit-greeting {\n text-align: center;\n padding: 24px 16px;\n color: ${textSecondary};\n font-size: 14px;\n line-height: 1.6;\n }\n\n /* Message bubbles */\n .orbit-msg {\n max-width: 80%;\n padding: 10px 14px;\n border-radius: 16px;\n font-size: 14px;\n line-height: 1.5;\n word-break: break-word;\n animation: orbit-fade-in 0.2s ease;\n }\n @keyframes orbit-fade-in {\n from { opacity: 0; transform: translateY(4px); }\n to { opacity: 1; transform: translateY(0); }\n }\n\n .orbit-msg.outbound {\n align-self: flex-end;\n background: ${primaryColor};\n color: #ffffff;\n border-bottom-right-radius: 4px;\n }\n .orbit-msg.inbound {\n align-self: flex-start;\n background: ${bgSecondary};\n color: ${text};\n border-bottom-left-radius: 4px;\n }\n\n .orbit-msg-time {\n font-size: 11px;\n opacity: 0.6;\n margin-top: 4px;\n }\n .orbit-msg.outbound .orbit-msg-time {\n text-align: right;\n }\n .orbit-msg.inbound .orbit-msg-time {\n text-align: left;\n }\n\n /* Attachment bubble */\n .orbit-msg-attachment {\n display: flex;\n align-items: center;\n gap: 8px;\n padding: 8px 12px;\n background: rgba(255,255,255,0.15);\n border-radius: 8px;\n margin-top: 4px;\n font-size: 13px;\n text-decoration: none;\n color: inherit;\n }\n .orbit-msg.inbound .orbit-msg-attachment {\n background: ${bgTertiary};\n }\n .orbit-msg-attachment svg {\n width: 16px;\n height: 16px;\n flex-shrink: 0;\n fill: currentColor;\n }\n\n /* Attachment image preview */\n .orbit-msg-image {\n max-width: 100%;\n border-radius: 8px;\n margin-top: 4px;\n cursor: pointer;\n }\n\n /* ── Typing indicator ── */\n .orbit-typing {\n display: none;\n align-self: flex-start;\n padding: 10px 16px;\n background: ${bgSecondary};\n border-radius: 16px;\n border-bottom-left-radius: 4px;\n gap: 4px;\n align-items: center;\n }\n .orbit-typing.visible {\n display: flex;\n }\n .orbit-typing-dot {\n width: 7px;\n height: 7px;\n border-radius: 50%;\n background: ${textSecondary};\n animation: orbit-typing 1.4s infinite ease-in-out;\n }\n .orbit-typing-dot:nth-child(2) { animation-delay: 0.2s; }\n .orbit-typing-dot:nth-child(3) { animation-delay: 0.4s; }\n @keyframes orbit-typing {\n 0%, 60%, 100% { transform: translateY(0); opacity: 0.4; }\n 30% { transform: translateY(-4px); opacity: 1; }\n }\n\n /* ── Input bar ── */\n .orbit-input-bar {\n padding: 12px 16px;\n border-top: 1px solid ${border};\n display: flex;\n gap: 8px;\n align-items: flex-end;\n flex-shrink: 0;\n background: ${bg};\n }\n\n .orbit-attach-btn {\n background: none;\n border: none;\n cursor: pointer;\n padding: 6px;\n color: ${textSecondary};\n border-radius: 6px;\n transition: color 0.15s, background 0.15s;\n display: flex;\n align-items: center;\n justify-content: center;\n flex-shrink: 0;\n }\n .orbit-attach-btn:hover {\n color: ${primaryColor};\n background: ${bgSecondary};\n }\n .orbit-attach-btn svg {\n width: 20px;\n height: 20px;\n fill: currentColor;\n }\n\n .orbit-input {\n flex: 1;\n border: 1px solid ${inputBorder};\n border-radius: 20px;\n padding: 8px 16px;\n font-size: 14px;\n font-family: inherit;\n background: ${inputBg};\n color: ${text};\n outline: none;\n resize: none;\n max-height: 100px;\n min-height: 36px;\n line-height: 1.4;\n transition: border-color 0.15s;\n }\n .orbit-input:focus {\n border-color: ${primaryColor};\n }\n .orbit-input::placeholder {\n color: ${textSecondary};\n }\n\n .orbit-send-btn {\n background: ${primaryColor};\n color: #ffffff;\n border: none;\n border-radius: 50%;\n width: 36px;\n height: 36px;\n cursor: pointer;\n display: flex;\n align-items: center;\n justify-content: center;\n flex-shrink: 0;\n transition: opacity 0.15s, transform 0.15s;\n }\n .orbit-send-btn:hover {\n opacity: 0.9;\n transform: scale(1.05);\n }\n .orbit-send-btn:disabled {\n opacity: 0.5;\n cursor: not-allowed;\n transform: none;\n }\n .orbit-send-btn svg {\n width: 18px;\n height: 18px;\n fill: #ffffff;\n }\n\n /* File attachment preview bar */\n .orbit-file-preview {\n display: none;\n padding: 8px 16px;\n border-top: 1px solid ${border};\n background: ${bgSecondary};\n align-items: center;\n gap: 8px;\n font-size: 13px;\n color: ${textSecondary};\n }\n .orbit-file-preview.visible {\n display: flex;\n }\n .orbit-file-preview-name {\n flex: 1;\n overflow: hidden;\n text-overflow: ellipsis;\n white-space: nowrap;\n }\n .orbit-file-preview-remove {\n background: none;\n border: none;\n color: ${textSecondary};\n cursor: pointer;\n font-size: 16px;\n padding: 2px 6px;\n border-radius: 4px;\n }\n .orbit-file-preview-remove:hover {\n color: #ef4444;\n }\n\n /* ── Footer / branding ── */\n .orbit-footer {\n padding: 8px;\n text-align: center;\n font-size: 11px;\n color: ${textSecondary};\n flex-shrink: 0;\n border-top: 1px solid ${border};\n }\n .orbit-footer a {\n color: ${textSecondary};\n text-decoration: none;\n font-weight: 500;\n }\n .orbit-footer a:hover {\n color: ${primaryColor};\n }\n\n /* ── Connection status ── */\n .orbit-connection {\n display: none;\n padding: 6px 16px;\n text-align: center;\n font-size: 12px;\n background: #fef3c7;\n color: #92400e;\n flex-shrink: 0;\n }\n .orbit-connection.disconnected {\n display: block;\n }\n\n /* ── Responsive ── */\n @media (max-width: 440px) {\n .orbit-panel {\n width: calc(100vw - 16px);\n height: calc(100vh - 80px);\n max-height: none;\n bottom: 72px;\n left: 8px;\n right: 8px;\n border-radius: 12px;\n }\n .orbit-toggle {\n bottom: 12px;\n ${isLeft ? \"left: 12px;\" : \"right: 12px;\"}\n }\n }\n `;\n}\n","/**\n * Persistent storage for the Orbit Chat widget.\n * Uses localStorage with a namespaced key prefix.\n * Falls back to in-memory storage when localStorage is unavailable.\n */\n\nconst PREFIX = 'orbit_chat_'\n\n/** In-memory fallback when localStorage is blocked (e.g., incognito, iframes). */\nconst memoryStore = new Map()\n\nfunction isLocalStorageAvailable(): boolean {\n try {\n const testKey = `${PREFIX}test`\n localStorage.setItem(testKey, '1')\n localStorage.removeItem(testKey)\n return true\n } catch (_err) {\n return false\n }\n}\n\nconst useLocal = typeof window !== 'undefined' && isLocalStorageAvailable()\n\nexport function storageGet(key: string): string | null {\n const fullKey = `${PREFIX}${key}`\n if (useLocal) {\n return localStorage.getItem(fullKey)\n }\n return memoryStore.get(fullKey) ?? null\n}\n\nexport function storageSet(key: string, value: string): void {\n const fullKey = `${PREFIX}${key}`\n if (useLocal) {\n localStorage.setItem(fullKey, value)\n } else {\n memoryStore.set(fullKey, value)\n }\n}\n\nexport function storageRemove(key: string): void {\n const fullKey = `${PREFIX}${key}`\n if (useLocal) {\n localStorage.removeItem(fullKey)\n } else {\n memoryStore.delete(fullKey)\n }\n}\n","/** SVG icon strings used in the Orbit Chat widget. */\n\nexport const ICON_CHAT = ``\n\nexport const ICON_CLOSE = ``\n\nexport const ICON_SEND = ``\n\nexport const ICON_ATTACH = ``\n\nexport const ICON_FILE = ``\n\nexport const ICON_AGENT = ``\n","import type { OrbitChatConfig, ChatMessage } from \"./types\";\nimport { ApiClient } from \"./api-client\";\nimport { EventStream } from \"./event-stream\";\nimport { generateStyles, sanitizePrimaryColor } from \"./styles\";\nimport { storageGet, storageSet } from \"./storage\";\nimport {\n ICON_CHAT,\n ICON_CLOSE,\n ICON_SEND,\n ICON_ATTACH,\n ICON_FILE,\n ICON_AGENT,\n} from \"./icons\";\n\nconst DEFAULT_BASE_URL = \"https://api.orbit.devotel.io/api/v1\";\nconst DEFAULT_PRIMARY_COLOR = \"#6366f1\";\nconst DEFAULT_GREETING = \"Hi there! How can we help you today?\";\nconst DEFAULT_AGENT_NAME = \"Orbit Support\";\n\nconst MAX_FILE_SIZE = 10 * 1024 * 1024; // 10 MB\nconst ACCEPTED_FILE_TYPES =\n \".jpg,.jpeg,.png,.gif,.webp,.pdf,.doc,.docx,.xls,.xlsx,.csv,.txt,.zip\";\nconst IMAGE_EXTENSIONS = new Set([\"jpg\", \"jpeg\", \"png\", \"gif\", \"webp\"]);\n\n/**\n * Resolves the public-key from a config object, accepting both the new\n * `publicKey` field (canonical) and the deprecated `apiKey` alias. When\n * only `apiKey` is supplied, the SDK emits a one-shot `console.warn` so\n * customers can migrate without an immediate runtime break.\n *\n * Deduplicated via a process-level Set so React strict-mode double-mount\n * or repeated `OrbitChat.init` calls don't spam the console.\n */\nconst APIKEY_DEPRECATION_SEEN = new Set();\nfunction resolvePublicKey(config: {\n publicKey?: string;\n apiKey?: string;\n}): string | undefined {\n if (config.publicKey && config.publicKey.length > 0) {\n return config.publicKey;\n }\n if (config.apiKey && config.apiKey.length > 0) {\n // Dedup by component key + raw value prefix so two distinct migrations\n // (different keys, different code paths) still each warn once.\n const dedupKey = `OrbitChat:${config.apiKey.slice(0, 16)}`;\n if (\n !APIKEY_DEPRECATION_SEEN.has(dedupKey) &&\n typeof console !== \"undefined\" &&\n console.warn\n ) {\n APIKEY_DEPRECATION_SEEN.add(dedupKey);\n console.warn(\n \"OrbitChat: `apiKey` is deprecated — rename to `publicKey`. \" +\n \"The `apiKey` alias will be removed in the next major version. \" +\n \"See https://docs.orbit.devotel.io/sdks/web#authentication.\",\n );\n }\n return config.apiKey;\n }\n return undefined;\n}\n\n/**\n * Embeddable Orbit Chat widget.\n *\n * Renders a floating chat button and panel inside a Shadow DOM.\n * Communicates with the Orbit conversations API and receives\n * real-time updates via SSE.\n *\n * Usage:\n * ```html\n * \n * \n * ```\n */\nexport class OrbitChat {\n /* ── Configuration ── */\n private apiKey: string;\n private baseUrl: string;\n private position: \"bottom-right\" | \"bottom-left\";\n private theme: \"light\" | \"dark\";\n private greeting: string;\n private primaryColor: string;\n private agentAvatar: string | undefined;\n private agentName: string;\n private visitorId: string | undefined;\n private metadata: Record | undefined;\n\n /* ── State ── */\n private host: HTMLElement | null = null;\n private shadow: ShadowRoot | null = null;\n private isOpen = false;\n private isSending = false;\n private unreadCount = 0;\n private messages: ChatMessage[] = [];\n private pendingFile: File | null = null;\n private conversationReady = false;\n\n /* ── Services ── */\n private api: ApiClient;\n private eventStream: EventStream;\n\n /* ── DOM references (inside shadow) ── */\n private toggleBtn: HTMLButtonElement | null = null;\n private badgeEl: HTMLElement | null = null;\n private panelEl: HTMLElement | null = null;\n private messagesEl: HTMLElement | null = null;\n private inputEl: HTMLTextAreaElement | null = null;\n private sendBtn: HTMLButtonElement | null = null;\n private typingEl: HTMLElement | null = null;\n private filePreviewEl: HTMLElement | null = null;\n private filePreviewName: HTMLElement | null = null;\n private fileInput: HTMLInputElement | null = null;\n private connectionEl: HTMLElement | null = null;\n\n /**\n * Factory method -- creates, mounts, and returns a widget instance.\n */\n static init(config: OrbitChatConfig): OrbitChat {\n const chat = new OrbitChat(config);\n chat.mount();\n return chat;\n }\n\n constructor(config: OrbitChatConfig) {\n // Accept both the canonical `publicKey` field and the deprecated\n // `apiKey` alias (audit #SDK-010). `publicKey` wins when both are\n // set; passing only `apiKey` emits a one-shot console.warn pointing\n // at the migration docs.\n const resolvedKey = resolvePublicKey(config);\n if (!resolvedKey) {\n throw new Error(\"OrbitChat: publicKey is required\");\n }\n\n // Audit #SDK-004 — refuse server-side secret keys (`dv_live_sk_…` /\n // `dv_test_sk_…`) in the browser widget. A developer who copy-pastes\n // their dashboard secret key into `OrbitChat.init({ publicKey })` would\n // otherwise ship it to every visitor's browser AND every proxy log\n // between visitor and Orbit. The widget MUST receive the PUBLISHABLE\n // key (prefix `dv_live_pk_…` or `dv_test_pk_…`).\n if (\n resolvedKey.startsWith(\"dv_live_sk_\") ||\n resolvedKey.startsWith(\"dv_test_sk_\")\n ) {\n const msg =\n \"OrbitChat: server-side secret keys (dv_live_sk_… / dv_test_sk_…) cannot be used in the browser. \" +\n \"Use the public publishable key (dv_live_pk_… / dv_test_pk_…) — see https://docs.orbit.devotel.io/widget/api-keys.\";\n if (typeof console !== \"undefined\" && console.error) {\n // eslint-disable-next-line no-console\n console.error(msg);\n }\n throw new Error(msg);\n }\n\n this.apiKey = resolvedKey;\n this.baseUrl = config.baseUrl ?? DEFAULT_BASE_URL;\n this.position = config.position ?? \"bottom-right\";\n this.theme = config.theme ?? \"light\";\n this.greeting = config.greeting ?? DEFAULT_GREETING;\n // Audit #SDK-006 — sanitize primaryColor at the constructor boundary.\n // The value lands in Shadow DOM CSS via `background: ${primaryColor}`\n // at multiple sites; an unvalidated payload like\n // `red; }body{background:url(https://attacker.tld)` would parse\n // through and trigger a covert outbound beacon on every paint. The\n // helper rejects anything that isn't a #RGB/#RGBA/#RRGGBB/#RRGGBBAA\n // hex string and falls back to the default with a console.warn.\n this.primaryColor = sanitizePrimaryColor(\n config.primaryColor ?? DEFAULT_PRIMARY_COLOR,\n );\n this.agentAvatar = config.agentAvatar;\n this.agentName = config.agentName ?? DEFAULT_AGENT_NAME;\n this.visitorId = config.visitorId;\n this.metadata = config.metadata;\n\n this.api = new ApiClient(this.baseUrl, this.apiKey);\n // Audit #SDK-004 — pass the ApiClient (not the long-lived URL +\n // raw apiKey) so EventStream can swap the long-lived widget key\n // for a short-lived stream token before opening SSE.\n this.eventStream = new EventStream(this.baseUrl, this.baseUrl, this.api);\n }\n\n /** Returns the configured API base URL. */\n getBaseUrl(): string {\n return this.baseUrl;\n }\n\n /** Returns the public API key. */\n getApiKey(): string {\n return this.apiKey;\n }\n\n /**\n * Mounts the widget into the DOM using Shadow DOM for style isolation.\n * Safe to call multiple times -- existing widget is removed first.\n */\n mount(): void {\n this.destroy();\n\n // Create host element\n this.host = document.createElement(\"div\");\n this.host.id = \"orbit-chat-widget\";\n this.host.setAttribute(\"data-orbit-chat\", \"true\");\n\n // Attach shadow DOM for style isolation\n this.shadow = this.host.attachShadow({ mode: \"open\" });\n\n // Inject styles\n const styleEl = document.createElement(\"style\");\n styleEl.textContent = generateStyles({\n position: this.position,\n theme: this.theme,\n primaryColor: this.primaryColor,\n });\n this.shadow.appendChild(styleEl);\n\n // Build the widget DOM\n this.shadow.appendChild(this.buildToggle());\n this.shadow.appendChild(this.buildPanel());\n\n // Hidden file input for attachments\n this.fileInput = document.createElement(\"input\");\n this.fileInput.type = \"file\";\n this.fileInput.accept = ACCEPTED_FILE_TYPES;\n this.fileInput.style.display = \"none\";\n this.fileInput.addEventListener(\"change\", () => this.handleFileSelected());\n this.shadow.appendChild(this.fileInput);\n\n // Add to page\n document.body.appendChild(this.host);\n\n // Cache DOM references\n this.cacheRefs();\n\n // Bind events\n this.bindEvents();\n\n // Restore conversation from storage\n this.restoreConversation();\n\n // Connect real-time event stream\n this.setupEventStream();\n }\n\n /** Removes the widget from the DOM and cleans up. */\n destroy(): void {\n this.eventStream.disconnect();\n if (this.host) {\n this.host.remove();\n this.host = null;\n this.shadow = null;\n }\n this.isOpen = false;\n this.pendingFile = null;\n this.messages = [];\n this.conversationReady = false;\n }\n\n /** Programmatically open the chat panel. */\n open(): void {\n if (!this.isOpen) {\n this.togglePanel();\n }\n }\n\n /** Programmatically close the chat panel. */\n close(): void {\n if (this.isOpen) {\n this.togglePanel();\n }\n }\n\n /** Send a message programmatically. */\n async sendMessage(text: string): Promise {\n await this.ensureConversation();\n await this.doSendMessage(text);\n }\n\n /* ════════════════════════════════════════════════════════════════\n DOM Construction\n ════════════════════════════════════════════════════════════════ */\n\n private buildToggle(): HTMLButtonElement {\n const btn = document.createElement(\"button\");\n btn.className = \"orbit-toggle\";\n btn.setAttribute(\"aria-label\", \"Open chat\");\n btn.innerHTML = `${ICON_CHAT}`;\n return btn;\n }\n\n private buildPanel(): HTMLElement {\n const panel = document.createElement(\"div\");\n panel.className = \"orbit-panel\";\n panel.setAttribute(\"role\", \"dialog\");\n panel.setAttribute(\"aria-label\", \"Chat with support\");\n\n const avatarContent = this.agentAvatar\n ? `\"${this.escapeAttr(this.agentName)}\"`\n : ICON_AGENT;\n\n panel.innerHTML = `\n
\n
${avatarContent}
\n
\n
${this.escapeHtml(this.agentName)}
\n
\n \n Online\n
\n
\n \n
\n
Reconnecting...
\n
\n
${this.escapeHtml(this.greeting)}
\n
\n
\n \n \n \n
\n
\n \n \n
\n
\n \n \n \n
\n
\n Powered by Orbit\n
\n `;\n\n return panel;\n }\n\n /* ════════════════════════════════════════════════════════════════\n Event Binding\n ════════════════════════════════════════════════════════════════ */\n\n private cacheRefs(): void {\n if (!this.shadow) return;\n this.toggleBtn = this.shadow.querySelector(\".orbit-toggle\");\n this.badgeEl = this.shadow.querySelector(\".orbit-badge\");\n this.panelEl = this.shadow.querySelector(\".orbit-panel\");\n this.messagesEl = this.shadow.querySelector(\".orbit-messages\");\n this.inputEl = this.shadow.querySelector(\".orbit-input\");\n this.sendBtn = this.shadow.querySelector(\".orbit-send-btn\");\n this.typingEl = this.shadow.querySelector(\".orbit-typing\");\n this.filePreviewEl = this.shadow.querySelector(\".orbit-file-preview\");\n this.filePreviewName = this.shadow.querySelector(\n \".orbit-file-preview-name\",\n );\n this.connectionEl = this.shadow.querySelector(\".orbit-connection\");\n }\n\n private bindEvents(): void {\n this.toggleBtn?.addEventListener(\"click\", () => this.togglePanel());\n\n const closeBtn = this.shadow?.querySelector(\".orbit-close\");\n closeBtn?.addEventListener(\"click\", () => this.togglePanel());\n\n this.sendBtn?.addEventListener(\"click\", () => {\n void this.handleSend();\n });\n\n this.inputEl?.addEventListener(\"keydown\", (e: KeyboardEvent) => {\n if (e.key === \"Enter\" && !e.shiftKey) {\n e.preventDefault();\n void this.handleSend();\n }\n });\n\n // Auto-resize textarea\n this.inputEl?.addEventListener(\"input\", () => this.autoResizeInput());\n\n // Attach button\n const attachBtn = this.shadow?.querySelector(\".orbit-attach-btn\");\n attachBtn?.addEventListener(\"click\", () => this.fileInput?.click());\n\n // Remove file preview\n const removeFileBtn = this.shadow?.querySelector(\n \".orbit-file-preview-remove\",\n );\n removeFileBtn?.addEventListener(\"click\", () => this.clearPendingFile());\n }\n\n /* ════════════════════════════════════════════════════════════════\n Panel Toggle & State\n ════════════════════════════════════════════════════════════════ */\n\n private togglePanel(): void {\n if (!this.panelEl || !this.toggleBtn) return;\n\n this.isOpen = !this.isOpen;\n\n if (this.isOpen) {\n this.panelEl.classList.add(\"open\");\n this.toggleBtn.classList.add(\"open\");\n this.toggleBtn.innerHTML = `${ICON_CLOSE}`;\n this.badgeEl = this.shadow?.querySelector(\".orbit-badge\") ?? null;\n\n // Animate in\n requestAnimationFrame(() => {\n requestAnimationFrame(() => {\n this.panelEl?.classList.add(\"visible\");\n });\n });\n\n // Focus input\n setTimeout(() => this.inputEl?.focus(), 100);\n\n // Clear unread\n this.unreadCount = 0;\n this.updateBadge();\n\n // Scroll to bottom\n this.scrollToBottom();\n } else {\n this.panelEl.classList.remove(\"visible\");\n this.toggleBtn.classList.remove(\"open\");\n this.toggleBtn.innerHTML = `${ICON_CHAT}`;\n this.badgeEl = this.shadow?.querySelector(\".orbit-badge\") ?? null;\n\n // Wait for animation then hide\n setTimeout(() => {\n this.panelEl?.classList.remove(\"open\");\n }, 200);\n }\n }\n\n /* ════════════════════════════════════════════════════════════════\n Conversation Management\n ════════════════════════════════════════════════════════════════ */\n\n private restoreConversation(): void {\n const storedId = storageGet(`conversation_${this.apiKey}`);\n if (storedId) {\n this.api.setConversationId(storedId);\n this.conversationReady = true;\n // Load existing messages\n void this.loadMessages();\n }\n }\n\n private async ensureConversation(): Promise {\n if (this.conversationReady && this.api.getConversationId()) return;\n\n try {\n const conversation = await this.api.createConversation(\n this.visitorId,\n this.metadata,\n );\n storageSet(`conversation_${this.apiKey}`, conversation.id);\n this.conversationReady = true;\n } catch (err) {\n // If creation fails (e.g. conversation already exists), try listing\n try {\n const conversations = await this.api.listConversations(\"open\");\n if (conversations.length > 0) {\n const conv = conversations[0]!;\n this.api.setConversationId(conv.id);\n storageSet(`conversation_${this.apiKey}`, conv.id);\n this.conversationReady = true;\n return;\n }\n } catch (_listErr) {\n // Both attempts failed\n }\n console.error(\"[OrbitChat] Failed to create conversation:\", err);\n }\n }\n\n private async loadMessages(): Promise {\n try {\n const messages = await this.api.getMessages(50);\n this.messages = messages;\n\n // Clear greeting if messages exist\n if (messages.length > 0 && this.messagesEl) {\n const greeting = this.messagesEl.querySelector(\".orbit-greeting\");\n if (greeting) greeting.remove();\n }\n\n // Render all messages\n for (const msg of messages) {\n this.renderMessage(msg, false);\n }\n this.scrollToBottom();\n } catch (err) {\n console.error(\"[OrbitChat] Failed to load messages:\", err);\n }\n }\n\n /* ════════════════════════════════════════════════════════════════\n Message Sending\n ════════════════════════════════════════════════════════════════ */\n\n private async handleSend(): Promise {\n if (this.isSending) return;\n\n const text = this.inputEl?.value.trim() ?? \"\";\n const file = this.pendingFile;\n\n if (!text && !file) return;\n\n this.isSending = true;\n if (this.sendBtn) this.sendBtn.disabled = true;\n\n try {\n await this.ensureConversation();\n\n if (file) {\n await this.doSendFile(file);\n this.clearPendingFile();\n }\n\n if (text) {\n await this.doSendMessage(text);\n }\n } catch (err) {\n console.error(\"[OrbitChat] Failed to send message:\", err);\n // Show the error as a system message\n this.renderSystemMessage(\"Message failed to send. Please try again.\");\n } finally {\n this.isSending = false;\n if (this.sendBtn) this.sendBtn.disabled = false;\n }\n }\n\n private async doSendMessage(text: string): Promise {\n // Optimistically render the message\n const optimisticMsg: ChatMessage = {\n id: `temp_${Date.now()}`,\n body: text,\n direction: \"outbound\",\n created_at: new Date().toISOString(),\n };\n this.messages.push(optimisticMsg);\n this.renderMessage(optimisticMsg, true);\n\n // Clear input\n if (this.inputEl) {\n this.inputEl.value = \"\";\n this.autoResizeInput();\n }\n\n // Remove greeting\n const greeting = this.messagesEl?.querySelector(\".orbit-greeting\");\n if (greeting) greeting.remove();\n\n try {\n await this.api.sendMessage(text);\n } catch (err) {\n // Remove optimistic message on failure\n const msgEl = this.messagesEl?.querySelector(\n `[data-msg-id=\"${optimisticMsg.id}\"]`,\n );\n msgEl?.remove();\n this.messages = this.messages.filter((m) => m.id !== optimisticMsg.id);\n throw err;\n }\n }\n\n private async doSendFile(file: File): Promise {\n // Optimistically render the file message\n const optimisticMsg: ChatMessage = {\n id: `temp_file_${Date.now()}`,\n body: file.name,\n direction: \"outbound\",\n created_at: new Date().toISOString(),\n };\n this.messages.push(optimisticMsg);\n this.renderMessage(optimisticMsg, true);\n\n try {\n await this.api.sendAttachment(file);\n } catch (err) {\n const msgEl = this.messagesEl?.querySelector(\n `[data-msg-id=\"${optimisticMsg.id}\"]`,\n );\n msgEl?.remove();\n this.messages = this.messages.filter((m) => m.id !== optimisticMsg.id);\n throw err;\n }\n }\n\n /* ════════════════════════════════════════════════════════════════\n File Attachments\n ════════════════════════════════════════════════════════════════ */\n\n private handleFileSelected(): void {\n const file = this.fileInput?.files?.[0];\n if (!file) return;\n\n if (file.size > MAX_FILE_SIZE) {\n this.renderSystemMessage(\"File is too large. Maximum size is 10 MB.\");\n return;\n }\n\n this.pendingFile = file;\n if (this.filePreviewName) {\n this.filePreviewName.textContent = file.name;\n }\n this.filePreviewEl?.classList.add(\"visible\");\n\n // Reset the input so the same file can be re-selected\n if (this.fileInput) this.fileInput.value = \"\";\n }\n\n private clearPendingFile(): void {\n this.pendingFile = null;\n this.filePreviewEl?.classList.remove(\"visible\");\n if (this.filePreviewName) this.filePreviewName.textContent = \"\";\n }\n\n /* ════════════════════════════════════════════════════════════════\n Message Rendering\n ════════════════════════════════════════════════════════════════ */\n\n private renderMessage(msg: ChatMessage, animate: boolean): void {\n if (!this.messagesEl) return;\n\n // Avoid duplicates\n if (this.messagesEl.querySelector(`[data-msg-id=\"${msg.id}\"]`)) return;\n\n const bubble = document.createElement(\"div\");\n bubble.className = `orbit-msg ${msg.direction === \"outbound\" ? \"outbound\" : \"inbound\"}`;\n bubble.setAttribute(\"data-msg-id\", msg.id);\n\n if (!animate) {\n bubble.style.animation = \"none\";\n }\n\n // Message body\n const bodyEl = document.createElement(\"div\");\n bodyEl.textContent = msg.body;\n bubble.appendChild(bodyEl);\n\n // Attachment rendering\n if (msg.media_url) {\n const ext = msg.media_url.split(\".\").pop()?.toLowerCase() ?? \"\";\n if (IMAGE_EXTENSIONS.has(ext)) {\n const img = document.createElement(\"img\");\n img.className = \"orbit-msg-image\";\n img.src = msg.media_url;\n img.alt = msg.body || \"Attachment\";\n img.loading = \"lazy\";\n img.addEventListener(\"click\", () => {\n // `noopener,noreferrer` prevents the popup from getting a\n // `window.opener` reference back into the host page (reverse\n // tabnabbing) and strips the Referer header.\n if (msg.media_url)\n window.open(msg.media_url, \"_blank\", \"noopener,noreferrer\");\n });\n bubble.appendChild(img);\n } else {\n const link = document.createElement(\"a\");\n link.className = \"orbit-msg-attachment\";\n link.href = msg.media_url;\n link.target = \"_blank\";\n link.rel = \"noopener noreferrer\";\n link.innerHTML = `${ICON_FILE}${this.escapeHtml(msg.body || \"Download\")}`;\n bubble.appendChild(link);\n }\n }\n\n // Timestamp\n const timeEl = document.createElement(\"div\");\n timeEl.className = \"orbit-msg-time\";\n timeEl.textContent = this.formatTime(msg.created_at);\n bubble.appendChild(timeEl);\n\n this.messagesEl.appendChild(bubble);\n this.scrollToBottom();\n }\n\n private renderSystemMessage(text: string): void {\n if (!this.messagesEl) return;\n\n const el = document.createElement(\"div\");\n el.className = \"orbit-greeting\";\n el.textContent = text;\n el.style.fontSize = \"13px\";\n el.style.padding = \"8px\";\n this.messagesEl.appendChild(el);\n this.scrollToBottom();\n\n // Auto-remove after 5 seconds\n setTimeout(() => el.remove(), 5000);\n }\n\n /* ════════════════════════════════════════════════════════════════\n Typing Indicators\n ════════════════════════════════════════════════════════════════ */\n\n private showTyping(): void {\n this.typingEl?.classList.add(\"visible\");\n this.scrollToBottom();\n }\n\n private hideTyping(): void {\n this.typingEl?.classList.remove(\"visible\");\n }\n\n /* ════════════════════════════════════════════════════════════════\n Real-time Event Stream\n ════════════════════════════════════════════════════════════════ */\n\n private setupEventStream(): void {\n this.eventStream.on(\"connected\", () => {\n this.connectionEl?.classList.remove(\"disconnected\");\n });\n\n this.eventStream.on(\"error\", () => {\n this.connectionEl?.classList.add(\"disconnected\");\n });\n\n // New message received (inbound from agent)\n this.eventStream.on(\"message.created\", (data) => {\n const convId = this.api.getConversationId();\n const nested = data[\"data\"] as Record | undefined;\n const eventConvId = (data[\"conversation_id\"] ??\n nested?.[\"conversation_id\"]) as string | undefined;\n\n // Only process messages for our conversation\n if (!convId || (eventConvId && eventConvId !== convId)) return;\n\n const direction = (data[\"direction\"] ?? nested?.[\"direction\"]) as\n | string\n | undefined;\n if (direction !== \"inbound\") return;\n\n const msg: ChatMessage = {\n id: (data[\"id\"] ?? nested?.[\"id\"] ?? `sse_${Date.now()}`) as string,\n body: (data[\"body\"] ?? nested?.[\"body\"] ?? \"\") as string,\n direction: \"inbound\",\n created_at: (data[\"created_at\"] ??\n nested?.[\"created_at\"] ??\n new Date().toISOString()) as string,\n media_url: (data[\"media_url\"] ?? nested?.[\"media_url\"]) as\n | string\n | undefined,\n };\n\n // Avoid rendering duplicates\n const isDuplicate = this.messages.some((m) => m.id === msg.id);\n if (isDuplicate) return;\n\n this.messages.push(msg);\n this.hideTyping();\n this.renderMessage(msg, true);\n\n // Increment unread if panel is closed\n if (!this.isOpen) {\n this.unreadCount++;\n this.updateBadge();\n }\n });\n\n // Typing indicators\n this.eventStream.on(\"typing.start\", (data) => {\n const convId = this.api.getConversationId();\n const nested = data[\"data\"] as Record | undefined;\n const eventConvId = (data[\"conversation_id\"] ??\n nested?.[\"conversation_id\"]) as string | undefined;\n if (convId && eventConvId === convId) {\n this.showTyping();\n }\n });\n\n this.eventStream.on(\"typing.stop\", (data) => {\n const convId = this.api.getConversationId();\n const nested = data[\"data\"] as Record | undefined;\n const eventConvId = (data[\"conversation_id\"] ??\n nested?.[\"conversation_id\"]) as string | undefined;\n if (convId && eventConvId === convId) {\n this.hideTyping();\n }\n });\n\n // Connect\n this.eventStream.connect();\n }\n\n /* ════════════════════════════════════════════════════════════════\n Unread Badge\n ════════════════════════════════════════════════════════════════ */\n\n private updateBadge(): void {\n if (!this.badgeEl) return;\n if (this.unreadCount > 0) {\n this.badgeEl.classList.add(\"visible\");\n this.badgeEl.textContent =\n this.unreadCount > 9 ? \"9+\" : String(this.unreadCount);\n } else {\n this.badgeEl.classList.remove(\"visible\");\n this.badgeEl.textContent = \"\";\n }\n }\n\n /* ════════════════════════════════════════════════════════════════\n Helpers\n ════════════════════════════════════════════════════════════════ */\n\n private scrollToBottom(): void {\n if (this.messagesEl) {\n requestAnimationFrame(() => {\n if (this.messagesEl) {\n this.messagesEl.scrollTop = this.messagesEl.scrollHeight;\n }\n });\n }\n }\n\n private autoResizeInput(): void {\n if (!this.inputEl) return;\n this.inputEl.style.height = \"auto\";\n const maxHeight = 100;\n this.inputEl.style.height = `${Math.min(this.inputEl.scrollHeight, maxHeight)}px`;\n }\n\n private formatTime(isoString: string): string {\n try {\n const date = new Date(isoString);\n return date.toLocaleTimeString(undefined, {\n hour: \"numeric\",\n minute: \"2-digit\",\n hour12: true,\n });\n } catch (_err) {\n return \"\";\n }\n }\n\n private escapeHtml(str: string): string {\n const div = document.createElement(\"div\");\n div.textContent = str;\n return div.innerHTML;\n }\n\n private escapeAttr(str: string): string {\n return str\n .replace(/&/g, \"&\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\")\n .replace(//g, \">\");\n }\n}\n","/**\n * Orbit browser softphone — thin wrapper around LiveKit's Web SDK that\n * drives the dashboard / customer browser softphone UX.\n *\n * Lifecycle:\n * 1. Ask the API for a LiveKit token (POST /voice/softphone/token) —\n * the token is scoped to a deterministic per-user room.\n * 2. Connect to LiveKit with the token + publish the local mic.\n * 3. To place an outbound call: POST /voice/softphone/dial; the server\n * bridges a Telnyx leg into the same room.\n * 4. The remote SIP participant's audio auto-subscribes; the caller\n * hears them via the WebRTC audio element the SDK attaches.\n *\n * The SDK has no opinion on UI — consumers wire onCallStateChange into\n * their own React / Vue / vanilla component tree.\n */\n\n// LiveKit Web SDK types are dynamically imported so the package has no\n// hard install-time dep when the caller only uses other sdk-web exports\n// (e.g. OrbitChat). Consumers that call OrbitSoftphone methods must have\n// `livekit-client` installed themselves.\ntype LKRoom = {\n connect: (url: string, token: string) => Promise;\n disconnect: () => Promise;\n localParticipant: {\n setMicrophoneEnabled: (enabled: boolean) => Promise;\n isMicrophoneEnabled: boolean;\n };\n on: (event: string, handler: (...args: unknown[]) => void) => void;\n};\n\nexport type SoftphoneCallState =\n | \"idle\"\n | \"connecting\"\n | \"ringing\"\n | \"in-call\"\n | \"ended\";\n\nexport interface SoftphoneConfig {\n /** Orbit API base URL (e.g. https://api.orbit.devotel.io). */\n apiBaseUrl: string;\n /** Tenant API key with voice scope. */\n apiKey: string;\n /**\n * Optional Orbit Media WebSocket URL override (otherwise taken from the\n * token response `media_url` field). Preferred name since the LiveKit→Orbit\n * Media fork landed (task #796).\n */\n mediaUrl?: string;\n /**\n * @deprecated Use `mediaUrl` instead. Kept as a back-compat alias for one\n * minor SDK version; both fields are read and `mediaUrl` takes precedence.\n */\n livekitUrl?: string;\n /** Fires whenever the softphone call state transitions. */\n onCallStateChange?: (state: SoftphoneCallState) => void;\n /** Fires on unrecoverable errors (bad token, no mic permission, etc). */\n onError?: (err: Error) => void;\n}\n\n/**\n * Minimal browser softphone. One instance == one softphone session for\n * the logged-in user.\n */\nexport class OrbitSoftphone {\n private room: LKRoom | null = null;\n private state: SoftphoneCallState = \"idle\";\n\n constructor(private config: SoftphoneConfig) {}\n\n /** Connect to the user's Orbit Media softphone room and publish the mic. */\n async connect(): Promise {\n this.setState(\"connecting\");\n try {\n const tokenRes = await fetch(\n `${this.config.apiBaseUrl}/api/v1/voice/softphone/token`,\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: `Bearer ${this.config.apiKey}`,\n },\n // Control-plane call before the LiveKit room is even minted —\n // bound at 10 s so a hung API doesn't leave the user staring\n // at a \"connecting\" spinner forever.\n signal: AbortSignal.timeout(10_000),\n },\n );\n if (!tokenRes.ok) {\n throw new Error(`softphone token request failed (${tokenRes.status})`);\n }\n const body = (await tokenRes.json()) as {\n data?: { token: string; media_url?: string | null; livekit_url?: string | null };\n };\n const token = body.data?.token;\n // Prefer new `media_url` field; fall back to deprecated `livekit_url` for\n // servers not yet upgraded. Config override: prefer `mediaUrl`, then\n // deprecated `livekitUrl`.\n const url =\n this.config.mediaUrl ??\n this.config.livekitUrl ??\n body.data?.media_url ??\n body.data?.livekit_url ??\n \"\";\n if (!token || !url) {\n throw new Error(\n \"softphone token response missing token or Orbit Media URL\",\n );\n }\n\n // Dynamic import — no hard dep. Consumers opt in by installing\n // `@orbit/media-client` themselves. The specifier is built from a string\n // local so TypeScript's module resolver doesn't try to type-check the\n // peer module at compile time (it isn't installed in this workspace).\n const livekitModuleName = \"@orbit/media-client\";\n const lk = (await import(/* @vite-ignore */ livekitModuleName)) as {\n Room: new () => LKRoom;\n };\n this.room = new lk.Room();\n this.room.on(\"disconnected\", () => {\n this.setState(\"ended\");\n });\n await this.room.connect(url, token);\n await this.room.localParticipant.setMicrophoneEnabled(true);\n this.setState(\"idle\");\n } catch (err) {\n this.config.onError?.(err as Error);\n this.setState(\"ended\");\n throw err;\n }\n }\n\n /** Place an outbound call through the softphone. Returns the call_id. */\n async dial(destination: string, from?: string): Promise {\n this.setState(\"ringing\");\n const res = await fetch(\n `${this.config.apiBaseUrl}/api/v1/voice/softphone/dial`,\n {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: `Bearer ${this.config.apiKey}`,\n },\n body: JSON.stringify({ to: destination, from }),\n // Same 10 s ceiling as the token call — both are control-plane\n // operations that gate the in-call UX.\n signal: AbortSignal.timeout(10_000),\n },\n );\n if (!res.ok) {\n this.setState(\"idle\");\n this.config.onError?.(new Error(`softphone dial failed (${res.status})`));\n throw new Error(`softphone dial failed (${res.status})`);\n }\n const body = (await res.json()) as {\n data?: { id?: string };\n };\n this.setState(\"in-call\");\n return body.data?.id ?? \"\";\n }\n\n /** Toggle local microphone mute. Returns the new muted state.\n *\n * Audit #511 voice/sdk-web/softphone:141 — read the LK flag, await\n * the toggle, then re-read so the returned value reflects what\n * LiveKit actually applied (not what we *requested*). On slow\n * networks the SDK can reject the toggle and the previous code\n * returned the wrong-flipped value, leaving consumers with a UI\n * that displayed \"muted\" while the mic was still hot — privacy\n * bug. Throw on rejection so the consumer surfaces it.\n */\n async toggleMute(): Promise {\n if (!this.room) return false;\n const wasEnabled = this.room.localParticipant.isMicrophoneEnabled;\n try {\n await this.room.localParticipant.setMicrophoneEnabled(!wasEnabled);\n } catch (err) {\n throw err instanceof Error ? err : new Error(String(err));\n }\n // muted = !enabled; re-read AFTER the await for the actual state.\n return !this.room.localParticipant.isMicrophoneEnabled;\n }\n\n /** End the softphone session and drop from the LiveKit room. */\n async disconnect(): Promise {\n if (this.room) {\n await this.room.disconnect();\n this.room = null;\n }\n this.setState(\"ended\");\n }\n\n private setState(next: SoftphoneCallState): void {\n if (next === this.state) return;\n this.state = next;\n this.config.onCallStateChange?.(next);\n }\n}\n","/**\n * OrbitVoiceAgent — embeddable browser WebRTC voice-agent widget\n * (PARITY-R1-010, parity-aiaas-04).\n *\n * The WEB front-door to Orbit's AI voice agent. Until this shipped, the\n * only path to the voice AI was an inbound PSTN DID — there was no web\n * widget, which Vapi (web widget), Retell (web call SDK), and Sierra all\n * ship as the primary demo / onboarding path. This class is the\n * drop-in a customer pastes into their site so a visitor can press\n * \"Talk to AI\" and hold a live WebRTC voice conversation with their\n * configured agent.\n *\n * Usage on the host page:\n *\n * ```html\n *
\n * \n * ```\n *\n * Architecture:\n *\n * - Control plane: `POST /widget/voice-agent-session` mints\n * a short-lived orbit-media room token bound to {publicKey, agentId,\n * visitorId}. Same anonymous, Origin-gated, public-key-keyed auth\n * model as the native-chat `/widget/session` route — no Clerk / API\n * key in the browser. The session carries `origin='web'` so the\n * server-side `runAnthropicPipelineSession` path treats it as a web\n * call (vs PSTN).\n *\n * - Media plane: the WebRTC transport is the SAME `@orbit/media-client`\n * (LiveKit fork) the legacy `OrbitSoftphone` already uses. We\n * dynamic-import it via a string specifier so the package has no\n * hard install-time dep when a consumer only uses other sdk-web\n * exports (e.g. OrbitChat). The visitor publishes their mic; the\n * agent runtime joins the same room server-side and its audio\n * auto-subscribes and plays through an attached `