v0.3.5-beta.0 → v0.3.6-beta.0

Release date: 2026-08-10 Previous version: 0.3.5-beta.0

What's New

No new features in this release — see Bug Fixes and Known Issues below.

Public API Changes

No public API changes in this release.

Bug Fixes

Account context no longer fails entirely when one endpoint is denied

Previously, if any single account-context request (features, site settings, account users, or skills) was denied during connect, the whole account context failed to load. Each of these now fails independently with a safe default, so a denied endpoint no longer prevents the rest of the account context — and the session itself — from loading successfully.

Known Issues

Account feature flags may not reflect live configuration

Account feature flags returned via the SDK are temporarily static and may not reflect the current live account configuration. This is expected to be resolved in an upcoming release.

Breaking Changes

No breaking changes in this release.

Full Changelog

v0.3.5-beta.0…main

v0.3.4-beta.0 → v0.3.5-beta.0

Release date: 2026-08-05 Previous version: 0.3.4-beta.0

What's New

SLA / Overdue data on every conversation

Conversation now always includes an sla object — the expiry time of the conversation's Expected Time To Resolution (as a server timestamp), whether it was set manually or automatically, and whether it's currently urgent. This lets an integrator calculate and display an "Overdue" state without separately tracking SLA timers themselves.

Message events can carry arbitrary UMS metadata

Message events received through the SDK's event stream can now include a metadata field carrying whatever arbitrary metadata UMS attached to the underlying event, in addition to the existing originator role/metadata/client-properties context.

Smaller auth popup

The SSO/IDP login popup is now sized closer to a typical login form instead of a larger general-purpose window.

Public API Changes

Added

Changed

Conversation.lastMessageText was removed and replaced by Conversation.lastMessage — ⚠️ see Breaking Changes.

Removed

• Conversation.lastMessageText ⚠️ Breaking. Replaced by the more detailed Conversation.lastMessage — see Migration Guide.

Bug Fixes

Privilege-denied REST responses no longer force a full logout

Previously, any HTTP 401 from an account-context REST call was treated as a terminated session, forcing the agent to log out — even when the actual cause was a privilege-gated action being denied on an otherwise-valid session. The SDK now attempts a token refresh first: if the session is still genuinely valid, the privilege rejection is surfaced as a regular error and the agent stays logged in; only a session that's actually dead triggers a logout, matching the original behavior for that case.

Breaking Changes

Migration Guide

Conversation.lastMessageText replaced by Conversation.lastMessage

Before:

const preview = conversation.lastMessageText ?? '';

After:

const preview = conversation.lastMessage?.message ?? '';
// Additional context now available on the same object:
// conversation.lastMessage?.serverTimestamp, .originatorId, .originatorRole,
// .messageAudience, .contentType, .dialogId, .sequence

Full Changelog

v0.3.4-beta.0…origin/main

v0.3.2-beta.0 → v0.3.4-beta.0

Release date: 2026-07-29 Previous version: 0.3.2-beta.0

What's New

Join a conversation as a read-only observer

Agents and managers can now join an active conversation in a non-participating, read-only capacity via the conversation/join-as-reader action, instead of only being able to join as a full participant. This supports oversight and coaching workflows where a manager wants visibility into a live conversation without appearing as an assigned agent.

Conversation takeover

A new conversation/takeover action lets an agent manager take over an active conversation from another agent, becoming the new assigned agent while the previous owner is removed from that role. The change is observable through the existing conversation update stream, so integrators building a supervisor view can reflect ownership changes in real time without polling.

Custom Away status reasons

Agents can now attach a configured reason (e.g. "Lunch", "Meeting") when going into an Away state. A new agent-state/custom-away-reasons action retrieves the account's configured reason list, and setting agent state now accepts an optional reason alongside the status itself.

Manual SLA / response-time override

A new conversation/set-sla action lets an integrator manually set or restore a conversation's target response time (ETTR), supporting workflows where an agent or supervisor needs to override the default SLA countdown for a specific conversation.

Attaching metadata to conversation transfers

Transferring a conversation can now carry additional metadata (for example, a transfer reason code) alongside the transfer itself, closing a gap where this context was previously impossible to record through the SDK.

Expanded consumer profile updates

Updating a consumer's profile on behalf of an agent now supports more than just name changes — email, phone, avatar URL, background image, and description can all be set independently, and any field left out is no longer overwritten. This update is gated by the combination of an account feature and an agent privilege, so integrators can drive their own UI based on whether the current agent is allowed to make the change.

Conversation history search

Three history-search capabilities that previously existed only as an untyped escape hatch are now part of the SDK's typed public surface: searching all of an account's historical conversations with rich filtering (date range, skill, agent, keyword, and more), retrieving a single consumer's past conversations, and looking up a specific conversation's structured data by ID. Integrators building "conversation history" or "customer context" panels now get full TypeScript support for the request filters and the returned conversation records.

Resume conversation improvements

Resuming a closed conversation is now more robust: the action returns the ID of the newly created conversation directly, campaign information can be attached to the new conversation, and if the consumer already has another open conversation, the SDK automatically recovers by returning that conversation's ID instead of failing outright.

Full session and agent configuration exposure

The session object returned after connecting now exposes the agent's raw privileges, account feature flags, and site settings, in addition to a much larger set of derived, ready-to-use configuration flags — covering things like auto-accept, per-status transfer permissions, SLA timers, rich content and formatting toggles, and conversation-timeout behavior. This lets an integrator drive custom UI behavior (what to show, what to allow) directly from one place instead of re-deriving it from raw account configuration.

Richer message originator context

Message events received through the SDK's event stream can now include the full originator metadata and the originator's client/device properties (such as browser and enabled features), not just the originator's role as before. This gives integrators more context about who — or what client — sent a given message.

Restructured user profile types

The profile data returned for agents and consumers is now described by clearly documented, purpose-specific types instead of one loosely-defined shape, making it easier to know which fields to expect depending on whether a profile belongs to a consumer or an agent.

Session storage moved to session-scoped storage

For improved security, the SDK's persisted authentication token and login handshake state no longer survive a full browser restart. Closing the browser now requires the agent to log in again on the next visit, reducing the exposure window for token theft on a shared or compromised machine.

Public API Changes

Added

Changed

getSession() now returns a fully frozen, deep-copied snapshot — previously, privileges, features, and siteSettings on the returned session were not consistently protected from mutation, and callers could accidentally affect internal SDK state by modifying the returned object.

// Before
const session = client.getSession();
session.roles.push('EXTRA'); // mutation error not guaranteed to be silent/consistent across fields

// After
const session = client.getSession();
session.roles.push('EXTRA'); // throws — every field on the returned object is frozen

AgentPermissions.view has been removed and merged into AgentPermissions.configuration:

// Before
session.permissions.view.allConversations
session.permissions.view.agentList

// After
session.permissions.configuration.allConversations
session.permissions.configuration.agentList

The agent-state/set dispatch value is now an object, not a bare string, so a custom Away reason can be attached:

// Before
await client.dispatch({ action: 'agent-state/set', value: 'AWAY' });

// After
await client.dispatch({ action: 'agent-state/set', value: { state: 'AWAY', reasonId: '42' } });

The conversation/leave dispatch value is now an object, not a bare conversation ID, to support the new join-as-reader role:

// Before
await client.dispatch({ action: 'conversation/leave', value: 'conv-123' });

// After
await client.dispatch({
  action: 'conversation/leave',
  value: { conversationId: 'conv-123', role: 'MANAGER' },
});

conversation/resume now resolves with the new conversation's ID instead of void, and ResumeConversationOptions.campaignInfo is now a structured CampaignInfo object instead of unknown:

// Before
await client.dispatch({ action: 'conversation/resume', value: { /* ... */ } }); // resolves void

// After
const newConversationId = await client.dispatch({
  action: 'conversation/resume',
  value: { /* ..., */ campaignInfo: { campaignId: 'c1', engagementId: 'e1' } },
});

SetUserProfileOptions.firstName and .lastName are now optional (not a breaking change, but notable): a profile/set call can now update any subset of supported fields instead of requiring both name fields every time.

profile/get now resolves UserProfile instead of AgentUserProfile — see the Removed section and Migration Guide for the shape change.

Note: No API reference file (api.md) was present in the repository at this comparison point, so this section is based entirely on the source diff, per the command's ground-truth rule. There was no generated file to cross-check against or reconcile artifacts with.

Removed

• MessagingClient.agentClient getter ⚠️ Breaking. This was documented as an "advanced/escape-hatch" accessor to the underlying agent client and has been removed with no direct replacement. All supported operations are available through dispatch() and the named MessagingClient methods.
• MessagingClient.agentId getter ⚠️ Breaking. Use client.getSession()?.agentId instead.
• MessagingClient.accountId getter ⚠️ Breaking. Use client.getSession()?.accountId instead.
• Root-level TokenManager export ⚠️ Breaking. TokenManager is no longer exported from the SDK's main entrypoint. The package currently defines only a single public entrypoint (its root), so there is no other supported subpath from which to import it in the published package.
• PermissionDeniedError export ⚠️ Breaking. This error class was exported but never thrown by the SDK — no dispatch action performed a client-side permission check before sending a request to the server. Authorization failures surface as a generic UmsError from the underlying service instead.
• AgentUserProfile type ⚠️ Breaking. Replaced by ConsumerProfile, AgentProfile, and the combined UserProfile type — see the Migration Guide.

Bug Fixes

Session data could leak mutable internal state

Previously, calling getSession() did not consistently protect every field of the returned session from mutation, and the session was not fully cleared when a client disconnected. Both issues are fixed: getSession() now always returns a deep-frozen snapshot, and the session is properly reset on disconnect so a stale session cannot be read afterward.

Agents were left in a stale, half-authenticated state after a server-side session invalidation

If an agent's session was invalidated on the server (for example, logging in again from a second browser), the SDK previously had no way to detect this — the app would continue operating as if still connected, with no user-visible signal that anything was wrong. The SDK now recognizes this condition and automatically logs the agent out client-side: it ends the connection, clears the persisted session, and notifies other open tabs of the same login so they log out too.

Breaking Changes

Migration Guide

MessagingClient.agentClient / .agentId / .accountId removed

TokenManager no longer exported

// Before
import { TokenManager } from '@liveperson/messaging-web-client-sdk';

// After
// No direct replacement in v0.3.4-beta.0 — TokenManager is not part of the public API.

PermissionDeniedError removed

This class was never thrown by the SDK. If your code imported it defensively (e.g. in a catch block's instanceof check), remove that check — permission failures from the server surface as UmsError.

AgentUserProfile replaced by ConsumerProfile / AgentProfile / UserProfile

// Before
import type { AgentUserProfile } from '@liveperson/messaging-web-client-sdk';

function show(profile: AgentUserProfile) {
  console.log(profile.firstName, profile.lastName, profile.role);
}

// After
import type { UserProfile } from '@liveperson/messaging-web-client-sdk';

function show(profile: UserProfile) {
  console.log(profile.firstName, profile.lastName);
  // `role` is no longer part of the profile shape.
}

profile/get resolves UserProfile instead of AgentUserProfile. Consumer-specific fields (lastName, mobileNumber, description, claims, acr) live on ConsumerProfile; agent-specific fields (id, maxSlots, skillIds, permissionGroups, employeeId, userTypeId, active) live on AgentProfile. UserProfile combines both, since the same dispatch action returns either shape depending on context.

AgentPermissions.view merged into configuration

// Before
session.permissions.view.allConversations
session.permissions.view.agentList

// After
session.permissions.configuration.allConversations
session.permissions.configuration.agentList

agent-state/set dispatch value is now an object

// Before
await client.dispatch({ action: 'agent-state/set', value: 'AWAY' });

// After
await client.dispatch({ action: 'agent-state/set', value: { state: 'AWAY' } });
// with a custom reason:
await client.dispatch({ action: 'agent-state/set', value: { state: 'AWAY', reasonId: '42' } });

conversation/leave dispatch value is now an object

// Before
await client.dispatch({ action: 'conversation/leave', value: 'conv-123' });

// After
await client.dispatch({
  action: 'conversation/leave',
  value: { conversationId: 'conv-123', role: 'MANAGER' },
});

ResumeConversationOptions.campaignInfo is now a structured object

// Before
await client.dispatch({
  action: 'conversation/resume',
  value: { /* ..., */ campaignInfo: { anything: 'goes' } },
});

// After
await client.dispatch({
  action: 'conversation/resume',
  value: { /* ..., */ campaignInfo: { campaignId: 'c1', engagementId: 'e1' } },
});

Full Changelog

v0.3.2-beta.0…v0.3.4-beta.0

v0.2.12-beta.0 → v0.3.2-beta.0

Release date: 2026-07-13 Previous version: 0.2.12-beta.0

What's New

Full session and permissions model after login

getSession() now returns a fully-resolved session for the authenticated agent, including their display name, login name, assigned roles, and a structured permissions object describing exactly which dispatch() actions they're allowed to invoke, plus account-level view and configuration capabilities (e.g. whether rich content or private/whisper messaging is enabled for the account). create() proactively loads this information — account features, skills, users, and the agent's permissions — before it resolves, so integrators no longer need a separate round trip after connecting to know what the current agent can and can't do. A permissionsReady flag distinguishes real, loaded permission data from the safe all-false default used if that initial fetch fails, so a UI can tell the difference between "not allowed" and "not yet known."

Manual conversation transfer

Agents can now transfer an active conversation to a skill or to a specific agent via dispatch({ action: 'conversation/transfer', ... }). Two new actions — account/skills and account/users — expose the account's skill list and agent roster (already loaded at connect time) so a custom UI can build its own transfer picker without an extra network call. This capability was removed in a previous release and is now available again, with an expanded shape that lets callers specify the target agent's own skill for correct routing when that agent covers more than one skill.

Search across conversation history

Three new dispatch() actions give integrators access to conversation history beyond what's held in memory from the live event stream: conversation/filter-history-conversations runs a filtered search across all of the account's historical conversations (by status, date range, agent, skill, keyword, and more), conversation/search-by-id looks up a single conversation's full history record, and conversation/get-consumer-conversations retrieves a specific consumer's past conversations. This supports building search, audit, and "customer history" views on top of the SDK.

Quick Replies in messages

Text and rich messages can now carry a quickReplies payload — a row of selectable buttons — on both send and receive. This lets an integrator's UI present a consumer or agent with a small set of pre-defined response options alongside a message, matching the same capability available in LivePerson's Agent Workspace.

Attaching a summary note to a conversation

A new conversation/set-summary-note action lets an agent attach an internal summary note to a conversation, separate from the visible message stream.

Updating an agent's profile

A new profile/set action lets an integrator update the authenticated user's first and last name.

Centered pop-up window for SSO login

SSO/IDP login now opens in a centered, fixed-size pop-up window instead of a new browser tab, matching the pattern used by Google and other common OAuth flows. The pop-up automatically closes once authentication completes. If the browser blocks the pop-up, the SDK surfaces a clear error so the host application can prompt the agent to allow pop-ups for the site, rather than login silently failing.

Public API Changes

Added

Note: packages/sdk/api/messaging-web-client-sdk.api.md was not present to cross-check against for this release; the source files above are the sole basis for this section.

Changed

SessionObject — ⚠️ see Breaking Changes below.

// Before
export interface SessionObject {
  readonly agentId: string;
  readonly agentName: string;
  readonly accountId: string;
}

// After
export interface SessionObject {
  readonly agentId: string;
  readonly accountId: string;
  readonly displayName: string;
  readonly loginName: string;
  readonly roles: string[];
  readonly permissions: AgentPermissions;
  readonly permissionsReady: boolean;
}

MessageReceiveValue.content — widened to optionally carry a quickReplies payload:

// Before
readonly content: { type: string; text?: string; content?: Record<string, unknown> };

// After
readonly content: {
  type: string;
  text?: string;
  content?: Record<string, unknown>;
  quickReplies?: QuickReplies;
};

SendMessageOptions.content — widened to optionally carry quickReplies on both text and rich messages:

// Before
content: { type: 'text'; text: string } | { type: 'rich'; content: Record<string, unknown> };

// After
content:
  | { type: 'text'; text: string; quickReplies?: QuickReplies }
  | { type: 'rich'; content: Record<string, unknown>; quickReplies?: QuickReplies };

This is additive — existing code that only sets type/text/content continues to work unchanged.

Chat state — 'PAUSE' is now a valid value for ConversationChatStateAction.value.state and SendChatStateOptions.state, alongside the existing 'COMPOSING' and 'ACTIVE'.

TransferConversationOptions.target — the agent-transfer branch gains an optional skillId, identifying the target agent's own skill so the transfer routes correctly when that agent covers more than one skill:

// Before
target: { type: 'skill'; id: string } | { type: 'agent'; id: string };

// After
target: { type: 'skill'; id: string } | { type: 'agent'; id: string; skillId?: string };

Token refresh behavior — ⚠️ see Breaking Changes below.

Removed

No public exports were removed in this release.

Bug Fixes

Agent identity no longer resets during token refresh

Previously, if a session's token-refresh response did not include the agent's identity claim, the SDK would silently reset the agent's ID to an empty string while continuing to use the old, expired token. Depending on the situation, this either surfaced as an unexplained login error or, in some cases, an unhandled crash the next time the client tried to load account data with a blank agent ID. Once an agent's identity is established for a session, it's now retained across every subsequent refresh, so a refresh response that omits identity information can no longer put the session into this broken state.

Breaking Changes

Migration Guide

SessionObject.agentName was removed

Before:

const { session } = await MessagingClient.create(options);
console.log(session.agentName);

After:

const { session } = await MessagingClient.create(options);
console.log(session.displayName);

There is no single-field equivalent of the old agentName beyond displayName — loginName and roles are also newly available on the same object if your integration needs them.

Handling the end of a long-idle session

Before: no action was required — the SDK refreshed the token in the background regardless of activity.

After: register a handler for session/end and prompt re-authentication when it fires, since a long-idle session's token is no longer refreshed until the next dispatch() call:

client.on({
  callback: (event) => {
    if (event.type === 'session/end') {
      // Show a "please log in again" prompt.
    }
  },
});

Full Changelog

v0.2.12-beta.0…v0.3.2-beta.0

v0.2.11-beta.0 → v0.2.12-beta.0

Release date: 2026-06-25 Previous version: 0.2.11-beta.0

What's New

Resume a closed conversation

Agents can now resume a previously closed conversation instead of asking a returning consumer to start over. Dispatching the new conversation/resume action creates a fresh conversation pre-linked to the original one and immediately sends a message into it, so the consumer's prior context carries forward without the agent needing to re-establish it manually.

Rich content messages are now surfaced on receive

Incoming structured (rich) content messages — previously only recognized as plain text — now arrive through the same message-receive path as text messages, with a type flag distinguishing them and the full structured payload attached. Integrators rendering a conversation view can now display cards, carousels, and other structured content sent by consumers or other agents, instead of that content being dropped or misread as plain text.

Public API Changes

Added

Note: None of these additions appear in messaging-web-client-sdk.api.md — that generated file was not refreshed for this release. The source is authoritative here; treat the API reference doc as stale until it is regenerated.

Changed

MessageReceiveValue.content was widened to optionally carry a structured payload alongside its existing text field, to support the new rich-content-on-receive behavior described above.

Before:

readonly content: { type: string; text?: string };

After:

readonly content: { type: string; text?: string; content?: Record<string, unknown> };

Existing integrations that only read content.text are unaffected — type continues to distinguish 'text' from 'rich', and the new content field is only present (and only needs to be read) for rich messages.

Removed

• ConversationTransferAction (the 'conversation/transfer' dispatch() action) — ⚠️ Breaking. The ability to transfer a conversation to a skill or another agent via dispatch({ action: 'conversation/transfer', ... }) was removed from the public DispatchPayload union and from DispatchReturnMap in this release. The TransferConversationOptions type remains exported for now, but no dispatch() action references it anymore, so it has no functional use in this version.

Bug Fixes

Agent session is now properly ended on disconnect

Previously, calling disconnect (or being disconnected automatically after the server invalidated a session) did not notify the routing backend that the agent's session had ended. This release adds that notification as part of the disconnect flow, so an agent's session state is consistently and correctly closed out on the server side whenever the SDK disconnects — including when the same agent's session is terminated because they logged in elsewhere.

Hardened URL handling for file transfers

File upload and download URLs returned by the server are now validated before being used, and are rejected if they are missing, malformed, or not HTTPS. This closes a gap where the SDK would previously have attempted a network request against whatever URL shape the server response contained.

Dependency security patches

Two development-tooling dependencies used to build and generate the SDK's documentation site were upgraded to pick up published security fixes (including fixes tracked under CVE-2026-53571, CVE-2026-53632, and GHSA-h67p-54hq-rp68). These are build-time-only tools and are not part of the runtime bundle shipped to browsers, so there is no functional change for integrators — this is a supply-chain hygiene improvement.

Breaking Changes

Migration Guide

conversation/transfer was removed

Before:

await client.dispatch({
  action: 'conversation/transfer',
  value: {
    conversationId: 'conv_123',
    target: { type: 'skill', id: 'skill_456' },
  },
});

After:

No direct replacement in v0.2.12-beta.0. There is no dispatch() action that performs a conversation transfer in this release — remove or gate any code path that depends on conversation/transfer until a replacement ships in a later version.

Full Changelog

7b59fea…0398d1a