@aforoai/storefront-widgets 1.0.2 → 1.0.4

package/dist/{AforoEmbed-CmqjlYlt.d.ts → AforoEmbed-BkJF1hAN.d.ts}

@@ -1,4 +1,4 @@
-import { aD as WidgetMountConfig, Q as AforoEventType, N as AforoEventPayload, aC as WidgetId } from './types-Dm6cp_Cc.js';
+import { aD as WidgetMountConfig, Q as AforoEventType, N as AforoEventPayload, aC as WidgetId } from './types-BbQw2_32.js';
 
 /**
  * AforoEmbed — vanilla-JS + script-tag mount API.

package/dist/{AforoEmbed-BqQOFsl3.d.cts → AforoEmbed-VYb6_GXB.d.cts}

@@ -1,4 +1,4 @@
-import { aD as WidgetMountConfig, Q as AforoEventType, N as AforoEventPayload, aC as WidgetId } from './types-Dm6cp_Cc.cjs';
+import { aD as WidgetMountConfig, Q as AforoEventType, N as AforoEventPayload, aC as WidgetId } from './types-BbQw2_32.cjs';
 
 /**
  * AforoEmbed — vanilla-JS + script-tag mount API.

package/dist/index.cjs

@@ -35,7 +35,7 @@ var BridgeClientError = class extends Error {
     this.retryable = retryable;
   }
 };
-var DEFAULT_BASE = "https://embed.aforo.ai";
+var DEFAULT_BASE = "https://storefront.aforo.ai";
 var DEFAULT_TIMEOUT_MS = 15e3;
 function uuidv4() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
@@ -223,10 +223,23 @@ var _BridgeClient = class _BridgeClient {
   /**
    * Headless config — the PricingCard widget's primary read path.
    *
-   * Mirrors `GET /api/v1/portal/headless/config` which returns
-   * `{branding, offerings, ratePlans, themeTokens, customPages, ...}`
-   * denormalized JSON. The endpoint is 60s Caffeine-cached server-side; we
-   * cache once per widget instance on the client.
+   * Hits `GET /api/v1/portal/embed/tenant-config/{slug}` — the SAME
+   * embed-key-authenticated endpoint {@link getTenantBrandKit} uses, now
+   * extended server-side with `offerings` + `embeddableWidget`. This was
+   * previously wired to `GET /api/v1/portal/headless/config`, an unrelated
+   * T6 Headless-tier endpoint that requires `X-Storefront-Key`/
+   * `X-Tenant-Id` auth — headers the embed key flow never sends. Every
+   * embed-tier fetch against that URL failed 400 "Missing tenant
+   * identification" by construction; this endpoint is scoped to the same
+   * `EmbedKeyAuthFilter` gate as the rest of the embed plane, so the
+   * `Authorization: Bearer <embed_key>` header `buildHeaders()` already
+   * sends is sufficient.
+   *
+   * The backend response is still a flat record (`tenantSlug,
+   * primaryColor, secondaryColor, logoUrl, fontFamily, offerings,
+   * embeddableWidget`) — kept flat so `getTenantBrandKit()`'s existing
+   * consumers (the ThemeReader cascade) are unaffected. This method nests
+   * the branding fields into the shape `HeadlessConfigResponse` expects.
    *
    * Pattern #18 fail-soft — returns `null` on transport failure, 404, or
    * malformed JSON. Widgets fall through to their empty / error state and
@@ -241,7 +254,7 @@ var _BridgeClient = class _BridgeClient {
     }
     const target = slug || this.tenantSlug;
     if (!target) return null;
-    const url = `${this.baseUrl}/api/v1/portal/headless/config?tenantSlug=${encodeURIComponent(target)}`;
+    const url = `${this.baseUrl}/api/v1/portal/embed/tenant-config/${encodeURIComponent(target)}`;
     let resp;
     try {
       resp = await this.send(url, {
@@ -254,7 +267,18 @@ var _BridgeClient = class _BridgeClient {
     if (!resp.ok) return null;
     try {
       const body = await resp.json();
-      return body && typeof body === "object" ? body : null;
+      if (!body || typeof body !== "object") return null;
+      return {
+        tenantSlug: body.tenantSlug,
+        branding: {
+          primaryColor: body.primaryColor ?? null,
+          secondaryColor: body.secondaryColor ?? null,
+          logoUrl: body.logoUrl ?? null,
+          fontFamily: body.fontFamily ?? null
+        },
+        offerings: Array.isArray(body.offerings) ? body.offerings : [],
+        embeddableWidget: body.embeddableWidget ?? null
+      };
     } catch {
       return null;
     }
@@ -1759,9 +1783,10 @@ var AforoSession = {
     };
     sessions.set(k, entry);
     if (config.bridgeToken) {
-      entry.pendingExchange = refreshSession(entry).catch((err) => {
-        throw err;
+      const exchangePromise = refreshSession(entry);
+      exchangePromise.catch(() => {
       });
+      entry.pendingExchange = exchangePromise;
     } else if (config.magicLinkMode) {
       const tokenInUrl = readMagicTokenFromUrl();
       if (tokenInUrl) {
@@ -1771,6 +1796,8 @@ var AforoSession = {
           pending = runMagicLinkVerify(entry, tokenInUrl).finally(() => {
             pendingMagicLinkVerifies.delete(dedupKey);
           });
+          pending.catch(() => {
+          });
           pendingMagicLinkVerifies.set(dedupKey, pending);
         }
         entry.pendingExchange = pending;
@@ -12148,7 +12175,7 @@ function ResultPanel({
 }
 
 // src/core/version.ts
-var VERSION = "1.0.2";
+var VERSION = "1.0.4";
 
 // src/core/AforoEmbed.ts
 var mountedElements = /* @__PURE__ */ new WeakMap();

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import * as React from 'react';
-import { T as ThemeTokenOverrides, O as OfferingPayload, H as HeadlessConfigResponse, S as SubscriptionPayload, W as WidgetErrorPayload, a as SubscriptionForOfferingResponse, C as CheckoutCartType, b as CheckoutConfirmedPayload, c as CheckoutCancelledPayload, d as CheckoutCartResponse, e as SubscriptionStatusFilter, f as SubscriptionPayloadV2, g as SubscriptionPageResponse, I as InvoiceStatusFilter, h as InvoicePayload, i as InvoicePageResponse, U as UsageMetricPayload, j as UsageThreshold, k as UsageResponse, P as PaymentMethodListResponse, A as ApplyAt, l as UpgradeCancelResultPayload, D as DemoModeBridgeProvider, m as TenantBrandKit, n as InitiateCheckoutRequest, o as InitiateCheckoutResponse, p as InvoiceListFilter, q as InvoicePdfUrlResponse, r as InitiateInvoicePaymentRequest, s as InitiateInvoicePaymentResponse, t as CreateCartRequest, u as UpdateCustomerDetailsRequest, v as InitiateCartPaymentRequest, w as ConfirmCartResponse, R as RequestMagicLinkRequest, x as RequestMagicLinkResponse, V as VerifyMagicLinkResponse, y as SubscriptionListFilter, z as PreviewChangeRequest, B as PreviewChangeResponse, E as UpgradeRequest, F as UpgradeResponse, G as CancelWithFeedbackRequest, J as CancelResponse, K as SetupIntentResponse, L as SessionConfig, M as SessionState } from './types-Dm6cp_Cc.cjs';
-export { N as AforoEventPayload, Q as AforoEventType, X as CancelReason, Y as CheckoutBillingAddress, Z as CheckoutCartErrorResponse, _ as CheckoutCartStatus, $ as CheckoutCustomerDetailsSubmittedPayload, a0 as CheckoutExpiredPayload, a1 as CheckoutFlowPhase, a2 as CheckoutPaymentCompletedPayload, a3 as CheckoutPaymentInitiatedPayload, a4 as CheckoutPaymentProvider, a5 as CheckoutStepChangedPayload, a6 as ConsentState, a7 as FeaturePayload, a8 as HeadlessBrandingPayload, a9 as InvoiceDownloadedPayload, aa as InvoiceExpandedPayload, ab as InvoiceFilterChangedPayload, ac as InvoicePaidPayload, ad as InvoicePayRequestedPayload, ae as InvoiceSearchChangedPayload, af as InvoiceStatus, ag as InvoiceTypeKind, ah as LiveSubscriptionStatus, ai as MagicLinkFailureCode, aj as OfferingSummary, ak as RatePlanPayload, al as RetentionOfferShown, am as RetentionOutcome, an as SubscriptionCancelRequestedPayload, ao as SubscriptionChangeType, ap as SubscriptionClickedPayload, aq as SubscriptionFilterChangedPayload, ar as SubscriptionStatus, as as SubscriptionUpgradeRequestedPayload, at as ThemeTokens, au as UpgradeCancelAbandonedPayload, av as UpgradeCancelCompletedPayload, aw as UpgradeCancelDeflectionOfferAcceptedPayload, ax as UpgradeCancelDeflectionOfferShownPayload, ay as UpgradeCancelPreviewFetchedPayload, az as UpgradeCancelStepChangedPayload, aA as UsageMetricClickedPayload, aB as UsageThresholdReachedPayload, aC as WidgetId, aD as WidgetMountConfig } from './types-Dm6cp_Cc.cjs';
-export { A as AforoEmbed } from './AforoEmbed-BqQOFsl3.cjs';
+import { T as ThemeTokenOverrides, O as OfferingPayload, H as HeadlessConfigResponse, S as SubscriptionPayload, W as WidgetErrorPayload, a as SubscriptionForOfferingResponse, C as CheckoutCartType, b as CheckoutConfirmedPayload, c as CheckoutCancelledPayload, d as CheckoutCartResponse, e as SubscriptionStatusFilter, f as SubscriptionPayloadV2, g as SubscriptionPageResponse, I as InvoiceStatusFilter, h as InvoicePayload, i as InvoicePageResponse, U as UsageMetricPayload, j as UsageThreshold, k as UsageResponse, P as PaymentMethodListResponse, A as ApplyAt, l as UpgradeCancelResultPayload, D as DemoModeBridgeProvider, m as TenantBrandKit, n as InitiateCheckoutRequest, o as InitiateCheckoutResponse, p as InvoiceListFilter, q as InvoicePdfUrlResponse, r as InitiateInvoicePaymentRequest, s as InitiateInvoicePaymentResponse, t as CreateCartRequest, u as UpdateCustomerDetailsRequest, v as InitiateCartPaymentRequest, w as ConfirmCartResponse, R as RequestMagicLinkRequest, x as RequestMagicLinkResponse, V as VerifyMagicLinkResponse, y as SubscriptionListFilter, z as PreviewChangeRequest, B as PreviewChangeResponse, E as UpgradeRequest, F as UpgradeResponse, G as CancelWithFeedbackRequest, J as CancelResponse, K as SetupIntentResponse, L as SessionConfig, M as SessionState } from './types-BbQw2_32.cjs';
+export { N as AforoEventPayload, Q as AforoEventType, X as CancelReason, Y as CheckoutBillingAddress, Z as CheckoutCartErrorResponse, _ as CheckoutCartStatus, $ as CheckoutCustomerDetailsSubmittedPayload, a0 as CheckoutExpiredPayload, a1 as CheckoutFlowPhase, a2 as CheckoutPaymentCompletedPayload, a3 as CheckoutPaymentInitiatedPayload, a4 as CheckoutPaymentProvider, a5 as CheckoutStepChangedPayload, a6 as ConsentState, a7 as FeaturePayload, a8 as HeadlessBrandingPayload, a9 as InvoiceDownloadedPayload, aa as InvoiceExpandedPayload, ab as InvoiceFilterChangedPayload, ac as InvoicePaidPayload, ad as InvoicePayRequestedPayload, ae as InvoiceSearchChangedPayload, af as InvoiceStatus, ag as InvoiceTypeKind, ah as LiveSubscriptionStatus, ai as MagicLinkFailureCode, aj as OfferingSummary, ak as RatePlanPayload, al as RetentionOfferShown, am as RetentionOutcome, an as SubscriptionCancelRequestedPayload, ao as SubscriptionChangeType, ap as SubscriptionClickedPayload, aq as SubscriptionFilterChangedPayload, ar as SubscriptionStatus, as as SubscriptionUpgradeRequestedPayload, at as ThemeTokens, au as UpgradeCancelAbandonedPayload, av as UpgradeCancelCompletedPayload, aw as UpgradeCancelDeflectionOfferAcceptedPayload, ax as UpgradeCancelDeflectionOfferShownPayload, ay as UpgradeCancelPreviewFetchedPayload, az as UpgradeCancelStepChangedPayload, aA as UsageMetricClickedPayload, aB as UsageThresholdReachedPayload, aC as WidgetId, aD as WidgetMountConfig } from './types-BbQw2_32.cjs';
+export { A as AforoEmbed } from './AforoEmbed-VYb6_GXB.cjs';
 export { EmbedEnvironment, EmbedKey } from '@aforoai/types';
 
 /**
@@ -639,7 +639,7 @@ declare function AforoUpgradeCancel(props: AforoUpgradeCancelProps): React.React
  *   POST /api/v1/portal/embed/bridge/exchange       — bridge JWT → session JWT
  *   POST /api/v1/portal/embed/bridge/refresh        — session JWT refresh (Prompt 8)
  *   POST /api/v1/portal/embed/telemetry             — telemetry batch sink
- *   GET  /api/v1/portal/embed/tenant-config/{slug}  — brand kit (this Prompt)
+ *   GET  /api/v1/portal/embed/tenant-config/{slug}  — brand kit + offerings + embeddableWidget
  *   GET  /api/v1/portal/embed/health                — public liveness
  *
  * Headers:
@@ -657,7 +657,7 @@ declare function AforoUpgradeCancel(props: AforoUpgradeCancelProps): React.React
 
 type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 interface BridgeClientOptions {
-    /** Default `https://embed.aforo.ai`. Override for tests / dev. */
+    /** Default `https://storefront.aforo.ai` (the storefront-service BFF, not the embed.aforo.ai CDN). Override for tests / dev. */
     embedBaseUrl?: string;
     /** Embed key (Bearer token for all embed-key-gated endpoints). */
     embedKey: string;
@@ -707,10 +707,23 @@ declare class BridgeClient {
     /**
      * Headless config — the PricingCard widget's primary read path.
      *
-     * Mirrors `GET /api/v1/portal/headless/config` which returns
-     * `{branding, offerings, ratePlans, themeTokens, customPages, ...}`
-     * denormalized JSON. The endpoint is 60s Caffeine-cached server-side; we
-     * cache once per widget instance on the client.
+     * Hits `GET /api/v1/portal/embed/tenant-config/{slug}` — the SAME
+     * embed-key-authenticated endpoint {@link getTenantBrandKit} uses, now
+     * extended server-side with `offerings` + `embeddableWidget`. This was
+     * previously wired to `GET /api/v1/portal/headless/config`, an unrelated
+     * T6 Headless-tier endpoint that requires `X-Storefront-Key`/
+     * `X-Tenant-Id` auth — headers the embed key flow never sends. Every
+     * embed-tier fetch against that URL failed 400 "Missing tenant
+     * identification" by construction; this endpoint is scoped to the same
+     * `EmbedKeyAuthFilter` gate as the rest of the embed plane, so the
+     * `Authorization: Bearer <embed_key>` header `buildHeaders()` already
+     * sends is sufficient.
+     *
+     * The backend response is still a flat record (`tenantSlug,
+     * primaryColor, secondaryColor, logoUrl, fontFamily, offerings,
+     * embeddableWidget`) — kept flat so `getTenantBrandKit()`'s existing
+     * consumers (the ThemeReader cascade) are unaffected. This method nests
+     * the branding fields into the shape `HeadlessConfigResponse` expects.
      *
      * Pattern #18 fail-soft — returns `null` on transport failure, 404, or
      * malformed JSON. Widgets fall through to their empty / error state and

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as React from 'react';
-import { T as ThemeTokenOverrides, O as OfferingPayload, H as HeadlessConfigResponse, S as SubscriptionPayload, W as WidgetErrorPayload, a as SubscriptionForOfferingResponse, C as CheckoutCartType, b as CheckoutConfirmedPayload, c as CheckoutCancelledPayload, d as CheckoutCartResponse, e as SubscriptionStatusFilter, f as SubscriptionPayloadV2, g as SubscriptionPageResponse, I as InvoiceStatusFilter, h as InvoicePayload, i as InvoicePageResponse, U as UsageMetricPayload, j as UsageThreshold, k as UsageResponse, P as PaymentMethodListResponse, A as ApplyAt, l as UpgradeCancelResultPayload, D as DemoModeBridgeProvider, m as TenantBrandKit, n as InitiateCheckoutRequest, o as InitiateCheckoutResponse, p as InvoiceListFilter, q as InvoicePdfUrlResponse, r as InitiateInvoicePaymentRequest, s as InitiateInvoicePaymentResponse, t as CreateCartRequest, u as UpdateCustomerDetailsRequest, v as InitiateCartPaymentRequest, w as ConfirmCartResponse, R as RequestMagicLinkRequest, x as RequestMagicLinkResponse, V as VerifyMagicLinkResponse, y as SubscriptionListFilter, z as PreviewChangeRequest, B as PreviewChangeResponse, E as UpgradeRequest, F as UpgradeResponse, G as CancelWithFeedbackRequest, J as CancelResponse, K as SetupIntentResponse, L as SessionConfig, M as SessionState } from './types-Dm6cp_Cc.js';
-export { N as AforoEventPayload, Q as AforoEventType, X as CancelReason, Y as CheckoutBillingAddress, Z as CheckoutCartErrorResponse, _ as CheckoutCartStatus, $ as CheckoutCustomerDetailsSubmittedPayload, a0 as CheckoutExpiredPayload, a1 as CheckoutFlowPhase, a2 as CheckoutPaymentCompletedPayload, a3 as CheckoutPaymentInitiatedPayload, a4 as CheckoutPaymentProvider, a5 as CheckoutStepChangedPayload, a6 as ConsentState, a7 as FeaturePayload, a8 as HeadlessBrandingPayload, a9 as InvoiceDownloadedPayload, aa as InvoiceExpandedPayload, ab as InvoiceFilterChangedPayload, ac as InvoicePaidPayload, ad as InvoicePayRequestedPayload, ae as InvoiceSearchChangedPayload, af as InvoiceStatus, ag as InvoiceTypeKind, ah as LiveSubscriptionStatus, ai as MagicLinkFailureCode, aj as OfferingSummary, ak as RatePlanPayload, al as RetentionOfferShown, am as RetentionOutcome, an as SubscriptionCancelRequestedPayload, ao as SubscriptionChangeType, ap as SubscriptionClickedPayload, aq as SubscriptionFilterChangedPayload, ar as SubscriptionStatus, as as SubscriptionUpgradeRequestedPayload, at as ThemeTokens, au as UpgradeCancelAbandonedPayload, av as UpgradeCancelCompletedPayload, aw as UpgradeCancelDeflectionOfferAcceptedPayload, ax as UpgradeCancelDeflectionOfferShownPayload, ay as UpgradeCancelPreviewFetchedPayload, az as UpgradeCancelStepChangedPayload, aA as UsageMetricClickedPayload, aB as UsageThresholdReachedPayload, aC as WidgetId, aD as WidgetMountConfig } from './types-Dm6cp_Cc.js';
-export { A as AforoEmbed } from './AforoEmbed-CmqjlYlt.js';
+import { T as ThemeTokenOverrides, O as OfferingPayload, H as HeadlessConfigResponse, S as SubscriptionPayload, W as WidgetErrorPayload, a as SubscriptionForOfferingResponse, C as CheckoutCartType, b as CheckoutConfirmedPayload, c as CheckoutCancelledPayload, d as CheckoutCartResponse, e as SubscriptionStatusFilter, f as SubscriptionPayloadV2, g as SubscriptionPageResponse, I as InvoiceStatusFilter, h as InvoicePayload, i as InvoicePageResponse, U as UsageMetricPayload, j as UsageThreshold, k as UsageResponse, P as PaymentMethodListResponse, A as ApplyAt, l as UpgradeCancelResultPayload, D as DemoModeBridgeProvider, m as TenantBrandKit, n as InitiateCheckoutRequest, o as InitiateCheckoutResponse, p as InvoiceListFilter, q as InvoicePdfUrlResponse, r as InitiateInvoicePaymentRequest, s as InitiateInvoicePaymentResponse, t as CreateCartRequest, u as UpdateCustomerDetailsRequest, v as InitiateCartPaymentRequest, w as ConfirmCartResponse, R as RequestMagicLinkRequest, x as RequestMagicLinkResponse, V as VerifyMagicLinkResponse, y as SubscriptionListFilter, z as PreviewChangeRequest, B as PreviewChangeResponse, E as UpgradeRequest, F as UpgradeResponse, G as CancelWithFeedbackRequest, J as CancelResponse, K as SetupIntentResponse, L as SessionConfig, M as SessionState } from './types-BbQw2_32.js';
+export { N as AforoEventPayload, Q as AforoEventType, X as CancelReason, Y as CheckoutBillingAddress, Z as CheckoutCartErrorResponse, _ as CheckoutCartStatus, $ as CheckoutCustomerDetailsSubmittedPayload, a0 as CheckoutExpiredPayload, a1 as CheckoutFlowPhase, a2 as CheckoutPaymentCompletedPayload, a3 as CheckoutPaymentInitiatedPayload, a4 as CheckoutPaymentProvider, a5 as CheckoutStepChangedPayload, a6 as ConsentState, a7 as FeaturePayload, a8 as HeadlessBrandingPayload, a9 as InvoiceDownloadedPayload, aa as InvoiceExpandedPayload, ab as InvoiceFilterChangedPayload, ac as InvoicePaidPayload, ad as InvoicePayRequestedPayload, ae as InvoiceSearchChangedPayload, af as InvoiceStatus, ag as InvoiceTypeKind, ah as LiveSubscriptionStatus, ai as MagicLinkFailureCode, aj as OfferingSummary, ak as RatePlanPayload, al as RetentionOfferShown, am as RetentionOutcome, an as SubscriptionCancelRequestedPayload, ao as SubscriptionChangeType, ap as SubscriptionClickedPayload, aq as SubscriptionFilterChangedPayload, ar as SubscriptionStatus, as as SubscriptionUpgradeRequestedPayload, at as ThemeTokens, au as UpgradeCancelAbandonedPayload, av as UpgradeCancelCompletedPayload, aw as UpgradeCancelDeflectionOfferAcceptedPayload, ax as UpgradeCancelDeflectionOfferShownPayload, ay as UpgradeCancelPreviewFetchedPayload, az as UpgradeCancelStepChangedPayload, aA as UsageMetricClickedPayload, aB as UsageThresholdReachedPayload, aC as WidgetId, aD as WidgetMountConfig } from './types-BbQw2_32.js';
+export { A as AforoEmbed } from './AforoEmbed-BkJF1hAN.js';
 export { EmbedEnvironment, EmbedKey } from '@aforoai/types';
 
 /**
@@ -639,7 +639,7 @@ declare function AforoUpgradeCancel(props: AforoUpgradeCancelProps): React.React
  *   POST /api/v1/portal/embed/bridge/exchange       — bridge JWT → session JWT
  *   POST /api/v1/portal/embed/bridge/refresh        — session JWT refresh (Prompt 8)
  *   POST /api/v1/portal/embed/telemetry             — telemetry batch sink
- *   GET  /api/v1/portal/embed/tenant-config/{slug}  — brand kit (this Prompt)
+ *   GET  /api/v1/portal/embed/tenant-config/{slug}  — brand kit + offerings + embeddableWidget
  *   GET  /api/v1/portal/embed/health                — public liveness
  *
  * Headers:
@@ -657,7 +657,7 @@ declare function AforoUpgradeCancel(props: AforoUpgradeCancelProps): React.React
 
 type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 interface BridgeClientOptions {
-    /** Default `https://embed.aforo.ai`. Override for tests / dev. */
+    /** Default `https://storefront.aforo.ai` (the storefront-service BFF, not the embed.aforo.ai CDN). Override for tests / dev. */
     embedBaseUrl?: string;
     /** Embed key (Bearer token for all embed-key-gated endpoints). */
     embedKey: string;
@@ -707,10 +707,23 @@ declare class BridgeClient {
     /**
      * Headless config — the PricingCard widget's primary read path.
      *
-     * Mirrors `GET /api/v1/portal/headless/config` which returns
-     * `{branding, offerings, ratePlans, themeTokens, customPages, ...}`
-     * denormalized JSON. The endpoint is 60s Caffeine-cached server-side; we
-     * cache once per widget instance on the client.
+     * Hits `GET /api/v1/portal/embed/tenant-config/{slug}` — the SAME
+     * embed-key-authenticated endpoint {@link getTenantBrandKit} uses, now
+     * extended server-side with `offerings` + `embeddableWidget`. This was
+     * previously wired to `GET /api/v1/portal/headless/config`, an unrelated
+     * T6 Headless-tier endpoint that requires `X-Storefront-Key`/
+     * `X-Tenant-Id` auth — headers the embed key flow never sends. Every
+     * embed-tier fetch against that URL failed 400 "Missing tenant
+     * identification" by construction; this endpoint is scoped to the same
+     * `EmbedKeyAuthFilter` gate as the rest of the embed plane, so the
+     * `Authorization: Bearer <embed_key>` header `buildHeaders()` already
+     * sends is sufficient.
+     *
+     * The backend response is still a flat record (`tenantSlug,
+     * primaryColor, secondaryColor, logoUrl, fontFamily, offerings,
+     * embeddableWidget`) — kept flat so `getTenantBrandKit()`'s existing
+     * consumers (the ThemeReader cascade) are unaffected. This method nests
+     * the branding fields into the shape `HeadlessConfigResponse` expects.
      *
      * Pattern #18 fail-soft — returns `null` on transport failure, 404, or
      * malformed JSON. Widgets fall through to their empty / error state and

package/dist/index.mjs

@@ -13,7 +13,7 @@ var BridgeClientError = class extends Error {
     this.retryable = retryable;
   }
 };
-var DEFAULT_BASE = "https://embed.aforo.ai";
+var DEFAULT_BASE = "https://storefront.aforo.ai";
 var DEFAULT_TIMEOUT_MS = 15e3;
 function uuidv4() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
@@ -201,10 +201,23 @@ var _BridgeClient = class _BridgeClient {
   /**
    * Headless config — the PricingCard widget's primary read path.
    *
-   * Mirrors `GET /api/v1/portal/headless/config` which returns
-   * `{branding, offerings, ratePlans, themeTokens, customPages, ...}`
-   * denormalized JSON. The endpoint is 60s Caffeine-cached server-side; we
-   * cache once per widget instance on the client.
+   * Hits `GET /api/v1/portal/embed/tenant-config/{slug}` — the SAME
+   * embed-key-authenticated endpoint {@link getTenantBrandKit} uses, now
+   * extended server-side with `offerings` + `embeddableWidget`. This was
+   * previously wired to `GET /api/v1/portal/headless/config`, an unrelated
+   * T6 Headless-tier endpoint that requires `X-Storefront-Key`/
+   * `X-Tenant-Id` auth — headers the embed key flow never sends. Every
+   * embed-tier fetch against that URL failed 400 "Missing tenant
+   * identification" by construction; this endpoint is scoped to the same
+   * `EmbedKeyAuthFilter` gate as the rest of the embed plane, so the
+   * `Authorization: Bearer <embed_key>` header `buildHeaders()` already
+   * sends is sufficient.
+   *
+   * The backend response is still a flat record (`tenantSlug,
+   * primaryColor, secondaryColor, logoUrl, fontFamily, offerings,
+   * embeddableWidget`) — kept flat so `getTenantBrandKit()`'s existing
+   * consumers (the ThemeReader cascade) are unaffected. This method nests
+   * the branding fields into the shape `HeadlessConfigResponse` expects.
    *
    * Pattern #18 fail-soft — returns `null` on transport failure, 404, or
    * malformed JSON. Widgets fall through to their empty / error state and
@@ -219,7 +232,7 @@ var _BridgeClient = class _BridgeClient {
     }
     const target = slug || this.tenantSlug;
     if (!target) return null;
-    const url = `${this.baseUrl}/api/v1/portal/headless/config?tenantSlug=${encodeURIComponent(target)}`;
+    const url = `${this.baseUrl}/api/v1/portal/embed/tenant-config/${encodeURIComponent(target)}`;
     let resp;
     try {
       resp = await this.send(url, {
@@ -232,7 +245,18 @@ var _BridgeClient = class _BridgeClient {
     if (!resp.ok) return null;
     try {
       const body = await resp.json();
-      return body && typeof body === "object" ? body : null;
+      if (!body || typeof body !== "object") return null;
+      return {
+        tenantSlug: body.tenantSlug,
+        branding: {
+          primaryColor: body.primaryColor ?? null,
+          secondaryColor: body.secondaryColor ?? null,
+          logoUrl: body.logoUrl ?? null,
+          fontFamily: body.fontFamily ?? null
+        },
+        offerings: Array.isArray(body.offerings) ? body.offerings : [],
+        embeddableWidget: body.embeddableWidget ?? null
+      };
     } catch {
       return null;
     }
@@ -1737,9 +1761,10 @@ var AforoSession = {
     };
     sessions.set(k, entry);
     if (config.bridgeToken) {
-      entry.pendingExchange = refreshSession(entry).catch((err) => {
-        throw err;
+      const exchangePromise = refreshSession(entry);
+      exchangePromise.catch(() => {
       });
+      entry.pendingExchange = exchangePromise;
     } else if (config.magicLinkMode) {
       const tokenInUrl = readMagicTokenFromUrl();
       if (tokenInUrl) {
@@ -1749,6 +1774,8 @@ var AforoSession = {
           pending = runMagicLinkVerify(entry, tokenInUrl).finally(() => {
             pendingMagicLinkVerifies.delete(dedupKey);
           });
+          pending.catch(() => {
+          });
           pendingMagicLinkVerifies.set(dedupKey, pending);
         }
         entry.pendingExchange = pending;
@@ -12126,7 +12153,7 @@ function ResultPanel({
 }
 
 // src/core/version.ts
-var VERSION = "1.0.2";
+var VERSION = "1.0.4";
 
 // src/core/AforoEmbed.ts
 var mountedElements = /* @__PURE__ */ new WeakMap();

package/dist/loader.js

@@ -1,3 +1,3 @@
-var AforoEmbedLoader=(function(exports){'use strict';var T="1.0.2";var y=new WeakMap,c=new Map,f={},A=false;function h(){A||typeof window!="undefined"&&(window.addEventListener("message",e=>{let t=e.data;!t||typeof t!="object"||typeof t.type!="string"||t.type.startsWith("aforo.")&&$(t);}),A=true);}function $(e){let t=c.get(e.type);if(t)for(let o of t)try{o(e);}catch(i){}let n=c.get("*");if(n)for(let o of n)try{o(e);}catch(i){}}var p=new Map;function N(e,t){p.set(e,t);}function w(e){return typeof e=="object"&&e!==null&&typeof e.tagName=="string"}var b={version:T,configure(e){f={...f,...e};},getConfig(){return {...f}},mount(e,t){var r,l,u,s,d;if(!w(e)||y.has(e))return  false;let n=t.widget,o=p.get(n);if(!o)return typeof console!="undefined"&&console.warn(`[aforo:embed] No mount handler registered for widget "${n}". Loader bundle may not have finished loading.`),false;let i={widget:n,tenantSlug:(l=(r=t.tenantSlug)!=null?r:f.tenantSlug)!=null?l:"",embedKey:(s=(u=t.embedKey)!=null?u:f.embedKey)!=null?s:"",bridgeToken:(d=t.bridgeToken)!=null?d:f.bridgeToken,layout:t.layout,themeOverrides:t.themeOverrides,config:t.config};if(!i.tenantSlug||!i.embedKey)return typeof console!="undefined"&&console.error(`[aforo:embed] Widget "${n}" requires tenantSlug + embedKey. Provide via AforoEmbed.configure() or data-* attributes.`),false;h();let a=o(e,i);return y.set(e,{element:e,widget:n,teardown:a}),true},unmount(e){if(!w(e))return  false;let t=y.get(e);if(!t)return  false;try{t.teardown();}catch(n){}return y.delete(e),true},on(e,t){h();let n=c.get(e);return n||(n=new Set,c.set(e,n)),n.add(t),()=>{let o=c.get(e);o&&(o.delete(t),o.size===0&&c.delete(e));}},_registerWidget:N,_registeredWidgetsForTesting(){return Array.from(p.keys())},_resetForTesting(){p.clear(),c.clear(),f={};}};function k(e){if(!e)return {};try{let t=JSON.parse(e);if(t&&typeof t=="object"&&!Array.isArray(t)){let n={},o=["primary","primaryContrast","text","textMuted","bg","border","radius","fontFamily"],i=t;for(let a of o){let r=i[a];typeof r=="string"&&r.length>0&&(n[a]=r);}return n}}catch(t){}return {}}var U=new Set(["pricing-card","subscribe-button","checkout-flow","subscription-manager","invoice-list","usage-meter","payment-method","upgrade-cancel"]),B="https://embed.aforo.ai/v1/widgets",g="[aforo:loader]";function D(){let e=typeof document!="undefined"?document.currentScript:null;if(e&&e.tagName==="SCRIPT")return e;if(typeof document!="undefined"){let t=document.getElementsByTagName("script");for(let n=t.length-1;n>=0;n--){let o=t[n];if(!o)continue;let i=o.getAttribute("src")||"";if(/(\/v1)?\/loader(\.umd)?\.js$/.test(i))return o}}return null}function G(e){let t=e==null?void 0:e.getAttribute("src");if(!t)return null;try{let n=typeof location!="undefined"?location.href:void 0,o=new URL(t,n),i=o.pathname.replace(/\/loader(\.umd)?\.js$/,"");return `${o.origin}${i}/widgets`}catch(n){return null}}function v(e,t){let n=e.getAttribute(t);if(n==null||n.trim()==="")return;let o=Number(n);return Number.isFinite(o)?o:void 0}function j(e,t){let n=e.getAttribute(t);if(n==null)return;let o=n.trim().toLowerCase();if(o==="true")return  true;if(o==="false")return  false}function V(e){let t=(e.getAttribute("data-aforo-widget")||"").trim(),n=e.getAttribute("data-tenant-slug")||e.getAttribute("data-tenant")||"",o=e.getAttribute("data-embed-key")||"",i=e.getAttribute("data-bridge-token")||void 0,a=e.getAttribute("data-layout")||void 0,r=k(e.getAttribute("data-theme-overrides")),l=e.getAttribute("data-offering-id")||void 0,u=e.getAttribute("data-subscription-id")||void 0,s=e.getAttribute("data-metric")||void 0,d=e.getAttribute("data-featured-offering-id")||void 0,m=e.getAttribute("data-mode")||void 0,M=e.getAttribute("data-return-url")||void 0,S=e.getAttribute("data-default-status")||void 0,F=e.getAttribute("data-render-mode")||void 0,_=e.getAttribute("data-locale")||void 0,C=v(e,"data-page-size"),O=v(e,"data-poll-interval-ms"),I=e.getAttribute("data-theme")||void 0,R=e.getAttribute("data-cart-type")||void 0,W=e.getAttribute("data-target-id")||void 0,H=e.getAttribute("data-cta-text")||void 0,x=e.getAttribute("data-cta-url")||void 0,P=v(e,"data-max-plans"),K=j(e,"data-show-features");return {widget:t,tenantSlug:n,embedKey:o,bridgeToken:i,layout:a,themeOverrides:r,config:{offeringId:l,subscriptionId:u,metricName:s,featuredOfferingId:d,mode:m,returnUrl:M,defaultStatus:S,renderMode:F,locale:_,pageSize:C,pollIntervalMs:O,theme:I,cartType:R,targetId:W,ctaText:H,ctaUrl:x,maxPlans:P,showFeatures:K}}}function z(e,t,n){return new Promise((o,i)=>{if(typeof document=="undefined")return i(new Error("no document"));let a=document.querySelector(`script[data-aforo-bundle="${e}"]`);if(a){if(a.dataset.aforoLoaded==="1")return o();a.addEventListener("load",()=>o()),a.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`)));return}let r=document.createElement("script");r.src=`${t}/${e}.js`,r.async=true,r.crossOrigin="anonymous",r.dataset.aforoBundle=e,n&&r.setAttribute("nonce",n),r.addEventListener("load",()=>{r.dataset.aforoLoaded="1",o();}),r.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`))),document.head.appendChild(r);})}function L(e){if(!e.__aforoEmbedReadyFired){e.__aforoEmbedReadyFired=true;try{typeof e.aforoEmbedReady=="function"&&e.aforoEmbedReady();}catch(t){typeof console!="undefined"&&console.error(`${g} aforoEmbedReady callback threw`,t);}if(typeof document!="undefined"&&typeof CustomEvent!="undefined")try{document.dispatchEvent(new CustomEvent("aforoEmbedReady"));}catch(t){}}}async function E(e){if(typeof window=="undefined"||typeof document=="undefined")return;let t=window;if(window.location.protocol!=="https:"&&window.location.hostname!=="localhost"){typeof console!="undefined"&&console.error(`${g} Refusing to mount Aforo widgets on a non-HTTPS page. Embed Plugin requires HTTPS (FR-TIER-12). Current origin: ${window.location.origin}`);return}if(t.__aforoEmbedLoaderInitialized){typeof console!="undefined"&&console.warn(`${g} Loader already initialised on this page \u2014 skipping duplicate run.`);return}t.__aforoEmbedLoaderInitialized=true,t.aforoEmbed||(t.aforoEmbed=b);let n=D(),o=(n==null?void 0:n.getAttribute("nonce"))||null,i=(e==null?void 0:e.bundleBaseUrl)||G(n)||B,a=Array.from(document.querySelectorAll("[data-aforo-widget]"));if(a.length===0){L(t);return}let r=new Map;for(let u of a){let s=(u.getAttribute("data-aforo-widget")||"").trim();if(!U.has(s)){typeof console!="undefined"&&console.warn(`${g} Unknown widget id "${s}" \u2014 skipping`);continue}let d=r.get(s);d||(d=[],r.set(s,d)),d.push(u);}let l=Array.from(r.entries()).map(async([u,s])=>{try{await z(u,i,o);for(let d of s){let m=V(d);if(!m.widget||!m.tenantSlug||!m.embedKey){typeof console!="undefined"&&console.error(`${g} Placeholder missing required attributes (data-tenant-slug + data-embed-key). Skipping element.`,d);continue}b.mount(d,m);}}catch(d){typeof console!="undefined"&&console.error(`${g} Failed to load bundle for "${u}"`,d);}});await Promise.all(l).catch(()=>{}),L(t);}typeof document!="undefined"&&document.readyState!=="loading"?Promise.resolve().then(()=>{E();}):typeof document!="undefined"&&document.addEventListener("DOMContentLoaded",()=>{E();});b._loader={bootstrap:E};
+var AforoEmbedLoader=(function(exports){'use strict';var T="1.0.4";var y=new WeakMap,c=new Map,f={},A=false;function h(){A||typeof window!="undefined"&&(window.addEventListener("message",e=>{let t=e.data;!t||typeof t!="object"||typeof t.type!="string"||t.type.startsWith("aforo.")&&$(t);}),A=true);}function $(e){let t=c.get(e.type);if(t)for(let o of t)try{o(e);}catch(i){}let n=c.get("*");if(n)for(let o of n)try{o(e);}catch(i){}}var p=new Map;function N(e,t){p.set(e,t);}function w(e){return typeof e=="object"&&e!==null&&typeof e.tagName=="string"}var b={version:T,configure(e){f={...f,...e};},getConfig(){return {...f}},mount(e,t){var r,l,u,s,d;if(!w(e)||y.has(e))return  false;let n=t.widget,o=p.get(n);if(!o)return typeof console!="undefined"&&console.warn(`[aforo:embed] No mount handler registered for widget "${n}". Loader bundle may not have finished loading.`),false;let i={widget:n,tenantSlug:(l=(r=t.tenantSlug)!=null?r:f.tenantSlug)!=null?l:"",embedKey:(s=(u=t.embedKey)!=null?u:f.embedKey)!=null?s:"",bridgeToken:(d=t.bridgeToken)!=null?d:f.bridgeToken,layout:t.layout,themeOverrides:t.themeOverrides,config:t.config};if(!i.tenantSlug||!i.embedKey)return typeof console!="undefined"&&console.error(`[aforo:embed] Widget "${n}" requires tenantSlug + embedKey. Provide via AforoEmbed.configure() or data-* attributes.`),false;h();let a=o(e,i);return y.set(e,{element:e,widget:n,teardown:a}),true},unmount(e){if(!w(e))return  false;let t=y.get(e);if(!t)return  false;try{t.teardown();}catch(n){}return y.delete(e),true},on(e,t){h();let n=c.get(e);return n||(n=new Set,c.set(e,n)),n.add(t),()=>{let o=c.get(e);o&&(o.delete(t),o.size===0&&c.delete(e));}},_registerWidget:N,_registeredWidgetsForTesting(){return Array.from(p.keys())},_resetForTesting(){p.clear(),c.clear(),f={};}};function k(e){if(!e)return {};try{let t=JSON.parse(e);if(t&&typeof t=="object"&&!Array.isArray(t)){let n={},o=["primary","primaryContrast","text","textMuted","bg","border","radius","fontFamily"],i=t;for(let a of o){let r=i[a];typeof r=="string"&&r.length>0&&(n[a]=r);}return n}}catch(t){}return {}}var U=new Set(["pricing-card","subscribe-button","checkout-flow","subscription-manager","invoice-list","usage-meter","payment-method","upgrade-cancel"]),B="https://embed.aforo.ai/v1/widgets",g="[aforo:loader]";function D(){let e=typeof document!="undefined"?document.currentScript:null;if(e&&e.tagName==="SCRIPT")return e;if(typeof document!="undefined"){let t=document.getElementsByTagName("script");for(let n=t.length-1;n>=0;n--){let o=t[n];if(!o)continue;let i=o.getAttribute("src")||"";if(/(\/v1)?\/loader(\.umd)?\.js$/.test(i))return o}}return null}function G(e){let t=e==null?void 0:e.getAttribute("src");if(!t)return null;try{let n=typeof location!="undefined"?location.href:void 0,o=new URL(t,n),i=o.pathname.replace(/\/loader(\.umd)?\.js$/,"");return `${o.origin}${i}/widgets`}catch(n){return null}}function v(e,t){let n=e.getAttribute(t);if(n==null||n.trim()==="")return;let o=Number(n);return Number.isFinite(o)?o:void 0}function j(e,t){let n=e.getAttribute(t);if(n==null)return;let o=n.trim().toLowerCase();if(o==="true")return  true;if(o==="false")return  false}function V(e){let t=(e.getAttribute("data-aforo-widget")||"").trim(),n=e.getAttribute("data-tenant-slug")||e.getAttribute("data-tenant")||"",o=e.getAttribute("data-embed-key")||"",i=e.getAttribute("data-bridge-token")||void 0,a=e.getAttribute("data-layout")||void 0,r=k(e.getAttribute("data-theme-overrides")),l=e.getAttribute("data-offering-id")||void 0,u=e.getAttribute("data-subscription-id")||void 0,s=e.getAttribute("data-metric")||void 0,d=e.getAttribute("data-featured-offering-id")||void 0,m=e.getAttribute("data-mode")||void 0,M=e.getAttribute("data-return-url")||void 0,S=e.getAttribute("data-default-status")||void 0,F=e.getAttribute("data-render-mode")||void 0,_=e.getAttribute("data-locale")||void 0,C=v(e,"data-page-size"),O=v(e,"data-poll-interval-ms"),I=e.getAttribute("data-theme")||void 0,R=e.getAttribute("data-cart-type")||void 0,W=e.getAttribute("data-target-id")||void 0,H=e.getAttribute("data-cta-text")||void 0,x=e.getAttribute("data-cta-url")||void 0,P=v(e,"data-max-plans"),K=j(e,"data-show-features");return {widget:t,tenantSlug:n,embedKey:o,bridgeToken:i,layout:a,themeOverrides:r,config:{offeringId:l,subscriptionId:u,metricName:s,featuredOfferingId:d,mode:m,returnUrl:M,defaultStatus:S,renderMode:F,locale:_,pageSize:C,pollIntervalMs:O,theme:I,cartType:R,targetId:W,ctaText:H,ctaUrl:x,maxPlans:P,showFeatures:K}}}function z(e,t,n){return new Promise((o,i)=>{if(typeof document=="undefined")return i(new Error("no document"));let a=document.querySelector(`script[data-aforo-bundle="${e}"]`);if(a){if(a.dataset.aforoLoaded==="1")return o();a.addEventListener("load",()=>o()),a.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`)));return}let r=document.createElement("script");r.src=`${t}/${e}.js`,r.async=true,r.crossOrigin="anonymous",r.dataset.aforoBundle=e,n&&r.setAttribute("nonce",n),r.addEventListener("load",()=>{r.dataset.aforoLoaded="1",o();}),r.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`))),document.head.appendChild(r);})}function L(e){if(!e.__aforoEmbedReadyFired){e.__aforoEmbedReadyFired=true;try{typeof e.aforoEmbedReady=="function"&&e.aforoEmbedReady();}catch(t){typeof console!="undefined"&&console.error(`${g} aforoEmbedReady callback threw`,t);}if(typeof document!="undefined"&&typeof CustomEvent!="undefined")try{document.dispatchEvent(new CustomEvent("aforoEmbedReady"));}catch(t){}}}async function E(e){if(typeof window=="undefined"||typeof document=="undefined")return;let t=window;if(window.location.protocol!=="https:"&&window.location.hostname!=="localhost"){typeof console!="undefined"&&console.error(`${g} Refusing to mount Aforo widgets on a non-HTTPS page. Embed Plugin requires HTTPS (FR-TIER-12). Current origin: ${window.location.origin}`);return}if(t.__aforoEmbedLoaderInitialized){typeof console!="undefined"&&console.warn(`${g} Loader already initialised on this page \u2014 skipping duplicate run.`);return}t.__aforoEmbedLoaderInitialized=true,t.aforoEmbed||(t.aforoEmbed=b);let n=D(),o=(n==null?void 0:n.getAttribute("nonce"))||null,i=(e==null?void 0:e.bundleBaseUrl)||G(n)||B,a=Array.from(document.querySelectorAll("[data-aforo-widget]"));if(a.length===0){L(t);return}let r=new Map;for(let u of a){let s=(u.getAttribute("data-aforo-widget")||"").trim();if(!U.has(s)){typeof console!="undefined"&&console.warn(`${g} Unknown widget id "${s}" \u2014 skipping`);continue}let d=r.get(s);d||(d=[],r.set(s,d)),d.push(u);}let l=Array.from(r.entries()).map(async([u,s])=>{try{await z(u,i,o);for(let d of s){let m=V(d);if(!m.widget||!m.tenantSlug||!m.embedKey){typeof console!="undefined"&&console.error(`${g} Placeholder missing required attributes (data-tenant-slug + data-embed-key). Skipping element.`,d);continue}b.mount(d,m);}}catch(d){typeof console!="undefined"&&console.error(`${g} Failed to load bundle for "${u}"`,d);}});await Promise.all(l).catch(()=>{}),L(t);}typeof document!="undefined"&&document.readyState!=="loading"?Promise.resolve().then(()=>{E();}):typeof document!="undefined"&&document.addEventListener("DOMContentLoaded",()=>{E();});b._loader={bootstrap:E};
 exports.AforoEmbed=b;exports.bootstrap=E;return exports;})({});//# sourceMappingURL=loader.js.map
 //# sourceMappingURL=loader.js.map

package/dist/loader.mjs

@@ -1,3 +1,3 @@
-var T="1.0.2";var y=new WeakMap,c=new Map,f={},A=false;function h(){A||typeof window!="undefined"&&(window.addEventListener("message",e=>{let t=e.data;!t||typeof t!="object"||typeof t.type!="string"||t.type.startsWith("aforo.")&&$(t);}),A=true);}function $(e){let t=c.get(e.type);if(t)for(let o of t)try{o(e);}catch(i){}let n=c.get("*");if(n)for(let o of n)try{o(e);}catch(i){}}var p=new Map;function N(e,t){p.set(e,t);}function w(e){return typeof e=="object"&&e!==null&&typeof e.tagName=="string"}var b={version:T,configure(e){f={...f,...e};},getConfig(){return {...f}},mount(e,t){var r,l,u,s,d;if(!w(e)||y.has(e))return  false;let n=t.widget,o=p.get(n);if(!o)return typeof console!="undefined"&&console.warn(`[aforo:embed] No mount handler registered for widget "${n}". Loader bundle may not have finished loading.`),false;let i={widget:n,tenantSlug:(l=(r=t.tenantSlug)!=null?r:f.tenantSlug)!=null?l:"",embedKey:(s=(u=t.embedKey)!=null?u:f.embedKey)!=null?s:"",bridgeToken:(d=t.bridgeToken)!=null?d:f.bridgeToken,layout:t.layout,themeOverrides:t.themeOverrides,config:t.config};if(!i.tenantSlug||!i.embedKey)return typeof console!="undefined"&&console.error(`[aforo:embed] Widget "${n}" requires tenantSlug + embedKey. Provide via AforoEmbed.configure() or data-* attributes.`),false;h();let a=o(e,i);return y.set(e,{element:e,widget:n,teardown:a}),true},unmount(e){if(!w(e))return  false;let t=y.get(e);if(!t)return  false;try{t.teardown();}catch(n){}return y.delete(e),true},on(e,t){h();let n=c.get(e);return n||(n=new Set,c.set(e,n)),n.add(t),()=>{let o=c.get(e);o&&(o.delete(t),o.size===0&&c.delete(e));}},_registerWidget:N,_registeredWidgetsForTesting(){return Array.from(p.keys())},_resetForTesting(){p.clear(),c.clear(),f={};}};function k(e){if(!e)return {};try{let t=JSON.parse(e);if(t&&typeof t=="object"&&!Array.isArray(t)){let n={},o=["primary","primaryContrast","text","textMuted","bg","border","radius","fontFamily"],i=t;for(let a of o){let r=i[a];typeof r=="string"&&r.length>0&&(n[a]=r);}return n}}catch(t){}return {}}var U=new Set(["pricing-card","subscribe-button","checkout-flow","subscription-manager","invoice-list","usage-meter","payment-method","upgrade-cancel"]),B="https://embed.aforo.ai/v1/widgets",g="[aforo:loader]";function D(){let e=typeof document!="undefined"?document.currentScript:null;if(e&&e.tagName==="SCRIPT")return e;if(typeof document!="undefined"){let t=document.getElementsByTagName("script");for(let n=t.length-1;n>=0;n--){let o=t[n];if(!o)continue;let i=o.getAttribute("src")||"";if(/(\/v1)?\/loader(\.umd)?\.js$/.test(i))return o}}return null}function G(e){let t=e==null?void 0:e.getAttribute("src");if(!t)return null;try{let n=typeof location!="undefined"?location.href:void 0,o=new URL(t,n),i=o.pathname.replace(/\/loader(\.umd)?\.js$/,"");return `${o.origin}${i}/widgets`}catch(n){return null}}function v(e,t){let n=e.getAttribute(t);if(n==null||n.trim()==="")return;let o=Number(n);return Number.isFinite(o)?o:void 0}function j(e,t){let n=e.getAttribute(t);if(n==null)return;let o=n.trim().toLowerCase();if(o==="true")return  true;if(o==="false")return  false}function V(e){let t=(e.getAttribute("data-aforo-widget")||"").trim(),n=e.getAttribute("data-tenant-slug")||e.getAttribute("data-tenant")||"",o=e.getAttribute("data-embed-key")||"",i=e.getAttribute("data-bridge-token")||void 0,a=e.getAttribute("data-layout")||void 0,r=k(e.getAttribute("data-theme-overrides")),l=e.getAttribute("data-offering-id")||void 0,u=e.getAttribute("data-subscription-id")||void 0,s=e.getAttribute("data-metric")||void 0,d=e.getAttribute("data-featured-offering-id")||void 0,m=e.getAttribute("data-mode")||void 0,M=e.getAttribute("data-return-url")||void 0,S=e.getAttribute("data-default-status")||void 0,F=e.getAttribute("data-render-mode")||void 0,_=e.getAttribute("data-locale")||void 0,C=v(e,"data-page-size"),O=v(e,"data-poll-interval-ms"),I=e.getAttribute("data-theme")||void 0,R=e.getAttribute("data-cart-type")||void 0,W=e.getAttribute("data-target-id")||void 0,H=e.getAttribute("data-cta-text")||void 0,x=e.getAttribute("data-cta-url")||void 0,P=v(e,"data-max-plans"),K=j(e,"data-show-features");return {widget:t,tenantSlug:n,embedKey:o,bridgeToken:i,layout:a,themeOverrides:r,config:{offeringId:l,subscriptionId:u,metricName:s,featuredOfferingId:d,mode:m,returnUrl:M,defaultStatus:S,renderMode:F,locale:_,pageSize:C,pollIntervalMs:O,theme:I,cartType:R,targetId:W,ctaText:H,ctaUrl:x,maxPlans:P,showFeatures:K}}}function z(e,t,n){return new Promise((o,i)=>{if(typeof document=="undefined")return i(new Error("no document"));let a=document.querySelector(`script[data-aforo-bundle="${e}"]`);if(a){if(a.dataset.aforoLoaded==="1")return o();a.addEventListener("load",()=>o()),a.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`)));return}let r=document.createElement("script");r.src=`${t}/${e}.js`,r.async=true,r.crossOrigin="anonymous",r.dataset.aforoBundle=e,n&&r.setAttribute("nonce",n),r.addEventListener("load",()=>{r.dataset.aforoLoaded="1",o();}),r.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`))),document.head.appendChild(r);})}function L(e){if(!e.__aforoEmbedReadyFired){e.__aforoEmbedReadyFired=true;try{typeof e.aforoEmbedReady=="function"&&e.aforoEmbedReady();}catch(t){typeof console!="undefined"&&console.error(`${g} aforoEmbedReady callback threw`,t);}if(typeof document!="undefined"&&typeof CustomEvent!="undefined")try{document.dispatchEvent(new CustomEvent("aforoEmbedReady"));}catch(t){}}}async function E(e){if(typeof window=="undefined"||typeof document=="undefined")return;let t=window;if(window.location.protocol!=="https:"&&window.location.hostname!=="localhost"){typeof console!="undefined"&&console.error(`${g} Refusing to mount Aforo widgets on a non-HTTPS page. Embed Plugin requires HTTPS (FR-TIER-12). Current origin: ${window.location.origin}`);return}if(t.__aforoEmbedLoaderInitialized){typeof console!="undefined"&&console.warn(`${g} Loader already initialised on this page \u2014 skipping duplicate run.`);return}t.__aforoEmbedLoaderInitialized=true,t.aforoEmbed||(t.aforoEmbed=b);let n=D(),o=(n==null?void 0:n.getAttribute("nonce"))||null,i=(e==null?void 0:e.bundleBaseUrl)||G(n)||B,a=Array.from(document.querySelectorAll("[data-aforo-widget]"));if(a.length===0){L(t);return}let r=new Map;for(let u of a){let s=(u.getAttribute("data-aforo-widget")||"").trim();if(!U.has(s)){typeof console!="undefined"&&console.warn(`${g} Unknown widget id "${s}" \u2014 skipping`);continue}let d=r.get(s);d||(d=[],r.set(s,d)),d.push(u);}let l=Array.from(r.entries()).map(async([u,s])=>{try{await z(u,i,o);for(let d of s){let m=V(d);if(!m.widget||!m.tenantSlug||!m.embedKey){typeof console!="undefined"&&console.error(`${g} Placeholder missing required attributes (data-tenant-slug + data-embed-key). Skipping element.`,d);continue}b.mount(d,m);}}catch(d){typeof console!="undefined"&&console.error(`${g} Failed to load bundle for "${u}"`,d);}});await Promise.all(l).catch(()=>{}),L(t);}typeof document!="undefined"&&document.readyState!=="loading"?Promise.resolve().then(()=>{E();}):typeof document!="undefined"&&document.addEventListener("DOMContentLoaded",()=>{E();});b._loader={bootstrap:E};
+var T="1.0.4";var y=new WeakMap,c=new Map,f={},A=false;function h(){A||typeof window!="undefined"&&(window.addEventListener("message",e=>{let t=e.data;!t||typeof t!="object"||typeof t.type!="string"||t.type.startsWith("aforo.")&&$(t);}),A=true);}function $(e){let t=c.get(e.type);if(t)for(let o of t)try{o(e);}catch(i){}let n=c.get("*");if(n)for(let o of n)try{o(e);}catch(i){}}var p=new Map;function N(e,t){p.set(e,t);}function w(e){return typeof e=="object"&&e!==null&&typeof e.tagName=="string"}var b={version:T,configure(e){f={...f,...e};},getConfig(){return {...f}},mount(e,t){var r,l,u,s,d;if(!w(e)||y.has(e))return  false;let n=t.widget,o=p.get(n);if(!o)return typeof console!="undefined"&&console.warn(`[aforo:embed] No mount handler registered for widget "${n}". Loader bundle may not have finished loading.`),false;let i={widget:n,tenantSlug:(l=(r=t.tenantSlug)!=null?r:f.tenantSlug)!=null?l:"",embedKey:(s=(u=t.embedKey)!=null?u:f.embedKey)!=null?s:"",bridgeToken:(d=t.bridgeToken)!=null?d:f.bridgeToken,layout:t.layout,themeOverrides:t.themeOverrides,config:t.config};if(!i.tenantSlug||!i.embedKey)return typeof console!="undefined"&&console.error(`[aforo:embed] Widget "${n}" requires tenantSlug + embedKey. Provide via AforoEmbed.configure() or data-* attributes.`),false;h();let a=o(e,i);return y.set(e,{element:e,widget:n,teardown:a}),true},unmount(e){if(!w(e))return  false;let t=y.get(e);if(!t)return  false;try{t.teardown();}catch(n){}return y.delete(e),true},on(e,t){h();let n=c.get(e);return n||(n=new Set,c.set(e,n)),n.add(t),()=>{let o=c.get(e);o&&(o.delete(t),o.size===0&&c.delete(e));}},_registerWidget:N,_registeredWidgetsForTesting(){return Array.from(p.keys())},_resetForTesting(){p.clear(),c.clear(),f={};}};function k(e){if(!e)return {};try{let t=JSON.parse(e);if(t&&typeof t=="object"&&!Array.isArray(t)){let n={},o=["primary","primaryContrast","text","textMuted","bg","border","radius","fontFamily"],i=t;for(let a of o){let r=i[a];typeof r=="string"&&r.length>0&&(n[a]=r);}return n}}catch(t){}return {}}var U=new Set(["pricing-card","subscribe-button","checkout-flow","subscription-manager","invoice-list","usage-meter","payment-method","upgrade-cancel"]),B="https://embed.aforo.ai/v1/widgets",g="[aforo:loader]";function D(){let e=typeof document!="undefined"?document.currentScript:null;if(e&&e.tagName==="SCRIPT")return e;if(typeof document!="undefined"){let t=document.getElementsByTagName("script");for(let n=t.length-1;n>=0;n--){let o=t[n];if(!o)continue;let i=o.getAttribute("src")||"";if(/(\/v1)?\/loader(\.umd)?\.js$/.test(i))return o}}return null}function G(e){let t=e==null?void 0:e.getAttribute("src");if(!t)return null;try{let n=typeof location!="undefined"?location.href:void 0,o=new URL(t,n),i=o.pathname.replace(/\/loader(\.umd)?\.js$/,"");return `${o.origin}${i}/widgets`}catch(n){return null}}function v(e,t){let n=e.getAttribute(t);if(n==null||n.trim()==="")return;let o=Number(n);return Number.isFinite(o)?o:void 0}function j(e,t){let n=e.getAttribute(t);if(n==null)return;let o=n.trim().toLowerCase();if(o==="true")return  true;if(o==="false")return  false}function V(e){let t=(e.getAttribute("data-aforo-widget")||"").trim(),n=e.getAttribute("data-tenant-slug")||e.getAttribute("data-tenant")||"",o=e.getAttribute("data-embed-key")||"",i=e.getAttribute("data-bridge-token")||void 0,a=e.getAttribute("data-layout")||void 0,r=k(e.getAttribute("data-theme-overrides")),l=e.getAttribute("data-offering-id")||void 0,u=e.getAttribute("data-subscription-id")||void 0,s=e.getAttribute("data-metric")||void 0,d=e.getAttribute("data-featured-offering-id")||void 0,m=e.getAttribute("data-mode")||void 0,M=e.getAttribute("data-return-url")||void 0,S=e.getAttribute("data-default-status")||void 0,F=e.getAttribute("data-render-mode")||void 0,_=e.getAttribute("data-locale")||void 0,C=v(e,"data-page-size"),O=v(e,"data-poll-interval-ms"),I=e.getAttribute("data-theme")||void 0,R=e.getAttribute("data-cart-type")||void 0,W=e.getAttribute("data-target-id")||void 0,H=e.getAttribute("data-cta-text")||void 0,x=e.getAttribute("data-cta-url")||void 0,P=v(e,"data-max-plans"),K=j(e,"data-show-features");return {widget:t,tenantSlug:n,embedKey:o,bridgeToken:i,layout:a,themeOverrides:r,config:{offeringId:l,subscriptionId:u,metricName:s,featuredOfferingId:d,mode:m,returnUrl:M,defaultStatus:S,renderMode:F,locale:_,pageSize:C,pollIntervalMs:O,theme:I,cartType:R,targetId:W,ctaText:H,ctaUrl:x,maxPlans:P,showFeatures:K}}}function z(e,t,n){return new Promise((o,i)=>{if(typeof document=="undefined")return i(new Error("no document"));let a=document.querySelector(`script[data-aforo-bundle="${e}"]`);if(a){if(a.dataset.aforoLoaded==="1")return o();a.addEventListener("load",()=>o()),a.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`)));return}let r=document.createElement("script");r.src=`${t}/${e}.js`,r.async=true,r.crossOrigin="anonymous",r.dataset.aforoBundle=e,n&&r.setAttribute("nonce",n),r.addEventListener("load",()=>{r.dataset.aforoLoaded="1",o();}),r.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`))),document.head.appendChild(r);})}function L(e){if(!e.__aforoEmbedReadyFired){e.__aforoEmbedReadyFired=true;try{typeof e.aforoEmbedReady=="function"&&e.aforoEmbedReady();}catch(t){typeof console!="undefined"&&console.error(`${g} aforoEmbedReady callback threw`,t);}if(typeof document!="undefined"&&typeof CustomEvent!="undefined")try{document.dispatchEvent(new CustomEvent("aforoEmbedReady"));}catch(t){}}}async function E(e){if(typeof window=="undefined"||typeof document=="undefined")return;let t=window;if(window.location.protocol!=="https:"&&window.location.hostname!=="localhost"){typeof console!="undefined"&&console.error(`${g} Refusing to mount Aforo widgets on a non-HTTPS page. Embed Plugin requires HTTPS (FR-TIER-12). Current origin: ${window.location.origin}`);return}if(t.__aforoEmbedLoaderInitialized){typeof console!="undefined"&&console.warn(`${g} Loader already initialised on this page \u2014 skipping duplicate run.`);return}t.__aforoEmbedLoaderInitialized=true,t.aforoEmbed||(t.aforoEmbed=b);let n=D(),o=(n==null?void 0:n.getAttribute("nonce"))||null,i=(e==null?void 0:e.bundleBaseUrl)||G(n)||B,a=Array.from(document.querySelectorAll("[data-aforo-widget]"));if(a.length===0){L(t);return}let r=new Map;for(let u of a){let s=(u.getAttribute("data-aforo-widget")||"").trim();if(!U.has(s)){typeof console!="undefined"&&console.warn(`${g} Unknown widget id "${s}" \u2014 skipping`);continue}let d=r.get(s);d||(d=[],r.set(s,d)),d.push(u);}let l=Array.from(r.entries()).map(async([u,s])=>{try{await z(u,i,o);for(let d of s){let m=V(d);if(!m.widget||!m.tenantSlug||!m.embedKey){typeof console!="undefined"&&console.error(`${g} Placeholder missing required attributes (data-tenant-slug + data-embed-key). Skipping element.`,d);continue}b.mount(d,m);}}catch(d){typeof console!="undefined"&&console.error(`${g} Failed to load bundle for "${u}"`,d);}});await Promise.all(l).catch(()=>{}),L(t);}typeof document!="undefined"&&document.readyState!=="loading"?Promise.resolve().then(()=>{E();}):typeof document!="undefined"&&document.addEventListener("DOMContentLoaded",()=>{E();});b._loader={bootstrap:E};
 export{b as AforoEmbed,E as bootstrap};//# sourceMappingURL=loader.mjs.map
 //# sourceMappingURL=loader.mjs.map

package/dist/sri.json

@@ -1,15 +1,15 @@
 {
-  "version": "1.0.2",
-  "generatedAt": "2026-08-06T06:31:48.975Z",
+  "version": "1.0.4",
+  "generatedAt": "2026-08-12T07:41:16.132Z",
   "bundles": {
-    "loader.js": "sha384-adV/66jM4GeO+0F6QuGDCP+hrZuc8SqeCHNCbfLEd+87lihORGgi0bivW8FVdupK",
-    "widgets/checkout-flow.js": "sha384-OqmD7sCMmpG3IEWZx5L3gy7eaGtUhcthcICtKOOHZHvy/d3iXDB8YDz5EwJKJQ4R",
-    "widgets/invoice-list.js": "sha384-VG+PfthxhO0FYDmEBv12fzgEL9sPaoT1ZUMVJc1DdJtUf9CZzUFa9Wl1WIklosed",
-    "widgets/payment-method.js": "sha384-84SAN5cWfiA/zSjAxAyNMTnhn3np5OIqJV9nK5OIGcFYIJkv/Nv0DMO19lGwlxOn",
-    "widgets/pricing-card.js": "sha384-mkoZr/tSjyXzKjetcqPbfZxrOFPGi50Z5ovzWjEZ/dau9wQSJU61BZ9jD3gnQOlH",
-    "widgets/subscribe-button.js": "sha384-dlK9xpeNcEulhXaXMOb/zy+DYcJaGsy++N2NOj+Y251kNtTa/Pz6fLSmQsByg+zl",
-    "widgets/subscription-manager.js": "sha384-iEGP3RdKjL48f/0isOohl9/wWZj5pqwYo/yLh1bz7HpFHd8QMEXM1kbMB0R1ynWV",
-    "widgets/upgrade-cancel.js": "sha384-L9AdnlHJo88E/e6NibEbOi++l6gMib5SFu4vmmOf3GkXc5tyTQ4Fsha/1P36qw/I",
-    "widgets/usage-meter.js": "sha384-UEFaHKHRkvu0GgrGodX44EQ2loDMT2wa/u1ilWlyxaURWNU7AeGW/EC4F0QejLrw"
+    "loader.js": "sha384-1PaCVhvIgReR0XDRtQjRnIqIqkg6XyUE8vGWDYwVPrIquBJ8nzLQ5YTYJGQ+gglP",
+    "widgets/checkout-flow.js": "sha384-xuqKo2+LKENycKs1xQRr+1MEoBNi/Gja7PTMORrJishixFMpb59od8dcBiMu3bTn",
+    "widgets/invoice-list.js": "sha384-BYAiV3yNVgfDWFM1oe+Nn/VPIBff2WCrclHtw1lTB/PiRC9fFRYggC8+ap2bwOBo",
+    "widgets/payment-method.js": "sha384-UKvAuOn02kOi05DyJrJS611LsoJjTMLC+y6rUCEHlZLZbym4k0jSp48C8YjvgDEm",
+    "widgets/pricing-card.js": "sha384-C1Y7pt2S0+jETNNnFoBH2rfySqbRTuB+IYA4hjeUuZKir9s+BM1Hu4g1ItSuEXlO",
+    "widgets/subscribe-button.js": "sha384-i7mqtIWTb2Olg2Uyw9sMAR+Jf53AGTwqIBRWb8QBGQNfy7eSsFNkF2J7yljl+BVz",
+    "widgets/subscription-manager.js": "sha384-rXZz4PRPYHhhfImIUVdfjtUJvJvNrfDLxfi/iV2EgSzONQ1m6Rc/lmhCsQYtyqeX",
+    "widgets/upgrade-cancel.js": "sha384-ZYZHCtJjqIlRn0yz2QR2pyv39C3mH4eFFQjSd/QkPUsqV3ht8ypbRkZOgi9Mmn8t",
+    "widgets/usage-meter.js": "sha384-8Jokz8Lmyb86GW9DBCaTJcsKF5KwCwoLOcZuTyecmMedIvvsSZQjZZtS4ou8bLN/"
   }
 }

package/dist/{types-Dm6cp_Cc.d.cts → types-BbQw2_32.d.cts}

@@ -61,7 +61,7 @@ interface SessionConfig {
      * naturally only ever set one).
      */
     magicLinkMode?: boolean;
-    /** Override the default `https://embed.aforo.ai` origin. Tests + dev. */
+    /** Override the default `https://storefront.aforo.ai` origin. Tests + dev. */
     apiBaseUrl?: string;
     /** Override embed-key authenticated endpoint base. */
     embedBaseUrl?: string;

package/dist/{types-Dm6cp_Cc.d.ts → types-BbQw2_32.d.ts}

@@ -61,7 +61,7 @@ interface SessionConfig {
      * naturally only ever set one).
      */
     magicLinkMode?: boolean;
-    /** Override the default `https://embed.aforo.ai` origin. Tests + dev. */
+    /** Override the default `https://storefront.aforo.ai` origin. Tests + dev. */
     apiBaseUrl?: string;
     /** Override embed-key authenticated endpoint base. */
     embedBaseUrl?: string;

package/dist/vanilla/index.cjs

@@ -27,7 +27,7 @@ var React7__namespace = /*#__PURE__*/_interopNamespace(React7);
 // src/vanilla/index.ts
 
 // src/core/version.ts
-var VERSION = "1.0.2";
+var VERSION = "1.0.4";
 
 // src/core/AforoEmbed.ts
 var mountedElements = /* @__PURE__ */ new WeakMap();
@@ -411,7 +411,7 @@ var BridgeClientError = class extends Error {
     this.retryable = retryable;
   }
 };
-var DEFAULT_BASE = "https://embed.aforo.ai";
+var DEFAULT_BASE = "https://storefront.aforo.ai";
 var DEFAULT_TIMEOUT_MS = 15e3;
 function uuidv4() {
   if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
@@ -599,10 +599,23 @@ var _BridgeClient = class _BridgeClient {
   /**
    * Headless config — the PricingCard widget's primary read path.
    *
-   * Mirrors `GET /api/v1/portal/headless/config` which returns
-   * `{branding, offerings, ratePlans, themeTokens, customPages, ...}`
-   * denormalized JSON. The endpoint is 60s Caffeine-cached server-side; we
-   * cache once per widget instance on the client.
+   * Hits `GET /api/v1/portal/embed/tenant-config/{slug}` — the SAME
+   * embed-key-authenticated endpoint {@link getTenantBrandKit} uses, now
+   * extended server-side with `offerings` + `embeddableWidget`. This was
+   * previously wired to `GET /api/v1/portal/headless/config`, an unrelated
+   * T6 Headless-tier endpoint that requires `X-Storefront-Key`/
+   * `X-Tenant-Id` auth — headers the embed key flow never sends. Every
+   * embed-tier fetch against that URL failed 400 "Missing tenant
+   * identification" by construction; this endpoint is scoped to the same
+   * `EmbedKeyAuthFilter` gate as the rest of the embed plane, so the
+   * `Authorization: Bearer <embed_key>` header `buildHeaders()` already
+   * sends is sufficient.
+   *
+   * The backend response is still a flat record (`tenantSlug,
+   * primaryColor, secondaryColor, logoUrl, fontFamily, offerings,
+   * embeddableWidget`) — kept flat so `getTenantBrandKit()`'s existing
+   * consumers (the ThemeReader cascade) are unaffected. This method nests
+   * the branding fields into the shape `HeadlessConfigResponse` expects.
    *
    * Pattern #18 fail-soft — returns `null` on transport failure, 404, or
    * malformed JSON. Widgets fall through to their empty / error state and
@@ -617,7 +630,7 @@ var _BridgeClient = class _BridgeClient {
     }
     const target = slug || this.tenantSlug;
     if (!target) return null;
-    const url = `${this.baseUrl}/api/v1/portal/headless/config?tenantSlug=${encodeURIComponent(target)}`;
+    const url = `${this.baseUrl}/api/v1/portal/embed/tenant-config/${encodeURIComponent(target)}`;
     let resp;
     try {
       resp = await this.send(url, {
@@ -630,7 +643,18 @@ var _BridgeClient = class _BridgeClient {
     if (!resp.ok) return null;
     try {
       const body = await resp.json();
-      return body && typeof body === "object" ? body : null;
+      if (!body || typeof body !== "object") return null;
+      return {
+        tenantSlug: body.tenantSlug,
+        branding: {
+          primaryColor: body.primaryColor ?? null,
+          secondaryColor: body.secondaryColor ?? null,
+          logoUrl: body.logoUrl ?? null,
+          fontFamily: body.fontFamily ?? null
+        },
+        offerings: Array.isArray(body.offerings) ? body.offerings : [],
+        embeddableWidget: body.embeddableWidget ?? null
+      };
     } catch {
       return null;
     }
@@ -2135,9 +2159,10 @@ var AforoSession = {
     };
     sessions.set(k, entry);
     if (config.bridgeToken) {
-      entry.pendingExchange = refreshSession(entry).catch((err) => {
-        throw err;
+      const exchangePromise = refreshSession(entry);
+      exchangePromise.catch(() => {
       });
+      entry.pendingExchange = exchangePromise;
     } else if (config.magicLinkMode) {
       const tokenInUrl = readMagicTokenFromUrl();
       if (tokenInUrl) {
@@ -2147,6 +2172,8 @@ var AforoSession = {
           pending = runMagicLinkVerify(entry, tokenInUrl).finally(() => {
             pendingMagicLinkVerifies.delete(dedupKey);
           });
+          pending.catch(() => {
+          });
           pendingMagicLinkVerifies.set(dedupKey, pending);
         }
         entry.pendingExchange = pending;

package/dist/vanilla/index.d.cts

@@ -1,5 +1,5 @@
-export { A as AforoEmbed } from '../AforoEmbed-BqQOFsl3.cjs';
-import { aD as WidgetMountConfig } from '../types-Dm6cp_Cc.cjs';
+export { A as AforoEmbed } from '../AforoEmbed-VYb6_GXB.cjs';
+import { aD as WidgetMountConfig } from '../types-BbQw2_32.cjs';
 
 /**
  * @aforoai/storefront-widgets/vanilla — vanilla-JS adapter (FR-TIER-3,

package/dist/vanilla/index.d.ts

@@ -1,5 +1,5 @@
-export { A as AforoEmbed } from '../AforoEmbed-CmqjlYlt.js';
-import { aD as WidgetMountConfig } from '../types-Dm6cp_Cc.js';
+export { A as AforoEmbed } from '../AforoEmbed-BkJF1hAN.js';
+import { aD as WidgetMountConfig } from '../types-BbQw2_32.js';
 
 /**
  * @aforoai/storefront-widgets/vanilla — vanilla-JS adapter (FR-TIER-3,