@aforoai/storefront-widgets 1.0.6 → 1.0.11

package/CHANGELOG.md

@@ -8,6 +8,99 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.11] — 2026-08-30
+
+### Fixed
+
+- **SC-Ticket-10: Checkout Flow's `createCart`/`getCart`/`updateCustomerDetails`/
+  `initiatePayment`/`confirmCart` threw "Malformed \<method\> response
+  (missing required fields)" on every genuinely successful backend
+  response.** `parseCartResponse()` (shared by the first four) and
+  `confirmCart()`'s own inline parser both read `cartId`/`cartType`/
+  `status`/`targetId` directly off the top-level JSON body instead of
+  unwrapping `{success, data, meta}` — same bug class as 1.0.7/1.0.9/1.0.10,
+  just never applied to the checkout-cart family. Live-verified against the
+  isopacai tenant with a real ACTIVE offering: `exchange()` itself (and the
+  rest of the bootstrap path) already worked fine — the reported ticket
+  title ("Malformed bridge exchange response") was a misdiagnosis one call
+  later in the same flow, exactly like SC-Ticket-5.
+
+## [1.0.10] — 2026-08-29
+
+### Fixed
+
+- **SC-Ticket-5: Payment Method widget's initial load silently showed 0
+  payment methods for every customer, even ones with real saved cards.**
+  `fetchPaymentMethods()` and `createPaymentMethodSetupIntent()` read
+  response fields directly off the top-level JSON body instead of
+  unwrapping `{success, data, meta}` — same bug class fixed for
+  `fetchInvoices()` (1.0.7) and the cancel/upgrade responses (1.0.9), never
+  applied here. `fetchPaymentMethods()` is Pattern #18 fail-soft, so this
+  never threw a visible error — it just silently returned an empty list
+  regardless of how many cards the customer actually had on file.
+  (Live-verified `exchange()` itself, and the widget bundle's own deployed
+  copy of it, are both already correct — the ticket's reported "Malformed
+  bridge exchange response" text is a misdiagnosis of this unwrap bug one
+  call later in the same load path.)
+
+## [1.0.9] — 2026-08-29
+
+### Fixed
+
+- **SC-Ticket-4 continued: cancellation succeeded server-side but the widget
+  still showed "Could not cancel."** After the 1.0.8 idempotencyKey fix,
+  live testing surfaced two more bugs in the same response path:
+  `cancelSubscription()`/`upgradeSubscription()` read fields directly off
+  the top-level response body instead of unwrapping `{success, data, meta}`
+  (same class of bug fixed for `fetchInvoices()` in 1.0.7, never applied
+  here), and `cancelSubscription()` additionally required `feedbackId` to
+  be present even though storefront-service's `/cancel` endpoint
+  deliberately omits it today (documented follow-up to read the V50 audit
+  row id back from pricing-service). Together these rejected every
+  genuinely successful cancellation as "malformed." `CancelResponse.feedbackId`
+  is now `string | null`. Live-verified: a real subscription
+  (`1b3af07f-d248-4860-a02b-9e3ee5601200`) was cancelled server-side
+  (confirmed `status: CANCELLED` in the raw API response) but the widget
+  still errored before this fix; re-tested after deploying 1.0.9.
+
+## [1.0.8] — 2026-08-29
+
+### Fixed
+
+- **SC-Ticket-4: Upgrade/Cancel widget's Confirm step always failed** — the
+  ticket's reported symptom ("Malformed bridge exchange response") turned
+  out to be a misdiagnosis of a different, real bug one step later:
+  `cancelSubscription()` and `upgradeSubscription()` sent `idempotencyKey`
+  only via the `Idempotency-Key` header, but storefront-service's
+  `EmbedCancelRequest`/`EmbedUpgradeRequest` DTOs require it as a
+  `@NotBlank` BODY field too. Every real cancellation or upgrade 400'd with
+  "idempotencyKey is required" (or, before a separate backend fix shipped
+  the same day, "Invalid value 'DISCOUNT_20_PCT' for field
+  'retentionOfferShown'" — the backend enum never matched the widget's own
+  documented `RetentionOfferShown` values). Both methods now include
+  `idempotencyKey` in the serialized body as well as the header.
+  Live-verified: a real subscription was successfully cancelled end-to-end
+  through this exact code path after the fix.
+
+## [1.0.7] — 2026-08-29
+
+### Fixed
+
+- **SC-Ticket-3: Invoice List widget always showed "0 invoices" even when
+  the customer had real, finalized invoices.** `BridgeClient.fetchInvoices()`
+  read `content`/`totalElements`/`totalPages` directly off the top-level
+  parsed JSON body, but `GET /api/v1/portal/embed/invoices` (like every
+  other Aforo endpoint) wraps its payload in `{success, data, meta}` via the
+  platform's global `ApiResponseAdvice`. `body.content` was therefore always
+  `undefined`, silently falling back to an empty page — same failure mode
+  as the pricing-card `offerings` bug fixed in 1.0.5, just never applied
+  here. Live-verified: the API correctly returned 3 real invoices
+  (confirmed via direct backend testing) while the widget rendered "No
+  invoices yet." `fetchInvoicePdfUrl()` and `initiateInvoicePayment()` had
+  the identical bug and are fixed the same way (`raw.data ?? raw` unwrap,
+  matching the existing pattern already used in `exchange()` /
+  `fetchHeadlessConfig()` / `initiateCheckout()`).
+
 ## [1.0.6] — 2026-08-26
 
 ### Fixed

package/dist/{AforoEmbed-VYb6_GXB.d.cts → AforoEmbed-BX2HPXWT.d.cts}

@@ -1,4 +1,4 @@
-import { aD as WidgetMountConfig, Q as AforoEventType, N as AforoEventPayload, aC as WidgetId } from './types-BbQw2_32.cjs';
+import { aD as WidgetMountConfig, Q as AforoEventType, N as AforoEventPayload, aC as WidgetId } from './types-RMTEXoGw.cjs';
 
 /**
  * AforoEmbed — vanilla-JS + script-tag mount API.

package/dist/{AforoEmbed-BkJF1hAN.d.ts → AforoEmbed-PsTY7zh0.d.ts}

@@ -1,4 +1,4 @@
-import { aD as WidgetMountConfig, Q as AforoEventType, N as AforoEventPayload, aC as WidgetId } from './types-BbQw2_32.js';
+import { aD as WidgetMountConfig, Q as AforoEventType, N as AforoEventPayload, aC as WidgetId } from './types-RMTEXoGw.js';
 
 /**
  * AforoEmbed — vanilla-JS + script-tag mount API.

package/dist/index.cjs

@@ -510,8 +510,9 @@ var _BridgeClient = class _BridgeClient {
     }
     if (!resp.ok) return emptyPage;
     try {
-      const body = await resp.json();
-      if (!body || typeof body !== "object") return emptyPage;
+      const raw = await resp.json();
+      if (!raw || typeof raw !== "object") return emptyPage;
+      const body = raw.data ?? raw;
       return {
         content: Array.isArray(body.content) ? body.content : [],
         totalElements: typeof body.totalElements === "number" && Number.isFinite(body.totalElements) ? body.totalElements : 0,
@@ -554,7 +555,8 @@ var _BridgeClient = class _BridgeClient {
     }
     if (!resp.ok) return null;
     try {
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : null;
       if (!body || typeof body.downloadUrl !== "string" || body.downloadUrl.length === 0) {
         return null;
       }
@@ -643,7 +645,8 @@ var _BridgeClient = class _BridgeClient {
     }
     let body;
     try {
-      body = await resp.json();
+      const raw = await resp.json();
+      body = raw?.data ?? raw;
     } catch {
       throw new BridgeClientError(
         "Malformed invoice-payment-initiate response (not JSON)",
@@ -954,9 +957,9 @@ var _BridgeClient = class _BridgeClient {
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed confirmCart response (not JSON)",
@@ -965,6 +968,7 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
+    const body = raw?.data ?? raw ?? {};
     if (!body.cartId || !body.status) {
       throw new BridgeClientError(
         "Malformed confirmCart response (missing required fields)",
@@ -1029,9 +1033,9 @@ var _BridgeClient = class _BridgeClient {
    * undefined access.
    */
   async parseCartResponse(resp, methodName) {
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         `Malformed ${methodName} response (not JSON)`,
@@ -1040,7 +1044,8 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
-    if (!body.cartId || !body.cartType || !body.status || !body.targetId) {
+    const data = raw?.data ?? raw ?? {};
+    if (!data.cartId || !data.cartType || !data.status || !data.targetId) {
       throw new BridgeClientError(
         `Malformed ${methodName} response (missing required fields)`,
         500,
@@ -1049,21 +1054,21 @@ var _BridgeClient = class _BridgeClient {
       );
     }
     return {
-      cartId: body.cartId,
-      cartType: body.cartType,
-      targetId: body.targetId,
-      status: body.status,
-      totalCents: typeof body.totalCents === "number" && Number.isFinite(body.totalCents) ? body.totalCents : 0,
-      currency: typeof body.currency === "string" ? body.currency : "USD",
-      gatewayProvider: body.gatewayProvider ?? null,
-      gatewayClientSecret: body.gatewayClientSecret ?? null,
-      gatewayOrderId: body.gatewayOrderId ?? null,
-      gatewayApprovalUrl: body.gatewayApprovalUrl ?? null,
-      gatewaySandboxMode: body.gatewaySandboxMode ?? null,
-      subscriptionId: body.subscriptionId ?? null,
-      invoiceId: body.invoiceId ?? null,
-      expiresAt: typeof body.expiresAt === "string" ? body.expiresAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-      completedAt: body.completedAt ?? null
+      cartId: data.cartId,
+      cartType: data.cartType,
+      targetId: data.targetId,
+      status: data.status,
+      totalCents: typeof data.totalCents === "number" && Number.isFinite(data.totalCents) ? data.totalCents : 0,
+      currency: typeof data.currency === "string" ? data.currency : "USD",
+      gatewayProvider: data.gatewayProvider ?? null,
+      gatewayClientSecret: data.gatewayClientSecret ?? null,
+      gatewayOrderId: data.gatewayOrderId ?? null,
+      gatewayApprovalUrl: data.gatewayApprovalUrl ?? null,
+      gatewaySandboxMode: data.gatewaySandboxMode ?? null,
+      subscriptionId: data.subscriptionId ?? null,
+      invoiceId: data.invoiceId ?? null,
+      expiresAt: typeof data.expiresAt === "string" ? data.expiresAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+      completedAt: data.completedAt ?? null
     };
   }
   /** Public liveness probe. Returns null on failure (not an error). */
@@ -1424,14 +1429,17 @@ var _BridgeClient = class _BridgeClient {
         idempotencyKey,
         sessionJwt
       }),
-      body: JSON.stringify(request)
+      // 2026-08-29 fix: same bug as cancelSubscription() below — EmbedUpgradeRequest
+      // requires idempotencyKey as a @NotBlank BODY field, but this only ever sent
+      // it via the Idempotency-Key header.
+      body: JSON.stringify({ ...request, idempotencyKey })
     });
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed upgrade response (not JSON)",
@@ -1440,6 +1448,7 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
+    const body = raw ? raw.data ?? raw : {};
     if (!body.subscriptionId || !body.previousOfferingId || !body.newOfferingId || !body.status) {
       throw new BridgeClientError(
         "Malformed upgrade response (missing required fields)",
@@ -1503,14 +1512,19 @@ var _BridgeClient = class _BridgeClient {
         idempotencyKey,
         sessionJwt
       }),
-      body: JSON.stringify(request)
+      // 2026-08-29 fix: EmbedCancelRequest (storefront-service) requires
+      // idempotencyKey as a @NotBlank BODY field — this only ever sent it
+      // via the Idempotency-Key header, so every real cancellation 400'd
+      // with "idempotencyKey is required" regardless of any other field.
+      // Confirmed live against production.
+      body: JSON.stringify({ ...request, idempotencyKey })
     });
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed cancel response (not JSON)",
@@ -1519,7 +1533,8 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
-    if (!body.subscriptionId || !body.status || !body.effectiveAt || !body.feedbackId) {
+    const body = raw ? raw.data ?? raw : null;
+    if (!body || !body.subscriptionId || !body.status || !body.effectiveAt) {
       throw new BridgeClientError(
         "Malformed cancel response (missing required fields)",
         500,
@@ -1532,7 +1547,7 @@ var _BridgeClient = class _BridgeClient {
       status: body.status,
       cancelledAt: body.cancelledAt ?? null,
       effectiveAt: body.effectiveAt,
-      feedbackId: body.feedbackId,
+      feedbackId: body.feedbackId ?? null,
       creditNoteId: body.creditNoteId ?? null
     };
   }
@@ -1562,7 +1577,8 @@ var _BridgeClient = class _BridgeClient {
       if (!resp.ok) {
         return { methods: [], defaultMethodId: null };
       }
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : {};
       return {
         methods: Array.isArray(body.methods) ? body.methods : [],
         defaultMethodId: body.defaultMethodId ?? null
@@ -1592,7 +1608,8 @@ var _BridgeClient = class _BridgeClient {
         body: JSON.stringify({})
       });
       if (!resp.ok) return null;
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : {};
       if (!body.clientSecret) return null;
       return {
         clientSecret: body.clientSecret,
@@ -12208,7 +12225,7 @@ function ResultPanel({
 }
 
 // src/core/version.ts
-var VERSION = "1.0.6";
+var VERSION = "1.0.11";
 
 // src/core/AforoEmbed.ts
 var mountedElements = /* @__PURE__ */ new WeakMap();

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import * as React from 'react';
-import { T as ThemeTokenOverrides, O as OfferingPayload, H as HeadlessConfigResponse, S as SubscriptionPayload, W as WidgetErrorPayload, a as SubscriptionForOfferingResponse, C as CheckoutCartType, b as CheckoutConfirmedPayload, c as CheckoutCancelledPayload, d as CheckoutCartResponse, e as SubscriptionStatusFilter, f as SubscriptionPayloadV2, g as SubscriptionPageResponse, I as InvoiceStatusFilter, h as InvoicePayload, i as InvoicePageResponse, U as UsageMetricPayload, j as UsageThreshold, k as UsageResponse, P as PaymentMethodListResponse, A as ApplyAt, l as UpgradeCancelResultPayload, D as DemoModeBridgeProvider, m as TenantBrandKit, n as InitiateCheckoutRequest, o as InitiateCheckoutResponse, p as InvoiceListFilter, q as InvoicePdfUrlResponse, r as InitiateInvoicePaymentRequest, s as InitiateInvoicePaymentResponse, t as CreateCartRequest, u as UpdateCustomerDetailsRequest, v as InitiateCartPaymentRequest, w as ConfirmCartResponse, R as RequestMagicLinkRequest, x as RequestMagicLinkResponse, V as VerifyMagicLinkResponse, y as SubscriptionListFilter, z as PreviewChangeRequest, B as PreviewChangeResponse, E as UpgradeRequest, F as UpgradeResponse, G as CancelWithFeedbackRequest, J as CancelResponse, K as SetupIntentResponse, L as SessionConfig, M as SessionState } from './types-BbQw2_32.cjs';
-export { N as AforoEventPayload, Q as AforoEventType, X as CancelReason, Y as CheckoutBillingAddress, Z as CheckoutCartErrorResponse, _ as CheckoutCartStatus, $ as CheckoutCustomerDetailsSubmittedPayload, a0 as CheckoutExpiredPayload, a1 as CheckoutFlowPhase, a2 as CheckoutPaymentCompletedPayload, a3 as CheckoutPaymentInitiatedPayload, a4 as CheckoutPaymentProvider, a5 as CheckoutStepChangedPayload, a6 as ConsentState, a7 as FeaturePayload, a8 as HeadlessBrandingPayload, a9 as InvoiceDownloadedPayload, aa as InvoiceExpandedPayload, ab as InvoiceFilterChangedPayload, ac as InvoicePaidPayload, ad as InvoicePayRequestedPayload, ae as InvoiceSearchChangedPayload, af as InvoiceStatus, ag as InvoiceTypeKind, ah as LiveSubscriptionStatus, ai as MagicLinkFailureCode, aj as OfferingSummary, ak as RatePlanPayload, al as RetentionOfferShown, am as RetentionOutcome, an as SubscriptionCancelRequestedPayload, ao as SubscriptionChangeType, ap as SubscriptionClickedPayload, aq as SubscriptionFilterChangedPayload, ar as SubscriptionStatus, as as SubscriptionUpgradeRequestedPayload, at as ThemeTokens, au as UpgradeCancelAbandonedPayload, av as UpgradeCancelCompletedPayload, aw as UpgradeCancelDeflectionOfferAcceptedPayload, ax as UpgradeCancelDeflectionOfferShownPayload, ay as UpgradeCancelPreviewFetchedPayload, az as UpgradeCancelStepChangedPayload, aA as UsageMetricClickedPayload, aB as UsageThresholdReachedPayload, aC as WidgetId, aD as WidgetMountConfig } from './types-BbQw2_32.cjs';
-export { A as AforoEmbed } from './AforoEmbed-VYb6_GXB.cjs';
+import { T as ThemeTokenOverrides, O as OfferingPayload, H as HeadlessConfigResponse, S as SubscriptionPayload, W as WidgetErrorPayload, a as SubscriptionForOfferingResponse, C as CheckoutCartType, b as CheckoutConfirmedPayload, c as CheckoutCancelledPayload, d as CheckoutCartResponse, e as SubscriptionStatusFilter, f as SubscriptionPayloadV2, g as SubscriptionPageResponse, I as InvoiceStatusFilter, h as InvoicePayload, i as InvoicePageResponse, U as UsageMetricPayload, j as UsageThreshold, k as UsageResponse, P as PaymentMethodListResponse, A as ApplyAt, l as UpgradeCancelResultPayload, D as DemoModeBridgeProvider, m as TenantBrandKit, n as InitiateCheckoutRequest, o as InitiateCheckoutResponse, p as InvoiceListFilter, q as InvoicePdfUrlResponse, r as InitiateInvoicePaymentRequest, s as InitiateInvoicePaymentResponse, t as CreateCartRequest, u as UpdateCustomerDetailsRequest, v as InitiateCartPaymentRequest, w as ConfirmCartResponse, R as RequestMagicLinkRequest, x as RequestMagicLinkResponse, V as VerifyMagicLinkResponse, y as SubscriptionListFilter, z as PreviewChangeRequest, B as PreviewChangeResponse, E as UpgradeRequest, F as UpgradeResponse, G as CancelWithFeedbackRequest, J as CancelResponse, K as SetupIntentResponse, L as SessionConfig, M as SessionState } from './types-RMTEXoGw.cjs';
+export { N as AforoEventPayload, Q as AforoEventType, X as CancelReason, Y as CheckoutBillingAddress, Z as CheckoutCartErrorResponse, _ as CheckoutCartStatus, $ as CheckoutCustomerDetailsSubmittedPayload, a0 as CheckoutExpiredPayload, a1 as CheckoutFlowPhase, a2 as CheckoutPaymentCompletedPayload, a3 as CheckoutPaymentInitiatedPayload, a4 as CheckoutPaymentProvider, a5 as CheckoutStepChangedPayload, a6 as ConsentState, a7 as FeaturePayload, a8 as HeadlessBrandingPayload, a9 as InvoiceDownloadedPayload, aa as InvoiceExpandedPayload, ab as InvoiceFilterChangedPayload, ac as InvoicePaidPayload, ad as InvoicePayRequestedPayload, ae as InvoiceSearchChangedPayload, af as InvoiceStatus, ag as InvoiceTypeKind, ah as LiveSubscriptionStatus, ai as MagicLinkFailureCode, aj as OfferingSummary, ak as RatePlanPayload, al as RetentionOfferShown, am as RetentionOutcome, an as SubscriptionCancelRequestedPayload, ao as SubscriptionChangeType, ap as SubscriptionClickedPayload, aq as SubscriptionFilterChangedPayload, ar as SubscriptionStatus, as as SubscriptionUpgradeRequestedPayload, at as ThemeTokens, au as UpgradeCancelAbandonedPayload, av as UpgradeCancelCompletedPayload, aw as UpgradeCancelDeflectionOfferAcceptedPayload, ax as UpgradeCancelDeflectionOfferShownPayload, ay as UpgradeCancelPreviewFetchedPayload, az as UpgradeCancelStepChangedPayload, aA as UsageMetricClickedPayload, aB as UsageThresholdReachedPayload, aC as WidgetId, aD as WidgetMountConfig } from './types-RMTEXoGw.cjs';
+export { A as AforoEmbed } from './AforoEmbed-BX2HPXWT.cjs';
 export { EmbedEnvironment, EmbedKey } from '@aforoai/types';
 
 /**

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as React from 'react';
-import { T as ThemeTokenOverrides, O as OfferingPayload, H as HeadlessConfigResponse, S as SubscriptionPayload, W as WidgetErrorPayload, a as SubscriptionForOfferingResponse, C as CheckoutCartType, b as CheckoutConfirmedPayload, c as CheckoutCancelledPayload, d as CheckoutCartResponse, e as SubscriptionStatusFilter, f as SubscriptionPayloadV2, g as SubscriptionPageResponse, I as InvoiceStatusFilter, h as InvoicePayload, i as InvoicePageResponse, U as UsageMetricPayload, j as UsageThreshold, k as UsageResponse, P as PaymentMethodListResponse, A as ApplyAt, l as UpgradeCancelResultPayload, D as DemoModeBridgeProvider, m as TenantBrandKit, n as InitiateCheckoutRequest, o as InitiateCheckoutResponse, p as InvoiceListFilter, q as InvoicePdfUrlResponse, r as InitiateInvoicePaymentRequest, s as InitiateInvoicePaymentResponse, t as CreateCartRequest, u as UpdateCustomerDetailsRequest, v as InitiateCartPaymentRequest, w as ConfirmCartResponse, R as RequestMagicLinkRequest, x as RequestMagicLinkResponse, V as VerifyMagicLinkResponse, y as SubscriptionListFilter, z as PreviewChangeRequest, B as PreviewChangeResponse, E as UpgradeRequest, F as UpgradeResponse, G as CancelWithFeedbackRequest, J as CancelResponse, K as SetupIntentResponse, L as SessionConfig, M as SessionState } from './types-BbQw2_32.js';
-export { N as AforoEventPayload, Q as AforoEventType, X as CancelReason, Y as CheckoutBillingAddress, Z as CheckoutCartErrorResponse, _ as CheckoutCartStatus, $ as CheckoutCustomerDetailsSubmittedPayload, a0 as CheckoutExpiredPayload, a1 as CheckoutFlowPhase, a2 as CheckoutPaymentCompletedPayload, a3 as CheckoutPaymentInitiatedPayload, a4 as CheckoutPaymentProvider, a5 as CheckoutStepChangedPayload, a6 as ConsentState, a7 as FeaturePayload, a8 as HeadlessBrandingPayload, a9 as InvoiceDownloadedPayload, aa as InvoiceExpandedPayload, ab as InvoiceFilterChangedPayload, ac as InvoicePaidPayload, ad as InvoicePayRequestedPayload, ae as InvoiceSearchChangedPayload, af as InvoiceStatus, ag as InvoiceTypeKind, ah as LiveSubscriptionStatus, ai as MagicLinkFailureCode, aj as OfferingSummary, ak as RatePlanPayload, al as RetentionOfferShown, am as RetentionOutcome, an as SubscriptionCancelRequestedPayload, ao as SubscriptionChangeType, ap as SubscriptionClickedPayload, aq as SubscriptionFilterChangedPayload, ar as SubscriptionStatus, as as SubscriptionUpgradeRequestedPayload, at as ThemeTokens, au as UpgradeCancelAbandonedPayload, av as UpgradeCancelCompletedPayload, aw as UpgradeCancelDeflectionOfferAcceptedPayload, ax as UpgradeCancelDeflectionOfferShownPayload, ay as UpgradeCancelPreviewFetchedPayload, az as UpgradeCancelStepChangedPayload, aA as UsageMetricClickedPayload, aB as UsageThresholdReachedPayload, aC as WidgetId, aD as WidgetMountConfig } from './types-BbQw2_32.js';
-export { A as AforoEmbed } from './AforoEmbed-BkJF1hAN.js';
+import { T as ThemeTokenOverrides, O as OfferingPayload, H as HeadlessConfigResponse, S as SubscriptionPayload, W as WidgetErrorPayload, a as SubscriptionForOfferingResponse, C as CheckoutCartType, b as CheckoutConfirmedPayload, c as CheckoutCancelledPayload, d as CheckoutCartResponse, e as SubscriptionStatusFilter, f as SubscriptionPayloadV2, g as SubscriptionPageResponse, I as InvoiceStatusFilter, h as InvoicePayload, i as InvoicePageResponse, U as UsageMetricPayload, j as UsageThreshold, k as UsageResponse, P as PaymentMethodListResponse, A as ApplyAt, l as UpgradeCancelResultPayload, D as DemoModeBridgeProvider, m as TenantBrandKit, n as InitiateCheckoutRequest, o as InitiateCheckoutResponse, p as InvoiceListFilter, q as InvoicePdfUrlResponse, r as InitiateInvoicePaymentRequest, s as InitiateInvoicePaymentResponse, t as CreateCartRequest, u as UpdateCustomerDetailsRequest, v as InitiateCartPaymentRequest, w as ConfirmCartResponse, R as RequestMagicLinkRequest, x as RequestMagicLinkResponse, V as VerifyMagicLinkResponse, y as SubscriptionListFilter, z as PreviewChangeRequest, B as PreviewChangeResponse, E as UpgradeRequest, F as UpgradeResponse, G as CancelWithFeedbackRequest, J as CancelResponse, K as SetupIntentResponse, L as SessionConfig, M as SessionState } from './types-RMTEXoGw.js';
+export { N as AforoEventPayload, Q as AforoEventType, X as CancelReason, Y as CheckoutBillingAddress, Z as CheckoutCartErrorResponse, _ as CheckoutCartStatus, $ as CheckoutCustomerDetailsSubmittedPayload, a0 as CheckoutExpiredPayload, a1 as CheckoutFlowPhase, a2 as CheckoutPaymentCompletedPayload, a3 as CheckoutPaymentInitiatedPayload, a4 as CheckoutPaymentProvider, a5 as CheckoutStepChangedPayload, a6 as ConsentState, a7 as FeaturePayload, a8 as HeadlessBrandingPayload, a9 as InvoiceDownloadedPayload, aa as InvoiceExpandedPayload, ab as InvoiceFilterChangedPayload, ac as InvoicePaidPayload, ad as InvoicePayRequestedPayload, ae as InvoiceSearchChangedPayload, af as InvoiceStatus, ag as InvoiceTypeKind, ah as LiveSubscriptionStatus, ai as MagicLinkFailureCode, aj as OfferingSummary, ak as RatePlanPayload, al as RetentionOfferShown, am as RetentionOutcome, an as SubscriptionCancelRequestedPayload, ao as SubscriptionChangeType, ap as SubscriptionClickedPayload, aq as SubscriptionFilterChangedPayload, ar as SubscriptionStatus, as as SubscriptionUpgradeRequestedPayload, at as ThemeTokens, au as UpgradeCancelAbandonedPayload, av as UpgradeCancelCompletedPayload, aw as UpgradeCancelDeflectionOfferAcceptedPayload, ax as UpgradeCancelDeflectionOfferShownPayload, ay as UpgradeCancelPreviewFetchedPayload, az as UpgradeCancelStepChangedPayload, aA as UsageMetricClickedPayload, aB as UsageThresholdReachedPayload, aC as WidgetId, aD as WidgetMountConfig } from './types-RMTEXoGw.js';
+export { A as AforoEmbed } from './AforoEmbed-PsTY7zh0.js';
 export { EmbedEnvironment, EmbedKey } from '@aforoai/types';
 
 /**

package/dist/index.mjs

@@ -488,8 +488,9 @@ var _BridgeClient = class _BridgeClient {
     }
     if (!resp.ok) return emptyPage;
     try {
-      const body = await resp.json();
-      if (!body || typeof body !== "object") return emptyPage;
+      const raw = await resp.json();
+      if (!raw || typeof raw !== "object") return emptyPage;
+      const body = raw.data ?? raw;
       return {
         content: Array.isArray(body.content) ? body.content : [],
         totalElements: typeof body.totalElements === "number" && Number.isFinite(body.totalElements) ? body.totalElements : 0,
@@ -532,7 +533,8 @@ var _BridgeClient = class _BridgeClient {
     }
     if (!resp.ok) return null;
     try {
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : null;
       if (!body || typeof body.downloadUrl !== "string" || body.downloadUrl.length === 0) {
         return null;
       }
@@ -621,7 +623,8 @@ var _BridgeClient = class _BridgeClient {
     }
     let body;
     try {
-      body = await resp.json();
+      const raw = await resp.json();
+      body = raw?.data ?? raw;
     } catch {
       throw new BridgeClientError(
         "Malformed invoice-payment-initiate response (not JSON)",
@@ -932,9 +935,9 @@ var _BridgeClient = class _BridgeClient {
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed confirmCart response (not JSON)",
@@ -943,6 +946,7 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
+    const body = raw?.data ?? raw ?? {};
     if (!body.cartId || !body.status) {
       throw new BridgeClientError(
         "Malformed confirmCart response (missing required fields)",
@@ -1007,9 +1011,9 @@ var _BridgeClient = class _BridgeClient {
    * undefined access.
    */
   async parseCartResponse(resp, methodName) {
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         `Malformed ${methodName} response (not JSON)`,
@@ -1018,7 +1022,8 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
-    if (!body.cartId || !body.cartType || !body.status || !body.targetId) {
+    const data = raw?.data ?? raw ?? {};
+    if (!data.cartId || !data.cartType || !data.status || !data.targetId) {
       throw new BridgeClientError(
         `Malformed ${methodName} response (missing required fields)`,
         500,
@@ -1027,21 +1032,21 @@ var _BridgeClient = class _BridgeClient {
       );
     }
     return {
-      cartId: body.cartId,
-      cartType: body.cartType,
-      targetId: body.targetId,
-      status: body.status,
-      totalCents: typeof body.totalCents === "number" && Number.isFinite(body.totalCents) ? body.totalCents : 0,
-      currency: typeof body.currency === "string" ? body.currency : "USD",
-      gatewayProvider: body.gatewayProvider ?? null,
-      gatewayClientSecret: body.gatewayClientSecret ?? null,
-      gatewayOrderId: body.gatewayOrderId ?? null,
-      gatewayApprovalUrl: body.gatewayApprovalUrl ?? null,
-      gatewaySandboxMode: body.gatewaySandboxMode ?? null,
-      subscriptionId: body.subscriptionId ?? null,
-      invoiceId: body.invoiceId ?? null,
-      expiresAt: typeof body.expiresAt === "string" ? body.expiresAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-      completedAt: body.completedAt ?? null
+      cartId: data.cartId,
+      cartType: data.cartType,
+      targetId: data.targetId,
+      status: data.status,
+      totalCents: typeof data.totalCents === "number" && Number.isFinite(data.totalCents) ? data.totalCents : 0,
+      currency: typeof data.currency === "string" ? data.currency : "USD",
+      gatewayProvider: data.gatewayProvider ?? null,
+      gatewayClientSecret: data.gatewayClientSecret ?? null,
+      gatewayOrderId: data.gatewayOrderId ?? null,
+      gatewayApprovalUrl: data.gatewayApprovalUrl ?? null,
+      gatewaySandboxMode: data.gatewaySandboxMode ?? null,
+      subscriptionId: data.subscriptionId ?? null,
+      invoiceId: data.invoiceId ?? null,
+      expiresAt: typeof data.expiresAt === "string" ? data.expiresAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+      completedAt: data.completedAt ?? null
     };
   }
   /** Public liveness probe. Returns null on failure (not an error). */
@@ -1402,14 +1407,17 @@ var _BridgeClient = class _BridgeClient {
         idempotencyKey,
         sessionJwt
       }),
-      body: JSON.stringify(request)
+      // 2026-08-29 fix: same bug as cancelSubscription() below — EmbedUpgradeRequest
+      // requires idempotencyKey as a @NotBlank BODY field, but this only ever sent
+      // it via the Idempotency-Key header.
+      body: JSON.stringify({ ...request, idempotencyKey })
     });
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed upgrade response (not JSON)",
@@ -1418,6 +1426,7 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
+    const body = raw ? raw.data ?? raw : {};
     if (!body.subscriptionId || !body.previousOfferingId || !body.newOfferingId || !body.status) {
       throw new BridgeClientError(
         "Malformed upgrade response (missing required fields)",
@@ -1481,14 +1490,19 @@ var _BridgeClient = class _BridgeClient {
         idempotencyKey,
         sessionJwt
       }),
-      body: JSON.stringify(request)
+      // 2026-08-29 fix: EmbedCancelRequest (storefront-service) requires
+      // idempotencyKey as a @NotBlank BODY field — this only ever sent it
+      // via the Idempotency-Key header, so every real cancellation 400'd
+      // with "idempotencyKey is required" regardless of any other field.
+      // Confirmed live against production.
+      body: JSON.stringify({ ...request, idempotencyKey })
     });
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed cancel response (not JSON)",
@@ -1497,7 +1511,8 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
-    if (!body.subscriptionId || !body.status || !body.effectiveAt || !body.feedbackId) {
+    const body = raw ? raw.data ?? raw : null;
+    if (!body || !body.subscriptionId || !body.status || !body.effectiveAt) {
       throw new BridgeClientError(
         "Malformed cancel response (missing required fields)",
         500,
@@ -1510,7 +1525,7 @@ var _BridgeClient = class _BridgeClient {
       status: body.status,
       cancelledAt: body.cancelledAt ?? null,
       effectiveAt: body.effectiveAt,
-      feedbackId: body.feedbackId,
+      feedbackId: body.feedbackId ?? null,
       creditNoteId: body.creditNoteId ?? null
     };
   }
@@ -1540,7 +1555,8 @@ var _BridgeClient = class _BridgeClient {
       if (!resp.ok) {
         return { methods: [], defaultMethodId: null };
       }
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : {};
       return {
         methods: Array.isArray(body.methods) ? body.methods : [],
         defaultMethodId: body.defaultMethodId ?? null
@@ -1570,7 +1586,8 @@ var _BridgeClient = class _BridgeClient {
         body: JSON.stringify({})
       });
       if (!resp.ok) return null;
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : {};
       if (!body.clientSecret) return null;
       return {
         clientSecret: body.clientSecret,
@@ -12186,7 +12203,7 @@ function ResultPanel({
 }
 
 // src/core/version.ts
-var VERSION = "1.0.6";
+var VERSION = "1.0.11";
 
 // src/core/AforoEmbed.ts
 var mountedElements = /* @__PURE__ */ new WeakMap();

package/dist/loader.js

@@ -1,3 +1,3 @@
-var AforoEmbedLoader=(function(exports){'use strict';var T="1.0.6";var y=new WeakMap,c=new Map,f={},A=false;function h(){A||typeof window!="undefined"&&(window.addEventListener("message",e=>{let t=e.data;!t||typeof t!="object"||typeof t.type!="string"||t.type.startsWith("aforo.")&&$(t);}),A=true);}function $(e){let t=c.get(e.type);if(t)for(let o of t)try{o(e);}catch(i){}let n=c.get("*");if(n)for(let o of n)try{o(e);}catch(i){}}var p=new Map;function N(e,t){p.set(e,t);}function w(e){return typeof e=="object"&&e!==null&&typeof e.tagName=="string"}var b={version:T,configure(e){f={...f,...e};},getConfig(){return {...f}},mount(e,t){var r,l,u,s,d;if(!w(e)||y.has(e))return  false;let n=t.widget,o=p.get(n);if(!o)return typeof console!="undefined"&&console.warn(`[aforo:embed] No mount handler registered for widget "${n}". Loader bundle may not have finished loading.`),false;let i={widget:n,tenantSlug:(l=(r=t.tenantSlug)!=null?r:f.tenantSlug)!=null?l:"",embedKey:(s=(u=t.embedKey)!=null?u:f.embedKey)!=null?s:"",bridgeToken:(d=t.bridgeToken)!=null?d:f.bridgeToken,layout:t.layout,themeOverrides:t.themeOverrides,config:t.config};if(!i.tenantSlug||!i.embedKey)return typeof console!="undefined"&&console.error(`[aforo:embed] Widget "${n}" requires tenantSlug + embedKey. Provide via AforoEmbed.configure() or data-* attributes.`),false;h();let a=o(e,i);return y.set(e,{element:e,widget:n,teardown:a}),true},unmount(e){if(!w(e))return  false;let t=y.get(e);if(!t)return  false;try{t.teardown();}catch(n){}return y.delete(e),true},on(e,t){h();let n=c.get(e);return n||(n=new Set,c.set(e,n)),n.add(t),()=>{let o=c.get(e);o&&(o.delete(t),o.size===0&&c.delete(e));}},_registerWidget:N,_registeredWidgetsForTesting(){return Array.from(p.keys())},_resetForTesting(){p.clear(),c.clear(),f={};}};function k(e){if(!e)return {};try{let t=JSON.parse(e);if(t&&typeof t=="object"&&!Array.isArray(t)){let n={},o=["primary","primaryContrast","text","textMuted","bg","border","radius","fontFamily"],i=t;for(let a of o){let r=i[a];typeof r=="string"&&r.length>0&&(n[a]=r);}return n}}catch(t){}return {}}var U=new Set(["pricing-card","subscribe-button","checkout-flow","subscription-manager","invoice-list","usage-meter","payment-method","upgrade-cancel"]),B="https://embed.aforo.ai/v1/widgets",g="[aforo:loader]";function D(){let e=typeof document!="undefined"?document.currentScript:null;if(e&&e.tagName==="SCRIPT")return e;if(typeof document!="undefined"){let t=document.getElementsByTagName("script");for(let n=t.length-1;n>=0;n--){let o=t[n];if(!o)continue;let i=o.getAttribute("src")||"";if(/(\/v1)?\/loader(\.umd)?\.js$/.test(i))return o}}return null}function G(e){let t=e==null?void 0:e.getAttribute("src");if(!t)return null;try{let n=typeof location!="undefined"?location.href:void 0,o=new URL(t,n),i=o.pathname.replace(/\/loader(\.umd)?\.js$/,"");return `${o.origin}${i}/widgets`}catch(n){return null}}function v(e,t){let n=e.getAttribute(t);if(n==null||n.trim()==="")return;let o=Number(n);return Number.isFinite(o)?o:void 0}function j(e,t){let n=e.getAttribute(t);if(n==null)return;let o=n.trim().toLowerCase();if(o==="true")return  true;if(o==="false")return  false}function V(e){let t=(e.getAttribute("data-aforo-widget")||"").trim(),n=e.getAttribute("data-tenant-slug")||e.getAttribute("data-tenant")||"",o=e.getAttribute("data-embed-key")||"",i=e.getAttribute("data-bridge-token")||void 0,a=e.getAttribute("data-layout")||void 0,r=k(e.getAttribute("data-theme-overrides")),l=e.getAttribute("data-offering-id")||void 0,u=e.getAttribute("data-subscription-id")||void 0,s=e.getAttribute("data-metric")||void 0,d=e.getAttribute("data-featured-offering-id")||void 0,m=e.getAttribute("data-mode")||void 0,M=e.getAttribute("data-return-url")||void 0,S=e.getAttribute("data-default-status")||void 0,F=e.getAttribute("data-render-mode")||void 0,_=e.getAttribute("data-locale")||void 0,C=v(e,"data-page-size"),O=v(e,"data-poll-interval-ms"),I=e.getAttribute("data-theme")||void 0,R=e.getAttribute("data-cart-type")||void 0,W=e.getAttribute("data-target-id")||void 0,H=e.getAttribute("data-cta-text")||void 0,x=e.getAttribute("data-cta-url")||void 0,P=v(e,"data-max-plans"),K=j(e,"data-show-features");return {widget:t,tenantSlug:n,embedKey:o,bridgeToken:i,layout:a,themeOverrides:r,config:{offeringId:l,subscriptionId:u,metricName:s,featuredOfferingId:d,mode:m,returnUrl:M,defaultStatus:S,renderMode:F,locale:_,pageSize:C,pollIntervalMs:O,theme:I,cartType:R,targetId:W,ctaText:H,ctaUrl:x,maxPlans:P,showFeatures:K}}}function z(e,t,n){return new Promise((o,i)=>{if(typeof document=="undefined")return i(new Error("no document"));let a=document.querySelector(`script[data-aforo-bundle="${e}"]`);if(a){if(a.dataset.aforoLoaded==="1")return o();a.addEventListener("load",()=>o()),a.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`)));return}let r=document.createElement("script");r.src=`${t}/${e}.js`,r.async=true,r.crossOrigin="anonymous",r.dataset.aforoBundle=e,n&&r.setAttribute("nonce",n),r.addEventListener("load",()=>{r.dataset.aforoLoaded="1",o();}),r.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`))),document.head.appendChild(r);})}function L(e){if(!e.__aforoEmbedReadyFired){e.__aforoEmbedReadyFired=true;try{typeof e.aforoEmbedReady=="function"&&e.aforoEmbedReady();}catch(t){typeof console!="undefined"&&console.error(`${g} aforoEmbedReady callback threw`,t);}if(typeof document!="undefined"&&typeof CustomEvent!="undefined")try{document.dispatchEvent(new CustomEvent("aforoEmbedReady"));}catch(t){}}}async function E(e){if(typeof window=="undefined"||typeof document=="undefined")return;let t=window;if(window.location.protocol!=="https:"&&window.location.hostname!=="localhost"){typeof console!="undefined"&&console.error(`${g} Refusing to mount Aforo widgets on a non-HTTPS page. Embed Plugin requires HTTPS (FR-TIER-12). Current origin: ${window.location.origin}`);return}if(t.__aforoEmbedLoaderInitialized){typeof console!="undefined"&&console.warn(`${g} Loader already initialised on this page \u2014 skipping duplicate run.`);return}t.__aforoEmbedLoaderInitialized=true,t.aforoEmbed||(t.aforoEmbed=b);let n=D(),o=(n==null?void 0:n.getAttribute("nonce"))||null,i=(e==null?void 0:e.bundleBaseUrl)||G(n)||B,a=Array.from(document.querySelectorAll("[data-aforo-widget]"));if(a.length===0){L(t);return}let r=new Map;for(let u of a){let s=(u.getAttribute("data-aforo-widget")||"").trim();if(!U.has(s)){typeof console!="undefined"&&console.warn(`${g} Unknown widget id "${s}" \u2014 skipping`);continue}let d=r.get(s);d||(d=[],r.set(s,d)),d.push(u);}let l=Array.from(r.entries()).map(async([u,s])=>{try{await z(u,i,o);for(let d of s){let m=V(d);if(!m.widget||!m.tenantSlug||!m.embedKey){typeof console!="undefined"&&console.error(`${g} Placeholder missing required attributes (data-tenant-slug + data-embed-key). Skipping element.`,d);continue}b.mount(d,m);}}catch(d){typeof console!="undefined"&&console.error(`${g} Failed to load bundle for "${u}"`,d);}});await Promise.all(l).catch(()=>{}),L(t);}typeof document!="undefined"&&document.readyState!=="loading"?Promise.resolve().then(()=>{E();}):typeof document!="undefined"&&document.addEventListener("DOMContentLoaded",()=>{E();});b._loader={bootstrap:E};
+var AforoEmbedLoader=(function(exports){'use strict';var T="1.0.11";var y=new WeakMap,c=new Map,f={},A=false;function h(){A||typeof window!="undefined"&&(window.addEventListener("message",e=>{let t=e.data;!t||typeof t!="object"||typeof t.type!="string"||t.type.startsWith("aforo.")&&$(t);}),A=true);}function $(e){let t=c.get(e.type);if(t)for(let o of t)try{o(e);}catch(i){}let n=c.get("*");if(n)for(let o of n)try{o(e);}catch(i){}}var p=new Map;function N(e,t){p.set(e,t);}function w(e){return typeof e=="object"&&e!==null&&typeof e.tagName=="string"}var b={version:T,configure(e){f={...f,...e};},getConfig(){return {...f}},mount(e,t){var r,l,u,s,d;if(!w(e)||y.has(e))return  false;let n=t.widget,o=p.get(n);if(!o)return typeof console!="undefined"&&console.warn(`[aforo:embed] No mount handler registered for widget "${n}". Loader bundle may not have finished loading.`),false;let i={widget:n,tenantSlug:(l=(r=t.tenantSlug)!=null?r:f.tenantSlug)!=null?l:"",embedKey:(s=(u=t.embedKey)!=null?u:f.embedKey)!=null?s:"",bridgeToken:(d=t.bridgeToken)!=null?d:f.bridgeToken,layout:t.layout,themeOverrides:t.themeOverrides,config:t.config};if(!i.tenantSlug||!i.embedKey)return typeof console!="undefined"&&console.error(`[aforo:embed] Widget "${n}" requires tenantSlug + embedKey. Provide via AforoEmbed.configure() or data-* attributes.`),false;h();let a=o(e,i);return y.set(e,{element:e,widget:n,teardown:a}),true},unmount(e){if(!w(e))return  false;let t=y.get(e);if(!t)return  false;try{t.teardown();}catch(n){}return y.delete(e),true},on(e,t){h();let n=c.get(e);return n||(n=new Set,c.set(e,n)),n.add(t),()=>{let o=c.get(e);o&&(o.delete(t),o.size===0&&c.delete(e));}},_registerWidget:N,_registeredWidgetsForTesting(){return Array.from(p.keys())},_resetForTesting(){p.clear(),c.clear(),f={};}};function k(e){if(!e)return {};try{let t=JSON.parse(e);if(t&&typeof t=="object"&&!Array.isArray(t)){let n={},o=["primary","primaryContrast","text","textMuted","bg","border","radius","fontFamily"],i=t;for(let a of o){let r=i[a];typeof r=="string"&&r.length>0&&(n[a]=r);}return n}}catch(t){}return {}}var U=new Set(["pricing-card","subscribe-button","checkout-flow","subscription-manager","invoice-list","usage-meter","payment-method","upgrade-cancel"]),B="https://embed.aforo.ai/v1/widgets",g="[aforo:loader]";function D(){let e=typeof document!="undefined"?document.currentScript:null;if(e&&e.tagName==="SCRIPT")return e;if(typeof document!="undefined"){let t=document.getElementsByTagName("script");for(let n=t.length-1;n>=0;n--){let o=t[n];if(!o)continue;let i=o.getAttribute("src")||"";if(/(\/v1)?\/loader(\.umd)?\.js$/.test(i))return o}}return null}function G(e){let t=e==null?void 0:e.getAttribute("src");if(!t)return null;try{let n=typeof location!="undefined"?location.href:void 0,o=new URL(t,n),i=o.pathname.replace(/\/loader(\.umd)?\.js$/,"");return `${o.origin}${i}/widgets`}catch(n){return null}}function v(e,t){let n=e.getAttribute(t);if(n==null||n.trim()==="")return;let o=Number(n);return Number.isFinite(o)?o:void 0}function j(e,t){let n=e.getAttribute(t);if(n==null)return;let o=n.trim().toLowerCase();if(o==="true")return  true;if(o==="false")return  false}function V(e){let t=(e.getAttribute("data-aforo-widget")||"").trim(),n=e.getAttribute("data-tenant-slug")||e.getAttribute("data-tenant")||"",o=e.getAttribute("data-embed-key")||"",i=e.getAttribute("data-bridge-token")||void 0,a=e.getAttribute("data-layout")||void 0,r=k(e.getAttribute("data-theme-overrides")),l=e.getAttribute("data-offering-id")||void 0,u=e.getAttribute("data-subscription-id")||void 0,s=e.getAttribute("data-metric")||void 0,d=e.getAttribute("data-featured-offering-id")||void 0,m=e.getAttribute("data-mode")||void 0,M=e.getAttribute("data-return-url")||void 0,S=e.getAttribute("data-default-status")||void 0,F=e.getAttribute("data-render-mode")||void 0,_=e.getAttribute("data-locale")||void 0,C=v(e,"data-page-size"),O=v(e,"data-poll-interval-ms"),I=e.getAttribute("data-theme")||void 0,R=e.getAttribute("data-cart-type")||void 0,W=e.getAttribute("data-target-id")||void 0,H=e.getAttribute("data-cta-text")||void 0,x=e.getAttribute("data-cta-url")||void 0,P=v(e,"data-max-plans"),K=j(e,"data-show-features");return {widget:t,tenantSlug:n,embedKey:o,bridgeToken:i,layout:a,themeOverrides:r,config:{offeringId:l,subscriptionId:u,metricName:s,featuredOfferingId:d,mode:m,returnUrl:M,defaultStatus:S,renderMode:F,locale:_,pageSize:C,pollIntervalMs:O,theme:I,cartType:R,targetId:W,ctaText:H,ctaUrl:x,maxPlans:P,showFeatures:K}}}function z(e,t,n){return new Promise((o,i)=>{if(typeof document=="undefined")return i(new Error("no document"));let a=document.querySelector(`script[data-aforo-bundle="${e}"]`);if(a){if(a.dataset.aforoLoaded==="1")return o();a.addEventListener("load",()=>o()),a.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`)));return}let r=document.createElement("script");r.src=`${t}/${e}.js`,r.async=true,r.crossOrigin="anonymous",r.dataset.aforoBundle=e,n&&r.setAttribute("nonce",n),r.addEventListener("load",()=>{r.dataset.aforoLoaded="1",o();}),r.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`))),document.head.appendChild(r);})}function L(e){if(!e.__aforoEmbedReadyFired){e.__aforoEmbedReadyFired=true;try{typeof e.aforoEmbedReady=="function"&&e.aforoEmbedReady();}catch(t){typeof console!="undefined"&&console.error(`${g} aforoEmbedReady callback threw`,t);}if(typeof document!="undefined"&&typeof CustomEvent!="undefined")try{document.dispatchEvent(new CustomEvent("aforoEmbedReady"));}catch(t){}}}async function E(e){if(typeof window=="undefined"||typeof document=="undefined")return;let t=window;if(window.location.protocol!=="https:"&&window.location.hostname!=="localhost"){typeof console!="undefined"&&console.error(`${g} Refusing to mount Aforo widgets on a non-HTTPS page. Embed Plugin requires HTTPS (FR-TIER-12). Current origin: ${window.location.origin}`);return}if(t.__aforoEmbedLoaderInitialized){typeof console!="undefined"&&console.warn(`${g} Loader already initialised on this page \u2014 skipping duplicate run.`);return}t.__aforoEmbedLoaderInitialized=true,t.aforoEmbed||(t.aforoEmbed=b);let n=D(),o=(n==null?void 0:n.getAttribute("nonce"))||null,i=(e==null?void 0:e.bundleBaseUrl)||G(n)||B,a=Array.from(document.querySelectorAll("[data-aforo-widget]"));if(a.length===0){L(t);return}let r=new Map;for(let u of a){let s=(u.getAttribute("data-aforo-widget")||"").trim();if(!U.has(s)){typeof console!="undefined"&&console.warn(`${g} Unknown widget id "${s}" \u2014 skipping`);continue}let d=r.get(s);d||(d=[],r.set(s,d)),d.push(u);}let l=Array.from(r.entries()).map(async([u,s])=>{try{await z(u,i,o);for(let d of s){let m=V(d);if(!m.widget||!m.tenantSlug||!m.embedKey){typeof console!="undefined"&&console.error(`${g} Placeholder missing required attributes (data-tenant-slug + data-embed-key). Skipping element.`,d);continue}b.mount(d,m);}}catch(d){typeof console!="undefined"&&console.error(`${g} Failed to load bundle for "${u}"`,d);}});await Promise.all(l).catch(()=>{}),L(t);}typeof document!="undefined"&&document.readyState!=="loading"?Promise.resolve().then(()=>{E();}):typeof document!="undefined"&&document.addEventListener("DOMContentLoaded",()=>{E();});b._loader={bootstrap:E};
 exports.AforoEmbed=b;exports.bootstrap=E;return exports;})({});//# sourceMappingURL=loader.js.map
 //# sourceMappingURL=loader.js.map