@aforoai/storefront-widgets 1.0.6 → 1.0.11

package/dist/loader.mjs

@@ -1,3 +1,3 @@
-var T="1.0.6";var y=new WeakMap,c=new Map,f={},A=false;function h(){A||typeof window!="undefined"&&(window.addEventListener("message",e=>{let t=e.data;!t||typeof t!="object"||typeof t.type!="string"||t.type.startsWith("aforo.")&&$(t);}),A=true);}function $(e){let t=c.get(e.type);if(t)for(let o of t)try{o(e);}catch(i){}let n=c.get("*");if(n)for(let o of n)try{o(e);}catch(i){}}var p=new Map;function N(e,t){p.set(e,t);}function w(e){return typeof e=="object"&&e!==null&&typeof e.tagName=="string"}var b={version:T,configure(e){f={...f,...e};},getConfig(){return {...f}},mount(e,t){var r,l,u,s,d;if(!w(e)||y.has(e))return  false;let n=t.widget,o=p.get(n);if(!o)return typeof console!="undefined"&&console.warn(`[aforo:embed] No mount handler registered for widget "${n}". Loader bundle may not have finished loading.`),false;let i={widget:n,tenantSlug:(l=(r=t.tenantSlug)!=null?r:f.tenantSlug)!=null?l:"",embedKey:(s=(u=t.embedKey)!=null?u:f.embedKey)!=null?s:"",bridgeToken:(d=t.bridgeToken)!=null?d:f.bridgeToken,layout:t.layout,themeOverrides:t.themeOverrides,config:t.config};if(!i.tenantSlug||!i.embedKey)return typeof console!="undefined"&&console.error(`[aforo:embed] Widget "${n}" requires tenantSlug + embedKey. Provide via AforoEmbed.configure() or data-* attributes.`),false;h();let a=o(e,i);return y.set(e,{element:e,widget:n,teardown:a}),true},unmount(e){if(!w(e))return  false;let t=y.get(e);if(!t)return  false;try{t.teardown();}catch(n){}return y.delete(e),true},on(e,t){h();let n=c.get(e);return n||(n=new Set,c.set(e,n)),n.add(t),()=>{let o=c.get(e);o&&(o.delete(t),o.size===0&&c.delete(e));}},_registerWidget:N,_registeredWidgetsForTesting(){return Array.from(p.keys())},_resetForTesting(){p.clear(),c.clear(),f={};}};function k(e){if(!e)return {};try{let t=JSON.parse(e);if(t&&typeof t=="object"&&!Array.isArray(t)){let n={},o=["primary","primaryContrast","text","textMuted","bg","border","radius","fontFamily"],i=t;for(let a of o){let r=i[a];typeof r=="string"&&r.length>0&&(n[a]=r);}return n}}catch(t){}return {}}var U=new Set(["pricing-card","subscribe-button","checkout-flow","subscription-manager","invoice-list","usage-meter","payment-method","upgrade-cancel"]),B="https://embed.aforo.ai/v1/widgets",g="[aforo:loader]";function D(){let e=typeof document!="undefined"?document.currentScript:null;if(e&&e.tagName==="SCRIPT")return e;if(typeof document!="undefined"){let t=document.getElementsByTagName("script");for(let n=t.length-1;n>=0;n--){let o=t[n];if(!o)continue;let i=o.getAttribute("src")||"";if(/(\/v1)?\/loader(\.umd)?\.js$/.test(i))return o}}return null}function G(e){let t=e==null?void 0:e.getAttribute("src");if(!t)return null;try{let n=typeof location!="undefined"?location.href:void 0,o=new URL(t,n),i=o.pathname.replace(/\/loader(\.umd)?\.js$/,"");return `${o.origin}${i}/widgets`}catch(n){return null}}function v(e,t){let n=e.getAttribute(t);if(n==null||n.trim()==="")return;let o=Number(n);return Number.isFinite(o)?o:void 0}function j(e,t){let n=e.getAttribute(t);if(n==null)return;let o=n.trim().toLowerCase();if(o==="true")return  true;if(o==="false")return  false}function V(e){let t=(e.getAttribute("data-aforo-widget")||"").trim(),n=e.getAttribute("data-tenant-slug")||e.getAttribute("data-tenant")||"",o=e.getAttribute("data-embed-key")||"",i=e.getAttribute("data-bridge-token")||void 0,a=e.getAttribute("data-layout")||void 0,r=k(e.getAttribute("data-theme-overrides")),l=e.getAttribute("data-offering-id")||void 0,u=e.getAttribute("data-subscription-id")||void 0,s=e.getAttribute("data-metric")||void 0,d=e.getAttribute("data-featured-offering-id")||void 0,m=e.getAttribute("data-mode")||void 0,M=e.getAttribute("data-return-url")||void 0,S=e.getAttribute("data-default-status")||void 0,F=e.getAttribute("data-render-mode")||void 0,_=e.getAttribute("data-locale")||void 0,C=v(e,"data-page-size"),O=v(e,"data-poll-interval-ms"),I=e.getAttribute("data-theme")||void 0,R=e.getAttribute("data-cart-type")||void 0,W=e.getAttribute("data-target-id")||void 0,H=e.getAttribute("data-cta-text")||void 0,x=e.getAttribute("data-cta-url")||void 0,P=v(e,"data-max-plans"),K=j(e,"data-show-features");return {widget:t,tenantSlug:n,embedKey:o,bridgeToken:i,layout:a,themeOverrides:r,config:{offeringId:l,subscriptionId:u,metricName:s,featuredOfferingId:d,mode:m,returnUrl:M,defaultStatus:S,renderMode:F,locale:_,pageSize:C,pollIntervalMs:O,theme:I,cartType:R,targetId:W,ctaText:H,ctaUrl:x,maxPlans:P,showFeatures:K}}}function z(e,t,n){return new Promise((o,i)=>{if(typeof document=="undefined")return i(new Error("no document"));let a=document.querySelector(`script[data-aforo-bundle="${e}"]`);if(a){if(a.dataset.aforoLoaded==="1")return o();a.addEventListener("load",()=>o()),a.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`)));return}let r=document.createElement("script");r.src=`${t}/${e}.js`,r.async=true,r.crossOrigin="anonymous",r.dataset.aforoBundle=e,n&&r.setAttribute("nonce",n),r.addEventListener("load",()=>{r.dataset.aforoLoaded="1",o();}),r.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`))),document.head.appendChild(r);})}function L(e){if(!e.__aforoEmbedReadyFired){e.__aforoEmbedReadyFired=true;try{typeof e.aforoEmbedReady=="function"&&e.aforoEmbedReady();}catch(t){typeof console!="undefined"&&console.error(`${g} aforoEmbedReady callback threw`,t);}if(typeof document!="undefined"&&typeof CustomEvent!="undefined")try{document.dispatchEvent(new CustomEvent("aforoEmbedReady"));}catch(t){}}}async function E(e){if(typeof window=="undefined"||typeof document=="undefined")return;let t=window;if(window.location.protocol!=="https:"&&window.location.hostname!=="localhost"){typeof console!="undefined"&&console.error(`${g} Refusing to mount Aforo widgets on a non-HTTPS page. Embed Plugin requires HTTPS (FR-TIER-12). Current origin: ${window.location.origin}`);return}if(t.__aforoEmbedLoaderInitialized){typeof console!="undefined"&&console.warn(`${g} Loader already initialised on this page \u2014 skipping duplicate run.`);return}t.__aforoEmbedLoaderInitialized=true,t.aforoEmbed||(t.aforoEmbed=b);let n=D(),o=(n==null?void 0:n.getAttribute("nonce"))||null,i=(e==null?void 0:e.bundleBaseUrl)||G(n)||B,a=Array.from(document.querySelectorAll("[data-aforo-widget]"));if(a.length===0){L(t);return}let r=new Map;for(let u of a){let s=(u.getAttribute("data-aforo-widget")||"").trim();if(!U.has(s)){typeof console!="undefined"&&console.warn(`${g} Unknown widget id "${s}" \u2014 skipping`);continue}let d=r.get(s);d||(d=[],r.set(s,d)),d.push(u);}let l=Array.from(r.entries()).map(async([u,s])=>{try{await z(u,i,o);for(let d of s){let m=V(d);if(!m.widget||!m.tenantSlug||!m.embedKey){typeof console!="undefined"&&console.error(`${g} Placeholder missing required attributes (data-tenant-slug + data-embed-key). Skipping element.`,d);continue}b.mount(d,m);}}catch(d){typeof console!="undefined"&&console.error(`${g} Failed to load bundle for "${u}"`,d);}});await Promise.all(l).catch(()=>{}),L(t);}typeof document!="undefined"&&document.readyState!=="loading"?Promise.resolve().then(()=>{E();}):typeof document!="undefined"&&document.addEventListener("DOMContentLoaded",()=>{E();});b._loader={bootstrap:E};
+var T="1.0.11";var y=new WeakMap,c=new Map,f={},A=false;function h(){A||typeof window!="undefined"&&(window.addEventListener("message",e=>{let t=e.data;!t||typeof t!="object"||typeof t.type!="string"||t.type.startsWith("aforo.")&&$(t);}),A=true);}function $(e){let t=c.get(e.type);if(t)for(let o of t)try{o(e);}catch(i){}let n=c.get("*");if(n)for(let o of n)try{o(e);}catch(i){}}var p=new Map;function N(e,t){p.set(e,t);}function w(e){return typeof e=="object"&&e!==null&&typeof e.tagName=="string"}var b={version:T,configure(e){f={...f,...e};},getConfig(){return {...f}},mount(e,t){var r,l,u,s,d;if(!w(e)||y.has(e))return  false;let n=t.widget,o=p.get(n);if(!o)return typeof console!="undefined"&&console.warn(`[aforo:embed] No mount handler registered for widget "${n}". Loader bundle may not have finished loading.`),false;let i={widget:n,tenantSlug:(l=(r=t.tenantSlug)!=null?r:f.tenantSlug)!=null?l:"",embedKey:(s=(u=t.embedKey)!=null?u:f.embedKey)!=null?s:"",bridgeToken:(d=t.bridgeToken)!=null?d:f.bridgeToken,layout:t.layout,themeOverrides:t.themeOverrides,config:t.config};if(!i.tenantSlug||!i.embedKey)return typeof console!="undefined"&&console.error(`[aforo:embed] Widget "${n}" requires tenantSlug + embedKey. Provide via AforoEmbed.configure() or data-* attributes.`),false;h();let a=o(e,i);return y.set(e,{element:e,widget:n,teardown:a}),true},unmount(e){if(!w(e))return  false;let t=y.get(e);if(!t)return  false;try{t.teardown();}catch(n){}return y.delete(e),true},on(e,t){h();let n=c.get(e);return n||(n=new Set,c.set(e,n)),n.add(t),()=>{let o=c.get(e);o&&(o.delete(t),o.size===0&&c.delete(e));}},_registerWidget:N,_registeredWidgetsForTesting(){return Array.from(p.keys())},_resetForTesting(){p.clear(),c.clear(),f={};}};function k(e){if(!e)return {};try{let t=JSON.parse(e);if(t&&typeof t=="object"&&!Array.isArray(t)){let n={},o=["primary","primaryContrast","text","textMuted","bg","border","radius","fontFamily"],i=t;for(let a of o){let r=i[a];typeof r=="string"&&r.length>0&&(n[a]=r);}return n}}catch(t){}return {}}var U=new Set(["pricing-card","subscribe-button","checkout-flow","subscription-manager","invoice-list","usage-meter","payment-method","upgrade-cancel"]),B="https://embed.aforo.ai/v1/widgets",g="[aforo:loader]";function D(){let e=typeof document!="undefined"?document.currentScript:null;if(e&&e.tagName==="SCRIPT")return e;if(typeof document!="undefined"){let t=document.getElementsByTagName("script");for(let n=t.length-1;n>=0;n--){let o=t[n];if(!o)continue;let i=o.getAttribute("src")||"";if(/(\/v1)?\/loader(\.umd)?\.js$/.test(i))return o}}return null}function G(e){let t=e==null?void 0:e.getAttribute("src");if(!t)return null;try{let n=typeof location!="undefined"?location.href:void 0,o=new URL(t,n),i=o.pathname.replace(/\/loader(\.umd)?\.js$/,"");return `${o.origin}${i}/widgets`}catch(n){return null}}function v(e,t){let n=e.getAttribute(t);if(n==null||n.trim()==="")return;let o=Number(n);return Number.isFinite(o)?o:void 0}function j(e,t){let n=e.getAttribute(t);if(n==null)return;let o=n.trim().toLowerCase();if(o==="true")return  true;if(o==="false")return  false}function V(e){let t=(e.getAttribute("data-aforo-widget")||"").trim(),n=e.getAttribute("data-tenant-slug")||e.getAttribute("data-tenant")||"",o=e.getAttribute("data-embed-key")||"",i=e.getAttribute("data-bridge-token")||void 0,a=e.getAttribute("data-layout")||void 0,r=k(e.getAttribute("data-theme-overrides")),l=e.getAttribute("data-offering-id")||void 0,u=e.getAttribute("data-subscription-id")||void 0,s=e.getAttribute("data-metric")||void 0,d=e.getAttribute("data-featured-offering-id")||void 0,m=e.getAttribute("data-mode")||void 0,M=e.getAttribute("data-return-url")||void 0,S=e.getAttribute("data-default-status")||void 0,F=e.getAttribute("data-render-mode")||void 0,_=e.getAttribute("data-locale")||void 0,C=v(e,"data-page-size"),O=v(e,"data-poll-interval-ms"),I=e.getAttribute("data-theme")||void 0,R=e.getAttribute("data-cart-type")||void 0,W=e.getAttribute("data-target-id")||void 0,H=e.getAttribute("data-cta-text")||void 0,x=e.getAttribute("data-cta-url")||void 0,P=v(e,"data-max-plans"),K=j(e,"data-show-features");return {widget:t,tenantSlug:n,embedKey:o,bridgeToken:i,layout:a,themeOverrides:r,config:{offeringId:l,subscriptionId:u,metricName:s,featuredOfferingId:d,mode:m,returnUrl:M,defaultStatus:S,renderMode:F,locale:_,pageSize:C,pollIntervalMs:O,theme:I,cartType:R,targetId:W,ctaText:H,ctaUrl:x,maxPlans:P,showFeatures:K}}}function z(e,t,n){return new Promise((o,i)=>{if(typeof document=="undefined")return i(new Error("no document"));let a=document.querySelector(`script[data-aforo-bundle="${e}"]`);if(a){if(a.dataset.aforoLoaded==="1")return o();a.addEventListener("load",()=>o()),a.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`)));return}let r=document.createElement("script");r.src=`${t}/${e}.js`,r.async=true,r.crossOrigin="anonymous",r.dataset.aforoBundle=e,n&&r.setAttribute("nonce",n),r.addEventListener("load",()=>{r.dataset.aforoLoaded="1",o();}),r.addEventListener("error",()=>i(new Error(`bundle load failed: ${e}`))),document.head.appendChild(r);})}function L(e){if(!e.__aforoEmbedReadyFired){e.__aforoEmbedReadyFired=true;try{typeof e.aforoEmbedReady=="function"&&e.aforoEmbedReady();}catch(t){typeof console!="undefined"&&console.error(`${g} aforoEmbedReady callback threw`,t);}if(typeof document!="undefined"&&typeof CustomEvent!="undefined")try{document.dispatchEvent(new CustomEvent("aforoEmbedReady"));}catch(t){}}}async function E(e){if(typeof window=="undefined"||typeof document=="undefined")return;let t=window;if(window.location.protocol!=="https:"&&window.location.hostname!=="localhost"){typeof console!="undefined"&&console.error(`${g} Refusing to mount Aforo widgets on a non-HTTPS page. Embed Plugin requires HTTPS (FR-TIER-12). Current origin: ${window.location.origin}`);return}if(t.__aforoEmbedLoaderInitialized){typeof console!="undefined"&&console.warn(`${g} Loader already initialised on this page \u2014 skipping duplicate run.`);return}t.__aforoEmbedLoaderInitialized=true,t.aforoEmbed||(t.aforoEmbed=b);let n=D(),o=(n==null?void 0:n.getAttribute("nonce"))||null,i=(e==null?void 0:e.bundleBaseUrl)||G(n)||B,a=Array.from(document.querySelectorAll("[data-aforo-widget]"));if(a.length===0){L(t);return}let r=new Map;for(let u of a){let s=(u.getAttribute("data-aforo-widget")||"").trim();if(!U.has(s)){typeof console!="undefined"&&console.warn(`${g} Unknown widget id "${s}" \u2014 skipping`);continue}let d=r.get(s);d||(d=[],r.set(s,d)),d.push(u);}let l=Array.from(r.entries()).map(async([u,s])=>{try{await z(u,i,o);for(let d of s){let m=V(d);if(!m.widget||!m.tenantSlug||!m.embedKey){typeof console!="undefined"&&console.error(`${g} Placeholder missing required attributes (data-tenant-slug + data-embed-key). Skipping element.`,d);continue}b.mount(d,m);}}catch(d){typeof console!="undefined"&&console.error(`${g} Failed to load bundle for "${u}"`,d);}});await Promise.all(l).catch(()=>{}),L(t);}typeof document!="undefined"&&document.readyState!=="loading"?Promise.resolve().then(()=>{E();}):typeof document!="undefined"&&document.addEventListener("DOMContentLoaded",()=>{E();});b._loader={bootstrap:E};
 export{b as AforoEmbed,E as bootstrap};//# sourceMappingURL=loader.mjs.map
 //# sourceMappingURL=loader.mjs.map

package/dist/sri.json

@@ -1,15 +1,15 @@
 {
-  "version": "1.0.6",
-  "generatedAt": "2026-08-26T08:25:03.608Z",
+  "version": "1.0.11",
+  "generatedAt": "2026-08-30T06:56:50.009Z",
   "bundles": {
-    "loader.js": "sha384-rX5O1gvlt56peSNtNEJduwPfDsM5oLSlw6AFh0nBuysuBTup7dH3cqK9aKLzewWN",
-    "widgets/checkout-flow.js": "sha384-3Rb+nizUBhxFhOh2VUu+i2l1QzX5bNJwjVdxG+VTnWrRzPGeU+8znz/I83Uqo6Lo",
-    "widgets/invoice-list.js": "sha384-R7ugqnPN9QzMwuv41eyYVIHvhWXT1l9MUqv3/lkwpWqeBimUGj4Jum97jgL6HwXA",
-    "widgets/payment-method.js": "sha384-gAMorea0TI66Sv1ygVCqyKriR+mDNgNNeHyTuTJADzSJi4wATSTzcAAUqz1JPEVK",
-    "widgets/pricing-card.js": "sha384-O0pOl4rPkd915RHmoW63fs1B4zng9WL1gtoJVb06qBC2QnTL6NO1aYNWBsDKLkql",
-    "widgets/subscribe-button.js": "sha384-rmG1ib5UoYVby5fSBNB6Omyu8j9beLzZSxmc97vaWrHhzsK/OKy8NM73URpS9wuF",
-    "widgets/subscription-manager.js": "sha384-Brhr0eLy2khBWGC1IWjmHdqMHlu5ul+TNEjk5iIJ+iwRf7qPWkcLU3Qw2+u3x2WT",
-    "widgets/upgrade-cancel.js": "sha384-9as15ROb0lsazumcF0NbPpAzCjWDE7NUFACSKzl5XC3bzzK7y1kNQukuqsNzlcaX",
-    "widgets/usage-meter.js": "sha384-vA74x194TdKa54vMuxJzdc/TWMNkLG+XGohe873qqFFILos6LaJVLG2iRZzcULEP"
+    "loader.js": "sha384-uTXiwN0zz6PH9Cpjfpfro+Kv3SjiWC5zDWrnoU7ztiiJZ53k6t5tOTuFQO0gNdsb",
+    "widgets/checkout-flow.js": "sha384-58hUZ91oYLzHGFTyCWPrPDYY794p2DOmLc6UsGEqT+idZHGPUVPWiNC7goGziA3a",
+    "widgets/invoice-list.js": "sha384-9yX9pfTTxyNk4/gzoNtwR/QjCr6zVCm2+gHFU2mVTt9CkMiIcu8e3mIUiGOyb4US",
+    "widgets/payment-method.js": "sha384-52GbGJhqU38OQcJQI8QROQ/O2jB+Zdo4U6CnwupTrJw9UZA/+1OS2NjNpkfawTDo",
+    "widgets/pricing-card.js": "sha384-WOmeOXYvgpDb+fgP88LQz14UE4znbtf9qatp1/piTb9rqEVen7IAAj+HNmvRNlr+",
+    "widgets/subscribe-button.js": "sha384-9kmGVVkWriGzhZMtRfR+pIJdjO0kpVStTcbQnO4ByZf1vyQ/OorqAfOyNN1He0KS",
+    "widgets/subscription-manager.js": "sha384-F3Jm5kORXyoIG7wZiV21zW4LXWFaCVooKch8z2EgcdjYFvuZYyX8wFVmje2MmV7I",
+    "widgets/upgrade-cancel.js": "sha384-Q+qTSjxOvB45ql6Erx/jTL6OxIjnfEp3z9LCI3/BOPjrhMMQgTJxP/oJkfD83BiJ",
+    "widgets/usage-meter.js": "sha384-dsxc/4fyzinNYVkFFU720jpF/SQpibGuO++gtUOcJKWdiKVqQXvk/7c8Q6kDs5Dk"
   }
 }

package/dist/{types-BbQw2_32.d.cts → types-RMTEXoGw.d.cts}

@@ -1030,8 +1030,13 @@ interface CancelResponse {
     cancelledAt: string | null;
     /** ISO-8601 timestamp the cancellation takes/took effect (today for IMMEDIATE, period end for PERIOD_END). */
     effectiveAt: string;
-    /** V50 feedback row id — useful for audit cross-reference. */
-    feedbackId: string;
+    /**
+     * V50 feedback row id — useful for audit cross-reference. Nullable:
+     * storefront-service's cancel endpoint doesn't read it back from
+     * pricing-service after writing it (documented follow-up), so it's
+     * omitted from the response today (2026-08-29).
+     */
+    feedbackId: string | null;
     /** Credit note produced by an IMMEDIATE cancel with prorated refund. */
     creditNoteId: string | null;
 }

package/dist/{types-BbQw2_32.d.ts → types-RMTEXoGw.d.ts}

@@ -1030,8 +1030,13 @@ interface CancelResponse {
     cancelledAt: string | null;
     /** ISO-8601 timestamp the cancellation takes/took effect (today for IMMEDIATE, period end for PERIOD_END). */
     effectiveAt: string;
-    /** V50 feedback row id — useful for audit cross-reference. */
-    feedbackId: string;
+    /**
+     * V50 feedback row id — useful for audit cross-reference. Nullable:
+     * storefront-service's cancel endpoint doesn't read it back from
+     * pricing-service after writing it (documented follow-up), so it's
+     * omitted from the response today (2026-08-29).
+     */
+    feedbackId: string | null;
     /** Credit note produced by an IMMEDIATE cancel with prorated refund. */
     creditNoteId: string | null;
 }

package/dist/vanilla/index.cjs

@@ -27,7 +27,7 @@ var React7__namespace = /*#__PURE__*/_interopNamespace(React7);
 // src/vanilla/index.ts
 
 // src/core/version.ts
-var VERSION = "1.0.6";
+var VERSION = "1.0.11";
 
 // src/core/AforoEmbed.ts
 var mountedElements = /* @__PURE__ */ new WeakMap();
@@ -888,8 +888,9 @@ var _BridgeClient = class _BridgeClient {
     }
     if (!resp.ok) return emptyPage;
     try {
-      const body = await resp.json();
-      if (!body || typeof body !== "object") return emptyPage;
+      const raw = await resp.json();
+      if (!raw || typeof raw !== "object") return emptyPage;
+      const body = raw.data ?? raw;
       return {
         content: Array.isArray(body.content) ? body.content : [],
         totalElements: typeof body.totalElements === "number" && Number.isFinite(body.totalElements) ? body.totalElements : 0,
@@ -932,7 +933,8 @@ var _BridgeClient = class _BridgeClient {
     }
     if (!resp.ok) return null;
     try {
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : null;
       if (!body || typeof body.downloadUrl !== "string" || body.downloadUrl.length === 0) {
         return null;
       }
@@ -1021,7 +1023,8 @@ var _BridgeClient = class _BridgeClient {
     }
     let body;
     try {
-      body = await resp.json();
+      const raw = await resp.json();
+      body = raw?.data ?? raw;
     } catch {
       throw new BridgeClientError(
         "Malformed invoice-payment-initiate response (not JSON)",
@@ -1332,9 +1335,9 @@ var _BridgeClient = class _BridgeClient {
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed confirmCart response (not JSON)",
@@ -1343,6 +1346,7 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
+    const body = raw?.data ?? raw ?? {};
     if (!body.cartId || !body.status) {
       throw new BridgeClientError(
         "Malformed confirmCart response (missing required fields)",
@@ -1407,9 +1411,9 @@ var _BridgeClient = class _BridgeClient {
    * undefined access.
    */
   async parseCartResponse(resp, methodName) {
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         `Malformed ${methodName} response (not JSON)`,
@@ -1418,7 +1422,8 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
-    if (!body.cartId || !body.cartType || !body.status || !body.targetId) {
+    const data = raw?.data ?? raw ?? {};
+    if (!data.cartId || !data.cartType || !data.status || !data.targetId) {
       throw new BridgeClientError(
         `Malformed ${methodName} response (missing required fields)`,
         500,
@@ -1427,21 +1432,21 @@ var _BridgeClient = class _BridgeClient {
       );
     }
     return {
-      cartId: body.cartId,
-      cartType: body.cartType,
-      targetId: body.targetId,
-      status: body.status,
-      totalCents: typeof body.totalCents === "number" && Number.isFinite(body.totalCents) ? body.totalCents : 0,
-      currency: typeof body.currency === "string" ? body.currency : "USD",
-      gatewayProvider: body.gatewayProvider ?? null,
-      gatewayClientSecret: body.gatewayClientSecret ?? null,
-      gatewayOrderId: body.gatewayOrderId ?? null,
-      gatewayApprovalUrl: body.gatewayApprovalUrl ?? null,
-      gatewaySandboxMode: body.gatewaySandboxMode ?? null,
-      subscriptionId: body.subscriptionId ?? null,
-      invoiceId: body.invoiceId ?? null,
-      expiresAt: typeof body.expiresAt === "string" ? body.expiresAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-      completedAt: body.completedAt ?? null
+      cartId: data.cartId,
+      cartType: data.cartType,
+      targetId: data.targetId,
+      status: data.status,
+      totalCents: typeof data.totalCents === "number" && Number.isFinite(data.totalCents) ? data.totalCents : 0,
+      currency: typeof data.currency === "string" ? data.currency : "USD",
+      gatewayProvider: data.gatewayProvider ?? null,
+      gatewayClientSecret: data.gatewayClientSecret ?? null,
+      gatewayOrderId: data.gatewayOrderId ?? null,
+      gatewayApprovalUrl: data.gatewayApprovalUrl ?? null,
+      gatewaySandboxMode: data.gatewaySandboxMode ?? null,
+      subscriptionId: data.subscriptionId ?? null,
+      invoiceId: data.invoiceId ?? null,
+      expiresAt: typeof data.expiresAt === "string" ? data.expiresAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+      completedAt: data.completedAt ?? null
     };
   }
   /** Public liveness probe. Returns null on failure (not an error). */
@@ -1802,14 +1807,17 @@ var _BridgeClient = class _BridgeClient {
         idempotencyKey,
         sessionJwt
       }),
-      body: JSON.stringify(request)
+      // 2026-08-29 fix: same bug as cancelSubscription() below — EmbedUpgradeRequest
+      // requires idempotencyKey as a @NotBlank BODY field, but this only ever sent
+      // it via the Idempotency-Key header.
+      body: JSON.stringify({ ...request, idempotencyKey })
     });
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed upgrade response (not JSON)",
@@ -1818,6 +1826,7 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
+    const body = raw ? raw.data ?? raw : {};
     if (!body.subscriptionId || !body.previousOfferingId || !body.newOfferingId || !body.status) {
       throw new BridgeClientError(
         "Malformed upgrade response (missing required fields)",
@@ -1881,14 +1890,19 @@ var _BridgeClient = class _BridgeClient {
         idempotencyKey,
         sessionJwt
       }),
-      body: JSON.stringify(request)
+      // 2026-08-29 fix: EmbedCancelRequest (storefront-service) requires
+      // idempotencyKey as a @NotBlank BODY field — this only ever sent it
+      // via the Idempotency-Key header, so every real cancellation 400'd
+      // with "idempotencyKey is required" regardless of any other field.
+      // Confirmed live against production.
+      body: JSON.stringify({ ...request, idempotencyKey })
     });
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed cancel response (not JSON)",
@@ -1897,7 +1911,8 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
-    if (!body.subscriptionId || !body.status || !body.effectiveAt || !body.feedbackId) {
+    const body = raw ? raw.data ?? raw : null;
+    if (!body || !body.subscriptionId || !body.status || !body.effectiveAt) {
       throw new BridgeClientError(
         "Malformed cancel response (missing required fields)",
         500,
@@ -1910,7 +1925,7 @@ var _BridgeClient = class _BridgeClient {
       status: body.status,
       cancelledAt: body.cancelledAt ?? null,
       effectiveAt: body.effectiveAt,
-      feedbackId: body.feedbackId,
+      feedbackId: body.feedbackId ?? null,
       creditNoteId: body.creditNoteId ?? null
     };
   }
@@ -1940,7 +1955,8 @@ var _BridgeClient = class _BridgeClient {
       if (!resp.ok) {
         return { methods: [], defaultMethodId: null };
       }
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : {};
       return {
         methods: Array.isArray(body.methods) ? body.methods : [],
         defaultMethodId: body.defaultMethodId ?? null
@@ -1970,7 +1986,8 @@ var _BridgeClient = class _BridgeClient {
         body: JSON.stringify({})
       });
       if (!resp.ok) return null;
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : {};
       if (!body.clientSecret) return null;
       return {
         clientSecret: body.clientSecret,

package/dist/vanilla/index.d.cts

@@ -1,5 +1,5 @@
-export { A as AforoEmbed } from '../AforoEmbed-VYb6_GXB.cjs';
-import { aD as WidgetMountConfig } from '../types-BbQw2_32.cjs';
+export { A as AforoEmbed } from '../AforoEmbed-BX2HPXWT.cjs';
+import { aD as WidgetMountConfig } from '../types-RMTEXoGw.cjs';
 
 /**
  * @aforoai/storefront-widgets/vanilla — vanilla-JS adapter (FR-TIER-3,

package/dist/vanilla/index.d.ts

@@ -1,5 +1,5 @@
-export { A as AforoEmbed } from '../AforoEmbed-BkJF1hAN.js';
-import { aD as WidgetMountConfig } from '../types-BbQw2_32.js';
+export { A as AforoEmbed } from '../AforoEmbed-PsTY7zh0.js';
+import { aD as WidgetMountConfig } from '../types-RMTEXoGw.js';
 
 /**
  * @aforoai/storefront-widgets/vanilla — vanilla-JS adapter (FR-TIER-3,

package/dist/vanilla/index.mjs

@@ -5,7 +5,7 @@ import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 // src/vanilla/index.ts
 
 // src/core/version.ts
-var VERSION = "1.0.6";
+var VERSION = "1.0.11";
 
 // src/core/AforoEmbed.ts
 var mountedElements = /* @__PURE__ */ new WeakMap();
@@ -866,8 +866,9 @@ var _BridgeClient = class _BridgeClient {
     }
     if (!resp.ok) return emptyPage;
     try {
-      const body = await resp.json();
-      if (!body || typeof body !== "object") return emptyPage;
+      const raw = await resp.json();
+      if (!raw || typeof raw !== "object") return emptyPage;
+      const body = raw.data ?? raw;
       return {
         content: Array.isArray(body.content) ? body.content : [],
         totalElements: typeof body.totalElements === "number" && Number.isFinite(body.totalElements) ? body.totalElements : 0,
@@ -910,7 +911,8 @@ var _BridgeClient = class _BridgeClient {
     }
     if (!resp.ok) return null;
     try {
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : null;
       if (!body || typeof body.downloadUrl !== "string" || body.downloadUrl.length === 0) {
         return null;
       }
@@ -999,7 +1001,8 @@ var _BridgeClient = class _BridgeClient {
     }
     let body;
     try {
-      body = await resp.json();
+      const raw = await resp.json();
+      body = raw?.data ?? raw;
     } catch {
       throw new BridgeClientError(
         "Malformed invoice-payment-initiate response (not JSON)",
@@ -1310,9 +1313,9 @@ var _BridgeClient = class _BridgeClient {
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed confirmCart response (not JSON)",
@@ -1321,6 +1324,7 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
+    const body = raw?.data ?? raw ?? {};
     if (!body.cartId || !body.status) {
       throw new BridgeClientError(
         "Malformed confirmCart response (missing required fields)",
@@ -1385,9 +1389,9 @@ var _BridgeClient = class _BridgeClient {
    * undefined access.
    */
   async parseCartResponse(resp, methodName) {
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         `Malformed ${methodName} response (not JSON)`,
@@ -1396,7 +1400,8 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
-    if (!body.cartId || !body.cartType || !body.status || !body.targetId) {
+    const data = raw?.data ?? raw ?? {};
+    if (!data.cartId || !data.cartType || !data.status || !data.targetId) {
       throw new BridgeClientError(
         `Malformed ${methodName} response (missing required fields)`,
         500,
@@ -1405,21 +1410,21 @@ var _BridgeClient = class _BridgeClient {
       );
     }
     return {
-      cartId: body.cartId,
-      cartType: body.cartType,
-      targetId: body.targetId,
-      status: body.status,
-      totalCents: typeof body.totalCents === "number" && Number.isFinite(body.totalCents) ? body.totalCents : 0,
-      currency: typeof body.currency === "string" ? body.currency : "USD",
-      gatewayProvider: body.gatewayProvider ?? null,
-      gatewayClientSecret: body.gatewayClientSecret ?? null,
-      gatewayOrderId: body.gatewayOrderId ?? null,
-      gatewayApprovalUrl: body.gatewayApprovalUrl ?? null,
-      gatewaySandboxMode: body.gatewaySandboxMode ?? null,
-      subscriptionId: body.subscriptionId ?? null,
-      invoiceId: body.invoiceId ?? null,
-      expiresAt: typeof body.expiresAt === "string" ? body.expiresAt : (/* @__PURE__ */ new Date(0)).toISOString(),
-      completedAt: body.completedAt ?? null
+      cartId: data.cartId,
+      cartType: data.cartType,
+      targetId: data.targetId,
+      status: data.status,
+      totalCents: typeof data.totalCents === "number" && Number.isFinite(data.totalCents) ? data.totalCents : 0,
+      currency: typeof data.currency === "string" ? data.currency : "USD",
+      gatewayProvider: data.gatewayProvider ?? null,
+      gatewayClientSecret: data.gatewayClientSecret ?? null,
+      gatewayOrderId: data.gatewayOrderId ?? null,
+      gatewayApprovalUrl: data.gatewayApprovalUrl ?? null,
+      gatewaySandboxMode: data.gatewaySandboxMode ?? null,
+      subscriptionId: data.subscriptionId ?? null,
+      invoiceId: data.invoiceId ?? null,
+      expiresAt: typeof data.expiresAt === "string" ? data.expiresAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+      completedAt: data.completedAt ?? null
     };
   }
   /** Public liveness probe. Returns null on failure (not an error). */
@@ -1780,14 +1785,17 @@ var _BridgeClient = class _BridgeClient {
         idempotencyKey,
         sessionJwt
       }),
-      body: JSON.stringify(request)
+      // 2026-08-29 fix: same bug as cancelSubscription() below — EmbedUpgradeRequest
+      // requires idempotencyKey as a @NotBlank BODY field, but this only ever sent
+      // it via the Idempotency-Key header.
+      body: JSON.stringify({ ...request, idempotencyKey })
     });
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed upgrade response (not JSON)",
@@ -1796,6 +1804,7 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
+    const body = raw ? raw.data ?? raw : {};
     if (!body.subscriptionId || !body.previousOfferingId || !body.newOfferingId || !body.status) {
       throw new BridgeClientError(
         "Malformed upgrade response (missing required fields)",
@@ -1859,14 +1868,19 @@ var _BridgeClient = class _BridgeClient {
         idempotencyKey,
         sessionJwt
       }),
-      body: JSON.stringify(request)
+      // 2026-08-29 fix: EmbedCancelRequest (storefront-service) requires
+      // idempotencyKey as a @NotBlank BODY field — this only ever sent it
+      // via the Idempotency-Key header, so every real cancellation 400'd
+      // with "idempotencyKey is required" regardless of any other field.
+      // Confirmed live against production.
+      body: JSON.stringify({ ...request, idempotencyKey })
     });
     if (!resp.ok) {
       throw await this.parseError(resp);
     }
-    let body;
+    let raw;
     try {
-      body = await resp.json();
+      raw = await resp.json();
     } catch {
       throw new BridgeClientError(
         "Malformed cancel response (not JSON)",
@@ -1875,7 +1889,8 @@ var _BridgeClient = class _BridgeClient {
         false
       );
     }
-    if (!body.subscriptionId || !body.status || !body.effectiveAt || !body.feedbackId) {
+    const body = raw ? raw.data ?? raw : null;
+    if (!body || !body.subscriptionId || !body.status || !body.effectiveAt) {
       throw new BridgeClientError(
         "Malformed cancel response (missing required fields)",
         500,
@@ -1888,7 +1903,7 @@ var _BridgeClient = class _BridgeClient {
       status: body.status,
       cancelledAt: body.cancelledAt ?? null,
       effectiveAt: body.effectiveAt,
-      feedbackId: body.feedbackId,
+      feedbackId: body.feedbackId ?? null,
       creditNoteId: body.creditNoteId ?? null
     };
   }
@@ -1918,7 +1933,8 @@ var _BridgeClient = class _BridgeClient {
       if (!resp.ok) {
         return { methods: [], defaultMethodId: null };
       }
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : {};
       return {
         methods: Array.isArray(body.methods) ? body.methods : [],
         defaultMethodId: body.defaultMethodId ?? null
@@ -1948,7 +1964,8 @@ var _BridgeClient = class _BridgeClient {
         body: JSON.stringify({})
       });
       if (!resp.ok) return null;
-      const body = await resp.json();
+      const raw = await resp.json();
+      const body = raw ? raw.data ?? raw : {};
       if (!body.clientSecret) return null;
       return {
         clientSecret: body.clientSecret,