@eshal-bot/chat-widget 0.1.66 → 0.1.67

package/dist/chat-widget.js

@@ -8010,21 +8010,20 @@
    * Sends a streaming chat request using fetch
    * @param {object} request - Chat request object
    * @param {string} apiBaseUrl - Base URL for the API
-   * @param {Function|undefined} getAuthToken - async fn returning a Bearer token (in-app JWT path), or undefined (Mode B proxy)
    */
-  const sendStreamingRequest = async (request, apiBaseUrl, getAuthToken) => {
+  const sendStreamingRequest = async (request, apiBaseUrl, organizationId, secretKey) => {
     const headers = {
       'Content-Type': 'application/json',
       Accept: 'text/event-stream'
     };
 
-    // In-app JWT path: call getAuthToken() and set Authorization header
-    // Mode B proxy: no auth header from widget; proxy injects x-eshal-sig + x-eshal-org server-side
-    if (typeof getAuthToken === 'function') {
-      const token = await getAuthToken();
-      if (token) {
-        headers['Authorization'] = "Bearer ".concat(token);
-      }
+    // Mode A — secret key (direct embed): key replaces orgId in the header
+    // Mode B — proxy (@eshal-bot/server): no header from widget; proxy injects x-eshal-sig + x-eshal-org
+    // Mode C — legacy: orgId sent directly
+    if (secretKey) {
+      headers['x-eshal-key'] = secretKey;
+    } else if (organizationId) {
+      headers['x-eshal-org'] = organizationId;
     }
     const response = await fetch("".concat(apiBaseUrl.replace(/\/$/, ''), "/api/v1/support"), {
       method: 'POST',
@@ -9147,7 +9146,7 @@
       apiBaseUrl,
       apiKey,
       organizationId,
-      getAuthToken,
+      secretKey,
       autoOpen,
       openDelay,
       darkMode,
@@ -9784,7 +9783,7 @@
         if (apiType === 'userName' || apiType === 'email' || apiType === 'phone') {
           // For onboarding fields, just consume the stream without processing.
           // Single attempt — no retry, no user-visible partial state to clean up.
-          const stream = await sendStreamingRequest(chatRequest, apiBaseUrl, getAuthToken);
+          const stream = await sendStreamingRequest(chatRequest, apiBaseUrl, organizationId, secretKey);
           const reader = stream.getReader();
           const decoder = new TextDecoder();
           while (true) {
@@ -9803,7 +9802,7 @@
           let lastErr;
           for (let attempt = 0; attempt <= STREAM_RETRY_DELAYS_MS.length; attempt += 1) {
             try {
-              const stream = await sendStreamingRequest(chatRequest, apiBaseUrl, getAuthToken);
+              const stream = await sendStreamingRequest(chatRequest, apiBaseUrl, organizationId, secretKey);
               await processStream(stream, setMessages);
               updateActivity(organizationId);
               return {
@@ -9831,7 +9830,7 @@
 
         // Non-chat, non-onboarding apiType (shouldn't currently happen):
         // fire and forget, single attempt.
-        await sendStreamingRequest(chatRequest, apiBaseUrl, getAuthToken);
+        await sendStreamingRequest(chatRequest, apiBaseUrl, organizationId);
         updateActivity(organizationId);
         return {
           success: true
@@ -9867,7 +9866,7 @@
         // UX-M09: release the concurrency guard so the next send can proceed.
         isSendingRef.current = false;
       }
-    }, [apiBaseUrl, apiKey, getNextMessageId, getAuthToken, messages, bidiSessionId, routingChoice, widgetFilter, provideCitations]);
+    }, [apiBaseUrl, apiKey, getNextMessageId, organizationId, messages, bidiSessionId, routingChoice, widgetFilter, provideCitations]);
     const handleOnboardingFormSubmit = reactExports.useCallback(async answers => {
       const questions = getOnboardingQuestions(onboardingQuestions);
       if (questions.length === 0) return;
@@ -94385,7 +94384,7 @@
     let {
       sources = [],
       apiBaseUrl,
-      getAuthToken,
+      organizationId,
       isDark,
       textColor,
       fontFamily,
@@ -94411,7 +94410,7 @@
     // corpora that have none of the above.
     const _downloadKey = s => s.url || s.source_id || s.source_name || "";
     const handleFileDownload = async source => {
-      if (!apiBaseUrl) return;
+      if (!apiBaseUrl || !organizationId) return;
       // SharePoint proxy URLs are GET endpoints that stream the file
       // directly via Microsoft Graph using the stored OAuth credential.
       // Bypass the legacy POST /file-download lookup (which expects an
@@ -94437,14 +94436,11 @@
           // set, or future deployments that set it) pass through
           // unchanged.
           const spUrl = source.url.startsWith("http") ? source.url : "".concat(apiBaseUrl.replace(/\/$/, "")).concat(source.url);
-          const spHeaders = {};
-          if (typeof getAuthToken === 'function') {
-            const token = await getAuthToken();
-            if (token) spHeaders['Authorization'] = "Bearer ".concat(token);
-          }
           res = await fetch(spUrl, {
             method: "GET",
-            headers: spHeaders,
+            headers: {
+              "x-eshal-org": organizationId
+            },
             credentials: "include"
           });
         } else {
@@ -94460,18 +94456,15 @@
           //   - source.source_name (the user's original filename)
           // Sending both lets the server skip the Milvus resolution
           // AND advertise the readable name in Content-Disposition.
-          const dlHeaders = {
-            "Content-Type": "application/json"
-          };
-          if (typeof getAuthToken === 'function') {
-            const token = await getAuthToken();
-            if (token) dlHeaders['Authorization'] = "Bearer ".concat(token);
-          }
           res = await fetch(url, {
             method: "POST",
-            headers: dlHeaders,
+            headers: {
+              "Content-Type": "application/json",
+              "x-eshal-org": organizationId
+            },
             credentials: "include",
             body: JSON.stringify({
+              org_id: organizationId,
               source_id: source.source_id,
               file_name: source.url || "",
               source_name: source.source_name || ""
@@ -94656,7 +94649,7 @@
       conciergeName,
       companyName,
       apiBaseUrl,
-      getAuthToken,
+      organizationId,
       onPromptSuggestionClick,
       allowFeedback = true,
       provideCitations = true,
@@ -94828,7 +94821,7 @@
                   }), /*#__PURE__*/jsxRuntimeExports.jsx(MessageSources, {
                     sources: message.sources,
                     apiBaseUrl: apiBaseUrl,
-                    getAuthToken: getAuthToken,
+                    organizationId: organizationId,
                     isDark: isDark,
                     textColor: messageTextColor,
                     fontFamily: messageFontFamily,
@@ -94854,7 +94847,7 @@
                   }), /*#__PURE__*/jsxRuntimeExports.jsx(MessageSources, {
                     sources: message.sources,
                     apiBaseUrl: apiBaseUrl,
-                    getAuthToken: getAuthToken,
+                    organizationId: organizationId,
                     isDark: isDark,
                     textColor: messageTextColor,
                     fontFamily: messageFontFamily,
@@ -95034,7 +95027,7 @@
       conciergeName,
       companyName,
       apiBaseUrl,
-      getAuthToken,
+      organizationId,
       onPromptSuggestionClick,
       allowFeedback,
       provideCitations,
@@ -95078,7 +95071,7 @@
       conciergeName: conciergeName,
       companyName: companyName,
       apiBaseUrl: apiBaseUrl,
-      getAuthToken: getAuthToken,
+      organizationId: organizationId,
       onPromptSuggestionClick: onPromptSuggestionClick,
       allowFeedback: allowFeedback,
       provideCitations: provideCitations,
@@ -95923,7 +95916,7 @@
       conciergeName,
       companyName,
       apiBaseUrl,
-      getAuthToken,
+      organizationId,
       onPromptSuggestionClick,
       conversationResetKey,
       allowFeedback,
@@ -96105,7 +96098,7 @@
         conciergeName: conciergeName,
         companyName: companyName,
         apiBaseUrl: apiBaseUrl,
-        getAuthToken: getAuthToken,
+        organizationId: organizationId,
         allowFeedback: allowFeedback,
         provideCitations: provideCitations,
         onFeedback: onFeedback,
@@ -96137,7 +96130,7 @@
             conciergeName: conciergeName,
             companyName: companyName,
             apiBaseUrl: apiBaseUrl,
-            getAuthToken: getAuthToken,
+            organizationId: organizationId,
             headerTextColor: headerTextColor
           }, "skeleton-waiting");
         }
@@ -99652,7 +99645,8 @@
       showPoweredBy = true,
       apiBaseUrl,
       apiKey,
-      getAuthToken,
+      organizationId,
+      secretKey,
       conversationId,
       conciergeId,
       onboardingQuestions = [],
@@ -99800,7 +99794,7 @@
         setCsatSubmitted(submitted);
         if (submitted) setShowCsat(false);
       } catch (_unused4) {}
-    }, [conversationId]);
+    }, [conversationId, organizationId]);
 
     // Auto-scroll hook
     useAutoScroll(messagesContainerRef, [messages, isLoading], {
@@ -99938,15 +99932,14 @@
     const handleCsatRating = async (rating, format) => {
       setCsatSubmitted(true); // optimistic UI
       setShowCsat(false);
-      markCsatSubmitted(undefined); // persist so page refresh doesn't re-show CSAT
+      markCsatSubmitted(organizationId); // persist so page refresh doesn't re-show CSAT
 
       try {
         const headers = {
           "Content-Type": "application/json"
         };
-        if (typeof getAuthToken === 'function') {
-          const token = await getAuthToken();
-          if (token) headers['Authorization'] = "Bearer ".concat(token);
+        if (organizationId) {
+          headers["x-eshal-org"] = organizationId;
         }
         const response = await fetch("".concat(apiBaseUrl.replace(/\/$/, ""), "/api/v1/support/csat"), {
           method: "POST",
@@ -99956,6 +99949,7 @@
             conversationId,
             rating,
             ratingFormat: format,
+            organizationId,
             conciergeId
           })
         });
@@ -99979,9 +99973,8 @@
         const headers = {
           "Content-Type": "application/json"
         };
-        if (typeof getAuthToken === 'function') {
-          const token = await getAuthToken();
-          if (token) headers['Authorization'] = "Bearer ".concat(token);
+        if (organizationId) {
+          headers["x-eshal-org"] = organizationId;
         }
         const ratingFormat = normalizeCsatFormat(csatFormat);
         const response = await fetch("".concat(apiBaseUrl.replace(/\/$/, ""), "/api/v1/support/csat"), {
@@ -99992,6 +99985,7 @@
             conversationId,
             rating: String(resolveRating),
             ratingFormat,
+            organizationId,
             conciergeId,
             feedback: resolveFeedbackText || undefined
           })
@@ -100025,7 +100019,7 @@
       } finally {
         setIsSubmittingResolve(false);
       }
-    }, [isCsatEnabled, isSubmittingResolve, isConversationResolved, resolveRating, resolveFeedbackText, conversationId, getAuthToken, conciergeId, apiBaseUrl, csatFormat, onResetConversation, onRefreshChat, onWidgetFilterChange]);
+    }, [isCsatEnabled, isSubmittingResolve, isConversationResolved, resolveRating, resolveFeedbackText, conversationId, organizationId, conciergeId, apiBaseUrl, csatFormat, onResetConversation, onRefreshChat, onWidgetFilterChange]);
 
     // Handle X button: first click shows form, second click closes
     const handleCloseClick = reactExports.useCallback(() => {
@@ -100363,7 +100357,7 @@
                 conciergeName: conciergeName,
                 companyName: companyName,
                 apiBaseUrl: apiBaseUrl,
-                getAuthToken: getAuthToken,
+                organizationId: organizationId,
                 conversationResetKey: conversationId,
                 allowFeedback: allowFeedback,
                 provideCitations: provideCitations,
@@ -100448,7 +100442,8 @@
 
   /**
    * @param {string|undefined|null} apiBaseUrl
-   * @param {Function|undefined|null} getAuthToken - async fn returning a Bearer token (in-app JWT path), or undefined/null (Mode B proxy)
+   * @param {string|undefined|null} orgId
+   * @param {string|undefined|null} secretKey  — Mode A/B: orgId resolved server-side
    * @returns {{
    *   categories: Array<{id:string,label:string,count:number,tags:string[]}>,
    *   loading: boolean,
@@ -100456,15 +100451,17 @@
    *   hasFilters: boolean,
    * }}
    */
-  function useFilterCatalog(apiBaseUrl, getAuthToken) {
-    const hasAuth = !!apiBaseUrl;
+  function useFilterCatalog(apiBaseUrl, orgId, secretKey) {
+    // Mode A: secretKey present, orgId null → key-based endpoint
+    // Mode C: orgId present (legacy) → orgId-in-path endpoint
+    const hasAuth = !!(apiBaseUrl && (orgId || secretKey));
     const [state, setState] = reactExports.useState({
       categories: [],
       loading: hasAuth,
       error: null
     });
     reactExports.useEffect(() => {
-      if (!apiBaseUrl) {
+      if (!apiBaseUrl || !orgId && !secretKey) {
         setState({
           categories: [],
           loading: false,
@@ -100472,7 +100469,7 @@
         });
         return;
       }
-      const cacheKey = getAuthToken ? "".concat(apiBaseUrl, "|__session__") : "".concat(apiBaseUrl, "|__proxy__");
+      const cacheKey = secretKey ? "".concat(apiBaseUrl, "|__key__") : "".concat(apiBaseUrl, "|").concat(orgId);
       const cached = _PROCESS_CACHE.get(cacheKey);
       if (cached) {
         setState({
@@ -100488,54 +100485,45 @@
         error: null
       }));
       const base = apiBaseUrl.replace(/\/$/, "");
-      const url = "".concat(base, "/api/v1/widget/filters");
-      (async () => {
-        try {
-          const headers = {
-            Accept: "application/json"
-          };
-          // In-app JWT path: set Authorization header
-          // Mode B proxy: no auth header; proxy handles org resolution
-          if (typeof getAuthToken === 'function') {
-            const token = await getAuthToken();
-            if (token) {
-              headers['Authorization'] = "Bearer ".concat(token);
-            }
-          }
-          const res = await fetch(url, {
-            method: "GET",
-            headers
-          });
-          if (!res.ok) {
-            throw new Error("filter catalog HTTP ".concat(res.status));
-          }
-          const body = await res.json();
-          const categories = Array.isArray(body === null || body === void 0 ? void 0 : body.categories) ? body.categories : [];
-          if (cancelled) return;
-          _PROCESS_CACHE.set(cacheKey, categories);
-          setState({
-            categories,
-            loading: false,
-            error: null
-          });
-        } catch (err) {
-          if (cancelled) return;
-          // Fail-soft: log and present empty so the UI hides itself.
-          // We do NOT bubble the error to the caller because chat
-          // should keep working even if the catalog is unreachable.
-          // eslint-disable-next-line no-console
-          console.warn("[useFilterCatalog] catalog fetch failed:", err);
-          setState({
-            categories: [],
-            loading: false,
-            error: err
-          });
+      const url = secretKey ? "".concat(base, "/api/v1/widget/filters") : "".concat(base, "/api/v1/widget/filters/").concat(encodeURIComponent(orgId));
+      const headers = {
+        Accept: "application/json"
+      };
+      if (secretKey) headers["x-eshal-key"] = secretKey;
+      fetch(url, {
+        method: "GET",
+        headers
+      }).then(async res => {
+        if (!res.ok) {
+          throw new Error("filter catalog HTTP ".concat(res.status));
         }
-      })();
+        const body = await res.json();
+        return Array.isArray(body === null || body === void 0 ? void 0 : body.categories) ? body.categories : [];
+      }).then(categories => {
+        if (cancelled) return;
+        _PROCESS_CACHE.set(cacheKey, categories);
+        setState({
+          categories,
+          loading: false,
+          error: null
+        });
+      }).catch(err => {
+        if (cancelled) return;
+        // Fail-soft: log and present empty so the UI hides itself.
+        // We do NOT bubble the error to the caller because chat
+        // should keep working even if the catalog is unreachable.
+        // eslint-disable-next-line no-console
+        console.warn("[useFilterCatalog] catalog fetch failed:", err);
+        setState({
+          categories: [],
+          loading: false,
+          error: err
+        });
+      });
       return () => {
         cancelled = true;
       };
-    }, [apiBaseUrl, getAuthToken]);
+    }, [apiBaseUrl, orgId, secretKey]);
     const hasFilters = reactExports.useMemo(() => Array.isArray(state.categories) && state.categories.length > 0, [state.categories]);
     return _objectSpread2(_objectSpread2({}, state), {}, {
       hasFilters
@@ -100614,28 +100602,24 @@
   /**
    * Fetches agent configuration from the deploy-agent endpoint
    * @param {string} apiBaseUrl - Base URL for the API
-   * @param {Function|undefined} getAuthToken - async fn returning a Bearer token (in-app JWT path), or undefined (Mode B proxy)
+   * @param {string} orgId - Organization ID
    * @returns {Promise<object>} Agent configuration object
    */
-  const fetchAgentConfig = async (apiBaseUrl, getAuthToken) => {
+  const fetchAgentConfig = async (apiBaseUrl, orgId, secretKey) => {
     if (!apiBaseUrl) {
       throw new Error("apiBaseUrl is required");
     }
+    // Mode A: secretKey in header, no orgId in URL
+    // Mode B (proxy): no secretKey, no orgId — proxy intercepts and signs the request
+    // Mode C legacy: orgId in URL path
+
     try {
       const base = apiBaseUrl.replace(/\/$/, '');
-      const url = "".concat(base, "/api/v1/deploy-agent");
+      const url = orgId ? "".concat(base, "/api/v1/deploy-agent/").concat(orgId) : "".concat(base, "/api/v1/deploy-agent");
       const headers = {
         "Content-Type": "application/json"
       };
-
-      // In-app JWT path: set Authorization header
-      // Mode B proxy: no auth header; proxy handles org resolution
-      if (typeof getAuthToken === 'function') {
-        const token = await getAuthToken();
-        if (token) {
-          headers['Authorization'] = "Bearer ".concat(token);
-        }
-      }
+      if (secretKey) headers['x-eshal-key'] = secretKey;
       const response = await fetch(url, {
         method: "GET",
         headers,
@@ -100655,10 +100639,11 @@
   const ChatWidget = _ref => {
     var _agentConfig$concierg;
     let {
-      /**
-       * @param {Function|undefined} getAuthToken - async fn returning a Keycloak Bearer token (in-app JWT path)
-       */
-      getAuthToken,
+      // Auth — at least one of secretKey (Mode A/B) or orgId (Mode C legacy) is needed.
+      secretKey,
+      // sk_live_... from ChatWidget.init({ secretKey, apiBaseUrl })
+      orgId,
+      // legacy — kept for backward compatibility
       apiBaseUrl,
       // Optional override props (will override fetched config if provided)
       darkMode,
@@ -100714,9 +100699,13 @@
           setIsLoadingConfig(false);
           return;
         }
+        // Mode B proxy: neither secretKey nor orgId in browser — proxy handles auth
+
         try {
           setIsLoadingConfig(true);
-          const config = await fetchAgentConfig(apiBaseUrl, getAuthToken);
+          // Pass secretKey for Mode A/B — fetchAgentConfig will send it as a
+          // header and omit the orgId path segment. Pass orgId for Mode C legacy.
+          const config = await fetchAgentConfig(apiBaseUrl, orgId, secretKey);
           setAgentConfig(config);
           setConfigError(null);
         } catch (error) {
@@ -100727,11 +100716,11 @@
         }
       };
       loadAgentConfig();
-    }, [apiBaseUrl, getAuthToken]);
+    }, [orgId, secretKey, apiBaseUrl]);
 
     // Map API response to widget props (use props as overrides if provided)
     const widgetConfig = reactExports.useMemo(() => {
-      var _agentConfig$config, _cfg$identity, _cfg$branding, _cfg$typography, _cfg$messages, _cfg$voice, _cfg$onboarding, _cfg$disclaimer, _cfg$csat, _cfg$inactivity, _cfg$behavior, _cfg$security, _cfg$layout, _ref2, _messages$bundles$loc, _messages$bundles, _messages$bundles$en, _messages$bundles2, _ref3, _ref4, _ref5, _ref6, _branding$chatbotAvat, _branding$chatbotAvat2, _ref7, _ref8, _ref9, _ref0, _ref1, _ref10, _ref11, _ref12, _typography$headerTex, _ref13, _ref14, _ref15, _ref16, _ref17, _ref18, _inactivity$timeoutVa, _inactivity$timeoutUn, _ref19, _ref20, _ref21, _ref22, _ref23, _ref24, _ref25, _ref26, _csat$enabled, _csat$format, _csat$prompt, _csat$triggerType, _csat$idleTimeoutMins, _csat$followUpEnabled, _csat$followUpPrompt, _behavior$autoPromptE, _behavior$allowFeedba, _behavior$provideCita, _agentConfig$organiza;
+      var _agentConfig$config, _cfg$identity, _cfg$branding, _cfg$typography, _cfg$messages, _cfg$voice, _cfg$onboarding, _cfg$disclaimer, _cfg$csat, _cfg$inactivity, _cfg$behavior, _cfg$security, _cfg$layout, _ref2, _messages$bundles$loc, _messages$bundles, _messages$bundles$en, _messages$bundles2, _ref3, _ref4, _ref5, _ref6, _branding$chatbotAvat, _branding$chatbotAvat2, _ref7, _ref8, _ref9, _ref0, _ref1, _ref10, _ref11, _ref12, _typography$headerTex, _ref13, _ref14, _ref15, _ref16, _ref17, _ref18, _inactivity$timeoutVa, _inactivity$timeoutUn, _ref19, _ref20, _ref21, _ref22, _ref23, _ref24, _ref25, _ref26, _csat$enabled, _csat$format, _csat$prompt, _csat$triggerType, _csat$idleTimeoutMins, _csat$followUpEnabled, _csat$followUpPrompt, _behavior$autoPromptE, _behavior$allowFeedba, _behavior$provideCita;
       if (!agentConfig) {
         return null;
       }
@@ -100790,6 +100779,7 @@
         fontFamily: (_ref1 = fontFamily !== null && fontFamily !== void 0 ? fontFamily : typography.agentMessageBubbleFontFamily) !== null && _ref1 !== void 0 ? _ref1 : "Inter",
         fontSize: (_ref10 = fontSize !== null && fontSize !== void 0 ? fontSize : typography.agentMessageBubbleFontSize) !== null && _ref10 !== void 0 ? _ref10 : "14px",
         defaultLanguage: locale,
+        organizationId: orgId,
         headerTextBold: (_ref11 = headerTextBold !== null && headerTextBold !== void 0 ? headerTextBold : typography.headerTextBold) !== null && _ref11 !== void 0 ? _ref11 : false,
         headerTextItalic: (_ref12 = headerTextItalic !== null && headerTextItalic !== void 0 ? headerTextItalic : typography.headerTextItalic) !== null && _ref12 !== void 0 ? _ref12 : false,
         headerTextColor: (_typography$headerTex = typography.headerTextColor) !== null && _typography$headerTex !== void 0 ? _typography$headerTex : "#FFFFFF",
@@ -100826,12 +100816,9 @@
         // every message and tell the backend to skip citation generation.
         // Defaults to true so agents that haven't set the field keep showing
         // citations (matches the testing-lab / chatbot-preview default).
-        provideCitations: (_behavior$provideCita = behavior.provideCitations) !== null && _behavior$provideCita !== void 0 ? _behavior$provideCita : true,
-        // organizationId from the backend response — used internally for
-        // session isolation (localStorage keys) and WS paths. Not a user prop.
-        organizationId: (_agentConfig$organiza = agentConfig.organizationId) !== null && _agentConfig$organiza !== void 0 ? _agentConfig$organiza : null
+        provideCitations: (_behavior$provideCita = behavior.provideCitations) !== null && _behavior$provideCita !== void 0 ? _behavior$provideCita : true
       };
-    }, [agentConfig, darkMode, primaryColor, position, companyName, conciergeName, companyLogo, welcomeMessage, quickQuestions, quickQuestionsEnabled, textColor, agentMessageBubbleColor, userMessageBoxColor, assistantTextColor, userTextColor, fontFamily, fontSize, defaultLanguage, headerTextBold, headerTextItalic, enableVoiceInteraction, disclaimerEnabled, disclaimerText, disclaimerPosition, disclaimerLinkLabel, disclaimerLinkUrl, showPoweredBy, onboardingQuestions, onboardingEnabled, collectionPrompt, allowedDomains, agentMessageBubbleFontFamily, agentMessageBubbleFontSize, userMessageBubbleFontFamily, userMessageBubbleFontSize
+    }, [agentConfig, darkMode, primaryColor, position, companyName, conciergeName, companyLogo, welcomeMessage, quickQuestions, quickQuestionsEnabled, textColor, agentMessageBubbleColor, userMessageBoxColor, assistantTextColor, userTextColor, fontFamily, fontSize, defaultLanguage, orgId, headerTextBold, headerTextItalic, enableVoiceInteraction, disclaimerEnabled, disclaimerText, disclaimerPosition, disclaimerLinkLabel, disclaimerLinkUrl, showPoweredBy, onboardingQuestions, onboardingEnabled, collectionPrompt, allowedDomains, agentMessageBubbleFontFamily, agentMessageBubbleFontSize, userMessageBubbleFontFamily, userMessageBubbleFontSize
     // CSAT dependencies
     // (kept minimal because these come from agentConfig)
     ]);
@@ -100850,7 +100837,7 @@
       quickQuestions: [],
       apiBaseUrl: apiBaseUrl || "",
       apiKey: apiKey || "",
-      getAuthToken,
+      organizationId: orgId || "",
       autoOpen: false,
       openDelay: 0,
       darkMode: false,
@@ -100858,7 +100845,7 @@
       onboardingQuestions: [],
       onboardingEnabled: false,
       collectionPrompt: undefined
-    }), [apiBaseUrl, apiKey, getAuthToken]);
+    }), [apiBaseUrl, apiKey, orgId]);
 
     // ALWAYS call hooks before any early returns (Rules of Hooks)
     const {
@@ -100907,7 +100894,7 @@
       // knowledge-api LoadBalancer.
       apiKey,
       organizationId: widgetConfig.organizationId,
-      getAuthToken,
+      secretKey,
       autoOpen,
       openDelay,
       darkMode: widgetConfig.darkMode,
@@ -100934,33 +100921,25 @@
       // navigation (but not a page refresh — feedback is not written to
       // localStorage so it resets on reload as intended).
       updateMessageFeedback(messageContent, feedback);
-      if (!conversationId || !apiBaseUrl) return;
+      if (!orgId && !secretKey || !conversationId || !apiBaseUrl) return;
       const base = apiBaseUrl.replace(/\/$/, "");
-      (async () => {
-        try {
-          const feedbackHeaders = {
-            "Content-Type": "application/json"
-          };
-          if (typeof getAuthToken === 'function') {
-            const token = await getAuthToken();
-            if (token) feedbackHeaders['Authorization'] = "Bearer ".concat(token);
-          }
-          await fetch("".concat(base, "/api/v1/support/feedback"), {
-            method: "POST",
-            headers: feedbackHeaders,
-            credentials: "include",
-            body: JSON.stringify({
-              messageContent,
-              conversationId,
-              feedback,
-              feedbackText
-            })
-          });
-        } catch (err) {
-          console.error("Feedback submission error:", err);
-        }
-      })();
-    }, [conversationId, apiBaseUrl, getAuthToken, updateMessageFeedback]);
+      const feedbackHeaders = {
+        "Content-Type": "application/json"
+      };
+      if (secretKey) feedbackHeaders['x-eshal-key'] = secretKey;else if (orgId) feedbackHeaders['x-eshal-org'] = orgId;
+      fetch("".concat(base, "/api/v1/support/feedback"), {
+        method: "POST",
+        headers: feedbackHeaders,
+        credentials: "include",
+        body: JSON.stringify({
+          messageContent,
+          conversationId,
+          organizationId: orgId,
+          feedback,
+          feedbackText
+        })
+      }).catch(err => console.error("Feedback submission error:", err));
+    }, [orgId, conversationId, apiBaseUrl, updateMessageFeedback]);
 
     // Refresh chat handler — reset conversation
     const handleRefreshChat = reactExports.useCallback(() => {
@@ -100976,7 +100955,7 @@
     const {
       categories: filterCategories,
       hasFilters: showFilterStep
-    } = useFilterCatalog(apiBaseUrl, getAuthToken);
+    } = useFilterCatalog(apiBaseUrl, orgId, secretKey);
 
     // Copy chat handler — copy all messages to clipboard
     const handleCopyChat = reactExports.useCallback(() => {
@@ -101081,7 +101060,8 @@
           showPoweredBy: widgetConfig.showPoweredBy,
           apiBaseUrl: apiBaseUrl,
           apiKey: apiKey,
-          getAuthToken: getAuthToken,
+          organizationId: widgetConfig.organizationId,
+          secretKey: secretKey,
           conversationId: conversationId,
           conciergeId: (_agentConfig$concierg = agentConfig === null || agentConfig === void 0 ? void 0 : agentConfig.conciergeId) !== null && _agentConfig$concierg !== void 0 ? _agentConfig$concierg : agentConfig === null || agentConfig === void 0 ? void 0 : agentConfig.id,
           onboardingQuestions: widgetConfig.onboardingQuestions,
@@ -101229,10 +101209,15 @@
         }
 
         // Render component
-        // Mode B proxy: apiBaseUrl alone is enough — no key or orgId in browser
-        // In-app JWT: getAuthToken fn passed via config
+        // Mode A/B: secretKey present — orgId derived server-side from the key
+        // Mode C legacy: orgId in config — backward compatible
+        // Both: apiBaseUrl required
+        // Mode B proxy: apiBaseUrl alone is enough — no secretKey or orgId in browser
         const hasNewAuth = config.apiBaseUrl;
         const widgetProps = hasNewAuth ? _objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2({
+          // Auth props — secretKey replaces orgId in Mode A/B
+          secretKey: config.secretKey || null,
+          orgId: config.orgId || null,
           apiBaseUrl: config.apiBaseUrl
         }, options.wsBaseUrl !== undefined && {
           wsBaseUrl: config.wsBaseUrl