@eshal-bot/chat-widget 0.1.71 → 0.1.72

package/dist/chat-widget.js

@@ -8010,16 +8010,21 @@
    * Sends a streaming chat request using fetch
    * @param {object} request - Chat request object
    * @param {string} apiBaseUrl - Base URL for the API
+   * @param {Function|undefined} getAuthToken - async fn returning a Bearer token (in-app JWT path), or undefined (Mode B proxy)
    */
-  const sendStreamingRequest = async (request, apiBaseUrl, organizationId) => {
+  const sendStreamingRequest = async (request, apiBaseUrl, getAuthToken) => {
     const headers = {
       'Content-Type': 'application/json',
       Accept: 'text/event-stream'
     };
 
-    // Add organization ID header if provided
-    if (organizationId) {
-      headers['x-eshal-org'] = organizationId;
+    // In-app JWT path: call getAuthToken() and set Authorization header
+    // Mode B proxy: no auth header from widget; proxy injects x-eshal-sig + x-eshal-org server-side
+    if (typeof getAuthToken === 'function') {
+      const token = await getAuthToken();
+      if (token) {
+        headers['Authorization'] = "Bearer ".concat(token);
+      }
     }
     const response = await fetch("".concat(apiBaseUrl.replace(/\/$/, ''), "/api/v1/support"), {
       method: 'POST',
@@ -8343,20 +8348,33 @@
             // Handle text_chunk events
             if (parsed.type === 'text_chunk') {
               var _parsed$choices;
+              // ALWAYS create the skeleton on the first text_chunk, even when it
+              // carries no content (a role-only "skeleton" chunk — delta.role
+              // without delta.content — is the backend's "an assistant turn is
+              // starting" signal used by the input/source-clarification short-
+              // circuits in chat_utils.py). Without this, a clarification turn
+              // that emits [text_chunk role-only] -> [complete content+
+              // finalContent] never created the assistant bubble (this branch
+              // skipped on empty content; the COMPLETE branch's updateFinalMessage
+              // requires lastMessage.role === 'assistant' to render — see
+              // updateFinalMessage line ~189) → the follow-up question was
+              // silently dropped, even though the wire carried everything
+              // correctly. Mirrors handleStreamEvent (line ~257) and packages/
+              // frontend ChatService.ts (line ~213) which both create the
+              // skeleton unconditionally on the first text_chunk.
+              if (!hasReceivedFirstChunk.current) {
+                hasReceivedFirstChunk.current = true;
+                setMessages(prev => {
+                  const lastMessage = prev[prev.length - 1];
+                  if (!lastMessage || lastMessage.role !== 'assistant' || !lastMessage.isProcessing) {
+                    const skeletonMessage = createSkeletonMessage();
+                    return [...(prev || []), skeletonMessage];
+                  }
+                  return prev;
+                });
+              }
               const content = ((_parsed$choices = parsed.choices) === null || _parsed$choices === void 0 || (_parsed$choices = _parsed$choices[0]) === null || _parsed$choices === void 0 || (_parsed$choices = _parsed$choices.delta) === null || _parsed$choices === void 0 ? void 0 : _parsed$choices.content) || parsed.content;
               if (content) {
-                // Create skeleton on first chunk if not already created
-                if (!hasReceivedFirstChunk.current) {
-                  hasReceivedFirstChunk.current = true;
-                  setMessages(prev => {
-                    const lastMessage = prev[prev.length - 1];
-                    if (!lastMessage || lastMessage.role !== 'assistant' || !lastMessage.isProcessing) {
-                      const skeletonMessage = createSkeletonMessage();
-                      return [...(prev || []), skeletonMessage];
-                    }
-                    return prev;
-                  });
-                }
                 accumulatedText.current += content;
                 updateMessage(accumulatedText.current);
               }
@@ -8759,31 +8777,27 @@
   };
 
   /**
-   * Constructs the voice WebSocket base URL — ALWAYS derived from the API
-   * base URL the widget is embedded with, as `wss://{host}/voice/ws`.
+   * Constructs the voice WebSocket base URL.
    *
-   * `/voice/ws/{org}/{session}` is terminated by the frontend custom server
-   * (packages/frontend/server.js), which proxies it in-cluster to
-   * knowledge-api on `/ws`. The widget always talks to the same origin it
-   * loaded its config from, so the WS endpoint is fully determined by
-   * `apiBaseUrl`. There is intentionally NO override parameter: voice can
-   * never be pointed at the (no-longer-public) knowledge-api LoadBalancer by
-   * a stale embed option or backend config value.
+   * If wsBaseUrl is provided explicitly (via ChatWidget.init({ wsBaseUrl })),
+   * use it directly. Required for Mode B external embeds where apiBaseUrl is
+   * the customer server, not the eshal frontend.
+   *
+   * For in-app use (apiBaseUrl IS the eshal frontend), derives from apiBaseUrl.
    *
    * @param {string} apiBaseUrl - Frontend base URL, e.g. https://demo.eshal.ai
-   * @returns {string} Voice WS base, e.g. wss://demo.eshal.ai/voice/ws
+   * @param {string} [wsBaseUrl] - Explicit override, e.g. wss://dev.eshal.ai/voice/ws
+   * @returns {string} Voice WS base URL
    */
-  const getWebSocketUrl = apiBaseUrl => {
+  const getWebSocketUrl = (apiBaseUrl, wsBaseUrl) => {
+    if (wsBaseUrl) return wsBaseUrl.replace(/\/$/, '');
     if (!apiBaseUrl) {
-      // No base URL yet (config still loading) — safe public default.
       return 'wss://dev.eshal.ai/voice/ws';
     }
     try {
       const url = new URL(apiBaseUrl);
-      // http→ws, https→wss; point at the frontend voice-proxy path.
       url.protocol = url.protocol.replace(/^http/, 'ws');
       url.pathname = '/voice/ws';
-      // Clean URL without a trailing slash.
       return url.toString().replace(/\/$/, '');
     } catch (error) {
       console.error("Invalid API base URL provided for WebSocket:", error);
@@ -9127,8 +9141,10 @@
       welcomeMessage,
       quickQuestions = [],
       apiBaseUrl,
+      wsBaseUrl,
       apiKey,
       organizationId,
+      getAuthToken,
       autoOpen,
       openDelay,
       darkMode,
@@ -9296,11 +9312,9 @@
     const visitorProfileRef = reactExports.useRef(null);
     const websocketUrl = reactExports.useMemo(() => {
       if (!organizationId) return null;
-      // Voice WS base is always derived from apiBaseUrl (the frontend origin
-      // the widget is embedded with) → wss://{host}/voice/ws. No override.
-      const resolvedWsBaseUrl = getWebSocketUrl(apiBaseUrl);
+      const resolvedWsBaseUrl = getWebSocketUrl(apiBaseUrl, wsBaseUrl);
       return "".concat(resolvedWsBaseUrl, "/").concat(organizationId, "/").concat(bidiSessionId);
-    }, [apiBaseUrl, organizationId, bidiSessionId]);
+    }, [apiBaseUrl, wsBaseUrl, organizationId, bidiSessionId]);
     const getNextMessageId = reactExports.useCallback(() => {
       const id = "msg-".concat(messageIdRef.current);
       messageIdRef.current += 1;
@@ -9765,7 +9779,7 @@
         if (apiType === 'userName' || apiType === 'email' || apiType === 'phone') {
           // For onboarding fields, just consume the stream without processing.
           // Single attempt — no retry, no user-visible partial state to clean up.
-          const stream = await sendStreamingRequest(chatRequest, apiBaseUrl, organizationId);
+          const stream = await sendStreamingRequest(chatRequest, apiBaseUrl, getAuthToken);
           const reader = stream.getReader();
           const decoder = new TextDecoder();
           while (true) {
@@ -9784,7 +9798,7 @@
           let lastErr;
           for (let attempt = 0; attempt <= STREAM_RETRY_DELAYS_MS.length; attempt += 1) {
             try {
-              const stream = await sendStreamingRequest(chatRequest, apiBaseUrl, organizationId);
+              const stream = await sendStreamingRequest(chatRequest, apiBaseUrl, getAuthToken);
               await processStream(stream, setMessages);
               updateActivity(organizationId);
               return {
@@ -9812,7 +9826,7 @@
 
         // Non-chat, non-onboarding apiType (shouldn't currently happen):
         // fire and forget, single attempt.
-        await sendStreamingRequest(chatRequest, apiBaseUrl, organizationId);
+        await sendStreamingRequest(chatRequest, apiBaseUrl, getAuthToken);
         updateActivity(organizationId);
         return {
           success: true
@@ -9848,7 +9862,7 @@
         // UX-M09: release the concurrency guard so the next send can proceed.
         isSendingRef.current = false;
       }
-    }, [apiBaseUrl, apiKey, getNextMessageId, organizationId, messages, bidiSessionId, routingChoice, widgetFilter, provideCitations]);
+    }, [apiBaseUrl, apiKey, getNextMessageId, getAuthToken, messages, bidiSessionId, routingChoice, widgetFilter, provideCitations]);
     const handleOnboardingFormSubmit = reactExports.useCallback(async answers => {
       const questions = getOnboardingQuestions(onboardingQuestions);
       if (questions.length === 0) return;
@@ -91749,6 +91763,31 @@
     return String(n);
   }
 
+  // ── Currency-aware value formatting ──────────────────────────────────────
+  // A2UI chart data is normalized to `{ label, value }` by A2uiBlock's
+  // numericData(), which drops the original Y-column key. A2uiBlock now threads
+  // that key through as `props.yKey` so these renderers can decide whether the
+  // axis / tooltip values are money. Heuristic mirrors the frontend's
+  // chartShared.tsx `isCurrencyKey` — keep the keyword list in lockstep.
+  // `(^|[_\W])` (not `\b`) so "average_salary" / "total_expenses" still match —
+  // JS `\b` doesn't fire next to `_`.
+  const CURRENCY_KEY_RE$1 = /(^|[_\W])(price|salary|cost|amount|revenue|expense|total|value|budget|spend|income|sale|balance)/i;
+  function isCurrencyKey$1(key) {
+    return typeof key === 'string' && CURRENCY_KEY_RE$1.test(key);
+  }
+
+  // Compact currency for axis ticks → "$120.0k". Full currency for tooltips →
+  // "$87,600" (comma-grouped, up to 2 decimals, no forced trailing zeros so a
+  // whole-dollar salary reads "$81,200" not "$81,200.00").
+  function formatCurrencyCompact(v) {
+    return "$".concat(formatCompactNumber(v));
+  }
+  function formatCurrencyFull(v) {
+    return "$".concat(Number(v).toLocaleString('en-US', {
+      maximumFractionDigits: 2
+    }));
+  }
+
   /**
    * Recharts bar chart — mirrors agent-sdk's eshalRenderers.BarChart.
    *
@@ -91761,6 +91800,11 @@
       isDark = false
     } = _ref;
     const data = Array.isArray(props.data) ? props.data : [];
+    // Whether the Y values are money — drives the `$` on axis ticks + tooltip.
+    const currency = isCurrencyKey$1(props.yKey);
+    // Human series name for the tooltip ("Average Salary"), so it no longer
+    // reads the generic dataKey "value".
+    const seriesName = props.valueLabel || undefined;
     const borderColor = isDark ? '#374151' : '#e2e8f0';
     const bgColor = isDark ? '#1f2937' : '#ffffff';
     const labelColor = isDark ? '#9ca3af' : '#64748b';
@@ -91835,6 +91879,9 @@
                 fontSize: 11,
                 fill: labelColor
               },
+              angle: 0,
+              textAnchor: "middle",
+              interval: 0,
               label: props.xAxisLabel ? {
                 value: props.xAxisLabel,
                 position: 'insideBottom',
@@ -91855,9 +91902,9 @@
                 fontSize: 11,
                 fill: labelColor
               } : undefined,
-              tickFormatter: v => props.unit ? "".concat(formatCompactNumber(v), " ").concat(props.unit) : formatCompactNumber(v)
+              tickFormatter: v => currency ? formatCurrencyCompact(v) : props.unit ? "".concat(formatCompactNumber(v), " ").concat(props.unit) : formatCompactNumber(v)
             }), /*#__PURE__*/jsxRuntimeExports.jsx(Tooltip, {
-              formatter: v => props.unit ? "".concat(Number(v).toLocaleString(), " ").concat(props.unit) : Number(v).toLocaleString(),
+              formatter: v => currency ? formatCurrencyFull(v) : props.unit ? "".concat(Number(v).toLocaleString(), " ").concat(props.unit) : Number(v).toLocaleString(),
               contentStyle: {
                 background: tooltipBg,
                 border: "1px solid ".concat(borderColor),
@@ -91867,6 +91914,7 @@
               }
             }), /*#__PURE__*/jsxRuntimeExports.jsx(Bar, {
               dataKey: "value",
+              name: seriesName,
               fill: "#3b82f6",
               radius: [2, 2, 0, 0]
             })]
@@ -91950,6 +91998,7 @@
       donut = false
     } = _ref3;
     const data = Array.isArray(props.data) ? props.data : [];
+    const currency = isCurrencyKey$1(props.yKey);
     const borderColor = isDark ? '#374151' : '#e2e8f0';
     const bgColor = isDark ? '#1f2937' : '#ffffff';
     const titleColor = isDark ? '#f3f4f6' : '#0f172a';
@@ -92000,7 +92049,7 @@
                 fill: PIE_COLORS[i % PIE_COLORS.length]
               }, i))
             }), /*#__PURE__*/jsxRuntimeExports.jsx(Tooltip, {
-              formatter: v => Number(v).toLocaleString(),
+              formatter: v => currency ? formatCurrencyFull(v) : Number(v).toLocaleString(),
               contentStyle: {
                 background: tooltipBg,
                 border: "1px solid ".concat(borderColor),
@@ -92034,6 +92083,8 @@
       area = false
     } = _ref4;
     const data = Array.isArray(props.data) ? props.data : [];
+    const currency = isCurrencyKey$1(props.yKey);
+    const seriesName = props.valueLabel || undefined;
     const borderColor = isDark ? '#374151' : '#e2e8f0';
     const bgColor = isDark ? '#1f2937' : '#ffffff';
     const labelColor = isDark ? '#9ca3af' : '#64748b';
@@ -92109,6 +92160,9 @@
                 fontSize: 11,
                 fill: labelColor
               },
+              angle: 0,
+              textAnchor: "middle",
+              interval: 0,
               label: props.xAxisLabel ? {
                 value: props.xAxisLabel,
                 position: 'insideBottom',
@@ -92122,9 +92176,9 @@
                 fontSize: 11,
                 fill: labelColor
               },
-              tickFormatter: v => props.unit ? "".concat(formatCompactNumber(v), " ").concat(props.unit) : formatCompactNumber(v)
+              tickFormatter: v => currency ? formatCurrencyCompact(v) : props.unit ? "".concat(formatCompactNumber(v), " ").concat(props.unit) : formatCompactNumber(v)
             }), /*#__PURE__*/jsxRuntimeExports.jsx(Tooltip, {
-              formatter: v => props.unit ? "".concat(Number(v).toLocaleString(), " ").concat(props.unit) : Number(v).toLocaleString(),
+              formatter: v => currency ? formatCurrencyFull(v) : props.unit ? "".concat(Number(v).toLocaleString(), " ").concat(props.unit) : Number(v).toLocaleString(),
               contentStyle: {
                 background: tooltipBg,
                 border: "1px solid ".concat(borderColor),
@@ -92135,6 +92189,7 @@
             }), area ? /*#__PURE__*/jsxRuntimeExports.jsx(Area, {
               type: "monotone",
               dataKey: "value",
+              name: seriesName,
               stroke: "#3b82f6",
               fill: "#3b82f6",
               fillOpacity: 0.15,
@@ -92146,6 +92201,7 @@
             }) : /*#__PURE__*/jsxRuntimeExports.jsx(Line, {
               type: "monotone",
               dataKey: "value",
+              name: seriesName,
               stroke: "#3b82f6",
               strokeWidth: 2,
               dot: {
@@ -92343,7 +92399,14 @@
       data: rows,
       unit: spec.unit,
       xAxisLabel: spec.xAxisLabel,
-      yAxisLabel: spec.yAxisLabel
+      yAxisLabel: spec.yAxisLabel,
+      // numericData() collapses the rows to { label, value }, dropping the
+      // original Y-column key. Pass it through so the renderer can detect a
+      // currency column (→ "$" on the Y-axis + tooltip) and label the tooltip
+      // series with the human column name ("Average Salary") instead of the
+      // generic dataKey "value".
+      yKey: y,
+      valueLabel: prettifyLabel(y)
     };
     if (t === 'pie') return /*#__PURE__*/jsxRuntimeExports.jsx(PieChartRenderer, {
       props: chartProps,
@@ -92670,10 +92733,12 @@
 
   // ISO date / datetime prefix — matches the typical SQL output the
   // agent's tools produce when GROUP BY-ing by month
-  // (`DATE_TRUNC('month', col)` → `YYYY-MM-DD`). Used by formatAxisTick
-  // below so a chart of monthly expenses shows "Jan '26" / "Feb '26"
-  // horizontally instead of "2026 01 01" slanted (EV-1187 follow-up).
-  const ISO_DATE_RE = /^(\d{4})-(\d{2})-(\d{2})(?:T|$)/;
+  // (`DATE_TRUNC('month', col)` → `YYYY-MM-DD`, or `to_char(..,'YYYY-MM')`
+  // → `YYYY-MM`). Used by formatAxisTick below so a chart of monthly
+  // expenses shows "Jan '26" / "Feb '26" horizontally instead of
+  // "2026 01 01" or "2026 01" slanted (EV-1187 follow-up + 2026-06-24
+  // day-less variant fix).
+  const ISO_DATE_RE = /^(\d{4})-(\d{2})(?:-\d{2})?(?:[T\s]|$)/;
   function formatIsoDateAsMonthTick(value) {
     if (typeof value !== 'string') return null;
     const m = value.match(ISO_DATE_RE);
@@ -92716,6 +92781,14 @@
     if (!SNAKE_CASE_CATEGORY_RE.test(value)) return value;
     return prettifyLabel(value);
   }
+
+  // Numeric string under a money column, e.g. "81,200" / "105444" / "-1,250.50".
+  // Markdown tables (the common concierge path) arrive as text cells, so a
+  // salary value is the STRING "81,200" — not a number — and skips the
+  // USD_FORMATTER branch below. We prefix "$" while keeping the source's own
+  // grouping/decimals so it reads "$81,200" (not "$81,200.00"). A leading "$"
+  // already present makes the regex miss, so we never double-prefix.
+  const _NUMERIC_STRING_RE = /^-?\d[\d,]*(\.\d+)?$/;
   function formatCell(v, columnKey) {
     if (v == null) return '';
     if (typeof v === 'number') {
@@ -92725,6 +92798,11 @@
       return Number.isInteger(v) ? String(v) : v.toFixed(2);
     }
     if (typeof v === 'object') return JSON.stringify(v);
+    // Numeric string under a money-named column → prefix "$" (Bug: concierge
+    // salary table showed "81,200" with no currency symbol).
+    if (isCurrencyKey(columnKey) && _NUMERIC_STRING_RE.test(String(v).trim())) {
+      return "$".concat(String(v).trim());
+    }
     // String cells: prettify snake_case category labels (e.g.
     // `office_supplies` → "Office Supplies") so the table reads
     // consistently with the chart's X-axis ticks on the same data.
@@ -94302,7 +94380,7 @@
     let {
       sources = [],
       apiBaseUrl,
-      organizationId,
+      getAuthToken,
       isDark,
       textColor,
       fontFamily,
@@ -94328,7 +94406,7 @@
     // corpora that have none of the above.
     const _downloadKey = s => s.url || s.source_id || s.source_name || "";
     const handleFileDownload = async source => {
-      if (!apiBaseUrl || !organizationId) return;
+      if (!apiBaseUrl) return;
       // SharePoint proxy URLs are GET endpoints that stream the file
       // directly via Microsoft Graph using the stored OAuth credential.
       // Bypass the legacy POST /file-download lookup (which expects an
@@ -94354,11 +94432,14 @@
           // set, or future deployments that set it) pass through
           // unchanged.
           const spUrl = source.url.startsWith("http") ? source.url : "".concat(apiBaseUrl.replace(/\/$/, "")).concat(source.url);
+          const spHeaders = {};
+          if (typeof getAuthToken === 'function') {
+            const token = await getAuthToken();
+            if (token) spHeaders['Authorization'] = "Bearer ".concat(token);
+          }
           res = await fetch(spUrl, {
             method: "GET",
-            headers: {
-              "x-eshal-org": organizationId
-            },
+            headers: spHeaders,
             credentials: "include"
           });
         } else {
@@ -94374,15 +94455,18 @@
           //   - source.source_name (the user's original filename)
           // Sending both lets the server skip the Milvus resolution
           // AND advertise the readable name in Content-Disposition.
+          const dlHeaders = {
+            "Content-Type": "application/json"
+          };
+          if (typeof getAuthToken === 'function') {
+            const token = await getAuthToken();
+            if (token) dlHeaders['Authorization'] = "Bearer ".concat(token);
+          }
           res = await fetch(url, {
             method: "POST",
-            headers: {
-              "Content-Type": "application/json",
-              "x-eshal-org": organizationId
-            },
+            headers: dlHeaders,
             credentials: "include",
             body: JSON.stringify({
-              org_id: organizationId,
               source_id: source.source_id,
               file_name: source.url || "",
               source_name: source.source_name || ""
@@ -94567,7 +94651,7 @@
       conciergeName,
       companyName,
       apiBaseUrl,
-      organizationId,
+      getAuthToken,
       onPromptSuggestionClick,
       allowFeedback = true,
       provideCitations = true,
@@ -94739,7 +94823,7 @@
                   }), /*#__PURE__*/jsxRuntimeExports.jsx(MessageSources, {
                     sources: message.sources,
                     apiBaseUrl: apiBaseUrl,
-                    organizationId: organizationId,
+                    getAuthToken: getAuthToken,
                     isDark: isDark,
                     textColor: messageTextColor,
                     fontFamily: messageFontFamily,
@@ -94765,7 +94849,7 @@
                   }), /*#__PURE__*/jsxRuntimeExports.jsx(MessageSources, {
                     sources: message.sources,
                     apiBaseUrl: apiBaseUrl,
-                    organizationId: organizationId,
+                    getAuthToken: getAuthToken,
                     isDark: isDark,
                     textColor: messageTextColor,
                     fontFamily: messageFontFamily,
@@ -94945,7 +95029,7 @@
       conciergeName,
       companyName,
       apiBaseUrl,
-      organizationId,
+      getAuthToken,
       onPromptSuggestionClick,
       allowFeedback,
       provideCitations,
@@ -94989,7 +95073,7 @@
       conciergeName: conciergeName,
       companyName: companyName,
       apiBaseUrl: apiBaseUrl,
-      organizationId: organizationId,
+      getAuthToken: getAuthToken,
       onPromptSuggestionClick: onPromptSuggestionClick,
       allowFeedback: allowFeedback,
       provideCitations: provideCitations,
@@ -95834,7 +95918,7 @@
       conciergeName,
       companyName,
       apiBaseUrl,
-      organizationId,
+      getAuthToken,
       onPromptSuggestionClick,
       conversationResetKey,
       allowFeedback,
@@ -96016,7 +96100,7 @@
         conciergeName: conciergeName,
         companyName: companyName,
         apiBaseUrl: apiBaseUrl,
-        organizationId: organizationId,
+        getAuthToken: getAuthToken,
         allowFeedback: allowFeedback,
         provideCitations: provideCitations,
         onFeedback: onFeedback,
@@ -96048,7 +96132,7 @@
             conciergeName: conciergeName,
             companyName: companyName,
             apiBaseUrl: apiBaseUrl,
-            organizationId: organizationId,
+            getAuthToken: getAuthToken,
             headerTextColor: headerTextColor
           }, "skeleton-waiting");
         }
@@ -96163,7 +96247,18 @@
     copyChat: "Copy Chat",
     startChat: "Start Chat",
     startingVoiceSession: "Starting voice session...",
-    allowMicAccess: "Allow microphone access"
+    allowMicAccess: "Allow microphone access",
+    // Onboarding-form validation messages. These are the English fallback for
+    // every locale (translate() falls back to EN[key]); without them the form
+    // rendered the raw key strings ("emailInvalid", etc.). `fieldRequiredSuffix`
+    // is appended after a field label: `${label} ${fieldRequiredSuffix}`.
+    emailRequired: "Please enter your email address",
+    nameRequired: "Please enter your name",
+    phoneRequired: "Please enter your phone number",
+    fieldRequiredSuffix: "is required",
+    emailInvalid: "Please enter a valid email address",
+    nameInvalid: "Please enter a valid name",
+    phoneInvalid: "Please enter a valid phone number"
   };
   const DICTIONARIES = {
     en: EN,
@@ -99552,7 +99647,7 @@
       showPoweredBy = true,
       apiBaseUrl,
       apiKey,
-      organizationId,
+      getAuthToken,
       conversationId,
       conciergeId,
       onboardingQuestions = [],
@@ -99700,7 +99795,7 @@
         setCsatSubmitted(submitted);
         if (submitted) setShowCsat(false);
       } catch (_unused4) {}
-    }, [conversationId, organizationId]);
+    }, [conversationId]);
 
     // Auto-scroll hook
     useAutoScroll(messagesContainerRef, [messages, isLoading], {
@@ -99838,14 +99933,15 @@
     const handleCsatRating = async (rating, format) => {
       setCsatSubmitted(true); // optimistic UI
       setShowCsat(false);
-      markCsatSubmitted(organizationId); // persist so page refresh doesn't re-show CSAT
+      markCsatSubmitted(undefined); // persist so page refresh doesn't re-show CSAT
 
       try {
         const headers = {
           "Content-Type": "application/json"
         };
-        if (organizationId) {
-          headers["x-eshal-org"] = organizationId;
+        if (typeof getAuthToken === 'function') {
+          const token = await getAuthToken();
+          if (token) headers['Authorization'] = "Bearer ".concat(token);
         }
         const response = await fetch("".concat(apiBaseUrl.replace(/\/$/, ""), "/api/v1/support/csat"), {
           method: "POST",
@@ -99855,7 +99951,6 @@
             conversationId,
             rating,
             ratingFormat: format,
-            organizationId,
             conciergeId
           })
         });
@@ -99879,8 +99974,9 @@
         const headers = {
           "Content-Type": "application/json"
         };
-        if (organizationId) {
-          headers["x-eshal-org"] = organizationId;
+        if (typeof getAuthToken === 'function') {
+          const token = await getAuthToken();
+          if (token) headers['Authorization'] = "Bearer ".concat(token);
         }
         const ratingFormat = normalizeCsatFormat(csatFormat);
         const response = await fetch("".concat(apiBaseUrl.replace(/\/$/, ""), "/api/v1/support/csat"), {
@@ -99891,7 +99987,6 @@
             conversationId,
             rating: String(resolveRating),
             ratingFormat,
-            organizationId,
             conciergeId,
             feedback: resolveFeedbackText || undefined
           })
@@ -99925,7 +100020,7 @@
       } finally {
         setIsSubmittingResolve(false);
       }
-    }, [isCsatEnabled, isSubmittingResolve, isConversationResolved, resolveRating, resolveFeedbackText, conversationId, organizationId, conciergeId, apiBaseUrl, csatFormat, onResetConversation, onRefreshChat, onWidgetFilterChange]);
+    }, [isCsatEnabled, isSubmittingResolve, isConversationResolved, resolveRating, resolveFeedbackText, conversationId, getAuthToken, conciergeId, apiBaseUrl, csatFormat, onResetConversation, onRefreshChat, onWidgetFilterChange]);
 
     // Handle X button: first click shows form, second click closes
     const handleCloseClick = reactExports.useCallback(() => {
@@ -100263,7 +100358,7 @@
                 conciergeName: conciergeName,
                 companyName: companyName,
                 apiBaseUrl: apiBaseUrl,
-                organizationId: organizationId,
+                getAuthToken: getAuthToken,
                 conversationResetKey: conversationId,
                 allowFeedback: allowFeedback,
                 provideCitations: provideCitations,
@@ -100348,7 +100443,7 @@
 
   /**
    * @param {string|undefined|null} apiBaseUrl
-   * @param {string|undefined|null} orgId
+   * @param {Function|undefined|null} getAuthToken - async fn returning a Bearer token (in-app JWT path), or undefined/null (Mode B proxy)
    * @returns {{
    *   categories: Array<{id:string,label:string,count:number,tags:string[]}>,
    *   loading: boolean,
@@ -100356,14 +100451,15 @@
    *   hasFilters: boolean,
    * }}
    */
-  function useFilterCatalog(apiBaseUrl, orgId) {
+  function useFilterCatalog(apiBaseUrl, getAuthToken) {
+    const hasAuth = !!apiBaseUrl;
     const [state, setState] = reactExports.useState({
       categories: [],
-      loading: !!(apiBaseUrl && orgId),
+      loading: hasAuth,
       error: null
     });
     reactExports.useEffect(() => {
-      if (!apiBaseUrl || !orgId) {
+      if (!apiBaseUrl) {
         setState({
           categories: [],
           loading: false,
@@ -100371,8 +100467,8 @@
         });
         return;
       }
-      const key = "".concat(apiBaseUrl, "|").concat(orgId);
-      const cached = _PROCESS_CACHE.get(key);
+      const cacheKey = getAuthToken ? "".concat(apiBaseUrl, "|__session__") : "".concat(apiBaseUrl, "|__proxy__");
+      const cached = _PROCESS_CACHE.get(cacheKey);
       if (cached) {
         setState({
           categories: cached,
@@ -100386,43 +100482,55 @@
         loading: true,
         error: null
       }));
-      const url = "".concat(apiBaseUrl.replace(/\/$/, ""), "/api/v1/widget/filters/").concat(encodeURIComponent(orgId));
-      fetch(url, {
-        method: "GET",
-        headers: {
-          Accept: "application/json"
-        }
-      }).then(async res => {
-        if (!res.ok) {
-          throw new Error("filter catalog HTTP ".concat(res.status));
+      const base = apiBaseUrl.replace(/\/$/, "");
+      const url = "".concat(base, "/api/v1/widget/filters");
+      (async () => {
+        try {
+          const headers = {
+            Accept: "application/json"
+          };
+          // In-app JWT path: set Authorization header
+          // Mode B proxy: no auth header; proxy handles org resolution
+          if (typeof getAuthToken === 'function') {
+            const token = await getAuthToken();
+            if (token) {
+              headers['Authorization'] = "Bearer ".concat(token);
+            }
+          }
+          const res = await fetch(url, {
+            method: "GET",
+            headers
+          });
+          if (!res.ok) {
+            throw new Error("filter catalog HTTP ".concat(res.status));
+          }
+          const body = await res.json();
+          const categories = Array.isArray(body === null || body === void 0 ? void 0 : body.categories) ? body.categories : [];
+          if (cancelled) return;
+          _PROCESS_CACHE.set(cacheKey, categories);
+          setState({
+            categories,
+            loading: false,
+            error: null
+          });
+        } catch (err) {
+          if (cancelled) return;
+          // Fail-soft: log and present empty so the UI hides itself.
+          // We do NOT bubble the error to the caller because chat
+          // should keep working even if the catalog is unreachable.
+          // eslint-disable-next-line no-console
+          console.warn("[useFilterCatalog] catalog fetch failed:", err);
+          setState({
+            categories: [],
+            loading: false,
+            error: err
+          });
         }
-        const body = await res.json();
-        return Array.isArray(body === null || body === void 0 ? void 0 : body.categories) ? body.categories : [];
-      }).then(categories => {
-        if (cancelled) return;
-        _PROCESS_CACHE.set(key, categories);
-        setState({
-          categories,
-          loading: false,
-          error: null
-        });
-      }).catch(err => {
-        if (cancelled) return;
-        // Fail-soft: log and present empty so the UI hides itself.
-        // We do NOT bubble the error to the caller because chat
-        // should keep working even if the catalog is unreachable.
-        // eslint-disable-next-line no-console
-        console.warn("[useFilterCatalog] catalog fetch failed:", err);
-        setState({
-          categories: [],
-          loading: false,
-          error: err
-        });
-      });
+      })();
       return () => {
         cancelled = true;
       };
-    }, [apiBaseUrl, orgId]);
+    }, [apiBaseUrl, getAuthToken]);
     const hasFilters = reactExports.useMemo(() => Array.isArray(state.categories) && state.categories.length > 0, [state.categories]);
     return _objectSpread2(_objectSpread2({}, state), {}, {
       hasFilters
@@ -100501,20 +100609,31 @@
   /**
    * Fetches agent configuration from the deploy-agent endpoint
    * @param {string} apiBaseUrl - Base URL for the API
-   * @param {string} orgId - Organization ID
+   * @param {Function|undefined} getAuthToken - async fn returning a Bearer token (in-app JWT path), or undefined (Mode B proxy)
    * @returns {Promise<object>} Agent configuration object
    */
-  const fetchAgentConfig = async (apiBaseUrl, orgId) => {
-    if (!apiBaseUrl || !orgId) {
-      throw new Error("apiBaseUrl and orgId are required");
+  const fetchAgentConfig = async (apiBaseUrl, getAuthToken) => {
+    if (!apiBaseUrl) {
+      throw new Error("apiBaseUrl is required");
     }
     try {
-      const url = "".concat(apiBaseUrl.replace(/\/$/, ''), "/api/v1/deploy-agent/").concat(orgId);
+      const base = apiBaseUrl.replace(/\/$/, '');
+      const url = "".concat(base, "/api/v1/deploy-agent");
+      const headers = {
+        "Content-Type": "application/json"
+      };
+
+      // In-app JWT path: set Authorization header
+      // Mode B proxy: no auth header; proxy handles org resolution
+      if (typeof getAuthToken === 'function') {
+        const token = await getAuthToken();
+        if (token) {
+          headers['Authorization'] = "Bearer ".concat(token);
+        }
+      }
       const response = await fetch(url, {
         method: "GET",
-        headers: {
-          "Content-Type": "application/json"
-        },
+        headers,
         credentials: "include"
       });
       if (!response.ok) {
@@ -100531,8 +100650,10 @@
   const ChatWidget = _ref => {
     var _agentConfig$concierg;
     let {
-      // Required props for dynamic config
-      orgId,
+      /**
+       * @param {Function|undefined} getAuthToken - async fn returning a Keycloak Bearer token (in-app JWT path)
+       */
+      getAuthToken,
       apiBaseUrl,
       // Optional override props (will override fetched config if provided)
       darkMode,
@@ -100574,7 +100695,8 @@
       onboardingQuestions,
       collectionPrompt,
       allowedDomains,
-      onboardingEnabled
+      onboardingEnabled,
+      wsBaseUrl
     } = _ref;
     const [agentConfig, setAgentConfig] = reactExports.useState(null);
     const [isLoadingConfig, setIsLoadingConfig] = reactExports.useState(true);
@@ -100583,14 +100705,14 @@
     // Fetch agent configuration on mount
     reactExports.useEffect(() => {
       const loadAgentConfig = async () => {
-        if (!orgId || !apiBaseUrl) {
-          setConfigError("orgId and apiBaseUrl are required");
+        if (!apiBaseUrl) {
+          setConfigError("apiBaseUrl is required");
           setIsLoadingConfig(false);
           return;
         }
         try {
           setIsLoadingConfig(true);
-          const config = await fetchAgentConfig(apiBaseUrl, orgId);
+          const config = await fetchAgentConfig(apiBaseUrl, getAuthToken);
           setAgentConfig(config);
           setConfigError(null);
         } catch (error) {
@@ -100601,11 +100723,11 @@
         }
       };
       loadAgentConfig();
-    }, [orgId, apiBaseUrl]);
+    }, [apiBaseUrl, getAuthToken]);
 
     // Map API response to widget props (use props as overrides if provided)
     const widgetConfig = reactExports.useMemo(() => {
-      var _agentConfig$config, _cfg$identity, _cfg$branding, _cfg$typography, _cfg$messages, _cfg$voice, _cfg$onboarding, _cfg$disclaimer, _cfg$csat, _cfg$inactivity, _cfg$behavior, _cfg$security, _cfg$layout, _ref2, _messages$bundles$loc, _messages$bundles, _messages$bundles$en, _messages$bundles2, _ref3, _ref4, _ref5, _ref6, _branding$chatbotAvat, _branding$chatbotAvat2, _ref7, _ref8, _ref9, _ref0, _ref1, _ref10, _ref11, _ref12, _typography$headerTex, _ref13, _ref14, _ref15, _ref16, _ref17, _ref18, _inactivity$timeoutVa, _inactivity$timeoutUn, _ref19, _ref20, _ref21, _ref22, _ref23, _ref24, _ref25, _ref26, _csat$enabled, _csat$format, _csat$prompt, _csat$triggerType, _csat$idleTimeoutMins, _csat$followUpEnabled, _csat$followUpPrompt, _behavior$autoPromptE, _behavior$allowFeedba, _behavior$provideCita;
+      var _agentConfig$config, _cfg$identity, _cfg$branding, _cfg$typography, _cfg$messages, _cfg$voice, _cfg$onboarding, _cfg$disclaimer, _cfg$csat, _cfg$inactivity, _cfg$behavior, _cfg$security, _cfg$layout, _ref2, _messages$bundles$loc, _messages$bundles, _messages$bundles$en, _messages$bundles2, _ref3, _ref4, _ref5, _ref6, _branding$chatbotAvat, _branding$chatbotAvat2, _ref7, _ref8, _ref9, _ref0, _ref1, _ref10, _ref11, _ref12, _typography$headerTex, _ref13, _ref14, _ref15, _ref16, _ref17, _ref18, _inactivity$timeoutVa, _inactivity$timeoutUn, _ref19, _ref20, _ref21, _ref22, _ref23, _ref24, _ref25, _ref26, _csat$enabled, _csat$format, _csat$prompt, _csat$triggerType, _csat$idleTimeoutMins, _csat$followUpEnabled, _csat$followUpPrompt, _behavior$autoPromptE, _behavior$allowFeedba, _behavior$provideCita, _agentConfig$organiza;
       if (!agentConfig) {
         return null;
       }
@@ -100664,7 +100786,6 @@
         fontFamily: (_ref1 = fontFamily !== null && fontFamily !== void 0 ? fontFamily : typography.agentMessageBubbleFontFamily) !== null && _ref1 !== void 0 ? _ref1 : "Inter",
         fontSize: (_ref10 = fontSize !== null && fontSize !== void 0 ? fontSize : typography.agentMessageBubbleFontSize) !== null && _ref10 !== void 0 ? _ref10 : "14px",
         defaultLanguage: locale,
-        organizationId: orgId,
         headerTextBold: (_ref11 = headerTextBold !== null && headerTextBold !== void 0 ? headerTextBold : typography.headerTextBold) !== null && _ref11 !== void 0 ? _ref11 : false,
         headerTextItalic: (_ref12 = headerTextItalic !== null && headerTextItalic !== void 0 ? headerTextItalic : typography.headerTextItalic) !== null && _ref12 !== void 0 ? _ref12 : false,
         headerTextColor: (_typography$headerTex = typography.headerTextColor) !== null && _typography$headerTex !== void 0 ? _typography$headerTex : "#FFFFFF",
@@ -100701,9 +100822,12 @@
         // every message and tell the backend to skip citation generation.
         // Defaults to true so agents that haven't set the field keep showing
         // citations (matches the testing-lab / chatbot-preview default).
-        provideCitations: (_behavior$provideCita = behavior.provideCitations) !== null && _behavior$provideCita !== void 0 ? _behavior$provideCita : true
+        provideCitations: (_behavior$provideCita = behavior.provideCitations) !== null && _behavior$provideCita !== void 0 ? _behavior$provideCita : true,
+        // organizationId from the backend response — used internally for
+        // session isolation (localStorage keys) and WS paths. Not a user prop.
+        organizationId: (_agentConfig$organiza = agentConfig.organizationId) !== null && _agentConfig$organiza !== void 0 ? _agentConfig$organiza : null
       };
-    }, [agentConfig, darkMode, primaryColor, position, companyName, conciergeName, companyLogo, welcomeMessage, quickQuestions, quickQuestionsEnabled, textColor, agentMessageBubbleColor, userMessageBoxColor, assistantTextColor, userTextColor, fontFamily, fontSize, defaultLanguage, orgId, headerTextBold, headerTextItalic, enableVoiceInteraction, disclaimerEnabled, disclaimerText, disclaimerPosition, disclaimerLinkLabel, disclaimerLinkUrl, showPoweredBy, onboardingQuestions, onboardingEnabled, collectionPrompt, allowedDomains, agentMessageBubbleFontFamily, agentMessageBubbleFontSize, userMessageBubbleFontFamily, userMessageBubbleFontSize
+    }, [agentConfig, darkMode, primaryColor, position, companyName, conciergeName, companyLogo, welcomeMessage, quickQuestions, quickQuestionsEnabled, textColor, agentMessageBubbleColor, userMessageBoxColor, assistantTextColor, userTextColor, fontFamily, fontSize, defaultLanguage, headerTextBold, headerTextItalic, enableVoiceInteraction, disclaimerEnabled, disclaimerText, disclaimerPosition, disclaimerLinkLabel, disclaimerLinkUrl, showPoweredBy, onboardingQuestions, onboardingEnabled, collectionPrompt, allowedDomains, agentMessageBubbleFontFamily, agentMessageBubbleFontSize, userMessageBubbleFontFamily, userMessageBubbleFontSize
     // CSAT dependencies
     // (kept minimal because these come from agentConfig)
     ]);
@@ -100722,7 +100846,7 @@
       quickQuestions: [],
       apiBaseUrl: apiBaseUrl || "",
       apiKey: apiKey || "",
-      organizationId: orgId || "",
+      getAuthToken,
       autoOpen: false,
       openDelay: 0,
       darkMode: false,
@@ -100730,7 +100854,7 @@
       onboardingQuestions: [],
       onboardingEnabled: false,
       collectionPrompt: undefined
-    }), [apiBaseUrl, apiKey, orgId]);
+    }), [apiBaseUrl, apiKey, getAuthToken]);
 
     // ALWAYS call hooks before any early returns (Rules of Hooks)
     const {
@@ -100772,13 +100896,10 @@
       welcomeMessage: widgetConfig.welcomeMessage,
       quickQuestions: widgetConfig.quickQuestions,
       apiBaseUrl,
-      // Voice WS endpoint is derived entirely from apiBaseUrl inside
-      // useChatState (→ wss://{host}/voice/ws, the frontend voice proxy).
-      // Nothing is forwarded/overridable here, so a stale backend or embed
-      // wsBaseUrl can't point voice at the old (now non-public)
-      // knowledge-api LoadBalancer.
+      wsBaseUrl,
       apiKey,
       organizationId: widgetConfig.organizationId,
+      getAuthToken,
       autoOpen,
       openDelay,
       darkMode: widgetConfig.darkMode,
@@ -100805,24 +100926,33 @@
       // navigation (but not a page refresh — feedback is not written to
       // localStorage so it resets on reload as intended).
       updateMessageFeedback(messageContent, feedback);
-      if (!orgId || !conversationId || !apiBaseUrl) return;
+      if (!conversationId || !apiBaseUrl) return;
       const base = apiBaseUrl.replace(/\/$/, "");
-      fetch("".concat(base, "/api/v1/support/feedback"), {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "x-eshal-org": orgId
-        },
-        credentials: "include",
-        body: JSON.stringify({
-          messageContent,
-          conversationId,
-          organizationId: orgId,
-          feedback,
-          feedbackText
-        })
-      }).catch(err => console.error("Feedback submission error:", err));
-    }, [orgId, conversationId, apiBaseUrl, updateMessageFeedback]);
+      (async () => {
+        try {
+          const feedbackHeaders = {
+            "Content-Type": "application/json"
+          };
+          if (typeof getAuthToken === 'function') {
+            const token = await getAuthToken();
+            if (token) feedbackHeaders['Authorization'] = "Bearer ".concat(token);
+          }
+          await fetch("".concat(base, "/api/v1/support/feedback"), {
+            method: "POST",
+            headers: feedbackHeaders,
+            credentials: "include",
+            body: JSON.stringify({
+              messageContent,
+              conversationId,
+              feedback,
+              feedbackText
+            })
+          });
+        } catch (err) {
+          console.error("Feedback submission error:", err);
+        }
+      })();
+    }, [conversationId, apiBaseUrl, getAuthToken, updateMessageFeedback]);
 
     // Refresh chat handler — reset conversation
     const handleRefreshChat = reactExports.useCallback(() => {
@@ -100838,7 +100968,7 @@
     const {
       categories: filterCategories,
       hasFilters: showFilterStep
-    } = useFilterCatalog(apiBaseUrl, orgId);
+    } = useFilterCatalog(apiBaseUrl, getAuthToken);
 
     // Copy chat handler — copy all messages to clipboard
     const handleCopyChat = reactExports.useCallback(() => {
@@ -100943,7 +101073,7 @@
           showPoweredBy: widgetConfig.showPoweredBy,
           apiBaseUrl: apiBaseUrl,
           apiKey: apiKey,
-          organizationId: widgetConfig.organizationId,
+          getAuthToken: getAuthToken,
           conversationId: conversationId,
           conciergeId: (_agentConfig$concierg = agentConfig === null || agentConfig === void 0 ? void 0 : agentConfig.conciergeId) !== null && _agentConfig$concierg !== void 0 ? _agentConfig$concierg : agentConfig === null || agentConfig === void 0 ? void 0 : agentConfig.id,
           onboardingQuestions: widgetConfig.onboardingQuestions,
@@ -101091,11 +101221,10 @@
         }
 
         // Render component
-        // If orgId and apiBaseUrl are provided, use dynamic config
-        // Otherwise, use the old static config approach for backward compatibility
-        const widgetProps = config.orgId && config.apiBaseUrl ? _objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2({
-          // Required props
-          orgId: config.orgId,
+        // Mode B proxy: apiBaseUrl alone is enough — no key or orgId in browser
+        // In-app JWT: getAuthToken fn passed via config
+        const hasNewAuth = config.apiBaseUrl;
+        const widgetProps = hasNewAuth ? _objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2(_objectSpread2({
           apiBaseUrl: config.apiBaseUrl
         }, options.wsBaseUrl !== undefined && {
           wsBaseUrl: config.wsBaseUrl