@helpai/elements 1.11.0 → 1.12.1

package/docs/analytics.md

@@ -28,8 +28,13 @@ internal event bus, and you subscribe as many listeners as you want.
 <!-- 2. Load the widget -->
 <script src="https://cdn.help.ai/sdk/js/elements/latest/elements.js" data-public-key="agent_pk_..." data-ai-agent-deployment-id="01900000-0000-7000-8000-000000000000" defer></script>
 
-<!-- 3. Subscribe to every widget event with one wildcard hook -->
+<!-- 3. Subscribe to every widget event with one wildcard hook. The stub queues the call until the deferred script runs. -->
 <script>
+  window.HelpAI =
+    window.HelpAI ||
+    function () {
+      (HelpAI.q = HelpAI.q || []).push(arguments);
+    };
   HelpAI('hook', 'default', '*', (chat, event, payload) => {
     gtag('event', `chat_${event}`, flatten(payload));
   });

package/docs/api-reference.md

@@ -478,8 +478,8 @@ The auto-boot parser exposes the documented flat `data-*` subset.
 
 Full attribute list: [Installation § script data attributes](./installation.md#attributes).
 
-`data-no-autoboot` — loads the bundle but doesn't auto-mount. For
-deferred init via JS.
+Leave out `data-ai-agent-deployment-id` to load the bundle without mounting, then call
+`HelpAI.init({ … })` from JavaScript ([Installation § Load without mounting](./installation.md#load-without-mounting)).
 
 ---
 

package/docs/events-and-hooks.md

@@ -22,7 +22,7 @@ Both deliver the same event stream. Both are safe to mix.
 | ----------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
 | `open`            | Panel opens (floating mode)                                                         | `void`                                                                                                                                     |
 | `close`           | Panel closes                                                                        | `void`                                                                                                                                     |
-| `message`         | User sends a message + assistant finishes a reply                                   | `{ role: "user" \| "assistant"; text: string }`                                                                                            |
+| `message`         | User sends a message, or a reply from the AI agent or a team member finishes        | `{ role: "user" \| "assistant" \| "operator"; text: string }`                                                                              |
 | `error`           | Transport error or mid-stream error                                                 | `unknown` (error object or message)                                                                                                        |
 | `expand`          | Expanded tier toggled (⤢)                                                           | `boolean` (new state)                                                                                                                      |
 | `fullscreen`      | Fullscreen tier toggled (⛶)                                                         | `boolean` (new state)                                                                                                                      |

package/docs/installation.md

@@ -100,13 +100,13 @@ Unknown attributes are ignored. Full option semantics:
 > one re-handshakes with the same anonymous visitor/conversation. This
 > context is informational for the AI, never an auth credential.
 
-### `data-no-autoboot`
+### Load without mounting
 
-Add this flag to load the bundle **without** automatically mounting.
-Useful when you want to `init()` later from JavaScript:
+The script tag mounts the widget only when it carries `data-ai-agent-deployment-id`. Leave that attribute out to
+load the bundle **without** mounting, then call `init()` from JavaScript when you're ready:
 
 ```html
-<script src="https://cdn.help.ai/sdk/js/elements/latest/elements.js" data-no-autoboot></script>
+<script src="https://cdn.help.ai/sdk/js/elements/latest/elements.js"></script>
 <script>
   // Mount later, conditionally
   document.addEventListener('DOMContentLoaded', () => {

package/docs/security-privacy.md

@@ -487,10 +487,13 @@ and anyone can base64url-decode it. Never put a secret in context.
 
 ### Key rotation
 
-- **public keys** — rotate from the dashboard. Old keys are deactivated
-  instantly; update your embeds.
-- **secret key** — user tokens signed with a replaced secret key stop verifying, so every verified user is signed out
-  until your server signs new ones with the new key.
+The dashboard has no key rotation today.
+
+- **public key** — public by design: it only names the deployment. Limit where it works with the deployment's
+  **Allowed websites**.
+- **secret key** — keep it on your server. If it leaks, create a new deployment (it gets new keys), move your embed
+  and your token signing to it, and delete the old one. User tokens signed with the old key stop verifying, so every
+  verified user is signed out until your server signs new ones.
 
 ---