@qualified-salesforce/web 0.0.1-oidc-bootstrap → 0.1.0

package/widget/multimodal_v2/utils/signals.js

@@ -1,7 +1,10 @@
+import { __webpack_require__ } from "../../../js/runtime.js";
 import { signals_core_module_d, signals_core_module_w } from "../../../js/multimodal_v2.js";
 import { getCache } from "./multimodal_cache.js";
 import { ObjectsMap } from "./objects_map.js";
+import "../../utils/native_globals.js";
 
+/* provided dependency */ var signals_setTimeout = __webpack_require__(68034).pS;
 
 
 
@@ -45,6 +48,31 @@ function $attr(signal, key) {
         return (_ref = (_signal_value = signal.value) == null ? void 0 : _signal_value[key]) != null ? _ref : null;
     });
 }
+/**
+ * Backoff between extra attempts at a failed dynamic import.
+ *
+ * Small on purpose. A chunk whose hash was rotated away by a deploy 404s on
+ * every attempt, so only a transient fetch benefits and a longer budget just
+ * holds the caller — an overlay waiting to open — for no gain.
+ */ const IMPORT_RETRY_DELAYS_MS = [
+    250,
+    1000
+];
+/**
+ * Runs a dynamic import, retrying a failure on the backoff above.
+ *
+ * Exported for chunks loaded outside a `$fromImport` store. Wrap the import
+ * itself, not work that follows it: a retry re-runs whatever it is given, and
+ * only the fetch is worth a second attempt.
+ */ const importWithRetry = (importFn, attempt)=>{
+    if (attempt === void 0) attempt = 0;
+    return importFn().catch((error)=>{
+        if (attempt >= IMPORT_RETRY_DELAYS_MS.length) throw error;
+        return new Promise((resolve, reject)=>{
+            signals_setTimeout(()=>importWithRetry(importFn, attempt + 1).then(resolve, reject), IMPORT_RETRY_DELAYS_MS[attempt]);
+        });
+    });
+};
 function $fromImport(importFn) {
     for(var _len = arguments.length, args = new Array(_len > 1 ? _len - 1 : 0), _key = 1; _key < _len; _key++){
         args[_key - 1] = arguments[_key];
@@ -60,12 +88,15 @@ function $fromImport(importFn) {
         if (loadPromise) {
             return loadPromise;
         }
-        // Start loading
-        loadPromise = importFn().then((module)=>{
-            // Use default export
+        loadPromise = importWithRetry(importFn).then((module)=>{
             const Class = module.default;
             sig.value = new Class(...args);
             return sig.value;
+        }) // Clear on failure so a later caller starts over instead of re-awaiting
+        // this rejection for the rest of the session.
+        .catch((error)=>{
+            loadPromise = null;
+            throw error;
         });
         return loadPromise;
     };
@@ -94,4 +125,4 @@ var signals_$all = /* unused export */ undefined;
 var signals_$attr = /* unused export */ undefined;
 var signals_$empty = /* unused export */ undefined;
 var signals_$present = /* unused export */ undefined;
-export { $any, $exists, $fromImport, $not, isSignalike, signals_$absent as $absent, signals_$all as $all, signals_$attr as $attr, signals_$empty as $empty, signals_$present as $present };
+export { $any, $exists, $fromImport, $not, importWithRetry, isSignalike, signals_$absent as $absent, signals_$all as $all, signals_$attr as $attr, signals_$empty as $empty, signals_$present as $present };

package/widget/pardot_visitor.js

@@ -1,6 +1,7 @@
 import { __webpack_require__ } from "../js/runtime.js";
 import { api } from "../js/4101.js";
 import { delay as timing_delay } from "../src/timing.js";
+import { isCapabilityAllowed } from "./capabilities.js";
 import "./telemetry/index.js";
 import "./utils/native_globals.js";
 import { telemetry, getTelemetryCtx } from "./telemetry/telemetry.js";
@@ -9,6 +10,7 @@ import { telemetry, getTelemetryCtx } from "./telemetry/telemetry.js";
 
 
 
+
 class PardotVisitor {
     async getIdentities() {
         const identities = {};
@@ -87,7 +89,11 @@ class PardotVisitor {
     }
     getProspectEmail() {
         const { trackerDomain, accountId, dynamicContentId } = this.config;
-        if (!dynamicContentId) {
+        // QAI-5864: never inject the third-party Pardot `dc.js` script when the consumer hasn't
+        // allowed the "pardot" capability. This is the one "must never load" third-party resource
+        // from the GitHub security review (finding 1). Allow-all for the hosted widget (no boundary
+        // installed); default-deny once an npm consumer enrols an allowlist via setup().
+        if (!isCapabilityAllowed("pardot") || !dynamicContentId) {
             const promise = Promise.reject();
             promise.cancel = ()=>{};
             return promise;

package/widget/server-logger.js

@@ -1,15 +1,22 @@
 import { __webpack_require__ } from "../js/runtime.js";
 import { _class_private_field_loose_base, _class_private_field_loose_key, _extends } from "../js/4101.js";
 import { getSentryClient } from "./widget/sentry.js";
+import "./utils/native_globals.js";
 
 const isNil = __webpack_require__("11655");
 var isNil_default = /*#__PURE__*/__webpack_require__.n(isNil);
+/* provided dependency */ var server_logger_setTimeout = __webpack_require__(68034).pS;
+/* provided dependency */ var server_logger_clearTimeout = __webpack_require__(68034).Kj;
+/* provided dependency */ var __nativeWindowAddEventListener = __webpack_require__(68034).zh;
+/* provided dependency */ var __nativeDocumentAddEventListener = __webpack_require__(68034).Qj;
 
 
 
 
 
-var _config = /*#__PURE__*/ _class_private_field_loose_key("_config"), _widgetId = /*#__PURE__*/ _class_private_field_loose_key("_widgetId"), _visitorId = /*#__PURE__*/ _class_private_field_loose_key("_visitorId");
+const VISITOR_EVENTS_BATCH_SIZE_LIMIT = 20;
+const VISITOR_EVENTS_BATCH_FLUSH_INTERVAL_MS = 3000;
+var _config = /*#__PURE__*/ _class_private_field_loose_key("_config"), _widgetId = /*#__PURE__*/ _class_private_field_loose_key("_widgetId"), _visitorId = /*#__PURE__*/ _class_private_field_loose_key("_visitorId"), _batchQueue = /*#__PURE__*/ _class_private_field_loose_key("_batchQueue"), _flushTimerId = /*#__PURE__*/ _class_private_field_loose_key("_flushTimerId");
 class ServerLogger {
     /**
    * Updates the widget configuration.
@@ -66,9 +73,19 @@ class ServerLogger {
    * serverLog({ message: "Page closing", fireAndForget: true });
    */ serverLog(param) {
         let { type = "log", message: event, extra = {}, fireAndForget = false } = param;
+        var _class_private_field_loose_base__config_featureFlags;
         if (!_class_private_field_loose_base(this, _config)[_config].host || !_class_private_field_loose_base(this, _config)[_config].token) {
             return;
         }
+        if ((_class_private_field_loose_base__config_featureFlags = _class_private_field_loose_base(this, _config)[_config].featureFlags) == null ? void 0 : _class_private_field_loose_base__config_featureFlags.widgetVisitorEventsBatching) {
+            this.enqueueEvent({
+                event,
+                type,
+                extra,
+                fireAndForget
+            });
+            return;
+        }
         this.sendEvent("visitor_events", {
             params: {
                 wu: _class_private_field_loose_base(this, _widgetId)[_widgetId],
@@ -99,6 +116,54 @@ class ServerLogger {
             })
         });
     }
+    enqueueEvent(item) {
+        _class_private_field_loose_base(this, _batchQueue)[_batchQueue].push(item);
+        if (_class_private_field_loose_base(this, _batchQueue)[_batchQueue].length >= VISITOR_EVENTS_BATCH_SIZE_LIMIT) {
+            this.flushBatch();
+            return;
+        }
+        this.scheduleFlush();
+    }
+    scheduleFlush() {
+        if (_class_private_field_loose_base(this, _flushTimerId)[_flushTimerId] !== null) {
+            return;
+        }
+        _class_private_field_loose_base(this, _flushTimerId)[_flushTimerId] = server_logger_setTimeout(()=>this.flushBatch(), VISITOR_EVENTS_BATCH_FLUSH_INTERVAL_MS);
+    }
+    flushBatch(param) {
+        let { fireAndForget = false } = param === void 0 ? {} : param;
+        if (_class_private_field_loose_base(this, _flushTimerId)[_flushTimerId] !== null) {
+            server_logger_clearTimeout(_class_private_field_loose_base(this, _flushTimerId)[_flushTimerId]);
+            _class_private_field_loose_base(this, _flushTimerId)[_flushTimerId] = null;
+        }
+        if (_class_private_field_loose_base(this, _batchQueue)[_batchQueue].length === 0) {
+            return;
+        }
+        const events = _class_private_field_loose_base(this, _batchQueue)[_batchQueue];
+        _class_private_field_loose_base(this, _batchQueue)[_batchQueue] = [];
+        // A batch is one request: if any queued event asked to be fire-and-forgotten
+        // (e.g. an abandonment logged on its own pagehide listener), the whole flush
+        // is, since we can't selectively suppress errors for part of one response.
+        const shouldFireAndForget = fireAndForget || events.some((event)=>event.fireAndForget);
+        this.sendEvent("visitor_events/batch", {
+            params: {
+                wu: _class_private_field_loose_base(this, _widgetId)[_widgetId],
+                uuid: _class_private_field_loose_base(this, _visitorId)[_visitorId]
+            },
+            body: {
+                events: events.map((param)=>{
+                    let { event, type, extra } = param;
+                    return {
+                        event,
+                        type,
+                        extra
+                    };
+                })
+            }
+        }, {
+            fireAndForget: shouldFireAndForget
+        });
+    }
     async sendEvent(path, param, param1) {
         let { params, body } = param;
         let { fireAndForget = false } = param1 === void 0 ? {} : param1;
@@ -145,12 +210,42 @@ class ServerLogger {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, _batchQueue, {
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, _flushTimerId, {
+            writable: true,
+            value: void 0
+        });
+        _class_private_field_loose_base(this, _batchQueue)[_batchQueue] = [];
+        _class_private_field_loose_base(this, _flushTimerId)[_flushTimerId] = null;
+        this.handlePagehide = ()=>{
+            this.flushBatch({
+                fireAndForget: true
+            });
+        };
+        this.handleVisibilityChange = ()=>{
+            if (typeof document !== "undefined" && document.visibilityState === "hidden") {
+                this.flushBatch({
+                    fireAndForget: true
+                });
+            }
+        };
         _class_private_field_loose_base(this, _config)[_config] = config;
         _class_private_field_loose_base(this, _widgetId)[_widgetId] = undefined;
         _class_private_field_loose_base(this, _visitorId)[_visitorId] = undefined;
+        if (typeof window !== "undefined") {
+            __nativeWindowAddEventListener("pagehide", this.handlePagehide);
+        }
+        if (typeof document !== "undefined") {
+            __nativeDocumentAddEventListener("visibilitychange", this.handleVisibilityChange);
+        }
     }
 }
 const serverLogger = new ServerLogger({});
 
 var server_logger_ServerLogger = /* unused export */ undefined;
-export { serverLogger, server_logger_ServerLogger as ServerLogger };
+var server_logger_VISITOR_EVENTS_BATCH_FLUSH_INTERVAL_MS = /* unused export */ undefined;
+var server_logger_VISITOR_EVENTS_BATCH_SIZE_LIMIT = /* unused export */ undefined;
+export { serverLogger, server_logger_ServerLogger as ServerLogger, server_logger_VISITOR_EVENTS_BATCH_FLUSH_INTERVAL_MS as VISITOR_EVENTS_BATCH_FLUSH_INTERVAL_MS, server_logger_VISITOR_EVENTS_BATCH_SIZE_LIMIT as VISITOR_EVENTS_BATCH_SIZE_LIMIT };

package/widget/tracker.js

@@ -7,6 +7,7 @@ import { BUTTON_LIKE_SELECTOR, isWithinQualifiedElement } from "../src/smart_web
 import { fromBase64 } from "../src/string.js";
 import { every, after } from "../src/timing.js";
 import { default as WidgetObject } from "./widget_object.js";
+import { isCapabilityAllowed } from "./capabilities.js";
 import { captureWidgetExceptions } from "./capture_widget_exceptions.js";
 import { isSafariUserAgent } from "./constants.js";
 import { default as data360_visitor } from "./data360_visitor.js";
@@ -53,6 +54,7 @@ var throttle_default = /*#__PURE__*/__webpack_require__.n(throttle);
 
 
 
+
 
 
 const events = [
@@ -111,7 +113,12 @@ class Tracker extends WidgetObject {
         if (this.isDisposed) {
             return;
         }
-        if (this.config.hasMarketo) {
+        // QAI-5896: marketing-automation visitor-identity capture (Marketo/HubSpot/Data360/Eloqua)
+        // reads a local marketing cookie/global and forwards the token to Qualified. The `has*` flags
+        // are stripped by `filterRuntimeConfig` when `marketingIdentity` is denied; this `isCapability
+        // Allowed` guard is the client-side backstop, so the capture never runs even if a flag reaches
+        // the widget by an unfiltered path. Allow-all for the hosted widget (no boundary installed).
+        if (this.config.hasMarketo && isCapabilityAllowed("marketingIdentity")) {
             await telemetry.startActiveSpanAsync("Init marketo", {}, this.telemetryCtx, async (span)=>{
                 const marketoToken = await new marketo_visitor().getToken();
                 if (marketoToken !== undefined) {
@@ -127,7 +134,7 @@ class Tracker extends WidgetObject {
         if (this.isDisposed) {
             return;
         }
-        if (this.config.hasHubSpot) {
+        if (this.config.hasHubSpot && isCapabilityAllowed("marketingIdentity")) {
             await telemetry.startActiveSpanAsync("Init hubspot", {}, this.telemetryCtx, async (span)=>{
                 const hubspotToken = await new hubspot_visitor().getToken(this.widget.config.hubspotTokenRetrievalTimeout);
                 if (hubspotToken !== undefined) {
@@ -143,7 +150,7 @@ class Tracker extends WidgetObject {
         if (this.isDisposed) {
             return;
         }
-        if (this.config.hasData360) {
+        if (this.config.hasData360 && isCapabilityAllowed("marketingIdentity")) {
             await telemetry.startActiveSpanAsync("Init data360", {}, this.telemetryCtx, async (span)=>{
                 const deviceId = await new data360_visitor().getDeviceId();
                 if (deviceId !== undefined) {
@@ -159,7 +166,7 @@ class Tracker extends WidgetObject {
         if (this.isDisposed) {
             return;
         }
-        if (this.config.hasEloqua) {
+        if (this.config.hasEloqua && isCapabilityAllowed("marketingIdentity")) {
             await telemetry.startActiveSpanAsync("Init eloqua", {}, this.telemetryCtx, async (span)=>{
                 const eloquaToken = new eloqua_visitor().getToken();
                 if (eloquaToken !== undefined) {
@@ -176,7 +183,12 @@ class Tracker extends WidgetObject {
             return;
         }
         if (this.visitor.smartFormData) {
-            if (this.config.hasSmartForms) {
+            // QAI-5896: the smart-form replay egresses captured form-field values, so it belongs behind
+            // formCapture too — a client backstop to the config-strip of `hasSmartForms`, for the case a
+            // flag reaches the widget by an unfiltered path. `clearSmartFormData()` still runs when denied
+            // so a stashed submit can't leak on a later navigation.
+            const formCaptureAllowed = isCapabilityAllowed("formCapture");
+            if (formCaptureAllowed && this.config.hasSmartForms) {
                 this.experienceAdapter.showLightboxLoading();
                 // Pre-offer SLI: a submit saved by `saveSmartFormData` before this page
                 // context existed, replayed at init. Unlike the api_handler path this IS
@@ -192,12 +204,14 @@ class Tracker extends WidgetObject {
                     armFormCtaBookerIntent("form:smart_form", this.visitor.smartFormData.botApiName);
                 }
             }
-            this.setInitializationParams({
-                smart_form: {
-                    field_values: this.visitor.smartFormData.fieldValues,
-                    bot_api_name: this.visitor.smartFormData.botApiName
-                }
-            });
+            if (formCaptureAllowed) {
+                this.setInitializationParams({
+                    smart_form: {
+                        field_values: this.visitor.smartFormData.fieldValues,
+                        bot_api_name: this.visitor.smartFormData.botApiName
+                    }
+                });
+            }
             this.visitor.clearSmartFormData();
         }
         if (!this.widget.isMeetingLink) {
@@ -534,11 +548,22 @@ class Tracker extends WidgetObject {
             if (!this.config.hasSmartForms) return;
             const validBotApiName = botApiName || ((_this_widget_visitor_smartFormData = this.widget.visitor.smartFormData) == null ? void 0 : _this_widget_visitor_smartFormData.botApiName);
             const validFieldValues = ((_this_widget_visitor_formData = this.widget.visitor.formData) == null ? void 0 : _this_widget_visitor_formData.fieldValues) || ((_this_widget_visitor_smartFormData1 = this.widget.visitor.smartFormData) == null ? void 0 : _this_widget_visitor_smartFormData1.fieldValues);
+            // Minted and registered here, immediately before the request that carries it,
+            // so every registered id is guaranteed to actually round-trip (CORE-3488).
+            // Registering any earlier (e.g. at the caller's showLightboxLoading site)
+            // would leak the id if this method bails out above on `!hasSmartForms`.
+            const formTransactionId = esm_browser_v4();
+            try {
+                this.widget.iframeManager.registerLoadingRequest(formTransactionId);
+            } catch (unused) {
+            // V2 path: IframeManager not registered, safe to ignore
+            }
             this.channel.perform("show_form_experience", {
                 bot_api_name: validBotApiName,
                 field_values: validFieldValues,
                 form_data: this.widget.visitor.formData,
-                form_destinations: formDestinations
+                form_destinations: formDestinations,
+                form_transaction_id: formTransactionId
             });
             this.widget.visitor.clearSmartFormData();
             this.widget.visitor.clearFormData();
@@ -585,6 +610,15 @@ class Tracker extends WidgetObject {
                     armFormCtaBookerIntent("form:" + formType);
                 }
                 this.experienceAdapter.showLightboxLoading();
+                // Minted and registered here, immediately before the request that carries
+                // it, so every registered id is guaranteed to actually round-trip
+                // (CORE-3488).
+                const formTransactionId = esm_browser_v4();
+                try {
+                    this.widget.iframeManager.registerLoadingRequest(formTransactionId);
+                } catch (unused) {
+                // V2 path: IframeManager not registered, safe to ignore
+                }
                 this.channel.perform("show_experience_for_form", {
                     form_type: formType,
                     form_data: {
@@ -592,7 +626,8 @@ class Tracker extends WidgetObject {
                         form_id: formData.formId,
                         form_email: formData.formEmail,
                         form_action_url: (_formData_formActionUrl1 = formData.formActionUrl) == null ? void 0 : _formData_formActionUrl1.replace(/^https?:\/\//, "")
-                    }
+                    },
+                    form_transaction_id: formTransactionId
                 });
             }
             this.widget.debugState.logEvent("tracker:showExperienceForForm", "success", {});
@@ -640,7 +675,6 @@ class Tracker extends WidgetObject {
             });
         }, // TODO: remove once meeting link has its own pack
         this.recordMeetingLinkLoad = (token)=>{
-            if (token === void 0) token = undefined;
             const data = Object.assign({}, this.initializationParams, {
                 wu: this.widget.widgetId,
                 url: document.location.href,
@@ -779,14 +813,28 @@ class Tracker extends WidgetObject {
             this.visitor.setQualifiedRedirect(true);
             this.isBotRedirecting = true;
         }, // @ts-expect-error property decorator typing
-        this.onEndLoadingState = ()=>{
-            var // Clear any active loading overlay in the v2 adapter path.
-            // In v1, the iframe handles this via postMessage; v2 needs an explicit signal write.
-            // Guard: experienceAdapter may not be initialized yet if the channel fires before Widget.init() completes.
-            _this_experienceAdapter;
-            (_this_experienceAdapter = this.experienceAdapter) == null ? void 0 : _this_experienceAdapter.closeLightbox();
+        this.onEndLoadingState = (payload)=>{
+            // Withhold the overlay teardown -- but not the fallback dispatch below -- when
+            // this answers for one outstanding request while another is still waiting
+            // (CORE-3488). Only the v1 iframe path tracks outstanding ids; v2 has nothing
+            // to withhold against, so it always tears down.
+            let shouldTeardown = true;
+            try {
+                shouldTeardown = this.widget.iframeManager.releaseLoadingRequest(payload == null ? void 0 : payload.formTransactionId);
+            } catch (unused) {
+            // V2 path: IframeManager not registered, safe to ignore
+            }
+            if (shouldTeardown) {
+                var // Clear any active loading overlay in the v2 adapter path.
+                // In v1, the iframe handles this via postMessage; v2 needs an explicit signal write.
+                // Guard: experienceAdapter may not be initialized yet if the channel fires before Widget.init() completes.
+                _this_experienceAdapter;
+                (_this_experienceAdapter = this.experienceAdapter) == null ? void 0 : _this_experienceAdapter.closeLightbox();
+            }
             // This fallback is called if we should trigger the default behavior of the last button click
-            // i.e if the button click was hijacked but the visitor was disqualified
+            // i.e if the button click was hijacked but the visitor was disqualified. Not gated on
+            // shouldTeardown: it answers a different question (was this click's own bot a dead end?)
+            // than the outstanding-request gate above (is some OTHER request still waiting?).
             this.lastButtonTriggerEvent && this.dispatchFallbackEvent(this.lastButtonTriggerEvent);
         }, this.getRedirectCount = ()=>{
             var _performance_getEntriesByType;

package/widget/widget/page_mirror_factory.js

@@ -1,11 +1,19 @@
+import { isCapabilityAllowed } from "../capabilities.js";
 import { default as PageMirror } from "../page_mirror.js";
 import { default as WidgetObject } from "../widget_object.js";
 
 
 
+
 class PageMirrorFactory extends WidgetObject {
     create() {
-        if (!this.widget.config.isComplete || this.widget.config.disableLiveView) {
+        // QAI-5864: skip DOM serialization/mirroring unless the consumer allowed the "liveView"
+        // capability. Live View has no positive config enabler (it is on unless `disableLiveView` is
+        // set) and its stream arrives on a separate cable subscription that bypasses the message,
+        // command, and config enforcement points — so this client-side guard is the only thing that
+        // stops the mirror for an enrolled npm consumer. Allow-all for the hosted widget (no boundary
+        // installed); default-deny once an npm consumer enrols via setup().
+        if (!this.widget.config.isComplete || this.widget.config.disableLiveView || !isCapabilityAllowed("liveView")) {
             return this.container.resolve("emptyPageMirror");
         } else {
             return this.container.resolve("pageMirror", this.widget.config.denylistedVisitorStreamDomains || []);

package/widget/widget/widget.js

@@ -6,6 +6,7 @@ import { isDomainMatch, isIframed } from "../../src/iframes.js";
 import { delay as timing_delay } from "../../src/timing.js";
 import { normalizeURL, hasURLMatch } from "../../src/url-utils.js";
 import { default as ApiHandler } from "../api_handler/api_handler.js";
+import { isCapabilityAllowed } from "../capabilities.js";
 import { captureWidgetExceptions } from "../capture_widget_exceptions.js";
 import { default as channel } from "../channel.js";
 import { default as Container } from "../container.js";
@@ -91,6 +92,7 @@ var cloneDeep_default = /*#__PURE__*/__webpack_require__.n(cloneDeep);
 
 
 
+
 
 
 const LOOPBACK_HOSTS = new Set([
@@ -114,7 +116,10 @@ function isLoopbackHost(host) {
         return host.includes("localhost");
     }
 }
-class IframedFormExperienceAdapter {
+// Presentation layer for a surface that never shows the messenger: every verb is
+// a no-op and every counter is at rest. `MeetingLinkWidget` uses it; the base
+// `V1Adapter` would dereference a missing iframe manager on the first verb.
+class NoopExperienceAdapter {
     dispose() {}
     showLightboxLoading() {}
     showMessengerLoading() {}
@@ -348,6 +353,10 @@ class Widget extends Injectable(Disposable(Object)) {
         }
         this.config = _extends({}, this.config, config);
         this.config.requiresCookieConsent = this.config.hasCookieConsent !== undefined;
+        // The earlier setConfig() call (above, before this async gap) captured a config
+        // snapshot that predates this merge, so featureFlags (only present on the merged
+        // config, not the bootstrap-time envConfig) never reached serverLogger without this.
+        serverLogger.setConfig(this.config);
         if (this.isIframed && !this.bootstrapsWhenIframed()) {
             this.messengerUptime.dispose();
             const iframeApiHandler = this.apiHandler;
@@ -516,7 +525,10 @@ class Widget extends Injectable(Disposable(Object)) {
                     error
                 });
             }
-            if (this.tracker.config.hasWebsiteEmbeddedForms) {
+            // QAI-5864: registering the `<qualified-form>` embedded-form element wires its own submit
+            // listener that egresses via `channel.send` (bypassing the command-layer gate), so guard the
+            // registration on the "formCapture" capability too. Allow-all for the hosted widget.
+            if (isCapabilityAllowed("formCapture") && this.tracker.config.hasWebsiteEmbeddedForms) {
                 this.initQualifiedForms();
             }
             this.exposeDebugging();
@@ -802,7 +814,13 @@ class Widget extends Injectable(Disposable(Object)) {
     // TODO: remove once meeting link has its own pack
     get meetingLinkToken() {
         if (!this.isMeetingLink) return;
-        const pathParts = window.location.pathname.replace(/^\//, "").split("-");
+        // Strip trailing slashes as well as the leading one. Customer CMSes often
+        // emit the link as `https://schedule.qualified.com/mA7n1gd/`; Rails ignores
+        // the trailing slash when routing the page, but `pathname` keeps it, so the
+        // token sent with `record_meeting_link_load` became `mA7n1gd/`. The server
+        // cannot resolve that and broadcasts an empty conversation, leaving the
+        // visitor on the spinner until the watchdog fires (CORE-3725).
+        const pathParts = window.location.pathname.replace(/^\/+|\/+$/g, "").split("-");
         return pathParts[pathParts.length - 1];
     }
     get connectionParams() {
@@ -910,6 +928,12 @@ class Widget extends Injectable(Disposable(Object)) {
     }
     initFormExperience() {
         var _this_config_featureFlags;
+        // QAI-5864: don't arm the auto-armed third-party form listeners (Marketo / HubSpot) unless the
+        // consumer allowed the "formCapture" capability. These listeners are not driven by a public
+        // command verb, so the command-layer gate never sees them — only the `hasSmartForms` config key
+        // (which the runtime-config filter strips when denied) and this guard protect them. Allow-all
+        // for the hosted widget (no boundary installed); default-deny once an npm consumer enrols.
+        if (!isCapabilityAllowed("formCapture")) return;
         if (!this.tracker.config.hasSmartForms) {
             this.debugState.logEvent("widget:hasSmartForms", "error");
             return;
@@ -1694,5 +1718,6 @@ __decorate([
 ], Widget.prototype, "trackVisitedContentActivity", null);
 
 var widget_FormStorageKey = /* unused export */ undefined;
-export { widget_FormStorageKey as FormStorageKey };
+var widget_NoopExperienceAdapter = /* unused export */ undefined;
+export { widget_FormStorageKey as FormStorageKey, widget_NoopExperienceAdapter as NoopExperienceAdapter };
 export default Widget;