@returningai/widget-sdk 1.4.2 → 1.5.0

package/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.5.0] — 2026-06-03
+
+### Added
+
+- Store and custom-store widgets can now register a host callback named
+  `callbackFieldOptions` to populate callback-backed purchase fields from the
+  customer's backend.
+- Added per-widget callback registration APIs:
+  `widget.registerCallback(callbackName, callback)` and
+  `widget.lockCallbacks()`. Register callbacks on the specific widget element
+  so pages with multiple widgets can route each widget to its own handler.
+- Added TypeScript exports for the store callback payload and result types,
+  including `StoreCallbackFieldOptionsPayload`,
+  `StoreCallbackFieldOptionsResult`, and
+  `ReturningAIStoreCallbackFieldOptionsCallback`.
+
+### Changed
+
+- Store callback examples now call the customer's backend from the browser
+  callback and expect the backend to return `{ fieldOptions, signature }`.
+  Keep SDK access credentials on the backend; do not call ReturningAI's
+  callback-signature endpoint from browser code.
+- Callback registration now supports both iframe mode and bundle mode.
+
+---
+
 ## [Security Notice — 2026-05-11] Refresh-token TTL change for Access Key Embed
 
 **This is a server-side change. No SDK code update is required. Customers do
@@ -51,13 +77,13 @@ session — not survive for up to a week in the user's browser.
 
 ### Visible behavior changes
 
-| Scenario | Before | After |
-|---|---|---|
-| First load with `embed-token` (valid claims) | 200, stores 7-day refresh token | 200, stores already-expired refresh token |
-| Subsequent loads with `embed-token` still present | Used cached refresh token via `/auth/refresh` | Re-validates via `/auth/serverless` every load |
-| Subsequent loads after `embed-token` is removed/changed | Continued working for up to 7 days (gap) | Re-auth required; fails closed if no identity is present |
-| Public Embed loads (`data-email` only) | Unchanged | Unchanged |
-| Users mid-session (in-memory access token) | Unchanged | Unchanged until access token expires (~5 min) |
+| Scenario                                                | Before                                        | After                                                    |
+| ------------------------------------------------------- | --------------------------------------------- | -------------------------------------------------------- |
+| First load with `embed-token` (valid claims)            | 200, stores 7-day refresh token               | 200, stores already-expired refresh token                |
+| Subsequent loads with `embed-token` still present       | Used cached refresh token via `/auth/refresh` | Re-validates via `/auth/serverless` every load           |
+| Subsequent loads after `embed-token` is removed/changed | Continued working for up to 7 days (gap)      | Re-auth required; fails closed if no identity is present |
+| Public Embed loads (`data-email` only)                  | Unchanged                                     | Unchanged                                                |
+| Users mid-session (in-memory access token)              | Unchanged                                     | Unchanged until access token expires (~5 min)            |
 
 ### Action required
 
@@ -77,9 +103,59 @@ re-auth on every load is transparent.
 
 ---
 
+## [1.4.2] — 2026-05-20
+
+### Added
+
+- `attributeChangedCallback` on custom elements watches `embed-token` /
+  `data-embed-token` and reloads the widget when the token changes at
+  runtime (e.g. SPA re-renders a fresh token without a full page reload).
+- User-identifier `data-*` attributes (e.g. `data-email`, `data-user-id`)
+  are now watched via `MutationObserver`. When any identifier value changes,
+  stored auth is cleared and the widget re-authenticates.
+
+### Fixed
+
+- Embed-token reload lifecycle: in-flight auth/mount work is cancelled when
+  identity changes mid-init, preventing stale sessions from mounting after a
+  token swap.
+- Widget teardown on reload/disconnect now removes iframes, bundle mount
+  nodes, postMessage listeners, and sync timers — fixes duplicate widgets
+  and leaked listeners after repeated reloads.
+- Error UI is cleared before relaunching after a successful re-auth.
+
+---
+
+## [1.4.1] — 2026-05-19
+
+### Added
+
+- Identity signature tracking: the SDK detects when `embed-token` or
+  `data-*` user identifiers change and triggers a full reload with cleared
+  storage.
+- `/auth/refresh` requests now include the current `embedToken` and
+  `userIdentifiers` so the server can validate the refresh against the
+  active identity proof.
+
+### Changed
+
+- Auth storage keys are scoped per mount container
+  (`{prefix}-{widgetId}-{container}-auth`). Legacy keys are read once and
+  migrated automatically.
+- `reload()` re-reads config, clears storage for both old and new identity,
+  and resets widget dimensions before re-init.
+
+### Fixed
+
+- Refresh failures (HTTP 400/401/403) fall back to `/auth/serverless`
+  re-auth instead of leaving the widget in a stuck authenticated state.
+
+---
+
 ## [1.4.0] — 2026-05-02
 
 ### Added
+
 - Bundled lottie-web (light build) loader instead of runtime CDN fetch.
   Eliminates dependency on `cdnjs.cloudflare.com` at runtime — works
   offline and behind corporate proxies.
@@ -89,6 +165,7 @@ re-auth on every load is transparent.
   selection in tests and external CSS.
 
 ### Changed
+
 - Environment URLs (`api-url`, `widget-url`, `domain-key`, `v2-api-url`)
   are now optional. The SDK resolves them from `domain-key` when present
   and defaults to production otherwise. Existing embeds that explicitly