@returningai/widget-sdk 1.8.13 → 1.8.14

package/dist/rai-widget.js

@@ -12275,7 +12275,12 @@ function legacyStorageKey(config) {
 function errorSettingsKey(config) {
   return `${config.storagePrefix}-${config.widgetId}-error-settings`;
 }
+const retiredStates = /* @__PURE__ */ new WeakSet();
+function retireWidgetState(state) {
+  retiredStates.add(state);
+}
 function saveToStorage(config, state) {
+  if (retiredStates.has(state)) return;
   try {
     const data = {
       refreshToken: state.refreshToken,
@@ -12311,7 +12316,8 @@ function loadFromStorage(config, state) {
     return false;
   }
 }
-function clearStorage(config) {
+function clearStorage(config, state) {
+  if (state && retiredStates.has(state)) return;
   try {
     localStorage.removeItem(storageKey(config));
     localStorage.removeItem(legacyStorageKey(config));
@@ -12446,6 +12452,363 @@ function createAuthRenewalRecoveryController(retry, environment = createDefaultE
     cancel: reset
   };
 }
+const STORE_CALLBACK_FIELD_OPTIONS_SCOPE = "store.callback_field_options";
+const STORE_CALLBACK_FIELD_OPTIONS_CALLBACK_NAME = "callbackFieldOptions";
+const STORE_CALLBACK_FIELD_OPTIONS_TIMEOUT_MS = 15e3;
+const STORE_PURCHASE_SUCCESS_SCOPE = "store.purchase_success";
+const STORE_PURCHASE_SUCCESS_CALLBACK_NAME = "storePurchaseSuccess";
+const MILESTONE_CTA_CLICK_SCOPE = "milestone.cta_click";
+const MILESTONE_CTA_CLICK_CALLBACK_NAME = "milestoneCtaClick";
+const MILESTONE_CTA_CLICK_EVENT = "milestone_cta_clicked";
+function isRecord$1(value) {
+  return typeof value === "object" && value !== null;
+}
+function isStringRecord$1(value) {
+  return isRecord$1(value) && Object.values(value).every((item) => typeof item === "string");
+}
+function readEmbedTokenClaims(embedToken) {
+  if (!embedToken) return null;
+  const encodedPayload = embedToken.split(".")[1];
+  if (!encodedPayload) return null;
+  try {
+    const normalizedPayload = encodedPayload.replace(/-/g, "+").replace(/_/g, "/");
+    const paddedPayload = normalizedPayload.padEnd(
+      Math.ceil(normalizedPayload.length / 4) * 4,
+      "="
+    );
+    const bytes = Uint8Array.from(atob(paddedPayload), (character) => character.charCodeAt(0));
+    const claims = JSON.parse(new TextDecoder().decode(bytes));
+    return isRecord$1(claims) ? claims : null;
+  } catch {
+    return null;
+  }
+}
+function readEmbedTokenUserIdentifiers(embedToken) {
+  const claims = readEmbedTokenClaims(embedToken);
+  if (!claims || !isStringRecord$1(claims.userIdentifiers)) return null;
+  return { ...claims.userIdentifiers };
+}
+function resolveHostUserIdentifiers(config) {
+  return readEmbedTokenUserIdentifiers(config.embedToken) ?? { ...config.userIdentifiers };
+}
+function hasCallbackContract(payload, callbackName, scope) {
+  return isRecord$1(payload) && payload.callbackName === callbackName && payload.scope === scope;
+}
+function isMilestoneCtaClickPayload(payload) {
+  if (!hasCallbackContract(
+    payload,
+    MILESTONE_CTA_CLICK_CALLBACK_NAME,
+    MILESTONE_CTA_CLICK_SCOPE
+  )) return false;
+  const context = payload.context;
+  if (!isRecord$1(context)) return false;
+  const community = context.community;
+  const milestone = context.milestone;
+  const stage = context.stage;
+  const button = context.button;
+  const user = context.user;
+  return context.event === MILESTONE_CTA_CLICK_EVENT && isRecord$1(community) && typeof community.id === "string" && community.id.length > 0 && (community.name === void 0 || community.name === null || typeof community.name === "string") && isRecord$1(milestone) && typeof milestone.id === "string" && milestone.id.length > 0 && typeof milestone.name === "string" && milestone.name.length > 0 && isRecord$1(stage) && typeof stage.id === "string" && stage.id.length > 0 && typeof stage.name === "string" && stage.name.length > 0 && isRecord$1(button) && typeof button.name === "string" && button.name.length > 0 && isRecord$1(user) && isStringRecord$1(user.identifiers) && typeof context.clickedAt === "string" && context.clickedAt.length > 0 && !Number.isNaN(Date.parse(context.clickedAt));
+}
+function enrichHostCallbackPayload(payload, userIdentifiers) {
+  if (!userIdentifiers || Object.keys(userIdentifiers).length === 0) return payload;
+  if (!isRecord$1(payload)) return payload;
+  const context = payload.context;
+  if (!isRecord$1(context)) return payload;
+  const user = context.user;
+  if (!isRecord$1(user)) return payload;
+  return {
+    ...payload,
+    context: {
+      ...context,
+      user: {
+        ...user,
+        identifiers: { ...userIdentifiers }
+      }
+    }
+  };
+}
+const HOST_CALLBACK_DEFINITIONS = {
+  [STORE_CALLBACK_FIELD_OPTIONS_CALLBACK_NAME]: {
+    callbackName: STORE_CALLBACK_FIELD_OPTIONS_CALLBACK_NAME,
+    scope: STORE_CALLBACK_FIELD_OPTIONS_SCOPE,
+    sourceWidgetType: "store",
+    allowedHostWidgetTypes: ["store", "custom"],
+    completionMode: "result",
+    missingHandler: "reject",
+    legacyActions: ["store:host-callback"],
+    validatePayload: (payload) => hasCallbackContract(
+      payload,
+      STORE_CALLBACK_FIELD_OPTIONS_CALLBACK_NAME,
+      STORE_CALLBACK_FIELD_OPTIONS_SCOPE
+    )
+  },
+  [STORE_PURCHASE_SUCCESS_CALLBACK_NAME]: {
+    callbackName: STORE_PURCHASE_SUCCESS_CALLBACK_NAME,
+    scope: STORE_PURCHASE_SUCCESS_SCOPE,
+    sourceWidgetType: "store",
+    allowedHostWidgetTypes: ["store", "custom"],
+    completionMode: "acknowledged",
+    missingHandler: "reject",
+    legacyActions: ["store:host-callback"],
+    validatePayload: (payload) => hasCallbackContract(
+      payload,
+      STORE_PURCHASE_SUCCESS_CALLBACK_NAME,
+      STORE_PURCHASE_SUCCESS_SCOPE
+    )
+  },
+  [MILESTONE_CTA_CLICK_CALLBACK_NAME]: {
+    callbackName: MILESTONE_CTA_CLICK_CALLBACK_NAME,
+    scope: MILESTONE_CTA_CLICK_SCOPE,
+    sourceWidgetType: "milestone",
+    allowedHostWidgetTypes: ["milestone", "custom"],
+    completionMode: "detached",
+    missingHandler: "ignore",
+    legacyActions: [],
+    validatePayload: isMilestoneCtaClickPayload
+  }
+};
+function createInvocationId() {
+  return `host_callback_${Date.now()}_${Math.random().toString(36).slice(2)}`;
+}
+function observe(observer, event) {
+  if (!observer) return;
+  try {
+    observer(event);
+  } catch {
+  }
+}
+function getHostCallbackDefinition(callbackName, payload) {
+  const definition = HOST_CALLBACK_DEFINITIONS[callbackName];
+  return (definition == null ? void 0 : definition.validatePayload(payload)) ? definition : void 0;
+}
+function getSupportedHostCallbacks(callbacks, hostWidgetType) {
+  return Object.values(HOST_CALLBACK_DEFINITIONS).filter(
+    (definition) => definition.allowedHostWidgetTypes.includes(hostWidgetType) && Object.prototype.hasOwnProperty.call(callbacks, definition.callbackName) && typeof callbacks[definition.callbackName] === "function"
+  ).map((definition) => definition.callbackName);
+}
+function isHostCallbackMessageSupported(definition, action, sourceWidgetType, hostWidgetType) {
+  const actionSupported = action === "widget:host-callback" || definition.legacyActions.includes(action);
+  return actionSupported && sourceWidgetType === definition.sourceWidgetType && definition.allowedHostWidgetTypes.includes(hostWidgetType);
+}
+function dispatchHostCallback(input) {
+  const definition = getHostCallbackDefinition(input.callbackName, input.payload);
+  if (!definition || !definition.allowedHostWidgetTypes.includes(input.hostWidgetType)) {
+    throw new Error("Host callback is not supported for this widget");
+  }
+  const invocationId = input.invocationId || createInvocationId();
+  const eventBase = {
+    invocationId,
+    callbackName: definition.callbackName,
+    scope: definition.scope,
+    sourceWidgetType: definition.sourceWidgetType,
+    hostWidgetType: input.hostWidgetType,
+    completionMode: definition.completionMode,
+    transport: input.transport
+  };
+  observe(input.observer, { type: "callback.received", ...eventBase });
+  const callback = input.callbacks[definition.callbackName];
+  if (!callback) {
+    observe(input.observer, { type: "callback.handler_missing", ...eventBase });
+    if (definition.missingHandler === "ignore") return;
+    return Promise.reject(new Error("Host callback is not registered"));
+  }
+  observe(input.observer, { type: "callback.handler_started", ...eventBase });
+  let result;
+  try {
+    result = callback(input.payload);
+  } catch (error) {
+    observe(input.observer, {
+      type: "callback.handler_rejected",
+      ...eventBase,
+      error
+    });
+    if (definition.completionMode === "detached") return;
+    return Promise.reject(new Error("Host callback failed"));
+  }
+  if (definition.completionMode === "detached") {
+    if (result && typeof result.then === "function") {
+      void Promise.resolve(result).then(
+        () => observe(input.observer, { type: "callback.handler_resolved", ...eventBase }),
+        (error) => observe(input.observer, {
+          type: "callback.handler_rejected",
+          ...eventBase,
+          error
+        })
+      );
+    } else {
+      observe(input.observer, { type: "callback.handler_resolved", ...eventBase });
+    }
+    return;
+  }
+  return Promise.resolve(result).then(
+    (value) => {
+      observe(input.observer, { type: "callback.handler_resolved", ...eventBase });
+      return definition.completionMode === "result" ? value : void 0;
+    },
+    (error) => {
+      observe(input.observer, {
+        type: "callback.handler_rejected",
+        ...eventBase,
+        error
+      });
+      throw new Error("Host callback failed");
+    }
+  );
+}
+const EMBED_TOKEN_REJECTED_ERROR = "Invalid or expired embed token";
+const EMBED_TOKEN_EXPIRY_WINDOW_MS = 3e4;
+const EMBED_TOKEN_REQUEST_TIMEOUT_MS = 1e4;
+const EMBED_TOKEN_REQUEST_COOLDOWN_MS = 3e4;
+const EMBED_TOKEN_CACHE_MARGIN_MS = 6e4;
+const defaultClock = {
+  now: () => Date.now(),
+  setTimeout: (callback, ms) => setTimeout(callback, ms),
+  clearTimeout: (handle) => clearTimeout(handle)
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringRecord(value) {
+  return isRecord(value) && Object.values(value).every((item) => typeof item === "string");
+}
+function decodeEmbedTokenClaims(embedToken) {
+  const payload = readEmbedTokenClaims(embedToken ?? void 0);
+  if (!payload) return null;
+  return {
+    accessId: typeof payload.accessId === "string" ? payload.accessId : void 0,
+    communityId: typeof payload.communityId === "string" ? payload.communityId : void 0,
+    userIdentifiers: isStringRecord(payload.userIdentifiers) ? { ...payload.userIdentifiers } : void 0,
+    exp: typeof payload.exp === "number" && Number.isFinite(payload.exp) ? payload.exp : void 0
+  };
+}
+function sortedIdentifiers(identifiers) {
+  return Object.keys(identifiers || {}).sort().map((key) => [key, identifiers[key]]);
+}
+function hasIdentifiers(identifiers) {
+  return !!identifiers && Object.keys(identifiers).length > 0;
+}
+function embedIdentityKey(embedToken) {
+  if (!embedToken) return "";
+  const claims = decodeEmbedTokenClaims(embedToken);
+  if (!claims || !hasIdentifiers(claims.userIdentifiers)) return embedToken;
+  return JSON.stringify({
+    accessId: claims.accessId ?? "",
+    communityId: claims.communityId ?? "",
+    userIdentifiers: sortedIdentifiers(claims.userIdentifiers)
+  });
+}
+function identitySignatureForConfig(config) {
+  return JSON.stringify({
+    embedToken: embedIdentityKey(config.embedToken),
+    userIdentifiers: sortedIdentifiers(config.userIdentifiers)
+  });
+}
+function isEmbedTokenRejected(error) {
+  return !!error && error.status === 401 && error.error === EMBED_TOKEN_REJECTED_ERROR;
+}
+function isEmbedTokenExpiring(embedToken, now = Date.now()) {
+  var _a;
+  const exp = (_a = decodeEmbedTokenClaims(embedToken)) == null ? void 0 : _a.exp;
+  if (exp === void 0) return false;
+  return exp * 1e3 <= now + EMBED_TOKEN_EXPIRY_WINDOW_MS;
+}
+function readEmbedTokenProvider(callbacks) {
+  const provider = callbacks == null ? void 0 : callbacks.embedTokenRequest;
+  return typeof provider === "function" ? provider : null;
+}
+function sameIdentifiers(left, right) {
+  return JSON.stringify(sortedIdentifiers(left)) === JSON.stringify(sortedIdentifiers(right));
+}
+function acceptRenewedEmbedToken(staleToken, result, now = Date.now()) {
+  if (!isRecord(result)) return null;
+  const candidate = result.embedToken;
+  if (typeof candidate !== "string" || !candidate || candidate === staleToken) return null;
+  const stale = decodeEmbedTokenClaims(staleToken);
+  const next = decodeEmbedTokenClaims(candidate);
+  if (!stale || !next) return null;
+  if (next.exp === void 0 || next.exp * 1e3 <= now + EMBED_TOKEN_EXPIRY_WINDOW_MS) return null;
+  if (!stale.communityId || stale.communityId !== next.communityId) return null;
+  if (hasIdentifiers(stale.userIdentifiers)) {
+    if (!sameIdentifiers(stale.userIdentifiers, next.userIdentifiers)) return null;
+  } else if (hasIdentifiers(next.userIdentifiers)) {
+    return null;
+  }
+  return candidate;
+}
+const REGISTRY_SYMBOL$1 = Symbol.for("returningai.widget-sdk.embed-token-renewal.v1");
+function registry$1() {
+  const root = globalThis;
+  root[REGISTRY_SYMBOL$1] ?? (root[REGISTRY_SYMBOL$1] = /* @__PURE__ */ new Map());
+  return root[REGISTRY_SYMBOL$1];
+}
+function registryEntry(key) {
+  const entries2 = registry$1();
+  let entry = entries2.get(key);
+  if (!entry) {
+    entry = { inFlight: null, cachedToken: null, cachedUntil: 0, cooldownUntil: 0 };
+    entries2.set(key, entry);
+  }
+  return entry;
+}
+function markRenewedEmbedTokenRefused(staleToken, refusedToken, clock = defaultClock) {
+  const cooldownUntil = clock.now() + EMBED_TOKEN_REQUEST_COOLDOWN_MS;
+  for (const token of /* @__PURE__ */ new Set([staleToken, refusedToken])) {
+    const entry = registryEntry(embedIdentityKey(token));
+    if (entry.cachedToken === refusedToken) {
+      entry.cachedToken = null;
+      entry.cachedUntil = 0;
+    }
+    entry.cooldownUntil = Math.max(entry.cooldownUntil, cooldownUntil);
+  }
+}
+function renewEmbedToken(request) {
+  const clock = request.clock ?? defaultClock;
+  const entry = registryEntry(embedIdentityKey(request.staleToken));
+  const now = clock.now();
+  if (entry.cachedToken && entry.cachedToken !== request.staleToken && now < entry.cachedUntil) {
+    return Promise.resolve(entry.cachedToken);
+  }
+  if (entry.inFlight) return entry.inFlight;
+  if (now < entry.cooldownUntil) return Promise.resolve(null);
+  const current = entry;
+  const inFlight = (async () => {
+    var _a;
+    let timer;
+    const timeout = new Promise((resolve) => {
+      timer = clock.setTimeout(() => resolve(void 0), EMBED_TOKEN_REQUEST_TIMEOUT_MS);
+    });
+    let accepted = null;
+    try {
+      const answer = await Promise.race([
+        Promise.resolve().then(() => request.provider({ reason: request.reason })),
+        timeout
+      ]);
+      accepted = acceptRenewedEmbedToken(request.staleToken, answer, clock.now());
+    } catch {
+      accepted = null;
+    } finally {
+      clock.clearTimeout(timer);
+    }
+    if (accepted) {
+      const exp = ((_a = decodeEmbedTokenClaims(accepted)) == null ? void 0 : _a.exp) ?? 0;
+      current.cachedToken = accepted;
+      current.cachedUntil = exp * 1e3 - EMBED_TOKEN_CACHE_MARGIN_MS;
+      current.cooldownUntil = 0;
+    } else {
+      current.cooldownUntil = clock.now() + EMBED_TOKEN_REQUEST_COOLDOWN_MS;
+    }
+    current.inFlight = null;
+    return accepted;
+  })();
+  current.inFlight = inFlight;
+  return inFlight;
+}
+function decideEmbedTokenChange(input) {
+  if (!input.hasAttemptedInit) return "update";
+  if (!input.sameSignature) return "reload";
+  if (!input.tokenChanged) return "update";
+  return input.healthy && input.hasProvider ? "swap" : "reload";
+}
 function setTokens(config, state, data, onRefreshScheduled) {
   state.accessToken = data.accessToken;
   state.refreshToken = data.refreshToken;
@@ -12471,13 +12834,62 @@ function buildIdentityProof(config) {
   }
   return proof;
 }
+function canReauthenticateAfterTransientFailure(config) {
+  var _a;
+  if (!config.embedToken) return true;
+  const exp = (_a = readEmbedTokenClaims(config.embedToken)) == null ? void 0 : _a.exp;
+  return typeof exp === "number" && exp * 1e3 > Date.now();
+}
 function calculateRefreshDelay(accessTokenExpiry, now = Date.now()) {
   const remainingLifetime = accessTokenExpiry - now;
   if (remainingLifetime <= 0) return 0;
   const refreshLeadTime = Math.min(6e4, remainingLifetime / 2);
   return Math.max(0, Math.floor(remainingLifetime - refreshLeadTime));
 }
-async function authenticateServerless(config, state, onRefreshScheduled) {
+async function authenticateServerless(config, state, renewal, onRefreshScheduled) {
+  var _a;
+  const provider = ((_a = renewal.getEmbedTokenProvider) == null ? void 0 : _a.call(renewal)) ?? null;
+  const isCurrent = () => !renewal.isCurrent || renewal.isCurrent();
+  let renewalAttempted = false;
+  let renewed = null;
+  let presentedToken;
+  const renewEmbedTokenOnce = async () => {
+    const staleToken = config.embedToken;
+    if (!provider || !staleToken || renewalAttempted) return false;
+    renewalAttempted = true;
+    const fresh = await renewEmbedToken({
+      staleToken,
+      reason: renewal.reason ?? "expired",
+      provider
+    });
+    if (!fresh) return false;
+    if (config.embedToken === staleToken) config.embedToken = fresh;
+    renewed = { from: staleToken, to: fresh };
+    return true;
+  };
+  const signIn = async () => {
+    const presented = config.embedToken;
+    presentedToken = presented;
+    const authed = await signInOnce(config, state, onRefreshScheduled);
+    if (!authed && renewed && presented === renewed.to && isEmbedTokenRejected(state.lastAuthError)) {
+      markRenewedEmbedTokenRefused(renewed.from, renewed.to);
+    }
+    return authed;
+  };
+  if (provider && config.embedToken && isEmbedTokenExpiring(config.embedToken)) {
+    await renewEmbedTokenOnce();
+  }
+  if (await signIn()) return true;
+  if (!isEmbedTokenRejected(state.lastAuthError)) return false;
+  if (provider && config.embedToken && config.embedToken !== presentedToken) {
+    if (!isCurrent()) return false;
+    return signIn();
+  }
+  if (!await renewEmbedTokenOnce() || !isCurrent()) return false;
+  return signIn();
+}
+async function signInOnce(config, state, onRefreshScheduled) {
+  state.lastAuthError = null;
   const nonce = crypto.randomUUID();
   const timestamp = Date.now();
   const maxRetries = config.maxRetries ?? 3;
@@ -12610,7 +13022,7 @@ async function authenticateViaProxy(config, state, onRefreshScheduled) {
   state.isAuthenticated = false;
   return false;
 }
-async function refreshAccessToken(config, state, onRefreshScheduled, sendToken) {
+async function refreshAccessToken(config, state, renewal, onRefreshScheduled, sendToken) {
   if (state.isRefreshing) {
     return state.refreshPromise;
   }
@@ -12626,50 +13038,81 @@ async function refreshAccessToken(config, state, onRefreshScheduled, sendToken)
   };
   state.isRefreshing = true;
   state.refreshPromise = (async () => {
-    const reauthenticateAfterRefreshFailure = async () => {
+    const adoptNewerGeneration = () => {
       if (state.refreshToken && state.refreshToken !== presentedRefreshToken && state.accessToken && state.accessTokenExpiry && Date.now() < state.accessTokenExpiry) {
         state.isAuthenticated = true;
         if (sendToken) sendToken();
         return true;
       }
-      const authed = await authenticateServerless(config, state, onRefreshScheduled);
+      return false;
+    };
+    const reauthenticateAfterRefreshFailure = async () => {
+      if (adoptNewerGeneration()) return true;
+      const authed = await authenticateServerless(
+        config,
+        state,
+        { ...renewal, reason: "session-expired" },
+        onRefreshScheduled
+      );
       if (authed && sendToken) sendToken();
       if (!authed && isPermanentAuthFailure(state.lastAuthError)) {
         const permanentError = state.lastAuthError;
         clearAuthenticationData(state);
         state.lastAuthError = permanentError;
-        clearStorage(config);
+        clearStorage(config, state);
       } else if (!authed) {
         Object.assign(state, previousAuthentication);
       }
       return authed;
     };
+    const retainSessionAfterTransientFailure = async (failure) => {
+      if (adoptNewerGeneration()) return true;
+      if (canReauthenticateAfterTransientFailure(config)) {
+        return reauthenticateAfterRefreshFailure();
+      }
+      Object.assign(state, previousAuthentication);
+      state.lastAuthError = failure;
+      return false;
+    };
     try {
       if (!presentedRefreshToken) {
         return reauthenticateAfterRefreshFailure();
       }
-      const response = await fetch(`${config.apiUrl}/${config.widgetId}/auth/refresh`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${presentedRefreshToken}`
-        },
-        body: JSON.stringify({
-          widgetType: config.widgetType,
-          ...buildIdentityProof(config)
-        })
-      });
+      let response;
+      try {
+        response = await fetch(`${config.apiUrl}/${config.widgetId}/auth/refresh`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${presentedRefreshToken}`
+          },
+          body: JSON.stringify({
+            widgetType: config.widgetType,
+            ...buildIdentityProof(config)
+          })
+        });
+      } catch (err) {
+        return retainSessionAfterTransientFailure({
+          status: 0,
+          error: err instanceof Error ? err.message : "Token refresh failed"
+        });
+      }
       if (!response.ok) {
-        if (response.status === 400 || response.status === 401 || response.status === 403) {
+        const error = await response.json().catch(() => ({ error: "Token refresh failed" }));
+        const failure = {
+          status: response.status,
+          error: (error == null ? void 0 : error.error) || `HTTP ${response.status}`
+        };
+        if (isPermanentAuthFailure(failure)) {
           return reauthenticateAfterRefreshFailure();
         }
-        const error = await response.json().catch(() => ({ error: "Token refresh failed" }));
-        throw new Error(error.error || `HTTP ${response.status}`);
+        return retainSessionAfterTransientFailure(failure);
       }
       const data = await response.json();
       if (!data.accessToken || !data.refreshToken) {
         throw new Error("Invalid refresh response");
       }
+      state.lastAuthError = null;
       setTokens(config, state, data, onRefreshScheduled);
       state.isAuthenticated = true;
       if (sendToken) sendToken();
@@ -12683,19 +13126,17 @@ async function refreshAccessToken(config, state, onRefreshScheduled, sendToken)
   })();
   return state.refreshPromise;
 }
-async function getValidToken(config, state, onRefreshScheduled) {
+async function getValidToken(config, state, renewal, onRefreshScheduled) {
   if (state.accessToken && !isTokenExpired(state.accessTokenExpiry)) {
     return state.accessToken;
   }
   if (config.authUrl) {
-    const authed2 = await authenticateViaProxy(config, state, onRefreshScheduled);
-    if (authed2 && state.accessToken) return state.accessToken;
+    const authed = await authenticateViaProxy(config, state, onRefreshScheduled);
+    if (authed && state.accessToken) return state.accessToken;
     throw new Error("Unable to obtain valid token");
   }
-  const refreshed = await refreshAccessToken(config, state, onRefreshScheduled);
+  const refreshed = await refreshAccessToken(config, state, renewal, onRefreshScheduled);
   if (refreshed && state.accessToken) return state.accessToken;
-  const authed = await authenticateServerless(config, state, onRefreshScheduled);
-  if (authed && state.accessToken) return state.accessToken;
   throw new Error("Unable to obtain valid token");
 }
 async function logout(config, state) {
@@ -12713,7 +13154,7 @@ async function logout(config, state) {
     }
   }
   clearState(state);
-  clearStorage(config);
+  clearStorage(config, state);
 }
 const inflightErrorSettings = /* @__PURE__ */ new Map();
 function applyErrorSettingsToState(state, data) {
@@ -12882,7 +13323,7 @@ function applySnapshot(subscriber, snapshot, notify = true) {
   var _a;
   Object.assign(subscriber.state, snapshot);
   if (snapshot.refreshToken) saveToStorage(subscriber.config, subscriber.state);
-  else clearStorage(subscriber.config);
+  else clearStorage(subscriber.config, subscriber.state);
   if (!notify) return;
   try {
     (_a = subscriber.onSnapshot) == null ? void 0 : _a.call(subscriber);
@@ -12944,10 +13385,9 @@ function subscribeAuthSession(config, state, onSnapshot) {
       return inFlight;
     },
     publish() {
-      if (!released) publishSnapshot(session, state);
+      publishSnapshot(session, state);
     },
     clear() {
-      if (released) return;
       state.accessToken = null;
       state.refreshToken = null;
       state.tokenFamily = null;
@@ -13327,321 +13767,127 @@ function syncBundleAccessToken(config, state, runtime = window) {
   return true;
 }
 function assertCallbackName(callbackName) {
-  if (!callbackName || typeof callbackName !== "string") {
-    throw new TypeError("ReturningAI callback name must be a non-empty string");
-  }
-}
-function assertCallback(callback) {
-  if (typeof callback !== "function") {
-    throw new TypeError("ReturningAI callback must be a function");
-  }
-}
-class WidgetCallbackRegistry {
-  constructor() {
-    __publicField(this, "registeredCallbacks", {});
-    __publicField(this, "locked", false);
-  }
-  get isLocked() {
-    return this.locked;
-  }
-  registerCallback(callbackName, callback) {
-    if (this.locked) {
-      return;
-    }
-    assertCallbackName(callbackName);
-    assertCallback(callback);
-    this.registeredCallbacks = {
-      ...this.registeredCallbacks,
-      [callbackName]: callback
-    };
-  }
-  lock() {
-    if (this.locked) {
-      return;
-    }
-    this.locked = true;
-  }
-  read() {
-    return { ...this.registeredCallbacks };
-  }
-}
-const loadedGoogleFontFamilies = /* @__PURE__ */ new Set();
-const LOCAL_OR_SYSTEM_FONT_FAMILIES = /* @__PURE__ */ new Set([
-  "aeonik",
-  "courier",
-  "courier new",
-  "monaco",
-  "monospace",
-  "sans-serif",
-  "serif",
-  "system-ui"
-]);
-const SERIF_FONT_FAMILIES = /* @__PURE__ */ new Set(["lora", "playfair display", "prata"]);
-const GOOGLE_FONT_VARIANTS = ":ital,wght@0,300;0,400;0,500;0,600;0,700;1,400;1,700";
-function normalizeFontFamily(family) {
-  return family.trim() === "Noto" ? "Noto Sans" : family.trim();
-}
-function getFontStack(family) {
-  const normalizedFamily = normalizeFontFamily(family);
-  if (normalizedFamily.includes(",")) return normalizedFamily;
-  const normalizedKey = normalizedFamily.toLowerCase();
-  switch (normalizedKey) {
-    case "monospace":
-      return "monospace";
-    case "courier":
-    case "courier new":
-      return '"Courier New", Courier, monospace';
-    case "monaco":
-      return "Monaco, Menlo, Consolas, monospace";
-    case "system-ui":
-      return "system-ui, -apple-system, sans-serif";
-    case "sans-serif":
-    case "serif":
-      return normalizedKey;
-    default:
-      return `'${normalizedFamily.replace(/[\\']/g, "\\\\$&")}', ${SERIF_FONT_FAMILIES.has(normalizedKey) ? "Georgia, 'Times New Roman', serif" : "system-ui, -apple-system, sans-serif"}`;
-  }
-}
-function ensureGoogleFontPreconnect() {
-  if (!document.getElementById("rai-fonts-preconnect")) {
-    const link = document.createElement("link");
-    link.id = "rai-fonts-preconnect";
-    link.rel = "preconnect";
-    link.href = "https://fonts.googleapis.com";
-    document.head.appendChild(link);
-  }
-  if (!document.getElementById("rai-fonts-static-preconnect")) {
-    const link = document.createElement("link");
-    link.id = "rai-fonts-static-preconnect";
-    link.rel = "preconnect";
-    link.href = "https://fonts.gstatic.com";
-    link.crossOrigin = "anonymous";
-    document.head.appendChild(link);
-  }
-}
-function ensureGoogleFontLoaded(family) {
-  const normalizedFamily = normalizeFontFamily(family);
-  const fontKey = normalizedFamily.toLowerCase();
-  if (!normalizedFamily || normalizedFamily.includes(",") || LOCAL_OR_SYSTEM_FONT_FAMILIES.has(fontKey)) {
-    return;
-  }
-  if (loadedGoogleFontFamilies.has(fontKey)) return;
-  ensureGoogleFontPreconnect();
-  const linkId = `rai-font-${normalizedFamily.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
-  const fontUrl = `https://fonts.googleapis.com/css2?family=${encodeURIComponent(
-    normalizedFamily
-  )}${GOOGLE_FONT_VARIANTS}&display=swap`;
-  let link = document.getElementById(linkId);
-  if (link && link.href !== fontUrl) {
-    link.remove();
-    link = null;
-  }
-  if (!link) {
-    link = document.createElement("link");
-    link.id = linkId;
-    link.rel = "stylesheet";
-    link.href = fontUrl;
-    document.head.appendChild(link);
-  }
-  loadedGoogleFontFamilies.add(fontKey);
-  link.onerror = () => {
-    loadedGoogleFontFamilies.delete(fontKey);
-    link == null ? void 0 : link.remove();
-  };
-}
-const STORE_CALLBACK_FIELD_OPTIONS_SCOPE = "store.callback_field_options";
-const STORE_CALLBACK_FIELD_OPTIONS_CALLBACK_NAME = "callbackFieldOptions";
-const STORE_CALLBACK_FIELD_OPTIONS_TIMEOUT_MS = 15e3;
-const STORE_PURCHASE_SUCCESS_SCOPE = "store.purchase_success";
-const STORE_PURCHASE_SUCCESS_CALLBACK_NAME = "storePurchaseSuccess";
-const MILESTONE_CTA_CLICK_SCOPE = "milestone.cta_click";
-const MILESTONE_CTA_CLICK_CALLBACK_NAME = "milestoneCtaClick";
-const MILESTONE_CTA_CLICK_EVENT = "milestone_cta_clicked";
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function isStringRecord(value) {
-  return isRecord(value) && Object.values(value).every((item) => typeof item === "string");
-}
-function readEmbedTokenUserIdentifiers(embedToken) {
-  if (!embedToken) return null;
-  const encodedPayload = embedToken.split(".")[1];
-  if (!encodedPayload) return null;
-  try {
-    const normalizedPayload = encodedPayload.replace(/-/g, "+").replace(/_/g, "/");
-    const paddedPayload = normalizedPayload.padEnd(
-      Math.ceil(normalizedPayload.length / 4) * 4,
-      "="
-    );
-    const bytes = Uint8Array.from(atob(paddedPayload), (character) => character.charCodeAt(0));
-    const claims = JSON.parse(new TextDecoder().decode(bytes));
-    if (!isRecord(claims) || !isStringRecord(claims.userIdentifiers)) return null;
-    return { ...claims.userIdentifiers };
-  } catch {
-    return null;
-  }
-}
-function resolveHostUserIdentifiers(config) {
-  return readEmbedTokenUserIdentifiers(config.embedToken) ?? { ...config.userIdentifiers };
-}
-function hasCallbackContract(payload, callbackName, scope) {
-  return isRecord(payload) && payload.callbackName === callbackName && payload.scope === scope;
-}
-function isMilestoneCtaClickPayload(payload) {
-  if (!hasCallbackContract(
-    payload,
-    MILESTONE_CTA_CLICK_CALLBACK_NAME,
-    MILESTONE_CTA_CLICK_SCOPE
-  )) return false;
-  const context = payload.context;
-  if (!isRecord(context)) return false;
-  const community = context.community;
-  const milestone = context.milestone;
-  const stage = context.stage;
-  const button = context.button;
-  const user = context.user;
-  return context.event === MILESTONE_CTA_CLICK_EVENT && isRecord(community) && typeof community.id === "string" && community.id.length > 0 && (community.name === void 0 || community.name === null || typeof community.name === "string") && isRecord(milestone) && typeof milestone.id === "string" && milestone.id.length > 0 && typeof milestone.name === "string" && milestone.name.length > 0 && isRecord(stage) && typeof stage.id === "string" && stage.id.length > 0 && typeof stage.name === "string" && stage.name.length > 0 && isRecord(button) && typeof button.name === "string" && button.name.length > 0 && isRecord(user) && isStringRecord(user.identifiers) && typeof context.clickedAt === "string" && context.clickedAt.length > 0 && !Number.isNaN(Date.parse(context.clickedAt));
-}
-function enrichHostCallbackPayload(payload, userIdentifiers) {
-  if (!userIdentifiers || Object.keys(userIdentifiers).length === 0) return payload;
-  if (!isRecord(payload)) return payload;
-  const context = payload.context;
-  if (!isRecord(context)) return payload;
-  const user = context.user;
-  if (!isRecord(user)) return payload;
-  return {
-    ...payload,
-    context: {
-      ...context,
-      user: {
-        ...user,
-        identifiers: { ...userIdentifiers }
-      }
-    }
-  };
-}
-const HOST_CALLBACK_DEFINITIONS = {
-  [STORE_CALLBACK_FIELD_OPTIONS_CALLBACK_NAME]: {
-    callbackName: STORE_CALLBACK_FIELD_OPTIONS_CALLBACK_NAME,
-    scope: STORE_CALLBACK_FIELD_OPTIONS_SCOPE,
-    sourceWidgetType: "store",
-    allowedHostWidgetTypes: ["store", "custom"],
-    completionMode: "result",
-    missingHandler: "reject",
-    legacyActions: ["store:host-callback"],
-    validatePayload: (payload) => hasCallbackContract(
-      payload,
-      STORE_CALLBACK_FIELD_OPTIONS_CALLBACK_NAME,
-      STORE_CALLBACK_FIELD_OPTIONS_SCOPE
-    )
-  },
-  [STORE_PURCHASE_SUCCESS_CALLBACK_NAME]: {
-    callbackName: STORE_PURCHASE_SUCCESS_CALLBACK_NAME,
-    scope: STORE_PURCHASE_SUCCESS_SCOPE,
-    sourceWidgetType: "store",
-    allowedHostWidgetTypes: ["store", "custom"],
-    completionMode: "acknowledged",
-    missingHandler: "reject",
-    legacyActions: ["store:host-callback"],
-    validatePayload: (payload) => hasCallbackContract(
-      payload,
-      STORE_PURCHASE_SUCCESS_CALLBACK_NAME,
-      STORE_PURCHASE_SUCCESS_SCOPE
-    )
-  },
-  [MILESTONE_CTA_CLICK_CALLBACK_NAME]: {
-    callbackName: MILESTONE_CTA_CLICK_CALLBACK_NAME,
-    scope: MILESTONE_CTA_CLICK_SCOPE,
-    sourceWidgetType: "milestone",
-    allowedHostWidgetTypes: ["milestone", "custom"],
-    completionMode: "detached",
-    missingHandler: "ignore",
-    legacyActions: [],
-    validatePayload: isMilestoneCtaClickPayload
+  if (!callbackName || typeof callbackName !== "string") {
+    throw new TypeError("ReturningAI callback name must be a non-empty string");
   }
-};
-function createInvocationId() {
-  return `host_callback_${Date.now()}_${Math.random().toString(36).slice(2)}`;
 }
-function observe(observer, event) {
-  if (!observer) return;
-  try {
-    observer(event);
-  } catch {
+function assertCallback(callback) {
+  if (typeof callback !== "function") {
+    throw new TypeError("ReturningAI callback must be a function");
   }
 }
-function getHostCallbackDefinition(callbackName, payload) {
-  const definition = HOST_CALLBACK_DEFINITIONS[callbackName];
-  return (definition == null ? void 0 : definition.validatePayload(payload)) ? definition : void 0;
+class WidgetCallbackRegistry {
+  constructor() {
+    __publicField(this, "registeredCallbacks", {});
+    __publicField(this, "locked", false);
+  }
+  get isLocked() {
+    return this.locked;
+  }
+  registerCallback(callbackName, callback) {
+    if (this.locked) {
+      return;
+    }
+    assertCallbackName(callbackName);
+    assertCallback(callback);
+    this.registeredCallbacks = {
+      ...this.registeredCallbacks,
+      [callbackName]: callback
+    };
+  }
+  lock() {
+    if (this.locked) {
+      return;
+    }
+    this.locked = true;
+  }
+  read() {
+    return { ...this.registeredCallbacks };
+  }
 }
-function isHostCallbackMessageSupported(definition, action, sourceWidgetType, hostWidgetType) {
-  const actionSupported = action === "widget:host-callback" || definition.legacyActions.includes(action);
-  return actionSupported && sourceWidgetType === definition.sourceWidgetType && definition.allowedHostWidgetTypes.includes(hostWidgetType);
+const loadedGoogleFontFamilies = /* @__PURE__ */ new Set();
+const LOCAL_OR_SYSTEM_FONT_FAMILIES = /* @__PURE__ */ new Set([
+  "aeonik",
+  "courier",
+  "courier new",
+  "monaco",
+  "monospace",
+  "sans-serif",
+  "serif",
+  "system-ui"
+]);
+const SERIF_FONT_FAMILIES = /* @__PURE__ */ new Set(["lora", "playfair display", "prata"]);
+const GOOGLE_FONT_VARIANTS = ":ital,wght@0,300;0,400;0,500;0,600;0,700;1,400;1,700";
+function normalizeFontFamily(family) {
+  return family.trim() === "Noto" ? "Noto Sans" : family.trim();
 }
-function dispatchHostCallback(input) {
-  const definition = getHostCallbackDefinition(input.callbackName, input.payload);
-  if (!definition || !definition.allowedHostWidgetTypes.includes(input.hostWidgetType)) {
-    throw new Error("Host callback is not supported for this widget");
+function getFontStack(family) {
+  const normalizedFamily = normalizeFontFamily(family);
+  if (normalizedFamily.includes(",")) return normalizedFamily;
+  const normalizedKey = normalizedFamily.toLowerCase();
+  switch (normalizedKey) {
+    case "monospace":
+      return "monospace";
+    case "courier":
+    case "courier new":
+      return '"Courier New", Courier, monospace';
+    case "monaco":
+      return "Monaco, Menlo, Consolas, monospace";
+    case "system-ui":
+      return "system-ui, -apple-system, sans-serif";
+    case "sans-serif":
+    case "serif":
+      return normalizedKey;
+    default:
+      return `'${normalizedFamily.replace(/[\\']/g, "\\\\$&")}', ${SERIF_FONT_FAMILIES.has(normalizedKey) ? "Georgia, 'Times New Roman', serif" : "system-ui, -apple-system, sans-serif"}`;
   }
-  const invocationId = input.invocationId || createInvocationId();
-  const eventBase = {
-    invocationId,
-    callbackName: definition.callbackName,
-    scope: definition.scope,
-    sourceWidgetType: definition.sourceWidgetType,
-    hostWidgetType: input.hostWidgetType,
-    completionMode: definition.completionMode,
-    transport: input.transport
-  };
-  observe(input.observer, { type: "callback.received", ...eventBase });
-  const callback = input.callbacks[definition.callbackName];
-  if (!callback) {
-    observe(input.observer, { type: "callback.handler_missing", ...eventBase });
-    if (definition.missingHandler === "ignore") return;
-    return Promise.reject(new Error("Host callback is not registered"));
+}
+function ensureGoogleFontPreconnect() {
+  if (!document.getElementById("rai-fonts-preconnect")) {
+    const link = document.createElement("link");
+    link.id = "rai-fonts-preconnect";
+    link.rel = "preconnect";
+    link.href = "https://fonts.googleapis.com";
+    document.head.appendChild(link);
   }
-  observe(input.observer, { type: "callback.handler_started", ...eventBase });
-  let result;
-  try {
-    result = callback(input.payload);
-  } catch (error) {
-    observe(input.observer, {
-      type: "callback.handler_rejected",
-      ...eventBase,
-      error
-    });
-    if (definition.completionMode === "detached") return;
-    return Promise.reject(new Error("Host callback failed"));
+  if (!document.getElementById("rai-fonts-static-preconnect")) {
+    const link = document.createElement("link");
+    link.id = "rai-fonts-static-preconnect";
+    link.rel = "preconnect";
+    link.href = "https://fonts.gstatic.com";
+    link.crossOrigin = "anonymous";
+    document.head.appendChild(link);
   }
-  if (definition.completionMode === "detached") {
-    if (result && typeof result.then === "function") {
-      void Promise.resolve(result).then(
-        () => observe(input.observer, { type: "callback.handler_resolved", ...eventBase }),
-        (error) => observe(input.observer, {
-          type: "callback.handler_rejected",
-          ...eventBase,
-          error
-        })
-      );
-    } else {
-      observe(input.observer, { type: "callback.handler_resolved", ...eventBase });
-    }
+}
+function ensureGoogleFontLoaded(family) {
+  const normalizedFamily = normalizeFontFamily(family);
+  const fontKey = normalizedFamily.toLowerCase();
+  if (!normalizedFamily || normalizedFamily.includes(",") || LOCAL_OR_SYSTEM_FONT_FAMILIES.has(fontKey)) {
     return;
   }
-  return Promise.resolve(result).then(
-    (value) => {
-      observe(input.observer, { type: "callback.handler_resolved", ...eventBase });
-      return definition.completionMode === "result" ? value : void 0;
-    },
-    (error) => {
-      observe(input.observer, {
-        type: "callback.handler_rejected",
-        ...eventBase,
-        error
-      });
-      throw new Error("Host callback failed");
-    }
-  );
+  if (loadedGoogleFontFamilies.has(fontKey)) return;
+  ensureGoogleFontPreconnect();
+  const linkId = `rai-font-${normalizedFamily.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
+  const fontUrl = `https://fonts.googleapis.com/css2?family=${encodeURIComponent(
+    normalizedFamily
+  )}${GOOGLE_FONT_VARIANTS}&display=swap`;
+  let link = document.getElementById(linkId);
+  if (link && link.href !== fontUrl) {
+    link.remove();
+    link = null;
+  }
+  if (!link) {
+    link = document.createElement("link");
+    link.id = linkId;
+    link.rel = "stylesheet";
+    link.href = fontUrl;
+    document.head.appendChild(link);
+  }
+  loadedGoogleFontFamilies.add(fontKey);
+  link.onerror = () => {
+    loadedGoogleFontFamilies.delete(fontKey);
+    link == null ? void 0 : link.remove();
+  };
 }
 const SUPPORTED_WIDGET_LANGUAGES = [
   "en",
@@ -13779,15 +14025,36 @@ function setupMessageListener(config, state, _shadow, iframe, onRefreshScheduled
     emit == null ? void 0 : emit("rai-height-change", { height: h });
   }, config.heightDebounce ?? 100);
   const handler = async (event) => {
-    var _a;
+    var _a, _b;
     if (event.origin !== config.widgetDomain) return;
     if (!event.data || typeof event.data.type !== "string") return;
     const { type, containerId, widgetId, payload } = event.data;
     switch (type) {
+      case "RETURNINGAI_WIDGET_REQUEST_CALLBACK_CAPABILITIES": {
+        if (event.source !== iframe.contentWindow) break;
+        if (widgetId !== void 0 && widgetId !== config.widgetId) break;
+        if (containerId !== void 0 && containerId !== config.container) break;
+        const requestId = event.data.requestId;
+        if (typeof requestId !== "string" || !requestId || requestId.length > 256) break;
+        (_a = iframe.contentWindow) == null ? void 0 : _a.postMessage({
+          type: "RETURNINGAI_WIDGET_CALLBACK_CAPABILITIES",
+          requestId,
+          supportedCallbacks: getSupportedHostCallbacks((getCallbacks == null ? void 0 : getCallbacks()) ?? {}, config.widgetType)
+        }, config.widgetDomain);
+        break;
+      }
       case "RETURNINGAI_WIDGET_REQUEST_TOKEN": {
         try {
-          const token = await getValidToken(config, state, onRefreshScheduled);
-          (_a = iframe.contentWindow) == null ? void 0 : _a.postMessage(
+          const token = await getValidToken(
+            config,
+            state,
+            {
+              getEmbedTokenProvider: () => readEmbedTokenProvider(getCallbacks == null ? void 0 : getCallbacks()),
+              isCurrent: () => iframe.isConnected
+            },
+            onRefreshScheduled
+          );
+          (_b = iframe.contentWindow) == null ? void 0 : _b.postMessage(
             {
               type: "RETURNINGAI_WIDGET_TOKEN",
               value: {
@@ -14238,13 +14505,6 @@ function readConfig(el2, existingId) {
     firstPaintFont: get("font") || void 0
   };
 }
-function identitySignatureForConfig(config) {
-  const identifiers = Object.keys(config.userIdentifiers || {}).sort().map((key) => [key, config.userIdentifiers[key]]);
-  return JSON.stringify({
-    embedToken: config.embedToken || "",
-    userIdentifiers: identifiers
-  });
-}
 function createInitialState() {
   return {
     accessToken: null,
@@ -14268,6 +14528,17 @@ function createInitialState() {
     widgetData: null
   };
 }
+function forkWidgetState(previous) {
+  return {
+    ...createInitialState(),
+    errorSettings: previous.errorSettings ?? null,
+    loadingAnimation: previous.loadingAnimation ?? null,
+    loadingSettings: previous.loadingSettings ?? null,
+    themePalette: previous.themePalette ?? null,
+    font: previous.font ?? null,
+    defaultColorSchema: previous.defaultColorSchema ?? null
+  };
+}
 class BaseWidget extends HTMLElement {
   constructor() {
     super();
@@ -14285,6 +14556,14 @@ class BaseWidget extends HTMLElement {
     __publicField(this, "themeObserver");
     __publicField(this, "identityAttributeObserver");
     __publicField(this, "identitySignature", "");
+    /** The `embed-token` attribute as last read; `config.embedToken` may hold a renewed pass instead. */
+    __publicField(this, "lastEmbedTokenAttribute");
+    /** The init generation whose widget launched; part of the silent-swap health check. */
+    __publicField(this, "launchedInitId", 0);
+    /** Set when the expired-pass error was shown with no `embedTokenRequest` registered. */
+    __publicField(this, "lateEmbedTokenRegistrationReload", false);
+    /** An error screen is showing for the current init (any cause); clears on the next launch. */
+    __publicField(this, "errorScreenShown", false);
     __publicField(this, "hasAttemptedInit", false);
     __publicField(this, "initGeneration", 0);
     __publicField(this, "lottieInstances", []);
@@ -14314,6 +14593,10 @@ class BaseWidget extends HTMLElement {
   }
   registerCallback(callbackName, callback) {
     this.callbackRegistry.registerCallback(callbackName, callback);
+    if (callbackName === "embedTokenRequest" && this.lateEmbedTokenRegistrationReload && !this.callbackRegistry.isLocked && this.readEmbedTokenProvider() && isEmbedTokenRejected(this.state.lastAuthError) && this.isConnected) {
+      this.lateEmbedTokenRegistrationReload = false;
+      void this.reload();
+    }
   }
   lockCallbacks() {
     this.callbackRegistry.lock();
@@ -14321,6 +14604,7 @@ class BaseWidget extends HTMLElement {
   connectedCallback() {
     this.config = readConfig(this, void 0);
     this.identitySignature = identitySignatureForConfig(this.config);
+    this.lastEmbedTokenAttribute = this.config.embedToken;
     this.setupIdentityAttributeObserver();
     ensureWidgetPreconnects(
       resolveWidgetPreconnectOrigins(this.config, document.baseURI)
@@ -14394,7 +14678,22 @@ class BaseWidget extends HTMLElement {
     if (!this.isConnected || !this.config) return;
     const nextConfig = readConfig(this, this.config.communityId);
     const nextIdentitySignature = identitySignatureForConfig(nextConfig);
-    if (nextIdentitySignature === this.identitySignature) {
+    const tokenChanged = nextConfig.embedToken !== this.lastEmbedTokenAttribute;
+    const sameSignature = nextIdentitySignature === this.identitySignature;
+    const decision = decideEmbedTokenChange({
+      tokenChanged,
+      sameSignature,
+      hasAttemptedInit: this.hasAttemptedInit,
+      healthy: this.isHealthyForEmbedTokenSwap(),
+      hasProvider: !!this.readEmbedTokenProvider()
+    });
+    this.lastEmbedTokenAttribute = nextConfig.embedToken;
+    if (decision === "swap") {
+      this.config.embedToken = nextConfig.embedToken;
+      return;
+    }
+    if (decision === "update" && sameSignature) {
+      if (!tokenChanged) nextConfig.embedToken = this.config.embedToken;
       this.config = nextConfig;
       return;
     }
@@ -14403,10 +14702,28 @@ class BaseWidget extends HTMLElement {
     this.identitySignature = nextIdentitySignature;
     clearStorage(previousConfig);
     clearStorage(this.config);
-    if (this.hasAttemptedInit) {
+    if (decision === "reload") {
       void this.reload();
     }
   }
+  readEmbedTokenProvider() {
+    return readEmbedTokenProvider(this.callbackRegistry.read());
+  }
+  /**
+   * Renewal options for auth calls started by init `initId`; the provider is
+   * read at call time. A disconnect or a newer init stops the retry. Writes
+   * from this call land only in the state object init `initId` owns.
+   */
+  embedTokenRenewal(initId) {
+    return {
+      getEmbedTokenProvider: () => this.readEmbedTokenProvider(),
+      isCurrent: () => this.isCurrentInit(initId)
+    };
+  }
+  /** Authenticated, no error state or error screen, and launched for the current init. */
+  isHealthyForEmbedTokenSwap() {
+    return this.state.isAuthenticated && !this.state.lastAuthError && !this.errorScreenShown && this.launchedInitId !== 0 && this.launchedInitId === this.initGeneration;
+  }
   // ── DOM event helper (#1) ─────────────────────────────────────────────
   emit(type, detail) {
     this.dispatchEvent(
@@ -14596,10 +14913,15 @@ class BaseWidget extends HTMLElement {
       this.renderLoaderAnimation();
       return;
     }
+    const target = this.state;
     try {
-      await fetchErrorSettings(this.config, this.state);
+      await fetchErrorSettings(this.config, target);
     } catch {
     }
+    if (target !== this.state) {
+      const fetched = loadErrorSettingsFromStorage(this.config);
+      if (fetched) applyErrorSettingsToState(this.state, fetched);
+    }
     if (!loaderEl || loaderEl !== this.loaderEl || !this.isConnected) return;
     if (!this.config.themeExplicit && (this.state.defaultColorSchema === "light" || this.state.defaultColorSchema === "dark") && this.state.defaultColorSchema !== this.config.theme) {
       this.config.theme = this.state.defaultColorSchema;
@@ -14808,6 +15130,8 @@ class BaseWidget extends HTMLElement {
   }
   showError(failureKind = "authentication") {
     this.hideLoader();
+    this.errorScreenShown = true;
+    this.lateEmbedTokenRegistrationReload = failureKind === "authentication" && isEmbedTokenRejected(this.state.lastAuthError) && !this.readEmbedTokenProvider();
     const settings = this.state.errorSettings;
     const presentation = selectWidgetErrorPresentation({
       failureKind,
@@ -14978,29 +15302,61 @@ class BaseWidget extends HTMLElement {
     }
   }
   // ── Initialization ─────────────────────────────────────────────────────
+  /**
+   * Starts a new init: it owns a fresh state object and its own auth-session
+   * subscription. The previous init's in-flight work keeps the retired state,
+   * so it can finish but never writes this init's state or storage. It still
+   * publishes to the session it started on; after a same-member reload that is
+   * the same shared session this init joined, which is intended (siblings and
+   * this init get the result).
+   */
+  beginInit() {
+    const initId = ++this.initGeneration;
+    const retired = this.state;
+    if (retired.refreshTimer) clearTimeout(retired.refreshTimer);
+    if (retired.syncTimer) clearInterval(retired.syncTimer);
+    retired.refreshTimer = null;
+    retired.syncTimer = null;
+    retireWidgetState(retired);
+    const state = forkWidgetState(retired);
+    this.state = state;
+    const previousSession = this.authSession;
+    this.authSession = void 0;
+    if (this.config.communityId && !this.config.authUrl) {
+      let subscribing = true;
+      this.authSession = subscribeAuthSession(this.config, state, () => {
+        if (this.state !== state) return;
+        if (state.isAuthenticated && !state.lastAuthError) {
+          this.authRenewalRecovery.succeeded();
+        }
+        if (this.config.autoRefresh && !state.lastAuthError) {
+          if (!subscribing) {
+            this.scheduleRefresh();
+          } else if (state.accessTokenExpiry && calculateRefreshDelay(state.accessTokenExpiry) > 0) {
+            this.scheduleRefresh();
+          }
+        }
+        if (state.iframe) {
+          sendTokenToWidget(this.config, state, state.iframe);
+        }
+        syncBundleAccessToken(this.config, state);
+      });
+      subscribing = false;
+    }
+    previousSession == null ? void 0 : previousSession.release();
+    return initId;
+  }
   async init() {
     var _a, _b;
     (_a = this.cancelBundleForegroundRecovery) == null ? void 0 : _a.call(this);
     this.cancelBundleForegroundRecovery = void 0;
     this.authRenewalRecovery.cancel();
-    const initId = ++this.initGeneration;
+    const initId = this.beginInit();
     this.hasAttemptedInit = true;
     if (!this.config.communityId) {
       this.showError();
       return;
     }
-    if (!this.config.authUrl && !this.authSession) {
-      this.authSession = subscribeAuthSession(this.config, this.state, () => {
-        if (this.state.isAuthenticated && !this.state.lastAuthError) {
-          this.authRenewalRecovery.succeeded();
-        }
-        if (this.config.autoRefresh) this.scheduleRefresh();
-        if (this.state.iframe) {
-          sendTokenToWidget(this.config, this.state, this.state.iframe);
-        }
-        syncBundleAccessToken(this.config, this.state);
-      });
-    }
     if (this.config.bundleUrl) {
       this.prepareBundleRuntimeEnvironment();
       warmBundleRuntime(
@@ -15008,6 +15364,7 @@ class BaseWidget extends HTMLElement {
         this.config.bundleUrl
       );
     }
+    const renewal = this.embedTokenRenewal(initId);
     const finishStartup = (authentication) => resolveStartupAuthentication(
       authentication,
       (options) => fetchErrorSettings(this.config, this.state, options)
@@ -15015,6 +15372,9 @@ class BaseWidget extends HTMLElement {
     const launchWidget = () => {
       var _a2;
       if (!this.isCurrentInit(initId)) return;
+      this.launchedInitId = initId;
+      this.lateEmbedTokenRegistrationReload = false;
+      this.errorScreenShown = false;
       (_a2 = this.errorEl) == null ? void 0 : _a2.classList.remove("visible");
       this.shadow.querySelectorAll(".rai-custom-error").forEach((el2) => el2.remove());
       let bannerGated = false;
@@ -15038,11 +15398,9 @@ class BaseWidget extends HTMLElement {
     };
     if (this.config.authUrl) {
       const authed2 = await finishStartup(
-        authenticateViaProxy(
-          this.config,
-          this.state,
-          () => this.scheduleRefresh()
-        )
+        authenticateViaProxy(this.config, this.state, () => {
+          if (initId === this.initGeneration) this.scheduleRefresh();
+        })
       );
       if (!this.isCurrentInit(initId)) return;
       if (authed2) {
@@ -15059,10 +15417,11 @@ class BaseWidget extends HTMLElement {
       const authed2 = await finishStartup(
         this.authSession ? this.authSession.run(
           "authenticate",
-          () => authenticateServerless(this.config, this.state)
+          () => authenticateServerless(this.config, this.state, renewal)
         ) : authenticateServerless(
           this.config,
           this.state,
+          renewal,
           () => this.scheduleRefresh()
         )
       );
@@ -15089,10 +15448,11 @@ class BaseWidget extends HTMLElement {
       const refreshed = await finishStartup(
         this.authSession ? this.authSession.run(
           "refresh",
-          () => refreshAccessToken(this.config, this.state)
+          () => refreshAccessToken(this.config, this.state, renewal)
         ) : refreshAccessToken(
           this.config,
           this.state,
+          renewal,
           () => this.scheduleRefresh()
         )
       );
@@ -15109,10 +15469,11 @@ class BaseWidget extends HTMLElement {
     const authed = await finishStartup(
       this.authSession ? this.authSession.run(
         "authenticate",
-        () => authenticateServerless(this.config, this.state)
+        () => authenticateServerless(this.config, this.state, renewal)
       ) : authenticateServerless(
         this.config,
         this.state,
+        renewal,
         () => this.scheduleRefresh()
       )
     );
@@ -15154,6 +15515,8 @@ class BaseWidget extends HTMLElement {
   }
   createIframe() {
     this.teardownMountedWidget();
+    const session = this.authSession;
+    const initId = this.initGeneration;
     const iframe = document.createElement("iframe");
     iframe.src = this.buildWidgetUrl(this.config);
     iframe.allow = "clipboard-write";
@@ -15181,7 +15544,14 @@ class BaseWidget extends HTMLElement {
       this.state,
       this.shadow,
       iframe,
-      () => this.scheduleRefresh(),
+      // A token the iframe asks for can renew the session outside the shared
+      // auth session. Publish it: the next session refresh would otherwise
+      // copy the old snapshot back and present a rotated-away refresh token,
+      // which the server treats as reuse once its 60 s grace has passed.
+      () => {
+        if (session) session.publish();
+        else if (initId === this.initGeneration) this.scheduleRefresh();
+      },
       () => this.logoutAndClear(),
       () => this.hideLoader(),
       (type, detail) => this.emit(type, detail),
@@ -15286,7 +15656,7 @@ class BaseWidget extends HTMLElement {
         // host page. Bundle consumers use this explicit contract instead of
         // inferring the SDK host element from their rendered DOM.
         autoHeight,
-        requestHostCallback: (callbackName, payload) => dispatchHostCallback({
+        requestHostCallback: Object.defineProperty((callbackName, payload) => dispatchHostCallback({
           callbacks: this.readRuntimeCallbacks(),
           callbackName,
           payload: enrichHostCallbackPayload(
@@ -15295,6 +15665,8 @@ class BaseWidget extends HTMLElement {
           ),
           hostWidgetType: this.config.widgetType,
           transport: "bundle"
+        }), "supportedCallbacks", {
+          get: () => getSupportedHostCallbacks(this.readRuntimeCallbacks(), this.config.widgetType)
         })
       });
       const resolvedMountResult = await resolveBundleMountResult(mountResult);
@@ -15361,30 +15733,29 @@ class BaseWidget extends HTMLElement {
   }
   async performScheduledRefresh() {
     this.state.refreshTimer = null;
+    const initId = this.initGeneration;
+    const { state, config, authSession } = this;
+    const current = () => initId === this.initGeneration;
     const pushToken = () => {
-      if (this.state.iframe)
-        sendTokenToWidget(this.config, this.state, this.state.iframe);
-      syncBundleAccessToken(this.config, this.state);
+      if (!current()) return;
+      if (state.iframe) sendTokenToWidget(config, state, state.iframe);
+      syncBundleAccessToken(config, state);
+    };
+    const rearm = () => {
+      if (current()) this.scheduleRefresh();
     };
     let ok;
-    if (this.config.authUrl) {
-      ok = await authenticateViaProxy(
-        this.config,
-        this.state,
-        () => this.scheduleRefresh()
-      );
+    if (config.authUrl) {
+      ok = await authenticateViaProxy(config, state, rearm);
       if (ok) pushToken();
     } else {
-      ok = this.authSession ? await this.authSession.run(
+      const renewal = this.embedTokenRenewal(initId);
+      ok = authSession ? await authSession.run(
         "refresh",
-        () => refreshAccessToken(this.config, this.state)
-      ) : await refreshAccessToken(
-        this.config,
-        this.state,
-        () => this.scheduleRefresh(),
-        pushToken
-      );
+        () => refreshAccessToken(config, state, renewal)
+      ) : await refreshAccessToken(config, state, renewal, rearm, pushToken);
     }
+    if (initId !== this.initGeneration) return;
     if (ok) {
       this.authRenewalRecovery.succeeded();
     } else if (isPermanentAuthFailure(this.state.lastAuthError)) {
@@ -15427,12 +15798,15 @@ class BaseWidget extends HTMLElement {
   }
   // ── Logout helper ─────────────────────────────────────────────────────
   async logoutAndClear() {
-    var _a;
+    const initId = this.initGeneration;
+    const session = this.authSession;
     this.authRenewalRecovery.cancel();
     await logout(this.config, this.state);
-    (_a = this.authSession) == null ? void 0 : _a.clear();
-    this.teardownMountedWidget();
-    this.removeBanner();
+    session == null ? void 0 : session.clear();
+    if (initId === this.initGeneration) {
+      this.teardownMountedWidget();
+      this.removeBanner();
+    }
     this.emit("rai-logout");
   }
   // ── Public API ────────────────────────────────────────────────────────
@@ -15444,13 +15818,13 @@ class BaseWidget extends HTMLElement {
     this.authSession = void 0;
     this.config = readConfig(this, (_b = this.config) == null ? void 0 : _b.communityId);
     this.identitySignature = identitySignatureForConfig(this.config);
+    this.lastEmbedTokenAttribute = this.config.embedToken;
     this.style.width = this.config.width;
     this.style.height = this.config.height;
     clearStorage(previousConfig);
     clearStorage(this.config);
     this.teardownMountedWidget();
     this.removeBanner();
-    clearState(this.state);
     this.applyFirstPaintColors();
     this.showLoader();
     await this.init();
@@ -15588,7 +15962,7 @@ class CustomWidget extends BaseWidget {
     }
   }
 }
-console.log(`[rai-widget] v${"1.8.13"}`);
+console.log(`[rai-widget] v${"1.8.14"}`);
 class StoreWidgetCompat extends StoreWidget {
 }
 const WIDGET_REGISTRY = [
@@ -15652,7 +16026,7 @@ function exposePublicApi() {
   })();
   const widget = container == null ? void 0 : container.querySelector(ALL_WIDGET_SELECTOR);
   window.ReturningAIWidget = {
-    version: "1.8.13",
+    version: "1.8.14",
     reload: () => (widget == null ? void 0 : widget.reload()) ?? Promise.resolve(),
     logout: () => (widget == null ? void 0 : widget.logoutPublic()) ?? Promise.resolve(),
     isAuthenticated: () => (widget == null ? void 0 : widget.isAuthenticated()) ?? false,