@syntrologie/adapt-chatbot 2.29.0 → 2.29.1

package/dist/elements/fetcher.d.ts

@@ -5,10 +5,11 @@
  * `packages/runtime-sdk/src/overlays/fetcher.ts` for the sibling pattern
  * — no shared HTTP client, no axios, no fetch wrapper).
  *
- * Auth: forwards the SDK token from `window.__SYNTRO_CONFIG__.token`
- * as a Bearer header, plus the runtime's visitor ids (`X-Distinct-Id` /
- * `X-Syntro-Session`) so the backend rehydrates mounts under the same
- * session-keyed Redis state the chat persisted to.
+ * Auth: forwards the caller-supplied SDK token (from the runtime handle,
+ * the single source `Syntro.init` populates — BUG-1785360157: never a
+ * window global) as a Bearer header, plus the runtime's visitor ids
+ * (`X-Distinct-Id` / `X-Syntro-Session`) so the backend rehydrates
+ * mounts under the same session-keyed Redis state the chat persisted to.
  *
  * 404 contract: the backend returns 404 only when the workspace's SDK
  * token doesn't resolve to a workspace. The SDK treats 404 as
@@ -22,7 +23,9 @@ export interface FetchMountedElementsOptions {
      *  `/api/adaptive/mounted_elements`). Tests + multi-environment
      *  deploys use this. */
     endpoint?: string;
-    /** SDK token. Defaults to `window.__SYNTRO_CONFIG__.token`. */
+    /** SDK token from the runtime handle (`runtime.token`). Absent →
+     *  unauthenticated request; the backend 401s and the caller's null
+     *  contract kicks in. No window-global fallback (BUG-1785360157). */
     token?: string;
     /** Custom fetch implementation — used by tests to mock the network. */
     fetchImpl?: typeof fetch;

package/dist/elements/fetcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetcher.d.ts","sourceRoot":"","sources":["../../src/elements/fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAIvD,MAAM,WAAW,2BAA2B;IAC1C;;4BAEwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oDAAoD;IACpD,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA2DzC"}
+{"version":3,"file":"fetcher.d.ts","sourceRoot":"","sources":["../../src/elements/fetcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAIvD,MAAM,WAAW,2BAA2B;IAC1C;;4BAEwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;yEAEqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oDAAoD;IACpD,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CA2DzC"}

package/dist/runtime.js

@@ -9,7 +9,7 @@ import {
   decodeMutationEnvelope,
   fetchMountedElements,
   renderFallbackHtml
-} from "./chunk-ZXV4GXMO.js";
+} from "./chunk-A3TIGA4G.js";
 import {
   pickPersona
 } from "./chunk-FXHYE6FY.js";
@@ -364,10 +364,8 @@ var chatSession = new ChatSession();
 // src/ChatTransport.ts
 var SESSION_READ_DEADLINE_MS = 6e4;
 var FALLBACK_DEBOUNCE_MS = 1500;
-function readSyntroToken() {
-  if (typeof window === "undefined") return void 0;
-  const cfg = window.__SYNTRO_CONFIG__;
-  const token = cfg?.token;
+function readRuntimeToken(runtime2) {
+  const token = runtime2?.token;
   return typeof token === "string" && token.length > 0 ? token : void 0;
 }
 function debug(...args) {
@@ -649,7 +647,7 @@ var ChatTransport = class {
     const baseUrl = this._config.backendUrl.replace(/\/$/, "");
     const url = `${baseUrl}/api/adaptive/session`;
     const headers = {};
-    const token = readSyntroToken();
+    const token = readRuntimeToken(this._config?.runtime);
     if (token) headers.Authorization = `Bearer ${token}`;
     const cft = await this._acquireTurnstileWithChallenge();
     if (cft) headers["CF-Turnstile-Token"] = cft;
@@ -932,7 +930,7 @@ var ChatTransport = class {
       if (this._config === null) return false;
       const baseUrl = this._config.backendUrl.replace(/\/$/, "");
       const streamUrl = `${baseUrl}/api/adaptive/stream`;
-      const token = readSyntroToken();
+      const token = readRuntimeToken(this._config?.runtime);
       const buildHeaders = () => {
         const h = {};
         if (token) h.Authorization = `Bearer ${token}`;
@@ -1814,7 +1812,7 @@ function hydrateOnce(runtime2, backendUrl) {
   const store = getOrCreateElementStore(runtime2);
   const trimmed = backendUrl.replace(/\/$/, "");
   const endpoint = trimmed ? `${trimmed}/api/adaptive/mounted_elements` : "/api/adaptive/mounted_elements";
-  fetchMountedElements({ endpoint }).then((response) => {
+  fetchMountedElements({ endpoint, token: runtime2.token }).then((response) => {
     if (!response) return;
     void store.hydrate(response.mounted_elements);
   });
@@ -1866,7 +1864,7 @@ function wireNudgeSurface(runtime2, backendUrl) {
         const store = getOrCreateElementStore(runtime2);
         const trimmed = backendUrl.replace(/\/$/, "");
         const endpoint = trimmed ? `${trimmed}/api/adaptive/mounted_elements` : "/api/adaptive/mounted_elements";
-        void fetchMountedElements({ endpoint }).then((response) => {
+        void fetchMountedElements({ endpoint, token: runtime2.token }).then((response) => {
           if (!response) return;
           void store.hydrate(response.mounted_elements);
         });
@@ -1905,7 +1903,7 @@ function configureTransportIfPossible(cfg) {
   const elementsActive = cfg.elementsEnabled === true && cfg.uiTemplates != null;
   refreshTemplateWidgetMap(elementsActive ? cfg.uiTemplates : void 0);
   const forwardedProps = elementsActive ? { elementsEnabled: true, uiTemplates: cfg.uiTemplates } : void 0;
-  if (elementsActive) publishTemplatesIfPossible(backendUrl, cfg.uiTemplates);
+  if (elementsActive) publishTemplatesIfPossible(backendUrl, cfg.uiTemplates, cfg.runtime?.token);
   const runtime2 = cfg.runtime;
   const onElementMutation = elementsActive ? (mutations) => {
     void getOrCreateElementStore(runtime2).apply(mutations);
@@ -1929,12 +1927,10 @@ function configureTransportIfPossible(cfg) {
   startObserverIfPossible(cfg);
 }
 var _templatesPublished = false;
-function publishTemplatesIfPossible(backendUrl, uiTemplates) {
+function publishTemplatesIfPossible(backendUrl, uiTemplates, token) {
   if (_templatesPublished || typeof window === "undefined") return;
   if (!uiTemplates || typeof uiTemplates !== "object") return;
   _templatesPublished = true;
-  const cfg = window.__SYNTRO_CONFIG__;
-  const token = typeof cfg?.token === "string" && cfg.token.length > 0 ? cfg.token : void 0;
   const headers = { "Content-Type": "application/json" };
   if (token) headers.Authorization = `Bearer ${token}`;
   const trimmed = backendUrl.replace(/\/$/, "");
@@ -1992,8 +1988,8 @@ function startObserverIfPossible(cfg) {
   const getDistinctId = () => runtimeId("getDistinctId");
   const getSessionId = () => runtimeId("getSessionId");
   const token = () => {
-    const c = window.__SYNTRO_CONFIG__;
-    return typeof c?.token === "string" ? c.token : "";
+    const t = runtimeRef.token;
+    return typeof t === "string" ? t : "";
   };
   const enrich = buildObserverEnrich(runtimeRef);
   const handle = startObserver({ url, token, getDistinctId, getSessionId, enrich });