@syntrologie/adapt-chatbot 2.8.0-canary.244 → 2.8.0-canary.245

package/dist/ChatAssistantLit.d.ts

@@ -4,9 +4,34 @@
  * Thin wrapper that mounts <syntro-chat> from @syntrologie/chat with an
  * SsePostTransport pointed at the adaptive SSE backend.
  *
- * The old hand-rolled ChatAssistantElement (Lit component with inline
- * styles, message management, and action parsing) is fully replaced by
- * the shared @syntrologie/chat package.
+ * Four pieces this mountable owns:
+ *
+ * 1. SDK token plumbing. The chat backend (`/api/adaptive/*`) is identified
+ *    by the workspace's `syn_*` SDK token. The token lives on
+ *    `window.__SYNTRO_CONFIG__.token` (set by runtime-config.js) — we read
+ *    it at mount time and forward it on both transports:
+ *      • SSE GET — append `?syn=${token}` to the URL. Browser EventSource
+ *        cannot set custom headers; the URL is the only channel.
+ *      • POST `/action` — `Authorization: Bearer ${token}` header.
+ *
+ * 2. Cloudflare Turnstile bot-check token. When `TURNSTILE_SITEKEY` is set
+ *    (hardcoded at the top of this file — operator updates after running
+ *    terraform apply on cloudflare/turnstile in the infra repo), the
+ *    widget dynamically loads Cloudflare's Turnstile JS, renders an
+ *    invisible widget, and acquires a token before opening the SSE
+ *    connection. The token is forwarded on both transports the same way
+ *    the SDK token is — `?cft=` on SSE GET, `CF-Turnstile-Token` on POST.
+ *    If sitekey is empty (default), this step is skipped entirely.
+ *
+ * 3. Fallback card. If the SSE connection fails before any successful event
+ *    (Cloudflare Turnstile bot-check failure, CORS / network error, or a
+ *    server-side rejection), swap the chat UI for a per-customer fallback
+ *    card built from `props.fallback`. The end-user is redirected to the
+ *    customer's normal support path instead of seeing a raw error.
+ *
+ * 4. A2UI passthrough. SSE-borne A2UI events (createSurface, updateDataModel,
+ *    …) get forwarded to `runtime.actions.applyBatch` so tiles can render
+ *    server-driven UI inside the chat surface.
  */
 import '@syntrologie/chat';
 import type { ChatbotConfig, ChatbotWidgetRuntime } from './types.js';
@@ -15,6 +40,21 @@ export interface ChatAssistantLitProps {
     runtime: ChatbotWidgetRuntime;
     tileId?: string;
 }
+/**
+ * Acquire a Cloudflare Turnstile token. Returns null when:
+ *   • TURNSTILE_SITEKEY is empty (Turnstile disabled at build time)
+ *   • the script fails to load (customer CSP blocks Cloudflare, etc.)
+ *   • the render callback doesn't fire within TURNSTILE_ACQUIRE_TIMEOUT_MS
+ *   • Cloudflare returns an error-callback (e.g., rate-limited, bad sitekey)
+ *
+ * When null is returned, the widget proceeds WITHOUT a Turnstile token.
+ * If backend enforcement is on, the request 403s and the fallback card
+ * renders via the existing failure-detection path. If enforcement is off,
+ * the request succeeds.
+ *
+ * Exported for tests; the production code path goes through `mount()`.
+ */
+export declare function acquireTurnstileToken(): Promise<string | null>;
 export declare const ChatAssistantLitMountable: {
     mount(container: HTMLElement, mountConfig?: Record<string, unknown>): () => void;
 };

package/dist/ChatAssistantLit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ChatAssistantLit.d.ts","sourceRoot":"","sources":["../src/ChatAssistantLit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,mBAAmB,CAAC;AAI3B,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAcD,eAAO,MAAM,yBAAyB;qBACnB,WAAW,gBAAgB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAoDpE,CAAC"}
+{"version":3,"file":"ChatAssistantLit.d.ts","sourceRoot":"","sources":["../src/ChatAssistantLit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,mBAAmB,CAAC;AAK3B,OAAO,KAAK,EAAE,aAAa,EAAmB,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAyHD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkDpE;AAiGD,eAAO,MAAM,yBAAyB;qBACnB,WAAW,gBAAgB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAwOpE,CAAC"}

package/dist/ChatAssistantLit.js

@@ -1,8 +1,10 @@
 import {
-  ChatAssistantLitMountable
-} from "./chunk-FM7MU2YX.js";
+  ChatAssistantLitMountable,
+  acquireTurnstileToken
+} from "./chunk-DUQTO5RE.js";
 import "./chunk-V6TY7KAL.js";
 export {
-  ChatAssistantLitMountable
+  ChatAssistantLitMountable,
+  acquireTurnstileToken
 };
 //# sourceMappingURL=ChatAssistantLit.js.map

package/dist/{chunk-FM7MU2YX.js → chunk-DUQTO5RE.js}

@@ -3218,8 +3218,12 @@ var SsePostTransport = class {
     return this._connected;
   }
   connect(sessionId) {
-    const url = sessionId ? `${this._sseUrl}?sessionId=${encodeURIComponent(sessionId)}` : this._sseUrl;
-    this._eventSource = new EventSource(url, { withCredentials: true });
+    const baseOrigin = typeof window !== "undefined" && window.location ? window.location.origin : "http://localhost";
+    const url = new URL(this._sseUrl, baseOrigin);
+    if (sessionId) {
+      url.searchParams.set("sessionId", sessionId);
+    }
+    this._eventSource = new EventSource(url.toString(), { withCredentials: true });
     this._eventSource.onopen = () => {
       this._connected = true;
     };
@@ -3277,12 +3281,330 @@ var SsePostTransport = class {
   }
 };
 
+// ../../sdk-contracts/dist/mount-plumbing.js
+var MOUNT_PLUMBING_KEYS = ["instanceId", "runtime", "tileId"];
+function stripMountPlumbing(config) {
+  if (!config || typeof config !== "object") {
+    return {};
+  }
+  const out = { ...config };
+  for (const key of MOUNT_PLUMBING_KEYS) {
+    delete out[key];
+  }
+  return out;
+}
+
+// ../../sdk-contracts/dist/schemas.js
+import { z as z2 } from "zod";
+var AnchorIdZ = z2.object({
+  selector: z2.string(),
+  route: z2.union([z2.string(), z2.array(z2.string())])
+}).strict();
+var AuthoringFieldsZ = {
+  title: z2.string().max(200).optional().describe("Authoring-only: short label shown on the action plan dashboard. Stripped before serving to the runtime SDK."),
+  description: z2.string().max(1e3).optional().describe("Authoring-only: one-sentence explanation of what this action does and why. Stripped before serving to the runtime SDK."),
+  validation: z2.array(z2.string().max(500)).max(10).optional().describe("Authoring-only: ordered steps a reviewer can follow to trigger this action and visually confirm it works. Each entry is one step. Stripped before serving to the runtime SDK.")
+};
+var COUNTABLE_EVENTS = [
+  // User interactions (from PostHog autocapture normalization)
+  "ui.click",
+  "ui.scroll",
+  "ui.input",
+  "ui.change",
+  "ui.submit",
+  // Behavioral detectors (from event-processor)
+  "ui.hover",
+  "ui.idle",
+  "ui.scroll_thrash",
+  "ui.focus_bounce",
+  // Navigation
+  "nav.page_view",
+  "nav.page_leave",
+  // Derived behavioral signals
+  "behavior.rage_click",
+  "behavior.hesitation",
+  "behavior.confusion"
+];
+var CountableEventZ = z2.enum(COUNTABLE_EVENTS).describe("Event name to count. ui.* = user interactions and behavioral detectors, nav.* = page navigation, behavior.* = derived behavioral signals.");
+var SESSION_METRIC_KEYS = ["time_on_page", "page_views", "scroll_depth"];
+var SessionMetricKeyZ = z2.enum(SESSION_METRIC_KEYS).describe("Session metric key. time_on_page = seconds on current page, page_views = pages visited this session, scroll_depth = 0-100 percentage.");
+var PageUrlConditionZ = z2.object({
+  type: z2.literal("page_url"),
+  url: z2.string().describe('URL path to match (e.g. "/pricing", "/dashboard")')
+}).describe('Fires when the current page URL matches. Use for page-specific actions. Example: {"type": "page_url", "url": "/pricing"}');
+var RouteConditionZ = z2.object({
+  type: z2.literal("route"),
+  routeId: z2.string().describe("Named route ID from the route filter")
+}).describe("Fires when the current route matches a named route ID.");
+var AnchorVisibleConditionZ = z2.object({
+  type: z2.literal("anchor_visible"),
+  anchorId: z2.string().describe("CSS selector of the anchor element"),
+  state: z2.enum(["visible", "present", "absent"]).describe('"visible" = in viewport, "present" = in DOM, "absent" = not in DOM')
+}).describe(`Fires based on a DOM element's visibility state. Example: {"type": "anchor_visible", "anchorId": "#cta-button", "state": "visible"}`);
+var EventOccurredConditionZ = z2.object({
+  type: z2.literal("event_occurred"),
+  eventName: z2.string().describe('Event name (e.g. "ui.click", "$pageview")'),
+  withinMs: z2.number().optional().describe("Time window in ms. Omit = any time this session.")
+}).describe('Fires when a specific event has occurred during this session. Example: {"type": "event_occurred", "eventName": "ui.click", "withinMs": 5000}');
+var StateEqualsConditionZ = z2.object({
+  type: z2.literal("state_equals"),
+  key: z2.string().describe("Key in the SDK persistent state store (localStorage). Only valid for keys the host app explicitly sets via syntro.state.set()."),
+  value: z2.unknown().describe("Expected value to match against")
+}).describe("Checks the SDK persistent state store (localStorage). ONLY for host-app state set via syntro.state.set() \u2014 NOT for user attributes like region, device, or UTM params (those are handled by segment targeting). Do NOT use this for targeting. If you do not know the valid state keys, do not use this condition type.");
+var ViewportConditionZ = z2.object({
+  type: z2.literal("viewport"),
+  minWidth: z2.number().optional().describe("Minimum viewport width in pixels"),
+  maxWidth: z2.number().optional().describe("Maximum viewport width in pixels"),
+  minHeight: z2.number().optional().describe("Minimum viewport height in pixels"),
+  maxHeight: z2.number().optional().describe("Maximum viewport height in pixels")
+}).describe('Fires based on viewport (screen) size. Use for responsive behavior. Example: {"type": "viewport", "minWidth": 768} \u2014 fires on tablet and larger.');
+var SessionMetricConditionZ = z2.object({
+  type: z2.literal("session_metric"),
+  key: SessionMetricKeyZ,
+  operator: z2.enum(["gte", "lte", "eq", "gt", "lt"]),
+  threshold: z2.number().describe("Numeric threshold to compare against")
+}).describe('Fires when a session metric crosses a threshold. Valid keys: "time_on_page" (seconds), "page_views" (count), "scroll_depth" (0-100). Example: {"type": "session_metric", "key": "time_on_page", "operator": "gte", "threshold": 30}');
+var DismissedConditionZ = z2.object({
+  type: z2.literal("dismissed"),
+  key: z2.string().describe("Dismissal key (usually a tile or action ID)"),
+  inverted: z2.boolean().optional().describe("When true, fires if NOT dismissed (default behavior)")
+}).describe("Checks if an item has been dismissed by the user. Use with inverted: true to show only if not dismissed.");
+var CooldownActiveConditionZ = z2.object({
+  type: z2.literal("cooldown_active"),
+  key: z2.string().describe("Cooldown key"),
+  inverted: z2.boolean().optional().describe("When true, fires if cooldown is NOT active")
+}).describe("Checks if a cooldown timer is currently active. Use to prevent showing the same intervention too frequently.");
+var FrequencyLimitConditionZ = z2.object({
+  type: z2.literal("frequency_limit"),
+  key: z2.string().describe("Frequency counter key"),
+  limit: z2.number().describe("Maximum allowed count"),
+  inverted: z2.boolean().optional().describe("When true, fires if limit NOT reached")
+}).describe("Checks if a frequency limit has been reached. Use to cap how many times an action fires per session.");
+var MatchOpZ = z2.object({
+  equals: z2.union([z2.string(), z2.number(), z2.boolean()]).optional(),
+  contains: z2.string().optional()
+}).describe("Match operator for counter filters. Exactly one of equals or contains must be specified.");
+var CounterDefZ = z2.object({
+  events: z2.array(CountableEventZ).min(1).describe("Event names to count. Use values from the countable events enum."),
+  match: z2.record(z2.string(), MatchOpZ).optional().describe("Property filters. Keys are event prop names or element-chain fields (tag_name, $el_text, attr__*). All entries AND together.")
+}).describe("Defines what events to count. Registered as an accumulator predicate at config-load time.");
+var EventCountConditionZ = z2.object({
+  type: z2.literal("event_count"),
+  key: z2.string().describe("Unique key for this counter (used for accumulator registration)"),
+  operator: z2.enum(["gte", "lte", "eq", "gt", "lt"]),
+  count: z2.number().int().min(0).describe("Target count threshold"),
+  withinMs: z2.number().positive().optional().describe("Time window in ms. Omit = count across entire session."),
+  counter: CounterDefZ.optional().describe("Inline counter definition. Defines what events to count.")
+}).describe('Fires when accumulated event count crosses a threshold. Most powerful trigger type. Example: {"type": "event_count", "key": "pricing-clicks", "operator": "gte", "count": 3, "counter": {"events": ["ui.click"], "match": {"attr__data-cta": {"contains": "pricing"}}}}');
+var ConditionZ = z2.discriminatedUnion("type", [
+  PageUrlConditionZ,
+  RouteConditionZ,
+  AnchorVisibleConditionZ,
+  EventOccurredConditionZ,
+  StateEqualsConditionZ,
+  ViewportConditionZ,
+  SessionMetricConditionZ,
+  DismissedConditionZ,
+  CooldownActiveConditionZ,
+  FrequencyLimitConditionZ,
+  EventCountConditionZ
+]);
+var RuleZ = z2.object({
+  conditions: z2.array(ConditionZ).describe("Array of conditions \u2014 ALL must match (AND logic) for this rule to fire."),
+  value: z2.unknown().describe("Value returned when all conditions match. For triggerWhen: true = fire the action.")
+}).describe("A single rule. ALL conditions must match (AND logic). Rules in a strategy are evaluated top-to-bottom \u2014 first rule where all conditions match wins and returns its value.");
+var RuleStrategyZ = z2.object({
+  type: z2.literal("rules"),
+  rules: z2.array(RuleZ).describe("Ordered list of rules. Evaluated top-to-bottom \u2014 first match wins."),
+  default: z2.unknown().describe("Fallback value when no rule matches. For triggerWhen: false = do not fire by default.")
+}).describe("Rule-based strategy. Evaluates rules top-to-bottom. First rule where ALL conditions match returns its value. If no rule matches, returns default. For triggerWhen: set value=true on matching rules, default=false.");
+var ScoreStrategyZ = z2.object({
+  type: z2.literal("score"),
+  field: z2.string(),
+  threshold: z2.number(),
+  above: z2.unknown(),
+  below: z2.unknown()
+}).describe("Score-based strategy. Compares a field value against a threshold.");
+var ModelStrategyZ = z2.object({
+  type: z2.literal("model"),
+  modelId: z2.string(),
+  inputs: z2.array(z2.string()),
+  outputMapping: z2.record(z2.string(), z2.unknown()),
+  default: z2.unknown()
+}).describe("ML model strategy. Sends inputs to a model and maps outputs.");
+var ExternalStrategyZ = z2.object({
+  type: z2.literal("external"),
+  endpoint: z2.string(),
+  method: z2.enum(["GET", "POST"]).optional(),
+  default: z2.unknown(),
+  timeoutMs: z2.number().optional()
+}).describe("External API strategy. Calls an endpoint to determine the value.");
+var DecisionStrategyZ = z2.discriminatedUnion("type", [
+  RuleStrategyZ,
+  ScoreStrategyZ,
+  ModelStrategyZ,
+  ExternalStrategyZ
+]);
+var TriggerWhenZ = DecisionStrategyZ.nullable().optional();
+var EventScopeZ = z2.object({
+  events: z2.array(z2.string()),
+  urlContains: z2.string().optional(),
+  props: z2.record(z2.union([z2.string(), z2.number(), z2.boolean()])).optional()
+});
+var NotifyZ = z2.object({
+  title: z2.string().optional(),
+  body: z2.string().optional(),
+  icon: z2.string().optional()
+}).nullable().optional();
+
 // src/ChatAssistantLit.ts
+var ERROR_DEBOUNCE_MS = 1500;
+var FAILURE_DETECTION_TIMEOUT_MS = 6e3;
+var TURNSTILE_SITEKEY = "0x4AAAAAADSzPbGWxeguF4YJ";
+var TURNSTILE_ACQUIRE_TIMEOUT_MS = 5e3;
+var TURNSTILE_SCRIPT_URL = "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit";
+function loadTurnstileScript() {
+  if (typeof window === "undefined") {
+    return Promise.reject(new Error("no window"));
+  }
+  const w2 = window;
+  if (w2.turnstile) return Promise.resolve(w2.turnstile);
+  return new Promise((resolve, reject) => {
+    const existing = document.querySelector(
+      'script[src^="https://challenges.cloudflare.com/turnstile/v0/api.js"]'
+    );
+    const onLoad = () => {
+      const t = window.turnstile;
+      if (t) resolve(t);
+      else reject(new Error("turnstile global not present after load"));
+    };
+    const onError = () => reject(new Error("turnstile script failed to load"));
+    if (existing) {
+      existing.addEventListener("load", onLoad);
+      existing.addEventListener("error", onError);
+      return;
+    }
+    const script = document.createElement("script");
+    script.src = TURNSTILE_SCRIPT_URL;
+    script.async = true;
+    script.defer = true;
+    script.addEventListener("load", onLoad);
+    script.addEventListener("error", onError);
+    document.head.appendChild(script);
+  });
+}
+async function acquireTurnstileToken() {
+  if (!TURNSTILE_SITEKEY) return null;
+  if (typeof window === "undefined" || typeof document === "undefined") return null;
+  let turnstile;
+  try {
+    turnstile = await Promise.race([
+      loadTurnstileScript(),
+      new Promise(
+        (_2, reject) => setTimeout(() => reject(new Error("turnstile load timeout")), TURNSTILE_ACQUIRE_TIMEOUT_MS)
+      )
+    ]);
+  } catch {
+    return null;
+  }
+  return new Promise((resolve) => {
+    const host = document.createElement("div");
+    host.style.cssText = "position:absolute;top:-9999px;left:-9999px;width:0;height:0;overflow:hidden;";
+    host.setAttribute("data-adaptive-chatbot-turnstile-host", "true");
+    document.body.appendChild(host);
+    let settled = false;
+    const settle = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      setTimeout(() => host.remove(), 0);
+      resolve(value);
+    };
+    const timer = setTimeout(() => settle(null), TURNSTILE_ACQUIRE_TIMEOUT_MS);
+    try {
+      turnstile.render(host, {
+        sitekey: TURNSTILE_SITEKEY,
+        size: "invisible",
+        callback: (token) => settle(token),
+        "error-callback": () => settle(null),
+        "timeout-callback": () => settle(null),
+        "expired-callback": () => settle(null)
+      });
+    } catch {
+      settle(null);
+    }
+  });
+}
+function readSyntroToken() {
+  if (typeof window === "undefined") return void 0;
+  const cfg = window.__SYNTRO_CONFIG__;
+  const token = cfg?.token;
+  return typeof token === "string" && token.startsWith("syn_") ? token : void 0;
+}
+var FALLBACK_DEFAULTS = {
+  title: "Live chat is unavailable right now",
+  message: "We couldn't verify your browser. Reach our team another way and we'll get back to you.",
+  ctaLabel: "Contact support"
+};
+function renderFallbackHtml(fallback) {
+  const title = fallback?.title ?? FALLBACK_DEFAULTS.title;
+  const message = fallback?.message ?? FALLBACK_DEFAULTS.message;
+  const ctaLabel = fallback?.ctaLabel ?? FALLBACK_DEFAULTS.ctaLabel;
+  const ctaHref = fallback?.ctaHref;
+  const wrapperStyle = [
+    "display:flex",
+    "flex-direction:column",
+    "gap:12px",
+    "padding:20px",
+    "height:100%",
+    "background:var(--sc-content-background,'transparent')",
+    "color:var(--sc-content-text-color,'#1a1a1a')",
+    "font-family:var(--sc-font-family,'system-ui')"
+  ].join(";");
+  const titleStyle = "font-size:15px;font-weight:600;line-height:1.3;";
+  const messageStyle = "font-size:14px;line-height:1.5;color:var(--sc-content-text-secondary-color,#6b7280);";
+  const ctaStyle = [
+    "display:inline-block",
+    "margin-top:4px",
+    "padding:10px 16px",
+    "background:var(--sc-color-primary,'#111')",
+    "color:var(--sc-color-primary-foreground,'#fff')",
+    "text-decoration:none",
+    "border-radius:8px",
+    "font-size:14px",
+    "font-weight:500",
+    "align-self:flex-start"
+  ].join(";");
+  const escapeHtml = (s) => s.replace(/[&<>"']/g, (ch) => {
+    switch (ch) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      default:
+        return "&#39;";
+    }
+  });
+  const ctaHtml = ctaHref && /^https?:\/\//.test(ctaHref) ? `<a href="${escapeHtml(ctaHref)}" target="_blank" rel="noopener noreferrer" style="${ctaStyle}">${escapeHtml(ctaLabel)}</a>` : "";
+  return `<div style="${wrapperStyle}" data-adaptive-chatbot-fallback="true"><div style="${titleStyle}">${escapeHtml(title)}</div><div style="${messageStyle}">${escapeHtml(message)}</div>${ctaHtml}</div>`;
+}
 var ChatAssistantLitMountable = {
   mount(container, mountConfig) {
-    const incoming = mountConfig ?? {};
-    const { runtime, instanceId, tileId, config: nestedConfig, ...flat } = incoming;
-    const chatbotConfig = nestedConfig ?? (flat.backendUrl ? flat : void 0);
+    const incoming = mountConfig ?? null;
+    const runtime = incoming?.runtime;
+    const instanceId = incoming?.instanceId;
+    const tileId = incoming?.tileId;
+    const nestedConfig = incoming?.config;
+    const flat = stripMountPlumbing(incoming);
+    if ("config" in flat) {
+      delete flat.config;
+    }
+    const flatLooksLikeChatbotConfig = typeof flat.backendUrl === "string";
+    const chatbotConfig = nestedConfig ?? (flatLooksLikeChatbotConfig ? flat : void 0);
     const resolvedTileId = tileId ?? instanceId ?? "chatbot-widget";
     if (!chatbotConfig?.backendUrl || !runtime) {
       container.innerHTML = '<div style="padding:16px;color:var(--sc-content-text-secondary-color,#87919f)">Chat widget requires config and runtime.</div>';
@@ -3291,35 +3613,117 @@ var ChatAssistantLitMountable = {
       };
     }
     const baseUrl = chatbotConfig.backendUrl.replace(/\/$/, "");
-    const transport = new SsePostTransport({
-      sseUrl: `${baseUrl}/api/adaptive/session`,
-      postUrl: `${baseUrl}/api/adaptive/action`,
-      onA2UIEvent: (payload) => {
-        runtime.actions.applyBatch([payload]).then(() => {
-          runtime.events.publish("chatbot.a2ui_applied", {
-            tileId: resolvedTileId
-          });
-        }).catch((err) => {
-          console.error("[adaptive-chatbot] A2UI apply failed:", err);
-        });
-      }
-    });
+    const token = readSyntroToken();
+    const postUrl = `${baseUrl}/api/adaptive/action`;
+    const buildSseUrl = (cft) => {
+      const parts = [];
+      if (token) parts.push(`syn=${encodeURIComponent(token)}`);
+      if (cft) parts.push(`cft=${encodeURIComponent(cft)}`);
+      return parts.length ? `${baseUrl}/api/adaptive/session?${parts.join("&")}` : `${baseUrl}/api/adaptive/session`;
+    };
+    const buildHeaders = (cft) => {
+      const h = {};
+      if (token) h.Authorization = `Bearer ${token}`;
+      if (cft) h["CF-Turnstile-Token"] = cft;
+      return h;
+    };
     const el = document.createElement("syntro-chat");
-    el.transport = transport;
     el.greeting = chatbotConfig.greeting;
     if (chatbotConfig.suggestions) {
       el.suggestions = chatbotConfig.suggestions;
     }
     el.style.cssText = "display:flex;flex-direction:column;height:100%;width:100%;";
-    container.appendChild(el);
-    return () => {
-      transport.disconnect();
+    let transport = null;
+    let hasSucceeded = false;
+    let isUnmounted = false;
+    let unsubscribe = null;
+    let failureTimer = null;
+    let errorDebounceTimer = null;
+    let fallbackRendered = false;
+    const clearTimers = () => {
+      if (failureTimer) {
+        clearTimeout(failureTimer);
+        failureTimer = null;
+      }
+      if (errorDebounceTimer) {
+        clearTimeout(errorDebounceTimer);
+        errorDebounceTimer = null;
+      }
+    };
+    const swapToFallback = (reason) => {
+      if (isUnmounted || hasSucceeded || fallbackRendered) return;
+      fallbackRendered = true;
+      clearTimers();
+      runtime.events.publish("chatbot.fallback_rendered", {
+        tileId: resolvedTileId,
+        reason
+      });
+      transport?.disconnect();
       el.remove();
+      container.innerHTML = renderFallbackHtml(chatbotConfig.fallback);
+    };
+    const setupTransport = (cftToken) => {
+      if (isUnmounted) return;
+      transport = new SsePostTransport({
+        sseUrl: buildSseUrl(cftToken),
+        postUrl,
+        headers: buildHeaders(cftToken),
+        onA2UIEvent: (payload) => {
+          runtime.actions.applyBatch([payload]).then(() => {
+            runtime.events.publish("chatbot.a2ui_applied", {
+              tileId: resolvedTileId
+            });
+          }).catch((err) => {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error("[adaptive-chatbot] A2UI apply failed:", message);
+          });
+        }
+      });
+      el.transport = transport;
+      unsubscribe = transport.subscribe((event) => {
+        if (isUnmounted) return;
+        if (event.type === "error") {
+          if (hasSucceeded || errorDebounceTimer) return;
+          errorDebounceTimer = setTimeout(() => {
+            errorDebounceTimer = null;
+            if (!hasSucceeded) swapToFallback("connect_failed");
+          }, ERROR_DEBOUNCE_MS);
+          return;
+        }
+        hasSucceeded = true;
+        clearTimers();
+        if (unsubscribe) {
+          unsubscribe();
+          unsubscribe = null;
+        }
+      });
+      container.appendChild(el);
+      failureTimer = setTimeout(() => {
+        if (!hasSucceeded) swapToFallback("connect_timeout");
+      }, FAILURE_DETECTION_TIMEOUT_MS);
+    };
+    if (TURNSTILE_SITEKEY) {
+      void acquireTurnstileToken().then(setupTransport);
+    } else {
+      setupTransport(null);
+    }
+    return () => {
+      isUnmounted = true;
+      clearTimers();
+      if (unsubscribe) {
+        unsubscribe();
+        unsubscribe = null;
+      }
+      if (!fallbackRendered) {
+        transport?.disconnect();
+        el.remove();
+      }
     };
   }
 };
 
 export {
+  acquireTurnstileToken,
   ChatAssistantLitMountable
 };
 /*! Bundled license information:
@@ -3327,4 +3731,4 @@ export {
 dompurify/dist/purify.es.mjs:
   (*! @license DOMPurify 3.3.1 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.3.1/LICENSE *)
 */
-//# sourceMappingURL=chunk-FM7MU2YX.js.map
+//# sourceMappingURL=chunk-DUQTO5RE.js.map