arcy.js 0.1.0 → 0.1.2

package/dist/index.js

@@ -1,11 +1,11 @@
-/* arcy.js — https://arcyai.com */
+import { DESIGN_MODE_PROTOCOL, DESIGN_MODE_EXIT, DESIGN_MODE_SCREENSHOT, DESIGN_MODE_PICK, DESIGN_MODE_READY } from './chunk-7VVKR3AO.js';
+import { FALLBACK_CHROME, resolveImageUrl, FONT_KEY_PROPERTY, isRenderableImageUrl, readViewport, POLICY_LINK_CLASS, BAR_TRAY_CLASS, ATTACHABLE_TYPES, TOOLTIP_CSS, surfaceWidth, clampOffsetX, dragTransform, carriesFiles, droppedFiles, MOBILE_MARGIN, CHAT_CONTRACT, CHAT_GLOBAL } from './chunk-DW3GUQ6J.js';
+import { createShellState, safeStore, browserSessionStorage, writeJson, browserLocalStorage, readJson, hasPendingPreview, createFlowRunState, FLOW_CONTRACT, FLOW_GLOBAL } from './chunk-FR6SJSDU.js';
+import { PICKER_CONTRACT, PICKER_GLOBAL } from './chunk-DKYMIAYF.js';
+import { warn, reportCspViolations, releaseHostFocus, Z_INDEX, createShell, injectStyles } from './chunk-LGWYJSYX.js';
+import { captureEventFingerprint, containsPii } from './chunk-NY3NXM2V.js';
 
-// src/warn.ts
-function warn(message) {
-  if (typeof console !== "undefined" && console.warn) {
-    console.warn(`[arcy] ${message}`);
-  }
-}
+/* arcy.js — https://arcyai.com */
 
 // src/emitter.ts
 function createEmitter() {
@@ -40,149 +40,6 @@ function createEmitter() {
   return { on, emit };
 }
 
-// src/fingerprint/model.ts
-var FINGERPRINT_TEXT_MAX = 80;
-
-// src/fingerprint/shadow.ts
-function parentOrHost(el) {
-  if (el.parentElement !== null) return el.parentElement;
-  const parentNode = el.parentNode;
-  if (parentNode !== null && "host" in parentNode) {
-    return parentNode.host;
-  }
-  return null;
-}
-
-// src/fingerprint/capture.ts
-var PII_PATTERNS = [
-  // Email
-  /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
-  // US SSN: 123-45-6789
-  /\b\d{3}-\d{2}-\d{4}\b/g,
-  // Card shapes: 13-19 digits, optionally grouped. A denylist, not a Luhn check.
-  /\b\d(?:[ -]?\d){12,18}\b/g
-];
-var MASK = "[masked]";
-function containsPii(raw) {
-  return PII_PATTERNS.some((pattern) => {
-    pattern.lastIndex = 0;
-    return pattern.test(raw);
-  });
-}
-var NORMALIZE_RAW_MAX = 4096;
-var NORMALIZE_RAW_MARGIN = 100;
-var ROLE_MAX = 64;
-function normalizeText(raw) {
-  if (!raw) return void 0;
-  let bounded = raw.slice(0, NORMALIZE_RAW_MAX);
-  if (raw.length > NORMALIZE_RAW_MAX) {
-    const lastSpace = bounded.search(/\s\S*$/);
-    bounded = lastSpace === -1 ? bounded.slice(0, NORMALIZE_RAW_MAX - NORMALIZE_RAW_MARGIN) : bounded.slice(0, lastSpace);
-  }
-  let text = bounded.replace(/\s+/g, " ").trim();
-  if (!text) return void 0;
-  for (const pattern of PII_PATTERNS) {
-    text = text.replace(pattern, MASK);
-  }
-  return text.slice(0, FINGERPRINT_TEXT_MAX);
-}
-function isStableId(id) {
-  if (id.length === 0 || id.length > 64) return false;
-  if (id.includes(":")) return false;
-  if (id.startsWith("radix-")) return false;
-  if (/^\d+$/.test(id)) return false;
-  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) return false;
-  return true;
-}
-var ANCESTOR_ATTRS = ["data-testid", "data-test", "data-cy", "id", "name", "aria-label"];
-var TEST_ATTRS = ["data-testid", "data-test", "data-cy"];
-var TEST_ID_MAX = 64;
-function firstTestId(el) {
-  for (const attr of TEST_ATTRS) {
-    const raw = el.getAttribute(attr);
-    if (raw === null) continue;
-    const trimmed = raw.trim();
-    if (trimmed === "" || trimmed.length > TEST_ID_MAX) continue;
-    if (containsPii(trimmed)) continue;
-    return trimmed;
-  }
-  return void 0;
-}
-var LANDMARK_ROLES = /* @__PURE__ */ new Set([
-  "navigation",
-  "main",
-  "banner",
-  "contentinfo",
-  "search",
-  "form",
-  "region",
-  "dialog"
-]);
-function findSemanticAncestor(el) {
-  let current = parentOrHost(el);
-  while (current !== null) {
-    const tag = current.tagName.toLowerCase();
-    if (tag === "body" || tag === "html") return void 0;
-    for (const attr of ANCESTOR_ATTRS) {
-      const raw = current.getAttribute(attr);
-      if (raw === null) continue;
-      if (attr === "id" && !isStableId(raw)) continue;
-      const value = normalizeText(raw);
-      if (value !== void 0) return { tag, attr, value };
-    }
-    const role = current.getAttribute("role");
-    if (role !== null && LANDMARK_ROLES.has(role)) {
-      return { tag, attr: "role", value: role };
-    }
-    current = parentOrHost(current);
-  }
-  return void 0;
-}
-function siblingIndexOf(el) {
-  let index = 0;
-  let sibling = el.previousElementSibling;
-  while (sibling !== null) {
-    if (sibling.tagName === el.tagName) index += 1;
-    sibling = sibling.previousElementSibling;
-  }
-  return index;
-}
-function captureEventFingerprint(el) {
-  const fingerprint = {
-    tag: el.tagName.toLowerCase(),
-    siblingIndex: siblingIndexOf(el)
-  };
-  const text = normalizeText(el.textContent);
-  if (text !== void 0) fingerprint.text = text;
-  const ariaLabel = normalizeText(el.getAttribute("aria-label"));
-  if (ariaLabel !== void 0) fingerprint.ariaLabel = ariaLabel;
-  const placeholder = normalizeText(el.getAttribute("placeholder"));
-  if (placeholder !== void 0) fingerprint.placeholder = placeholder;
-  const id = el.getAttribute("id");
-  if (id !== null && isStableId(id) && !containsPii(id)) fingerprint.id = id;
-  const role = el.getAttribute("role");
-  if (role !== null) {
-    const trimmed = role.trim();
-    if (trimmed !== "" && trimmed.length <= ROLE_MAX && !containsPii(trimmed)) {
-      fingerprint.role = trimmed;
-    }
-  }
-  const testId = firstTestId(el);
-  if (testId !== void 0) fingerprint.testId = testId;
-  const ancestor = findSemanticAncestor(el);
-  if (ancestor !== void 0) {
-    fingerprint.ancestorTag = ancestor.tag;
-    fingerprint.ancestorAttr = ancestor.attr;
-    fingerprint.ancestorValue = ancestor.value;
-  }
-  return fingerprint;
-}
-
-// src/generated/build-hashes.ts
-var PICKER_CHUNK_FILE = "arcy.picker.c598a581d964.js";
-var CHAT_CHUNK_FILE = "arcy.chat.ab181cf5a84b.js";
-var FLOW_CHUNK_FILE = "arcy.flow.fef131718e42.js";
-
 // src/telemetry/route.ts
 var MAX_ROUTE_LENGTH = 2048;
 var OPAQUE = /^(?:\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9a-f]{12,})$/i;
@@ -246,192 +103,6 @@ function normalizeRoute(href, base) {
   return path.length + query.length > MAX_ROUTE_LENGTH ? path : path + query;
 }
 
-// src/picker/contract.ts
-var PICKER_GLOBAL = "__arcyPicker";
-var PICKER_CONTRACT = 2;
-
-// src/picker/message.ts
-var DESIGN_MODE_PROTOCOL = 2;
-var DESIGN_MODE_READY = "arcy:design-mode:ready";
-var DESIGN_MODE_PICK = "arcy:design-mode:pick";
-var DESIGN_MODE_EXIT = "arcy:design-mode:exit";
-var DESIGN_MODE_SCREENSHOT = "arcy:design-mode:screenshot";
-
-// src/shell/host.ts
-var HOST_ID = "arcy-widget";
-var HOST_ATTRIBUTE = "data-arcy";
-var Z_INDEX = "2147483000";
-var CRITICAL_STYLE = [
-  ["position", "fixed"],
-  ["inset", "0"],
-  ["z-index", Z_INDEX],
-  // The layer spans the viewport so the launcher (1.4) and the chat panel (1.5)
-  // share one coordinate space. It must therefore be transparent to the
-  // pointer; each surface inside re-enables its own.
-  ["pointer-events", "none"],
-  // The layer must also be invisible, and that is not the shadow root's job
-  // (D512). The host is in the customer's light DOM whatever happens inside
-  // it, so their `div { background: ... !important }` paints it, and a painted
-  // full-viewport layer is their whole site replaced by a coloured sheet with
-  // no error anywhere. These four are every property that fills or edges a
-  // box, and none of them is something a customer wants on an invisible layer.
-  ["background", "transparent"],
-  ["border", "0"],
-  ["box-shadow", "none"],
-  ["outline", "0"]
-];
-var RESET_STYLE = [
-  ["margin", "0"],
-  ["padding", "0"]
-];
-var STYLE_MARKER = "data-arcy-style";
-var shells = /* @__PURE__ */ new Map();
-function isMounted(id = HOST_ID) {
-  const shell = shells.get(id);
-  return shell !== void 0 && shell.host.isConnected;
-}
-function createShell(options = {}) {
-  if (typeof document === "undefined") return null;
-  const id = options.id ?? HOST_ID;
-  const container = options.container;
-  if (isMounted(id)) {
-    warn("This ARCY surface is already on this page. Ignoring the second mount.");
-    return null;
-  }
-  shells.delete(id);
-  const parent = container ?? document.body ?? document.documentElement;
-  if (!parent) {
-    warn("The page has no <body> to mount into yet. The widget will not render.");
-    return null;
-  }
-  if (!container) {
-    const hosts = document.querySelectorAll(`[${HOST_ATTRIBUTE}]`);
-    for (let i = 0; i < hosts.length; i += 1) {
-      if (hosts[i]?.id === id) {
-        warn("Another copy of ARCY is already on this page. Ignoring this one.");
-        return null;
-      }
-    }
-  }
-  try {
-    const host = document.createElement("div");
-    host.id = id;
-    host.setAttribute(HOST_ATTRIBUTE, "");
-    for (const [property, value] of CRITICAL_STYLE) {
-      host.style.setProperty(property, value, "important");
-    }
-    for (const [property, value] of RESET_STYLE) {
-      host.style.setProperty(property, value);
-    }
-    let root = host;
-    let isolated = false;
-    try {
-      if (host.attachShadow) {
-        root = host.attachShadow({ mode: "closed" });
-        isolated = true;
-      }
-    } catch {
-    }
-    parent.appendChild(host);
-    isolateInteractions(host);
-    const shell = {
-      host,
-      root,
-      isolated,
-      destroy() {
-        try {
-          if (host.parentNode) host.parentNode.removeChild(host);
-        } catch {
-        }
-        if (shells.get(id) === shell) shells.delete(id);
-      }
-    };
-    shells.set(id, shell);
-    return shell;
-  } catch (error) {
-    warn(`The widget could not mount. ${String(error)}`);
-    return null;
-  }
-}
-var ISOLATED_EVENTS = [
-  "pointerdown",
-  "pointerup",
-  "pointercancel",
-  "mousedown",
-  "mouseup",
-  "click",
-  "dblclick",
-  "auxclick",
-  "contextmenu",
-  "touchstart",
-  "touchend",
-  "touchcancel",
-  "focusin",
-  "focusout",
-  "keydown",
-  "keyup",
-  "keypress",
-  "beforeinput",
-  "input",
-  "change",
-  "compositionstart",
-  "compositionupdate",
-  "compositionend",
-  "cut",
-  "copy",
-  "paste"
-];
-function isolateInteractions(host) {
-  const stop = (event) => {
-    try {
-      event.stopPropagation();
-    } catch {
-    }
-  };
-  for (const type of ISOLATED_EVENTS) {
-    try {
-      host.addEventListener(type, stop);
-    } catch {
-    }
-  }
-  try {
-    host.addEventListener("mousedown", (event) => {
-      if (event.defaultPrevented) return;
-      releaseHostFocus(host.ownerDocument, host);
-    });
-  } catch {
-  }
-}
-function releaseHostFocus(doc, host) {
-  try {
-    const active = doc.activeElement;
-    if (!active || active === host || host.contains(active)) return;
-    if (active === doc.body || active === doc.documentElement) return;
-    const blur = active.blur;
-    if (typeof blur === "function") blur.call(active);
-  } catch {
-  }
-}
-function injectStyles(shell, css) {
-  if (!shell.isolated) return false;
-  try {
-    const existing = shell.root.querySelector(`[${STYLE_MARKER}]`);
-    if (existing) {
-      existing.textContent = `${existing.textContent ?? ""}
-${css}`;
-      return true;
-    }
-    const style2 = shell.host.ownerDocument.createElement("style");
-    style2.setAttribute(STYLE_MARKER, "");
-    style2.textContent = css;
-    shell.root.appendChild(style2);
-    return true;
-  } catch (error) {
-    warn(`The widget could not apply its styles. ${String(error)}`);
-    return false;
-  }
-}
-
 // src/picker/notice.ts
 var NOTICE_HOST_ID = "arcy-picker-notice";
 var CARD_OFFSET = [
@@ -523,7 +194,6 @@ function refuse(message) {
 }
 var PICKER_PARAM = "arcy_picker";
 var PICKER_VERIFY_PATH = "/api/v1/sdk/tagging/verify";
-var PICKER_CDN_BASE = "https://cdn.arcyai.com";
 var PICKER_LOAD_TIMEOUT_MS = 15e3;
 var VERIFY_TIMEOUT_MS = 1e4;
 function detectPickerNonce(search, hash) {
@@ -608,115 +278,6 @@ function normalizeOrigin(value) {
     return null;
   }
 }
-function loadPickerChunk(win, cdnBase, timeoutMs, setTimeoutImpl) {
-  return new Promise((resolve) => {
-    let settled = false;
-    let script = null;
-    const settle = (value) => {
-      if (settled) return;
-      settled = true;
-      if (script) {
-        script.onload = null;
-        script.onerror = null;
-      }
-      resolve(value);
-    };
-    let warned = false;
-    const complain = (message) => {
-      if (warned) return;
-      warned = true;
-      refuse(message);
-    };
-    const read = () => {
-      let registration;
-      try {
-        registration = win[PICKER_GLOBAL];
-      } catch {
-        complain(
-          "The element picker registration could not be read. Design mode is off."
-        );
-        return null;
-      }
-      if (!registration) return null;
-      if (typeof registration.mount !== "function") {
-        complain(
-          "The element picker registered something unusable. Design mode is off."
-        );
-        return null;
-      }
-      let contract;
-      try {
-        contract = registration.contract;
-      } catch {
-        contract = void 0;
-      }
-      if (contract !== PICKER_CONTRACT) {
-        complain(
-          `The element picker on the CDN speaks contract ${typeof contract === "number" ? contract : "unknown"}, this arcy.js speaks ${PICKER_CONTRACT}. Update arcy.js to use design mode.`
-        );
-        return null;
-      }
-      return registration;
-    };
-    const readAndSettle = (whenAbsent) => {
-      try {
-        const registration = read();
-        if (!registration && !warned) whenAbsent();
-        settle(registration);
-      } catch {
-        settle(null);
-      }
-    };
-    let present = false;
-    try {
-      present = win[PICKER_GLOBAL] !== void 0;
-    } catch {
-      present = true;
-    }
-    if (present) {
-      readAndSettle(() => {
-      });
-      return;
-    }
-    try {
-      const doc = win.document;
-      script = doc.createElement("script");
-      script.async = true;
-      script.src = `${cdnBase}/${PICKER_CHUNK_FILE}`;
-      const src = script.src;
-      script.onload = () => readAndSettle(
-        () => refuse(
-          "The element picker loaded but did not register. Design mode is off."
-        )
-      );
-      script.onerror = () => {
-        try {
-          refuse(
-            `Failed to load ${src}. Design mode is off. If this page sets a Content-Security-Policy, it must allow scripts from ${cdnBase}.`
-          );
-        } catch {
-        }
-        settle(null);
-      };
-      (doc.head || doc.documentElement).appendChild(script);
-    } catch (error) {
-      refuse(`The element picker could not load. ${String(error)}`);
-      settle(null);
-      return;
-    }
-    try {
-      setTimeoutImpl(() => {
-        if (!settled) {
-          refuse(
-            "The element picker did not load in time. Design mode is off."
-          );
-        }
-        settle(null);
-      }, timeoutMs);
-    } catch {
-    }
-  });
-}
 function currentPath(win) {
   try {
     const path = win.location.pathname;
@@ -754,7 +315,7 @@ async function maybeActivateDesignMode(options) {
       apiBase,
       fetchImpl,
       onVerified,
-      cdnBase = PICKER_CDN_BASE,
+      loadChunk,
       loadTimeoutMs = PICKER_LOAD_TIMEOUT_MS,
       setTimeoutImpl = (fn, ms) => setTimeout(fn, ms)
     } = options;
@@ -784,12 +345,7 @@ async function maybeActivateDesignMode(options) {
       onVerified();
     } catch {
     }
-    const registration = await loadPickerChunk(
-      win,
-      cdnBase,
-      loadTimeoutMs,
-      setTimeoutImpl
-    );
+    const registration = await loadChunk(win, loadTimeoutMs, setTimeoutImpl);
     if (!registration) return "load_failed";
     const { returnOrigin, screenshotsEnabled } = verified;
     const handle = registration.mount({
@@ -843,84 +399,6 @@ async function maybeActivateDesignMode(options) {
   }
 }
 
-// src/telemetry/storage.ts
-var NULL_STORE = {
-  getItem: () => null,
-  setItem: () => {
-  },
-  removeItem: () => {
-  }
-};
-function safeStore(raw) {
-  if (!raw) return NULL_STORE;
-  return {
-    getItem(key) {
-      try {
-        return raw.getItem(key);
-      } catch {
-        return null;
-      }
-    },
-    setItem(key, value) {
-      try {
-        raw.setItem(key, value);
-      } catch {
-      }
-    },
-    removeItem(key) {
-      try {
-        raw.removeItem(key);
-      } catch {
-      }
-    }
-  };
-}
-function browserLocalStorage() {
-  try {
-    const candidate = globalThis.localStorage;
-    return safeStore(candidate);
-  } catch {
-    return NULL_STORE;
-  }
-}
-function browserSessionStorage() {
-  try {
-    const candidate = globalThis.sessionStorage;
-    return safeStore(candidate);
-  } catch {
-    return NULL_STORE;
-  }
-}
-function readJson(store, key) {
-  const raw = store.getItem(key);
-  if (!raw) return null;
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return null;
-    }
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-function writeJson(store, key, value) {
-  try {
-    store.setItem(key, JSON.stringify(value));
-  } catch {
-  }
-}
-
-// src/flow/preview-state.ts
-var PREVIEW_KEY_PREFIX = "arcy.preview.";
-function hasPendingPreview(token, store = browserSessionStorage()) {
-  try {
-    return safeStore(store).getItem(PREVIEW_KEY_PREFIX + token) !== null;
-  } catch {
-    return false;
-  }
-}
-
 // src/flow/preview.ts
 var PREVIEW_PARAM = "arcy_preview";
 var PREVIEW_PROTOCOL = 1;
@@ -1108,6 +586,8 @@ function createSessionBootstrap(options) {
     if (payload.viewerLocale !== void 0)
       out.viewerLocale = payload.viewerLocale;
     if (payload.route !== void 0) out.route = payload.route;
+    if (payload.sessionContext !== void 0)
+      out.sessionContext = payload.sessionContext;
     return JSON.stringify(out);
   }
   async function attempt(json) {
@@ -1191,190 +671,14 @@ function createSessionBootstrap(options) {
   };
 }
 
-// src/shell/chat-contract.ts
-var CHAT_GLOBAL = "__arcyChat";
-var CHAT_CONTRACT = 4;
-var ATTACHABLE_TYPES = [
-  "image/png",
-  "image/jpeg",
-  "image/webp"
-];
-var FONT_KEY_PROPERTY = "--_arcy-font-key";
-var POLICY_LINK_CLASS = "arcy-chat-policy";
-var FALLBACK_CHROME = {
-  historyTitle: "Recent chats",
-  historyEmpty: "No conversations yet.",
-  newChat: "New chat",
-  flowsTitle: "What I can do",
-  flowsEmpty: "Nothing to run yet.",
-  collapse: "Collapse",
-  back: "Back",
-  closeSheet: "Close",
-  settingsTitle: "Settings",
-  dockChat: "Dock to the corner",
-  dockChatHint: "Shrink ARCY to a button in the bottom-right corner.",
-  language: "Language",
-  openChat: "Open chat",
-  moveBar: "Move the chat bar",
-  send: "Send",
-  flowRunning: "Running",
-  flowStep: "Step {step} of {total}",
-  flowStop: "Stop",
-  flowFailed: "Sorry, I could not finish that for you this time. You can ask me here and I will help you do it.",
-  attachMenu: "Add",
-  attachImage: "Attach an image",
-  removeImage: "Remove image",
-  imageTooLarge: "That image is too large. Each image must be under 5 MB.",
-  imageWrongType: "That file type is not supported. Use PNG, JPEG or WEBP.",
-  imageTooMany: "You can attach up to 3 images.",
-  imageFailed: "That image could not be uploaded. Please try again.",
-  likeAnswer: "Good answer",
-  dislikeAnswer: "Bad answer",
-  answering: "Answering",
-  aiDisclaimer: "{app} is AI and can make mistakes",
-  consentNotice: "Your messages are processed to answer your question.",
-  consentWithPolicy: "{policy}",
-  disclaimerJoin: " \xB7 ",
-  privacyPolicy: "Privacy Policy",
-  poweredBy: "Powered by ARCY",
-  genericError: "Something went wrong. Please try again.",
-  userCapReached: "You've reached today's limit for questions. Please try again tomorrow.",
-  imageConversation: "Image",
-  searchedSourcesLabel: "Searched {count} sources",
-  sourcesLabel: "Sources:",
-  flowOfferHint: "You can do this in one click with the Quick Flow below.",
-  fillConfirm: "Confirm",
-  fillYes: "Yes",
-  fillNo: "No",
-  fillRequired: "This field needs an answer.",
-  fillInvalidNumber: "Please enter a number.",
-  fillNumberTooSmall: "Please enter {min} or more.",
-  fillNumberTooLarge: "Please enter {max} or less.",
-  fillInvalidEmail: "Please enter a valid email address.",
-  fillInvalidUrl: "Please enter a valid link.",
-  fillInvalidDate: "Please enter a valid date.",
-  fillInvalidTime: "Please enter a valid time.",
-  fillDateTooEarly: "Please pick {min} or later.",
-  fillDateTooLate: "Please pick {max} or earlier.",
-  fillTooLong: "Please keep it under {max} characters.",
-  fillInvalidOption: "Please pick one of the options.",
-  fillInvalid: "That does not look right. Please try again."
-};
-
 // src/shell/chat-loader.ts
-var CHAT_CDN_BASE = "https://cdn.arcyai.com";
 var CHAT_LOAD_TIMEOUT_MS = 15e3;
-function loadChatChunk(win, cdnBase, timeoutMs, setTimeoutImpl) {
-  return new Promise((resolve) => {
-    let settled = false;
-    let script = null;
-    const settle = (value) => {
-      if (settled) return;
-      settled = true;
-      if (script) {
-        script.onload = null;
-        script.onerror = null;
-      }
-      resolve(value);
-    };
-    let warned = false;
-    const complain = (message) => {
-      if (warned) return;
-      warned = true;
-      warn(message);
-    };
-    const read = () => {
-      let registration;
-      try {
-        registration = win[CHAT_GLOBAL];
-      } catch {
-        complain(
-          "The chat panel registration could not be read. The panel will not open."
-        );
-        return null;
-      }
-      if (!registration) return null;
-      if (typeof registration.mount !== "function") {
-        complain(
-          "The chat panel registered something unusable. The panel will not open."
-        );
-        return null;
-      }
-      let contract;
-      try {
-        contract = registration.contract;
-      } catch {
-        contract = void 0;
-      }
-      if (contract !== CHAT_CONTRACT) {
-        complain(
-          `The chat panel on the CDN speaks contract ${typeof contract === "number" ? contract : "unknown"}, this arcy.js speaks ${CHAT_CONTRACT}. Update arcy.js to open the chat panel.`
-        );
-        return null;
-      }
-      return registration;
-    };
-    const readAndSettle = (whenAbsent) => {
-      try {
-        const registration = read();
-        if (!registration && !warned) whenAbsent();
-        settle(registration);
-      } catch {
-        settle(null);
-      }
-    };
-    let present = false;
-    try {
-      present = win[CHAT_GLOBAL] !== void 0;
-    } catch {
-      present = true;
-    }
-    if (present) {
-      readAndSettle(() => {
-      });
-      return;
-    }
-    try {
-      const doc = win.document;
-      script = doc.createElement("script");
-      script.async = true;
-      script.src = `${cdnBase}/${CHAT_CHUNK_FILE}`;
-      const src = script.src;
-      script.onload = () => readAndSettle(
-        () => warn("The chat panel loaded but did not register. The panel will not open.")
-      );
-      script.onerror = () => {
-        try {
-          warn(
-            `Failed to load ${src}. The chat panel will not open. If this page sets a Content-Security-Policy, it must allow scripts from ${cdnBase}.`
-          );
-        } catch {
-        }
-        settle(null);
-      };
-      (doc.head || doc.documentElement).appendChild(script);
-    } catch (error) {
-      warn(`The chat panel could not load. ${String(error)}`);
-      settle(null);
-      return;
-    }
-    try {
-      setTimeoutImpl(() => {
-        if (!settled) {
-          warn("The chat panel did not load in time.");
-        }
-        settle(null);
-      }, timeoutMs);
-    } catch {
-    }
-  });
-}
 function createChatController(options) {
   const {
     root,
     host,
     win = typeof window !== "undefined" ? window : void 0,
-    cdnBase = CHAT_CDN_BASE,
+    loadChunk,
     loadTimeoutMs = CHAT_LOAD_TIMEOUT_MS,
     setTimeoutImpl = (fn, ms) => setTimeout(fn, ms),
     onRequestClose,
@@ -1407,12 +711,7 @@ function createChatController(options) {
     loading = (async () => {
       if (!win) return;
       try {
-        const registration = await loadChatChunk(
-          win,
-          cdnBase,
-          loadTimeoutMs,
-          setTimeoutImpl
-        );
+        const registration = await loadChunk(win, loadTimeoutMs, setTimeoutImpl);
         if (!registration || destroyed) return;
         const context = {
           root,
@@ -1524,144 +823,12 @@ function createChatController(options) {
   };
 }
 
-// src/flow/flow-contract.ts
-var FLOW_GLOBAL = "__arcyFlow";
-var FLOW_CONTRACT = 2;
-
-// src/flow/state.ts
-var FLOW_KEY_PREFIX = "arcy.flow.";
-function isValid(stored) {
-  return typeof stored.flowId === "string" && stored.flowId.length > 0 && typeof stored.currentStepCvid === "string" && stored.currentStepCvid.length > 0 && typeof stored.flowSessionId === "string" && stored.flowSessionId.length > 0 && typeof stored.startedAt === "number";
-}
-function createFlowRunState(token, { store: raw = browserLocalStorage() } = {}) {
-  const store = safeStore(raw);
-  const key = FLOW_KEY_PREFIX + token;
-  return {
-    read() {
-      const stored = readJson(store, key);
-      if (!stored || !isValid(stored)) return null;
-      return {
-        flowId: stored.flowId,
-        currentStepCvid: stored.currentStepCvid,
-        flowSessionId: stored.flowSessionId,
-        startedAt: stored.startedAt
-      };
-    },
-    save(run) {
-      writeJson(store, key, run);
-    },
-    clear() {
-      store.removeItem(key);
-    }
-  };
-}
-
 // src/flow/flow-loader.ts
-var FLOW_CDN_BASE = "https://cdn.arcyai.com";
 var FLOW_LOAD_TIMEOUT_MS = 15e3;
-function loadFlowChunk(win, cdnBase, timeoutMs, setTimeoutImpl) {
-  return new Promise((resolve) => {
-    let settled = false;
-    let script = null;
-    const settle = (value) => {
-      if (settled) return;
-      settled = true;
-      if (script) {
-        script.onload = null;
-        script.onerror = null;
-      }
-      resolve(value);
-    };
-    let warned = false;
-    const complain = (message) => {
-      if (warned) return;
-      warned = true;
-      warn(message);
-    };
-    const read = () => {
-      let registration;
-      try {
-        registration = win[FLOW_GLOBAL];
-      } catch {
-        complain("The flow engine registration could not be read. The flow will not start.");
-        return null;
-      }
-      if (!registration) return null;
-      if (typeof registration.mount !== "function") {
-        complain("The flow engine registered something unusable. The flow will not start.");
-        return null;
-      }
-      let contract;
-      try {
-        contract = registration.contract;
-      } catch {
-        contract = void 0;
-      }
-      if (contract !== FLOW_CONTRACT) {
-        complain(
-          `The flow engine on the CDN speaks contract ${typeof contract === "number" ? contract : "unknown"}, this arcy.js speaks ${FLOW_CONTRACT}. Update arcy.js to run flows.`
-        );
-        return null;
-      }
-      return registration;
-    };
-    const readAndSettle = (whenAbsent) => {
-      try {
-        const registration = read();
-        if (!registration && !warned) whenAbsent();
-        settle(registration);
-      } catch {
-        settle(null);
-      }
-    };
-    let present = false;
-    try {
-      present = win[FLOW_GLOBAL] !== void 0;
-    } catch {
-      present = true;
-    }
-    if (present) {
-      readAndSettle(() => {
-      });
-      return;
-    }
-    try {
-      const doc = win.document;
-      script = doc.createElement("script");
-      script.async = true;
-      script.src = `${cdnBase}/${FLOW_CHUNK_FILE}`;
-      const src = script.src;
-      script.onload = () => readAndSettle(
-        () => warn("The flow engine loaded but did not register. The flow will not start.")
-      );
-      script.onerror = () => {
-        try {
-          warn(
-            `Failed to load ${src}. The flow will not start. If this page sets a Content-Security-Policy, it must allow scripts from ${cdnBase}.`
-          );
-        } catch {
-        }
-        settle(null);
-      };
-      (doc.head || doc.documentElement).appendChild(script);
-    } catch (error) {
-      warn(`The flow engine could not load. ${String(error)}`);
-      settle(null);
-      return;
-    }
-    try {
-      setTimeoutImpl(() => {
-        if (!settled) warn("The flow engine did not load in time.");
-        settle(null);
-      }, timeoutMs);
-    } catch {
-    }
-  });
-}
 function createFlowController(options) {
   const {
     win = typeof window !== "undefined" ? window : void 0,
-    cdnBase = FLOW_CDN_BASE,
+    loadChunk,
     loadTimeoutMs = FLOW_LOAD_TIMEOUT_MS,
     setTimeoutImpl = (fn, ms) => setTimeout(fn, ms),
     context
@@ -1675,12 +842,7 @@ function createFlowController(options) {
     loading = (async () => {
       if (!win) return;
       try {
-        const registration = await loadFlowChunk(
-          win,
-          cdnBase,
-          loadTimeoutMs,
-          setTimeoutImpl
-        );
+        const registration = await loadChunk(win, loadTimeoutMs, setTimeoutImpl);
         if (!registration || destroyed) return;
         handle = registration.mount({ ...context, doc: win.document, win });
         if (!handle) warn("The flow engine could not start.");
@@ -1759,90 +921,6 @@ function createFlowController(options) {
   };
 }
 
-// src/shell/drag.ts
-function carriesFiles(event) {
-  const transfer = event.dataTransfer;
-  if (!transfer) return false;
-  const types = transfer.types;
-  if (!types) return false;
-  for (let index = 0; index < types.length; index += 1) {
-    if (types[index] === "Files") return true;
-  }
-  return false;
-}
-function droppedFiles(event) {
-  const transfer = event.dataTransfer;
-  return Array.from(transfer?.files ?? []);
-}
-
-// src/shell/tooltip.ts
-var TOOLTIP_CSS = `
-[data-tip] {
-  position: relative;
-}
-
-[data-tip]::after {
-  content: attr(data-tip);
-  position: absolute;
-  left: 50%;
-  bottom: calc(100% + 6px);
-  transform: translateX(-50%);
-  z-index: 2;
-  padding: 4px 8px;
-  border-radius: 6px;
-  background: var(--_arcy-main-text, #101828);
-  color: var(--_arcy-main-bg, #ffffff);
-  font-size: 11px;
-  line-height: 1.3;
-  white-space: nowrap;
-  pointer-events: none;
-  opacity: 0;
-  visibility: hidden;
-  transition: opacity 120ms ease;
-}
-
-[data-tip][data-tip-placement="below"]::after {
-  bottom: auto;
-  top: calc(100% + 6px);
-}
-
-/* Alignment, for a control near an edge the panel clips (D895). Centring a
-   bubble on the leftmost header icon puts half of it outside the panel, and
-   the panel clips its overflow, so the half outside is simply gone. No
-   z-index can fix that: the bubble is not behind anything, it is cut off.
-   These pin the bubble to the control's own edge instead. */
-[data-tip][data-tip-align="start"]::after {
-  left: 0;
-  transform: none;
-}
-
-[data-tip][data-tip-align="end"]::after {
-  left: auto;
-  right: 0;
-  transform: none;
-}
-
-[data-tip]:hover::after,
-[data-tip]:focus-visible::after {
-  opacity: 1;
-  visibility: visible;
-}
-
-/* A coarse pointer has no hover: the tooltip would latch open on tap and
-   sit over the thing the visitor just pressed. */
-@media (hover: none) {
-  [data-tip]::after {
-    display: none;
-  }
-}
-
-@media (prefers-reduced-motion: reduce) {
-  [data-tip]::after {
-    transition: none;
-  }
-}
-`;
-
 // src/shell/styles.ts
 var BAR_CSS = TOOLTIP_CSS + `
 .arcy-bar-wrap {
@@ -2209,20 +1287,20 @@ var BAR_CSS = TOOLTIP_CSS + `
   outline-offset: 1px;
 }
 
-/* The attachment count, so a visitor can see what is about to be sent
-   without the bar owning the upload. */
-.arcy-bar-badge {
-  display: flex;
+/* The attachment tray. See bar.ts's renderTray(). */
+.arcy-bar-tray {
+  display: none;
+  flex-wrap: wrap;
   align-items: center;
-  justify-content: center;
-  flex: 0 0 auto;
-  min-width: 20px;
-  height: 20px;
-  padding: 0 6px;
-  border-radius: 999px;
-  font-size: 12px;
-  background: var(--_arcy-brand-bg, #101828);
-  color: var(--_arcy-brand-text, #ffffff);
+  gap: 6px;
+  padding: 10px 4px 2px 4px;
+  min-width: 0;
+}
+
+/* A composer holding pictures is two rows, not one. */
+.arcy-bar[data-attachments="true"] {
+  flex-direction: column;
+  align-items: stretch;
 }
 
 /* \u2500\u2500 Flow-running mode \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
@@ -2342,59 +1420,7 @@ var BAR_CSS = TOOLTIP_CSS + `
     animation: none;
   }
 }
-`;
-
-// src/shell/viewport.ts
-var MOBILE_BREAKPOINT = 640;
-var MOBILE_MARGIN = 12;
-var PANEL_MARGIN = 16;
-var positive = (value) => typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
-function readSize(win) {
-  const el = win?.document?.documentElement;
-  return {
-    width: positive(el?.clientWidth) || positive(win?.innerWidth),
-    height: positive(el?.clientHeight) || positive(win?.innerHeight)
-  };
-}
-function keyboardOffset(win) {
-  const vv = win?.visualViewport;
-  if (!vv) return 0;
-  const layoutHeight = readSize(win).height;
-  const visualHeight = positive(vv.height);
-  if (!layoutHeight || !visualHeight) return 0;
-  const top = typeof vv.offsetTop === "number" && Number.isFinite(vv.offsetTop) ? vv.offsetTop : 0;
-  const covered = layoutHeight - (visualHeight + top);
-  if (!Number.isFinite(covered) || covered < 24) return 0;
-  return Math.min(covered, layoutHeight);
-}
-function readViewport(win) {
-  const size2 = readSize(win);
-  return {
-    ...size2,
-    isMobile: size2.width > 0 && size2.width < MOBILE_BREAKPOINT,
-    keyboardOffset: keyboardOffset(win)
-  };
-}
-var FALLBACK_WIDTH_PX = 560;
-function surfaceWidth(widthPercent, viewport) {
-  const available = positive(viewport.width);
-  if (!available) return FALLBACK_WIDTH_PX;
-  if (available < MOBILE_BREAKPOINT) {
-    return Math.max(0, available - MOBILE_MARGIN * 2);
-  }
-  const target = Math.round(widthPercent / 100 * available);
-  return Math.min(target, available - PANEL_MARGIN * 2);
-}
-function dragTransform(offset) {
-  if (offset.x === 0 && offset.y === 0) return "none";
-  return `translate(${offset.x}px, ${offset.y}px)`;
-}
-function clampOffsetX(x, width, viewportWidth) {
-  const available = positive(viewportWidth);
-  if (!available) return x;
-  const maxX = Math.max(0, (available - positive(width)) / 2);
-  return Math.min(maxX, Math.max(-maxX, x));
-}
+`;
 
 // src/shell/bar.ts
 var MAX_INPUT_LENGTH = 1e4;
@@ -2508,7 +1534,7 @@ function createBar(options = {}) {
   let statusStep = null;
   let stop = null;
   let disclaimer = null;
-  let badge = null;
+  let tray = null;
   let mode = "idle";
   let flow = null;
   let awaitingInput = false;
@@ -2631,6 +1657,15 @@ function createBar(options = {}) {
     leading.tabIndex = hasMenu ? 0 : -1;
     if (!hasMenu) closeMenu();
   }
+  function renderTray() {
+    if (!tray || !bar) return;
+    const visible = attachEnabled && attachmentCount > 0 && !isCollapsed();
+    const was = bar.getAttribute("data-attachments") === "true";
+    tray.style.setProperty("display", visible ? "flex" : "none");
+    bar.setAttribute("data-attachments", visible ? "true" : "false");
+    if (was === visible) return;
+    safe("onGeometryChange", () => options.onGeometryChange?.())();
+  }
   function setMenuOpen(open) {
     menuOpen = open;
     if (menu) menu.style.setProperty("display", open ? "flex" : "none");
@@ -2689,6 +1724,7 @@ function createBar(options = {}) {
     );
     bar.setAttribute("data-collapsed", isCollapsed() ? "true" : "false");
     renderLeading();
+    renderTray();
     render();
     form.style.setProperty("display", effective === "flow" ? "none" : "flex");
     status.style.setProperty(
@@ -2894,9 +1930,9 @@ function createBar(options = {}) {
     input.maxLength = MAX_INPUT_LENGTH;
     input.setAttribute("aria-label", labels.openChat);
     input.autocomplete = "off";
-    badge = doc.createElement("span");
-    badge.className = "arcy-bar-badge";
-    badge.style.setProperty("display", "none");
+    tray = doc.createElement("div");
+    tray.className = BAR_TRAY_CLASS;
+    tray.style.setProperty("display", "none");
     grip = doc.createElement("button");
     grip.type = "button";
     grip.className = "arcy-bar-grip";
@@ -2937,7 +1973,6 @@ function createBar(options = {}) {
     form.appendChild(grip);
     form.appendChild(leading);
     form.appendChild(input);
-    form.appendChild(badge);
     form.appendChild(submit);
     status = doc.createElement("div");
     status.className = "arcy-bar-status";
@@ -2958,6 +1993,7 @@ function createBar(options = {}) {
     status.appendChild(statusName);
     status.appendChild(statusStep);
     status.appendChild(stop);
+    bar.appendChild(tray);
     bar.appendChild(form);
     bar.appendChild(status);
     bar.appendChild(menu);
@@ -3045,7 +2081,7 @@ function createBar(options = {}) {
     dock = null;
     dockIcon = null;
     menu = null;
-    badge = null;
+    tray = null;
     menuOpen = false;
     flow = null;
     mode = "idle";
@@ -3201,13 +2237,11 @@ function createBar(options = {}) {
     setAttachmentCount(count) {
       attachmentCount = count;
       try {
-        if (!badge) return;
-        const visible = attachEnabled && count > 0;
-        badge.textContent = visible ? String(count) : "";
-        badge.style.setProperty("display", visible ? "flex" : "none");
+        renderTray();
       } catch {
       }
     },
+    attachmentSlot: () => tray,
     focusInput() {
       try {
         if (shell) releaseHostFocus(shell.host.ownerDocument, shell.host);
@@ -3395,13 +2429,12 @@ function applyTokens(host, tokens) {
 var TOKEN_KEY_PREFIX = "arcy.tokens.";
 var MAX_STORED = 4096;
 var MAX_NAME = 100;
-var MAX_URL = 2048;
 function readIdentity(value) {
   const raw = object(value);
   if (!raw) return null;
   const name = typeof raw.name === "string" ? raw.name.slice(0, MAX_NAME) : "";
   const url = raw.logoUrl;
-  const logoUrl = typeof url === "string" && url.length <= MAX_URL && /^https:\/\//i.test(url) ? url : null;
+  const logoUrl = isRenderableImageUrl(url) ? url : null;
   return { name, logoUrl };
 }
 function createTokenCache(token, raw = browserLocalStorage()) {
@@ -3432,93 +2465,6 @@ function createTokenCache(token, raw = browserLocalStorage()) {
   };
 }
 
-// src/shell/state.ts
-var SHELL_KEY_PREFIX = "arcy.shell.";
-var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var LOCALE_PATTERN = /^[a-z]{2}-[A-Z]{2}$/;
-function readPosition(value) {
-  if (!value || typeof value !== "object") return null;
-  const { x, y } = value;
-  if (typeof x !== "number" || typeof y !== "number") return null;
-  if (!Number.isFinite(x) || !Number.isFinite(y)) return null;
-  return { x, y };
-}
-function uuidV4(fill) {
-  const source = typeof globalThis !== "undefined" ? globalThis.crypto : void 0;
-  if (!fill && source && typeof source.randomUUID === "function") {
-    try {
-      const native = source.randomUUID();
-      if (UUID_PATTERN.test(native)) return native;
-    } catch {
-    }
-  }
-  const bytes = new Uint8Array(16);
-  if (fill) {
-    fill(bytes);
-  } else if (source && typeof source.getRandomValues === "function") {
-    source.getRandomValues(bytes);
-  } else {
-    for (let i = 0; i < bytes.length; i++) {
-      bytes[i] = Math.floor(Math.random() * 256);
-    }
-  }
-  bytes[6] = (bytes[6] ?? 0) & 15 | 64;
-  bytes[8] = (bytes[8] ?? 0) & 63 | 128;
-  let hex = "";
-  for (let i = 0; i < bytes.length; i++) {
-    hex += (bytes[i] ?? 0).toString(16).padStart(2, "0");
-  }
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-function createShellState(token, { store: raw = browserLocalStorage(), fill } = {}) {
-  const store = safeStore(raw);
-  const key = SHELL_KEY_PREFIX + token;
-  function readRaw() {
-    return readJson(store, key) ?? {};
-  }
-  function patch(next) {
-    writeJson(store, key, { ...readRaw(), ...next });
-  }
-  function read() {
-    const stored = readRaw();
-    const id = stored.anonymousId;
-    return {
-      anonymousId: typeof id === "string" && UUID_PATTERN.test(id) ? id : null,
-      position: readPosition(stored.position),
-      // Anything but a literal `true` means not docked. The value is in the
-      // visitor's own storage, so a truthy string written by an older build
-      // must not be able to hide the widget.
-      docked: stored.docked === true,
-      locale: typeof stored.locale === "string" && LOCALE_PATTERN.test(stored.locale) ? stored.locale : null
-    };
-  }
-  return {
-    read,
-    anonymousId() {
-      const existing = read().anonymousId;
-      if (existing) return existing;
-      patch({ anonymousId: uuidV4(fill) });
-      return read().anonymousId;
-    },
-    rememberPosition(position) {
-      patch({ position });
-    },
-    rememberDocked(docked) {
-      patch({ docked });
-    },
-    rememberLocale(locale) {
-      patch({ locale });
-    },
-    forgetAnonymousId() {
-      const current = readRaw();
-      if (current.anonymousId === void 0) return;
-      delete current.anonymousId;
-      if (Object.keys(current).length === 0) store.removeItem(key);
-      else writeJson(store, key, current);
-    }
-  };
-}
-
 // src/session/visit.ts
 var VISIT_KEY_PREFIX = "arcy.visit.";
 var FIRST_VISIT_VALUE = "first";
@@ -3610,6 +2556,97 @@ function createConversationStore(token, { store: raw = browserLocalStorage(), fi
   };
 }
 
+// src/session/context.ts
+var CAMPAIGN_KEYS = [
+  ["utm_source", "utmSource"],
+  ["utm_medium", "utmMedium"],
+  ["utm_campaign", "utmCampaign"],
+  ["utm_content", "utmContent"],
+  ["utm_term", "utmTerm"]
+];
+var MAX_CAMPAIGN_LENGTH = 255;
+var MAX_REFERRER_LENGTH = 512;
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/g;
+function clean(value, max) {
+  const trimmed = value.replace(CONTROL_CHARACTERS, "").trim();
+  if (trimmed.length === 0) return void 0;
+  return trimmed.slice(0, max);
+}
+function scrubReferrer(referrer) {
+  if (typeof referrer !== "string" || referrer.length === 0) return void 0;
+  try {
+    const url = new URL(referrer);
+    const host = url.host;
+    if (!host) return void 0;
+    const path = scrubPath(url.pathname);
+    return clean(path === "/" ? host : host + path, MAX_REFERRER_LENGTH);
+  } catch {
+    return void 0;
+  }
+}
+function readCampaign(search) {
+  const out = {};
+  if (typeof search !== "string" || search.length === 0) return out;
+  const query = search.charAt(0) === "?" ? search.slice(1) : search;
+  for (const pair of query.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) continue;
+    const rawKey = pair.slice(0, eq).toLowerCase();
+    const match = CAMPAIGN_KEYS.find((entry) => entry[0] === rawKey);
+    if (!match) continue;
+    let value = pair.slice(eq + 1).replace(/\+/g, " ");
+    try {
+      value = decodeURIComponent(value);
+    } catch {
+    }
+    const cleaned = clean(value, MAX_CAMPAIGN_LENGTH);
+    if (cleaned) out[match[1]] = cleaned;
+  }
+  return out;
+}
+function readBrowser(userAgent) {
+  const ua = typeof userAgent === "string" ? userAgent : "";
+  if (ua.length === 0) return void 0;
+  if (/Edg[A-Z]?\//.test(ua)) return "Edge";
+  if (/OPR\/|Opera/.test(ua)) return "Opera";
+  if (/SamsungBrowser\//.test(ua)) return "Samsung Internet";
+  if (/Firefox\/|FxiOS\//.test(ua)) return "Firefox";
+  if (/Chrome\/|CriOS\//.test(ua)) return "Chrome";
+  if (/Safari\//.test(ua)) return "Safari";
+  return void 0;
+}
+function readOs(userAgent) {
+  const ua = typeof userAgent === "string" ? userAgent : "";
+  if (ua.length === 0) return void 0;
+  if (/iPhone|iPad|iPod/.test(ua)) return "iOS";
+  if (/Android/.test(ua)) return "Android";
+  if (/CrOS/.test(ua)) return "ChromeOS";
+  if (/Windows/.test(ua)) return "Windows";
+  if (/Mac OS X|Macintosh/.test(ua)) return "macOS";
+  if (/Linux/.test(ua)) return "Linux";
+  return void 0;
+}
+function viewportBucket(width) {
+  if (typeof width !== "number" || !(width > 0)) return void 0;
+  if (width < 480) return "xs";
+  if (width < 768) return "sm";
+  if (width < 1024) return "md";
+  if (width < 1280) return "lg";
+  return "xl";
+}
+function captureSessionContext(input) {
+  const context = { ...readCampaign(input.search) };
+  const referrer = scrubReferrer(input.referrer);
+  if (referrer) context.referrer = referrer;
+  const browser = readBrowser(input.userAgent);
+  if (browser) context.browser = browser;
+  const os = readOs(input.userAgent);
+  if (os) context.os = os;
+  const viewport = viewportBucket(input.viewportWidth);
+  if (viewport) context.viewport = viewport;
+  return Object.keys(context).length > 0 ? context : void 0;
+}
+
 // src/telemetry/consent.ts
 var STATES = ["ON", "REQUIRE_CONSENT", "OFF"];
 function createConsentCache(store, key) {
@@ -3666,8 +2703,14 @@ function deviceClass(nav) {
 
 // src/telemetry/describe.ts
 var MAX_TEXT_LENGTH = 100;
+var PII_SCAN_MAX = 4096;
 var VALUE_BEARING = ["INPUT", "TEXTAREA", "SELECT"];
-function describeClick(element, describeElement) {
+function readableCopy(raw) {
+  if (raw.length === 0) return void 0;
+  if (containsPii(raw.slice(0, PII_SCAN_MAX))) return void 0;
+  return raw.slice(0, MAX_TEXT_LENGTH);
+}
+function describeElementPayload(element, describeElement) {
   const tag = (element.tagName ?? "").toUpperCase();
   const payload = { tag: tag.toLowerCase() };
   const role = element.getAttribute("role");
@@ -3676,10 +2719,12 @@ function describeClick(element, describeElement) {
   if (type) payload.type = type.slice(0, 32);
   if (VALUE_BEARING.indexOf(tag) === -1) {
     const text = (element.textContent ?? "").replace(/\s+/g, " ").trim();
-    if (text) payload.text = text.slice(0, MAX_TEXT_LENGTH);
+    const readable = readableCopy(text);
+    if (readable) payload.text = readable;
   } else {
     const label = element.getAttribute("aria-label") ?? element.getAttribute("name");
-    if (label) payload.label = label.slice(0, MAX_TEXT_LENGTH);
+    const readable = readableCopy(label ?? "");
+    if (readable) payload.label = readable;
   }
   if (describeElement) {
     const fingerprint = describeElement(element);
@@ -3689,8 +2734,17 @@ function describeClick(element, describeElement) {
   }
   return payload;
 }
-function describeSubmit(form) {
-  const payload = {};
+function describeClick(element, describeElement) {
+  return describeElementPayload(element, describeElement);
+}
+function describeField(element, describeElement) {
+  const payload = describeElementPayload(element, describeElement);
+  const valid = element.validity?.valid;
+  if (typeof valid === "boolean") payload.valid = valid;
+  return payload;
+}
+function describeSubmit(form, describeElement) {
+  const payload = describeElementPayload(form, describeElement);
   const name = form.getAttribute("name") ?? form.getAttribute("id");
   if (name) payload.form = name.slice(0, MAX_TEXT_LENGTH);
   const count = form.elements?.length;
@@ -3698,6 +2752,169 @@ function describeSubmit(form) {
   return payload;
 }
 
+// src/telemetry/errors.ts
+var REQUEST_METHODS = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS"
+];
+var OTHER_METHOD = "OTHER";
+var FAILED_STATUS_MIN = 400;
+var ERROR_MESSAGE_MAX = 200;
+var CONTROL_CHARACTERS2 = /[\u0000-\u001f\u007f]+/g;
+function readErrorMessage(raw) {
+  let text = null;
+  if (typeof raw === "string") text = raw;
+  else if (raw && typeof raw === "object") {
+    const message = raw.message;
+    if (typeof message === "string") text = message;
+  }
+  if (text === null) return null;
+  const flattened = text.replace(CONTROL_CHARACTERS2, " ").trim();
+  if (flattened.length === 0) return null;
+  return flattened.length > ERROR_MESSAGE_MAX ? flattened.slice(0, ERROR_MESSAGE_MAX) : flattened;
+}
+function normalizeMethod(raw) {
+  if (typeof raw !== "string") return "GET";
+  const upper = raw.toUpperCase();
+  return REQUEST_METHODS.indexOf(upper) === -1 ? OTHER_METHOD : upper;
+}
+function isFailedStatus(status) {
+  return typeof status === "number" && status >= FAILED_STATUS_MIN;
+}
+function installNetworkWatch(options) {
+  const { target, report, ignore } = options;
+  const restores = [];
+  function emit(method, status, raw) {
+    try {
+      if (!isFailedStatus(status)) return;
+      if (raw !== null && ignore?.(raw)) return;
+      report({
+        method,
+        status,
+        url: raw === null ? null : normalizeRoute(raw, target.location?.href)
+      });
+    } catch {
+    }
+  }
+  function installFetch() {
+    const original = target.fetch;
+    if (typeof original !== "function") return;
+    const wrapper = function(...args) {
+      const result = original.apply(this, args);
+      try {
+        const promise = result;
+        if (typeof promise?.then !== "function") return result;
+        promise.then(
+          (response) => {
+            const status = response?.status;
+            emit(fetchMethod(args), status, fetchUrl(args));
+          },
+          () => {
+          }
+        );
+      } catch {
+      }
+      return result;
+    };
+    target.fetch = wrapper;
+    restores.push(() => {
+      if (target.fetch === wrapper) target.fetch = original;
+    });
+  }
+  function installXhr() {
+    const proto = target.XMLHttpRequest?.prototype;
+    const originalOpen = proto?.open;
+    const originalSend = proto?.send;
+    if (!proto || typeof originalOpen !== "function" || typeof originalSend !== "function") {
+      return;
+    }
+    if (typeof WeakMap !== "function") return;
+    const pending = /* @__PURE__ */ new WeakMap();
+    const open = function(...args) {
+      const result = originalOpen.apply(this, args);
+      try {
+        pending.set(this, {
+          method: normalizeMethod(args[0]),
+          url: typeof args[1] === "string" ? args[1] : null,
+          listening: pending.get(this)?.listening ?? false
+        });
+      } catch {
+      }
+      return result;
+    };
+    const send = function(...args) {
+      try {
+        const xhr = this;
+        const record = pending.get(this);
+        if (typeof xhr.addEventListener === "function" && record?.listening !== true) {
+          if (record) record.listening = true;
+          xhr.addEventListener("loadend", () => {
+            const current = pending.get(this);
+            emit(current?.method ?? "GET", xhr.status, current?.url ?? null);
+          });
+        }
+      } catch {
+      }
+      return originalSend.apply(this, args);
+    };
+    proto.open = open;
+    restores.push(() => {
+      if (proto.open === open) proto.open = originalOpen;
+    });
+    proto.send = send;
+    restores.push(() => {
+      if (proto.send === send) proto.send = originalSend;
+    });
+  }
+  try {
+    installFetch();
+    installXhr();
+  } catch {
+    for (const restore of restores) {
+      try {
+        restore();
+      } catch {
+      }
+    }
+    return null;
+  }
+  if (restores.length === 0) return null;
+  return () => {
+    for (const restore of restores) {
+      try {
+        restore();
+      } catch {
+      }
+    }
+    restores.length = 0;
+  };
+}
+function fetchMethod(args) {
+  const init = args[1];
+  if (init && typeof init === "object" && typeof init.method === "string") {
+    return normalizeMethod(init.method);
+  }
+  const input = args[0];
+  if (input && typeof input === "object" && typeof input.method === "string") {
+    return normalizeMethod(input.method);
+  }
+  return "GET";
+}
+function fetchUrl(args) {
+  const input = args[0];
+  if (typeof input === "string") return input;
+  if (!input || typeof input !== "object") return null;
+  const url = input.url;
+  if (typeof url === "string") return url;
+  const href = input.href;
+  return typeof href === "string" ? href : null;
+}
+
 // src/telemetry/events.ts
 function buildEvent(id, name, occurredAt, context, payload) {
   const event = {
@@ -3716,6 +2933,63 @@ function buildEvent(id, name, occurredAt, context, payload) {
   return event;
 }
 
+// src/telemetry/fields.ts
+var NON_FIELD_TYPES = [
+  "button",
+  "submit",
+  "reset",
+  "image",
+  "hidden",
+  "checkbox",
+  "radio"
+];
+var FIELD_TAGS = ["INPUT", "TEXTAREA", "SELECT"];
+function isFieldElement(element) {
+  if (!element || typeof element.getAttribute !== "function") return false;
+  const tag = (element.tagName ?? "").toUpperCase();
+  if (FIELD_TAGS.indexOf(tag) === -1) return false;
+  if (tag !== "INPUT") return true;
+  const type = (element.getAttribute("type") ?? "text").toLowerCase();
+  return NON_FIELD_TYPES.indexOf(type) === -1;
+}
+function isEmpty(element) {
+  const value = element.value;
+  return typeof value === "string" ? value.length === 0 : value == null;
+}
+function createFieldObserver(options) {
+  let active = null;
+  return {
+    focus(element) {
+      if (!isFieldElement(element)) return;
+      active = {
+        element,
+        empty: isEmpty(element),
+        filled: false,
+        cleared: false
+      };
+      options.emit("field_focused", element);
+    },
+    change(element) {
+      if (!active || active.element !== element) return;
+      const empty = isEmpty(element);
+      if (empty === active.empty) return;
+      active.empty = empty;
+      if (!empty) {
+        if (active.filled) return;
+        active.filled = true;
+        options.emit("input_filled", element);
+        return;
+      }
+      if (active.cleared) return;
+      active.cleared = true;
+      options.emit("input_cleared", element);
+    },
+    blur(element) {
+      if (active && active.element === element) active = null;
+    }
+  };
+}
+
 // src/telemetry/interactive.ts
 var INTERACTIVE_TAGS = [
   "A",
@@ -3766,6 +3040,78 @@ function findInteractive(target, cursorOf) {
   return null;
 }
 
+// src/telemetry/scroll.ts
+var SCROLL_MILESTONES = [25, 50, 75, 100];
+var SCROLL_THROTTLE_MS = 250;
+var FINAL_MILESTONE = 100;
+function createScrollObserver(options) {
+  const {
+    readDepth,
+    emit,
+    setTimeoutImpl = (fn, ms) => setTimeout(fn, ms),
+    clearTimeoutImpl = (handle) => clearTimeout(handle),
+    throttleMs = SCROLL_THROTTLE_MS
+  } = options;
+  let reported = 0;
+  let pending = null;
+  function evaluate() {
+    pending = null;
+    let depth = null;
+    try {
+      depth = readDepth();
+    } catch {
+      return;
+    }
+    if (depth === null) return;
+    let reached = 0;
+    for (const milestone of SCROLL_MILESTONES) {
+      if (depth >= milestone) reached = milestone;
+    }
+    if (reached <= reported) return;
+    reported = reached;
+    emit(reached);
+  }
+  return {
+    scrolled() {
+      if (pending !== null) return;
+      if (reported >= FINAL_MILESTONE) return;
+      try {
+        pending = setTimeoutImpl(evaluate, throttleMs);
+      } catch {
+        pending = null;
+      }
+    },
+    reset() {
+      reported = 0;
+      if (pending !== null) {
+        try {
+          clearTimeoutImpl(pending);
+        } catch {
+        }
+        pending = null;
+      }
+    },
+    dispose() {
+      if (pending === null) return;
+      try {
+        clearTimeoutImpl(pending);
+      } catch {
+      }
+      pending = null;
+    }
+  };
+}
+function scrollDepthPercent(metrics) {
+  const viewport = metrics.innerHeight ?? 0;
+  const total = metrics.documentHeight ?? 0;
+  const scrollable = total - viewport;
+  if (!(scrollable > 0) || !(viewport > 0)) return null;
+  const scrolled = (metrics.scrollY ?? 0) + viewport;
+  const percent = scrolled / total * 100;
+  if (!(percent > 0)) return 0;
+  return percent > 100 ? 100 : percent;
+}
+
 // src/telemetry/session.ts
 var SESSION_WINDOW_MS = 30 * 60 * 1e3;
 var TOUCH_WRITE_INTERVAL_MS = 60 * 1e3;
@@ -3776,22 +3122,34 @@ function createSessionStore({
   fill,
   windowMs = SESSION_WINDOW_MS
 }) {
-  function touch() {
-    const at = now();
+  function alive(at) {
     const existing = readJson(store, key);
-    const alive = existing && typeof existing.id === "string" && existing.id.length > 0 && typeof existing.seen === "number" && at - existing.seen < windowMs;
-    if (alive) {
-      if (at - existing.seen >= TOUCH_WRITE_INTERVAL_MS) {
-        writeJson(store, key, { id: existing.id, seen: at });
-      }
-      return existing.id;
+    if (existing && typeof existing.id === "string" && existing.id.length > 0 && typeof existing.seen === "number" && at - existing.seen < windowMs) {
+      return existing;
     }
+    return null;
+  }
+  function mint(at) {
     const id = ulid(at, fill);
     writeJson(store, key, { id, seen: at });
     return id;
   }
+  function touch() {
+    const at = now();
+    const existing = alive(at);
+    if (!existing) return mint(at);
+    if (at - existing.seen >= TOUCH_WRITE_INTERVAL_MS) {
+      writeJson(store, key, { id: existing.id, seen: at });
+    }
+    return existing.id;
+  }
+  function current() {
+    const at = now();
+    return alive(at)?.id ?? mint(at);
+  }
   return {
     touch,
+    current,
     peek: () => readJson(store, key),
     clear() {
       store.removeItem(key);
@@ -4069,7 +3427,7 @@ function createTelemetry(options) {
   function currentRoute() {
     return normalizeRoute(win?.location?.href) ?? void 0;
   }
-  function capture(name, payload, fields) {
+  function capture(name, payload, fields2) {
     if (halted) return false;
     if (!consent.shouldCapture()) return false;
     if (transport.stopped() !== null) return false;
@@ -4086,13 +3444,13 @@ function createTelemetry(options) {
         route: currentRoute(),
         localeCode,
         deviceClass: resolvedDeviceClass,
-        flowSessionId: fields?.flowSessionId ?? getFlowSessionId?.() ?? void 0
+        flowSessionId: fields2?.flowSessionId ?? getFlowSessionId?.() ?? void 0
       },
       payload
     );
-    if (fields?.flowId) event.flowId = fields.flowId;
-    if (fields?.flowVersion) event.flowVersion = fields.flowVersion;
-    if (fields?.stepCvid) event.stepCvid = fields.stepCvid;
+    if (fields2?.flowId) event.flowId = fields2.flowId;
+    if (fields2?.flowVersion) event.flowVersion = fields2.flowVersion;
+    if (fields2?.stepCvid) event.stepCvid = fields2.stepCvid;
     transport.enqueue(event);
     return true;
   }
@@ -4118,7 +3476,7 @@ function createTelemetry(options) {
       const raw = event;
       if (isSynthetic(raw)) return;
       if (!raw.target || typeof raw.target.getAttribute !== "function") return;
-      capture("form_submit", describeSubmit(raw.target));
+      capture("form_submit", describeSubmit(raw.target, describeElement));
     } catch {
     }
   };
@@ -4128,16 +3486,118 @@ function createTelemetry(options) {
       if (route === lastRoute) return;
       const from = lastRoute;
       lastRoute = route;
+      scroll.reset();
       capture("navigation", from ? { from } : void 0);
     } catch {
     }
   };
+  const fields = createFieldObserver({
+    emit: (name, element) => {
+      capture(name, describeField(element, describeElement));
+    }
+  });
+  const scroll = createScrollObserver({
+    readDepth: () => scrollDepthPercent({
+      scrollY: win?.scrollY,
+      innerHeight: win?.innerHeight,
+      documentHeight: doc?.documentElement?.scrollHeight
+    }),
+    emit: (percent) => {
+      capture("scroll_depth", { percent });
+    },
+    setTimeoutImpl: options.setTimeoutImpl,
+    clearTimeoutImpl: options.clearTimeoutImpl
+  });
+  let sessionEnded = false;
+  const onFocusIn = (event) => {
+    try {
+      const raw = event;
+      if (isSynthetic(raw) || !raw.target) return;
+      fields.focus(raw.target);
+    } catch {
+    }
+  };
+  const onFieldChange = (event) => {
+    try {
+      const raw = event;
+      if (isSynthetic(raw) || !raw.target) return;
+      fields.change(raw.target);
+    } catch {
+    }
+  };
+  const onFocusOut = (event) => {
+    try {
+      const raw = event;
+      if (!raw.target) return;
+      fields.blur(raw.target);
+    } catch {
+    }
+  };
+  const onScroll = () => {
+    try {
+      scroll.scrolled();
+    } catch {
+    }
+  };
+  const onVisibilityChange = () => {
+    try {
+      if (doc?.visibilityState === "visible") {
+        capture("page_visible");
+        return;
+      }
+      capture("page_hidden");
+      void transport.flush(true);
+    } catch {
+    }
+  };
   const onPageHide = () => {
     try {
+      if (!sessionEnded) {
+        sessionEnded = true;
+        capture("session_end");
+      }
       void transport.flush(true);
     } catch {
     }
   };
+  const onError = (event) => {
+    try {
+      const raw = event;
+      captureError({
+        message: readErrorMessage(raw.message) ?? "Uncaught error",
+        kind: "error",
+        source: scrubSource(raw.filename)
+      });
+    } catch {
+    }
+  };
+  const onRejection = (event) => {
+    try {
+      const raw = event;
+      captureError({
+        // The kind alone when the reason is neither a string nor an `Error`.
+        // Serializing an unknown object from the customer's application is the
+        // one thing this event must never do.
+        message: readErrorMessage(raw.reason) ?? "Unhandled promise rejection",
+        kind: "unhandledrejection"
+      });
+    } catch {
+    }
+  };
+  function captureError(encounter) {
+    const payload = {
+      message: encounter.message,
+      kind: encounter.kind
+    };
+    if (encounter.source) payload.source = encounter.source;
+    capture("js_error", payload);
+  }
+  function scrubSource(raw) {
+    if (typeof raw !== "string") return void 0;
+    return normalizeRoute(raw, win?.location?.href) ?? void 0;
+  }
+  const ownOrigin = (apiBase ?? DEFAULT_API_BASE2).replace(/\/+$/, "");
+  let uninstallNetworkWatch = null;
   return {
     start() {
       if (started || halted) return;
@@ -4145,10 +3605,31 @@ function createTelemetry(options) {
       lastRoute = currentRoute() ?? null;
       doc?.addEventListener("click", onClick, true);
       doc?.addEventListener("submit", onSubmit, true);
+      doc?.addEventListener("focusin", onFocusIn, true);
+      doc?.addEventListener("focusout", onFocusOut, true);
+      doc?.addEventListener("input", onFieldChange, true);
+      doc?.addEventListener("change", onFieldChange, true);
       win?.addEventListener(ROUTE_CHANGE_EVENT, onNavigate);
       win?.addEventListener("popstate", onNavigate);
+      win?.addEventListener("scroll", onScroll, { passive: true });
       win?.addEventListener("pagehide", onPageHide);
-      doc?.addEventListener("visibilitychange", onPageHide);
+      doc?.addEventListener("visibilitychange", onVisibilityChange);
+      win?.addEventListener("error", onError);
+      win?.addEventListener("unhandledrejection", onRejection);
+      if (win && uninstallNetworkWatch === null) {
+        uninstallNetworkWatch = installNetworkWatch({
+          target: win,
+          report: (failure) => {
+            const payload = {
+              method: failure.method,
+              status: failure.status
+            };
+            if (failure.url) payload.url = failure.url;
+            capture("request_failed", payload);
+          },
+          ignore: (url) => url.indexOf(ownOrigin) === 0
+        });
+      }
       loadNavigationPending = !capture("navigation") && consent.state() === null;
     },
     stop(options2) {
@@ -4157,10 +3638,22 @@ function createTelemetry(options) {
       started = false;
       doc?.removeEventListener("click", onClick, true);
       doc?.removeEventListener("submit", onSubmit, true);
+      doc?.removeEventListener("focusin", onFocusIn, true);
+      doc?.removeEventListener("focusout", onFocusOut, true);
+      doc?.removeEventListener("input", onFieldChange, true);
+      doc?.removeEventListener("change", onFieldChange, true);
       win?.removeEventListener(ROUTE_CHANGE_EVENT, onNavigate);
       win?.removeEventListener("popstate", onNavigate);
+      win?.removeEventListener("scroll", onScroll);
       win?.removeEventListener("pagehide", onPageHide);
-      doc?.removeEventListener("visibilitychange", onPageHide);
+      doc?.removeEventListener("visibilitychange", onVisibilityChange);
+      win?.removeEventListener("error", onError);
+      win?.removeEventListener("unhandledrejection", onRejection);
+      if (uninstallNetworkWatch) {
+        uninstallNetworkWatch();
+        uninstallNetworkWatch = null;
+      }
+      scroll.dispose();
       if (options2?.discard) transport.discard();
       else void transport.flush(false);
       transport.dispose();
@@ -4176,11 +3669,11 @@ function createTelemetry(options) {
       consent.setConsent(granted);
       if (!granted) transport.discard();
     },
-    track(name, payload, fields) {
-      capture(name, payload, fields);
+    track(name, payload, fields2) {
+      capture(name, payload, fields2);
     },
     flush: () => transport.flush(false),
-    sessionId: () => session.touch(),
+    sessionId: () => session.current(),
     resetSession: () => session.clear(),
     stopped: () => transport.stopped(),
     state: () => consent.state()
@@ -4188,14 +3681,15 @@ function createTelemetry(options) {
 }
 
 // src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.1.1";
 
 // src/api.ts
 var OPTION_KEYS = [
   "telemetry",
   "locale",
   "defaultOpen",
-  "contentLocale"
+  "contentLocale",
+  "apiBase"
 ];
 function emptyIdentity() {
   return { userId: null, isAnonymous: false, attributes: {} };
@@ -4217,6 +3711,7 @@ function sanitizeAttributes(attributes, method) {
   }
   const out = {};
   for (const [key, value] of Object.entries(attributes)) {
+    if (value === void 0) continue;
     if (value === null) {
       out[key] = null;
       continue;
@@ -4236,11 +3731,25 @@ function sanitizeAttributes(attributes, method) {
   }
   return out;
 }
-function createArcy() {
-  return createArcyInternals().api;
+var unavailableChunks = {
+  cdnBase: null,
+  loadChat: () => Promise.resolve(null),
+  loadFlow: () => Promise.resolve(null),
+  loadPicker: () => Promise.resolve(null)
+};
+function createArcy(chunks) {
+  return createArcyInternals({ chunks }).api;
 }
 function createArcyInternals(internalOptions = {}) {
+  const chunks = internalOptions.chunks ?? unavailableChunks;
   const emitter = createEmitter();
+  function resolveApiBase() {
+    const fromOptions = options.apiBase;
+    if (typeof fromOptions === "string" && fromOptions.length > 0) {
+      return fromOptions.replace(/\/+$/, "");
+    }
+    return internalOptions.apiBase ?? DEFAULT_API_BASE;
+  }
   let token = null;
   let options = {};
   let identity = emptyIdentity();
@@ -4254,6 +3763,8 @@ function createArcyInternals(internalOptions = {}) {
   let bootstrap = null;
   let sendSessionSequence = 0;
   let entryRouteValue;
+  let sessionContextValue;
+  let sessionContextResolved = false;
   let shellState = null;
   let visitState = null;
   let conversationStore = null;
@@ -4292,7 +3803,7 @@ function createArcyInternals(internalOptions = {}) {
         for (const [key, value] of Object.entries(nextOptions)) {
           if (!OPTION_KEYS.includes(key)) {
             warn(
-              `init() ignored unknown option "${key}". Only telemetry, locale, defaultOpen, and contentLocale can be set in code; everything else is configured in the dashboard.`
+              `init() ignored unknown option "${key}". Only telemetry, locale, defaultOpen, contentLocale, and apiBase can be set in code; everything else is configured in the dashboard.`
             );
             continue;
           }
@@ -4300,6 +3811,12 @@ function createArcyInternals(internalOptions = {}) {
         }
       }
     }
+    if (typeof window !== "undefined") {
+      reportCspViolations(window, {
+        apiBase: resolveApiBase(),
+        cdnBase: chunks.cdnBase
+      });
+    }
     start(nextToken);
     startDesignMode(nextToken);
     startPreviewMode(nextToken);
@@ -4343,7 +3860,7 @@ function createArcyInternals(internalOptions = {}) {
         // The same seam the bootstrap gets. Without it the collector's batches
         // leave through the real `fetch` even under test, so nothing in this
         // package could ever assert what a captured event actually carries.
-        apiBase: internalOptions.apiBase,
+        apiBase: resolveApiBase(),
         fetchImpl: internalOptions.fetchImpl,
         // 15.1 plugs in here. This is what makes a click on the customer's
         // page resolvable to the element the dashboard picked: both sides
@@ -4368,7 +3885,7 @@ function createArcyInternals(internalOptions = {}) {
     try {
       bootstrap = createSessionBootstrap({
         token: activeToken,
-        apiBase: internalOptions.apiBase,
+        apiBase: resolveApiBase(),
         fetchImpl: internalOptions.fetchImpl,
         setTimeoutImpl: internalOptions.setTimeoutImpl
       });
@@ -4383,7 +3900,8 @@ function createArcyInternals(internalOptions = {}) {
       void maybeActivateDesignMode({
         win: window,
         token: activeToken,
-        apiBase: internalOptions.apiBase ?? DEFAULT_API_BASE,
+        loadChunk: chunks.loadPicker,
+        apiBase: resolveApiBase(),
         fetchImpl: internalOptions.fetchImpl !== void 0 ? internalOptions.fetchImpl : typeof fetch !== "undefined" ? fetch.bind(globalThis) : null,
         setTimeoutImpl: internalOptions.setTimeoutImpl,
         // Discard, not flush (D490, D492): the queue at this moment is the
@@ -4408,7 +3926,7 @@ function createArcyInternals(internalOptions = {}) {
   }
   function verifyPreview(nonce) {
     return verifyPreviewNonce({
-      apiBase: internalOptions.apiBase ?? DEFAULT_API_BASE,
+      apiBase: resolveApiBase(),
       token: token ?? "",
       nonce,
       sessionToken: bootstrap?.config()?.sessionToken ?? null,
@@ -4471,16 +3989,12 @@ function createArcyInternals(internalOptions = {}) {
     const chrome = raw?.chrome && typeof raw.chrome === "object" && !Array.isArray(raw.chrome) ? { ...FALLBACK_CHROME, ...raw.chrome } : FALLBACK_CHROME;
     const welcomeIconUrl = raw?.welcomeIconUrl;
     const chatBarIconUrl = raw?.chatBarIconUrl;
+    const apiBase = resolveApiBase();
     return {
       name: identity2.name,
-      logoUrl: identity2.logoUrl,
-      // Re-checked here rather than trusted, same as privacyPolicyUrl below:
-      // a rewritten bootstrap must not be able to point this at a
-      // non-`https` URL (ADR 0050).
-      welcomeIconUrl: typeof welcomeIconUrl === "string" && /^https:\/\//i.test(welcomeIconUrl) ? welcomeIconUrl : null,
-      // Same re-check, same reason: this renders into an `<img src>` on a
-      // page ARCY does not control (ADR 0050).
-      chatBarIconUrl: typeof chatBarIconUrl === "string" && /^https:\/\//i.test(chatBarIconUrl) ? chatBarIconUrl : null,
+      logoUrl: resolveImageUrl(identity2.logoUrl, apiBase),
+      welcomeIconUrl: resolveImageUrl(welcomeIconUrl, apiBase),
+      chatBarIconUrl: resolveImageUrl(chatBarIconUrl, apiBase),
       welcomeMessage: text(raw?.welcomeMessage),
       inputPlaceholder: text(raw?.inputPlaceholder),
       welcomeHeadline: text(raw?.welcomeHeadline),
@@ -4710,6 +4224,7 @@ function createArcyInternals(internalOptions = {}) {
       chatController = createChatController({
         root,
         host,
+        loadChunk: chunks.loadChat,
         // The panel's collapse control reaches the public close() through
         // here, so isOpen() has exactly one writer. There is no close, only
         // collapse: the bar never leaves.
@@ -4742,6 +4257,10 @@ function createArcyInternals(internalOptions = {}) {
           setDisclaimer: (text) => mountedBar.setDisclaimer(text),
           setAttachEnabled: (enabled) => mountedBar.setAttachEnabled(enabled),
           setAttachmentCount: (count) => mountedBar.setAttachmentCount(count),
+          // Where the panel's image tiles render: inside the composer, above
+          // its input. The tiles stay the panel's (it owns the upload they
+          // stand for); only the place is the bar's.
+          attachmentSlot: () => mountedBar.attachmentSlot(),
           focusInput: () => mountedBar.focusInput(),
           getMetrics: () => mountedBar.getMetrics(),
           // The panel's Settings sheet asked for the widget to become a
@@ -4752,7 +4271,7 @@ function createArcyInternals(internalOptions = {}) {
         // The flows catalog fetch inputs; read live rather than captured,
         // same reasoning as everything else in this options object, since
         // the panel can mount before the bootstrap resolves.
-        apiBase: internalOptions.apiBase,
+        apiBase: resolveApiBase(),
         getSessionToken: () => bootstrap?.config()?.sessionToken ?? null,
         getSessionId: () => telemetry?.sessionId(),
         getRoute: () => typeof window !== "undefined" ? window.location.pathname : "",
@@ -4806,7 +4325,7 @@ function createArcyInternals(internalOptions = {}) {
     if (!sessionToken) return null;
     const visits = visitState;
     return {
-      apiBase: internalOptions.apiBase ?? DEFAULT_API_BASE,
+      apiBase: resolveApiBase(),
       token,
       sessionToken,
       sessionId: telemetry?.sessionId(),
@@ -4882,7 +4401,7 @@ function createArcyInternals(internalOptions = {}) {
     try {
       const context = buildFlowContext();
       if (!context) return;
-      flowController = createFlowController({ context });
+      flowController = createFlowController({ context, loadChunk: chunks.loadFlow });
     } catch (error) {
       warn(`The flow engine could not be prepared. ${String(error)}`);
     }
@@ -4939,6 +4458,22 @@ function createArcyInternals(internalOptions = {}) {
       return void 0;
     }
   }
+  function sessionContext() {
+    if (sessionContextResolved) return sessionContextValue;
+    sessionContextResolved = true;
+    try {
+      if (typeof window === "undefined") return void 0;
+      sessionContextValue = captureSessionContext({
+        referrer: typeof document !== "undefined" ? document.referrer : null,
+        search: window.location?.search ?? null,
+        userAgent: typeof navigator !== "undefined" ? navigator.userAgent : null,
+        viewportWidth: window.innerWidth
+      });
+      return sessionContextValue;
+    } catch {
+      return void 0;
+    }
+  }
   async function sendSession() {
     if (!bootstrap || !telemetry) return;
     const mySequence = ++sendSessionSequence;
@@ -4951,6 +4486,10 @@ function createArcyInternals(internalOptions = {}) {
       // identify() per route change from making every navigation a new
       // payload, which is the re-send storm D338's skip exists to prevent.
       route: entryRoute(),
+      // Frozen with the entry route and for the same reason. Segmentation
+      // dimensions, not behavior: they land on the session row rather than on
+      // four hundred events that would each repeat them (#790).
+      sessionContext: sessionContext(),
       // Sent whether or not this browser has identified (D517). It is the
       // Lift Subject for anyone who never will, and the anonymous half of the
       // pairing ADR 0055 discovers for everyone who does.
@@ -5004,15 +4543,15 @@ function createArcyInternals(internalOptions = {}) {
       warn("identify() needs a user id. Ignoring the call.");
       return;
     }
-    const clean = sanitizeAttributes(attributes, "identify");
-    if (clean === null) return;
+    const clean2 = sanitizeAttributes(attributes, "identify");
+    if (clean2 === null) return;
     const hash = readUserHash((options2 ?? {}).userHash, "identify");
     if (!hash.ok) return;
     const sameUser = identity.userId === userId && !identity.isAnonymous;
     identity = {
       userId,
       isAnonymous: false,
-      attributes: sameUser ? { ...identity.attributes, ...clean } : clean,
+      attributes: sameUser ? { ...identity.attributes, ...clean2 } : clean2,
       // **The proof carries over for the same id and never across ids.** An
       // SPA re-identifying the same user on every route change passes the hash
       // once at login and nothing afterwards, and dropping it there would
@@ -5026,9 +4565,9 @@ function createArcyInternals(internalOptions = {}) {
   }
   async function identifyAnonymous(attributes) {
     if (!requireInit("identifyAnonymous")) return;
-    const clean = sanitizeAttributes(attributes, "identifyAnonymous");
-    if (clean === null) return;
-    identity = { userId: null, isAnonymous: true, attributes: clean };
+    const clean2 = sanitizeAttributes(attributes, "identifyAnonymous");
+    if (clean2 === null) return;
+    identity = { userId: null, isAnonymous: true, attributes: clean2 };
     await syncSession();
   }
   async function updateUser(attributes) {
@@ -5039,9 +4578,9 @@ function createArcyInternals(internalOptions = {}) {
       );
       return;
     }
-    const clean = sanitizeAttributes(attributes, "updateUser");
-    if (clean === null) return;
-    identity = { ...identity, attributes: { ...identity.attributes, ...clean } };
+    const clean2 = sanitizeAttributes(attributes, "updateUser");
+    if (clean2 === null) return;
+    identity = { ...identity, attributes: { ...identity.attributes, ...clean2 } };
     await syncSession();
   }
   function reset() {
@@ -5098,12 +4637,115 @@ function createArcyInternals(internalOptions = {}) {
     getConfig: () => bootstrap?.config() ?? null,
     selectLocale,
     getShellState: () => shellState,
-    getTokens: () => tokens
+    getTokens: () => tokens,
+    getWidgetChrome: () => readWidgetChrome()
   };
 }
 
+// src/chunks/bundled.ts
+async function importChunk(win, importer, globalKey, contract, surface, timeoutMs, setTimeoutImpl) {
+  const holder = win;
+  let warned = false;
+  const complain = (message) => {
+    if (warned) return;
+    warned = true;
+    warn(message);
+  };
+  const read = () => {
+    let registration2;
+    try {
+      registration2 = holder[globalKey];
+    } catch {
+      complain(`The ${surface} registration could not be read. It will not start.`);
+      return null;
+    }
+    if (!registration2) return null;
+    if (typeof registration2.mount !== "function") {
+      complain(`The ${surface} registered something unusable. It will not start.`);
+      return null;
+    }
+    let declared;
+    try {
+      declared = registration2.contract;
+    } catch {
+      declared = void 0;
+    }
+    if (declared !== contract) {
+      complain(
+        `The bundled ${surface} speaks contract ${typeof declared === "number" ? declared : "unknown"}, this arcy.js speaks ${contract}. Reinstall arcy.js so both halves come from one version.`
+      );
+      return null;
+    }
+    return registration2;
+  };
+  let present = false;
+  try {
+    present = holder[globalKey] !== void 0;
+  } catch {
+    present = true;
+  }
+  if (present) return read();
+  const arrived = await Promise.race([
+    importer().then(
+      () => "loaded",
+      (error) => {
+        warn(
+          `The ${surface} chunk could not be loaded from your own build. ${String(error)}`
+        );
+        return "failed";
+      }
+    ),
+    new Promise((resolve) => {
+      try {
+        setTimeoutImpl(() => resolve("timeout"), timeoutMs);
+      } catch {
+      }
+    })
+  ]);
+  if (arrived === "failed") return null;
+  if (arrived === "timeout") {
+    warn(`The ${surface} did not load in time.`);
+    return null;
+  }
+  const registration = read();
+  if (!registration && !warned) {
+    complain(`The ${surface} loaded but did not register. It will not start.`);
+  }
+  return registration;
+}
+var bundledChunks = {
+  cdnBase: null,
+  loadChat: (win, timeoutMs, setTimeoutImpl) => importChunk(
+    win,
+    () => import('./chat-IU4IJMGO.js'),
+    CHAT_GLOBAL,
+    CHAT_CONTRACT,
+    "chat panel",
+    timeoutMs,
+    setTimeoutImpl
+  ),
+  loadFlow: (win, timeoutMs, setTimeoutImpl) => importChunk(
+    win,
+    () => import('./flow-M7W3H3C5.js'),
+    FLOW_GLOBAL,
+    FLOW_CONTRACT,
+    "flow engine",
+    timeoutMs,
+    setTimeoutImpl
+  ),
+  loadPicker: (win, timeoutMs, setTimeoutImpl) => importChunk(
+    win,
+    () => import('./picker-JPESE6JJ.js'),
+    PICKER_GLOBAL,
+    PICKER_CONTRACT,
+    "design-mode picker",
+    timeoutMs,
+    setTimeoutImpl
+  )
+};
+
 // src/index.ts
-var arcy = createArcy();
+var arcy = createArcy(bundledChunks);
 var src_default = arcy;
 
 export { VERSION, src_default as default };