Fix chat session init crash and improve embed reliability

app/admin/templates/admin.html

@@ -596,43 +596,32 @@
 
     <!-- ═══ EMBED CODE ═══ -->
     <div class="page" id="page-embed">
-      <div class="page-header"><h1 class="page-title">🚀 Embed & Test Widget</h1><p class="page-sub">Get your chatbot live on your website in under 2 minutes</p></div>
-
-      <!-- Step 1: Test it live -->
-      <div class="card" style="border:2px solid var(--accent);margin-bottom:16px;">
-        <div class="card-title" style="color:var(--accent);">Step 1 — Test Your Widget Live</div>
-        <div class="card-sub">Preview how the chatbot will look and work before adding to your site.</div>
-        <div style="display:flex;gap:12px;flex-wrap:wrap;margin-top:16px;">
-          <button class="btn btn-primary" onclick="openWidgetPreview('midnight')">🌙 Test Dark Theme</button>
-          <button class="btn btn-secondary" onclick="openWidgetPreview('minimal')">☀️ Test Light Theme</button>
-          <button class="btn btn-secondary" onclick="openWidgetPreview('ocean')">🌊 Test Ocean Theme</button>
-        </div>
-        <div style="margin-top:12px;padding:12px;background:var(--surface2);border-radius:8px;font-size:13px;color:var(--muted);">
-          ⚠️ <strong>Note:</strong> You need an active <strong>Subscription Token</strong> to test the real chatbot. Ask your SuperAdmin to grant access. The preview above shows the UI without a real token.
+      <div class="page-header">
+        <h1 class="page-title">Add Chatbot to Your Website</h1>
+        <p class="page-sub">Copy one line, paste it in your website footer — your chatbot goes live instantly</p>
+      </div>
+
+      <!-- Live preview notice -->
+      <div class="card" style="border:2px solid var(--green);margin-bottom:16px;background:linear-gradient(135deg,rgba(34,197,94,0.08),transparent);">
+        <div class="card-title" style="color:var(--green);">✅ See it working right now</div>
+        <div class="card-sub">Look at the <strong>💬 chat bubble in the bottom corner of this page</strong>. That is exactly what your readers will see on your website.</div>
+        <div id="embed-live-status" style="margin-top:12px;padding:12px 16px;background:var(--surface2);border-radius:8px;font-size:13px;">
+          <span style="color:var(--muted);">🔄 Loading your chatbot preview...</span>
         </div>
       </div>
 
-      <!-- Step 2: Subscription Status + Token -->
+      <!-- Step 1: Copy code -->
       <div class="card" style="margin-bottom:16px;">
-        <div class="card-title">Step 2 — Your Subscription Status</div>
-        <div class="card-sub">Your embed script is auto-generated with your secure token already included.</div>
+        <div class="card-title">Step 1 — Copy this one line</div>
+        <div class="card-sub">Click the copy button. Your secure access token is already included — nothing else to configure.</div>
         <div id="embed-token-status" style="margin-top:14px;padding:12px 16px;background:var(--surface2);border-radius:8px;font-size:13px;">
           <span style="color:var(--muted);">🔄 Checking subscription...</span>
         </div>
-        <div style="margin-top:10px;font-size:13px;color:var(--muted);">
-          📋 <strong>Your Author ID:</strong> <code style="background:var(--surface2);padding:3px 8px;border-radius:6px;font-size:12px;" id="slug-display">Loading...</code>
-        </div>
-      </div>
-
-      <!-- Step 3: Embed code -->
-      <div class="card" style="margin-bottom:16px;">
-        <div class="card-title">Step 3 — Copy Your Embed Script</div>
-        <div class="card-sub">Paste this snippet just before the <code>&lt;/body&gt;</code> tag on every page of your website. Your token is already embedded — just copy and paste.</div>
         <div style="position:relative;margin-top:14px;">
-          <pre style="background:#0d1117;color:#e6edf3;border:1px solid var(--border);border-radius:10px;padding:20px;font-size:12px;overflow-x:auto;line-height:1.7;white-space:pre-wrap;word-break:break-all;" id="embed-code">⏳ Loading your personalised embed script...</pre>
-          <button class="btn btn-primary btn-sm" style="position:absolute;top:12px;right:12px;" onclick="copyEmbedCode()">📋 Copy</button>
+          <pre style="background:#0d1117;color:#e6edf3;border:1px solid var(--border);border-radius:10px;padding:20px;font-size:12px;overflow-x:auto;line-height:1.7;white-space:pre-wrap;word-break:break-all;" id="embed-code">⏳ Preparing your embed code...</pre>
+          <button class="btn btn-primary btn-sm" style="position:absolute;top:12px;right:12px;" onclick="copyEmbedCode()">📋 Copy Code</button>
         </div>
-        <div style="margin-top:10px;display:flex;gap:8px;flex-wrap:wrap;">
+        <div style="margin-top:10px;display:flex;gap:8px;flex-wrap:wrap;align-items:center;">
           <label style="font-size:13px;font-weight:600;color:var(--muted);">Theme:</label>
           <select class="form-input" style="width:auto;margin:0;padding:4px 10px;font-size:13px;" id="embed-theme" onchange="generateEmbedCode()">
             <option value="midnight">Midnight (Dark)</option>
@@ -647,23 +636,30 @@
             <option value="bottom-left">Bottom Left</option>
           </select>
         </div>
-        <div style="margin-top:12px;padding:10px 14px;background:var(--surface2);border-radius:8px;font-size:12px;color:var(--muted);">
-          🔒 <strong>Security note:</strong> Your token is cryptographically signed and tied to your account. Do not share it publicly or commit it to version control.
-        </div>
       </div>
 
-
-      <!-- Platform instructions -->
-      <div class="card">
-        <div class="card-title">Platform-Specific Instructions</div>
+      <!-- Step 2: Paste -->
+      <div class="card" style="margin-bottom:16px;">
+        <div class="card-title">Step 2 — Paste it on your website</div>
+        <div class="card-sub">Paste the code in your website's <strong>footer</strong> section. Every platform has a place for this — pick yours below.</div>
         <div style="display:flex;gap:8px;flex-wrap:wrap;margin:14px 0;">
           <button class="btn btn-secondary btn-sm" onclick="showPlatform('wordpress')" id="plat-wordpress">WordPress</button>
           <button class="btn btn-secondary btn-sm" onclick="showPlatform('squarespace')" id="plat-squarespace">Squarespace</button>
           <button class="btn btn-secondary btn-sm" onclick="showPlatform('webflow')" id="plat-webflow">Webflow</button>
-          <button class="btn btn-secondary btn-sm" onclick="showPlatform('html')" id="plat-html">Plain HTML</button>
+          <button class="btn btn-secondary btn-sm" onclick="showPlatform('wix')" id="plat-wix">Wix</button>
           <button class="btn btn-secondary btn-sm" onclick="showPlatform('shopify')" id="plat-shopify">Shopify</button>
+          <button class="btn btn-secondary btn-sm" onclick="showPlatform('html')" id="plat-html">Other / HTML</button>
+        </div>
+        <div id="platform-instructions" style="font-size:14px;line-height:1.8;color:var(--text2);padding:14px;background:var(--surface2);border-radius:8px;"></div>
+      </div>
+
+      <!-- Step 3: Done -->
+      <div class="card">
+        <div class="card-title">Step 3 — You're done!</div>
+        <div class="card-sub">Visit your website and look for the 💬 bubble in the corner. Click it to test a conversation. Come back here anytime to change the theme or copy the code again.</div>
+        <div style="margin-top:14px;display:flex;gap:12px;flex-wrap:wrap;">
+          <button class="btn btn-primary" onclick="openWidgetPreview('midnight')">Open Full-Screen Preview</button>
         </div>
-        <div id="platform-instructions" style="font-size:14px;line-height:1.8;color:var(--text2);"></div>
       </div>
     </div>
 
@@ -1207,87 +1203,120 @@ async function loadTokenUsage() {
 
 /* ── EMBED CODE ── */
 let _cachedEmbedToken = null;
+
+function buildEmbedSnippet(origin, token, slug, theme, pos) {
+  return (
+    '<scr' + 'ipt src="' + origin + '/static/widget.js" defer\n' +
+    '  data-authorbot-token="' + token + '"\n' +
+    '  data-authorbot-slug="' + slug + '"\n' +
+    '  data-authorbot-api="' + origin + '/api"\n' +
+    '  data-authorbot-theme="' + theme + '"\n' +
+    '  data-authorbot-position="' + pos + '"><\/scr' + 'ipt>'
+  );
+}
+
+function mountLiveWidgetPreview(origin, token, theme, pos) {
+  document.getElementById('ab-root')?.remove();
+  window.__authorBotMounted = false;
+  document.getElementById('authorbot-preview-script')?.remove();
+
+  const script = document.createElement('script');
+  script.id = 'authorbot-preview-script';
+  script.src = origin + '/static/widget.js';
+  script.defer = true;
+  script.setAttribute('data-authorbot-token', token);
+  script.setAttribute('data-authorbot-slug', authorSlug);
+  script.setAttribute('data-authorbot-api', origin + '/api');
+  script.setAttribute('data-authorbot-theme', theme);
+  script.setAttribute('data-authorbot-position', pos);
+  document.body.appendChild(script);
+
+  const liveStatus = document.getElementById('embed-live-status');
+  if (liveStatus) {
+    liveStatus.innerHTML = '<span style="color:var(--green);font-weight:600;">✅ Your chatbot is live on this page — click the 💬 bubble to try it!</span>';
+  }
+}
+
 async function generateEmbedCode() {
   const origin = window.location.origin;
   const theme = document.getElementById('embed-theme')?.value || 'midnight';
   const pos = document.getElementById('embed-pos')?.value || 'bottom-right';
-  document.getElementById('slug-display').textContent = authorSlug;
 
-  // Show loading state
   const codeEl = document.getElementById('embed-code');
   const statusEl = document.getElementById('embed-token-status');
+  const liveStatus = document.getElementById('embed-live-status');
 
   if (!_cachedEmbedToken) {
-    if (codeEl) codeEl.textContent = '⏳ Fetching your subscription token...';
+    if (codeEl) codeEl.textContent = '⏳ Preparing your embed code...';
     try {
       const data = await apiGet(`/admin/${authorSlug}/embed-token`);
       _cachedEmbedToken = data.token;
-      // Show subscription status
       if (statusEl) {
         const d = data.days_remaining || 0;
         const t = (data.tokens_remaining || 0).toLocaleString();
-        statusEl.innerHTML = `<span style="color:var(--green);font-weight:600;">✅ Active subscription</span> &mdash; ${d} days remaining &bull; ${t} tokens left`;
+        statusEl.innerHTML = `<span style="color:var(--green);font-weight:600;">✅ Your chatbot is active</span> — ${d} days remaining, ${t} tokens left`;
       }
     } catch(e) {
-      if (codeEl) codeEl.textContent = '❌ ' + (e.message || 'No active subscription found. Ask your SuperAdmin to grant access.');
-      if (statusEl) statusEl.innerHTML = `<span style="color:var(--red);">❌ No active subscription — contact your administrator</span>`;
+      if (codeEl) codeEl.textContent = '❌ ' + (e.message || 'Your account is not active yet. Please contact support.');
+      if (statusEl) statusEl.innerHTML = `<span style="color:var(--red);">❌ Not active yet — please contact your administrator to activate your chatbot</span>`;
+      if (liveStatus) liveStatus.innerHTML = `<span style="color:var(--red);">❌ Cannot preview — your account needs to be activated first</span>`;
       return;
     }
   }
 
   const tok = _cachedEmbedToken;
-  codeEl.textContent =
-'<!-- AuthorBot Chat Widget -->\n' +
-'<scr' + 'ipt>\n' +
-'  window.AuthorBotConfig = {\n' +
-'    token: "' + tok + '",\n' +
-'    slug: "' + authorSlug + '",\n' +
-'    apiBase: "' + origin + '/api",\n' +
-'    theme: "' + theme + '",\n' +
-'    position: "' + pos + '",\n' +
-'    autoOpenDelay: 0\n' +
-'  };\n' +
-'<\/scr' + 'ipt>\n' +
-'<scr' + 'ipt src="' + origin + '/static/widget.js" async><\/scr' + 'ipt>';
+  if (codeEl) codeEl.textContent = buildEmbedSnippet(origin, tok, authorSlug, theme, pos);
+  mountLiveWidgetPreview(origin, tok, theme, pos);
+  if (!document.getElementById('platform-instructions')?.innerHTML) showPlatform('wordpress');
 }
+
 function copyEmbedCode() {
-  navigator.clipboard.writeText(document.getElementById('embed-code').textContent);
-  toast('Embed code copied to clipboard!', 'success');
+  const text = document.getElementById('embed-code').textContent;
+  if (text.startsWith('⏳') || text.startsWith('❌')) {
+    toast('Please wait for your embed code to load first', 'error');
+    return;
+  }
+  navigator.clipboard.writeText(text);
+  toast('Copied! Now paste it in your website footer.', 'success');
 }
-function openWidgetPreview(theme) {
-  const url = `${window.location.origin}/api/widget/${authorSlug}?theme=${theme}&position=bottom-right&autoOpen=1`;
+
+async function openWidgetPreview(theme) {
+  if (!_cachedEmbedToken) await generateEmbedCode();
+  if (!_cachedEmbedToken) return;
+  const pos = document.getElementById('embed-pos')?.value || 'bottom-right';
+  const url = `${window.location.origin}/api/widget/${authorSlug}?token=${encodeURIComponent(_cachedEmbedToken)}&slug=${encodeURIComponent(authorSlug)}&theme=${theme}&position=${pos}&autoOpen=1`;
   window.open(url, '_blank', 'width=500,height=720,resizable=yes');
 }
+
 const PLATFORM_GUIDES = {
-  wordpress: `<strong>WordPress Installation:</strong><br>
-1. In your WordPress dashboard, go to <strong>Appearance → Theme Editor</strong><br>
-2. Open your theme's <strong>footer.php</strong> file<br>
-3. Paste the embed code just before the <code>&lt;/body&gt;</code> tag<br>
-4. Save changes — the widget appears on all pages immediately<br><br>
-<em>Alternative: Use a plugin like <strong>Insert Headers and Footers</strong> to add code without editing theme files.</em>`,
-  squarespace: `<strong>Squarespace Installation:</strong><br>
+  wordpress: `<strong>WordPress — 2 minutes:</strong><br>
+1. Install the free plugin <strong>"WPCode"</strong> or <strong>"Insert Headers and Footers"</strong><br>
+2. Go to the plugin settings → <strong>Footer</strong> section<br>
+3. Paste your copied code → click <strong>Save</strong><br>
+4. Visit your website — the 💬 bubble appears immediately`,
+  squarespace: `<strong>Squarespace — 2 minutes:</strong><br>
 1. Go to <strong>Settings → Advanced → Code Injection</strong><br>
-2. Paste the embed code into the <strong>Footer</strong> section<br>
-3. Click <strong>Save</strong> — widget appears on all pages`,
-  webflow: `<strong>Webflow Installation:</strong><br>
-1. Open your Webflow project settings<br>
-2. Go to <strong>Custom Code → Footer Code</strong><br>
-3. Paste the embed code and click <strong>Save</strong><br>
-4. Publish your site`,
-  html: `<strong>Plain HTML Installation:</strong><br>
-1. Open your HTML file in a text editor<br>
-2. Find the closing <code>&lt;/body&gt;</code> tag<br>
-3. Paste the embed code just before it:<br><br>
-<pre style="background:#0d1117;color:#e6edf3;padding:12px;border-radius:8px;font-size:12px;">    ...your page content...
-    &lt;!-- AuthorBot Widget --&gt;
-    &lt;script&gt;...&lt;/script&gt;
-    &lt;script src="...widget.js"&gt;&lt;/script&gt;
-&lt;/body&gt;</pre>`,
-  shopify: `<strong>Shopify Installation:</strong><br>
-1. In Shopify admin, go to <strong>Online Store → Themes → Actions → Edit Code</strong><br>
-2. Open the <strong>Layout/theme.liquid</strong> file<br>
-3. Find the <code>&lt;/body&gt;</code> tag and paste the embed code just before it<br>
-4. Click <strong>Save</strong>`
+2. Paste your copied code in the <strong>Footer</strong> box<br>
+3. Click <strong>Save</strong> — done!`,
+  webflow: `<strong>Webflow — 2 minutes:</strong><br>
+1. Open <strong>Project Settings → Custom Code</strong><br>
+2. Paste your copied code in <strong>Footer Code</strong><br>
+3. Click <strong>Save</strong>, then <strong>Publish</strong> your site`,
+  wix: `<strong>Wix — 2 minutes:</strong><br>
+1. Go to <strong>Settings → Custom Code</strong><br>
+2. Click <strong>+ Add Custom Code</strong><br>
+3. Paste your copied code, set placement to <strong>Body - end</strong><br>
+4. Apply to <strong>All Pages</strong> → click <strong>Publish</strong>`,
+  shopify: `<strong>Shopify — 3 minutes:</strong><br>
+1. Go to <strong>Online Store → Themes → Edit Code</strong><br>
+2. Open <strong>theme.liquid</strong><br>
+3. Paste your copied code just before <code>&lt;/body&gt;</code><br>
+4. Click <strong>Save</strong>`,
+  html: `<strong>Any website — paste before the closing body tag:</strong><br>
+1. Open your website's HTML editor<br>
+2. Find <code>&lt;/body&gt;</code> near the bottom<br>
+3. Paste your copied code on the line above it<br>
+4. Save and refresh your page`,
 };
 function showPlatform(name) {
   document.querySelectorAll('[id^="plat-"]').forEach(b => b.classList.remove('btn-primary'));

app/api/chat.py

@@ -15,7 +15,8 @@ RULE: Visitor fingerprint is generated server-side.
 import uuid
 import hashlib
 
-from fastapi import APIRouter, Depends, Header, Request
+import structlog
+from fastapi import APIRouter, Depends, Header, HTTPException, Request
 from fastapi.responses import StreamingResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -26,6 +27,7 @@ from app.repositories.book_repo import BookRepository
 from app.schemas.chatbot import ChatRequest, ChatResponse, SessionInitResponse
 
 router = APIRouter()
+logger = structlog.get_logger(__name__)
 
 
 def _fingerprint(request: Request) -> str:
@@ -44,53 +46,58 @@ async def init_session(
     request: Request,
     author=Depends(get_subscription_author),
     db: AsyncSession = Depends(get_db),
-    redis=Depends(get_redis),
 ):
     """Initialize a new chat session for a visitor."""
-    session_id = str(uuid.uuid4())
-    visitor_fp = _fingerprint(request)
-
-    book_repo = BookRepository(db)
-    active_books = await book_repo.list_active_for_author(author.id)
-
-    from app.models.chat_session import ChatSession
-    from app.services.analytics_core.geo import get_geo_info
-    from app.services.analytics_core.tracker import parse_device_info
-
-    geo = await get_geo_info(request)
-    device = parse_device_info(request)
+    try:
+        session_id = str(uuid.uuid4())
+        visitor_fp = _fingerprint(request)
 
-    session = ChatSession(
-        id=session_id,
-        author_id=author.id,
-        visitor_fingerprint=visitor_fp,
-        country_code=geo.get("country_code"),
-        country_name=geo.get("country_name"),
-        city=geo.get("city"),
-        device_type=device.get("device_type"),
-        browser=device.get("browser"),
-        os=device.get("os"),
-    )
-    db.add(session)
-    await db.commit()
+        book_repo = BookRepository(db)
+        active_books = await book_repo.list_active_for_author(author.id)
 
-    return SessionInitResponse(
-        session_id=session_id,
-        bot_name=author.bot_name,
-        welcome_message=author.welcome_message,
-        widget_theme=author.widget_theme,
-        books=[
-            {
-                "id": b.id,
-                "title": b.title,
-                "tagline": b.tagline,
-                "cover_path": b.cover_path,
-                "ai_summary": b.ai_summary,
-            }
-            for b in active_books
-        ],
-        show_book_selector=len(active_books) > 1,
-    )
+        from app.models.chat_session import ChatSession
+        from app.services.analytics_core.geo import get_geo_info
+        from app.services.analytics_core.tracker import parse_device_info
+
+        geo = await get_geo_info(request)
+        device = parse_device_info(request)
+
+        session = ChatSession(
+            id=session_id,
+            author_id=author.id,
+            visitor_fingerprint=visitor_fp,
+            country_code=geo.get("country_code") or None,
+            country_name=geo.get("country_name") or None,
+            city=geo.get("city") or None,
+            device_type=device.get("device_type"),
+            browser=device.get("browser"),
+            os=device.get("os"),
+        )
+        db.add(session)
+        await db.flush()
+
+        return SessionInitResponse(
+            session_id=session_id,
+            bot_name=author.bot_name or "Book Advisor",
+            welcome_message=author.welcome_message or "Hi! How can I help you today?",
+            widget_theme=author.widget_theme or "midnight",
+            books=[
+                {
+                    "id": b.id,
+                    "title": b.title,
+                    "tagline": b.tagline,
+                    "cover_path": b.cover_path,
+                    "ai_summary": b.ai_summary,
+                }
+                for b in active_books
+            ],
+            show_book_selector=len(active_books) > 1,
+        )
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error("session init failed", author_id=author.id, error=str(e), exc_info=True)
+        raise HTTPException(status_code=500, detail="Could not start chat session")
 
 
 @router.post("/{author_slug}", response_model=ChatResponse)

app/core/access/subscription.py

@@ -65,7 +65,11 @@ async def validate_subscription_token(
     token_hash = hash_subscription_token(token)
 
     # Step 3: Redis revocation blacklist (fastest check — O(1))
-    is_revoked = await redis.exists(f"{REVOCATION_REDIS_PREFIX}{token_hash}")
+    try:
+        is_revoked = await redis.exists(f"{REVOCATION_REDIS_PREFIX}{token_hash}")
+    except Exception as e:
+        logger.warning("Redis revocation check skipped", error=str(e))
+        is_revoked = 0
     if is_revoked:
         logger.warning("Revoked token used", author_id=author_id, grant_id=grant_id)
         raise AccessRevokedError()
@@ -87,7 +91,11 @@ async def validate_subscription_token(
         raise AccessRevokedError(access_record.revoke_reason or "Access revoked")
 
     # Step 5: Token budget check
-    budget_exhausted = await redis.exists(f"{BUDGET_EXHAUSTED_REDIS_PREFIX}{author_id}")
+    try:
+        budget_exhausted = await redis.exists(f"{BUDGET_EXHAUSTED_REDIS_PREFIX}{author_id}")
+    except Exception as e:
+        logger.warning("Redis budget check skipped", error=str(e))
+        budget_exhausted = 0
     if budget_exhausted:
         raise BudgetExhaustedError()
 
@@ -122,7 +130,10 @@ async def _add_to_revocation_blacklist(redis: Redis, token_hash: str, expires_at
     """Internal: add token to Redis blacklist with appropriate TTL."""
     from datetime import datetime, timezone
     now = datetime.now(timezone.utc)
-    ttl_seconds = max(int((expires_at - now).total_seconds()), 1)
+    exp = expires_at
+    if exp.tzinfo is None:
+        exp = exp.replace(tzinfo=timezone.utc)
+    ttl_seconds = max(int((exp - now).total_seconds()), 1)
     await redis.setex(
         name=f"{REVOCATION_REDIS_PREFIX}{token_hash}",
         time=ttl_seconds,

app/core/access/token_crypto.py

@@ -110,6 +110,13 @@ def decode_jwt(token: str) -> dict[str, Any]:
 
 # ─── HMAC Subscription Tokens ─────────────────────────────────────────────────
 
+def _datetime_to_unix(dt: datetime) -> int:
+    """Convert datetime to unix timestamp, treating naive values as UTC."""
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return int(dt.timestamp())
+
+
 def create_subscription_token(
     author_id: str,
     grant_id: str,
@@ -133,8 +140,8 @@ def create_subscription_token(
     payload = {
         "author_id": author_id,
         "grant_id": grant_id,
-        "granted_at": int(granted_at.timestamp()),
-        "expires_at": int(expires_at.timestamp()),
+        "granted_at": _datetime_to_unix(granted_at),
+        "expires_at": _datetime_to_unix(expires_at),
     }
     payload_bytes = json.dumps(payload, separators=(",", ":"), sort_keys=True).encode()
     payload_b64 = urlsafe_b64encode(payload_bytes).rstrip(b"=")

app/dependencies.py

@@ -155,9 +155,28 @@ async def get_subscription_author(
     db: AsyncSession = Depends(get_db),
     redis: aioredis.Redis = Depends(get_redis),
 ):
-    """Validate subscription token for chatbot endpoints. Raises on any failure."""
+    """Validate subscription token for chatbot endpoints."""
     from app.core.access.subscription import validate_subscription_token
-    return await validate_subscription_token(x_subscription_token, db, redis)
+    from app.exceptions.access import (
+        AccessRevokedError,
+        BudgetExhaustedError,
+        InvalidSubscriptionTokenError,
+        SubscriptionExpiredError,
+        SubscriptionNotFoundError,
+    )
+
+    try:
+        return await validate_subscription_token(x_subscription_token, db, redis)
+    except InvalidSubscriptionTokenError:
+        raise HTTPException(status_code=401, detail="Invalid or expired subscription token")
+    except SubscriptionExpiredError:
+        raise HTTPException(status_code=403, detail="This chatbot service is currently unavailable")
+    except AccessRevokedError:
+        raise HTTPException(status_code=403, detail="This chatbot service is currently unavailable")
+    except SubscriptionNotFoundError:
+        raise HTTPException(status_code=403, detail="No active subscription. Contact support.")
+    except BudgetExhaustedError:
+        raise HTTPException(status_code=403, detail="Monthly token budget exhausted")
 
 
 # ─── Health Check ─────────────────────────────────────────────────────────────

app/repositories/book_repo.py

@@ -22,7 +22,7 @@ class BookRepository(BaseRepository[Book]):
         Returns:
             List of active Book instances ordered by display_order ascending.
         """
-        result = await self._session.execute(
+        result = await self.session.execute(
             select(Book)
             .where(Book.author_id == author_id, Book.is_active == True)
             .order_by(Book.display_order.asc())
@@ -48,7 +48,7 @@ class BookRepository(BaseRepository[Book]):
             ordered_ids: List of book UUIDs in desired display order.
         """
         for position, book_id in enumerate(ordered_ids):
-            await self._session.execute(
+            await self.session.execute(
                 update(Book)
                 .where(Book.id == book_id, Book.author_id == author_id)
                 .values(display_order=position)
@@ -63,7 +63,7 @@ class BookRepository(BaseRepository[Book]):
         Returns:
             Book instance or None.
         """
-        result = await self._session.execute(
+        result = await self.session.execute(
             select(Book).where(Book.chroma_collection_id == collection_id)
         )
         return result.scalar_one_or_none()
@@ -80,7 +80,7 @@ class BookRepository(BaseRepository[Book]):
         values = {"status": status}
         if error is not None:
             values["error_message"] = error
-        await self._session.execute(
+        await self.session.execute(
             update(Book)
             .where(Book.id == book_id, Book.author_id == author_id)
             .values(**values)

app/repositories/document_repo.py

@@ -23,7 +23,7 @@ class DocumentRepository(BaseRepository[Document]):
         Returns:
             Existing Document or None.
         """
-        result = await self._session.execute(
+        result = await self.session.execute(
             select(Document).where(
                 Document.file_hash == file_hash,
                 Document.author_id == author_id,
@@ -40,7 +40,7 @@ class DocumentRepository(BaseRepository[Document]):
         Returns:
             Document or None.
         """
-        result = await self._session.execute(
+        result = await self.session.execute(
             select(Document).where(Document.upload_id == upload_id)
         )
         return result.scalar_one_or_none()
@@ -65,7 +65,7 @@ class DocumentRepository(BaseRepository[Document]):
         values = {"status": status, **extra_fields}
         if error_message is not None:
             values["error_message"] = error_message
-        await self._session.execute(
+        await self.session.execute(
             update(Document)
             .where(Document.id == doc_id, Document.author_id == author_id)
             .values(**values)
@@ -81,7 +81,7 @@ class DocumentRepository(BaseRepository[Document]):
         Returns:
             List of Document instances.
         """
-        result = await self._session.execute(
+        result = await self.session.execute(
             select(Document).where(
                 Document.book_id == book_id,
                 Document.author_id == author_id,

app/repositories/link_repo.py

@@ -12,7 +12,6 @@ class LinkRepository(BaseRepository[Link]):
 
     def __init__(self, session: AsyncSession) -> None:
         super().__init__(Link, session)
-        self._session = session
 
     async def get_for_book(self, book_id: str, author_id: str) -> Link | None:
         """Get the links record for a specific book.
@@ -24,7 +23,7 @@ class LinkRepository(BaseRepository[Link]):
         Returns:
             Link instance or None.
         """
-        result = await self._session.execute(
+        result = await self.session.execute(
             select(Link).where(
                 Link.book_id == book_id,
                 Link.author_id == author_id,

static/widget.js

@@ -1,58 +1,81 @@
 /**
  * AuthorBot Chat Widget — widget.js
- * Vanilla JS, zero dependencies, ~8KB minified.
+ * Vanilla JS, zero dependencies.
  * Embeds as a floating chat bubble on any author website.
  *
- * Usage:
- *   window.AuthorBotConfig = { token: "YOUR_TOKEN", theme: "midnight", position: "bottom-right" };
- *   <script src="https://cdn.authorbot.io/widget.min.js" async></script>
+ * One-line install (recommended):
+ *   <script src="https://YOUR-BACKEND/static/widget.js" defer
+ *     data-authorbot-token="TOKEN"
+ *     data-authorbot-slug="AUTHOR_ID"
+ *     data-authorbot-api="https://YOUR-BACKEND/api"
+ *     data-authorbot-theme="midnight"
+ *     data-authorbot-position="bottom-right"></script>
  */
 
 (function() {
   'use strict';
 
-  // ── Configuration ──────────────────────────────────────────
-  const CONFIG = Object.assign({
-    theme: 'midnight',
-    position: 'bottom-right',
-    autoOpenDelay: 0,
-    apiBase: '',
-    slug: '',
-  }, window.AuthorBotConfig || {});
-
-  if (!CONFIG.token) {
-    console.warn('[AuthorBot] No token provided. Widget disabled.');
-    return;
+  if (window.__authorBotMounted) return;
+
+  function readConfig() {
+    const script = document.currentScript;
+    const fromData = script ? {
+      token: script.getAttribute('data-authorbot-token') || '',
+      slug: script.getAttribute('data-authorbot-slug') || '',
+      apiBase: script.getAttribute('data-authorbot-api') || '',
+      theme: script.getAttribute('data-authorbot-theme') || '',
+      position: script.getAttribute('data-authorbot-position') || '',
+      autoOpenDelay: Number(script.getAttribute('data-authorbot-auto-open') || 0),
+    } : {};
+
+    return Object.assign({
+      theme: 'midnight',
+      position: 'bottom-right',
+      autoOpenDelay: 0,
+      apiBase: '',
+      slug: '',
+      token: '',
+    }, window.AuthorBotConfig || {}, fromData);
   }
 
-  // ── Theme Definitions ──────────────────────────────────────
-  const THEMES = {
-    midnight: { bg: '#0d0f1a', surface: '#13161f', border: '#ffffff0f', brand: '#6366f1', text: '#e2e8f0', sub: '#94a3b8' },
-    ocean:    { bg: '#0a1628', surface: '#0f1e38', border: '#ffffff0f', brand: '#0ea5e9', text: '#e0f2fe', sub: '#7dd3fc' },
-    forest:   { bg: '#0a1a0f', surface: '#0f2416', border: '#ffffff0f', brand: '#22c55e', text: '#dcfce7', sub: '#86efac' },
-    sunset:   { bg: '#1a0d0a', surface: '#261510', border: '#ffffff0f', brand: '#f97316', text: '#fff7ed', sub: '#fdba74' },
-    minimal:  { bg: '#ffffff', surface: '#f8fafc', border: '#e2e8f0',   brand: '#4f46e5', text: '#1e293b', sub: '#64748b' },
-  };
-
-  const T = THEMES[CONFIG.theme] || THEMES.midnight;
-  const isDark = CONFIG.theme !== 'minimal';
-
-  // ── State ───────────────────────────────────────────────────
-  let sessionId = null;
-  let isOpen = false;
-  let isLoading = false;
-  let selectedBookId = null;
-  let books = [];
-  let turnCount = 0;
-
-  // ── Position helpers ────────────────────────────────────────
-  const POS = CONFIG.position.split('-');
-  const vPos = POS[0]; // top / bottom
-  const hPos = POS[1]; // left / right
-
-  // ── CSS injection ────────────────────────────────────────────
-  const style = document.createElement('style');
-  style.textContent = `
+  function mount() {
+    if (window.__authorBotMounted) return;
+    if (!document.body) return;
+
+    const CONFIG = readConfig();
+
+    if (!CONFIG.token) {
+      console.warn('[AuthorBot] No token provided. Widget disabled.');
+      return;
+    }
+
+    window.__authorBotMounted = true;
+
+    // ── Theme Definitions ──────────────────────────────────────
+    const THEMES = {
+      midnight: { bg: '#0d0f1a', surface: '#13161f', border: '#ffffff0f', brand: '#6366f1', text: '#e2e8f0', sub: '#94a3b8' },
+      ocean:    { bg: '#0a1628', surface: '#0f1e38', border: '#ffffff0f', brand: '#0ea5e9', text: '#e0f2fe', sub: '#7dd3fc' },
+      forest:   { bg: '#0a1a0f', surface: '#0f2416', border: '#ffffff0f', brand: '#22c55e', text: '#dcfce7', sub: '#86efac' },
+      sunset:   { bg: '#1a0d0a', surface: '#261510', border: '#ffffff0f', brand: '#f97316', text: '#fff7ed', sub: '#fdba74' },
+      minimal:  { bg: '#ffffff', surface: '#f8fafc', border: '#e2e8f0',   brand: '#4f46e5', text: '#1e293b', sub: '#64748b' },
+    };
+
+    const T = THEMES[CONFIG.theme] || THEMES.midnight;
+
+    // ── State ───────────────────────────────────────────────────
+    let sessionId = null;
+    let isOpen = false;
+    let isLoading = false;
+    let selectedBookId = null;
+    let books = [];
+    let turnCount = 0;
+
+    const POS = CONFIG.position.split('-');
+    const vPos = POS[0];
+    const hPos = POS[1];
+
+    const style = document.createElement('style');
+    style.textContent = `
     #ab-root * { box-sizing: border-box; font-family: -apple-system, 'Inter', BlinkMacSystemFont, sans-serif; }
     #ab-root { position: fixed; ${vPos}: 24px; ${hPos}: 24px; z-index: 2147483647; display: flex; flex-direction: column; align-items: ${hPos === 'right' ? 'flex-end' : 'flex-start'}; gap: 12px; }
 
@@ -170,12 +193,11 @@
     @keyframes ab-slide-up { from{opacity:0;transform:translateY(8px)} to{opacity:1;transform:translateY(0)} }
     @keyframes ab-bounce { 0%,100%{transform:translateY(0)} 50%{transform:translateY(-4px)} }
   `;
-  document.head.appendChild(style);
+    (document.head || document.documentElement).appendChild(style);
 
-  // ── DOM construction ─────────────────────────────────────────
-  const root = document.createElement('div');
-  root.id = 'ab-root';
-  root.innerHTML = `
+    const root = document.createElement('div');
+    root.id = 'ab-root';
+    root.innerHTML = `
     <div id="ab-window" class="ab-hidden">
       <div id="ab-header">
         <div id="ab-avatar">🤖</div>
@@ -195,222 +217,219 @@
     <button id="ab-bubble" aria-label="Open book advisor chat">💬</button>
   `;
 
-  // Bubble is above window — reverse for bottom positioning
-  if (vPos === 'bottom') {
-    root.style.flexDirection = 'column-reverse';
-  }
+    if (vPos === 'bottom') {
+      root.style.flexDirection = 'column-reverse';
+    }
 
-  document.body.appendChild(root);
-
-  // ── DOM refs ─────────────────────────────────────────────────
-  const $window   = root.querySelector('#ab-window');
-  const $messages = root.querySelector('#ab-messages');
-  const $input    = root.querySelector('#ab-input');
-  const $send     = root.querySelector('#ab-send');
-  const $bubble   = root.querySelector('#ab-bubble');
-  const $close    = root.querySelector('#ab-close-btn');
-  const $botName  = root.querySelector('#ab-bot-name');
-
-  // ── Toggle open/close ─────────────────────────────────────────
-  function openChat() {
-    isOpen = true;
-    $window.classList.remove('ab-hidden');
-    $bubble.style.display = 'none';
-    if (!sessionId) initSession();
-    else $input.focus();
-  }
+    document.body.appendChild(root);
+
+    const $window   = root.querySelector('#ab-window');
+    const $messages = root.querySelector('#ab-messages');
+    const $input    = root.querySelector('#ab-input');
+    const $send     = root.querySelector('#ab-send');
+    const $bubble   = root.querySelector('#ab-bubble');
+    const $close    = root.querySelector('#ab-close-btn');
+    const $botName  = root.querySelector('#ab-bot-name');
+
+    function openChat() {
+      isOpen = true;
+      $window.classList.remove('ab-hidden');
+      $bubble.style.display = 'none';
+      if (!sessionId) initSession();
+      else $input.focus();
+    }
 
-  function closeChat() {
-    isOpen = false;
-    $window.classList.add('ab-hidden');
-    $bubble.style.display = '';
-  }
+    function closeChat() {
+      isOpen = false;
+      $window.classList.add('ab-hidden');
+      $bubble.style.display = '';
+    }
 
-  $bubble.addEventListener('click', openChat);
-  $close.addEventListener('click', closeChat);
-
-  // ── Session init ──────────────────────────────────────────────
-  async function initSession() {
-    try {
-      const res = await apiPost(`/chat/${CONFIG.slug}/session/init`, {}, { 'X-Subscription-Token': CONFIG.token });
-      sessionId = res.session_id;
-      books = res.books || [];
-      $botName.textContent = res.bot_name || 'Book Advisor';
-      addBotMessage(res.welcome_message || 'Hi! How can I help you today?', [], null);
-      if (res.show_book_selector && books.length > 1) {
-        addBotMessage("Which book are you curious about?", [], books);
+    $bubble.addEventListener('click', openChat);
+    $close.addEventListener('click', closeChat);
+
+    async function initSession() {
+      try {
+        const res = await apiPost(`/chat/${CONFIG.slug}/session/init`, {}, { 'X-Subscription-Token': CONFIG.token });
+        sessionId = res.session_id;
+        books = res.books || [];
+        $botName.textContent = res.bot_name || 'Book Advisor';
+        addBotMessage(res.welcome_message || 'Hi! How can I help you today?', [], null);
+        if (res.show_book_selector && books.length > 1) {
+          addBotMessage("Which book are you curious about?", [], books);
+        }
+        $input.focus();
+      } catch (e) {
+        addBotMessage("Sorry, I'm having trouble starting. Please refresh and try again.", [], null);
       }
-      $input.focus();
-    } catch (e) {
-      addBotMessage("Sorry, I'm having trouble starting. Please refresh and try again.", [], null);
     }
-  }
 
-  // ── Send message ──────────────────────────────────────────────
-  async function sendMessage() {
-    const text = $input.value.trim();
-    if (!text || isLoading || !sessionId) return;
-
-    addUserMessage(text);
-    $input.value = '';
-    resizeInput();
-
-    const typingEl = addTypingIndicator();
-    isLoading = true;
-    $send.disabled = true;
-    turnCount++;
-
-    try {
-      const res = await apiPost(`/chat/${CONFIG.slug}`, {
-        session_id: sessionId,
-        message: text,
-        selected_book_id: selectedBookId,
-      }, { 'X-Subscription-Token': CONFIG.token });
-
-      typingEl.remove();
-      addBotMessage(res.text, res.links || [], res.book_selector || null);
-    } catch (e) {
-      typingEl.remove();
-      addBotMessage("Sorry, something went wrong. Please try again.", [], null);
-    } finally {
-      isLoading = false;
-      $send.disabled = false;
-      $input.focus();
-    }
-  }
+    async function sendMessage() {
+      const text = $input.value.trim();
+      if (!text || isLoading || !sessionId) return;
 
-  // ── Message rendering ─────────────────────────────────────────
-  function addUserMessage(text) {
-    const el = document.createElement('div');
-    el.className = 'ab-msg ab-user';
-    el.innerHTML = `<div class="ab-bubble-text">${escHtml(text)}</div>`;
-    $messages.appendChild(el);
-    scrollToBottom();
-  }
+      addUserMessage(text);
+      $input.value = '';
+      resizeInput();
 
-  function addBotMessage(text, links, bookSelector) {
-    const el = document.createElement('div');
-    el.className = 'ab-msg ab-bot';
+      const typingEl = addTypingIndicator();
+      isLoading = true;
+      $send.disabled = true;
+      turnCount++;
 
-    let html = `<div class="ab-bubble-text">${escHtml(text)}</div>`;
+      try {
+        const res = await apiPost(`/chat/${CONFIG.slug}`, {
+          session_id: sessionId,
+          message: text,
+          selected_book_id: selectedBookId,
+        }, { 'X-Subscription-Token': CONFIG.token });
+
+        typingEl.remove();
+        addBotMessage(res.text, res.links || [], res.book_selector || null);
+      } catch (e) {
+        typingEl.remove();
+        addBotMessage("Sorry, something went wrong. Please try again.", [], null);
+      } finally {
+        isLoading = false;
+        $send.disabled = false;
+        $input.focus();
+      }
+    }
 
-    if (links && links.length) {
-      html += `<div class="ab-links">`;
-      links.forEach(l => {
-        html += `<a class="ab-link-btn" href="${escAttr(l.url)}" target="_blank" rel="noopener" data-type="${escAttr(l.type)}">${escHtml(l.icon)} ${escHtml(l.label)}</a>`;
-      });
-      html += `</div>`;
+    function addUserMessage(text) {
+      const el = document.createElement('div');
+      el.className = 'ab-msg ab-user';
+      el.innerHTML = `<div class="ab-bubble-text">${escHtml(text)}</div>`;
+      $messages.appendChild(el);
+      scrollToBottom();
     }
 
-    if (bookSelector && bookSelector.length) {
-      html += `<div class="ab-book-selector">`;
-      bookSelector.forEach(b => {
-        html += `<button class="ab-book-btn" data-book-id="${escAttr(b.id)}">
+    function addBotMessage(text, links, bookSelector) {
+      const el = document.createElement('div');
+      el.className = 'ab-msg ab-bot';
+
+      let html = `<div class="ab-bubble-text">${escHtml(text)}</div>`;
+
+      if (links && links.length) {
+        html += `<div class="ab-links">`;
+        links.forEach(l => {
+          html += `<a class="ab-link-btn" href="${escAttr(l.url)}" target="_blank" rel="noopener" data-type="${escAttr(l.type)}">${escHtml(l.icon)} ${escHtml(l.label)}</a>`;
+        });
+        html += `</div>`;
+      }
+
+      if (bookSelector && bookSelector.length) {
+        html += `<div class="ab-book-selector">`;
+        bookSelector.forEach(b => {
+          html += `<button class="ab-book-btn" data-book-id="${escAttr(b.id)}">
           <span class="ab-book-thumb">📖</span>
           <div style="text-align:left">
             <div style="font-weight:600;font-size:13px">${escHtml(b.title)}</div>
             ${b.tagline ? `<div style="font-size:11px;opacity:0.7;margin-top:1px">${escHtml(b.tagline)}</div>` : ''}
           </div>
         </button>`;
-      });
-      html += `</div>`;
-    }
+        });
+        html += `</div>`;
+      }
 
-    el.innerHTML = html;
+      el.innerHTML = html;
 
-    // Book selection handler
-    el.querySelectorAll('.ab-book-btn').forEach(btn => {
-      btn.addEventListener('click', () => {
-        const bookId = btn.getAttribute('data-book-id');
-        selectedBookId = bookId;
-        const book = bookSelector.find(b => b.id === bookId);
-        addUserMessage(`Tell me about "${book?.title}"`);
-        apiPost(`/chat/${CONFIG.slug}`, {
-          session_id: sessionId,
-          message: `Tell me about "${book?.title}"`,
-          selected_book_id: bookId,
-        }, { 'X-Subscription-Token': CONFIG.token }).then(res => {
-          addBotMessage(res.text, res.links || [], null);
+      el.querySelectorAll('.ab-book-btn').forEach(btn => {
+        btn.addEventListener('click', () => {
+          const bookId = btn.getAttribute('data-book-id');
+          selectedBookId = bookId;
+          const book = bookSelector.find(b => b.id === bookId);
+          addUserMessage(`Tell me about "${book?.title}"`);
+          apiPost(`/chat/${CONFIG.slug}`, {
+            session_id: sessionId,
+            message: `Tell me about "${book?.title}"`,
+            selected_book_id: bookId,
+          }, { 'X-Subscription-Token': CONFIG.token }).then(res => {
+            addBotMessage(res.text, res.links || [], null);
+          });
+          el.querySelectorAll('.ab-book-btn').forEach(b => b.style.opacity = '0.4');
+          btn.style.opacity = '1'; btn.style.borderColor = T.brand;
         });
-        // Disable all book buttons after selection
-        el.querySelectorAll('.ab-book-btn').forEach(b => b.style.opacity = '0.4');
-        btn.style.opacity = '1'; btn.style.borderColor = T.brand;
       });
-    });
 
-    // Link click tracking
-    el.querySelectorAll('.ab-link-btn').forEach(a => {
-      a.addEventListener('click', () => {
-        try {
-          apiPost(`/chat/${CONFIG.slug}/track-click`, {
-            session_id: sessionId,
-            link_type: a.getAttribute('data-type'),
-          }, { 'X-Subscription-Token': CONFIG.token }).catch(() => {});
-        } catch {}
+      el.querySelectorAll('.ab-link-btn').forEach(a => {
+        a.addEventListener('click', () => {
+          try {
+            apiPost(`/chat/${CONFIG.slug}/track-click`, {
+              session_id: sessionId,
+              link_type: a.getAttribute('data-type'),
+            }, { 'X-Subscription-Token': CONFIG.token }).catch(() => {});
+          } catch {}
+        });
       });
-    });
-
-    $messages.appendChild(el);
-    scrollToBottom();
-  }
 
-  function addTypingIndicator() {
-    const el = document.createElement('div');
-    el.className = 'ab-msg ab-bot';
-    el.innerHTML = `<div class="ab-bubble-text ab-typing"><div class="ab-dot"></div><div class="ab-dot"></div><div class="ab-dot"></div></div>`;
-    $messages.appendChild(el);
-    scrollToBottom();
-    return el;
-  }
+      $messages.appendChild(el);
+      scrollToBottom();
+    }
 
-  // ── Input handling ─────────────────────────────────────────────
-  function resizeInput() {
-    $input.style.height = 'auto';
-    $input.style.height = Math.min($input.scrollHeight, 100) + 'px';
-  }
+    function addTypingIndicator() {
+      const el = document.createElement('div');
+      el.className = 'ab-msg ab-bot';
+      el.innerHTML = `<div class="ab-bubble-text ab-typing"><div class="ab-dot"></div><div class="ab-dot"></div><div class="ab-dot"></div></div>`;
+      $messages.appendChild(el);
+      scrollToBottom();
+      return el;
+    }
 
-  $input.addEventListener('input', resizeInput);
-  $input.addEventListener('keydown', e => {
-    if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); sendMessage(); }
-  });
-  $send.addEventListener('click', sendMessage);
+    function resizeInput() {
+      $input.style.height = 'auto';
+      $input.style.height = Math.min($input.scrollHeight, 100) + 'px';
+    }
 
-  // ── Utilities ──────────────────────────────────────────────────
-  function scrollToBottom() {
-    requestAnimationFrame(() => {
-      $messages.scrollTop = $messages.scrollHeight;
+    $input.addEventListener('input', resizeInput);
+    $input.addEventListener('keydown', e => {
+      if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); sendMessage(); }
     });
-  }
+    $send.addEventListener('click', sendMessage);
 
-  function escHtml(str) {
-    return String(str || '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
-  }
+    function scrollToBottom() {
+      requestAnimationFrame(() => {
+        $messages.scrollTop = $messages.scrollHeight;
+      });
+    }
 
-  function escAttr(str) {
-    return String(str || '').replace(/"/g, '&quot;');
-  }
+    function escHtml(str) {
+      return String(str || '').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
+    }
 
-  async function apiPost(path, body, headers) {
-    const base = CONFIG.apiBase || window.location.origin + '/api';
-    const res = await fetch(`${base}${path}`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', ...headers },
-      body: JSON.stringify(body),
-    });
-    if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    return res.json();
-  }
+    function escAttr(str) {
+      return String(str || '').replace(/"/g, '&quot;');
+    }
 
-  // ── Auto-open ──────────────────────────────────────────────────
-  if (CONFIG.autoOpenDelay > 0) {
-    setTimeout(openChat, CONFIG.autoOpenDelay * 1000);
+    async function apiPost(path, body, headers) {
+      const base = CONFIG.apiBase || window.location.origin + '/api';
+      const res = await fetch(`${base}${path}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...headers },
+        body: JSON.stringify(body),
+      });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      return res.json();
+    }
+
+    if (CONFIG.autoOpenDelay > 0) {
+      setTimeout(openChat, CONFIG.autoOpenDelay * 1000);
+    }
+
+    window.AuthorBot = {
+      open: openChat,
+      close: closeChat,
+      toggle: () => isOpen ? closeChat() : openChat(),
+    };
   }
 
-  // ── Expose to window for programmatic control ──────────────────
-  window.AuthorBot = {
-    open: openChat,
-    close: closeChat,
-    toggle: () => isOpen ? closeChat() : openChat(),
-  };
+  function boot() {
+    if (document.readyState === 'loading') {
+      document.addEventListener('DOMContentLoaded', mount);
+    } else {
+      mount();
+    }
+  }
 
+  boot();
 })();