@agent-native/core 0.22.15 → 0.22.17

package/dist/client/embed-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embed-auth.d.ts","sourceRoot":"","sources":["../../src/client/embed-auth.ts"],"names":[],"mappings":"AA0BA,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAMjD;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAW3C;AAiCD,wBAAgB,+BAA+B,IAAI,IAAI,CAoCtD"}
+{"version":3,"file":"embed-auth.d.ts","sourceRoot":"","sources":["../../src/client/embed-auth.ts"],"names":[],"mappings":"AAyDA,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CASjD;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAW3C;AAoLD,wBAAgB,+BAA+B,IAAI,IAAI,CAsCtD"}

package/dist/client/embed-auth.js

@@ -1,6 +1,12 @@
-import { EMBED_MODE_QUERY_PARAM, EMBED_TARGET_HEADER, EMBED_TOKEN_QUERY_PARAM, } from "../shared/embed-auth.js";
+import { EMBED_MODE_QUERY_PARAM, EMBED_START_PATH, EMBED_TARGET_HEADER, EMBED_TOKEN_QUERY_PARAM, } from "../shared/embed-auth.js";
 let installed = false;
 let memoryToken = null;
+const EMBED_TOKEN_STORAGE_KEY = "agent-native:embed-auth-token";
+const AUTH_FAILURE_COOLDOWN_MS = 60_000;
+const GUARDED_METHODS = new Set(["GET", "HEAD"]);
+const AUTH_FAILURE_HEADER = "x-agent-native-auth-circuit-breaker";
+const authFailureCache = new Map();
+let embedAuthFailure = null;
 function browserWindow() {
     return typeof window === "undefined" ? null : window;
 }
@@ -13,17 +19,34 @@ function readTokenFromUrl(win) {
         return null;
     }
 }
-function storeToken(token) {
+function storedToken(win) {
+    try {
+        return win.sessionStorage?.getItem(EMBED_TOKEN_STORAGE_KEY) ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function storeToken(token, win) {
     memoryToken = token;
+    try {
+        win.sessionStorage?.setItem(EMBED_TOKEN_STORAGE_KEY, token);
+    }
+    catch {
+        // Session storage may be unavailable in some sandboxed hosts. The
+        // in-memory fallback still covers the normal single-page boot path.
+    }
 }
 export function getEmbedAuthToken() {
     const win = browserWindow();
     if (!win)
         return null;
     const fromUrl = readTokenFromUrl(win);
-    if (fromUrl)
+    if (fromUrl) {
+        storeToken(fromUrl, win);
         return fromUrl;
-    return memoryToken;
+    }
+    return memoryToken ?? storedToken(win);
 }
 export function isEmbedAuthActive() {
     const win = browserWindow();
@@ -55,16 +78,128 @@ function stripTokenFromUrl(win) {
 function currentEmbedTarget(win) {
     return `${win.location.pathname}${win.location.search}`;
 }
-function sameOrigin(input, win) {
+function inputUrl(input, win) {
     try {
-        const url = input instanceof Request
+        return input instanceof Request
             ? new URL(input.url)
             : new URL(String(input), win.location.origin);
-        return url.origin === win.location.origin;
     }
     catch {
+        return null;
+    }
+}
+function sameOrigin(input, win) {
+    const url = inputUrl(input, win);
+    return !!url && url.origin === win.location.origin;
+}
+function requestMethod(input, init) {
+    return (init?.method ??
+        (input instanceof Request ? input.method : undefined) ??
+        "GET").toUpperCase();
+}
+function authFailureKey(method, url) {
+    return `${method} ${url.href}`;
+}
+function isAuthFailureStatus(status) {
+    return status === 401 || status === 403;
+}
+function shouldGuardAuthFailure(method, url) {
+    if (!GUARDED_METHODS.has(method))
+        return false;
+    if (url.pathname === EMBED_START_PATH)
+        return false;
+    if (url.pathname === "/_agent-native/sign-in")
         return false;
+    return true;
+}
+function activeAuthFailure(record) {
+    if (!record)
+        return null;
+    if (record.expiresAt > Date.now())
+        return record;
+    return null;
+}
+function getCachedAuthFailure(key, useEmbedWideFailure) {
+    const cached = activeAuthFailure(authFailureCache.get(key));
+    if (cached)
+        return cached;
+    authFailureCache.delete(key);
+    if (!useEmbedWideFailure)
+        return null;
+    const embedCached = activeAuthFailure(embedAuthFailure);
+    if (embedCached)
+        return embedCached;
+    embedAuthFailure = null;
+    return null;
+}
+function authFailureResponse(record) {
+    const headers = new Headers(record.headers);
+    headers.set(AUTH_FAILURE_HEADER, "1");
+    if (!headers.has("retry-after")) {
+        headers.set("retry-after", String(Math.max(1, Math.ceil((record.expiresAt - Date.now()) / 1000))));
+    }
+    return new Response(record.body, {
+        status: record.status,
+        statusText: record.statusText,
+        headers,
+    });
+}
+async function recordAuthFailure(key, response, useEmbedWideFailure) {
+    let body = null;
+    try {
+        body = await response.clone().text();
+    }
+    catch {
+        body = null;
     }
+    const headers = [];
+    response.headers.forEach((value, name) => {
+        const lower = name.toLowerCase();
+        if (lower === "content-encoding" ||
+            lower === "content-length" ||
+            lower === "transfer-encoding") {
+            return;
+        }
+        headers.push([name, value]);
+    });
+    const record = {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+        body,
+        expiresAt: Date.now() + AUTH_FAILURE_COOLDOWN_MS,
+    };
+    authFailureCache.set(key, record);
+    if (useEmbedWideFailure)
+        embedAuthFailure = record;
+}
+function clearAuthFailure(key, useEmbedWideFailure) {
+    authFailureCache.delete(key);
+    if (useEmbedWideFailure)
+        embedAuthFailure = null;
+}
+function withEmbedAuthHeaders(input, init, token, win) {
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+    if (!headers.has("Authorization")) {
+        headers.set("Authorization", `Bearer ${token}`);
+    }
+    if (!headers.has(EMBED_TARGET_HEADER)) {
+        headers.set(EMBED_TARGET_HEADER, currentEmbedTarget(win));
+    }
+    if (input instanceof Request) {
+        return [new Request(input, { ...init, headers }), undefined];
+    }
+    return [input, { ...init, headers }];
+}
+function requestUrlAndKey(input, init, win) {
+    const url = inputUrl(input, win);
+    if (!url || url.origin !== win.location.origin)
+        return undefined;
+    const method = requestMethod(input, init);
+    return {
+        key: authFailureKey(method, url),
+        shouldGuard: shouldGuardAuthFailure(method, url),
+    };
 }
 export function ensureEmbedAuthFetchInterceptor() {
     const win = browserWindow();
@@ -72,7 +207,7 @@ export function ensureEmbedAuthFetchInterceptor() {
         return;
     const urlToken = readTokenFromUrl(win);
     if (urlToken) {
-        storeToken(urlToken);
+        storeToken(urlToken, win);
         stripTokenFromUrl(win);
     }
     if (installed)
@@ -81,22 +216,28 @@ export function ensureEmbedAuthFetchInterceptor() {
         return;
     installed = true;
     const originalFetch = win.fetch.bind(win);
-    win.fetch = ((input, init) => {
-        const token = getEmbedAuthToken();
-        if (!token || !sameOrigin(input, win)) {
-            return originalFetch(input, init);
+    win.fetch = (async (input, init) => {
+        const request = requestUrlAndKey(input, init, win);
+        const embedMode = isEmbedAuthActive();
+        if (request?.shouldGuard) {
+            const cached = getCachedAuthFailure(request.key, embedMode);
+            if (cached)
+                return authFailureResponse(cached);
         }
-        const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
-        if (!headers.has("Authorization")) {
-            headers.set("Authorization", `Bearer ${token}`);
+        const token = getEmbedAuthToken();
+        let fetchInput = input;
+        let fetchInit = init;
+        if (token && sameOrigin(input, win)) {
+            [fetchInput, fetchInit] = withEmbedAuthHeaders(input, init, token, win);
         }
-        if (!headers.has(EMBED_TARGET_HEADER)) {
-            headers.set(EMBED_TARGET_HEADER, currentEmbedTarget(win));
+        const response = await originalFetch(fetchInput, fetchInit);
+        if (request?.shouldGuard && isAuthFailureStatus(response.status)) {
+            await recordAuthFailure(request.key, response, embedMode || !!token);
         }
-        if (input instanceof Request) {
-            return originalFetch(new Request(input, { ...init, headers }));
+        else if (request?.shouldGuard && response.ok) {
+            clearAuthFailure(request.key, embedMode || !!token);
         }
-        return originalFetch(input, { ...init, headers });
+        return response;
     });
 }
 //# sourceMappingURL=embed-auth.js.map

package/dist/client/embed-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"embed-auth.js","sourceRoot":"","sources":["../../src/client/embed-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,IAAI,SAAS,GAAG,KAAK,CAAC;AACtB,IAAI,WAAW,GAAkB,IAAI,CAAC;AAEtC,SAAS,aAAa;IACpB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC1D,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAAE,OAAO;QAC3D,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,YAAY,CACtB,GAAG,CAAC,OAAO,CAAC,KAAK,EACjB,EAAE,EACF,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,KAAwB,EAAE,GAAW;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GACP,KAAK,YAAY,OAAO;YACtB,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACpB,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,SAAS;QAAE,OAAO;IACtB,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO;IAC5C,SAAS,GAAG,IAAI,CAAC;IAEjB,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAwB,EAAE,IAAkB,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,aAAa,CAAC,KAAY,EAAE,IAAW,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,IAAI,EAAE,OAAO,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CACxE,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,aAAa,CAAC,KAAY,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAiB,CAAC;AACrB,CAAC","sourcesContent":["import {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_TARGET_HEADER,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\n\nlet installed = false;\nlet memoryToken: string | null = null;\n\nfunction browserWindow(): Window | null {\n  return typeof window === \"undefined\" ? null : window;\n}\n\nfunction readTokenFromUrl(win: Window): string | null {\n  try {\n    const url = new URL(win.location.href);\n    return url.searchParams.get(EMBED_TOKEN_QUERY_PARAM);\n  } catch {\n    return null;\n  }\n}\n\nfunction storeToken(token: string): void {\n  memoryToken = token;\n}\n\nexport function getEmbedAuthToken(): string | null {\n  const win = browserWindow();\n  if (!win) return null;\n  const fromUrl = readTokenFromUrl(win);\n  if (fromUrl) return fromUrl;\n  return memoryToken;\n}\n\nexport function isEmbedAuthActive(): boolean {\n  const win = browserWindow();\n  if (!win) return false;\n  if (getEmbedAuthToken()) return true;\n  try {\n    const url = new URL(win.location.href);\n    const mode = url.searchParams.get(EMBED_MODE_QUERY_PARAM);\n    return mode === \"1\" || mode === \"true\";\n  } catch {\n    return false;\n  }\n}\n\nfunction stripTokenFromUrl(win: Window): void {\n  try {\n    const url = new URL(win.location.href);\n    if (!url.searchParams.has(EMBED_TOKEN_QUERY_PARAM)) return;\n    url.searchParams.delete(EMBED_TOKEN_QUERY_PARAM);\n    win.history.replaceState(\n      win.history.state,\n      \"\",\n      `${url.pathname}${url.search}${url.hash}`,\n    );\n  } catch {\n    // best effort only\n  }\n}\n\nfunction currentEmbedTarget(win: Window): string {\n  return `${win.location.pathname}${win.location.search}`;\n}\n\nfunction sameOrigin(input: RequestInfo | URL, win: Window): boolean {\n  try {\n    const url =\n      input instanceof Request\n        ? new URL(input.url)\n        : new URL(String(input), win.location.origin);\n    return url.origin === win.location.origin;\n  } catch {\n    return false;\n  }\n}\n\nexport function ensureEmbedAuthFetchInterceptor(): void {\n  const win = browserWindow();\n  if (!win) return;\n\n  const urlToken = readTokenFromUrl(win);\n  if (urlToken) {\n    storeToken(urlToken);\n    stripTokenFromUrl(win);\n  }\n\n  if (installed) return;\n  if (typeof win.fetch !== \"function\") return;\n  installed = true;\n\n  const originalFetch = win.fetch.bind(win);\n  win.fetch = ((input: RequestInfo | URL, init?: RequestInit) => {\n    const token = getEmbedAuthToken();\n    if (!token || !sameOrigin(input, win)) {\n      return originalFetch(input as any, init as any);\n    }\n\n    const headers = new Headers(\n      init?.headers ?? (input instanceof Request ? input.headers : undefined),\n    );\n    if (!headers.has(\"Authorization\")) {\n      headers.set(\"Authorization\", `Bearer ${token}`);\n    }\n    if (!headers.has(EMBED_TARGET_HEADER)) {\n      headers.set(EMBED_TARGET_HEADER, currentEmbedTarget(win));\n    }\n\n    if (input instanceof Request) {\n      return originalFetch(new Request(input, { ...init, headers }));\n    }\n    return originalFetch(input as any, { ...init, headers });\n  }) as typeof fetch;\n}\n"]}
+{"version":3,"file":"embed-auth.js","sourceRoot":"","sources":["../../src/client/embed-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,IAAI,SAAS,GAAG,KAAK,CAAC;AACtB,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,MAAM,uBAAuB,GAAG,+BAA+B,CAAC;AAEhE,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACjD,MAAM,mBAAmB,GAAG,qCAAqC,CAAC;AAUlE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAC9D,IAAI,gBAAgB,GAA6B,IAAI,CAAC;AAEtD,SAAS,aAAa;IACpB,OAAO,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,GAAW;IAC5C,WAAW,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,EAAE,CAAC;QACZ,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,iBAAiB,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC1D,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,MAAM,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAAE,OAAO;QAC3D,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,YAAY,CACtB,GAAG,CAAC,OAAO,CAAC,KAAK,EACjB,EAAE,EACF,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAwB,EAAE,GAAW;IACrD,IAAI,CAAC;QACH,OAAO,KAAK,YAAY,OAAO;YAC7B,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACpB,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAwB,EAAE,GAAW;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB,EAAE,IAAkB;IACjE,OAAO,CACL,IAAI,EAAE,MAAM;QACZ,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,KAAK,CACN,CAAC,WAAW,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,GAAQ;IAC9C,OAAO,GAAG,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc,EAAE,GAAQ;IACtD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,GAAG,CAAC,QAAQ,KAAK,wBAAwB;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA4C;IAE5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,mBAA4B;IAE5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAE7B,IAAI,CAAC,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,WAAW,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IACxD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,gBAAgB,GAAG,IAAI,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAyB;IACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CACT,aAAa,EACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAW,EACX,QAAkB,EAClB,mBAA4B;IAE5B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,IACE,KAAK,KAAK,kBAAkB;YAC5B,KAAK,KAAK,gBAAgB;YAC1B,KAAK,KAAK,mBAAmB,EAC7B,CAAC;YACD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAsB;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;QACP,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB;KACjD,CAAC;IACF,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,mBAAmB;QAAE,gBAAgB,GAAG,MAAM,CAAC;AACrD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW,EAAE,mBAA4B;IACjE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,mBAAmB;QAAE,gBAAgB,GAAG,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAwB,EACxB,IAA6B,EAC7B,KAAa,EACb,GAAW;IAEX,MAAM,OAAO,GAAG,IAAI,OAAO,CACzB,IAAI,EAAE,OAAO,IAAI,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CACxE,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAwB,EACxB,IAA6B,EAC7B,GAAW;IAOX,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC;QAChC,WAAW,EAAE,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1B,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,SAAS;QAAE,OAAO;IACtB,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO;IAC5C,SAAS,GAAG,IAAI,CAAC;IAEjB,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QAClE,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QACtC,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC5D,IAAI,MAAM;gBAAE,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YACpC,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAiB,EAAE,SAAgB,CAAC,CAAC;QAC1E,IAAI,OAAO,EAAE,WAAW,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACvE,CAAC;aAAM,IAAI,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC/C,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAiB,CAAC;AACrB,CAAC","sourcesContent":["import {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_START_PATH,\n  EMBED_TARGET_HEADER,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\n\nlet installed = false;\nlet memoryToken: string | null = null;\nconst EMBED_TOKEN_STORAGE_KEY = \"agent-native:embed-auth-token\";\n\nconst AUTH_FAILURE_COOLDOWN_MS = 60_000;\nconst GUARDED_METHODS = new Set([\"GET\", \"HEAD\"]);\nconst AUTH_FAILURE_HEADER = \"x-agent-native-auth-circuit-breaker\";\n\ntype AuthFailureRecord = {\n  status: number;\n  statusText: string;\n  headers: [string, string][];\n  body: string | null;\n  expiresAt: number;\n};\n\nconst authFailureCache = new Map<string, AuthFailureRecord>();\nlet embedAuthFailure: AuthFailureRecord | null = null;\n\nfunction browserWindow(): Window | null {\n  return typeof window === \"undefined\" ? null : window;\n}\n\nfunction readTokenFromUrl(win: Window): string | null {\n  try {\n    const url = new URL(win.location.href);\n    return url.searchParams.get(EMBED_TOKEN_QUERY_PARAM);\n  } catch {\n    return null;\n  }\n}\n\nfunction storedToken(win: Window): string | null {\n  try {\n    return win.sessionStorage?.getItem(EMBED_TOKEN_STORAGE_KEY) ?? null;\n  } catch {\n    return null;\n  }\n}\n\nfunction storeToken(token: string, win: Window): void {\n  memoryToken = token;\n  try {\n    win.sessionStorage?.setItem(EMBED_TOKEN_STORAGE_KEY, token);\n  } catch {\n    // Session storage may be unavailable in some sandboxed hosts. The\n    // in-memory fallback still covers the normal single-page boot path.\n  }\n}\n\nexport function getEmbedAuthToken(): string | null {\n  const win = browserWindow();\n  if (!win) return null;\n  const fromUrl = readTokenFromUrl(win);\n  if (fromUrl) {\n    storeToken(fromUrl, win);\n    return fromUrl;\n  }\n  return memoryToken ?? storedToken(win);\n}\n\nexport function isEmbedAuthActive(): boolean {\n  const win = browserWindow();\n  if (!win) return false;\n  if (getEmbedAuthToken()) return true;\n  try {\n    const url = new URL(win.location.href);\n    const mode = url.searchParams.get(EMBED_MODE_QUERY_PARAM);\n    return mode === \"1\" || mode === \"true\";\n  } catch {\n    return false;\n  }\n}\n\nfunction stripTokenFromUrl(win: Window): void {\n  try {\n    const url = new URL(win.location.href);\n    if (!url.searchParams.has(EMBED_TOKEN_QUERY_PARAM)) return;\n    url.searchParams.delete(EMBED_TOKEN_QUERY_PARAM);\n    win.history.replaceState(\n      win.history.state,\n      \"\",\n      `${url.pathname}${url.search}${url.hash}`,\n    );\n  } catch {\n    // best effort only\n  }\n}\n\nfunction currentEmbedTarget(win: Window): string {\n  return `${win.location.pathname}${win.location.search}`;\n}\n\nfunction inputUrl(input: RequestInfo | URL, win: Window): URL | null {\n  try {\n    return input instanceof Request\n      ? new URL(input.url)\n      : new URL(String(input), win.location.origin);\n  } catch {\n    return null;\n  }\n}\n\nfunction sameOrigin(input: RequestInfo | URL, win: Window): boolean {\n  const url = inputUrl(input, win);\n  return !!url && url.origin === win.location.origin;\n}\n\nfunction requestMethod(input: RequestInfo | URL, init?: RequestInit): string {\n  return (\n    init?.method ??\n    (input instanceof Request ? input.method : undefined) ??\n    \"GET\"\n  ).toUpperCase();\n}\n\nfunction authFailureKey(method: string, url: URL): string {\n  return `${method} ${url.href}`;\n}\n\nfunction isAuthFailureStatus(status: number): boolean {\n  return status === 401 || status === 403;\n}\n\nfunction shouldGuardAuthFailure(method: string, url: URL): boolean {\n  if (!GUARDED_METHODS.has(method)) return false;\n  if (url.pathname === EMBED_START_PATH) return false;\n  if (url.pathname === \"/_agent-native/sign-in\") return false;\n  return true;\n}\n\nfunction activeAuthFailure(\n  record: AuthFailureRecord | null | undefined,\n): AuthFailureRecord | null {\n  if (!record) return null;\n  if (record.expiresAt > Date.now()) return record;\n  return null;\n}\n\nfunction getCachedAuthFailure(\n  key: string,\n  useEmbedWideFailure: boolean,\n): AuthFailureRecord | null {\n  const cached = activeAuthFailure(authFailureCache.get(key));\n  if (cached) return cached;\n  authFailureCache.delete(key);\n\n  if (!useEmbedWideFailure) return null;\n  const embedCached = activeAuthFailure(embedAuthFailure);\n  if (embedCached) return embedCached;\n  embedAuthFailure = null;\n  return null;\n}\n\nfunction authFailureResponse(record: AuthFailureRecord): Response {\n  const headers = new Headers(record.headers);\n  headers.set(AUTH_FAILURE_HEADER, \"1\");\n  if (!headers.has(\"retry-after\")) {\n    headers.set(\n      \"retry-after\",\n      String(Math.max(1, Math.ceil((record.expiresAt - Date.now()) / 1000))),\n    );\n  }\n  return new Response(record.body, {\n    status: record.status,\n    statusText: record.statusText,\n    headers,\n  });\n}\n\nasync function recordAuthFailure(\n  key: string,\n  response: Response,\n  useEmbedWideFailure: boolean,\n): Promise<void> {\n  let body: string | null = null;\n  try {\n    body = await response.clone().text();\n  } catch {\n    body = null;\n  }\n\n  const headers: [string, string][] = [];\n  response.headers.forEach((value, name) => {\n    const lower = name.toLowerCase();\n    if (\n      lower === \"content-encoding\" ||\n      lower === \"content-length\" ||\n      lower === \"transfer-encoding\"\n    ) {\n      return;\n    }\n    headers.push([name, value]);\n  });\n\n  const record: AuthFailureRecord = {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n    body,\n    expiresAt: Date.now() + AUTH_FAILURE_COOLDOWN_MS,\n  };\n  authFailureCache.set(key, record);\n  if (useEmbedWideFailure) embedAuthFailure = record;\n}\n\nfunction clearAuthFailure(key: string, useEmbedWideFailure: boolean): void {\n  authFailureCache.delete(key);\n  if (useEmbedWideFailure) embedAuthFailure = null;\n}\n\nfunction withEmbedAuthHeaders(\n  input: RequestInfo | URL,\n  init: RequestInit | undefined,\n  token: string,\n  win: Window,\n): [RequestInfo | URL, RequestInit | undefined] {\n  const headers = new Headers(\n    init?.headers ?? (input instanceof Request ? input.headers : undefined),\n  );\n  if (!headers.has(\"Authorization\")) {\n    headers.set(\"Authorization\", `Bearer ${token}`);\n  }\n  if (!headers.has(EMBED_TARGET_HEADER)) {\n    headers.set(EMBED_TARGET_HEADER, currentEmbedTarget(win));\n  }\n\n  if (input instanceof Request) {\n    return [new Request(input, { ...init, headers }), undefined];\n  }\n  return [input, { ...init, headers }];\n}\n\nfunction requestUrlAndKey(\n  input: RequestInfo | URL,\n  init: RequestInit | undefined,\n  win: Window,\n):\n  | {\n      key: string;\n      shouldGuard: boolean;\n    }\n  | undefined {\n  const url = inputUrl(input, win);\n  if (!url || url.origin !== win.location.origin) return undefined;\n  const method = requestMethod(input, init);\n  return {\n    key: authFailureKey(method, url),\n    shouldGuard: shouldGuardAuthFailure(method, url),\n  };\n}\n\nexport function ensureEmbedAuthFetchInterceptor(): void {\n  const win = browserWindow();\n  if (!win) return;\n\n  const urlToken = readTokenFromUrl(win);\n  if (urlToken) {\n    storeToken(urlToken, win);\n    stripTokenFromUrl(win);\n  }\n\n  if (installed) return;\n  if (typeof win.fetch !== \"function\") return;\n  installed = true;\n\n  const originalFetch = win.fetch.bind(win);\n  win.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {\n    const request = requestUrlAndKey(input, init, win);\n    const embedMode = isEmbedAuthActive();\n    if (request?.shouldGuard) {\n      const cached = getCachedAuthFailure(request.key, embedMode);\n      if (cached) return authFailureResponse(cached);\n    }\n\n    const token = getEmbedAuthToken();\n    let fetchInput = input;\n    let fetchInit = init;\n    if (token && sameOrigin(input, win)) {\n      [fetchInput, fetchInit] = withEmbedAuthHeaders(input, init, token, win);\n    }\n\n    const response = await originalFetch(fetchInput as any, fetchInit as any);\n    if (request?.shouldGuard && isAuthFailureStatus(response.status)) {\n      await recordAuthFailure(request.key, response, embedMode || !!token);\n    } else if (request?.shouldGuard && response.ok) {\n      clearAuthFailure(request.key, embedMode || !!token);\n    }\n    return response;\n  }) as typeof fetch;\n}\n"]}

package/dist/client/use-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-action.d.ts","sourceRoot":"","sources":["../../src/client/use-action.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAU/B;;;;;GAKG;AACH,MAAM,WAAW,cAAc;CAAG;AAElC,2FAA2F;AAC3F,KAAK,UAAU,GAAG,MAAM,cAAc,SAAS,KAAK,GAChD,MAAM,GACN,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,cAAc,GAChE,cAAc,CAAC,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC3C,CAAC,GACD,GAAG,GACL,GAAG,CAAC;AAER,iGAAiG;AACjG,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,cAAc,GAChE,cAAc,CAAC,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC3C,CAAC,GACD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACrB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAyIxB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,OAAO,GAAG,SAAS,EACnB,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,UAAU,EAAE,KAAK,EACjB,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,EAC5B,OAAO,CAAC,EAAE,IAAI,CACZ,eAAe,CAAC,OAAO,SAAS,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,EAC1E,UAAU,GAAG,SAAS,CACvB,6JAQF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAG,SAAS,EACjB,UAAU,GAAG,SAAS,EACtB,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,UAAU,EAAE,KAAK,EACjB,OAAO,CAAC,EAAE,IAAI,CACZ,kBAAkB,CAChB,KAAK,SAAS,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,EACrD,KAAK,EACL,UAAU,SAAS,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,UAAU,CAChE,EACD,YAAY,CACb,GAAG;IACF,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;CACpC,6LAuBF"}
+{"version":3,"file":"use-action.d.ts","sourceRoot":"","sources":["../../src/client/use-action.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AA4B/B;;;;;GAKG;AACH,MAAM,WAAW,cAAc;CAAG;AAElC,2FAA2F;AAC3F,KAAK,UAAU,GAAG,MAAM,cAAc,SAAS,KAAK,GAChD,MAAM,GACN,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,cAAc,GAChE,cAAc,CAAC,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC3C,CAAC,GACD,GAAG,GACL,GAAG,CAAC;AAER,iGAAiG;AACjG,KAAK,YAAY,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,cAAc,GAChE,cAAc,CAAC,CAAC,CAAC,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC3C,CAAC,GACD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GACrB,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAyIxB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,OAAO,GAAG,SAAS,EACnB,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,UAAU,EAAE,KAAK,EACjB,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,EAC5B,OAAO,CAAC,EAAE,IAAI,CACZ,eAAe,CAAC,OAAO,SAAS,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,EAC1E,UAAU,GAAG,SAAS,CACvB,6JASF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,GAAG,SAAS,EACjB,UAAU,GAAG,SAAS,EACtB,KAAK,SAAS,UAAU,GAAG,UAAU,EAErC,UAAU,EAAE,KAAK,EACjB,OAAO,CAAC,EAAE,IAAI,CACZ,kBAAkB,CAChB,KAAK,SAAS,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,KAAK,EACrD,KAAK,EACL,UAAU,SAAS,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,UAAU,CAChE,EACD,YAAY,CACb,GAAG;IACF,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;CACpC,6LAuBF"}

package/dist/client/use-action.js

@@ -23,6 +23,18 @@ import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { agentNativePath } from "./api-path.js";
 import { ensureEmbedAuthFetchInterceptor } from "./embed-auth.js";
 const ACTION_PREFIX = agentNativePath("/_agent-native/actions");
+function isAuthFailure(error) {
+    return (!!error &&
+        typeof error === "object" &&
+        "status" in error &&
+        (error.status === 401 ||
+            error.status === 403));
+}
+function defaultActionQueryRetry(failureCount, error) {
+    if (isAuthFailure(error))
+        return false;
+    return failureCount < 3;
+}
 // ---------------------------------------------------------------------------
 // Fetch helper
 // ---------------------------------------------------------------------------
@@ -158,6 +170,7 @@ export function useActionQuery(actionName, params, options) {
     return useQuery({
         queryKey: ["action", actionName, params],
         queryFn: () => actionFetch(actionName, "GET", params),
+        retry: defaultActionQueryRetry,
         ...options,
     });
 }

package/dist/client/use-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-action.js","sourceRoot":"","sources":["../../src/client/use-action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,MAAM,aAAa,GAAG,eAAe,CAAC,wBAAwB,CAAC,CAAC;AAiChE,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,IAAI,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,MAAc,EACd,MAA4B;IAE5B,+BAA+B,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,GAAG,aAAa,IAAI,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACjC,IAAI,EAAE;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,IAAI,GAAgB;QACxB,MAAM;QACN,OAAO;QACP,KAAK,EAAE,UAAU;KAClB,CAAC;IAEF,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CACzC,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,YAAY,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAS,CAAC;IAEzC,yCAAyC;IACzC,oEAAoE;IACpE,8EAA8E;IAC9E,4DAA4D;IAC5D,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,IAAI,CAAC;QAClB,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,GAAQ,SAAS,CAAC;IAC1B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,OAAO,GACX,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;YACtC,uEAAuE;YACvE,qEAAqE;YACrE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1B,GAAG,CAAC,UAAU;YACd,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,IAAI,YAAY,OAAO,EAAE,CAAC,CAAC;QAC5D,KAAa,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GACT,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,UAAU,IAAI,aAAa,GAAG,CAAC,MAAM,oCAAoC,KAAK,EAAE,CACjF,CAAC;QACD,KAAa,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,+BAA+B;IAC/B,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,UAAU,IAAI,wBAAwB,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAClF,CAAC;QACD,KAAa,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAAI,IAAK,IAAgB,CAAM,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAI5B,UAAiB,EACjB,MAA4B,EAC5B,OAGC;IAGD,OAAO,QAAQ,CAAI;QACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAI,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC;QACxD,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAK/B,UAAiB,EACjB,OASC;IAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EACJ,MAAM,EAAE,SAAS,EACjB,SAAS,EACT,GAAG,WAAW,EACf,GAAG,OAAO,IAAK,EAAU,CAAC;IAC3B,MAAM,MAAM,GAAG,SAAS,IAAI,MAAM,CAAC;IAKnC,OAAO,WAAW,CAAc;QAC9B,GAAG,WAAW;QACd,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CACrB,WAAW,CAAI,UAAU,EAAE,MAAM,EAAE,MAA6B,CAAC;QACnE,SAAS,EAAE,CAAC,GAAG,IAAqB,EAAE,EAAE;YACtC,oCAAoC;YACpC,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvD,SAAsB,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrC,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * React Query hooks for calling actions via their auto-mounted HTTP endpoints.\n *\n * Actions are mounted at `/_agent-native/actions/:name` by the framework.\n *\n * ## End-to-end type safety\n *\n * When the action type registry is generated (via the Vite plugin or CLI),\n * `useActionQuery` and `useActionMutation` automatically infer the correct\n * return type and parameter types from the action definitions — no manual\n * type annotations needed.\n *\n * ```ts\n * // Fully typed — return type and params inferred from the action's defineAction()\n * const { data } = useActionQuery(\"list-forms\", { status: \"published\" });\n * //      ^? Form[]  (inferred from the action's run() return type)\n * ```\n *\n * Without the registry, the hooks fall back to `any` types for backward\n * compatibility.\n */\nimport { useQuery, useMutation, useQueryClient } from \"@tanstack/react-query\";\nimport type {\n  UseQueryOptions,\n  UseMutationOptions,\n} from \"@tanstack/react-query\";\nimport { agentNativePath } from \"./api-path.js\";\nimport { ensureEmbedAuthFetchInterceptor } from \"./embed-auth.js\";\n\nconst ACTION_PREFIX = agentNativePath(\"/_agent-native/actions\");\n\n// ---------------------------------------------------------------------------\n// Action type registry — augmented by generated code\n// ---------------------------------------------------------------------------\n\n/**\n * Action type registry. This interface is empty by default and gets augmented\n * by the auto-generated `.generated/action-types.d.ts` file. When augmented,\n * it maps action names to their parameter and return types, enabling\n * end-to-end type safety for `useActionQuery` and `useActionMutation`.\n */\nexport interface ActionRegistry {}\n\n/** Resolves to the union of registered action names, or `string` if no registry exists. */\ntype ActionName = keyof ActionRegistry extends never\n  ? string\n  : (keyof ActionRegistry & string) | (string & {});\n\n/** Resolves the return type of an action, or `any` if not in the registry. */\ntype ActionResult<T extends string> = T extends keyof ActionRegistry\n  ? ActionRegistry[T] extends { result: infer R }\n    ? R\n    : any\n  : any;\n\n/** Resolves the parameter type of an action, or `Record<string, any>` if not in the registry. */\ntype ActionParams<T extends string> = T extends keyof ActionRegistry\n  ? ActionRegistry[T] extends { params: infer P }\n    ? P\n    : Record<string, any>\n  : Record<string, any>;\n\n// ---------------------------------------------------------------------------\n// Fetch helper\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the browser's IANA timezone (e.g. \"America/Los_Angeles\"). This is\n * sent on every action request as `x-user-timezone` so server-side defaults\n * like \"today\" honor the user's local day rather than the server's UTC clock.\n */\nfunction resolveUserTimezone(): string | undefined {\n  try {\n    return Intl.DateTimeFormat().resolvedOptions().timeZone || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function actionFetch<T>(\n  name: string,\n  method: string,\n  params?: Record<string, any>,\n): Promise<T> {\n  ensureEmbedAuthFetchInterceptor();\n  let url = `${ACTION_PREFIX}/${name}`;\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n  };\n  const tz = resolveUserTimezone();\n  if (tz) headers[\"x-user-timezone\"] = tz;\n  const init: RequestInit = {\n    method,\n    headers,\n    cache: \"no-store\",\n  };\n\n  if (method === \"GET\" && params && Object.keys(params).length > 0) {\n    // Skip null/undefined so optional filters don't turn into literal \"null\"\n    // strings in the query string (e.g. `?folderId=null`).\n    const entries = Object.entries(params).filter(\n      ([, v]) => v !== null && v !== undefined,\n    );\n    if (entries.length > 0) {\n      const qs = new URLSearchParams(entries.map(([k, v]) => [k, String(v)]));\n      url += `?${qs}`;\n    }\n  } else if (method !== \"GET\" && params) {\n    init.body = JSON.stringify(params);\n  }\n\n  let res: Response;\n  try {\n    res = await fetch(url, init);\n  } catch (err) {\n    // Network failures, CORS, server unreachable, etc. — give the caller a\n    // useful message instead of the opaque \"Failed to fetch\".\n    const cause = err instanceof Error ? err.message : String(err);\n    throw new Error(`Action ${name} failed: ${cause}`);\n  }\n\n  // 204 No Content — nothing to parse.\n  if (res.status === 204) return null as T;\n\n  // Read the body as text first so we can:\n  //   - tolerate empty bodies (avoids \"Unexpected end of JSON input\")\n  //   - surface non-JSON error responses (HTML 401/404 pages, plain text, etc.)\n  //   - preserve the original HTTP status in the thrown error\n  // Track read failures separately from \"no body\" — a stream interruption /\n  // decode failure on a 2xx response should error rather than silently\n  // succeed with `null`.\n  let raw = \"\";\n  let readFailed = false;\n  let readError: unknown;\n  try {\n    raw = await res.text();\n  } catch (err) {\n    readFailed = true;\n    readError = err;\n  }\n\n  let data: any = undefined;\n  let parseFailed = false;\n  if (raw.length > 0) {\n    try {\n      data = JSON.parse(raw);\n    } catch {\n      // Body wasn't JSON — keep `data` undefined and use the raw text below.\n      parseFailed = true;\n    }\n  }\n\n  if (!res.ok) {\n    const message =\n      (data && (data.error || data.message)) ||\n      // Truncate non-JSON bodies so we don't dump entire HTML pages into the\n      // console, but still give the developer a hint as to what came back.\n      (raw && raw.slice(0, 200)) ||\n      res.statusText ||\n      `HTTP ${res.status}`;\n    const error = new Error(`Action ${name} failed: ${message}`);\n    (error as any).status = res.status;\n    throw error;\n  }\n\n  // 2xx but the body couldn't even be read (mid-stream abort, decode failure,\n  // etc.). Don't silently treat that as a `null` success.\n  if (readFailed) {\n    const cause =\n      readError instanceof Error ? readError.message : String(readError);\n    const error = new Error(\n      `Action ${name} returned ${res.status} but the body could not be read: ${cause}`,\n    );\n    (error as any).status = res.status;\n    throw error;\n  }\n\n  // 2xx with a non-empty, non-JSON body. Action callers expect typed data, so\n  // returning `null` here would silently mask a real server bug (e.g. a proxy\n  // returning HTML 200 instead of JSON). Throw instead — empty bodies (handled\n  // above by the `raw.length > 0` guard and the 204 short-circuit) still\n  // correctly resolve to `null`.\n  if (parseFailed) {\n    const error = new Error(\n      `Action ${name} returned a non-JSON ${res.status} response: ${raw.slice(0, 200)}`,\n    );\n    (error as any).status = res.status;\n    throw error;\n  }\n\n  return (data ?? (null as unknown)) as T;\n}\n\n// ---------------------------------------------------------------------------\n// Query hook\n// ---------------------------------------------------------------------------\n\n/**\n * Query an action exposed as GET.\n *\n * When the action type registry is generated, the return type and parameter\n * types are inferred automatically from the action's `defineAction()` call.\n *\n * ```ts\n * // Type-safe — no manual generic needed\n * const { data } = useActionQuery(\"list-meals\", { date: \"2025-01-01\" });\n *\n * // Manual override still works when needed\n * const { data } = useActionQuery<CustomType>(\"list-meals\");\n * ```\n */\nexport function useActionQuery<\n  TResult = undefined,\n  TName extends ActionName = ActionName,\n>(\n  actionName: TName,\n  params?: ActionParams<TName>,\n  options?: Omit<\n    UseQueryOptions<TResult extends undefined ? ActionResult<TName> : TResult>,\n    \"queryKey\" | \"queryFn\"\n  >,\n) {\n  type R = TResult extends undefined ? ActionResult<TName> : TResult;\n  return useQuery<R>({\n    queryKey: [\"action\", actionName, params],\n    queryFn: () => actionFetch<R>(actionName, \"GET\", params),\n    ...options,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Mutation hook\n// ---------------------------------------------------------------------------\n\n/**\n * Mutate via an action exposed as POST (default), PUT, or DELETE.\n *\n * When the action type registry is generated, the return type and parameter\n * types are inferred automatically.\n *\n * ```ts\n * // Type-safe\n * const { mutate } = useActionMutation(\"log-meal\");\n * mutate({ name: \"Salad\", calories: 350 });\n * ```\n */\nexport function useActionMutation<\n  TData = undefined,\n  TVariables = undefined,\n  TName extends ActionName = ActionName,\n>(\n  actionName: TName,\n  options?: Omit<\n    UseMutationOptions<\n      TData extends undefined ? ActionResult<TName> : TData,\n      Error,\n      TVariables extends undefined ? ActionParams<TName> : TVariables\n    >,\n    \"mutationFn\"\n  > & {\n    method?: \"POST\" | \"PUT\" | \"DELETE\";\n  },\n) {\n  const queryClient = useQueryClient();\n  const {\n    method: methodOpt,\n    onSuccess,\n    ...restOptions\n  } = options ?? ({} as any);\n  const method = methodOpt ?? \"POST\";\n\n  type D = TData extends undefined ? ActionResult<TName> : TData;\n  type V = TVariables extends undefined ? ActionParams<TName> : TVariables;\n\n  return useMutation<D, Error, V>({\n    ...restOptions,\n    mutationFn: (params) =>\n      actionFetch<D>(actionName, method, params as Record<string, any>),\n    onSuccess: (...args: [any, any, any]) => {\n      // Invalidate related action queries\n      queryClient.invalidateQueries({ queryKey: [\"action\"] });\n      (onSuccess as Function)?.(...args);\n    },\n  });\n}\n"]}
+{"version":3,"file":"use-action.js","sourceRoot":"","sources":["../../src/client/use-action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK9E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,MAAM,aAAa,GAAG,eAAe,CAAC,wBAAwB,CAAC,CAAC;AAEhE,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,CACL,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,QAAQ,IAAI,KAAK;QACjB,CAAE,KAA8B,CAAC,MAAM,KAAK,GAAG;YAC5C,KAA8B,CAAC,MAAM,KAAK,GAAG,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,YAAoB,EACpB,KAAc;IAEd,IAAI,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC;AAiCD,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,IAAI,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,MAAc,EACd,MAA4B;IAE5B,+BAA+B,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,GAAG,aAAa,IAAI,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACjC,IAAI,EAAE;QAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,IAAI,GAAgB;QACxB,MAAM;QACN,OAAO;QACP,KAAK,EAAE,UAAU;KAClB,CAAC;IAEF,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAC3C,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CACzC,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,YAAY,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,qCAAqC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAS,CAAC;IAEzC,yCAAyC;IACzC,oEAAoE;IACpE,8EAA8E;IAC9E,4DAA4D;IAC5D,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB;IACvB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,UAAU,GAAG,IAAI,CAAC;QAClB,SAAS,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,GAAQ,SAAS,CAAC;IAC1B,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,OAAO,GACX,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;YACtC,uEAAuE;YACvE,qEAAqE;YACrE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1B,GAAG,CAAC,UAAU;YACd,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,IAAI,YAAY,OAAO,EAAE,CAAC,CAAC;QAC5D,KAAa,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GACT,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,UAAU,IAAI,aAAa,GAAG,CAAC,MAAM,oCAAoC,KAAK,EAAE,CACjF,CAAC;QACD,KAAa,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,+BAA+B;IAC/B,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,UAAU,IAAI,wBAAwB,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAClF,CAAC;QACD,KAAa,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,OAAO,CAAC,IAAI,IAAK,IAAgB,CAAM,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAI5B,UAAiB,EACjB,MAA4B,EAC5B,OAGC;IAGD,OAAO,QAAQ,CAAI;QACjB,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAI,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC;QACxD,KAAK,EAAE,uBAAuB;QAC9B,GAAG,OAAO;KACX,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAK/B,UAAiB,EACjB,OASC;IAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EACJ,MAAM,EAAE,SAAS,EACjB,SAAS,EACT,GAAG,WAAW,EACf,GAAG,OAAO,IAAK,EAAU,CAAC;IAC3B,MAAM,MAAM,GAAG,SAAS,IAAI,MAAM,CAAC;IAKnC,OAAO,WAAW,CAAc;QAC9B,GAAG,WAAW;QACd,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CACrB,WAAW,CAAI,UAAU,EAAE,MAAM,EAAE,MAA6B,CAAC;QACnE,SAAS,EAAE,CAAC,GAAG,IAAqB,EAAE,EAAE;YACtC,oCAAoC;YACpC,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvD,SAAsB,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrC,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * React Query hooks for calling actions via their auto-mounted HTTP endpoints.\n *\n * Actions are mounted at `/_agent-native/actions/:name` by the framework.\n *\n * ## End-to-end type safety\n *\n * When the action type registry is generated (via the Vite plugin or CLI),\n * `useActionQuery` and `useActionMutation` automatically infer the correct\n * return type and parameter types from the action definitions — no manual\n * type annotations needed.\n *\n * ```ts\n * // Fully typed — return type and params inferred from the action's defineAction()\n * const { data } = useActionQuery(\"list-forms\", { status: \"published\" });\n * //      ^? Form[]  (inferred from the action's run() return type)\n * ```\n *\n * Without the registry, the hooks fall back to `any` types for backward\n * compatibility.\n */\nimport { useQuery, useMutation, useQueryClient } from \"@tanstack/react-query\";\nimport type {\n  UseQueryOptions,\n  UseMutationOptions,\n} from \"@tanstack/react-query\";\nimport { agentNativePath } from \"./api-path.js\";\nimport { ensureEmbedAuthFetchInterceptor } from \"./embed-auth.js\";\n\nconst ACTION_PREFIX = agentNativePath(\"/_agent-native/actions\");\n\nfunction isAuthFailure(error: unknown): boolean {\n  return (\n    !!error &&\n    typeof error === \"object\" &&\n    \"status\" in error &&\n    ((error as { status?: unknown }).status === 401 ||\n      (error as { status?: unknown }).status === 403)\n  );\n}\n\nfunction defaultActionQueryRetry(\n  failureCount: number,\n  error: unknown,\n): boolean {\n  if (isAuthFailure(error)) return false;\n  return failureCount < 3;\n}\n\n// ---------------------------------------------------------------------------\n// Action type registry — augmented by generated code\n// ---------------------------------------------------------------------------\n\n/**\n * Action type registry. This interface is empty by default and gets augmented\n * by the auto-generated `.generated/action-types.d.ts` file. When augmented,\n * it maps action names to their parameter and return types, enabling\n * end-to-end type safety for `useActionQuery` and `useActionMutation`.\n */\nexport interface ActionRegistry {}\n\n/** Resolves to the union of registered action names, or `string` if no registry exists. */\ntype ActionName = keyof ActionRegistry extends never\n  ? string\n  : (keyof ActionRegistry & string) | (string & {});\n\n/** Resolves the return type of an action, or `any` if not in the registry. */\ntype ActionResult<T extends string> = T extends keyof ActionRegistry\n  ? ActionRegistry[T] extends { result: infer R }\n    ? R\n    : any\n  : any;\n\n/** Resolves the parameter type of an action, or `Record<string, any>` if not in the registry. */\ntype ActionParams<T extends string> = T extends keyof ActionRegistry\n  ? ActionRegistry[T] extends { params: infer P }\n    ? P\n    : Record<string, any>\n  : Record<string, any>;\n\n// ---------------------------------------------------------------------------\n// Fetch helper\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve the browser's IANA timezone (e.g. \"America/Los_Angeles\"). This is\n * sent on every action request as `x-user-timezone` so server-side defaults\n * like \"today\" honor the user's local day rather than the server's UTC clock.\n */\nfunction resolveUserTimezone(): string | undefined {\n  try {\n    return Intl.DateTimeFormat().resolvedOptions().timeZone || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function actionFetch<T>(\n  name: string,\n  method: string,\n  params?: Record<string, any>,\n): Promise<T> {\n  ensureEmbedAuthFetchInterceptor();\n  let url = `${ACTION_PREFIX}/${name}`;\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n  };\n  const tz = resolveUserTimezone();\n  if (tz) headers[\"x-user-timezone\"] = tz;\n  const init: RequestInit = {\n    method,\n    headers,\n    cache: \"no-store\",\n  };\n\n  if (method === \"GET\" && params && Object.keys(params).length > 0) {\n    // Skip null/undefined so optional filters don't turn into literal \"null\"\n    // strings in the query string (e.g. `?folderId=null`).\n    const entries = Object.entries(params).filter(\n      ([, v]) => v !== null && v !== undefined,\n    );\n    if (entries.length > 0) {\n      const qs = new URLSearchParams(entries.map(([k, v]) => [k, String(v)]));\n      url += `?${qs}`;\n    }\n  } else if (method !== \"GET\" && params) {\n    init.body = JSON.stringify(params);\n  }\n\n  let res: Response;\n  try {\n    res = await fetch(url, init);\n  } catch (err) {\n    // Network failures, CORS, server unreachable, etc. — give the caller a\n    // useful message instead of the opaque \"Failed to fetch\".\n    const cause = err instanceof Error ? err.message : String(err);\n    throw new Error(`Action ${name} failed: ${cause}`);\n  }\n\n  // 204 No Content — nothing to parse.\n  if (res.status === 204) return null as T;\n\n  // Read the body as text first so we can:\n  //   - tolerate empty bodies (avoids \"Unexpected end of JSON input\")\n  //   - surface non-JSON error responses (HTML 401/404 pages, plain text, etc.)\n  //   - preserve the original HTTP status in the thrown error\n  // Track read failures separately from \"no body\" — a stream interruption /\n  // decode failure on a 2xx response should error rather than silently\n  // succeed with `null`.\n  let raw = \"\";\n  let readFailed = false;\n  let readError: unknown;\n  try {\n    raw = await res.text();\n  } catch (err) {\n    readFailed = true;\n    readError = err;\n  }\n\n  let data: any = undefined;\n  let parseFailed = false;\n  if (raw.length > 0) {\n    try {\n      data = JSON.parse(raw);\n    } catch {\n      // Body wasn't JSON — keep `data` undefined and use the raw text below.\n      parseFailed = true;\n    }\n  }\n\n  if (!res.ok) {\n    const message =\n      (data && (data.error || data.message)) ||\n      // Truncate non-JSON bodies so we don't dump entire HTML pages into the\n      // console, but still give the developer a hint as to what came back.\n      (raw && raw.slice(0, 200)) ||\n      res.statusText ||\n      `HTTP ${res.status}`;\n    const error = new Error(`Action ${name} failed: ${message}`);\n    (error as any).status = res.status;\n    throw error;\n  }\n\n  // 2xx but the body couldn't even be read (mid-stream abort, decode failure,\n  // etc.). Don't silently treat that as a `null` success.\n  if (readFailed) {\n    const cause =\n      readError instanceof Error ? readError.message : String(readError);\n    const error = new Error(\n      `Action ${name} returned ${res.status} but the body could not be read: ${cause}`,\n    );\n    (error as any).status = res.status;\n    throw error;\n  }\n\n  // 2xx with a non-empty, non-JSON body. Action callers expect typed data, so\n  // returning `null` here would silently mask a real server bug (e.g. a proxy\n  // returning HTML 200 instead of JSON). Throw instead — empty bodies (handled\n  // above by the `raw.length > 0` guard and the 204 short-circuit) still\n  // correctly resolve to `null`.\n  if (parseFailed) {\n    const error = new Error(\n      `Action ${name} returned a non-JSON ${res.status} response: ${raw.slice(0, 200)}`,\n    );\n    (error as any).status = res.status;\n    throw error;\n  }\n\n  return (data ?? (null as unknown)) as T;\n}\n\n// ---------------------------------------------------------------------------\n// Query hook\n// ---------------------------------------------------------------------------\n\n/**\n * Query an action exposed as GET.\n *\n * When the action type registry is generated, the return type and parameter\n * types are inferred automatically from the action's `defineAction()` call.\n *\n * ```ts\n * // Type-safe — no manual generic needed\n * const { data } = useActionQuery(\"list-meals\", { date: \"2025-01-01\" });\n *\n * // Manual override still works when needed\n * const { data } = useActionQuery<CustomType>(\"list-meals\");\n * ```\n */\nexport function useActionQuery<\n  TResult = undefined,\n  TName extends ActionName = ActionName,\n>(\n  actionName: TName,\n  params?: ActionParams<TName>,\n  options?: Omit<\n    UseQueryOptions<TResult extends undefined ? ActionResult<TName> : TResult>,\n    \"queryKey\" | \"queryFn\"\n  >,\n) {\n  type R = TResult extends undefined ? ActionResult<TName> : TResult;\n  return useQuery<R>({\n    queryKey: [\"action\", actionName, params],\n    queryFn: () => actionFetch<R>(actionName, \"GET\", params),\n    retry: defaultActionQueryRetry,\n    ...options,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Mutation hook\n// ---------------------------------------------------------------------------\n\n/**\n * Mutate via an action exposed as POST (default), PUT, or DELETE.\n *\n * When the action type registry is generated, the return type and parameter\n * types are inferred automatically.\n *\n * ```ts\n * // Type-safe\n * const { mutate } = useActionMutation(\"log-meal\");\n * mutate({ name: \"Salad\", calories: 350 });\n * ```\n */\nexport function useActionMutation<\n  TData = undefined,\n  TVariables = undefined,\n  TName extends ActionName = ActionName,\n>(\n  actionName: TName,\n  options?: Omit<\n    UseMutationOptions<\n      TData extends undefined ? ActionResult<TName> : TData,\n      Error,\n      TVariables extends undefined ? ActionParams<TName> : TVariables\n    >,\n    \"mutationFn\"\n  > & {\n    method?: \"POST\" | \"PUT\" | \"DELETE\";\n  },\n) {\n  const queryClient = useQueryClient();\n  const {\n    method: methodOpt,\n    onSuccess,\n    ...restOptions\n  } = options ?? ({} as any);\n  const method = methodOpt ?? \"POST\";\n\n  type D = TData extends undefined ? ActionResult<TName> : TData;\n  type V = TVariables extends undefined ? ActionParams<TName> : TVariables;\n\n  return useMutation<D, Error, V>({\n    ...restOptions,\n    mutationFn: (params) =>\n      actionFetch<D>(actionName, method, params as Record<string, any>),\n    onSuccess: (...args: [any, any, any]) => {\n      // Invalidate related action queries\n      queryClient.invalidateQueries({ queryKey: [\"action\"] });\n      (onSuccess as Function)?.(...args);\n    },\n  });\n}\n"]}

package/dist/client/use-db-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-db-sync.d.ts","sourceRoot":"","sources":["../../src/client/use-db-sync.ts"],"names":[],"mappings":"AASA,UAAU,WAAW;IACnB,iBAAiB,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACzD;AA0FD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,SAAS,CACvB,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACxB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,IAAI,CAwON;AAED,wCAAwC;AACxC,eAAO,MAAM,cAAc,kBAAY,CAAC;AAExC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;CACtB,GACL,MAAM,CAsJR"}
+{"version":3,"file":"use-db-sync.d.ts","sourceRoot":"","sources":["../../src/client/use-db-sync.ts"],"names":[],"mappings":"AASA,UAAU,WAAW;IACnB,iBAAiB,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CACzD;AA8GD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,SAAS,CACvB,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACxB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,IAAI,CA6PN;AAED,wCAAwC;AACxC,eAAO,MAAM,cAAc,kBAAY,CAAC;AAExC;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;CACtB,GACL,MAAM,CA2KR"}

package/dist/client/use-db-sync.js

@@ -5,6 +5,14 @@ import { ensureDemoModeFetchInterceptor } from "../demo/fetch-interceptor.js";
 import { ensureEmbedAuthFetchInterceptor, isEmbedAuthActive, } from "./embed-auth.js";
 const POLL_ABORT_MIN_MS = 10_000;
 const SSE_FALLBACK_INTERVAL_MS = 15_000;
+const POLL_AUTH_FAILURE_COOLDOWN_MS = 60_000;
+class HttpStatusError extends Error {
+    status;
+    constructor(status) {
+        super("HTTP " + status);
+        this.status = status;
+    }
+}
 function getPollAbortMs(interval) {
     return Math.max(POLL_ABORT_MIN_MS, interval * 4);
 }
@@ -39,6 +47,13 @@ function hasAppStateEvent(events, key) {
             event.key === "*" ||
             (typeof event.key === "string" && event.key.startsWith(`${key}:`))));
 }
+function isAuthFailure(error) {
+    return (!!error &&
+        typeof error === "object" &&
+        "status" in error &&
+        (error.status === 401 ||
+            error.status === 403));
+}
 async function fetchPollJson(pollUrl, since, interval) {
     const controller = typeof AbortController === "undefined" ? null : new AbortController();
     const timeout = controller
@@ -47,7 +62,7 @@ async function fetchPollJson(pollUrl, since, interval) {
     try {
         const res = await fetch(`${pollUrl}?since=${since}`, controller ? { signal: controller.signal } : undefined);
         if (!res.ok)
-            throw new Error("HTTP " + res.status);
+            throw new HttpStatusError(res.status);
         // Await the json before the finally so a body-stream abort doesn't
         // produce a dangling promise that escapes as an unhandled rejection.
         return await res.json();
@@ -102,6 +117,10 @@ export function useDbSync(options = {}) {
         let inFlight = false;
         let eventSource = null;
         let sseConnected = false;
+        let authFailureUntil = 0;
+        function authFailureDelayMs() {
+            return Math.max(0, authFailureUntil - Date.now());
+        }
         function schedulePoll() {
             if (stopped)
                 return;
@@ -109,6 +128,14 @@ export function useDbSync(options = {}) {
                 return;
             if (timer)
                 clearTimeout(timer);
+            const authDelay = authFailureDelayMs();
+            if (authDelay > 0) {
+                timer = setTimeout(() => {
+                    timer = null;
+                    void poll();
+                }, authDelay);
+                return;
+            }
             timer = setTimeout(() => {
                 timer = null;
                 void poll();
@@ -228,7 +255,11 @@ export function useDbSync(options = {}) {
                 const data = await fetchPollJson(pollUrl, versionRef, interval);
                 applyEvents(data.events ?? [], data.version);
             }
-            catch {
+            catch (err) {
+                if (isAuthFailure(err)) {
+                    authFailureUntil = Date.now() + POLL_AUTH_FAILURE_COOLDOWN_MS;
+                    closeEvents();
+                }
                 // Network error — will retry on next interval
             }
             finally {
@@ -240,6 +271,10 @@ export function useDbSync(options = {}) {
             if (pauseWhenHidden && isDocumentHidden()) {
                 return;
             }
+            if (authFailureDelayMs() > 0) {
+                schedulePoll();
+                return;
+            }
             if (timer) {
                 clearTimeout(timer);
                 timer = null;
@@ -315,6 +350,10 @@ export function useScreenRefreshKey(options = {}) {
         let inFlight = false;
         let eventSource = null;
         let sseConnected = false;
+        let authFailureUntil = 0;
+        function authFailureDelayMs() {
+            return Math.max(0, authFailureUntil - Date.now());
+        }
         function schedulePoll() {
             if (stopped)
                 return;
@@ -322,6 +361,14 @@ export function useScreenRefreshKey(options = {}) {
                 return;
             if (timer)
                 clearTimeout(timer);
+            const authDelay = authFailureDelayMs();
+            if (authDelay > 0) {
+                timer = setTimeout(() => {
+                    timer = null;
+                    void poll();
+                }, authDelay);
+                return;
+            }
             timer = setTimeout(() => {
                 timer = null;
                 void poll();
@@ -383,7 +430,11 @@ export function useScreenRefreshKey(options = {}) {
                 const data = await fetchPollJson(pollUrl, versionRef, interval);
                 applyEvents(data.events ?? [], data.version);
             }
-            catch {
+            catch (err) {
+                if (isAuthFailure(err)) {
+                    authFailureUntil = Date.now() + POLL_AUTH_FAILURE_COOLDOWN_MS;
+                    closeEvents();
+                }
                 // Network error — retry on next interval.
             }
             finally {
@@ -395,6 +446,10 @@ export function useScreenRefreshKey(options = {}) {
             if (pauseWhenHidden && isDocumentHidden()) {
                 return;
             }
+            if (authFailureDelayMs() > 0) {
+                schedulePoll();
+                return;
+            }
             if (timer) {
                 clearTimeout(timer);
                 timer = null;