@blade-hq/agent-kit 1.0.34 → 1.0.35

package/dist/{chunk-FK4CV6R2.js → chunk-C63X3RCM.js}

@@ -95,12 +95,99 @@ var AppDevTemplatesResource = class {
   }
 };
 
-// src/client/resources/auth.ts
+// src/client/connection.ts
+var BladeConnectionError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "BladeConnectionError";
+    this.code = code;
+  }
+};
+function createMemoryAuthStorage() {
+  const values = /* @__PURE__ */ new Map();
+  return {
+    get: (key) => values.get(key) ?? null,
+    set: (key, value) => {
+      values.set(key, value);
+    },
+    remove: (key) => {
+      values.delete(key);
+    }
+  };
+}
+function createLocalAuthStorage() {
+  return {
+    get(key) {
+      const raw = window.localStorage.getItem(key);
+      if (!raw) return null;
+      try {
+        const value = JSON.parse(raw);
+        if (!value.accessToken || !value.user?.id || !value.user.username) return null;
+        return value;
+      } catch {
+        window.localStorage.removeItem(key);
+        return null;
+      }
+    },
+    set(key, value) {
+      window.localStorage.setItem(key, JSON.stringify(value));
+    },
+    remove(key) {
+      window.localStorage.removeItem(key);
+    }
+  };
+}
+
+// src/client/auth.ts
+function buildSocketAuth(options) {
+  const token = resolveAuthToken(options);
+  return token ? { token } : void 0;
+}
+function resolveAuthToken(options) {
+  const token = typeof options.token === "function" ? options.token() : options.token;
+  return token ? token : null;
+}
+var DEFAULT_POPUP_TIMEOUT_MS = 5 * 60 * 1e3;
+var DEFAULT_WINDOW_FEATURES = "popup=yes,width=560,height=720,resizable=yes,scrollbars=yes";
+var HEALTH_TIMEOUT_MS = 5e3;
 var AuthResource = class {
   constructor(client) {
     this.client = client;
+    const configured = client.options.authStorage;
+    if (configured === false) {
+      this.storage = this.memoryStorage;
+      this.persistent = false;
+    } else if (configured) {
+      this.storage = configured;
+      this.persistent = true;
+    } else if (typeof window === "undefined") {
+      this.storage = this.memoryStorage;
+      this.persistent = false;
+    } else {
+      this.storage = createLocalAuthStorage();
+      this.persistent = true;
+    }
+    this.snapshot = {
+      status: "signed_out",
+      baseUrl: client.baseUrl,
+      user: null,
+      error: null,
+      persistent: this.persistent,
+      managedBySdk: client.options.token === void 0
+    };
   }
   client;
+  listeners = /* @__PURE__ */ new Set();
+  memoryStorage = createMemoryAuthStorage();
+  storage;
+  persistent;
+  restorePromise = null;
+  baseUrlGeneration = 0;
+  pendingConnection = null;
+  activePopup = null;
+  cancelPending = null;
+  snapshot;
   getProviders() {
     return this.client.json("GET", "/api/auth/providers");
   }
@@ -110,7 +197,449 @@ var AuthResource = class {
   logout() {
     return this.client.json("POST", "/api/auth/logout");
   }
+  getConnectionSnapshot() {
+    return this.snapshot;
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  async probe() {
+    this.assertNoMixedContent();
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), HEALTH_TIMEOUT_MS);
+    let response;
+    try {
+      response = await (this.client.options.fetchImpl ?? fetch)(this.url("/api/health"), {
+        method: "GET",
+        credentials: "omit",
+        signal: controller.signal
+      });
+    } catch (error) {
+      throw new BladeConnectionError(
+        "service_unreachable",
+        "\u65E0\u6CD5\u8FDE\u63A5\u5230 Blade Agent\uFF0C\u8BF7\u786E\u8BA4\u670D\u52A1\u5730\u5740\u548C\u7F51\u7EDC\u72B6\u6001\u3002",
+        { cause: error }
+      );
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (!response.ok) {
+      throw new BladeConnectionError(
+        "service_unreachable",
+        `Blade Agent \u670D\u52A1\u8FD4\u56DE\u4E86 ${response.status}\u3002`
+      );
+    }
+    let data;
+    try {
+      data = await response.json();
+    } catch (error) {
+      throw new BladeConnectionError("not_blade_agent", "\u8BE5\u5730\u5740\u4E0D\u662F Blade Agent \u670D\u52A1\u3002", {
+        cause: error
+      });
+    }
+    if (data.service !== "blade-agent") {
+      throw new BladeConnectionError("not_blade_agent", "\u8BE5\u5730\u5740\u4E0D\u662F Blade Agent \u670D\u52A1\u3002");
+    }
+    if (data.sdk_auth_version !== "1") {
+      throw new BladeConnectionError(
+        "incompatible_server",
+        "Blade Agent \u7248\u672C\u8FC7\u4F4E\uFF0C\u8BF7\u5347\u7EA7\u670D\u52A1\u540E\u91CD\u8BD5\u3002"
+      );
+    }
+    return data;
+  }
+  restore() {
+    if (this.restorePromise) return this.restorePromise;
+    if (this.pendingConnection) {
+      return this.pendingConnection.then(
+        () => this.snapshot,
+        () => this.snapshot
+      );
+    }
+    const promise = this.runRestore().finally(() => {
+      if (this.restorePromise === promise) this.restorePromise = null;
+    });
+    this.restorePromise = promise;
+    return promise;
+  }
+  async runRestore() {
+    const generation = this.baseUrlGeneration;
+    this.update({ status: "checking_service", user: null, error: null });
+    try {
+      await this.probe();
+      if (generation !== this.baseUrlGeneration) return this.snapshot;
+      if (this.client.options.token !== void 0) {
+        try {
+          const user = await this.getMe();
+          if (generation !== this.baseUrlGeneration) return this.snapshot;
+          this.update({ status: "connected", user, error: null });
+          return this.snapshot;
+        } catch (error) {
+          if (error instanceof BladeApiError && error.status === 401) {
+            this.update({
+              status: "expired",
+              user: null,
+              error: new BladeConnectionError(
+                "invalid_credentials",
+                "\u63A5\u5165\u65B9\u914D\u7F6E\u7684 Token \u5DF2\u5931\u6548\uFF0C\u8BF7\u66F4\u65B0 Token \u540E\u91CD\u65B0\u68C0\u6D4B\u3002"
+              )
+            });
+            return this.snapshot;
+          }
+          throw error;
+        }
+      }
+      const stored = await this.storageGet();
+      if (generation !== this.baseUrlGeneration) return this.snapshot;
+      if (!stored) {
+        this.client._setManagedToken(null);
+        this.update({ status: "signed_out", user: null, error: null });
+        return this.snapshot;
+      }
+      this.client._setManagedToken(stored.accessToken);
+      try {
+        const user = await this.getMe();
+        if (generation !== this.baseUrlGeneration) return this.snapshot;
+        this.client._reconnectSocketWithCurrentAuth();
+        this.update({ status: "connected", user, error: null });
+        return this.snapshot;
+      } catch (error) {
+        if (error instanceof BladeApiError && error.status === 401) {
+          if (generation !== this.baseUrlGeneration) return this.snapshot;
+          await this.clearManagedAuth();
+          if (generation !== this.baseUrlGeneration) return this.snapshot;
+          this.update({ status: "expired", user: null, error: null });
+          return this.snapshot;
+        }
+        throw error;
+      }
+    } catch (error) {
+      const connectionError = this.toConnectionError(error, "service_unreachable");
+      this.update({
+        status: connectionError.code === "invalid_url" || connectionError.code === "mixed_content" ? "configuration_error" : "service_unavailable",
+        user: null,
+        error: connectionError
+      });
+      return this.snapshot;
+    }
+  }
+  retry() {
+    return this.restore();
+  }
+  connectWithPopup(options = {}) {
+    if (this.pendingConnection) return this.pendingConnection;
+    const promise = this.runPopupFlow(options).finally(() => {
+      if (this.pendingConnection === promise) this.pendingConnection = null;
+      this.cancelPending = null;
+      this.activePopup = null;
+    });
+    this.pendingConnection = promise;
+    return promise;
+  }
+  async disconnect() {
+    if (this.client.options.token !== void 0) {
+      throw new BladeConnectionError(
+        "token_exchange_failed",
+        "\u5F53\u524D Token \u7531\u63A5\u5165\u65B9\u7BA1\u7406\uFF0C\u8BF7\u7531\u63A5\u5165\u65B9\u5B8C\u6210\u65AD\u5F00\u64CD\u4F5C\u3002"
+      );
+    }
+    const generation = this.baseUrlGeneration;
+    await this.clearManagedAuth();
+    if (generation !== this.baseUrlGeneration) return;
+    this.client._disconnectSocket();
+    this.update({ status: "signed_out", user: null, error: null });
+  }
+  async _handleUnauthorized() {
+    if (this.client.options.token !== void 0) return;
+    const generation = this.baseUrlGeneration;
+    await this.clearManagedAuth();
+    if (generation !== this.baseUrlGeneration) return;
+    this.client._disconnectSocket();
+    this.update({ status: "expired", user: null, error: null });
+  }
+  async _handleBaseUrlChange() {
+    this.baseUrlGeneration += 1;
+    const previousRestore = this.restorePromise;
+    const previousConnection = this.pendingConnection;
+    this.cancelPending?.(
+      new BladeConnectionError("invalid_url", "\u670D\u52A1\u5730\u5740\u5DF2\u6539\u53D8\uFF0C\u672C\u6B21\u6388\u6743\u5DF2\u53D6\u6D88\u3002")
+    );
+    this.activePopup?.close();
+    this.client._setManagedToken(null);
+    this.update({
+      status: "checking_service",
+      baseUrl: this.client.baseUrl,
+      user: null,
+      error: null
+    });
+    if (previousConnection) {
+      try {
+        await previousConnection;
+      } catch {
+      }
+    }
+    if (previousRestore) await previousRestore;
+    await this.restore();
+  }
+  async runPopupFlow(options) {
+    if (this.client.options.token !== void 0) {
+      throw new BladeConnectionError(
+        "token_exchange_failed",
+        "\u5DF2\u7ECF\u914D\u7F6E\u663E\u5F0F Token\uFF0C\u65E0\u9700\u518D\u6B21\u6388\u6743\u3002"
+      );
+    }
+    const generation = this.baseUrlGeneration;
+    if (typeof window === "undefined" || !window.location) {
+      throw new BladeConnectionError("invalid_url", "\u5F39\u7A97\u6388\u6743\u53EA\u80FD\u5728\u6D4F\u89C8\u5668\u9875\u9762\u4E2D\u4F7F\u7528\u3002");
+    }
+    try {
+      const popup = window.open(
+        "",
+        "blade-agent-sdk-authorization",
+        options.windowFeatures ?? DEFAULT_WINDOW_FEATURES
+      );
+      if (!popup) {
+        throw new BladeConnectionError(
+          "popup_blocked",
+          "\u6D4F\u89C8\u5668\u963B\u6B62\u4E86\u6388\u6743\u7A97\u53E3\uFF0C\u8BF7\u5141\u8BB8\u5F39\u7A97\u540E\u91CD\u8BD5\u3002"
+        );
+      }
+      this.activePopup = popup;
+      if (this.restorePromise) {
+        await this.restorePromise;
+        this.assertGeneration(generation);
+        if (this.snapshot.status === "connected" && this.snapshot.user) {
+          return this.snapshot.user;
+        }
+      }
+      this.update({ status: "checking_service", user: null, error: null });
+      await this.probe();
+      if (generation !== this.baseUrlGeneration) {
+        throw new BladeConnectionError("invalid_url", "\u670D\u52A1\u5730\u5740\u5DF2\u6539\u53D8\uFF0C\u672C\u6B21\u6388\u6743\u5DF2\u53D6\u6D88\u3002");
+      }
+      const state = createAuthorizationState();
+      const clientOrigin = normalizeBrowserOrigin(window.location.origin);
+      const authorizeUrl = new URL(this.url("/api/auth/sdk/authorize"));
+      authorizeUrl.searchParams.set("client_origin", clientOrigin);
+      authorizeUrl.searchParams.set("state", state);
+      popup.location.href = authorizeUrl.toString();
+      this.update({ status: "waiting_for_authorization", user: null, error: null });
+      const message = await this.waitForPopup(
+        popup,
+        state,
+        options.timeoutMs ?? DEFAULT_POPUP_TIMEOUT_MS
+      );
+      this.assertGeneration(generation);
+      if (message.status === "denied") {
+        throw new BladeConnectionError("authorization_denied", "\u4F60\u5DF2\u53D6\u6D88\u8FDE\u63A5\u3002");
+      }
+      if (message.status === "error") {
+        if (message.error === "authentication_expired") {
+          throw new BladeConnectionError(
+            "authorization_expired",
+            "Blade Agent \u767B\u5F55\u72B6\u6001\u5DF2\u5931\u6548\uFF0C\u8BF7\u91CD\u65B0\u8FDE\u63A5\u3002"
+          );
+        }
+        throw new BladeConnectionError(
+          "token_exchange_failed",
+          "Blade Agent \u6682\u65F6\u65E0\u6CD5\u521B\u5EFA\u8FDE\u63A5\u51ED\u636E\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5\u3002"
+        );
+      }
+      if (!message.code) {
+        throw new BladeConnectionError(
+          "token_exchange_failed",
+          "\u6388\u6743\u7ED3\u679C\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u8FDE\u63A5\u3002"
+        );
+      }
+      this.update({ status: "connecting", user: null, error: null });
+      const issued = await this.client.jsonFromInit("/api/auth/sdk/token", {
+        method: "POST",
+        credentials: "omit",
+        body: JSON.stringify({
+          code: message.code,
+          state,
+          client_origin: clientOrigin
+        })
+      });
+      this.assertGeneration(generation);
+      if (!issued.access_token || !issued.user?.id) {
+        throw new BladeConnectionError(
+          "token_exchange_failed",
+          "Blade Agent \u672A\u8FD4\u56DE\u6709\u6548\u7684\u8FDE\u63A5\u51ED\u636E\u3002"
+        );
+      }
+      this.client._setManagedToken(issued.access_token);
+      const verified = await this.getMe();
+      this.assertGeneration(generation);
+      if (verified.id !== issued.user.id) {
+        throw new BladeConnectionError("origin_mismatch", "\u6388\u6743\u8D26\u53F7\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u8FDE\u63A5\u3002");
+      }
+      const user = {
+        id: verified.id,
+        username: verified.username,
+        display_name: verified.display_name,
+        avatar_url: verified.avatar_url
+      };
+      await this.storageSet({
+        accessToken: issued.access_token,
+        user,
+        savedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      this.assertGeneration(generation);
+      this.update({ status: "connected", user, error: null });
+      this.client._reconnectSocketWithCurrentAuth();
+      return user;
+    } catch (error) {
+      if (generation === this.baseUrlGeneration) await this.clearManagedAuth();
+      const connectionError = this.toConnectionError(error, "token_exchange_failed");
+      if (generation === this.baseUrlGeneration) {
+        this.update({
+          status: connectionError.code === "authorization_denied" || connectionError.code === "popup_closed" ? "signed_out" : connectionError.code === "mixed_content" || connectionError.code === "invalid_url" ? "configuration_error" : "service_unavailable",
+          user: null,
+          error: connectionError
+        });
+      }
+      throw connectionError;
+    } finally {
+      this.activePopup?.close();
+    }
+  }
+  waitForPopup(popup, state, timeoutMs) {
+    const expectedOrigin = new URL(this.client.baseUrl).origin;
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const finish = (error, message) => {
+        if (settled) return;
+        settled = true;
+        window.removeEventListener("message", onMessage);
+        clearInterval(closedTimer);
+        clearTimeout(expiryTimer);
+        this.cancelPending = null;
+        if (error) reject(error);
+        else if (message) resolve(message);
+      };
+      const onMessage = (event) => {
+        const data = event.data;
+        if (event.source !== popup || data?.type !== "blade-agent:sdk-auth") return;
+        if (event.origin !== expectedOrigin || data.version !== 1 || data.state !== state) {
+          finish(
+            new BladeConnectionError(
+              "origin_mismatch",
+              "\u6388\u6743\u7ED3\u679C\u6765\u6E90\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u5173\u95ED\u7A97\u53E3\u540E\u91CD\u65B0\u8FDE\u63A5\u3002"
+            )
+          );
+          return;
+        }
+        if (data.status !== "success" && data.status !== "denied" && data.status !== "error") {
+          return;
+        }
+        finish(void 0, data);
+      };
+      window.addEventListener("message", onMessage);
+      const closedTimer = window.setInterval(() => {
+        if (popup.closed) {
+          finish(new BladeConnectionError("popup_closed", "\u6388\u6743\u7A97\u53E3\u5DF2\u5173\u95ED\u3002"));
+        }
+      }, 250);
+      const expiryTimer = window.setTimeout(() => {
+        finish(
+          new BladeConnectionError(
+            "authorization_expired",
+            "\u6388\u6743\u7B49\u5F85\u65F6\u95F4\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u65B0\u8FDE\u63A5\u3002"
+          )
+        );
+      }, timeoutMs);
+      this.cancelPending = (error) => finish(error);
+    });
+  }
+  assertNoMixedContent() {
+    if (typeof window !== "undefined" && window.location.protocol === "https:" && new URL(this.client.baseUrl).protocol === "http:") {
+      throw new BladeConnectionError(
+        "mixed_content",
+        "\u5F53\u524D\u9875\u9762\u4F7F\u7528 HTTPS\uFF0CBlade Agent \u4E5F\u9700\u8981\u4F7F\u7528 HTTPS \u5730\u5740\u6216\u901A\u8FC7\u53CD\u5411\u4EE3\u7406\u8BBF\u95EE\u3002"
+      );
+    }
+  }
+  assertGeneration(generation) {
+    if (generation !== this.baseUrlGeneration) {
+      throw new BladeConnectionError("invalid_url", "\u670D\u52A1\u5730\u5740\u5DF2\u6539\u53D8\uFF0C\u672C\u6B21\u6388\u6743\u5DF2\u53D6\u6D88\u3002");
+    }
+  }
+  url(path) {
+    const base = this.client.baseUrl.endsWith("/") ? this.client.baseUrl : `${this.client.baseUrl}/`;
+    return new URL(path.replace(/^\//, ""), base).toString();
+  }
+  storageKey() {
+    return `blade-agent:auth:v1:${encodeURIComponent(this.client.baseUrl)}`;
+  }
+  async storageGet() {
+    try {
+      return await this.storage.get(this.storageKey());
+    } catch {
+      this.useMemoryStorage();
+      return null;
+    }
+  }
+  async storageSet(value) {
+    const generation = this.baseUrlGeneration;
+    const key = this.storageKey();
+    try {
+      await this.storage.set(key, value);
+    } catch {
+      this.assertGeneration(generation);
+      this.useMemoryStorage();
+      await this.storage.set(key, value);
+    }
+  }
+  async clearManagedAuth() {
+    const generation = this.baseUrlGeneration;
+    const key = this.storageKey();
+    this.client._setManagedToken(null);
+    try {
+      await this.storage.remove(key);
+    } catch {
+      if (generation !== this.baseUrlGeneration) return;
+      this.useMemoryStorage();
+      await this.storage.remove(key);
+    }
+  }
+  useMemoryStorage() {
+    this.storage = this.memoryStorage;
+    this.persistent = false;
+    this.snapshot = { ...this.snapshot, persistent: false };
+  }
+  update(next) {
+    this.snapshot = {
+      ...this.snapshot,
+      ...next,
+      baseUrl: next.baseUrl ?? this.client.baseUrl,
+      persistent: this.persistent,
+      managedBySdk: this.client.options.token === void 0
+    };
+    for (const listener of this.listeners) listener();
+  }
+  toConnectionError(error, fallback) {
+    if (error instanceof BladeConnectionError) return error;
+    return new BladeConnectionError(
+      fallback,
+      fallback === "service_unreachable" ? "\u65E0\u6CD5\u8FDE\u63A5\u5230 Blade Agent\uFF0C\u8BF7\u68C0\u67E5\u670D\u52A1\u5730\u5740\u540E\u91CD\u8BD5\u3002" : "\u8FDE\u63A5\u6CA1\u6709\u5B8C\u6210\uFF0C\u8BF7\u91CD\u65B0\u6388\u6743\u3002",
+      { cause: error }
+    );
+  }
 };
+function normalizeBrowserOrigin(value) {
+  const url = new URL(value);
+  if (!/^https?:$/.test(url.protocol) || url.origin === "null") {
+    throw new BladeConnectionError("invalid_url", "\u5F53\u524D\u9875\u9762\u5FC5\u987B\u901A\u8FC7 HTTP \u6216 HTTPS \u6253\u5F00\u3002");
+  }
+  return url.origin;
+}
+function createAuthorizationState() {
+  const bytes = new Uint8Array(24);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (value) => value.toString(16).padStart(2, "0")).join("");
+}
 
 // src/client/resources/env-buckets.ts
 var EnvBucketsResource = class {
@@ -2590,25 +3119,13 @@ var UserPreferencesResource = class {
 
 // src/client/socket.ts
 import { io } from "socket.io-client";
-
-// src/client/auth.ts
-function buildSocketAuth(options) {
-  const token = resolveAuthToken(options);
-  return token ? { token } : void 0;
-}
-function resolveAuthToken(options) {
-  const token = typeof options.token === "function" ? options.token() : options.token;
-  return token ? token : null;
-}
-
-// src/client/socket.ts
 function createSocket(options) {
   const auth = buildSocketAuth(options);
   const token = resolveAuthToken(options);
   return io(options.baseUrl, {
     path: options.path ?? "/socket.io",
-    withCredentials: true,
-    query: token ? { token } : void 0,
+    withCredentials: options.withCredentials ?? true,
+    query: typeof options.token === "function" || !token ? void 0 : { token },
     auth: typeof options.token === "function" ? (cb) => cb(buildSocketAuth(options) ?? {}) : auth,
     autoConnect: false
   });
@@ -2619,6 +3136,8 @@ var REFRESH_PATH = "/api/auth/refresh";
 var BladeClient = class {
   refreshPromise = null;
   socketInstance = null;
+  managedToken = null;
+  baseUrlChangeListeners = /* @__PURE__ */ new Set();
   storeRestTokenResolver = null;
   storeSocketTokenResolver = null;
   options;
@@ -2638,10 +3157,10 @@ var BladeClient = class {
   skills;
   solutions;
   userPreferences;
-  constructor(options) {
+  constructor(options = {}) {
     this.options = {
       ...options,
-      baseUrl: normalizeBaseUrl(options.baseUrl)
+      baseUrl: resolveBladeBaseUrl(options)
     };
     this.apiKeys = new ApiKeysResource(this);
     this.appDevTemplates = new AppDevTemplatesResource(this);
@@ -2667,22 +3186,47 @@ var BladeClient = class {
     this.storeSocketTokenResolver = fn;
   }
   setBaseUrl(baseUrl) {
-    const nextBaseUrl = normalizeBaseUrl(baseUrl);
+    const nextBaseUrl = resolveBladeBaseUrl({ baseUrl });
     if (nextBaseUrl === this.options.baseUrl) {
       return;
     }
     this.options.baseUrl = nextBaseUrl;
+    this.managedToken = null;
     if (this.socketInstance) {
       this.socketInstance.removeAllListeners();
       this.socketInstance.disconnect();
       this.socketInstance = null;
     }
+    for (const listener of this.baseUrlChangeListeners) listener();
+    void this.auth._handleBaseUrlChange();
+  }
+  onBaseUrlChange(listener) {
+    this.baseUrlChangeListeners.add(listener);
+    return () => this.baseUrlChangeListeners.delete(listener);
+  }
+  get baseUrl() {
+    return this.options.baseUrl ?? "";
+  }
+  _setManagedToken(token) {
+    this.managedToken = token;
+  }
+  _reconnectSocketWithCurrentAuth() {
+    if (!this.socketInstance) return;
+    this.socketInstance.disconnect();
+    this.socketInstance.io.opts.withCredentials = !this.shouldOmitManagedCredentials(
+      new URL(this.options.baseUrl)
+    );
+    this.socketInstance.connect();
+  }
+  _disconnectSocket() {
+    this.socketInstance?.disconnect();
   }
   socket() {
     if (!this.socketInstance) {
       this.socketInstance = createSocket({
         baseUrl: this.options.baseUrl,
-        token: () => this.resolveSocketToken()
+        token: () => this.resolveSocketToken(),
+        withCredentials: !this.shouldOmitManagedCredentials(new URL(this.options.baseUrl))
       });
     }
     return this.socketInstance;
@@ -2743,10 +3287,11 @@ var BladeClient = class {
   }
   async fetch(method, path, init = {}, isRetry = false) {
     const url = this.buildUrl(path);
+    const managedTokenAtRequest = this.managedToken;
     const response = await (this.options.fetchImpl ?? fetch)(url.toString(), {
       method,
       body: init.body,
-      credentials: init.credentials ?? "include",
+      credentials: init.credentials ?? this.defaultCredentials(url),
       headers: this.buildHeaders(url, init.headers),
       signal: init.signal
     });
@@ -2756,6 +3301,9 @@ var BladeClient = class {
         return this.fetch(method, path, init, true);
       }
     }
+    if (response.status === 401 && managedTokenAtRequest && this.managedToken === managedTokenAtRequest && this.isSameBackendUrl(url)) {
+      void this.auth._handleUnauthorized();
+    }
     if (init.expectOk !== false && !response.ok) {
       const detail = await extractErrorDetail(response);
       throw new BladeApiError(response, detail);
@@ -2803,7 +3351,13 @@ var BladeClient = class {
   }
   shouldRefreshFor401(url) {
     const refreshUrl = this.buildUrl(REFRESH_PATH);
-    return this.isSameBackendUrl(url) && url.pathname !== refreshUrl.pathname && !this.hasExplicitBearerToken();
+    return this.isSameBackendUrl(url) && url.pathname !== refreshUrl.pathname && !this.hasExplicitBearerToken() && !this.managedToken;
+  }
+  defaultCredentials(url) {
+    return this.shouldOmitManagedCredentials(url) ? "omit" : "include";
+  }
+  shouldOmitManagedCredentials(url) {
+    return !!this.managedToken && typeof window !== "undefined" && !!window.location?.origin && url.origin !== window.location.origin;
   }
   hasExplicitBearerToken() {
     return this.options.token !== void 0;
@@ -2838,7 +3392,7 @@ var BladeClient = class {
     if (!this.isSameBackendUrl(url)) {
       return null;
     }
-    return this.resolveRestToken();
+    return this.resolveConfiguredToken(this.storeRestTokenResolver);
   }
   resolveRestToken() {
     return this.resolveToken(this.storeRestTokenResolver);
@@ -2847,16 +3401,20 @@ var BladeClient = class {
     return this.resolveToken(this.storeSocketTokenResolver);
   }
   resolveToken(resolver) {
-    const token = this.options.token === void 0 ? resolver?.() : typeof this.options.token === "function" ? this.options.token() : this.options.token;
-    return token ? token : null;
+    return this.resolveConfiguredToken(resolver) || this.managedToken || null;
+  }
+  resolveConfiguredToken(resolver) {
+    const configuredToken = this.options.token === void 0 ? resolver?.() : typeof this.options.token === "function" ? this.options.token() : this.options.token;
+    return configuredToken || null;
   }
   formDataWithUploadProgress(method, path, form, options, isRetry = false) {
     const url = this.buildUrl(path);
+    const managedTokenAtRequest = this.managedToken;
     const headers = this.buildHeaders(url);
     return new Promise((resolve, reject) => {
       const xhr = new XMLHttpRequest();
       xhr.open(method, url.toString(), true);
-      xhr.withCredentials = true;
+      xhr.withCredentials = this.defaultCredentials(url) === "include";
       headers.forEach((value, key) => {
         xhr.setRequestHeader(key, value);
       });
@@ -2878,6 +3436,9 @@ var BladeClient = class {
             return;
           }
         }
+        if (xhr.status === 401 && managedTokenAtRequest && this.managedToken === managedTokenAtRequest && this.isSameBackendUrl(url)) {
+          void this.auth._handleUnauthorized();
+        }
         const response = new Response(xhr.responseText, {
           status: xhr.status,
           statusText: xhr.statusText,
@@ -2895,12 +3456,44 @@ var BladeClient = class {
     });
   }
 };
-function normalizeBaseUrl(baseUrl) {
-  const normalized = baseUrl.trim().replace(/\/+$/, "");
-  if (normalized || typeof window === "undefined") {
-    return normalized;
+function resolveBladeBaseUrl(options = {}) {
+  const explicit = options.baseUrl?.trim() ?? "";
+  if (explicit && options.port !== void 0) {
+    throw new TypeError("baseUrl and port cannot be configured at the same time");
+  }
+  if (options.port !== void 0 && (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535)) {
+    throw new TypeError("port must be an integer between 1 and 65535");
+  }
+  let candidate = explicit;
+  if (!candidate) {
+    if (typeof window === "undefined" || !window.location?.hostname) {
+      throw new TypeError(
+        "BladeClient requires baseUrl outside a browser, for example new BladeClient({ baseUrl: 'http://127.0.0.1:8020' })"
+      );
+    }
+    const protocol = window.location.protocol;
+    if (protocol !== "http:" && protocol !== "https:") {
+      throw new TypeError("BladeClient automatic baseUrl requires an HTTP(S) page");
+    }
+    const url = new URL(window.location.origin);
+    url.port = String(options.port ?? 8020);
+    url.pathname = "/";
+    url.search = "";
+    url.hash = "";
+    candidate = url.toString();
+  }
+  let parsed;
+  try {
+    parsed = new URL(candidate);
+  } catch (error) {
+    throw new TypeError("baseUrl must be a valid HTTP(S) URL", { cause: error });
+  }
+  if (!/^https?:$/.test(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new TypeError(
+      "baseUrl must be an HTTP(S) URL without embedded credentials, query, or fragment"
+    );
   }
-  return window.location.origin;
+  return parsed.toString().replace(/\/+$/, "");
 }
 function isFormData(value) {
   return typeof FormData !== "undefined" && value instanceof FormData;
@@ -2925,6 +3518,9 @@ export {
   BladeApiError,
   ApiKeysResource,
   AppDevTemplatesResource,
+  BladeConnectionError,
+  createMemoryAuthStorage,
+  createLocalAuthStorage,
   AuthResource,
   GisResource,
   HeadlessError,
@@ -2945,6 +3541,7 @@ export {
   SolutionsResource,
   UserPreferencesResource,
   createSocket,
-  BladeClient
+  BladeClient,
+  resolveBladeBaseUrl
 };
-//# sourceMappingURL=chunk-FK4CV6R2.js.map
+//# sourceMappingURL=chunk-C63X3RCM.js.map