@burtson-labs/bandit-engine 2.0.164 → 2.0.166

package/dist/index.js

@@ -46,31 +46,42 @@ var init_packageSettingsStore = __esm({
 });
 
 // src/store/authenticationStore.ts
-var import_zustand2, TOKEN_KEY, validToken, user, rawToken, useAuthenticationStore, readPersistedToken;
+var import_zustand2, TOKEN_KEY, decodeClaims, validOrNull, readLegacyStorage, validToken, user, rawToken, useAuthenticationStore, readPersistedToken;
 var init_authenticationStore = __esm({
   "src/store/authenticationStore.ts"() {
     "use strict";
     import_zustand2 = require("zustand");
     TOKEN_KEY = "authToken";
-    validToken = null;
-    user = null;
-    rawToken = localStorage.getItem(TOKEN_KEY);
-    if (rawToken) {
+    decodeClaims = (token) => {
       try {
-        const base64Url = rawToken.split(".")[1];
+        const base64Url = token.split(".")[1];
         const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
         const jsonPayload = decodeURIComponent(
           atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
         );
-        const decoded = JSON.parse(jsonPayload);
-        if (decoded.exp * 1e3 > Date.now()) {
-          validToken = rawToken;
-          user = decoded;
-        }
+        return JSON.parse(jsonPayload);
       } catch {
-        validToken = null;
-        user = null;
+        return null;
       }
+    };
+    validOrNull = (raw) => {
+      if (!raw) return null;
+      const decoded = decodeClaims(raw);
+      return decoded && decoded.exp * 1e3 > Date.now() ? raw : null;
+    };
+    readLegacyStorage = () => {
+      try {
+        return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY);
+      } catch {
+        return null;
+      }
+    };
+    validToken = null;
+    user = null;
+    rawToken = readLegacyStorage();
+    if (rawToken) {
+      validToken = validOrNull(rawToken);
+      user = validToken ? decodeClaims(validToken) : null;
     }
     useAuthenticationStore = (0, import_zustand2.create)((set) => ({
       token: validToken,
@@ -78,16 +89,10 @@ var init_authenticationStore = __esm({
       authError: null,
       setToken: (token) => {
         if (token) {
-          try {
-            const base64Url = token.split(".")[1];
-            const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-            const jsonPayload = decodeURIComponent(
-              atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-            );
-            const user2 = JSON.parse(jsonPayload);
-            localStorage.setItem(TOKEN_KEY, token);
-            set({ token, authError: null, user: user2 });
-          } catch {
+          const decoded = decodeClaims(token);
+          if (decoded) {
+            set({ token, authError: null, user: decoded });
+          } else {
             set({ token: null, authError: "Invalid token", user: null });
           }
         } else {
@@ -95,23 +100,11 @@ var init_authenticationStore = __esm({
         }
       },
       clearToken: () => {
-        localStorage.removeItem(TOKEN_KEY);
         set({ token: null, authError: null, user: null });
       }
     }));
     readPersistedToken = () => {
-      try {
-        const raw = localStorage.getItem(TOKEN_KEY);
-        if (!raw) return null;
-        const base64 = raw.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
-        const json2 = decodeURIComponent(
-          atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-        );
-        const decoded = JSON.parse(json2);
-        return decoded.exp * 1e3 > Date.now() ? raw : null;
-      } catch {
-        return null;
-      }
+      return validOrNull(readLegacyStorage()) ?? validOrNull(useAuthenticationStore.getState().token);
     };
   }
 });
@@ -158,11 +151,20 @@ var init_debugLogger = __esm({
        */
       debug(message, context) {
       }
+      verboseEnabled() {
+        if (this.isDevelopment) return true;
+        try {
+          return typeof localStorage !== "undefined" && localStorage.getItem("bandit:debug") === "1";
+        } catch {
+          return false;
+        }
+      }
       /**
-       * Info logs - shown in both development and production
-       * Used for important user-facing information
+       * Info logs - shown in development, or in production when localStorage
+       * `bandit:debug` is "1"
        */
       info(message, context) {
+        if (!this.verboseEnabled()) return;
         const prefix = this.isDevelopment ? "\u2139\uFE0F [INFO]" : "[INFO]";
         if (context) {
           console.info(`${prefix} ${message}`, context);
@@ -232,7 +234,7 @@ function emitAuthTokenChanged(token) {
     detail: { token }
   }));
 }
-var TOKEN_KEY2, AUTH_TOKEN_CHANGED_EVENT, AuthenticationService, authenticationService;
+var TOKEN_KEY2, AUTH_TOKEN_CHANGED_EVENT, readLocalStorage, writeLocalStorage, AuthenticationService, authenticationService;
 var init_authenticationService = __esm({
   "src/services/auth/authenticationService.ts"() {
     "use strict";
@@ -240,21 +242,103 @@ var init_authenticationService = __esm({
     init_debugLogger();
     TOKEN_KEY2 = "authToken";
     AUTH_TOKEN_CHANGED_EVENT = "bandit:auth-token-changed";
+    readLocalStorage = () => {
+      try {
+        return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY2);
+      } catch {
+        return null;
+      }
+    };
+    writeLocalStorage = (token) => {
+      try {
+        if (typeof localStorage === "undefined") return;
+        if (token) localStorage.setItem(TOKEN_KEY2, token);
+        else localStorage.removeItem(TOKEN_KEY2);
+      } catch {
+      }
+    };
     AuthenticationService = class {
+      storageMode = "localStorage";
+      persistence = null;
+      handlers = {};
+      /** Bumped on every setToken/clearToken; async flows compare it to detect a superseded session. */
+      revision = 0;
+      refreshInFlight = null;
+      lastPersist = Promise.resolve();
+      /**
+       * Pick the storage contract for this host. Call once at boot, before the
+       * first `setToken`. Switching modes never moves a token by itself: the
+       * host migrates (e.g. reads the legacy localStorage value, then clears it).
+       */
+      configureSession(config) {
+        this.storageMode = config.storage;
+        this.persistence = config.persistence ?? null;
+        this.handlers = config.handlers ?? {};
+      }
+      getStorageMode() {
+        return this.storageMode;
+      }
+      getSessionRevision() {
+        return this.revision;
+      }
       getToken() {
-        const token = localStorage.getItem(TOKEN_KEY2);
-        return token;
+        if (this.storageMode === "memory") {
+          return useAuthenticationStore.getState().token;
+        }
+        return readLocalStorage();
       }
       setToken(token) {
-        localStorage.setItem(TOKEN_KEY2, token);
+        this.revision += 1;
+        if (this.storageMode === "localStorage") {
+          writeLocalStorage(token);
+        } else {
+          writeLocalStorage(null);
+        }
         useAuthenticationStore.getState().setToken(token);
+        this.mirror(() => this.persistence?.write(token));
         emitAuthTokenChanged(token);
       }
       clearToken() {
-        localStorage.removeItem(TOKEN_KEY2);
+        this.revision += 1;
+        const current = this.getToken() ?? useAuthenticationStore.getState().token;
+        try {
+          this.handlers.beforeClear?.(current);
+        } catch (error) {
+          debugLogger.warn("Auth beforeClear handler failed", { error });
+        }
+        writeLocalStorage(null);
         useAuthenticationStore.getState().clearToken();
+        this.mirror(() => this.persistence?.clear());
         emitAuthTokenChanged(null);
       }
+      /** True when the host registered a silent refresh path. */
+      canRefresh() {
+        return typeof this.handlers.refresh === "function";
+      }
+      /**
+       * Ask the host for a fresh token. Concurrent callers share one attempt.
+       * Resolves false when no refresh path exists or it did not produce a token.
+       */
+      tryRefresh() {
+        const refresh = this.handlers.refresh;
+        if (!refresh) return Promise.resolve(false);
+        if (this.refreshInFlight) return this.refreshInFlight;
+        this.refreshInFlight = (async () => {
+          try {
+            return await refresh();
+          } catch (error) {
+            debugLogger.warn("Auth refresh handler failed", { error });
+            return false;
+          } finally {
+            this.refreshInFlight = null;
+          }
+        })();
+        return this.refreshInFlight;
+      }
+      /** Resolves once the most recent persistence write/clear has settled. */
+      whenPersisted() {
+        return this.lastPersist;
+      }
       isAuthenticated() {
         const token = useAuthenticationStore.getState().token;
         return !!token && !this.isTokenExpired(token);
@@ -284,6 +368,16 @@ var init_authenticationService = __esm({
           return null;
         }
       }
+      mirror(run) {
+        const attempt = (async () => {
+          try {
+            await run();
+          } catch (error) {
+            debugLogger.warn("Auth token persistence failed", { error });
+          }
+        })();
+        this.lastPersist = attempt;
+      }
     };
     authenticationService = new AuthenticationService();
   }
@@ -4872,13 +4966,35 @@ var init_gateway_service = __esm({
         });
         instance.interceptors.response.use(
           (response) => response,
-          (error) => {
+          async (error) => {
+            const retried = await this._retryAfterRefresh(instance, error);
+            if (retried) return retried;
             this._handleAuthFailure(error);
             return Promise.reject(this._normalizeAxiosError(error));
           }
         );
         return instance;
       }
+      /**
+       * A bare 401 on a host with a silent refresh path (HttpOnly refresh cookie,
+       * native device token) usually means the access token aged out mid-session.
+       * Refresh once and replay the request with the new token instead of
+       * signing the user out; a failed refresh falls through to the sign-out path.
+       */
+      async _retryAfterRefresh(instance, error) {
+        const config = error.config;
+        if (!config || config._banditAuthRetried || error.response?.status !== 401) return null;
+        if (!authenticationService.canRefresh()) return null;
+        const data = error.response?.data;
+        if (data?.code && data.code !== "TOKEN_EXPIRED") return null;
+        try {
+          if (!await authenticationService.tryRefresh()) return null;
+        } catch {
+          return null;
+        }
+        config._banditAuthRetried = true;
+        return instance.request(config);
+      }
       _normalizeAxiosError(error) {
         if (error.response) {
           return this._createHttpError(
@@ -9598,14 +9714,28 @@ function isJWTExpired(payload) {
   if (!payload.exp) return false;
   return Date.now() >= payload.exp * 1e3;
 }
-var import_react, import_jsx_runtime, FeatureFlagContext, coerceNumber, coerceBoolean, FeatureFlagProvider, useFeatureFlag;
+var import_react, import_jsx_runtime, readSessionToken, FeatureFlagContext, coerceNumber, coerceBoolean, FeatureFlagProvider, useFeatureFlag;
 var init_FeatureFlagContext = __esm({
   "src/contexts/FeatureFlagContext.tsx"() {
     "use strict";
     import_react = require("react");
     init_featureFlags();
     init_debugLogger();
+    init_authenticationService();
     import_jsx_runtime = require("react/jsx-runtime");
+    readSessionToken = (jwtStorageKey) => {
+      const fromStorage = () => {
+        try {
+          return localStorage.getItem(jwtStorageKey);
+        } catch {
+          return null;
+        }
+      };
+      if (jwtStorageKey && jwtStorageKey !== TOKEN_KEY2) {
+        return fromStorage() ?? authenticationService.getToken();
+      }
+      return authenticationService.getToken() ?? fromStorage();
+    };
     FeatureFlagContext = (0, import_react.createContext)(void 0);
     coerceNumber = (value, fallback) => {
       if (typeof value === "number" && Number.isFinite(value)) {
@@ -9655,7 +9785,7 @@ var init_FeatureFlagContext = __esm({
         let effectiveTier = currentTier || subscriptionType || "oss";
         if (typeof window !== "undefined") {
           try {
-            const token = localStorage.getItem(jwtStorageKey);
+            const token = readSessionToken(jwtStorageKey);
             if (token) {
               jwtFound = true;
               const payload = decodeJWT(token);
@@ -9741,10 +9871,13 @@ var init_FeatureFlagContext = __esm({
             setCurrentTier(e.detail.tier);
           }
         };
+        const handleSessionChange = () => refreshEvaluation();
         window.addEventListener("storage", handleStorageChange);
+        window.addEventListener(AUTH_TOKEN_CHANGED_EVENT, handleSessionChange);
         window.addEventListener("bandit:tier-updated", handleTierUpdate);
         return () => {
           window.removeEventListener("storage", handleStorageChange);
+          window.removeEventListener(AUTH_TOKEN_CHANGED_EVENT, handleSessionChange);
           window.removeEventListener("bandit:tier-updated", handleTierUpdate);
         };
       }, [refreshEvaluation, config.jwtStorageKey]);
@@ -13890,7 +14023,7 @@ var init_voiceService = __esm({
         }
         const token = authenticationService.getToken();
         if (!token) {
-          debugLogger.warn("No JWT token available - skipping voice models fetch");
+          debugLogger.info("No JWT token available - skipping voice models fetch");
           const emptyModels = {
             models: [],
             defaultModel: "",
@@ -31107,6 +31240,7 @@ var init_chat2 = __esm({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AUTH_TOKEN_CHANGED_EVENT: () => AUTH_TOKEN_CHANGED_EVENT,
   Chat: () => chat_default,
   ChatModal: () => chat_modal_default,
   ChatProvider: () => chat_provider_default,
@@ -31127,6 +31261,7 @@ __export(index_exports, {
   StreamingTTSClient: () => StreamingTTSClient,
   SubscriptionExpiredGuard: () => SubscriptionExpiredGuard,
   SubscriptionExpiredModal: () => SubscriptionExpiredModal,
+  TOKEN_KEY: () => TOKEN_KEY2,
   TTSState: () => TTSState,
   VectorDatabaseService: () => VectorDatabaseService,
   VectorMigrationService: () => VectorMigrationService,
@@ -31201,6 +31336,11 @@ init_common_types();
 init_authenticationService();
 init_debugLogger();
 init_indexedDBService();
+var sessionTokenFactory = (label) => () => {
+  const token = authenticationService.getToken();
+  debugLogger.info(`AIProviderInit: ${label}`, { hasToken: !!token });
+  return token;
+};
 var AIProviderInitService = class _AIProviderInitService {
   static instance;
   constructor() {
@@ -31280,25 +31420,7 @@ var AIProviderInitService = class _AIProviderInitService {
       providerConfig = {
         type: "ollama" /* OLLAMA */,
         baseUrl: settings.ollamaUrl,
-        tokenFactory: () => {
-          let token = authenticationService.getToken();
-          if (!token) {
-            token = localStorage.getItem("authToken");
-          }
-          if (!token) {
-            try {
-              const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-              const authStore = useAuthenticationStore2.getState();
-              token = authStore.token;
-            } catch (e) {
-            }
-          }
-          debugLogger.info("AIProviderInit: Token factory called", {
-            hasToken: !!token,
-            localStorage: !!localStorage.getItem("authToken")
-          });
-          return token;
-        }
+        tokenFactory: sessionTokenFactory("Token factory called")
       };
       debugLogger.info("Using legacy Ollama config", providerConfig);
     }
@@ -31321,25 +31443,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const fallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: settings.ollamaUrl || "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore2.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(fallbackConfig);
@@ -31352,25 +31456,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const localFallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore2.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Local fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Local fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(localFallbackConfig);
@@ -31442,27 +31528,7 @@ var AIProviderInitService = class _AIProviderInitService {
         });
         return config;
       }
-      config.tokenFactory = () => {
-        let token = authenticationService.getToken();
-        if (!token && typeof localStorage !== "undefined") {
-          try {
-            token = localStorage.getItem("authToken");
-          } catch {
-          }
-        }
-        if (!token) {
-          try {
-            const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-            const authStore = useAuthenticationStore2.getState();
-            token = authStore.token;
-          } catch {
-          }
-        }
-        debugLogger.info("AIProviderInit: Token factory resolved auth token", {
-          hasToken: !!token
-        });
-        return token;
-      };
+      config.tokenFactory = sessionTokenFactory("Token factory resolved auth token");
     }
     return config;
   }
@@ -45216,7 +45282,7 @@ var SubscriptionExpiredModal = ({
             "Account: ",
             /* @__PURE__ */ (0, import_jsx_runtime64.jsx)("strong", { children: userEmail })
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(import_material62.Typography, { variant: "body1", sx: { textAlign: "center", color: "text.secondary" }, children: IS_STORE_BUILD ? "Premium features are unavailable on this account right now." : "To continue using all features, please renew your subscription or return to the main application." }),
+          /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(import_material62.Typography, { variant: "body1", sx: { textAlign: "center", color: "text.secondary" }, children: IS_STORE_BUILD ? "Premium features are unavailable on this account right now. You can subscribe to Pro in the app or review your account." : "To continue using all features, please renew your subscription or return to the main application." }),
           /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(import_material62.Box, { sx: {
             bgcolor: "background.paper",
             border: 1,
@@ -45238,10 +45304,10 @@ var SubscriptionExpiredModal = ({
               startIcon: /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(import_react89.Home, {}),
               size: "large",
               sx: { minWidth: 140 },
-              children: "Go Home"
+              children: IS_STORE_BUILD ? "My Account" : "Go Home"
             }
           ),
-          !IS_STORE_BUILD && /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(
+          (!IS_STORE_BUILD || onManageSubscription) && /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(
             import_material62.Button,
             {
               onClick: handleManageSubscription,
@@ -45250,7 +45316,7 @@ var SubscriptionExpiredModal = ({
               size: "large",
               color: "primary",
               sx: { minWidth: 140 },
-              children: "Renew Subscription"
+              children: IS_STORE_BUILD ? "View Pro Options" : "Renew Subscription"
             }
           )
         ] })
@@ -45262,6 +45328,7 @@ var SubscriptionExpiredModal = ({
 // src/guards/SubscriptionExpiredGuard.tsx
 var import_react90 = require("react");
 init_useFeatures();
+init_authenticationService();
 var import_jsx_runtime65 = require("react/jsx-runtime");
 var SubscriptionExpiredGuard = ({
   children,
@@ -45289,11 +45356,9 @@ var SubscriptionExpiredGuard = ({
   const evaluation = getFullEvaluation();
   const extractedEmail = userEmail || evaluation?.metadata?.jwtFound ? (() => {
     try {
-      const token = localStorage.getItem("authToken");
+      const token = authenticationService.getToken();
       if (token) {
-        const parts = token.split(".");
-        const payload = JSON.parse(atob(parts[1]));
-        return payload.email;
+        return authenticationService.parseJwtClaims(token)?.email;
       }
     } catch (e) {
     }
@@ -45475,6 +45540,7 @@ init_vectorMigrationService();
 init_useVectorStore();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AUTH_TOKEN_CHANGED_EVENT,
   Chat,
   ChatModal,
   ChatProvider,
@@ -45495,6 +45561,7 @@ init_useVectorStore();
   StreamingTTSClient,
   SubscriptionExpiredGuard,
   SubscriptionExpiredModal,
+  TOKEN_KEY,
   TTSState,
   VectorDatabaseService,
   VectorMigrationService,