@burtson-labs/bandit-engine 2.0.164 → 2.0.166

package/dist/{chunk-JYBQAKSZ.mjs → chunk-WSZE3DDJ.mjs}

@@ -5,10 +5,10 @@ import {
   StreamingMarkdown_default,
   isNativeShell,
   isStandalonePwa
-} from "./chunk-IZX2J65Q.mjs";
+} from "./chunk-IB2LPSQQ.mjs";
 import {
   useMCPToolsStore
-} from "./chunk-O6P37PFR.mjs";
+} from "./chunk-MM3NRLVR.mjs";
 import {
   ArrowDown,
   ArrowUp,
@@ -47,7 +47,7 @@ import {
   useNotificationService,
   useTTS,
   useVoiceStore
-} from "./chunk-WLNZL6SP.mjs";
+} from "./chunk-Q2DINRIU.mjs";
 import {
   brandingService_default,
   detectMessageMood,
@@ -68,22 +68,22 @@ import {
   useMemoryStore,
   useProjectStore,
   useVectorStore
-} from "./chunk-J6SWNO7Z.mjs";
+} from "./chunk-33OSALGS.mjs";
 import {
   indexedDBService_default,
   useModelStore,
   usePackageSettingsStore,
   usePreferencesStore
-} from "./chunk-TY5VL3SG.mjs";
+} from "./chunk-YH5YWK4K.mjs";
 import {
   authenticationService,
   readPersistedToken,
   useAIProviderStore,
   useAuthenticationStore
-} from "./chunk-CQJGUYRW.mjs";
+} from "./chunk-GRPTCHFN.mjs";
 import {
   debugLogger
-} from "./chunk-OCVZVBQQ.mjs";
+} from "./chunk-HNXPDIWC.mjs";
 
 // src/chat/chat.tsx
 import { useCallback as useCallback6, useEffect as useEffect17, useLayoutEffect, useRef as useRef16, useState as useState19 } from "react";
@@ -11900,4 +11900,4 @@ export {
   IS_STORE_BUILD,
   chat_default
 };
-//# sourceMappingURL=chunk-JYBQAKSZ.mjs.map
+//# sourceMappingURL=chunk-WSZE3DDJ.mjs.map

package/dist/{chunk-TY5VL3SG.mjs → chunk-YH5YWK4K.mjs}

@@ -1,6 +1,6 @@
 import {
   debugLogger
-} from "./chunk-OCVZVBQQ.mjs";
+} from "./chunk-HNXPDIWC.mjs";
 
 // src/store/modelStore.ts
 import { create as create3 } from "zustand";
@@ -357,7 +357,7 @@ var usePreferencesStore = create2((set, get) => ({
     }));
     get().savePreferences();
     if (key === "banditModelsEnabled" && prevValue !== value) {
-      import("./modelStore-7XYYDCNC.mjs").then(({ useModelStore: useModelStore2 }) => {
+      import("./modelStore-F6JQUXGG.mjs").then(({ useModelStore: useModelStore2 }) => {
         useModelStore2.getState().handleBanditPersonalitiesPreferenceChange(value);
       });
     }
@@ -877,4 +877,4 @@ export {
   usePreferencesStore,
   useModelStore
 };
-//# sourceMappingURL=chunk-TY5VL3SG.mjs.map
+//# sourceMappingURL=chunk-YH5YWK4K.mjs.map

package/dist/index.d.mts

@@ -117,7 +117,8 @@ declare function defineCustomElement<Props extends Record<string, unknown>>(name
  * Centralized logging service that provides environment-aware debug logging.
  *
  * Features:
- * - Production builds: Only errors and info logs are shown
+ * - Production builds: Only warnings and errors are shown; set
+ *   localStorage `bandit:debug` to "1" to see info logs too
  * - Development mode: All logs are shown with clear debug prefixes
  * - Consistent formatting for debugging purposes
  * - Clear indication that logs are for debugging
@@ -147,9 +148,10 @@ declare class DebugLogger {
      * DISABLED to prevent console flooding during chat processing
      */
     debug(message: string, context?: LogContext): void;
+    private verboseEnabled;
     /**
-     * Info logs - shown in both development and production
-     * Used for important user-facing information
+     * Info logs - shown in development, or in production when localStorage
+     * `bandit:debug` is "1"
      */
     info(message: string, context?: LogContext): void;
     /**
@@ -246,14 +248,105 @@ interface JwtClaims {
      * Present when user belongs to a team.
      */
     teamId?: string;
+    /**
+     * Identifiers of the teams this user OWNS (Team.createdBy == email).
+     * Present only when the user owns at least one team.
+     */
+    ownedTeamIds?: string[];
+    /**
+     * Host domains this token can reach — tenant workspaces appear here as
+     * "{slug}.banditai.ai". The tenant app gates access on this claim.
+     */
+    domains?: string[];
+    /**
+     * Current subscription tier inferred from the JWT.
+     */
+    subscriptionType?: string;
+    /**
+     * Indicates whether the subscription is active.
+     */
+    isSubscribed?: boolean;
+    /**
+     * Optional avatar reference (an S3 app-asset id) for the user's profile
+     * picture. Resolved to an image via the file-storage download endpoint.
+     */
+    avatarUrl?: string;
+}
+declare const TOKEN_KEY = "authToken";
+declare const AUTH_TOKEN_CHANGED_EVENT = "bandit:auth-token-changed";
+/**
+ * Where the live access token is kept.
+ *
+ * - `localStorage` — the historical contract: the JWT is persisted under
+ *   `authToken` and readable by any script on the page. Default, so npm
+ *   consumers that wire `tokenFactory: () => localStorage.getItem("authToken")`
+ *   keep working unchanged.
+ * - `memory` — the JWT lives only in the auth store for the life of the page.
+ *   The host app is responsible for restoring it at boot (an HttpOnly refresh
+ *   cookie, secure native storage, ...) through a `TokenPersistence` and a
+ *   `refresh` handler. Nothing token-shaped is written to Web Storage.
+ */
+type TokenStorageMode = "localStorage" | "memory";
+/**
+ * Optional write-through mirror of the live token. Used by the native shell
+ * to keep the session in the OS keychain / Android Keystore instead of the
+ * WebView's localStorage. Failures are the host's to handle; the in-memory
+ * session is already valid when these run.
+ */
+interface TokenPersistence {
+    write(token: string): void | Promise<void>;
+    clear(): void | Promise<void>;
+}
+interface AuthSessionHandlers {
+    /**
+     * Obtain a fresh access token silently (refresh cookie, device token, ...).
+     * Resolve `true` after calling `setToken` with the new token, `false` when
+     * an interactive sign-in is needed. Deduplicated by the service.
+     */
+    refresh?: () => Promise<boolean>;
+    /**
+     * Runs synchronously inside `clearToken()`, before the token is dropped,
+     * with the token being dropped — the moment to revoke it server-side.
+     */
+    beforeClear?: (token: string | null) => void;
+}
+interface AuthSessionConfig {
+    storage: TokenStorageMode;
+    persistence?: TokenPersistence | null;
+    handlers?: AuthSessionHandlers;
 }
 declare class AuthenticationService {
+    private storageMode;
+    private persistence;
+    private handlers;
+    /** Bumped on every setToken/clearToken; async flows compare it to detect a superseded session. */
+    private revision;
+    private refreshInFlight;
+    private lastPersist;
+    /**
+     * Pick the storage contract for this host. Call once at boot, before the
+     * first `setToken`. Switching modes never moves a token by itself: the
+     * host migrates (e.g. reads the legacy localStorage value, then clears it).
+     */
+    configureSession(config: AuthSessionConfig): void;
+    getStorageMode(): TokenStorageMode;
+    getSessionRevision(): number;
     getToken(): string | null;
     setToken(token: string): void;
     clearToken(): void;
+    /** True when the host registered a silent refresh path. */
+    canRefresh(): boolean;
+    /**
+     * Ask the host for a fresh token. Concurrent callers share one attempt.
+     * Resolves false when no refresh path exists or it did not produce a token.
+     */
+    tryRefresh(): Promise<boolean>;
+    /** Resolves once the most recent persistence write/clear has settled. */
+    whenPersisted(): Promise<void>;
     isAuthenticated(): boolean;
     isTokenExpired(token: string): boolean;
     parseJwtClaims(token: string): JwtClaims | null;
+    private mirror;
 }
 declare const authenticationService: AuthenticationService;
 
@@ -1438,4 +1531,4 @@ declare const useVectorStore: () => {
     initializeVectorService: () => Promise<void>;
 };
 
-export { Chat, type CreateMemoryOptions, DebugLogger, FeatureEvaluation, FeatureFlagConfig, FeatureFlagContext, type FeatureFlagContextValue, FeatureFlagProvider, type FeatureFlagProviderProps, FeatureFlagService, FeatureKey, FeedbackButton, type FeedbackButtonProps, type FeedbackCategories, FeedbackModal, type FeedbackModalProps, type FeedbackPriorities, type FeedbackRequest, type FeedbackResponse, type FileUploadResult, type GatewayQueryOptions, InterestsEditor, type LogContext, MANAGEMENT_SECTIONS, Management, type ManagementAccess, type ManagementAccessInput, type ManagementLink, type ManagementProps, type ManagementRequest, type ManagementSectionDef, type ManagementSectionId, type MemorySearchFilters, type MigrationProgress, type MigrationStatus, type NotificationConfig, type NotificationContextType, NotificationProvider, type NotificationProviderProps, NotificationService, SYSTEM_FLAGS, type SearchOptions, type SearchResult, StreamingTTSClient, SubscriptionExpiredGuard, type SubscriptionExpiredGuardProps, SubscriptionExpiredModal, type SubscriptionExpiredModalProps, SubscriptionTier, type TTSOptions, type TTSProgress, TTSState, TrialUsage, type UploadRequest, type UseTTSReturn, VectorDatabaseService, type VectorDocument, type VectorMemory, type VectorMemoryMetadata, VectorMigrationService, type VectorStoreStatus, type VoiceState, authenticationService, debugLogger, defineCustomElement, featureFlagService, getCriticalConfig, getFeatureMatrix, getStreamingTTSClient, getSystemConstants, getTTSState, handleHttpError, handleSubscriptionUpgrade, handleValidationError, initializeCoreSystem, isWorkspaceAdminRole, notificationService, pauseTTS, previewTierUpgrade, resolveManagementSections, resumeTTS, showInfoNotification, showSuccessNotification, speakStream as speakWithStreaming, stopTTS, syncSubscriptionWithAPI, updateSubscriptionTier, useFeatureFlag, useFeatureVisibility, useFeatures, useGatewayHealth, useGatewayMemory, useGatewayModels, useGlobalTTS, useManagementAccess, useNotification, useNotificationService, useTTS, useVectorStore, useVoiceStore, useVoices, validateEnvironment, validateSystemIntegrity, vectorDatabaseService, vectorMigrationService };
+export { AUTH_TOKEN_CHANGED_EVENT, type AuthSessionConfig, type AuthSessionHandlers, Chat, type CreateMemoryOptions, DebugLogger, FeatureEvaluation, FeatureFlagConfig, FeatureFlagContext, type FeatureFlagContextValue, FeatureFlagProvider, type FeatureFlagProviderProps, FeatureFlagService, FeatureKey, FeedbackButton, type FeedbackButtonProps, type FeedbackCategories, FeedbackModal, type FeedbackModalProps, type FeedbackPriorities, type FeedbackRequest, type FeedbackResponse, type FileUploadResult, type GatewayQueryOptions, InterestsEditor, type JwtClaims, type LogContext, MANAGEMENT_SECTIONS, Management, type ManagementAccess, type ManagementAccessInput, type ManagementLink, type ManagementProps, type ManagementRequest, type ManagementSectionDef, type ManagementSectionId, type MemorySearchFilters, type MigrationProgress, type MigrationStatus, type NotificationConfig, type NotificationContextType, NotificationProvider, type NotificationProviderProps, NotificationService, SYSTEM_FLAGS, type SearchOptions, type SearchResult, StreamingTTSClient, SubscriptionExpiredGuard, type SubscriptionExpiredGuardProps, SubscriptionExpiredModal, type SubscriptionExpiredModalProps, SubscriptionTier, TOKEN_KEY, type TTSOptions, type TTSProgress, TTSState, type TokenPersistence, type TokenStorageMode, TrialUsage, type UploadRequest, type UseTTSReturn, VectorDatabaseService, type VectorDocument, type VectorMemory, type VectorMemoryMetadata, VectorMigrationService, type VectorStoreStatus, type VoiceState, authenticationService, debugLogger, defineCustomElement, featureFlagService, getCriticalConfig, getFeatureMatrix, getStreamingTTSClient, getSystemConstants, getTTSState, handleHttpError, handleSubscriptionUpgrade, handleValidationError, initializeCoreSystem, isWorkspaceAdminRole, notificationService, pauseTTS, previewTierUpgrade, resolveManagementSections, resumeTTS, showInfoNotification, showSuccessNotification, speakStream as speakWithStreaming, stopTTS, syncSubscriptionWithAPI, updateSubscriptionTier, useFeatureFlag, useFeatureVisibility, useFeatures, useGatewayHealth, useGatewayMemory, useGatewayModels, useGlobalTTS, useManagementAccess, useNotification, useNotificationService, useTTS, useVectorStore, useVoiceStore, useVoices, validateEnvironment, validateSystemIntegrity, vectorDatabaseService, vectorMigrationService };

package/dist/index.d.ts

@@ -117,7 +117,8 @@ declare function defineCustomElement<Props extends Record<string, unknown>>(name
  * Centralized logging service that provides environment-aware debug logging.
  *
  * Features:
- * - Production builds: Only errors and info logs are shown
+ * - Production builds: Only warnings and errors are shown; set
+ *   localStorage `bandit:debug` to "1" to see info logs too
  * - Development mode: All logs are shown with clear debug prefixes
  * - Consistent formatting for debugging purposes
  * - Clear indication that logs are for debugging
@@ -147,9 +148,10 @@ declare class DebugLogger {
      * DISABLED to prevent console flooding during chat processing
      */
     debug(message: string, context?: LogContext): void;
+    private verboseEnabled;
     /**
-     * Info logs - shown in both development and production
-     * Used for important user-facing information
+     * Info logs - shown in development, or in production when localStorage
+     * `bandit:debug` is "1"
      */
     info(message: string, context?: LogContext): void;
     /**
@@ -246,14 +248,105 @@ interface JwtClaims {
      * Present when user belongs to a team.
      */
     teamId?: string;
+    /**
+     * Identifiers of the teams this user OWNS (Team.createdBy == email).
+     * Present only when the user owns at least one team.
+     */
+    ownedTeamIds?: string[];
+    /**
+     * Host domains this token can reach — tenant workspaces appear here as
+     * "{slug}.banditai.ai". The tenant app gates access on this claim.
+     */
+    domains?: string[];
+    /**
+     * Current subscription tier inferred from the JWT.
+     */
+    subscriptionType?: string;
+    /**
+     * Indicates whether the subscription is active.
+     */
+    isSubscribed?: boolean;
+    /**
+     * Optional avatar reference (an S3 app-asset id) for the user's profile
+     * picture. Resolved to an image via the file-storage download endpoint.
+     */
+    avatarUrl?: string;
+}
+declare const TOKEN_KEY = "authToken";
+declare const AUTH_TOKEN_CHANGED_EVENT = "bandit:auth-token-changed";
+/**
+ * Where the live access token is kept.
+ *
+ * - `localStorage` — the historical contract: the JWT is persisted under
+ *   `authToken` and readable by any script on the page. Default, so npm
+ *   consumers that wire `tokenFactory: () => localStorage.getItem("authToken")`
+ *   keep working unchanged.
+ * - `memory` — the JWT lives only in the auth store for the life of the page.
+ *   The host app is responsible for restoring it at boot (an HttpOnly refresh
+ *   cookie, secure native storage, ...) through a `TokenPersistence` and a
+ *   `refresh` handler. Nothing token-shaped is written to Web Storage.
+ */
+type TokenStorageMode = "localStorage" | "memory";
+/**
+ * Optional write-through mirror of the live token. Used by the native shell
+ * to keep the session in the OS keychain / Android Keystore instead of the
+ * WebView's localStorage. Failures are the host's to handle; the in-memory
+ * session is already valid when these run.
+ */
+interface TokenPersistence {
+    write(token: string): void | Promise<void>;
+    clear(): void | Promise<void>;
+}
+interface AuthSessionHandlers {
+    /**
+     * Obtain a fresh access token silently (refresh cookie, device token, ...).
+     * Resolve `true` after calling `setToken` with the new token, `false` when
+     * an interactive sign-in is needed. Deduplicated by the service.
+     */
+    refresh?: () => Promise<boolean>;
+    /**
+     * Runs synchronously inside `clearToken()`, before the token is dropped,
+     * with the token being dropped — the moment to revoke it server-side.
+     */
+    beforeClear?: (token: string | null) => void;
+}
+interface AuthSessionConfig {
+    storage: TokenStorageMode;
+    persistence?: TokenPersistence | null;
+    handlers?: AuthSessionHandlers;
 }
 declare class AuthenticationService {
+    private storageMode;
+    private persistence;
+    private handlers;
+    /** Bumped on every setToken/clearToken; async flows compare it to detect a superseded session. */
+    private revision;
+    private refreshInFlight;
+    private lastPersist;
+    /**
+     * Pick the storage contract for this host. Call once at boot, before the
+     * first `setToken`. Switching modes never moves a token by itself: the
+     * host migrates (e.g. reads the legacy localStorage value, then clears it).
+     */
+    configureSession(config: AuthSessionConfig): void;
+    getStorageMode(): TokenStorageMode;
+    getSessionRevision(): number;
     getToken(): string | null;
     setToken(token: string): void;
     clearToken(): void;
+    /** True when the host registered a silent refresh path. */
+    canRefresh(): boolean;
+    /**
+     * Ask the host for a fresh token. Concurrent callers share one attempt.
+     * Resolves false when no refresh path exists or it did not produce a token.
+     */
+    tryRefresh(): Promise<boolean>;
+    /** Resolves once the most recent persistence write/clear has settled. */
+    whenPersisted(): Promise<void>;
     isAuthenticated(): boolean;
     isTokenExpired(token: string): boolean;
     parseJwtClaims(token: string): JwtClaims | null;
+    private mirror;
 }
 declare const authenticationService: AuthenticationService;
 
@@ -1438,4 +1531,4 @@ declare const useVectorStore: () => {
     initializeVectorService: () => Promise<void>;
 };
 
-export { Chat, type CreateMemoryOptions, DebugLogger, FeatureEvaluation, FeatureFlagConfig, FeatureFlagContext, type FeatureFlagContextValue, FeatureFlagProvider, type FeatureFlagProviderProps, FeatureFlagService, FeatureKey, FeedbackButton, type FeedbackButtonProps, type FeedbackCategories, FeedbackModal, type FeedbackModalProps, type FeedbackPriorities, type FeedbackRequest, type FeedbackResponse, type FileUploadResult, type GatewayQueryOptions, InterestsEditor, type LogContext, MANAGEMENT_SECTIONS, Management, type ManagementAccess, type ManagementAccessInput, type ManagementLink, type ManagementProps, type ManagementRequest, type ManagementSectionDef, type ManagementSectionId, type MemorySearchFilters, type MigrationProgress, type MigrationStatus, type NotificationConfig, type NotificationContextType, NotificationProvider, type NotificationProviderProps, NotificationService, SYSTEM_FLAGS, type SearchOptions, type SearchResult, StreamingTTSClient, SubscriptionExpiredGuard, type SubscriptionExpiredGuardProps, SubscriptionExpiredModal, type SubscriptionExpiredModalProps, SubscriptionTier, type TTSOptions, type TTSProgress, TTSState, TrialUsage, type UploadRequest, type UseTTSReturn, VectorDatabaseService, type VectorDocument, type VectorMemory, type VectorMemoryMetadata, VectorMigrationService, type VectorStoreStatus, type VoiceState, authenticationService, debugLogger, defineCustomElement, featureFlagService, getCriticalConfig, getFeatureMatrix, getStreamingTTSClient, getSystemConstants, getTTSState, handleHttpError, handleSubscriptionUpgrade, handleValidationError, initializeCoreSystem, isWorkspaceAdminRole, notificationService, pauseTTS, previewTierUpgrade, resolveManagementSections, resumeTTS, showInfoNotification, showSuccessNotification, speakStream as speakWithStreaming, stopTTS, syncSubscriptionWithAPI, updateSubscriptionTier, useFeatureFlag, useFeatureVisibility, useFeatures, useGatewayHealth, useGatewayMemory, useGatewayModels, useGlobalTTS, useManagementAccess, useNotification, useNotificationService, useTTS, useVectorStore, useVoiceStore, useVoices, validateEnvironment, validateSystemIntegrity, vectorDatabaseService, vectorMigrationService };
+export { AUTH_TOKEN_CHANGED_EVENT, type AuthSessionConfig, type AuthSessionHandlers, Chat, type CreateMemoryOptions, DebugLogger, FeatureEvaluation, FeatureFlagConfig, FeatureFlagContext, type FeatureFlagContextValue, FeatureFlagProvider, type FeatureFlagProviderProps, FeatureFlagService, FeatureKey, FeedbackButton, type FeedbackButtonProps, type FeedbackCategories, FeedbackModal, type FeedbackModalProps, type FeedbackPriorities, type FeedbackRequest, type FeedbackResponse, type FileUploadResult, type GatewayQueryOptions, InterestsEditor, type JwtClaims, type LogContext, MANAGEMENT_SECTIONS, Management, type ManagementAccess, type ManagementAccessInput, type ManagementLink, type ManagementProps, type ManagementRequest, type ManagementSectionDef, type ManagementSectionId, type MemorySearchFilters, type MigrationProgress, type MigrationStatus, type NotificationConfig, type NotificationContextType, NotificationProvider, type NotificationProviderProps, NotificationService, SYSTEM_FLAGS, type SearchOptions, type SearchResult, StreamingTTSClient, SubscriptionExpiredGuard, type SubscriptionExpiredGuardProps, SubscriptionExpiredModal, type SubscriptionExpiredModalProps, SubscriptionTier, TOKEN_KEY, type TTSOptions, type TTSProgress, TTSState, type TokenPersistence, type TokenStorageMode, TrialUsage, type UploadRequest, type UseTTSReturn, VectorDatabaseService, type VectorDocument, type VectorMemory, type VectorMemoryMetadata, VectorMigrationService, type VectorStoreStatus, type VoiceState, authenticationService, debugLogger, defineCustomElement, featureFlagService, getCriticalConfig, getFeatureMatrix, getStreamingTTSClient, getSystemConstants, getTTSState, handleHttpError, handleSubscriptionUpgrade, handleValidationError, initializeCoreSystem, isWorkspaceAdminRole, notificationService, pauseTTS, previewTierUpgrade, resolveManagementSections, resumeTTS, showInfoNotification, showSuccessNotification, speakStream as speakWithStreaming, stopTTS, syncSubscriptionWithAPI, updateSubscriptionTier, useFeatureFlag, useFeatureVisibility, useFeatures, useGatewayHealth, useGatewayMemory, useGatewayModels, useGlobalTTS, useManagementAccess, useNotification, useNotificationService, useTTS, useVectorStore, useVoiceStore, useVoices, validateEnvironment, validateSystemIntegrity, vectorDatabaseService, vectorMigrationService };