@burtson-labs/bandit-engine 2.0.165 → 2.0.167

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { F as FeatureKey, a as FeatureEvaluation, S as SubscriptionTier, b as FeatureFlagConfig, T as TrialUsage } from './public-0EYmtpGD.js';
-export { A as AIChatRequest, c as AIChatResponse, d as AIGenerateRequest, e as AIGenerateResponse, f as AIMessage, g as AIModel, h as AIProviderConfig, C as ChatConfig, i as ChatModal, j as ChatModalProps, k as ChatProvider, D as DEFAULT_TIER_FEATURES, l as FeatureMatrix, O as OSS_DEFAULT_FEATURES, P as PackageSettings, V as VoiceModelsResponse, m as VoiceService, v as voiceService } from './public-0EYmtpGD.js';
+import { F as FeatureKey, a as FeatureEvaluation, S as SubscriptionTier, b as FeatureFlagConfig, T as TrialUsage } from './public-DJa4Db00.js';
+export { A as AIChatRequest, c as AIChatResponse, d as AIGenerateRequest, e as AIGenerateResponse, f as AIMessage, g as AIModel, h as AIProviderConfig, C as ChatConfig, i as ChatModal, j as ChatModalProps, k as ChatProvider, D as DEFAULT_TIER_FEATURES, l as FeatureMatrix, O as OSS_DEFAULT_FEATURES, P as PackageSettings, V as VoiceModelsResponse, m as VoiceService, v as voiceService } from './public-DJa4Db00.js';
 import * as react_jsx_runtime from 'react/jsx-runtime';
 import React, { ReactNode } from 'react';
 import { Theme } from '@mui/material/styles';
@@ -248,14 +248,105 @@ interface JwtClaims {
      * Present when user belongs to a team.
      */
     teamId?: string;
+    /**
+     * Identifiers of the teams this user OWNS (Team.createdBy == email).
+     * Present only when the user owns at least one team.
+     */
+    ownedTeamIds?: string[];
+    /**
+     * Host domains this token can reach — tenant workspaces appear here as
+     * "{slug}.banditai.ai". The tenant app gates access on this claim.
+     */
+    domains?: string[];
+    /**
+     * Current subscription tier inferred from the JWT.
+     */
+    subscriptionType?: string;
+    /**
+     * Indicates whether the subscription is active.
+     */
+    isSubscribed?: boolean;
+    /**
+     * Optional avatar reference (an S3 app-asset id) for the user's profile
+     * picture. Resolved to an image via the file-storage download endpoint.
+     */
+    avatarUrl?: string;
+}
+declare const TOKEN_KEY = "authToken";
+declare const AUTH_TOKEN_CHANGED_EVENT = "bandit:auth-token-changed";
+/**
+ * Where the live access token is kept.
+ *
+ * - `localStorage` — the historical contract: the JWT is persisted under
+ *   `authToken` and readable by any script on the page. Default, so npm
+ *   consumers that wire `tokenFactory: () => localStorage.getItem("authToken")`
+ *   keep working unchanged.
+ * - `memory` — the JWT lives only in the auth store for the life of the page.
+ *   The host app is responsible for restoring it at boot (an HttpOnly refresh
+ *   cookie, secure native storage, ...) through a `TokenPersistence` and a
+ *   `refresh` handler. Nothing token-shaped is written to Web Storage.
+ */
+type TokenStorageMode = "localStorage" | "memory";
+/**
+ * Optional write-through mirror of the live token. Used by the native shell
+ * to keep the session in the OS keychain / Android Keystore instead of the
+ * WebView's localStorage. Failures are the host's to handle; the in-memory
+ * session is already valid when these run.
+ */
+interface TokenPersistence {
+    write(token: string): void | Promise<void>;
+    clear(): void | Promise<void>;
+}
+interface AuthSessionHandlers {
+    /**
+     * Obtain a fresh access token silently (refresh cookie, device token, ...).
+     * Resolve `true` after calling `setToken` with the new token, `false` when
+     * an interactive sign-in is needed. Deduplicated by the service.
+     */
+    refresh?: () => Promise<boolean>;
+    /**
+     * Runs synchronously inside `clearToken()`, before the token is dropped,
+     * with the token being dropped — the moment to revoke it server-side.
+     */
+    beforeClear?: (token: string | null) => void;
+}
+interface AuthSessionConfig {
+    storage: TokenStorageMode;
+    persistence?: TokenPersistence | null;
+    handlers?: AuthSessionHandlers;
 }
 declare class AuthenticationService {
+    private storageMode;
+    private persistence;
+    private handlers;
+    /** Bumped on every setToken/clearToken; async flows compare it to detect a superseded session. */
+    private revision;
+    private refreshInFlight;
+    private lastPersist;
+    /**
+     * Pick the storage contract for this host. Call once at boot, before the
+     * first `setToken`. Switching modes never moves a token by itself: the
+     * host migrates (e.g. reads the legacy localStorage value, then clears it).
+     */
+    configureSession(config: AuthSessionConfig): void;
+    getStorageMode(): TokenStorageMode;
+    getSessionRevision(): number;
     getToken(): string | null;
     setToken(token: string): void;
     clearToken(): void;
+    /** True when the host registered a silent refresh path. */
+    canRefresh(): boolean;
+    /**
+     * Ask the host for a fresh token. Concurrent callers share one attempt.
+     * Resolves false when no refresh path exists or it did not produce a token.
+     */
+    tryRefresh(): Promise<boolean>;
+    /** Resolves once the most recent persistence write/clear has settled. */
+    whenPersisted(): Promise<void>;
     isAuthenticated(): boolean;
     isTokenExpired(token: string): boolean;
     parseJwtClaims(token: string): JwtClaims | null;
+    private mirror;
 }
 declare const authenticationService: AuthenticationService;
 
@@ -1440,4 +1531,4 @@ declare const useVectorStore: () => {
     initializeVectorService: () => Promise<void>;
 };
 
-export { Chat, type CreateMemoryOptions, DebugLogger, FeatureEvaluation, FeatureFlagConfig, FeatureFlagContext, type FeatureFlagContextValue, FeatureFlagProvider, type FeatureFlagProviderProps, FeatureFlagService, FeatureKey, FeedbackButton, type FeedbackButtonProps, type FeedbackCategories, FeedbackModal, type FeedbackModalProps, type FeedbackPriorities, type FeedbackRequest, type FeedbackResponse, type FileUploadResult, type GatewayQueryOptions, InterestsEditor, type LogContext, MANAGEMENT_SECTIONS, Management, type ManagementAccess, type ManagementAccessInput, type ManagementLink, type ManagementProps, type ManagementRequest, type ManagementSectionDef, type ManagementSectionId, type MemorySearchFilters, type MigrationProgress, type MigrationStatus, type NotificationConfig, type NotificationContextType, NotificationProvider, type NotificationProviderProps, NotificationService, SYSTEM_FLAGS, type SearchOptions, type SearchResult, StreamingTTSClient, SubscriptionExpiredGuard, type SubscriptionExpiredGuardProps, SubscriptionExpiredModal, type SubscriptionExpiredModalProps, SubscriptionTier, type TTSOptions, type TTSProgress, TTSState, TrialUsage, type UploadRequest, type UseTTSReturn, VectorDatabaseService, type VectorDocument, type VectorMemory, type VectorMemoryMetadata, VectorMigrationService, type VectorStoreStatus, type VoiceState, authenticationService, debugLogger, defineCustomElement, featureFlagService, getCriticalConfig, getFeatureMatrix, getStreamingTTSClient, getSystemConstants, getTTSState, handleHttpError, handleSubscriptionUpgrade, handleValidationError, initializeCoreSystem, isWorkspaceAdminRole, notificationService, pauseTTS, previewTierUpgrade, resolveManagementSections, resumeTTS, showInfoNotification, showSuccessNotification, speakStream as speakWithStreaming, stopTTS, syncSubscriptionWithAPI, updateSubscriptionTier, useFeatureFlag, useFeatureVisibility, useFeatures, useGatewayHealth, useGatewayMemory, useGatewayModels, useGlobalTTS, useManagementAccess, useNotification, useNotificationService, useTTS, useVectorStore, useVoiceStore, useVoices, validateEnvironment, validateSystemIntegrity, vectorDatabaseService, vectorMigrationService };
+export { AUTH_TOKEN_CHANGED_EVENT, type AuthSessionConfig, type AuthSessionHandlers, Chat, type CreateMemoryOptions, DebugLogger, FeatureEvaluation, FeatureFlagConfig, FeatureFlagContext, type FeatureFlagContextValue, FeatureFlagProvider, type FeatureFlagProviderProps, FeatureFlagService, FeatureKey, FeedbackButton, type FeedbackButtonProps, type FeedbackCategories, FeedbackModal, type FeedbackModalProps, type FeedbackPriorities, type FeedbackRequest, type FeedbackResponse, type FileUploadResult, type GatewayQueryOptions, InterestsEditor, type JwtClaims, type LogContext, MANAGEMENT_SECTIONS, Management, type ManagementAccess, type ManagementAccessInput, type ManagementLink, type ManagementProps, type ManagementRequest, type ManagementSectionDef, type ManagementSectionId, type MemorySearchFilters, type MigrationProgress, type MigrationStatus, type NotificationConfig, type NotificationContextType, NotificationProvider, type NotificationProviderProps, NotificationService, SYSTEM_FLAGS, type SearchOptions, type SearchResult, StreamingTTSClient, SubscriptionExpiredGuard, type SubscriptionExpiredGuardProps, SubscriptionExpiredModal, type SubscriptionExpiredModalProps, SubscriptionTier, TOKEN_KEY, type TTSOptions, type TTSProgress, TTSState, type TokenPersistence, type TokenStorageMode, TrialUsage, type UploadRequest, type UseTTSReturn, VectorDatabaseService, type VectorDocument, type VectorMemory, type VectorMemoryMetadata, VectorMigrationService, type VectorStoreStatus, type VoiceState, authenticationService, debugLogger, defineCustomElement, featureFlagService, getCriticalConfig, getFeatureMatrix, getStreamingTTSClient, getSystemConstants, getTTSState, handleHttpError, handleSubscriptionUpgrade, handleValidationError, initializeCoreSystem, isWorkspaceAdminRole, notificationService, pauseTTS, previewTierUpgrade, resolveManagementSections, resumeTTS, showInfoNotification, showSuccessNotification, speakStream as speakWithStreaming, stopTTS, syncSubscriptionWithAPI, updateSubscriptionTier, useFeatureFlag, useFeatureVisibility, useFeatures, useGatewayHealth, useGatewayMemory, useGatewayModels, useGlobalTTS, useManagementAccess, useNotification, useNotificationService, useTTS, useVectorStore, useVoiceStore, useVoices, validateEnvironment, validateSystemIntegrity, vectorDatabaseService, vectorMigrationService };

package/dist/index.js

@@ -46,31 +46,42 @@ var init_packageSettingsStore = __esm({
 });
 
 // src/store/authenticationStore.ts
-var import_zustand2, TOKEN_KEY, validToken, user, rawToken, useAuthenticationStore, readPersistedToken;
+var import_zustand2, TOKEN_KEY, decodeClaims, validOrNull, readLegacyStorage, validToken, user, rawToken, useAuthenticationStore, readPersistedToken;
 var init_authenticationStore = __esm({
   "src/store/authenticationStore.ts"() {
     "use strict";
     import_zustand2 = require("zustand");
     TOKEN_KEY = "authToken";
-    validToken = null;
-    user = null;
-    rawToken = localStorage.getItem(TOKEN_KEY);
-    if (rawToken) {
+    decodeClaims = (token) => {
       try {
-        const base64Url = rawToken.split(".")[1];
+        const base64Url = token.split(".")[1];
         const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
         const jsonPayload = decodeURIComponent(
           atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
         );
-        const decoded = JSON.parse(jsonPayload);
-        if (decoded.exp * 1e3 > Date.now()) {
-          validToken = rawToken;
-          user = decoded;
-        }
+        return JSON.parse(jsonPayload);
+      } catch {
+        return null;
+      }
+    };
+    validOrNull = (raw) => {
+      if (!raw) return null;
+      const decoded = decodeClaims(raw);
+      return decoded && decoded.exp * 1e3 > Date.now() ? raw : null;
+    };
+    readLegacyStorage = () => {
+      try {
+        return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY);
       } catch {
-        validToken = null;
-        user = null;
+        return null;
       }
+    };
+    validToken = null;
+    user = null;
+    rawToken = readLegacyStorage();
+    if (rawToken) {
+      validToken = validOrNull(rawToken);
+      user = validToken ? decodeClaims(validToken) : null;
     }
     useAuthenticationStore = (0, import_zustand2.create)((set) => ({
       token: validToken,
@@ -78,16 +89,10 @@ var init_authenticationStore = __esm({
       authError: null,
       setToken: (token) => {
         if (token) {
-          try {
-            const base64Url = token.split(".")[1];
-            const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-            const jsonPayload = decodeURIComponent(
-              atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-            );
-            const user2 = JSON.parse(jsonPayload);
-            localStorage.setItem(TOKEN_KEY, token);
-            set({ token, authError: null, user: user2 });
-          } catch {
+          const decoded = decodeClaims(token);
+          if (decoded) {
+            set({ token, authError: null, user: decoded });
+          } else {
             set({ token: null, authError: "Invalid token", user: null });
           }
         } else {
@@ -95,23 +100,11 @@ var init_authenticationStore = __esm({
         }
       },
       clearToken: () => {
-        localStorage.removeItem(TOKEN_KEY);
         set({ token: null, authError: null, user: null });
       }
     }));
     readPersistedToken = () => {
-      try {
-        const raw = localStorage.getItem(TOKEN_KEY);
-        if (!raw) return null;
-        const base64 = raw.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
-        const json2 = decodeURIComponent(
-          atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-        );
-        const decoded = JSON.parse(json2);
-        return decoded.exp * 1e3 > Date.now() ? raw : null;
-      } catch {
-        return null;
-      }
+      return validOrNull(readLegacyStorage()) ?? validOrNull(useAuthenticationStore.getState().token);
     };
   }
 });
@@ -241,7 +234,7 @@ function emitAuthTokenChanged(token) {
     detail: { token }
   }));
 }
-var TOKEN_KEY2, AUTH_TOKEN_CHANGED_EVENT, AuthenticationService, authenticationService;
+var TOKEN_KEY2, AUTH_TOKEN_CHANGED_EVENT, readLocalStorage, writeLocalStorage, AuthenticationService, authenticationService;
 var init_authenticationService = __esm({
   "src/services/auth/authenticationService.ts"() {
     "use strict";
@@ -249,21 +242,103 @@ var init_authenticationService = __esm({
     init_debugLogger();
     TOKEN_KEY2 = "authToken";
     AUTH_TOKEN_CHANGED_EVENT = "bandit:auth-token-changed";
+    readLocalStorage = () => {
+      try {
+        return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY2);
+      } catch {
+        return null;
+      }
+    };
+    writeLocalStorage = (token) => {
+      try {
+        if (typeof localStorage === "undefined") return;
+        if (token) localStorage.setItem(TOKEN_KEY2, token);
+        else localStorage.removeItem(TOKEN_KEY2);
+      } catch {
+      }
+    };
     AuthenticationService = class {
+      storageMode = "localStorage";
+      persistence = null;
+      handlers = {};
+      /** Bumped on every setToken/clearToken; async flows compare it to detect a superseded session. */
+      revision = 0;
+      refreshInFlight = null;
+      lastPersist = Promise.resolve();
+      /**
+       * Pick the storage contract for this host. Call once at boot, before the
+       * first `setToken`. Switching modes never moves a token by itself: the
+       * host migrates (e.g. reads the legacy localStorage value, then clears it).
+       */
+      configureSession(config) {
+        this.storageMode = config.storage;
+        this.persistence = config.persistence ?? null;
+        this.handlers = config.handlers ?? {};
+      }
+      getStorageMode() {
+        return this.storageMode;
+      }
+      getSessionRevision() {
+        return this.revision;
+      }
       getToken() {
-        const token = localStorage.getItem(TOKEN_KEY2);
-        return token;
+        if (this.storageMode === "memory") {
+          return useAuthenticationStore.getState().token;
+        }
+        return readLocalStorage();
       }
       setToken(token) {
-        localStorage.setItem(TOKEN_KEY2, token);
+        this.revision += 1;
+        if (this.storageMode === "localStorage") {
+          writeLocalStorage(token);
+        } else {
+          writeLocalStorage(null);
+        }
         useAuthenticationStore.getState().setToken(token);
+        this.mirror(() => this.persistence?.write(token));
         emitAuthTokenChanged(token);
       }
       clearToken() {
-        localStorage.removeItem(TOKEN_KEY2);
+        this.revision += 1;
+        const current = this.getToken() ?? useAuthenticationStore.getState().token;
+        try {
+          this.handlers.beforeClear?.(current);
+        } catch (error) {
+          debugLogger.warn("Auth beforeClear handler failed", { error });
+        }
+        writeLocalStorage(null);
         useAuthenticationStore.getState().clearToken();
+        this.mirror(() => this.persistence?.clear());
         emitAuthTokenChanged(null);
       }
+      /** True when the host registered a silent refresh path. */
+      canRefresh() {
+        return typeof this.handlers.refresh === "function";
+      }
+      /**
+       * Ask the host for a fresh token. Concurrent callers share one attempt.
+       * Resolves false when no refresh path exists or it did not produce a token.
+       */
+      tryRefresh() {
+        const refresh = this.handlers.refresh;
+        if (!refresh) return Promise.resolve(false);
+        if (this.refreshInFlight) return this.refreshInFlight;
+        this.refreshInFlight = (async () => {
+          try {
+            return await refresh();
+          } catch (error) {
+            debugLogger.warn("Auth refresh handler failed", { error });
+            return false;
+          } finally {
+            this.refreshInFlight = null;
+          }
+        })();
+        return this.refreshInFlight;
+      }
+      /** Resolves once the most recent persistence write/clear has settled. */
+      whenPersisted() {
+        return this.lastPersist;
+      }
       isAuthenticated() {
         const token = useAuthenticationStore.getState().token;
         return !!token && !this.isTokenExpired(token);
@@ -293,6 +368,16 @@ var init_authenticationService = __esm({
           return null;
         }
       }
+      mirror(run) {
+        const attempt = (async () => {
+          try {
+            await run();
+          } catch (error) {
+            debugLogger.warn("Auth token persistence failed", { error });
+          }
+        })();
+        this.lastPersist = attempt;
+      }
     };
     authenticationService = new AuthenticationService();
   }
@@ -4881,13 +4966,35 @@ var init_gateway_service = __esm({
         });
         instance.interceptors.response.use(
           (response) => response,
-          (error) => {
+          async (error) => {
+            const retried = await this._retryAfterRefresh(instance, error);
+            if (retried) return retried;
             this._handleAuthFailure(error);
             return Promise.reject(this._normalizeAxiosError(error));
           }
         );
         return instance;
       }
+      /**
+       * A bare 401 on a host with a silent refresh path (HttpOnly refresh cookie,
+       * native device token) usually means the access token aged out mid-session.
+       * Refresh once and replay the request with the new token instead of
+       * signing the user out; a failed refresh falls through to the sign-out path.
+       */
+      async _retryAfterRefresh(instance, error) {
+        const config = error.config;
+        if (!config || config._banditAuthRetried || error.response?.status !== 401) return null;
+        if (!authenticationService.canRefresh()) return null;
+        const data = error.response?.data;
+        if (data?.code && data.code !== "TOKEN_EXPIRED") return null;
+        try {
+          if (!await authenticationService.tryRefresh()) return null;
+        } catch {
+          return null;
+        }
+        config._banditAuthRetried = true;
+        return instance.request(config);
+      }
       _normalizeAxiosError(error) {
         if (error.response) {
           return this._createHttpError(
@@ -9607,14 +9714,28 @@ function isJWTExpired(payload) {
   if (!payload.exp) return false;
   return Date.now() >= payload.exp * 1e3;
 }
-var import_react, import_jsx_runtime, FeatureFlagContext, coerceNumber, coerceBoolean, FeatureFlagProvider, useFeatureFlag;
+var import_react, import_jsx_runtime, readSessionToken, FeatureFlagContext, coerceNumber, coerceBoolean, FeatureFlagProvider, useFeatureFlag;
 var init_FeatureFlagContext = __esm({
   "src/contexts/FeatureFlagContext.tsx"() {
     "use strict";
     import_react = require("react");
     init_featureFlags();
     init_debugLogger();
+    init_authenticationService();
     import_jsx_runtime = require("react/jsx-runtime");
+    readSessionToken = (jwtStorageKey) => {
+      const fromStorage = () => {
+        try {
+          return localStorage.getItem(jwtStorageKey);
+        } catch {
+          return null;
+        }
+      };
+      if (jwtStorageKey && jwtStorageKey !== TOKEN_KEY2) {
+        return fromStorage() ?? authenticationService.getToken();
+      }
+      return authenticationService.getToken() ?? fromStorage();
+    };
     FeatureFlagContext = (0, import_react.createContext)(void 0);
     coerceNumber = (value, fallback) => {
       if (typeof value === "number" && Number.isFinite(value)) {
@@ -9664,7 +9785,7 @@ var init_FeatureFlagContext = __esm({
         let effectiveTier = currentTier || subscriptionType || "oss";
         if (typeof window !== "undefined") {
           try {
-            const token = localStorage.getItem(jwtStorageKey);
+            const token = readSessionToken(jwtStorageKey);
             if (token) {
               jwtFound = true;
               const payload = decodeJWT(token);
@@ -9750,10 +9871,13 @@ var init_FeatureFlagContext = __esm({
             setCurrentTier(e.detail.tier);
           }
         };
+        const handleSessionChange = () => refreshEvaluation();
         window.addEventListener("storage", handleStorageChange);
+        window.addEventListener(AUTH_TOKEN_CHANGED_EVENT, handleSessionChange);
         window.addEventListener("bandit:tier-updated", handleTierUpdate);
         return () => {
           window.removeEventListener("storage", handleStorageChange);
+          window.removeEventListener(AUTH_TOKEN_CHANGED_EVENT, handleSessionChange);
           window.removeEventListener("bandit:tier-updated", handleTierUpdate);
         };
       }, [refreshEvaluation, config.jwtStorageKey]);
@@ -27488,6 +27612,7 @@ var init_chat_app_bar = __esm({
       const { conversations, currentId, createNewConversation, toggleIncognito, _hasHydrated } = useConversationStore();
       const { preferences } = usePreferencesStore();
       const { settings: packageSettings } = usePackageSettingsStore();
+      const HostNav = packageSettings?.components?.ProductNav;
       const isPlaygroundRoute = typeof window !== "undefined" && window.location.pathname.includes("/playground");
       const isPlaygroundMode3 = Boolean(packageSettings?.playgroundMode) || (packageSettings?.gatewayApiUrl ?? "").toLowerCase().startsWith("playground://") || typeof window !== "undefined" && window.location.pathname.startsWith("/playground");
       const { syncEnabled, setSyncEnabled } = useConversationSyncStore((state) => ({
@@ -27626,6 +27751,7 @@ var init_chat_app_bar = __esm({
                     ]
                   }
                 ),
+                HostNav && /* @__PURE__ */ (0, import_jsx_runtime31.jsx)(import_material30.Box, { sx: { minWidth: 0, mx: 1, display: "flex", justifyContent: "center" }, children: /* @__PURE__ */ (0, import_jsx_runtime31.jsx)(HostNav, { compact: true }) }),
                 /* @__PURE__ */ (0, import_jsx_runtime31.jsxs)(import_material30.Box, { sx: { display: "flex", alignItems: "center", gap: 1 }, children: [
                   canShowNewConversationButton && !isIncognitoActive && /* @__PURE__ */ (0, import_jsx_runtime31.jsx)(
                     import_material30.IconButton,
@@ -27744,6 +27870,7 @@ var init_chat_app_bar = __esm({
                   ]
                 }
               ),
+              !isMobile && HostNav && /* @__PURE__ */ (0, import_jsx_runtime31.jsx)(import_material30.Box, { sx: { minWidth: 0, mx: 2, display: "flex", justifyContent: "center" }, children: /* @__PURE__ */ (0, import_jsx_runtime31.jsx)(HostNav, {}) }),
               !isMobile && /* @__PURE__ */ (0, import_jsx_runtime31.jsxs)(
                 import_material30.Box,
                 {
@@ -31116,6 +31243,7 @@ var init_chat2 = __esm({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AUTH_TOKEN_CHANGED_EVENT: () => AUTH_TOKEN_CHANGED_EVENT,
   Chat: () => chat_default,
   ChatModal: () => chat_modal_default,
   ChatProvider: () => chat_provider_default,
@@ -31136,6 +31264,7 @@ __export(index_exports, {
   StreamingTTSClient: () => StreamingTTSClient,
   SubscriptionExpiredGuard: () => SubscriptionExpiredGuard,
   SubscriptionExpiredModal: () => SubscriptionExpiredModal,
+  TOKEN_KEY: () => TOKEN_KEY2,
   TTSState: () => TTSState,
   VectorDatabaseService: () => VectorDatabaseService,
   VectorMigrationService: () => VectorMigrationService,
@@ -31210,6 +31339,11 @@ init_common_types();
 init_authenticationService();
 init_debugLogger();
 init_indexedDBService();
+var sessionTokenFactory = (label) => () => {
+  const token = authenticationService.getToken();
+  debugLogger.info(`AIProviderInit: ${label}`, { hasToken: !!token });
+  return token;
+};
 var AIProviderInitService = class _AIProviderInitService {
   static instance;
   constructor() {
@@ -31289,25 +31423,7 @@ var AIProviderInitService = class _AIProviderInitService {
       providerConfig = {
         type: "ollama" /* OLLAMA */,
         baseUrl: settings.ollamaUrl,
-        tokenFactory: () => {
-          let token = authenticationService.getToken();
-          if (!token) {
-            token = localStorage.getItem("authToken");
-          }
-          if (!token) {
-            try {
-              const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-              const authStore = useAuthenticationStore2.getState();
-              token = authStore.token;
-            } catch (e) {
-            }
-          }
-          debugLogger.info("AIProviderInit: Token factory called", {
-            hasToken: !!token,
-            localStorage: !!localStorage.getItem("authToken")
-          });
-          return token;
-        }
+        tokenFactory: sessionTokenFactory("Token factory called")
       };
       debugLogger.info("Using legacy Ollama config", providerConfig);
     }
@@ -31330,25 +31446,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const fallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: settings.ollamaUrl || "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore2.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(fallbackConfig);
@@ -31361,25 +31459,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const localFallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore2.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Local fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Local fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(localFallbackConfig);
@@ -31451,27 +31531,7 @@ var AIProviderInitService = class _AIProviderInitService {
         });
         return config;
       }
-      config.tokenFactory = () => {
-        let token = authenticationService.getToken();
-        if (!token && typeof localStorage !== "undefined") {
-          try {
-            token = localStorage.getItem("authToken");
-          } catch {
-          }
-        }
-        if (!token) {
-          try {
-            const { useAuthenticationStore: useAuthenticationStore2 } = require("../../store/authenticationStore");
-            const authStore = useAuthenticationStore2.getState();
-            token = authStore.token;
-          } catch {
-          }
-        }
-        debugLogger.info("AIProviderInit: Token factory resolved auth token", {
-          hasToken: !!token
-        });
-        return token;
-      };
+      config.tokenFactory = sessionTokenFactory("Token factory resolved auth token");
     }
     return config;
   }
@@ -45225,7 +45285,7 @@ var SubscriptionExpiredModal = ({
             "Account: ",
             /* @__PURE__ */ (0, import_jsx_runtime64.jsx)("strong", { children: userEmail })
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(import_material62.Typography, { variant: "body1", sx: { textAlign: "center", color: "text.secondary" }, children: IS_STORE_BUILD ? "Premium features are unavailable on this account right now." : "To continue using all features, please renew your subscription or return to the main application." }),
+          /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(import_material62.Typography, { variant: "body1", sx: { textAlign: "center", color: "text.secondary" }, children: IS_STORE_BUILD ? "Premium features are unavailable on this account right now. You can subscribe to Pro in the app or review your account." : "To continue using all features, please renew your subscription or return to the main application." }),
           /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(import_material62.Box, { sx: {
             bgcolor: "background.paper",
             border: 1,
@@ -45247,10 +45307,10 @@ var SubscriptionExpiredModal = ({
               startIcon: /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(import_react89.Home, {}),
               size: "large",
               sx: { minWidth: 140 },
-              children: "Go Home"
+              children: IS_STORE_BUILD ? "My Account" : "Go Home"
             }
           ),
-          !IS_STORE_BUILD && /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(
+          (!IS_STORE_BUILD || onManageSubscription) && /* @__PURE__ */ (0, import_jsx_runtime64.jsx)(
             import_material62.Button,
             {
               onClick: handleManageSubscription,
@@ -45259,7 +45319,7 @@ var SubscriptionExpiredModal = ({
               size: "large",
               color: "primary",
               sx: { minWidth: 140 },
-              children: "Renew Subscription"
+              children: IS_STORE_BUILD ? "View Pro Options" : "Renew Subscription"
             }
           )
         ] })
@@ -45271,6 +45331,7 @@ var SubscriptionExpiredModal = ({
 // src/guards/SubscriptionExpiredGuard.tsx
 var import_react90 = require("react");
 init_useFeatures();
+init_authenticationService();
 var import_jsx_runtime65 = require("react/jsx-runtime");
 var SubscriptionExpiredGuard = ({
   children,
@@ -45298,11 +45359,9 @@ var SubscriptionExpiredGuard = ({
   const evaluation = getFullEvaluation();
   const extractedEmail = userEmail || evaluation?.metadata?.jwtFound ? (() => {
     try {
-      const token = localStorage.getItem("authToken");
+      const token = authenticationService.getToken();
       if (token) {
-        const parts = token.split(".");
-        const payload = JSON.parse(atob(parts[1]));
-        return payload.email;
+        return authenticationService.parseJwtClaims(token)?.email;
       }
     } catch (e) {
     }
@@ -45484,6 +45543,7 @@ init_vectorMigrationService();
 init_useVectorStore();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AUTH_TOKEN_CHANGED_EVENT,
   Chat,
   ChatModal,
   ChatProvider,
@@ -45504,6 +45564,7 @@ init_useVectorStore();
   StreamingTTSClient,
   SubscriptionExpiredGuard,
   SubscriptionExpiredModal,
+  TOKEN_KEY,
   TTSState,
   VectorDatabaseService,
   VectorMigrationService,