@burtson-labs/bandit-engine 2.0.165 → 2.0.167

package/dist/{chunk-ASWUEAWM.mjs → chunk-5BZWJQ5O.mjs}

@@ -6,7 +6,7 @@ import {
   markdownSanitizeSchema,
   maybeHandleFileLinkClick,
   renderLowlightChildren
-} from "./chunk-RLW4RBIR.mjs";
+} from "./chunk-KDIL5WUL.mjs";
 
 // src/components/StreamingMarkdown.tsx
 import React, { useEffect, useMemo, useRef, useState } from "react";
@@ -513,4 +513,4 @@ export {
   isNativeShell,
   isStandalonePwa
 };
-//# sourceMappingURL=chunk-ASWUEAWM.mjs.map
+//# sourceMappingURL=chunk-5BZWJQ5O.mjs.map

package/dist/{chunk-LKGBO5OP.mjs → chunk-CABOLDNR.mjs}

@@ -1,19 +1,21 @@
 import {
   indexedDBService_default,
   usePackageSettingsStore
-} from "./chunk-2EM4ATKI.mjs";
+} from "./chunk-SZJB5FLZ.mjs";
 import {
   authenticationService,
   useAIProviderStore
-} from "./chunk-J6LSSK3G.mjs";
+} from "./chunk-GRPTCHFN.mjs";
 import {
   debugLogger
 } from "./chunk-HNXPDIWC.mjs";
-import {
-  __require
-} from "./chunk-BJTO5JO5.mjs";
 
 // src/services/ai-provider-init.service.ts
+var sessionTokenFactory = (label) => () => {
+  const token = authenticationService.getToken();
+  debugLogger.info(`AIProviderInit: ${label}`, { hasToken: !!token });
+  return token;
+};
 var AIProviderInitService = class _AIProviderInitService {
   static instance;
   constructor() {
@@ -93,25 +95,7 @@ var AIProviderInitService = class _AIProviderInitService {
       providerConfig = {
         type: "ollama" /* OLLAMA */,
         baseUrl: settings.ollamaUrl,
-        tokenFactory: () => {
-          let token = authenticationService.getToken();
-          if (!token) {
-            token = localStorage.getItem("authToken");
-          }
-          if (!token) {
-            try {
-              const { useAuthenticationStore } = __require("../../store/authenticationStore");
-              const authStore = useAuthenticationStore.getState();
-              token = authStore.token;
-            } catch (e) {
-            }
-          }
-          debugLogger.info("AIProviderInit: Token factory called", {
-            hasToken: !!token,
-            localStorage: !!localStorage.getItem("authToken")
-          });
-          return token;
-        }
+        tokenFactory: sessionTokenFactory("Token factory called")
       };
       debugLogger.info("Using legacy Ollama config", providerConfig);
     }
@@ -134,25 +118,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const fallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: settings.ollamaUrl || "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore } = __require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(fallbackConfig);
@@ -165,25 +131,7 @@ var AIProviderInitService = class _AIProviderInitService {
           const localFallbackConfig = {
             type: "ollama" /* OLLAMA */,
             baseUrl: "http://localhost:11434",
-            tokenFactory: () => {
-              let token = authenticationService.getToken();
-              if (!token) {
-                token = localStorage.getItem("authToken");
-              }
-              if (!token) {
-                try {
-                  const { useAuthenticationStore } = __require("../../store/authenticationStore");
-                  const authStore = useAuthenticationStore.getState();
-                  token = authStore.token;
-                } catch (e) {
-                }
-              }
-              debugLogger.info("AIProviderInit: Local fallback tokenFactory", {
-                hasToken: !!token,
-                localStorage: !!localStorage.getItem("authToken")
-              });
-              return token;
-            }
+            tokenFactory: sessionTokenFactory("Local fallback tokenFactory")
           };
           const { createProvider } = useAIProviderStore.getState();
           createProvider(localFallbackConfig);
@@ -255,27 +203,7 @@ var AIProviderInitService = class _AIProviderInitService {
         });
         return config;
       }
-      config.tokenFactory = () => {
-        let token = authenticationService.getToken();
-        if (!token && typeof localStorage !== "undefined") {
-          try {
-            token = localStorage.getItem("authToken");
-          } catch {
-          }
-        }
-        if (!token) {
-          try {
-            const { useAuthenticationStore } = __require("../../store/authenticationStore");
-            const authStore = useAuthenticationStore.getState();
-            token = authStore.token;
-          } catch {
-          }
-        }
-        debugLogger.info("AIProviderInit: Token factory resolved auth token", {
-          hasToken: !!token
-        });
-        return token;
-      };
+      config.tokenFactory = sessionTokenFactory("Token factory resolved auth token");
     }
     return config;
   }
@@ -285,4 +213,4 @@ var aiProviderInitService = AIProviderInitService.getInstance();
 export {
   aiProviderInitService
 };
-//# sourceMappingURL=chunk-LKGBO5OP.mjs.map
+//# sourceMappingURL=chunk-CABOLDNR.mjs.map

package/dist/chunk-CABOLDNR.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/ai-provider-init.service.ts"],"sourcesContent":["/*\n * Copyright (c) 2025 Burtson Labs LLC.\n * SPDX-License-Identifier: BUSL-1.1\n * See LICENSE for the applicable terms.\n */\n\n\nimport { useAIProviderStore } from \"../store/aiProviderStore\";\nimport { usePackageSettingsStore } from \"../store/packageSettingsStore\";\nimport { AIProviderConfig, AIProviderType } from \"./ai-provider/types/common.types\";\nimport { authenticationService } from \"./auth/authenticationService\";\nimport { debugLogger } from \"./logging/debugLogger\";\nimport indexedDBService from \"./indexedDB/indexedDBService\";\n\ntype StoredAIProviderConfig = AIProviderConfig & { id?: string };\n\n/**\n * The signed-in user's access token for provider calls. authenticationService\n * is the single source of truth: depending on the host it reads localStorage,\n * the in-memory session (HttpOnly-cookie web sessions) or the token restored\n * from native secure storage. Nothing here reads Web Storage directly — in\n * memory mode a token must never be looked for there.\n */\nconst sessionTokenFactory = (label: string) => (): string | null => {\n  const token = authenticationService.getToken();\n  debugLogger.info(`AIProviderInit: ${label}`, { hasToken: !!token });\n  return token;\n};\n\n/**\n * Service to initialize AI providers based on package settings\n */\nexport class AIProviderInitService {\n  private static instance: AIProviderInitService;\n\n  private constructor() {}\n\n  static getInstance(): AIProviderInitService {\n    if (!AIProviderInitService.instance) {\n      AIProviderInitService.instance = new AIProviderInitService();\n    }\n    return AIProviderInitService.instance;\n  }\n\n  /**\n   * Initialize AI provider from package settings\n   * Provides backward compatibility with existing Ollama settings\n   */\n  async initializeFromSettings(): Promise<void> {\n    const settings = usePackageSettingsStore.getState().settings;\n    if (!settings) {\n      debugLogger.warn(\"No package settings found, cannot initialize AI provider\");\n      return;\n    }\n\n    let providerConfig: AIProviderConfig;\n\n    debugLogger.info(\"AI Provider Init: Starting initialization\", { \n      hasSettings: !!settings,\n      hasAiProvider: !!settings.aiProvider,\n      ollamaUrl: settings.ollamaUrl\n    });\n\n    const isPlaygroundEnvironment =\n      settings.playgroundMode === true ||\n      settings.aiProvider?.type === AIProviderType.PLAYGROUND ||\n      (settings.gatewayApiUrl?.toLowerCase()?.startsWith(\"playground://\") ?? false) ||\n      (typeof window !== \"undefined\" && window.location.pathname.includes(\"/playground\"));\n\n    // First, try to load provider configuration from IndexedDB\n    if (isPlaygroundEnvironment) {\n      debugLogger.info(\"AI Provider Init: Playground environment detected, bypassing saved provider config\");\n    } else {\n      try {\n        const savedConfig = await indexedDBService.get<StoredAIProviderConfig>(\n          'banditConfig', \n          1, \n          'config', \n          'aiProvider',\n          [{ name: 'config', keyPath: 'id' }]\n        );\n        \n        if (savedConfig) {\n          debugLogger.info('AI Provider Init: Found saved config in IndexedDB', { type: savedConfig.type });\n          \n          // Filter out the 'id' property that was added for IndexedDB storage\n          const { id: _id, ...configWithoutId } = savedConfig;\n          providerConfig = { ...configWithoutId };\n          if (providerConfig.type === AIProviderType.ANTHROPIC) {\n            providerConfig = this.convertAnthropicConfig(providerConfig, settings?.gatewayApiUrl);\n          }\n\n          // Ensure tokenFactory is present for providers that need it\n          providerConfig = this.ensureTokenFactory(providerConfig);\n          \n          // Initialize the provider with saved config\n          try {\n            const { createProvider } = useAIProviderStore.getState();\n            createProvider(providerConfig);\n            \n            const provider = useAIProviderStore.getState().provider;\n            if (provider) {\n              try {\n                await provider.validateServiceAvailability({ timeoutMs: 5000 });\n                debugLogger.info(`AI Provider initialized and validated from IndexedDB: ${providerConfig.type}`);\n              } catch (validationError) {\n                debugLogger.warn(`AI Provider created but validation failed`, { error: validationError });\n              }\n            }\n            return; // Successfully initialized from IndexedDB\n          } catch (error) {\n            debugLogger.error(\"Failed to initialize saved provider config, falling back to package settings\", { error });\n          }\n        }\n        \n        debugLogger.info('AI Provider Init: No saved config found, using package settings');\n      } catch (error) {\n        debugLogger.warn('AI Provider Init: Failed to load from IndexedDB, using package settings', { error });\n      }\n    }\n\n    // Fallback to package settings if no saved config found\n    if (settings.aiProvider) {\n      providerConfig = { ...settings.aiProvider };\n      if (providerConfig.type === AIProviderType.ANTHROPIC) {\n        providerConfig = this.convertAnthropicConfig(providerConfig, settings.gatewayApiUrl);\n      }\n      \n      providerConfig = this.ensureTokenFactory(providerConfig);\n      \n      debugLogger.info(\"Using explicit AI provider config\", providerConfig);\n    } else {\n      // Fall back to legacy Ollama settings for backward compatibility\n      providerConfig = {\n        type: AIProviderType.OLLAMA,\n        baseUrl: settings.ollamaUrl,\n        tokenFactory: sessionTokenFactory(\"Token factory called\")\n      };\n      debugLogger.info(\"Using legacy Ollama config\", providerConfig);\n    }\n\n    try {\n      // First validate if the service is available\n      const { createProvider } = useAIProviderStore.getState();\n      \n      // Try to create and validate the provider\n      createProvider(providerConfig);\n      \n      // Test provider availability\n      const provider = useAIProviderStore.getState().provider;\n      if (provider) {\n        try {\n          await provider.validateServiceAvailability({ timeoutMs: 5000 });\n          debugLogger.info(`AI Provider initialized and validated: ${providerConfig.type}`);\n        } catch (validationError) {\n          debugLogger.warn(`AI Provider created but validation failed:`, { error: validationError });\n          // Provider is created but may not be fully available - this is ok for offline scenarios\n        }\n      }\n    } catch (error) {\n      debugLogger.error(\"Failed to initialize AI provider:\", { error });\n      \n      // Try to fall back to default Ollama if initial provider fails\n      if (providerConfig.type !== AIProviderType.OLLAMA) {\n        try {\n          const fallbackConfig: AIProviderConfig = {\n            type: AIProviderType.OLLAMA,\n            baseUrl: settings.ollamaUrl || 'http://localhost:11434',\n            tokenFactory: sessionTokenFactory(\"Fallback tokenFactory\")\n          };\n          const { createProvider } = useAIProviderStore.getState();\n          createProvider(fallbackConfig);\n          debugLogger.info(\"Fallback to Ollama provider successful\");\n        } catch (fallbackError) {\n          debugLogger.error(\"Failed to initialize fallback Ollama provider:\", { error: fallbackError });\n        }\n      } else {\n        // If Ollama provider fails, try localhost as ultimate fallback\n        try {\n          const localFallbackConfig: AIProviderConfig = {\n            type: AIProviderType.OLLAMA,\n            baseUrl: 'http://localhost:11434',\n            tokenFactory: sessionTokenFactory(\"Local fallback tokenFactory\")\n          };\n          const { createProvider } = useAIProviderStore.getState();\n          createProvider(localFallbackConfig);\n          debugLogger.info(\"Fallback to localhost Ollama provider successful\");\n        } catch (localFallbackError) {\n          debugLogger.error(\"All provider initialization attempts failed:\", { error: localFallbackError });\n        }\n      }\n    }\n  }\n\n  /**\n   * Switch to a different AI provider\n   */\n  switchProvider(config: AIProviderConfig): void {\n    try {\n      const normalizedConfig = this.ensureTokenFactory({ ...config });\n      const { switchProvider } = useAIProviderStore.getState();\n      switchProvider(normalizedConfig);\n      debugLogger.info(`Switched to AI provider: ${normalizedConfig.type}`);\n    } catch (error) {\n      debugLogger.error(\"Failed to switch AI provider:\", { error });\n      throw error;\n    }\n  }\n\n  /**\n   * Get the current provider type\n   */\n  getCurrentProviderType(): string | null {\n    const provider = useAIProviderStore.getState().provider;\n    return provider ? provider.getProviderType() : null;\n  }\n\n  /**\n   * Check if a provider is initialized\n   */\n  isProviderInitialized(): boolean {\n    return useAIProviderStore.getState().provider !== null;\n  }\n\n  private convertAnthropicConfig(config: AIProviderConfig, gatewayUrl?: string | null): AIProviderConfig {\n    if (config.type !== AIProviderType.ANTHROPIC) {\n      return config;\n    }\n\n    const defaultModel = typeof config.defaultModel === 'string' && config.defaultModel.trim()\n      ? config.defaultModel.trim()\n      : 'claude-3-5-sonnet-latest';\n\n    const normalized: AIProviderConfig = {\n      type: AIProviderType.GATEWAY,\n      gatewayUrl: gatewayUrl || config.gatewayUrl || '',\n      provider: 'anthropic',\n      defaultModel,\n      tokenFactory: config.tokenFactory\n    };\n\n    debugLogger.info('AI Provider Init: Converted direct Anthropic provider to gateway configuration');\n    return normalized;\n  }\n\n  /**\n   * Ensure providers that require auth have a token factory configured.\n   * Handles both UI auth tokens and API key scenarios.\n   */\n  private ensureTokenFactory(config: AIProviderConfig): AIProviderConfig {\n    if (config.type === AIProviderType.OLLAMA || config.type === AIProviderType.GATEWAY) {\n      const existingFactory = config.tokenFactory;\n      if (existingFactory) {\n        return config;\n      }\n\n      // Prefer explicit API key if provided\n      if (typeof config.apiKey === 'string' && config.apiKey.trim() !== '') {\n        const key = config.apiKey.trim();\n        config.tokenFactory = () => key;\n        debugLogger.info(\"AIProviderInit: Using API key for token factory\", {\n          type: config.type,\n          hasKey: true\n        });\n        return config;\n      }\n\n      // Fallback to the signed-in session (UI sessions)\n      config.tokenFactory = sessionTokenFactory(\"Token factory resolved auth token\");\n    }\n\n    return config;\n  }\n}\n\nexport const aiProviderInitService = AIProviderInitService.getInstance();\n"],"mappings":";;;;;;;;;;;;;AAuBA,IAAM,sBAAsB,CAAC,UAAkB,MAAqB;AAClE,QAAM,QAAQ,sBAAsB,SAAS;AAC7C,cAAY,KAAK,mBAAmB,KAAK,IAAI,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC;AAClE,SAAO;AACT;AAKO,IAAM,wBAAN,MAAM,uBAAsB;AAAA,EACjC,OAAe;AAAA,EAEP,cAAc;AAAA,EAAC;AAAA,EAEvB,OAAO,cAAqC;AAC1C,QAAI,CAAC,uBAAsB,UAAU;AACnC,6BAAsB,WAAW,IAAI,uBAAsB;AAAA,IAC7D;AACA,WAAO,uBAAsB;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,yBAAwC;AAC5C,UAAM,WAAW,wBAAwB,SAAS,EAAE;AACpD,QAAI,CAAC,UAAU;AACb,kBAAY,KAAK,0DAA0D;AAC3E;AAAA,IACF;AAEA,QAAI;AAEJ,gBAAY,KAAK,6CAA6C;AAAA,MAC5D,aAAa,CAAC,CAAC;AAAA,MACf,eAAe,CAAC,CAAC,SAAS;AAAA,MAC1B,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,UAAM,0BACJ,SAAS,mBAAmB,QAC5B,SAAS,YAAY,2CACpB,SAAS,eAAe,YAAY,GAAG,WAAW,eAAe,KAAK,UACtE,OAAO,WAAW,eAAe,OAAO,SAAS,SAAS,SAAS,aAAa;AAGnF,QAAI,yBAAyB;AAC3B,kBAAY,KAAK,oFAAoF;AAAA,IACvG,OAAO;AACL,UAAI;AACF,cAAM,cAAc,MAAM,yBAAiB;AAAA,UACzC;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,CAAC,EAAE,MAAM,UAAU,SAAS,KAAK,CAAC;AAAA,QACpC;AAEA,YAAI,aAAa;AACf,sBAAY,KAAK,qDAAqD,EAAE,MAAM,YAAY,KAAK,CAAC;AAGhG,gBAAM,EAAE,IAAI,KAAK,GAAG,gBAAgB,IAAI;AACxC,2BAAiB,EAAE,GAAG,gBAAgB;AACtC,cAAI,eAAe,sCAAmC;AACpD,6BAAiB,KAAK,uBAAuB,gBAAgB,UAAU,aAAa;AAAA,UACtF;AAGA,2BAAiB,KAAK,mBAAmB,cAAc;AAGvD,cAAI;AACF,kBAAM,EAAE,eAAe,IAAI,mBAAmB,SAAS;AACvD,2BAAe,cAAc;AAE7B,kBAAM,WAAW,mBAAmB,SAAS,EAAE;AAC/C,gBAAI,UAAU;AACZ,kBAAI;AACF,sBAAM,SAAS,4BAA4B,EAAE,WAAW,IAAK,CAAC;AAC9D,4BAAY,KAAK,yDAAyD,eAAe,IAAI,EAAE;AAAA,cACjG,SAAS,iBAAiB;AACxB,4BAAY,KAAK,6CAA6C,EAAE,OAAO,gBAAgB,CAAC;AAAA,cAC1F;AAAA,YACF;AACA;AAAA,UACF,SAAS,OAAO;AACd,wBAAY,MAAM,gFAAgF,EAAE,MAAM,CAAC;AAAA,UAC7G;AAAA,QACF;AAEA,oBAAY,KAAK,iEAAiE;AAAA,MACpF,SAAS,OAAO;AACd,oBAAY,KAAK,2EAA2E,EAAE,MAAM,CAAC;AAAA,MACvG;AAAA,IACF;AAGA,QAAI,SAAS,YAAY;AACvB,uBAAiB,EAAE,GAAG,SAAS,WAAW;AAC1C,UAAI,eAAe,sCAAmC;AACpD,yBAAiB,KAAK,uBAAuB,gBAAgB,SAAS,aAAa;AAAA,MACrF;AAEA,uBAAiB,KAAK,mBAAmB,cAAc;AAEvD,kBAAY,KAAK,qCAAqC,cAAc;AAAA,IACtE,OAAO;AAEL,uBAAiB;AAAA,QACf;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,cAAc,oBAAoB,sBAAsB;AAAA,MAC1D;AACA,kBAAY,KAAK,8BAA8B,cAAc;AAAA,IAC/D;AAEA,QAAI;AAEF,YAAM,EAAE,eAAe,IAAI,mBAAmB,SAAS;AAGvD,qBAAe,cAAc;AAG7B,YAAM,WAAW,mBAAmB,SAAS,EAAE;AAC/C,UAAI,UAAU;AACZ,YAAI;AACF,gBAAM,SAAS,4BAA4B,EAAE,WAAW,IAAK,CAAC;AAC9D,sBAAY,KAAK,0CAA0C,eAAe,IAAI,EAAE;AAAA,QAClF,SAAS,iBAAiB;AACxB,sBAAY,KAAK,8CAA8C,EAAE,OAAO,gBAAgB,CAAC;AAAA,QAE3F;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,kBAAY,MAAM,qCAAqC,EAAE,MAAM,CAAC;AAGhE,UAAI,eAAe,gCAAgC;AACjD,YAAI;AACF,gBAAM,iBAAmC;AAAA,YACvC;AAAA,YACA,SAAS,SAAS,aAAa;AAAA,YAC/B,cAAc,oBAAoB,uBAAuB;AAAA,UAC3D;AACA,gBAAM,EAAE,eAAe,IAAI,mBAAmB,SAAS;AACvD,yBAAe,cAAc;AAC7B,sBAAY,KAAK,wCAAwC;AAAA,QAC3D,SAAS,eAAe;AACtB,sBAAY,MAAM,kDAAkD,EAAE,OAAO,cAAc,CAAC;AAAA,QAC9F;AAAA,MACF,OAAO;AAEL,YAAI;AACF,gBAAM,sBAAwC;AAAA,YAC5C;AAAA,YACA,SAAS;AAAA,YACT,cAAc,oBAAoB,6BAA6B;AAAA,UACjE;AACA,gBAAM,EAAE,eAAe,IAAI,mBAAmB,SAAS;AACvD,yBAAe,mBAAmB;AAClC,sBAAY,KAAK,kDAAkD;AAAA,QACrE,SAAS,oBAAoB;AAC3B,sBAAY,MAAM,gDAAgD,EAAE,OAAO,mBAAmB,CAAC;AAAA,QACjG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,QAAgC;AAC7C,QAAI;AACF,YAAM,mBAAmB,KAAK,mBAAmB,EAAE,GAAG,OAAO,CAAC;AAC9D,YAAM,EAAE,eAAe,IAAI,mBAAmB,SAAS;AACvD,qBAAe,gBAAgB;AAC/B,kBAAY,KAAK,4BAA4B,iBAAiB,IAAI,EAAE;AAAA,IACtE,SAAS,OAAO;AACd,kBAAY,MAAM,iCAAiC,EAAE,MAAM,CAAC;AAC5D,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,yBAAwC;AACtC,UAAM,WAAW,mBAAmB,SAAS,EAAE;AAC/C,WAAO,WAAW,SAAS,gBAAgB,IAAI;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,wBAAiC;AAC/B,WAAO,mBAAmB,SAAS,EAAE,aAAa;AAAA,EACpD;AAAA,EAEQ,uBAAuB,QAA0B,YAA8C;AACrG,QAAI,OAAO,sCAAmC;AAC5C,aAAO;AAAA,IACT;AAEA,UAAM,eAAe,OAAO,OAAO,iBAAiB,YAAY,OAAO,aAAa,KAAK,IACrF,OAAO,aAAa,KAAK,IACzB;AAEJ,UAAM,aAA+B;AAAA,MACnC;AAAA,MACA,YAAY,cAAc,OAAO,cAAc;AAAA,MAC/C,UAAU;AAAA,MACV;AAAA,MACA,cAAc,OAAO;AAAA,IACvB;AAEA,gBAAY,KAAK,gFAAgF;AACjG,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,mBAAmB,QAA4C;AACrE,QAAI,OAAO,kCAAkC,OAAO,kCAAiC;AACnF,YAAM,kBAAkB,OAAO;AAC/B,UAAI,iBAAiB;AACnB,eAAO;AAAA,MACT;AAGA,UAAI,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,MAAM,IAAI;AACpE,cAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,eAAO,eAAe,MAAM;AAC5B,oBAAY,KAAK,mDAAmD;AAAA,UAClE,MAAM,OAAO;AAAA,UACb,QAAQ;AAAA,QACV,CAAC;AACD,eAAO;AAAA,MACT;AAGA,aAAO,eAAe,oBAAoB,mCAAmC;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AACF;AAEO,IAAM,wBAAwB,sBAAsB,YAAY;","names":[]}

package/dist/{chunk-NGGTQVGX.mjs → chunk-E5WMDLE3.mjs}

@@ -1,10 +1,10 @@
 import {
   indexedDBService_default,
   usePackageSettingsStore
-} from "./chunk-2EM4ATKI.mjs";
+} from "./chunk-SZJB5FLZ.mjs";
 import {
   authenticationService
-} from "./chunk-J6LSSK3G.mjs";
+} from "./chunk-GRPTCHFN.mjs";
 import {
   debugLogger
 } from "./chunk-HNXPDIWC.mjs";
@@ -387,4 +387,4 @@ export {
   discoverMcpTools,
   useMCPToolsStore
 };
-//# sourceMappingURL=chunk-NGGTQVGX.mjs.map
+//# sourceMappingURL=chunk-E5WMDLE3.mjs.map

package/dist/{chunk-J6LSSK3G.mjs → chunk-GRPTCHFN.mjs}

@@ -1060,25 +1060,36 @@ import { catchError as catchError2, from as from5, lastValueFrom as lastValueFro
 // src/store/authenticationStore.ts
 import { create } from "zustand";
 var TOKEN_KEY = "authToken";
-var validToken = null;
-var user = null;
-var rawToken = localStorage.getItem(TOKEN_KEY);
-if (rawToken) {
+var decodeClaims = (token) => {
   try {
-    const base64Url = rawToken.split(".")[1];
+    const base64Url = token.split(".")[1];
     const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
     const jsonPayload = decodeURIComponent(
       atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
     );
-    const decoded = JSON.parse(jsonPayload);
-    if (decoded.exp * 1e3 > Date.now()) {
-      validToken = rawToken;
-      user = decoded;
-    }
+    return JSON.parse(jsonPayload);
   } catch {
-    validToken = null;
-    user = null;
+    return null;
   }
+};
+var validOrNull = (raw) => {
+  if (!raw) return null;
+  const decoded = decodeClaims(raw);
+  return decoded && decoded.exp * 1e3 > Date.now() ? raw : null;
+};
+var readLegacyStorage = () => {
+  try {
+    return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY);
+  } catch {
+    return null;
+  }
+};
+var validToken = null;
+var user = null;
+var rawToken = readLegacyStorage();
+if (rawToken) {
+  validToken = validOrNull(rawToken);
+  user = validToken ? decodeClaims(validToken) : null;
 }
 var useAuthenticationStore = create((set) => ({
   token: validToken,
@@ -1086,16 +1097,10 @@ var useAuthenticationStore = create((set) => ({
   authError: null,
   setToken: (token) => {
     if (token) {
-      try {
-        const base64Url = token.split(".")[1];
-        const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-        const jsonPayload = decodeURIComponent(
-          atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-        );
-        const user2 = JSON.parse(jsonPayload);
-        localStorage.setItem(TOKEN_KEY, token);
-        set({ token, authError: null, user: user2 });
-      } catch {
+      const decoded = decodeClaims(token);
+      if (decoded) {
+        set({ token, authError: null, user: decoded });
+      } else {
         set({ token: null, authError: "Invalid token", user: null });
       }
     } else {
@@ -1103,23 +1108,11 @@ var useAuthenticationStore = create((set) => ({
     }
   },
   clearToken: () => {
-    localStorage.removeItem(TOKEN_KEY);
     set({ token: null, authError: null, user: null });
   }
 }));
 var readPersistedToken = () => {
-  try {
-    const raw = localStorage.getItem(TOKEN_KEY);
-    if (!raw) return null;
-    const base64 = raw.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
-    const json = decodeURIComponent(
-      atob(base64).split("").map((c) => "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2)).join("")
-    );
-    const decoded = JSON.parse(json);
-    return decoded.exp * 1e3 > Date.now() ? raw : null;
-  } catch {
-    return null;
-  }
+  return validOrNull(readLegacyStorage()) ?? validOrNull(useAuthenticationStore.getState().token);
 };
 
 // src/services/auth/authenticationService.ts
@@ -1133,21 +1126,103 @@ function emitAuthTokenChanged(token) {
     detail: { token }
   }));
 }
+var readLocalStorage = () => {
+  try {
+    return typeof localStorage === "undefined" ? null : localStorage.getItem(TOKEN_KEY2);
+  } catch {
+    return null;
+  }
+};
+var writeLocalStorage = (token) => {
+  try {
+    if (typeof localStorage === "undefined") return;
+    if (token) localStorage.setItem(TOKEN_KEY2, token);
+    else localStorage.removeItem(TOKEN_KEY2);
+  } catch {
+  }
+};
 var AuthenticationService = class {
+  storageMode = "localStorage";
+  persistence = null;
+  handlers = {};
+  /** Bumped on every setToken/clearToken; async flows compare it to detect a superseded session. */
+  revision = 0;
+  refreshInFlight = null;
+  lastPersist = Promise.resolve();
+  /**
+   * Pick the storage contract for this host. Call once at boot, before the
+   * first `setToken`. Switching modes never moves a token by itself: the
+   * host migrates (e.g. reads the legacy localStorage value, then clears it).
+   */
+  configureSession(config) {
+    this.storageMode = config.storage;
+    this.persistence = config.persistence ?? null;
+    this.handlers = config.handlers ?? {};
+  }
+  getStorageMode() {
+    return this.storageMode;
+  }
+  getSessionRevision() {
+    return this.revision;
+  }
   getToken() {
-    const token = localStorage.getItem(TOKEN_KEY2);
-    return token;
+    if (this.storageMode === "memory") {
+      return useAuthenticationStore.getState().token;
+    }
+    return readLocalStorage();
   }
   setToken(token) {
-    localStorage.setItem(TOKEN_KEY2, token);
+    this.revision += 1;
+    if (this.storageMode === "localStorage") {
+      writeLocalStorage(token);
+    } else {
+      writeLocalStorage(null);
+    }
     useAuthenticationStore.getState().setToken(token);
+    this.mirror(() => this.persistence?.write(token));
     emitAuthTokenChanged(token);
   }
   clearToken() {
-    localStorage.removeItem(TOKEN_KEY2);
+    this.revision += 1;
+    const current = this.getToken() ?? useAuthenticationStore.getState().token;
+    try {
+      this.handlers.beforeClear?.(current);
+    } catch (error) {
+      debugLogger.warn("Auth beforeClear handler failed", { error });
+    }
+    writeLocalStorage(null);
     useAuthenticationStore.getState().clearToken();
+    this.mirror(() => this.persistence?.clear());
     emitAuthTokenChanged(null);
   }
+  /** True when the host registered a silent refresh path. */
+  canRefresh() {
+    return typeof this.handlers.refresh === "function";
+  }
+  /**
+   * Ask the host for a fresh token. Concurrent callers share one attempt.
+   * Resolves false when no refresh path exists or it did not produce a token.
+   */
+  tryRefresh() {
+    const refresh = this.handlers.refresh;
+    if (!refresh) return Promise.resolve(false);
+    if (this.refreshInFlight) return this.refreshInFlight;
+    this.refreshInFlight = (async () => {
+      try {
+        return await refresh();
+      } catch (error) {
+        debugLogger.warn("Auth refresh handler failed", { error });
+        return false;
+      } finally {
+        this.refreshInFlight = null;
+      }
+    })();
+    return this.refreshInFlight;
+  }
+  /** Resolves once the most recent persistence write/clear has settled. */
+  whenPersisted() {
+    return this.lastPersist;
+  }
   isAuthenticated() {
     const token = useAuthenticationStore.getState().token;
     return !!token && !this.isTokenExpired(token);
@@ -1177,6 +1252,16 @@ var AuthenticationService = class {
       return null;
     }
   }
+  mirror(run) {
+    const attempt = (async () => {
+      try {
+        await run();
+      } catch (error) {
+        debugLogger.warn("Auth token persistence failed", { error });
+      }
+    })();
+    this.lastPersist = attempt;
+  }
 };
 var authenticationService = new AuthenticationService();
 
@@ -1221,13 +1306,35 @@ var GatewayService = class {
     });
     instance.interceptors.response.use(
       (response) => response,
-      (error) => {
+      async (error) => {
+        const retried = await this._retryAfterRefresh(instance, error);
+        if (retried) return retried;
         this._handleAuthFailure(error);
         return Promise.reject(this._normalizeAxiosError(error));
       }
     );
     return instance;
   }
+  /**
+   * A bare 401 on a host with a silent refresh path (HttpOnly refresh cookie,
+   * native device token) usually means the access token aged out mid-session.
+   * Refresh once and replay the request with the new token instead of
+   * signing the user out; a failed refresh falls through to the sign-out path.
+   */
+  async _retryAfterRefresh(instance, error) {
+    const config = error.config;
+    if (!config || config._banditAuthRetried || error.response?.status !== 401) return null;
+    if (!authenticationService.canRefresh()) return null;
+    const data = error.response?.data;
+    if (data?.code && data.code !== "TOKEN_EXPIRED") return null;
+    try {
+      if (!await authenticationService.tryRefresh()) return null;
+    } catch {
+      return null;
+    }
+    config._banditAuthRetried = true;
+    return instance.request(config);
+  }
   _normalizeAxiosError(error) {
     if (error.response) {
       return this._createHttpError(
@@ -3148,10 +3255,11 @@ var useAIProviderStore = create2((set, get) => ({
 export {
   useAuthenticationStore,
   readPersistedToken,
+  TOKEN_KEY2 as TOKEN_KEY,
   AUTH_TOKEN_CHANGED_EVENT,
   authenticationService,
   GatewayService,
   AIProviderFactory,
   useAIProviderStore
 };
-//# sourceMappingURL=chunk-J6LSSK3G.mjs.map
+//# sourceMappingURL=chunk-GRPTCHFN.mjs.map