@flamingo-stack/openframe-frontend-core 0.0.741 → 0.0.742

package/dist/{software-update-QAMNASVF.cjs → software-update-ED33WSKT.cjs}

@@ -15,26 +15,26 @@ var _chunkDKOLQPE7cjs = require('./chunk-DKOLQPE7.cjs');
 
 
 
-var _chunkIK2RJUEAcjs = require('./chunk-IK2RJUEA.cjs');
-require('./chunk-O67V3HJR.cjs');
-require('./chunk-3HPB4H4C.cjs');
+var _chunk4PKORVOXcjs = require('./chunk-4PKORVOX.cjs');
+require('./chunk-URVIPSAJ.cjs');
+require('./chunk-NTGIQP7O.cjs');
 
 
-var _chunkDSVNFRY5cjs = require('./chunk-DSVNFRY5.cjs');
+var _chunkU2O5YQRPcjs = require('./chunk-U2O5YQRP.cjs');
 require('./chunk-HQQE74RO.cjs');
 require('./chunk-DEY6XXGO.cjs');
-require('./chunk-VA7OMDZO.cjs');
-require('./chunk-AAFW4STC.cjs');
+require('./chunk-4FWURR3W.cjs');
+require('./chunk-LU7TD6QS.cjs');
 require('./chunk-24I6RFVU.cjs');
 require('./chunk-A6P6DHEZ.cjs');
 require('./chunk-MZ4KBSH7.cjs');
-require('./chunk-KLI4OSRA.cjs');
+require('./chunk-YQGDXH3M.cjs');
 require('./chunk-YUMFVQIN.cjs');
-require('./chunk-CWRVTQUO.cjs');
-require('./chunk-BV5WZVOP.cjs');
-require('./chunk-GABDE3FM.cjs');
+require('./chunk-PS6T65KA.cjs');
+require('./chunk-32Q7K5OP.cjs');
+require('./chunk-OWGLRE74.cjs');
 require('./chunk-3RFQPQ7Z.cjs');
-require('./chunk-PQ2M7P2U.cjs');
+require('./chunk-5TCIRWHL.cjs');
 require('./chunk-B27QEHYR.cjs');
 require('./chunk-ZOZR3QI2.cjs');
 require('./chunk-OMV5S5PI.cjs');
@@ -1824,20 +1824,20 @@ require('./chunk-LMBYZITR.cjs');
 require('./chunk-TMVC7S2R.cjs');
 require('./chunk-IYHH5EIO.cjs');
 require('./chunk-XIBCMGBW.cjs');
-require('./chunk-DUVOQHQI.cjs');
-require('./chunk-SA7LDEVJ.cjs');
-require('./chunk-NTJE6SM6.cjs');
+require('./chunk-W2RM764D.cjs');
+require('./chunk-CSJO7ZGN.cjs');
+require('./chunk-WI2OTGKC.cjs');
 require('./chunk-JKX2C3I2.cjs');
 require('./chunk-7DNL734S.cjs');
 require('./chunk-WWUSFOJ7.cjs');
 require('./chunk-SKI6NKOE.cjs');
 require('./chunk-EWPR7662.cjs');
-require('./chunk-YRE3O65E.cjs');
-require('./chunk-YXKB5WRE.cjs');
-require('./chunk-IFS4AH77.cjs');
+require('./chunk-XAA5EZ5T.cjs');
+require('./chunk-5MH6BRPY.cjs');
+require('./chunk-QYLIHZKZ.cjs');
 require('./chunk-63N4FN5V.cjs');
-require('./chunk-GSWQZX23.cjs');
-require('./chunk-7ZFCR7UY.cjs');
+require('./chunk-UY6A6TEY.cjs');
+require('./chunk-ABLUMGCI.cjs');
 require('./chunk-S5C3OZCO.cjs');
 require('./chunk-32ASZMTV.cjs');
 require('./chunk-OOYBIS7D.cjs');
@@ -1847,11 +1847,11 @@ require('./chunk-ORO54HDF.cjs');
 require('./chunk-RUHKTWGB.cjs');
 require('./chunk-BLH2SFOO.cjs');
 require('./chunk-I5MSCD57.cjs');
-require('./chunk-PX7FY655.cjs');
+require('./chunk-ASMNNSUQ.cjs');
 require('./chunk-CW3ML76U.cjs');
-require('./chunk-GVTDVS5U.cjs');
-require('./chunk-FICJS5OA.cjs');
-require('./chunk-VOX4E6AX.cjs');
+require('./chunk-R34JD6NP.cjs');
+require('./chunk-KTPR66EE.cjs');
+require('./chunk-DGFDBPO7.cjs');
 require('./chunk-HOTM4UM6.cjs');
 require('./chunk-UJ7AXHRZ.cjs');
 require('./chunk-HTRILBJD.cjs');
@@ -1920,14 +1920,14 @@ var noop = () => {
 var HIDDEN_WHEN_COMPACT = ["organization"];
 function StaticPackageField({ value }) {
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-    _chunkDSVNFRY5cjs.Autocomplete,
+    _chunkU2O5YQRPcjs.Autocomplete,
     {
-      label: _chunkIK2RJUEAcjs.PACKAGE_SEARCH_LABEL,
+      label: _chunk4PKORVOXcjs.PACKAGE_SEARCH_LABEL,
       labelVariant: "large",
       options: value ? [{ value: value.id, label: value.name, description: _nullishCoalesce(value.description, () => ( void 0)) }] : [],
       value: _nullishCoalesce(_optionalChain([value, 'optionalAccess', _ => _.id]), () => ( null)),
       onChange: noop,
-      placeholder: _chunkIK2RJUEAcjs.PACKAGE_SEARCH_PLACEHOLDER
+      placeholder: _chunk4PKORVOXcjs.PACKAGE_SEARCH_PLACEHOLDER
     }
   );
 }
@@ -1941,7 +1941,7 @@ function SoftwareUpdateScreen({ compact = false }) {
     [fixture.devices, fixture.selectedIds]
   );
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "h-full bg-ods-bg pt-[var(--spacing-system-l)]", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "h-full", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-    _chunkIK2RJUEAcjs.SoftwareActionForm,
+    _chunk4PKORVOXcjs.SoftwareActionForm,
     {
       action: fixture.action,
       showHeader: false,
@@ -1953,7 +1953,7 @@ function SoftwareUpdateScreen({ compact = false }) {
       initialValues: fixture.initialValues,
       renderPackageSearch,
       renderDevicePicker: () => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-        _chunkIK2RJUEAcjs.DeviceSelector,
+        _chunk4PKORVOXcjs.DeviceSelector,
         {
           devices: selected,
           loading: false,

package/dist/{tickets-board-CEDHD3KB.cjs → tickets-board-O753S4ZB.cjs}

@@ -10,9 +10,9 @@ var _chunkDKOLQPE7cjs = require('./chunk-DKOLQPE7.cjs');
 
 
 
-var _chunkO67V3HJRcjs = require('./chunk-O67V3HJR.cjs');
-require('./chunk-AAFW4STC.cjs');
-require('./chunk-GABDE3FM.cjs');
+var _chunkURVIPSAJcjs = require('./chunk-URVIPSAJ.cjs');
+require('./chunk-LU7TD6QS.cjs');
+require('./chunk-OWGLRE74.cjs');
 require('./chunk-B27QEHYR.cjs');
 require('./chunk-ZOZR3QI2.cjs');
 require('./chunk-OMV5S5PI.cjs');
@@ -1802,11 +1802,11 @@ require('./chunk-LMBYZITR.cjs');
 require('./chunk-TMVC7S2R.cjs');
 require('./chunk-IYHH5EIO.cjs');
 require('./chunk-XIBCMGBW.cjs');
-require('./chunk-NTJE6SM6.cjs');
+require('./chunk-WI2OTGKC.cjs');
 require('./chunk-WWUSFOJ7.cjs');
 require('./chunk-SKI6NKOE.cjs');
-require('./chunk-IFS4AH77.cjs');
-require('./chunk-7ZFCR7UY.cjs');
+require('./chunk-QYLIHZKZ.cjs');
+require('./chunk-ABLUMGCI.cjs');
 require('./chunk-S5C3OZCO.cjs');
 require('./chunk-32ASZMTV.cjs');
 require('./chunk-OOYBIS7D.cjs');
@@ -1814,9 +1814,9 @@ require('./chunk-4IYNDV3G.cjs');
 require('./chunk-6VOOPMP5.cjs');
 require('./chunk-ORO54HDF.cjs');
 require('./chunk-RUHKTWGB.cjs');
-require('./chunk-PX7FY655.cjs');
-require('./chunk-FICJS5OA.cjs');
-require('./chunk-VOX4E6AX.cjs');
+require('./chunk-ASMNNSUQ.cjs');
+require('./chunk-KTPR66EE.cjs');
+require('./chunk-DGFDBPO7.cjs');
 require('./chunk-HOTM4UM6.cjs');
 require('./chunk-L2RMTGOK.cjs');
 require('./chunk-Z74QE57T.cjs');
@@ -1839,7 +1839,7 @@ function buildTicketsBoardFixture(cast) {
   const dana = assignee(cast.person("dana"));
   const alex = assignee(cast.person("alex"));
   return [
-    _chunkO67V3HJRcjs.columnFromTicketStatus.call(void 0, "ACTIVE", [
+    _chunkURVIPSAJcjs.columnFromTicketStatus.call(void 0, "ACTIVE", [
       ticket("tk-1051", "Printer offline at the front desk", "ACTIVE", {
         ticketNumber: "1051",
         agent: "fae",
@@ -1857,7 +1857,7 @@ function buildTicketsBoardFixture(cast) {
         tags: ["onboarding"]
       })
     ]),
-    _chunkO67V3HJRcjs.columnFromTicketStatus.call(void 0, "TECH_REQUIRED", [
+    _chunkURVIPSAJcjs.columnFromTicketStatus.call(void 0, "TECH_REQUIRED", [
       ticket("tk-1049", "Acrobat Pro for Maya", "TECH_REQUIRED", {
         ticketNumber: "1049",
         agent: "fae",
@@ -1881,7 +1881,7 @@ function buildTicketsBoardFixture(cast) {
         escalatedByUser: true
       })
     ]),
-    _chunkO67V3HJRcjs.columnFromTicketStatus.call(void 0, "ON_HOLD", [
+    _chunkURVIPSAJcjs.columnFromTicketStatus.call(void 0, "ON_HOLD", [
       ticket("tk-1046", "Replace the conference room display", "ON_HOLD", {
         ticketNumber: "1046",
         organizationName: _chunkDKOLQPE7cjs.DEMO_ORGANIZATIONS.acme.name,
@@ -1890,7 +1890,7 @@ function buildTicketsBoardFixture(cast) {
         activity: { kind: "waiting-external" }
       })
     ]),
-    _chunkO67V3HJRcjs.columnFromTicketStatus.call(void 0, 
+    _chunkURVIPSAJcjs.columnFromTicketStatus.call(void 0, 
       "RESOLVED",
       [
         ticket("tk-1048", "Slow laptop", "RESOLVED", {
@@ -1926,7 +1926,7 @@ function TicketsBoardScreen({ compact = false }) {
   const cast = _chunkSTEJZPIOcjs.useProductDemoCast.call(void 0, );
   const board = _react.useMemo.call(void 0, () => buildTicketsBoardFixture(cast), [cast]);
   const columns = compact ? board.filter((column) => column.id !== "ON_HOLD") : board;
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "h-full bg-ods-bg p-[var(--spacing-system-m)]", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkO67V3HJRcjs.Board, { columns, onChange: noop, initialCollapsed: compact ? void 0 : FOLDED }) });
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "h-full bg-ods-bg p-[var(--spacing-system-m)]", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkURVIPSAJcjs.Board, { columns, onChange: noop, initialCollapsed: compact ? void 0 : FOLDED }) });
 }
 
 

package/dist/utils/embed-authed-fetch.d.ts

@@ -58,6 +58,34 @@ export interface EmbedAuthAdapter {
      * host's own auth layer, not to this fetch wrapper.
      */
     refresh?: () => Promise<boolean>;
+    /**
+     * Optional guard, run before every request goes out — the first attempt
+     * and the retry after a `refresh`. Throw — or reject — to refuse the
+     * request: `embedAuthedFetch` rejects with that error and nothing reaches
+     * the network.
+     *
+     * For a host-wide state that makes every request pointless. openframe's
+     * mobile force-update is the case it exists for: once the gateway has
+     * refused this client build, every later request is refused locally, so no
+     * surface's retry or reconnect loop keeps hitting the gateway. Runs inside
+     * the returned promise (after the synchronous same-origin guard), so
+     * callers see a rejection, never a synchronous throw.
+     */
+    beforeRequest?: () => void | Promise<void>;
+    /**
+     * Optional response hook, run on every response (the post-refresh retry's
+     * too) BEFORE the 401 self-heal. Throw — or reject — to fail the request
+     * with that error: `embedAuthedFetch` rejects with it, and neither
+     * `refresh` nor a retry runs. Return to let the response continue through
+     * the wrapper unchanged.
+     *
+     * For a status the host handles app-wide rather than per surface — e.g.
+     * openframe's gateway answering `426 Upgrade Required` to a too-old mobile
+     * build, which swaps the whole app for an "update required" screen and
+     * must never be retried or read as an auth failure. Read the body from
+     * `response.clone()`: once the hook returns, the caller reads the original.
+     */
+    onResponse?: (response: Response) => void | Promise<void>;
     /**
      * Exact extra origins (`scheme://host[:port]`, as produced by `URL.origin`)
      * the same-origin guard additionally accepts. The guard normally rejects
@@ -166,6 +194,11 @@ export declare function needsBearerAssetFetch(url: string): boolean;
  * no longer need a host-side `window.fetch` monkey-patch to survive an
  * expired access token mid-chat. With no adapter (or no `refresh`), the
  * 401 passes straight through unchanged.
+ *
+ * **Host hooks:** an adapter's `beforeRequest` may refuse a request before it
+ * is sent, and its `onResponse` sees every response ahead of the 401
+ * self-heal and may fail the request instead (see their docs). Without them
+ * the wrapper behaves exactly as described above.
  */
 export declare function embedAuthedFetch(url: string, init?: RequestInit): Promise<Response>;
 //# sourceMappingURL=embed-authed-fetch.d.ts.map

package/dist/utils/embed-authed-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embed-authed-fetch.d.ts","sourceRoot":"","sources":["../../src/utils/embed-authed-fetch.ts"],"names":[],"mappings":"AA4BA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;4EAMwE;IACxE,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD;;6EAEyE;IACzE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;CAClD;AA0BD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAS1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAE/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAiB1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkCvF"}
+{"version":3,"file":"embed-authed-fetch.d.ts","sourceRoot":"","sources":["../../src/utils/embed-authed-fetch.ts"],"names":[],"mappings":"AA4BA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;4EAMwE;IACxE,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD;;6EAEyE;IACzE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;CAClD;AA0BD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAS1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAE/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAiB1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkCvF"}

package/dist/utils/embed-authed-fetch.js

@@ -82,8 +82,9 @@ function dedupedRefresh() {
   return inFlightRefresh;
 }
 async function fetchWithRefresh(url, init, baseHeaders, isRetry) {
-  const { url: authedUrl, headers } = applyProxyAuth(url, { ...baseHeaders });
   const adapter = getRegisteredAuthAdapter();
+  await adapter?.beforeRequest?.();
+  const { url: authedUrl, headers } = applyProxyAuth(url, { ...baseHeaders });
   if (adapter?.getHeaders) {
     for (const [k, v] of Object.entries(adapter.getHeaders())) {
       if (v !== void 0) headers[k] = v;
@@ -100,6 +101,7 @@ async function fetchWithRefresh(url, init, baseHeaders, isRetry) {
     // `SameSite=None` must be configured server-side for that to work).
     credentials
   });
+  await adapter?.onResponse?.(response);
   if (response.status === 401 && !isRetry && adapter?.refresh) {
     const refreshed = await dedupedRefresh();
     if (refreshed) {

package/dist/utils/index.cjs

@@ -83337,8 +83337,9 @@ function dedupedRefresh() {
   return inFlightRefresh;
 }
 async function fetchWithRefresh(url, init, baseHeaders, isRetry) {
-  const { url: authedUrl, headers } = applyProxyAuth(url, { ...baseHeaders });
   const adapter2 = getRegisteredAuthAdapter();
+  await adapter2?.beforeRequest?.();
+  const { url: authedUrl, headers } = applyProxyAuth(url, { ...baseHeaders });
   if (adapter2?.getHeaders) {
     for (const [k, v] of Object.entries(adapter2.getHeaders())) {
       if (v !== void 0) headers[k] = v;
@@ -83355,6 +83356,7 @@ async function fetchWithRefresh(url, init, baseHeaders, isRetry) {
     // `SameSite=None` must be configured server-side for that to work).
     credentials
   });
+  await adapter2?.onResponse?.(response);
   if (response.status === 401 && !isRetry && adapter2?.refresh) {
     const refreshed = await dedupedRefresh();
     if (refreshed) {

package/dist/{video-file-player-ZH2ILAPO.cjs → video-file-player-QZ3YOLHO.cjs}

@@ -19,7 +19,7 @@ require('./chunk-4IYNDV3G.cjs');
 require('./chunk-CW3ML76U.cjs');
 
 
-var _chunkVOX4E6AXcjs = require('./chunk-VOX4E6AX.cjs');
+var _chunkDGFDBPO7cjs = require('./chunk-DGFDBPO7.cjs');
 require('./chunk-UJ7AXHRZ.cjs');
 
 
@@ -406,7 +406,7 @@ function FilePlayer({
   const hover = useHoverPlayback(mediaRef, sound, { playOnHover, playWhenHovered, mutedIntent });
   const health = usePlaybackHealth(mediaRef, url, !chromeless);
   useIosNativeVideoFullscreen(mediaRef);
-  const captions = _chunkVOX4E6AXcjs.useAuthedAssetSrc.call(void 0, captionsUrl, "text/vtt, */*");
+  const captions = _chunkDGFDBPO7cjs.useAuthedAssetSrc.call(void 0, captionsUrl, "text/vtt, */*");
   const player = /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
     _muxplayerreact2.default,
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flamingo-stack/openframe-frontend-core",
-  "version": "0.0.741",
+  "version": "0.0.742",
   "description": "Shared design system and components for all Flamingo platforms",
   "type": "module",
   "sideEffects": [

package/src/utils/embed-authed-fetch.ts

@@ -86,6 +86,34 @@ export interface EmbedAuthAdapter {
    * host's own auth layer, not to this fetch wrapper.
    */
   refresh?: () => Promise<boolean>;
+  /**
+   * Optional guard, run before every request goes out — the first attempt
+   * and the retry after a `refresh`. Throw — or reject — to refuse the
+   * request: `embedAuthedFetch` rejects with that error and nothing reaches
+   * the network.
+   *
+   * For a host-wide state that makes every request pointless. openframe's
+   * mobile force-update is the case it exists for: once the gateway has
+   * refused this client build, every later request is refused locally, so no
+   * surface's retry or reconnect loop keeps hitting the gateway. Runs inside
+   * the returned promise (after the synchronous same-origin guard), so
+   * callers see a rejection, never a synchronous throw.
+   */
+  beforeRequest?: () => void | Promise<void>;
+  /**
+   * Optional response hook, run on every response (the post-refresh retry's
+   * too) BEFORE the 401 self-heal. Throw — or reject — to fail the request
+   * with that error: `embedAuthedFetch` rejects with it, and neither
+   * `refresh` nor a retry runs. Return to let the response continue through
+   * the wrapper unchanged.
+   *
+   * For a status the host handles app-wide rather than per surface — e.g.
+   * openframe's gateway answering `426 Upgrade Required` to a too-old mobile
+   * build, which swaps the whole app for an "update required" screen and
+   * must never be retried or read as an auth failure. Read the body from
+   * `response.clone()`: once the hook returns, the caller reads the original.
+   */
+  onResponse?: (response: Response) => void | Promise<void>;
   /**
    * Exact extra origins (`scheme://host[:port]`, as produced by `URL.origin`)
    * the same-origin guard additionally accepts. The guard normally rejects
@@ -253,6 +281,11 @@ export function needsBearerAssetFetch(url: string): boolean {
  * no longer need a host-side `window.fetch` monkey-patch to survive an
  * expired access token mid-chat. With no adapter (or no `refresh`), the
  * 401 passes straight through unchanged.
+ *
+ * **Host hooks:** an adapter's `beforeRequest` may refuse a request before it
+ * is sent, and its `onResponse` sees every response ahead of the 401
+ * self-heal and may fail the request instead (see their docs). Without them
+ * the wrapper behaves exactly as described above.
  */
 export function embedAuthedFetch(url: string, init: RequestInit = {}): Promise<Response> {
   // Same-origin guard runs SYNCHRONOUSLY (not awaited inside the async
@@ -354,6 +387,11 @@ async function fetchWithRefresh(
   baseHeaders: Record<string, string>,
   isRetry: boolean,
 ): Promise<Response> {
+  const adapter = getRegisteredAuthAdapter();
+  // Per attempt, so a retry after `refresh` is refused too when the host's
+  // state changed while the refresh was in flight.
+  await adapter?.beforeRequest?.();
+
   // Re-run the merge each attempt: `applyProxyAuth` reads the latest stored
   // proxy creds and `getHeaders()` reads the latest bearer, so a retry after
   // refresh carries the rotated token rather than the stale one. `{...baseHeaders}`
@@ -365,7 +403,6 @@ async function fetchWithRefresh(
   // is the host's explicit "this is my auth model" override, intentionally
   // last-writer-wins. When no adapter is registered, this is a zero-cost
   // no-op (object spread of `{}`).
-  const adapter = getRegisteredAuthAdapter();
   if (adapter?.getHeaders) {
     // Filter `undefined` values — the adapter type allows them so consumers
     // don't have to narrow `{ Authorization: token ? '…' : undefined }`-shaped
@@ -387,6 +424,10 @@ async function fetchWithRefresh(
     credentials,
   });
 
+  // Ahead of the 401 self-heal: a status the host claims by throwing must
+  // never reach `refresh` or a retry.
+  await adapter?.onResponse?.(response);
+
   // 401 self-heal: refresh the token once and retry. Only when an adapter
   // opted into `refresh`, and only on the first attempt — a 401 on the
   // retry means the fresh token is also unauthorized, so surface it.