@flamingo-stack/openframe-frontend-core 0.0.853 → 0.0.855

package/dist/{software-update-MYLKHDHC.cjs → software-update-PXTANMAO.cjs}

@@ -15,24 +15,24 @@ var _chunkFDZOE5TLcjs = require('./chunk-FDZOE5TL.cjs');
 
 
 
-var _chunkGI6ECCWBcjs = require('./chunk-GI6ECCWB.cjs');
-require('./chunk-USPUZO53.cjs');
+var _chunkZUGJLCYPcjs = require('./chunk-ZUGJLCYP.cjs');
+require('./chunk-KZAQPRTA.cjs');
 
 
-var _chunkCOJG2ATYcjs = require('./chunk-COJG2ATY.cjs');
-require('./chunk-P63CRPWI.cjs');
+var _chunkRIJU4HZ2cjs = require('./chunk-RIJU4HZ2.cjs');
+require('./chunk-4H3J57AN.cjs');
 require('./chunk-HQQE74RO.cjs');
 require('./chunk-DEY6XXGO.cjs');
-require('./chunk-UO2EJGRJ.cjs');
+require('./chunk-QZXCUY36.cjs');
 require('./chunk-24I6RFVU.cjs');
-require('./chunk-IUDBG3HJ.cjs');
+require('./chunk-PCQ2HKU3.cjs');
 require('./chunk-MZ4KBSH7.cjs');
 require('./chunk-ZZDFMUEU.cjs');
-require('./chunk-IC4IJJB2.cjs');
-require('./chunk-LFEURIZN.cjs');
+require('./chunk-F33EAPD2.cjs');
+require('./chunk-HML3JUXF.cjs');
 require('./chunk-OT6P57ZS.cjs');
-require('./chunk-EIACEY2L.cjs');
-require('./chunk-U767P4JU.cjs');
+require('./chunk-65NMKAPQ.cjs');
+require('./chunk-STV6VJ3U.cjs');
 require('./chunk-KXFIYO4O.cjs');
 require('./chunk-PGAMWM6C.cjs');
 require('./chunk-7HH4Y27U.cjs');
@@ -1825,22 +1825,22 @@ require('./chunk-LMBYZITR.cjs');
 require('./chunk-TMVC7S2R.cjs');
 require('./chunk-IYHH5EIO.cjs');
 require('./chunk-XIBCMGBW.cjs');
-require('./chunk-OH5TXFRR.cjs');
-require('./chunk-G7GF4PWA.cjs');
-require('./chunk-FW7RKWPY.cjs');
-require('./chunk-IGVAPIEW.cjs');
+require('./chunk-O4CPT3RK.cjs');
+require('./chunk-77GX573I.cjs');
+require('./chunk-D6GEMVHD.cjs');
+require('./chunk-6C4OR4MZ.cjs');
 require('./chunk-JKX2C3I2.cjs');
 require('./chunk-WWUSFOJ7.cjs');
 require('./chunk-SKI6NKOE.cjs');
 require('./chunk-EWPR7662.cjs');
 require('./chunk-IX2E3AN7.cjs');
 require('./chunk-7DNL734S.cjs');
-require('./chunk-2W22LY3W.cjs');
-require('./chunk-NMWLXHFH.cjs');
-require('./chunk-HTYJUMFB.cjs');
-require('./chunk-W7OFAROY.cjs');
-require('./chunk-O3EKOXFZ.cjs');
-require('./chunk-SSKMGH5O.cjs');
+require('./chunk-2JCA7BRK.cjs');
+require('./chunk-3GJ75OUL.cjs');
+require('./chunk-LSLRJJFP.cjs');
+require('./chunk-YSXVRTGT.cjs');
+require('./chunk-AYMY2VNB.cjs');
+require('./chunk-DXVGGWLG.cjs');
 require('./chunk-X432Y6RM.cjs');
 require('./chunk-S5C3OZCO.cjs');
 require('./chunk-32ASZMTV.cjs');
@@ -1850,15 +1850,14 @@ require('./chunk-6VOOPMP5.cjs');
 require('./chunk-ORO54HDF.cjs');
 require('./chunk-RUHKTWGB.cjs');
 require('./chunk-BLH2SFOO.cjs');
-require('./chunk-UAI4VMEF.cjs');
-require('./chunk-COWMXUHN.cjs');
-require('./chunk-YSDB6HGQ.cjs');
-require('./chunk-ETZFBB7O.cjs');
-require('./chunk-FX35L4Y6.cjs');
-require('./chunk-KKFDRCQF.cjs');
+require('./chunk-T54I5ZZY.cjs');
+require('./chunk-GK577ZLJ.cjs');
+require('./chunk-EXQSIX2I.cjs');
+require('./chunk-XCQ5I27Z.cjs');
+require('./chunk-RY7INTYU.cjs');
 require('./chunk-NTPX5GXI.cjs');
-require('./chunk-GI3MMBP3.cjs');
-require('./chunk-GG466XFQ.cjs');
+require('./chunk-6DMH4GXN.cjs');
+require('./chunk-SQ7YHWEP.cjs');
 require('./chunk-UJ7AXHRZ.cjs');
 require('./chunk-HXURNKXI.cjs');
 require('./chunk-VCFQHPOO.cjs');
@@ -1923,14 +1922,14 @@ var noop = () => {
 var HIDDEN_WHEN_COMPACT = ["organization"];
 function StaticPackageField({ value }) {
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-    _chunkCOJG2ATYcjs.Autocomplete,
+    _chunkRIJU4HZ2cjs.Autocomplete,
     {
-      label: _chunkGI6ECCWBcjs.PACKAGE_SEARCH_LABEL,
+      label: _chunkZUGJLCYPcjs.PACKAGE_SEARCH_LABEL,
       labelVariant: "large",
       options: value ? [{ value: value.id, label: value.name, description: _nullishCoalesce(value.description, () => ( void 0)) }] : [],
       value: _nullishCoalesce(_optionalChain([value, 'optionalAccess', _ => _.id]), () => ( null)),
       onChange: noop,
-      placeholder: _chunkGI6ECCWBcjs.PACKAGE_SEARCH_PLACEHOLDER
+      placeholder: _chunkZUGJLCYPcjs.PACKAGE_SEARCH_PLACEHOLDER
     }
   );
 }
@@ -1944,7 +1943,7 @@ function SoftwareUpdateScreen({ compact = false }) {
     [fixture.devices, fixture.selectedIds]
   );
   return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "h-full bg-ods-bg pt-[var(--spacing-system-l)]", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "h-full", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-    _chunkGI6ECCWBcjs.SoftwareActionForm,
+    _chunkZUGJLCYPcjs.SoftwareActionForm,
     {
       action: fixture.action,
       showHeader: false,
@@ -1956,7 +1955,7 @@ function SoftwareUpdateScreen({ compact = false }) {
       initialValues: fixture.initialValues,
       renderPackageSearch,
       renderDevicePicker: () => /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
-        _chunkGI6ECCWBcjs.DeviceSelector,
+        _chunkZUGJLCYPcjs.DeviceSelector,
         {
           devices: selected,
           loading: false,

package/dist/{tickets-board-SQY2Y6QV.cjs → tickets-board-POYZS7BW.cjs}

@@ -10,9 +10,9 @@ var _chunkFDZOE5TLcjs = require('./chunk-FDZOE5TL.cjs');
 
 
 
-var _chunkP63CRPWIcjs = require('./chunk-P63CRPWI.cjs');
-require('./chunk-IUDBG3HJ.cjs');
-require('./chunk-U767P4JU.cjs');
+var _chunk4H3J57ANcjs = require('./chunk-4H3J57AN.cjs');
+require('./chunk-PCQ2HKU3.cjs');
+require('./chunk-STV6VJ3U.cjs');
 require('./chunk-KXFIYO4O.cjs');
 require('./chunk-7HH4Y27U.cjs');
 require('./chunk-QKCF77NZ.cjs');
@@ -1804,11 +1804,11 @@ require('./chunk-LMBYZITR.cjs');
 require('./chunk-TMVC7S2R.cjs');
 require('./chunk-IYHH5EIO.cjs');
 require('./chunk-XIBCMGBW.cjs');
-require('./chunk-IGVAPIEW.cjs');
+require('./chunk-6C4OR4MZ.cjs');
 require('./chunk-WWUSFOJ7.cjs');
 require('./chunk-SKI6NKOE.cjs');
-require('./chunk-W7OFAROY.cjs');
-require('./chunk-SSKMGH5O.cjs');
+require('./chunk-YSXVRTGT.cjs');
+require('./chunk-DXVGGWLG.cjs');
 require('./chunk-S5C3OZCO.cjs');
 require('./chunk-32ASZMTV.cjs');
 require('./chunk-OOYBIS7D.cjs');
@@ -1816,12 +1816,11 @@ require('./chunk-4IYNDV3G.cjs');
 require('./chunk-6VOOPMP5.cjs');
 require('./chunk-ORO54HDF.cjs');
 require('./chunk-RUHKTWGB.cjs');
-require('./chunk-COWMXUHN.cjs');
-require('./chunk-YSDB6HGQ.cjs');
-require('./chunk-FX35L4Y6.cjs');
-require('./chunk-KKFDRCQF.cjs');
-require('./chunk-GI3MMBP3.cjs');
-require('./chunk-GG466XFQ.cjs');
+require('./chunk-GK577ZLJ.cjs');
+require('./chunk-XCQ5I27Z.cjs');
+require('./chunk-RY7INTYU.cjs');
+require('./chunk-6DMH4GXN.cjs');
+require('./chunk-SQ7YHWEP.cjs');
 require('./chunk-VCFQHPOO.cjs');
 require('./chunk-Z74QE57T.cjs');
 require('./chunk-XZJCBIYR.cjs');
@@ -1842,7 +1841,7 @@ function buildTicketsBoardFixture(cast) {
   const dana = assignee(cast.person("dana"));
   const alex = assignee(cast.person("alex"));
   return [
-    _chunkP63CRPWIcjs.columnFromTicketStatus.call(void 0, "ACTIVE", [
+    _chunk4H3J57ANcjs.columnFromTicketStatus.call(void 0, "ACTIVE", [
       ticket("tk-1051", "Printer offline at the front desk", "ACTIVE", {
         ticketNumber: "1051",
         agent: "fae",
@@ -1860,7 +1859,7 @@ function buildTicketsBoardFixture(cast) {
         tags: ["onboarding"]
       })
     ]),
-    _chunkP63CRPWIcjs.columnFromTicketStatus.call(void 0, "TECH_REQUIRED", [
+    _chunk4H3J57ANcjs.columnFromTicketStatus.call(void 0, "TECH_REQUIRED", [
       ticket("tk-1049", "Acrobat Pro for Maya", "TECH_REQUIRED", {
         ticketNumber: "1049",
         agent: "fae",
@@ -1884,7 +1883,7 @@ function buildTicketsBoardFixture(cast) {
         escalatedByUser: true
       })
     ]),
-    _chunkP63CRPWIcjs.columnFromTicketStatus.call(void 0, "ON_HOLD", [
+    _chunk4H3J57ANcjs.columnFromTicketStatus.call(void 0, "ON_HOLD", [
       ticket("tk-1046", "Replace the conference room display", "ON_HOLD", {
         ticketNumber: "1046",
         organizationName: _chunkFDZOE5TLcjs.DEMO_ORGANIZATIONS.acme.name,
@@ -1893,7 +1892,7 @@ function buildTicketsBoardFixture(cast) {
         activity: { kind: "waiting-external" }
       })
     ]),
-    _chunkP63CRPWIcjs.columnFromTicketStatus.call(void 0, 
+    _chunk4H3J57ANcjs.columnFromTicketStatus.call(void 0, 
       "RESOLVED",
       [
         ticket("tk-1048", "Slow laptop", "RESOLVED", {
@@ -1929,7 +1928,7 @@ function TicketsBoardScreen({ compact = false }) {
   const cast = _chunkLHV2R6QUcjs.useProductDemoCast.call(void 0, );
   const board = _react.useMemo.call(void 0, () => buildTicketsBoardFixture(cast), [cast]);
   const columns = compact ? board.filter((column) => column.id !== "ON_HOLD") : board;
-  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "h-full bg-ods-bg p-[var(--spacing-system-m)]", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunkP63CRPWIcjs.Board, { columns, onChange: noop, initialCollapsed: compact ? void 0 : FOLDED }) });
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "div", { className: "h-full bg-ods-bg p-[var(--spacing-system-m)]", children: /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _chunk4H3J57ANcjs.Board, { columns, onChange: noop, initialCollapsed: compact ? void 0 : FOLDED }) });
 }
 
 

package/dist/utils/app-origins.d.ts

@@ -18,12 +18,9 @@ export declare const SERVER_APP_ORIGINS: AppOrigins;
 export declare function readAppOrigins(): AppOrigins;
 /** Called when a host registers, replaces or clears its auth adapter, which can change `allowedOrigins`. */
 export declare const subscribeAppOrigins: (listener: () => void) => () => void;
-/**
- * `url` resolved against the page when it belongs to the app, otherwise `null`.
- *
- * The page match compares scheme and host instead of `URL.origin`, which is
- * `"null"` for a `capacitor://` page.
- */
+/** Whether `target` is on the page's own origin rather than on an origin the host sanctioned. */
+export declare function isPageOriginUrl(target: URL, origins?: AppOrigins): boolean;
+/** `url` resolved against the page when it belongs to the app, otherwise `null`. */
 export declare function resolveAppOriginUrl(url: string, origins?: AppOrigins): URL | null;
 /**
  * Whether `url` loads from the app itself rather than from a third party.

package/dist/utils/app-origins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-origins.d.ts","sourceRoot":"","sources":["../../src/utils/app-origins.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,qHAAqH;IACrH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,6GAA6G;AAC7G,eAAO,MAAM,kBAAkB,EAAE,UAAgF,CAAC;AAOlH;;;GAGG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAqB3C;AAED,4GAA4G;AAC5G,eAAO,MAAM,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAiC,CAAC;AAEpG;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,UAA6B,GAAG,GAAG,GAAG,IAAI,CAYnG;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAEzE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,UAA6B,GAAG,MAAM,GAAG,IAAI,CAOlG"}
+{"version":3,"file":"app-origins.d.ts","sourceRoot":"","sources":["../../src/utils/app-origins.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,qHAAqH;IACrH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,6GAA6G;AAC7G,eAAO,MAAM,kBAAkB,EAAE,UAAgF,CAAC;AAOlH;;;GAGG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAqB3C;AAED,4GAA4G;AAC5G,eAAO,MAAM,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAiC,CAAC;AAOpG,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAE,UAA6B,GAAG,OAAO,CAE5F;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,UAA6B,GAAG,GAAG,GAAG,IAAI,CAYnG;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAEzE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,UAA6B,GAAG,MAAM,GAAG,IAAI,CAOlG"}

package/dist/utils/app-origins.js

@@ -17,6 +17,12 @@ function readAppOrigins() {
   return snapshot;
 }
 const subscribeAppOrigins = subscribeRegisteredAdapter;
+function isOnPage(target, page) {
+  return target.protocol === page.protocol && target.host === page.host;
+}
+function isPageOriginUrl(target, origins = readAppOrigins()) {
+  return isOnPage(target, new URL(origins.pageUrl ?? SERVER_PAGE_URL));
+}
 function resolveAppOriginUrl(url, origins = readAppOrigins()) {
   let page;
   let target;
@@ -26,7 +32,7 @@ function resolveAppOriginUrl(url, origins = readAppOrigins()) {
   } catch {
     return null;
   }
-  if (target.protocol === page.protocol && target.host === page.host) return target;
+  if (isOnPage(target, page)) return target;
   if (target.protocol !== "http:" && target.protocol !== "https:") return null;
   return origins.allowedOrigins.includes(target.origin) ? target : null;
 }
@@ -45,6 +51,7 @@ export {
   SERVER_APP_ORIGINS,
   absoluteHttpUrl,
   isAppOriginUrl,
+  isPageOriginUrl,
   readAppOrigins,
   resolveAppOriginUrl,
   subscribeAppOrigins

package/dist/utils/embed-authed-fetch.d.ts

@@ -99,6 +99,27 @@ export interface EmbedAuthAdapter {
      * remains the rule, this is the narrow exception.
      */
     allowedOrigins?: string[];
+    /**
+     * Optional: where a picture or other asset URL found in the host's data actually lives. Every asset the lib
+     * loads natively (the boxed `Image`, and everything drawn through `useAuthedAsset`) passes its URL through
+     * this first. A backend path that the page's origin does not serve, such as `/images/user/1` stored on a
+     * record but served at `{gateway}/api/images/user/1`, then loads from the gateway on every host, including a
+     * native shell, whose page origin has no server behind it.
+     *
+     * Must be idempotent. It must return absolute URLs and `data:` / `blob:` URLs unchanged, and leave the host's
+     * own static assets alone. Omit it when every URL in the host's data is already loadable as it stands. A host
+     * that registers `next/image` with its optimizer on must allow the hosts this returns in its image config.
+     */
+    resolveAssetUrl?: (url: string) => string;
+    /**
+     * Optional, side-effect-free: whether `getHeaders()` would carry an `Authorization` header now. Declaring it also
+     * says the host authenticates by header: a picture on an origin in `allowedOrigins` then waits for the credential
+     * (`assetLoadMode`'s `awaiting-credential`) instead of loading natively into a 401. The lib asks it for every
+     * mounted picture and right after every credential change, so a host whose `getHeaders` has per-call side effects
+     * needs it to keep classifying from counting as sending.
+     * Without it the lib reads `getHeaders()` and never waits.
+     */
+    hasCredential?: () => boolean;
     /**
      * Optional: call `listener` whenever `getHeaders()` starts returning a NEW
      * credential (a rotation the host ran on its own — e.g. a native shell's
@@ -137,34 +158,28 @@ export declare function hasEmbedAuthAdapter(): boolean;
  */
 export declare function subscribeEmbedCredentialChange(listener: () => void): () => void;
 /**
- * Whether `url` is an asset the browser CANNOT load natively because its
- * auth rides in request headers.
+ * How the browser has to load an asset URL on this host. Native asset loads (`<img src>`, `<track src>`, CSS
+ * `background-image`) can't carry custom headers, so where the host authenticates by HEADER (its adapter has a
+ * credential: `hasCredential`, else an `Authorization` from `getHeaders`) nothing the browser fetches on its own is
+ * authenticated:
  *
- * Native asset loads (`<img src>`, `<track src>`, CSS `background-image`)
- * can't carry custom headers, so a URL this returns `true` for must go
- * through `embedAuthedFetch` → blob object-URL instead (see
- * `useAuthedAssetSrc` / `useAuthedImageSrc`).
- *
- * The single signal is the registered adapter: when it supplies an
- * `Authorization` header, the host authenticates by HEADER, so nothing the
- * browser fetches on its own is authenticated. That holds for BOTH shapes a
- * header-auth host takes:
- *
- *   - a cross-origin gateway URL — sanctioned via `allowedOrigins` (native
- *     shells, whose page origin is `capacitor://` / `tauri://`);
- *   - a same-origin / relative reverse-proxy path (`/content/api/...`) —
- *     dev-ticket web, where the token lives in localStorage and there is NO
- *     session cookie to fall back on. This case used to be excluded on the
- *     assumption that same-origin implies "cookies work"; true for a cookie
- *     session, false for every header-auth host, which is exactly when this
- *     predicate is consulted at all.
- *
- * Everything else loads natively, unchanged: cookie-auth web (the adapter
- * supplies no `Authorization`), no adapter at all (the hub), and third-party
- * origins the bearer does NOT belong to (public images) — those stay out of
- * reach of the token by the same origin rules `embedAuthedFetch` enforces.
+ *   - `native`: hand it to the element as it stands. Cookie-auth web (no credential), no adapter at all (the hub), a
+ *     third-party origin the bearer does NOT belong to (public images: out of the token's reach by the same origin
+ *     rules `embedAuthedFetch` enforces), or a non-http(s) URL (`data:`, `blob:`, a native shell's own bundle).
+ *   - `bearer`: fetch it with the adapter's credential (`embedAuthedFetch`) and draw the blob. That covers both shapes
+ *     a header-auth host takes: a cross-origin gateway sanctioned in `allowedOrigins` (native shells, whose page
+ *     origin is `capacitor://` / `tauri://`), and a same-origin or relative reverse-proxy path (`/content/api/...`)
+ *     on dev-ticket web, where the token lives in localStorage and there is NO session cookie to fall back on.
+ *   - `awaiting-credential`: it lives on a gateway the host sanctioned in `allowedOrigins`, which only the bearer
+ *     opens, and the host, which declared header auth (`hasCredential`), has no credential yet. A native shell
+ *     renders before its tokens arrive: a native load at that moment is a guaranteed 401, so the caller waits for
+ *     `subscribeEmbedCredentialChange` instead.
  */
-export declare function needsBearerAssetFetch(url: string): boolean;
+export type AssetLoadMode = 'native' | 'bearer' | 'awaiting-credential';
+/** `url`'s `AssetLoadMode` on this host now. Pass the URL after `resolveAssetUrl`. */
+export declare function assetLoadMode(url: string): AssetLoadMode;
+/** `url` where the host says it lives (`EmbedAuthAdapter.resolveAssetUrl`); unchanged when no host says. */
+export declare function resolveAssetUrl(url: string): string;
 /**
  * `fetch` wrapper that attaches embed-proxy bearer headers (when
  * present in sessionStorage) and forces `credentials: 'same-origin'`
@@ -201,4 +216,9 @@ export declare function needsBearerAssetFetch(url: string): boolean;
  * the wrapper behaves exactly as described above.
  */
 export declare function embedAuthedFetch(url: string, init?: RequestInit): Promise<Response>;
+/**
+ * Whether `response` answered the retry `embedAuthedFetch` sent after refreshing the credential: a 401 here is a
+ * refusal of a credential just issued, which another refresh will not lift.
+ */
+export declare function answeredAfterRefresh(response: Response): boolean;
 //# sourceMappingURL=embed-authed-fetch.d.ts.map

package/dist/utils/embed-authed-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embed-authed-fetch.d.ts","sourceRoot":"","sources":["../../src/utils/embed-authed-fetch.ts"],"names":[],"mappings":"AA8BA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;4EAMwE;IACxE,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD;;6EAEyE;IACzE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;CAClD;AAOD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAS1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAE/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAM1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkCvF"}
+{"version":3,"file":"embed-authed-fetch.d.ts","sourceRoot":"","sources":["../../src/utils/embed-authed-fetch.ts"],"names":[],"mappings":"AA8BA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;4EAMwE;IACxE,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACtD;;6EAEyE;IACzE,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC;IAC9B;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,MAAM,IAAI,CAAC;CAClD;AAOD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAS1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAE/E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,GAAG,qBAAqB,CAAC;AAExE,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAaxD;AAED,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkCvF;AAwDD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAEhE"}

package/dist/utils/embed-authed-fetch.js

@@ -1,5 +1,5 @@
 "use client";
-import { resolveAppOriginUrl } from "./app-origins.js";
+import { isPageOriginUrl, readAppOrigins, resolveAppOriginUrl } from "./app-origins.js";
 import { readRegisteredAdapter, writeRegisteredAdapter } from "./embed-auth-adapter-registry.js";
 import { applyProxyAuth } from "./embed-proxy-auth-storage.js";
 function getRegisteredAuthAdapter() {
@@ -20,12 +20,20 @@ function subscribeEmbedCredentialChange(listener) {
   return getRegisteredAuthAdapter()?.subscribe?.(listener) ?? (() => {
   });
 }
-function needsBearerAssetFetch(url) {
-  if (typeof window === "undefined") return false;
+function assetLoadMode(url) {
+  if (typeof window === "undefined") return "native";
   const adapter = getRegisteredAuthAdapter();
-  if (!adapter || adapter.getHeaders?.().Authorization === void 0) return false;
-  const target = resolveAppOriginUrl(url);
-  return target !== null && (target.protocol === "http:" || target.protocol === "https:");
+  if (!adapter) return "native";
+  const origins = readAppOrigins();
+  const target = resolveAppOriginUrl(url, origins);
+  if (!target || target.protocol !== "http:" && target.protocol !== "https:") return "native";
+  if (!adapter.hasCredential) return adapter.getHeaders?.().Authorization !== void 0 ? "bearer" : "native";
+  if (adapter.hasCredential()) return "bearer";
+  return isPageOriginUrl(target, origins) ? "native" : "awaiting-credential";
+}
+function resolveAssetUrl(url) {
+  const resolve = getRegisteredAuthAdapter()?.resolveAssetUrl;
+  return resolve ? resolve(url) : url;
 }
 function embedAuthedFetch(url, init = {}) {
   assertSameOrigin(url);
@@ -68,6 +76,10 @@ function dedupedRefresh() {
   }
   return inFlightRefresh;
 }
+const answersAfterRefresh = /* @__PURE__ */ new WeakSet();
+function answeredAfterRefresh(response) {
+  return answersAfterRefresh.has(response);
+}
 async function fetchWithRefresh(url, init, baseHeaders, isRetry) {
   const adapter = getRegisteredAuthAdapter();
   await adapter?.beforeRequest?.();
@@ -92,7 +104,9 @@ async function fetchWithRefresh(url, init, baseHeaders, isRetry) {
   if (response.status === 401 && !isRetry && adapter?.refresh) {
     const refreshed = await dedupedRefresh();
     if (refreshed) {
-      return fetchWithRefresh(url, init, baseHeaders, true);
+      const retried = await fetchWithRefresh(url, init, baseHeaders, true);
+      answersAfterRefresh.add(retried);
+      return retried;
     }
   }
   return response;
@@ -128,9 +142,11 @@ function assertSameOrigin(url) {
   }
 }
 export {
+  answeredAfterRefresh,
+  assetLoadMode,
   embedAuthedFetch,
   hasEmbedAuthAdapter,
-  needsBearerAssetFetch,
+  resolveAssetUrl,
   setEmbedAuthAdapter,
   subscribeEmbedCredentialChange
 };

package/dist/utils/index.cjs

@@ -83636,6 +83636,7 @@ function dedupedRefresh() {
   }
   return inFlightRefresh;
 }
+var answersAfterRefresh = /* @__PURE__ */ new WeakSet();
 async function fetchWithRefresh(url, init, baseHeaders, isRetry) {
   const adapter2 = getRegisteredAuthAdapter();
   await adapter2?.beforeRequest?.();
@@ -83660,7 +83661,9 @@ async function fetchWithRefresh(url, init, baseHeaders, isRetry) {
   if (response.status === 401 && !isRetry && adapter2?.refresh) {
     const refreshed = await dedupedRefresh();
     if (refreshed) {
-      return fetchWithRefresh(url, init, baseHeaders, true);
+      const retried = await fetchWithRefresh(url, init, baseHeaders, true);
+      answersAfterRefresh.add(retried);
+      return retried;
     }
   }
   return response;

package/dist/utils/presentation-for.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The entry of a value → presentation table for a value off the wire, `undefined` for one the table does not know.
+ * Own keys only: `in` or a bare index would answer `toString` or `constructor` with the prototype's function.
+ */
+export declare function presentationFor<K extends string, V>(map: Readonly<Record<K, V>>, key: string | null | undefined): V | undefined;
+//# sourceMappingURL=presentation-for.d.ts.map

package/dist/utils/presentation-for.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentation-for.d.ts","sourceRoot":"","sources":["../../src/utils/presentation-for.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EACjD,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7B,CAAC,GAAG,SAAS,CAEf"}

package/dist/utils/presentation-for.js

@@ -0,0 +1,7 @@
+"use client";
+function presentationFor(map, key) {
+  return key != null && Object.prototype.hasOwnProperty.call(map, key) ? map[key] : void 0;
+}
+export {
+  presentationFor
+};

package/dist/{video-file-player-XMOB234V.cjs → video-file-player-RIOT24NT.cjs}

@@ -16,11 +16,10 @@ var _chunkJKX2C3I2cjs = require('./chunk-JKX2C3I2.cjs');
 var _chunkX432Y6RMcjs = require('./chunk-X432Y6RM.cjs');
 require('./chunk-S5C3OZCO.cjs');
 require('./chunk-4IYNDV3G.cjs');
+require('./chunk-NTPX5GXI.cjs');
 
 
-var _chunkYSDB6HGQcjs = require('./chunk-YSDB6HGQ.cjs');
-require('./chunk-NTPX5GXI.cjs');
-require('./chunk-GI3MMBP3.cjs');
+var _chunkSQ7YHWEPcjs = require('./chunk-SQ7YHWEP.cjs');
 require('./chunk-UJ7AXHRZ.cjs');
 
 
@@ -416,7 +415,7 @@ function FilePlayer({
   const hover = useHoverPlayback(mediaRef, sound, { playOnHover, playWhenHovered, mutedIntent });
   const health = usePlaybackHealth(mediaRef, url, !chromeless);
   useIosNativeVideoFullscreen(mediaRef);
-  const captions = _chunkYSDB6HGQcjs.useAuthedAssetSrc.call(void 0, captionsUrl, "text/vtt, */*");
+  const captions = _chunkSQ7YHWEPcjs.useAuthedAssetSrc.call(void 0, captionsUrl, "text/vtt, */*");
   const player = /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
     _muxplayerreact2.default,
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flamingo-stack/openframe-frontend-core",
-  "version": "0.0.853",
+  "version": "0.0.855",
   "description": "Shared design system and components for all Flamingo platforms",
   "type": "module",
   "sideEffects": [

package/src/components/chat/chat-message-row.tsx

@@ -19,8 +19,10 @@
  * "N replies" badge; the ticket feed passes `<TicketAttachmentsList>`.
  */
 
-import { useState, type ReactNode } from 'react';
+import type { ReactNode } from 'react';
 import Image from '../../embed-shims/next-image';
+import { useAuthedImageSrc } from '../../hooks/use-authed-image-src';
+import { useImageFallback } from '../../hooks/use-image-fallback';
 import { AVATAR_SIZE_PX } from '../../styles/component-sizes';
 import { cn } from '../../utils/cn';
 import { personInitials } from '../../utils/format';
@@ -84,11 +86,10 @@ function ChatMessageRowLoaded(props: ChatMessageRowProps) {
   const proxiedAvatar = useProxiedImageUrl(avatarUrl ?? '');
   const resolvedAvatar = proxiedAvatar || avatarUrl || undefined;
   // Fall back to the initials box if the avatar load FAILS (transient CDN 429,
-  // ad-blocker, dead URL) instead of showing a broken image. Keyed on the URL
-  // (not a bool) so a later render with a DIFFERENT avatar re-attempts the load
-  // rather than inheriting a stale failure.
-  const [failedSrc, setFailedSrc] = useState<string | null>(null);
-  const src = resolvedAvatar && resolvedAvatar !== failedSrc ? resolvedAvatar : undefined;
+  // ad-blocker, dead URL) instead of showing a broken image.
+  // Keyed on the store's answer, not the URL: this row keeps holding the avatar's store entry, so where it needs the
+  // bearer, a fetch that got no answer, or a 401 the session can refresh past, is retried and the picture comes back.
+  const { src, onError } = useImageFallback(useAuthedImageSrc(resolvedAvatar));
   const hasBody = typeof body === 'string' ? body.trim().length > 0 : body != null && body !== false;
 
   return (
@@ -103,7 +104,7 @@ function ChatMessageRowLoaded(props: ChatMessageRowProps) {
           className={cn(AVATAR_BOX_CLASS, 'object-cover')}
           width={AVATAR_SIZE_PX.md}
           height={AVATAR_SIZE_PX.md}
-          onError={() => setFailedSrc(resolvedAvatar ?? null)}
+          onError={onError}
         />
       ) : (
         <div

package/src/components/chat/entity-cards/use-cover-image-fallback.ts

@@ -8,42 +8,22 @@
  * ternary (they drift: the pre-hook BlogCard chain couldn't recover from a
  * FAILING placeholder, EntityPortraitCard duplicated the same logic with
  * different state). Cards wire `src` + `onError` and render their own
- * empty-state when `src` is null.
- *
- * Implementation note: state is the SET of candidate URLs that failed, and
- * `src` is derived — so a prop change (new cover URL) re-resolves instantly
- * with no reset effect, and a URL that failed once isn't retried in a loop.
+ * empty-state when `src` is null. The chain itself is `useImageFallback`.
  */
 
-import { useCallback, useState, type SyntheticEvent } from 'react';
+import type { SyntheticEvent } from 'react';
+import { type ImageFallback, useImageFallback } from '../../../hooks/use-image-fallback';
 
-export interface CoverImageFallback {
-  /** Resolved source: first non-failed of [imageUrl, placeholderUrl], else null. */
-  src: string | null;
-  /** Wire to the media element's `onError`. */
-  onError: () => void;
-}
+export type CoverImageFallback = ImageFallback;
 
 export function useCoverImageFallback(imageUrl?: string | null, placeholderUrl?: string | null): CoverImageFallback {
-  const [failed, setFailed] = useState<ReadonlySet<string>>(() => new Set());
-
-  const src =
-    imageUrl && !failed.has(imageUrl)
-      ? imageUrl
-      : placeholderUrl && !failed.has(placeholderUrl)
-        ? placeholderUrl
-        : null;
-
-  const onError = useCallback(() => {
-    if (!src) return;
-    setFailed(prev => new Set(prev).add(src));
-  }, [src]);
-
-  return { src, onError };
+  return useImageFallback(imageUrl, placeholderUrl);
 }
 
 /** Fallback for cards with NO placeholder chain (compact/sm image slots):
- *  a broken cover simply disappears, leaving the slot's background. */
+ *  a broken cover simply disappears, leaving the slot's background.
+ *  Legacy: a DOM write in `onError`, which the next src does not undo. New
+ *  code renders nothing when `useImageFallback(url).src` is null instead. */
 export const hideOnError = (e: SyntheticEvent<HTMLImageElement>) => {
   const img = e.currentTarget;
   img.style.display = 'none';