@idapt/browser-app-sdk 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,6 @@
+Idapt browser-app runtime SDK (@idapt/browser-app-sdk)
+Copyright 2025-2026 Idapt
+
+This product includes software developed by Idapt (https://idapt.app).
+
+Licensed under the Apache License, Version 2.0. See the LICENSE file.

package/README.md

@@ -0,0 +1,53 @@
+# @idapt/browser-app-sdk
+
+The runtime SDK for **apps that run inside [idapt](https://idapt.app)**. Browser
+apps are **npm-only**: you `npm install @idapt/browser-app-sdk`, import it, and
+your build bundles it — the server does NOT inject a global SDK. It gives an
+in-idapt app the glue beyond plain API calls:
+
+- the **cookie auto-connect** (auto sign-in for your app, no key handling),
+- per-app **key/value data** (`client.data.*`) and your app's **bundle reader**,
+- the workspace **data plane** — `client.kv` (Datastore KV), `client.blobs`
+  (object store), `client.tables` (structured documents), and `client.realtime`
+  (broadcast / presence / live subscribe),
+- the **React hooks** (`@idapt/browser-app-sdk/react`) — including
+  `useChannel` / `usePresence` / `useLiveQuery` for realtime,
+- the full v1 API surface (it composes
+  [`@idapt/sdk`](https://www.npmjs.com/package/@idapt/sdk)).
+
+There is **no off-idapt local mode** and **no `window.Idapt` IIFE** — an app
+built with this SDK must run on idapt (the cookie bootstrap needs the idapt
+origin). `connect()` throws if the app is not served by idapt.
+
+## Usage
+
+```ts
+import { connect } from "@idapt/browser-app-sdk";
+
+// On an idapt app subdomain the app-key cookie auto-connects — no args needed:
+const client = await connect();
+await client.data.setJSON("prefs.json", { theme: "dark" });
+const me = await client.user.me();
+```
+
+For library / server use (outside an app subdomain), pass an explicit key:
+
+```ts
+const client = await connect({ apiUrl: "https://idapt.app", key: process.env.IDAPT_API_KEY! });
+```
+
+## Development
+
+The package emits the npm library bundle with `npm run build`. The local
+Kubernetes API dev image and Tilt live-update use the equivalent
+`npm run build:browser` alias so browser-app SDK rebuilds can stay scoped to the
+browser runtime package.
+
+## Links
+
+- [Developer docs](https://idapt.app/developers)
+- [`@idapt/sdk`](https://www.npmjs.com/package/@idapt/sdk)
+
+## License
+
+Apache-2.0 — see [LICENSE](./LICENSE) and [NOTICE](./NOTICE).

package/dist/chunk-6FSNLUVJ.js

@@ -0,0 +1,435 @@
+import { AppFolder, DataFolder, UserApi, FilesApi, AgentsApi, ChatsApi, WorkspacesApi, TriggersApi, ComputersApi, SecretsApi, DatastoreApi, BlobsApi, TablesApi, RealtimeApi, ApiKeysApi, NotificationsApi, SettingsApi, SubscriptionApi, SharingApi, StoreApi, ModelsApi, ProviderEndpointsApi, ImagesApi, AudioApi, CodeRunsApi, SearchApi, WebSearchApi, GuideApi, DocsApi } from './chunk-AQZ2QVBK.js';
+
+// src/client.ts
+var IdaptClient = class {
+  constructor(deps) {
+    this.deps = deps;
+    const cred = deps.credential;
+    this.mode = "remote";
+    const auth = cred.auth ?? (cred.key ? "bearer" : "cookie");
+    const ctx = {
+      apiUrl: cred.apiUrl,
+      key: cred.key ?? "",
+      auth,
+      fetch: deps.fetch
+    };
+    this.ctx = ctx;
+    const dataCtx = ctx;
+    let v1Ctx = ctx;
+    if (auth === "cookie") {
+      const mintToken = this.makeAppTokenMinter(ctx.apiUrl, deps.fetch);
+      v1Ctx = {
+        ...ctx,
+        getToken: mintToken.get,
+        onUnauthorized: mintToken.invalidate
+      };
+    }
+    const appResourceId = deriveAppId(cred, deps.browserAppDomain);
+    this.app = new AppFolder(v1Ctx, cred.appFolderId);
+    this.data = new DataFolder(dataCtx, appResourceId);
+    this.user = new UserApi(v1Ctx);
+    this.files = new FilesApi(v1Ctx);
+    this.agents = new AgentsApi(v1Ctx);
+    this.chats = new ChatsApi(v1Ctx);
+    this.workspaces = new WorkspacesApi(v1Ctx);
+    this.triggers = new TriggersApi(v1Ctx);
+    this.computers = new ComputersApi(v1Ctx);
+    this.secrets = new SecretsApi(v1Ctx);
+    this.kv = new DatastoreApi(v1Ctx);
+    this.blobs = new BlobsApi(v1Ctx);
+    this.tables = new TablesApi(v1Ctx);
+    this.realtime = new RealtimeApi(v1Ctx);
+    this.apiKeys = new ApiKeysApi(v1Ctx);
+    this.notifications = new NotificationsApi(v1Ctx);
+    this.settings = new SettingsApi(v1Ctx);
+    this.subscription = new SubscriptionApi(v1Ctx);
+    this.sharing = new SharingApi(v1Ctx);
+    this.store = new StoreApi(v1Ctx);
+    this.models = new ModelsApi(v1Ctx);
+    this.providerEndpoints = new ProviderEndpointsApi(v1Ctx);
+    this.images = new ImagesApi(v1Ctx);
+    this.audio = new AudioApi(v1Ctx);
+    this.code = new CodeRunsApi(v1Ctx);
+    this.search = new SearchApi(v1Ctx);
+    this.web = new WebSearchApi(v1Ctx);
+    this.guide = new GuideApi(v1Ctx);
+    this.docs = new DocsApi(v1Ctx);
+    this.meta = {
+      appId: appResourceId,
+      apiUrl: cred.apiUrl,
+      appFolderId: cred.appFolderId,
+      dataFolderId: cred.dataFolderId,
+      mode: this.mode
+    };
+  }
+  /**
+   * The `ap_`/`uk_` key — use only for raw v1 calls the SDK doesn't wrap.
+   * In cookie mode there is no raw key — it lives only in the httpOnly app-key
+   * cookie the browser attaches automatically — so this throws; use the SDK
+   * surfaces (or `getAuthToken()` for ad-hoc bearer use) instead.
+   */
+  getApiKey() {
+    if (this.ctx.auth === "cookie" || !this.ctx.key) {
+      throw new Error(
+        "getApiKey() is unavailable in cookie mode \u2014 the app key lives only in the httpOnly cookie. Use the SDK surfaces or getAuthToken() instead."
+      );
+    }
+    return this.ctx.key;
+  }
+  /** API base URL the client targets. */
+  getApiUrl() {
+    return this.ctx.apiUrl;
+  }
+  /**
+   * Mint a short-lived JWT for ad-hoc Bearer use (custom fetch calls,
+   * third-party libraries, WebSocket protocols). Expires after ~15 min —
+   * cache in memory, never persist to localStorage.
+   *
+   * Two mint paths depending on auth mode:
+   *   - **bearer/library** — the raw `uk_`/`ap_` key authenticates better-auth's
+   *     `/api/auth/token` directly.
+   *   - **cookie** — the iframe carries only the httpOnly `__Secure-idapt_app_key`
+   *     cookie, which better-auth's session-based `/api/auth/token` can't see.
+   *     We mint via `/api/browser-app/token` instead (resolves the app principal
+   *     from that cookie). The request rides `credentials: "include"` and sends
+   *     NO empty `Bearer` header.
+   */
+  async getAuthToken() {
+    if (this.ctx.auth === "cookie") {
+      return (await this.fetchAppToken(this.ctx.apiUrl, this.deps.fetch)).token;
+    }
+    const doFetch = this.deps.fetch ?? globalThis.fetch;
+    if (!doFetch) throw new Error("No fetch implementation available");
+    const res = await doFetch(`${this.ctx.apiUrl}/api/auth/token`, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${this.ctx.key}`,
+        "Sec-Fetch-Site": "same-origin"
+      }
+    });
+    if (!res.ok) throw new Error(`getAuthToken failed: ${res.status}`);
+    const body = await res.json();
+    if (!body.token) throw new Error("getAuthToken: missing token in response");
+    return body.token;
+  }
+  /**
+   * Low-level mint against `/api/browser-app/token` — exchanges the httpOnly
+   * app cookie for a short-lived `idapt-api` JWT. Used by the cookie-mode v1
+   * surfaces' token provider AND by `getAuthToken()` in cookie mode.
+   *
+   * Carries the app cookie via `credentials: "include"`; sends `Sec-Fetch-Site:
+   * same-origin` so the server's CSRF guard accepts it (the SDK only ever runs
+   * same-origin under the app subdomain in cookie mode).
+   */
+  async fetchAppToken(apiUrl, fetchImpl) {
+    const doFetch = fetchImpl ?? globalThis.fetch;
+    if (!doFetch) throw new Error("No fetch implementation available");
+    const res = await doFetch(`${apiUrl}/api/browser-app/token`, {
+      method: "GET",
+      headers: { "Sec-Fetch-Site": "same-origin" },
+      credentials: "include"
+    });
+    if (!res.ok) throw new Error(`app token mint failed: ${res.status}`);
+    const body = await res.json();
+    if (!body.token) throw new Error("app token mint: missing token");
+    const expiresAt = typeof body.expiresAt === "number" ? body.expiresAt : Date.now();
+    return { token: body.token, expiresAt };
+  }
+  /**
+   * Build a lazily-minting, self-refreshing app-token provider for the
+   * cookie-mode v1 contexts. Caches the JWT until ~30 s before its stated
+   * expiry; `invalidate()` (wired to the request layer's 401 hook) drops the
+   * cache so the next call re-mints.
+   */
+  makeAppTokenMinter(apiUrl, fetchImpl) {
+    const SKEW_MS = 3e4;
+    let cached = null;
+    let inflight = null;
+    const get = async () => {
+      if (cached && cached.expiresAt - SKEW_MS > Date.now()) {
+        return cached.token;
+      }
+      if (!inflight) {
+        inflight = this.fetchAppToken(apiUrl, fetchImpl).finally(() => {
+          inflight = null;
+        });
+      }
+      const minted = await inflight;
+      cached = minted;
+      return minted.token;
+    };
+    const invalidate = () => {
+      cached = null;
+    };
+    return { get, invalidate };
+  }
+  /**
+   * Request additional scopes at runtime. Navigates to the consent page;
+   * the returned promise never resolves because the page is navigating away.
+   *
+   * The credential doesn't change — principal.authorization is broadened
+   * server-side. When the user lands back in the app, the cached key now
+   * has the new scope.
+   */
+  escalate(permissions) {
+    const appId = this.meta.appId;
+    const url = `${this.ctx.apiUrl.replace(/\/+$/, "")}/apps/${encodeURIComponent(appId)}?standalone_return=1`;
+    this.navigate(url);
+    return new Promise(() => {
+    });
+  }
+  /**
+   * No-op in the cookie-based flow — the `__idapt_app_key` cookie is
+   * httpOnly + server-managed, so the SDK can't clear it from JS. To end a
+   * hosted session, revoke the credential from the main-app Connected Apps
+   * settings.
+   */
+  disconnect() {
+  }
+  navigate(url) {
+    if (this.deps.navigate) {
+      this.deps.navigate(url);
+      return;
+    }
+    if (typeof window !== "undefined") {
+      window.location.href = url;
+    }
+  }
+};
+function deriveAppId(cred, _browserAppDomain) {
+  if (cred.appResourceId) return cred.appResourceId;
+  if (typeof window === "undefined") return "";
+  try {
+    const host = window.location.hostname;
+    return host.split(".")[0]?.toLowerCase() ?? "";
+  } catch {
+    return cred.appFolderId;
+  }
+}
+
+// src/detect.ts
+function detectAppId(browserAppDomain, loc) {
+  const location = loc ?? safeWindowLocation();
+  if (!location) return "";
+  if (browserAppDomain && location.hostname.endsWith(`.${browserAppDomain}`)) {
+    const label = location.hostname.slice(
+      0,
+      location.hostname.length - browserAppDomain.length - 1
+    );
+    return label.toLowerCase();
+  }
+  const first = location.hostname.split(".")[0];
+  return first ? first.toLowerCase() : "";
+}
+function getAppBaseUrl(_browserAppDomain, loc) {
+  const location = loc ?? safeWindowLocation();
+  if (!location) return "";
+  return location.origin;
+}
+function safeWindowLocation() {
+  if (typeof window === "undefined") return void 0;
+  return window.location;
+}
+
+// src/connect.ts
+var NOT_ON_IDAPT = "idapt SDK: not connected \u2014 this app must run on idapt";
+var LOOP_KEY = "idapt:reauth-at";
+var LOOP_WINDOW_MS = 3e4;
+function sessionStorageSafe() {
+  try {
+    if (typeof window === "undefined") return null;
+    return window.sessionStorage ?? null;
+  } catch {
+    return null;
+  }
+}
+function readLoopMarker() {
+  const ss = sessionStorageSafe();
+  if (!ss) return 0;
+  try {
+    const raw = ss.getItem(LOOP_KEY);
+    if (!raw) return 0;
+    const n = Number(raw);
+    return Number.isFinite(n) ? n : 0;
+  } catch {
+    return 0;
+  }
+}
+function writeLoopMarker(ts) {
+  const ss = sessionStorageSafe();
+  if (!ss) return;
+  try {
+    ss.setItem(LOOP_KEY, String(ts));
+  } catch {
+  }
+}
+function clearLoopMarker() {
+  const ss = sessionStorageSafe();
+  if (!ss) return;
+  try {
+    ss.removeItem(LOOP_KEY);
+  } catch {
+  }
+}
+function makeConnect(defaults) {
+  return async function connect2(options = {}) {
+    const apiUrl = options.apiUrl || defaults.apiUrl;
+    const browserAppDomain = options.browserAppDomain !== void 0 ? options.browserAppDomain : defaults.browserAppDomain;
+    const location = resolveLocation(options);
+    if (options.key) {
+      if (!apiUrl) {
+        return Promise.reject(new Error("connect({ key }) requires `apiUrl`"));
+      }
+      return new IdaptClient({
+        credential: {
+          key: options.key,
+          apiUrl,
+          appResourceId: detectAppId(browserAppDomain, location) || void 0,
+          appFolderId: "",
+          dataFolderId: "",
+          mode: "remote"
+        },
+        browserAppDomain,
+        fetch: options.fetch
+      });
+    }
+    const boot = await readBootstrap(options);
+    if (boot.credential) {
+      clearLoopMarker();
+      return new IdaptClient({
+        credential: boot.credential,
+        browserAppDomain,
+        fetch: options.fetch
+      });
+    }
+    if (typeof window === "undefined") {
+      return Promise.reject(
+        new Error("connect() requires a browser environment")
+      );
+    }
+    if (!boot.reachable && !boot.authorizeUrl) {
+      return Promise.reject(new Error(NOT_ON_IDAPT));
+    }
+    const lastAttempt = readLoopMarker();
+    if (lastAttempt && Date.now() - lastAttempt < LOOP_WINDOW_MS) {
+      clearLoopMarker();
+      return Promise.reject(
+        new Error(
+          "idapt: connection failed after authorization. The app-key cookie was not delivered back to the server \u2014 this usually means third-party cookies are blocked, an extension is stripping the request, or a CDN is filtering the cookie. Open the app directly in a new tab, or disable third-party cookie blocking for this site."
+        )
+      );
+    }
+    const isEmbedded = (() => {
+      try {
+        return !!window.parent && window.parent !== window;
+      } catch {
+        return false;
+      }
+    })();
+    if (isEmbedded) {
+      try {
+        window.parent.postMessage({ type: "idapt:reauth-needed" }, "*");
+      } catch {
+      }
+      const err2 = new Error(
+        "idapt: bootstrap 401 inside iframe \u2014 waiting for parent to re-provision"
+      );
+      err2.__redirecting = true;
+      return Promise.reject(err2);
+    }
+    const target = buildAuthorizeUrl({
+      serverHint: boot.authorizeUrl,
+      apiUrl,
+      browserAppDomain,
+      location
+    });
+    writeLoopMarker(Date.now());
+    window.location.href = target;
+    const err = new Error(
+      "idapt: redirecting to authorize"
+    );
+    err.__redirecting = true;
+    return Promise.reject(err);
+  };
+}
+async function readBootstrap(options) {
+  const empty = {
+    credential: null,
+    authorizeUrl: null,
+    reachable: false
+  };
+  if (typeof window === "undefined") return empty;
+  const fetcher = options.fetch ?? globalThis.fetch;
+  if (typeof fetcher !== "function") return empty;
+  try {
+    const res = await fetcher("/__idapt__/bootstrap", {
+      credentials: "include"
+    });
+    if (!res.ok) {
+      if (res.status === 401) {
+        const hdr = typeof res.headers?.get === "function" ? res.headers.get("x-idapt-authorize-url") : null;
+        return { credential: null, authorizeUrl: hdr, reachable: true };
+      }
+      return empty;
+    }
+    const body = await res.json().catch(() => null);
+    const appResourceId = typeof body?.appResourceId === "string" ? body.appResourceId : null;
+    if (!appResourceId) {
+      return { credential: null, authorizeUrl: null, reachable: true };
+    }
+    return {
+      credential: {
+        key: null,
+        apiUrl: window.location.origin,
+        appResourceId,
+        appFolderId: "",
+        dataFolderId: "",
+        mode: "remote",
+        auth: "cookie"
+      },
+      authorizeUrl: null,
+      reachable: true
+    };
+  } catch {
+    return empty;
+  }
+}
+function buildAuthorizeUrl(params) {
+  const { serverHint, apiUrl, browserAppDomain, location } = params;
+  if (serverHint && /^https?:\/\//i.test(serverHint)) {
+    return serverHint;
+  }
+  if (serverHint?.startsWith("/")) {
+    const base2 = apiUrl.replace(/\/+$/, "");
+    const url = new URL(serverHint, base2);
+    url.searchParams.set("standalone_return", "1");
+    return url.toString();
+  }
+  const appId = detectAppId(browserAppDomain, location);
+  const base = apiUrl.replace(/\/+$/, "");
+  return `${base}/apps/${encodeURIComponent(appId)}?standalone_return=1`;
+}
+function resolveLocation(options) {
+  if (options.location) return options.location;
+  if (typeof window !== "undefined") return window.location;
+  return {
+    hostname: "",
+    pathname: "",
+    origin: "",
+    href: "",
+    search: ""
+  };
+}
+
+// src/index.ts
+function connect(options = {}) {
+  return makeConnect({
+    apiUrl: options.apiUrl ?? "",
+    browserAppDomain: options.browserAppDomain ?? ""
+  })(options);
+}
+var Idapt = { connect };
+
+export { Idapt, IdaptClient, connect, detectAppId, getAppBaseUrl, makeConnect };
+//# sourceMappingURL=chunk-6FSNLUVJ.js.map
+//# sourceMappingURL=chunk-6FSNLUVJ.js.map