@kortix/sdk 0.9.98

package/dist/platform/api-client.d.ts

@@ -0,0 +1,35 @@
+import { ApiError } from './api/errors.js';
+export { ApiError, AuthError, BillingError, RequestTooLargeError, parseBillingError, isBillingError, formatBillingErrorForUI, type ApiErrorFields, type BillingErrorUI, } from './api/errors.js';
+export interface ErrorContext {
+    operation?: string;
+    resource?: string;
+    silent?: boolean;
+}
+export interface ApiClientOptions {
+    showErrors?: boolean;
+    errorContext?: ErrorContext;
+    timeout?: number;
+}
+export interface ApiResponse<T = any> {
+    data?: T;
+    error?: ApiError;
+    success: boolean;
+}
+export declare function setAdminBypass(enabled: boolean): void;
+export declare function isAdminBypassEnabled(): boolean;
+export declare const supabaseClient: {
+    execute<T = any>(queryFn: () => Promise<{
+        data: T | null;
+        error: any;
+    }>, errorContext?: ErrorContext): Promise<ApiResponse<T>>;
+};
+export declare const backendApi: {
+    get: <T = any>(endpoint: string, options?: Omit<RequestInit & ApiClientOptions, "method" | "body">) => Promise<ApiResponse<T>>;
+    post: <T = any>(endpoint: string, data?: any, options?: Omit<RequestInit & ApiClientOptions, "method">) => Promise<ApiResponse<T>>;
+    put: <T = any>(endpoint: string, data?: any, options?: Omit<RequestInit & ApiClientOptions, "method">) => Promise<ApiResponse<T>>;
+    patch: <T = any>(endpoint: string, data?: any, options?: Omit<RequestInit & ApiClientOptions, "method">) => Promise<ApiResponse<T>>;
+    delete: <T = any>(endpoint: string, options?: Omit<RequestInit & ApiClientOptions, "method" | "body">) => Promise<ApiResponse<T>>;
+    upload: <T = any>(endpoint: string, formData: FormData, options?: Omit<RequestInit & ApiClientOptions, "method" | "body">) => Promise<ApiResponse<T>>;
+    uploadPut: <T = any>(endpoint: string, formData: FormData, options?: Omit<RequestInit & ApiClientOptions, "method" | "body">) => Promise<ApiResponse<T>>;
+};
+//# sourceMappingURL=api-client.d.ts.map

package/dist/platform/api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../../src/platform/api-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAsD,MAAM,cAAc,CAAC;AAQ5F,OAAO,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,GAAG;IAClC,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAUD,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAErD;AAED,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAuND,eAAO,MAAM,cAAc;YACX,CAAC,iBACJ,MAAM,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,GAAG,CAAA;KAAE,CAAC,iBACvC,YAAY,GAC1B,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CAmC3B,CAAC;AAEF,eAAO,MAAM,UAAU;UACf,CAAC,kBAAkB,MAAM,YAAY,IAAI,CAAC,WAAW,GAAG,gBAAgB,EAAE,QAAQ,GAAG,MAAM,CAAC;WAG3F,CAAC,kBAAkB,MAAM,SAAS,GAAG,YAAY,IAAI,CAAC,WAAW,GAAG,gBAAgB,EAAE,QAAQ,CAAC;UAOhG,CAAC,kBAAkB,MAAM,SAAS,GAAG,YAAY,IAAI,CAAC,WAAW,GAAG,gBAAgB,EAAE,QAAQ,CAAC;YAO7F,CAAC,kBAAkB,MAAM,SAAS,GAAG,YAAY,IAAI,CAAC,WAAW,GAAG,gBAAgB,EAAE,QAAQ,CAAC;aAO9F,CAAC,kBAAkB,MAAM,YAAY,IAAI,CAAC,WAAW,GAAG,gBAAgB,EAAE,QAAQ,GAAG,MAAM,CAAC;aAG5F,CAAC,kBAAkB,MAAM,YAAY,QAAQ,YAAY,IAAI,CAAC,WAAW,GAAG,gBAAgB,EAAE,QAAQ,GAAG,MAAM,CAAC;gBAa7G,CAAC,kBAAkB,MAAM,YAAY,QAAQ,YAAY,IAAI,CAAC,WAAW,GAAG,gBAAgB,EAAE,QAAQ,GAAG,MAAM,CAAC;CAY7H,CAAC"}

package/dist/platform/api-client.js

@@ -0,0 +1,279 @@
+import { platformConfig } from './config.js';
+import { getSupabaseAccessTokenWithRetry } from './auth.js';
+import { ApiError, AuthError, parseBillingError, RequestTooLargeError } from './api/errors.js';
+const getApiUrl = () => platformConfig().backendUrl || '';
+// Ported from web's error-handler. User-facing error handling is routed
+// through platformConfig().onError?.() instead of web's handleApiError.
+// The error classes live in ./api/errors — re-exported here so both the
+// root barrel and the `@kortix/sdk/api-client` subpath expose them.
+export { ApiError, AuthError, BillingError, RequestTooLargeError, parseBillingError, isBillingError, formatBillingErrorForUI, } from './api/errors.js';
+// Platform-admin read-only bypass toggle (web only). In-memory, per-tab — never
+// persisted — so it resets on reload and can't linger silently. When on, every
+// request from this client carries `x-kortix-admin-bypass: 1`; the API only
+// honors it for a real platform admin/super_admin on a `read` action (see
+// apps/api/src/projects/lib/access.ts), so this is safe to set unconditionally
+// here rather than threading it through every call site.
+let adminBypassEnabled = false;
+export function setAdminBypass(enabled) {
+    adminBypassEnabled = enabled;
+}
+export function isAdminBypassEnabled() {
+    return adminBypassEnabled;
+}
+async function makeRequest(url, options = {}) {
+    const { showErrors = true, errorContext, timeout = 30000, ...fetchOptions } = options;
+    const controller = new AbortController();
+    let timeoutId = null;
+    let isAborted = false;
+    // Tracks whether *our* timer fired the abort, vs. an external abort
+    // (client navigation, tab close, dropped connection). Only the former is a
+    // real timeout; the latter must not be surfaced as one.
+    let didTimeout = false;
+    try {
+        timeoutId = setTimeout(() => {
+            if (!isAborted && !controller.signal.aborted) {
+                isAborted = true;
+                didTimeout = true;
+                controller.abort();
+            }
+        }, timeout);
+        const token = await getSupabaseAccessTokenWithRetry();
+        // Don't set Content-Type for FormData - browser will set it automatically with boundary
+        const isFormData = fetchOptions.body instanceof FormData;
+        const headers = {};
+        if (!isFormData) {
+            headers['Content-Type'] = 'application/json';
+        }
+        // Merge with any headers from fetchOptions
+        Object.assign(headers, fetchOptions.headers);
+        if (adminBypassEnabled) {
+            headers['x-kortix-admin-bypass'] = '1';
+        }
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+        }
+        else {
+            // No session yet — Supabase hasn't hydrated from cookies.
+            // Return a silent failure instead of sending a naked request that will 401.
+            // Callers gated by `enabled: !!user` should prevent this path, but this
+            // is a safety net for any calls that slip through.
+            return {
+                error: new AuthError(),
+                success: false,
+            };
+        }
+        // Note: X-Refresh-Token was removed to reduce header size and prevent HTTP 431 errors.
+        // The backend handles token refresh via Supabase directly.
+        const response = await fetch(url, {
+            ...fetchOptions,
+            headers,
+            signal: controller.signal,
+            // API auth is bearer-token based. Don't send browser cookies to the
+            // same-origin /v1 proxy; large localhost cookie jars can trip HTTP 431
+            // before the request reaches the API.
+            credentials: fetchOptions.credentials ?? 'omit',
+        });
+        if (timeoutId) {
+            clearTimeout(timeoutId);
+            timeoutId = null;
+        }
+        if (!response.ok) {
+            let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
+            let errorData = null;
+            try {
+                errorData = await response.json();
+                if (errorData.message) {
+                    errorMessage = errorData.message;
+                }
+                else if (errorData.error && typeof errorData.error === 'string') {
+                    errorMessage = errorData.error;
+                }
+                else if (typeof errorData.detail === 'string') {
+                    // FastAPI returns {"detail": "error message"}
+                    errorMessage = errorData.detail;
+                }
+                else if (errorData.detail?.message) {
+                    errorMessage = errorData.detail.message;
+                }
+            }
+            catch {
+            }
+            let error = new ApiError(errorMessage, {
+                status: response.status,
+                response: response,
+                details: errorData || undefined,
+                data: errorData,
+                detail: errorData?.detail,
+                code: errorData?.code || errorData?.error_code || errorData?.detail?.error_code || response.status.toString()
+            });
+            if (response.status === 402) {
+                error = parseBillingError(error);
+            }
+            // Handle HTTP 431 - Request Header Fields Too Large
+            // This typically happens when uploading many files at once
+            if (response.status === 431) {
+                error = new RequestTooLargeError(431, {
+                    message: 'Request is too large to process',
+                    suggestion: 'Try uploading files one at a time, or reduce the number of files attached to your message.',
+                });
+            }
+            if (showErrors) {
+                platformConfig().onError?.(error, errorContext);
+            }
+            return {
+                error,
+                success: false,
+            };
+        }
+        let data;
+        const contentType = response.headers.get('content-type');
+        if (contentType?.includes('application/json')) {
+            data = await response.json();
+        }
+        else if (contentType?.includes('text/')) {
+            data = await response.text();
+        }
+        else {
+            data = await response.blob();
+        }
+        return {
+            data,
+            success: true,
+        };
+    }
+    catch (error) {
+        // Always clear timeout on error
+        if (timeoutId) {
+            clearTimeout(timeoutId);
+            timeoutId = null;
+        }
+        // Check if this is an abort error (timeout or manual abort)
+        const isAbortError = error?.name === 'AbortError' ||
+            error?.name === 'AbortSignal' ||
+            (error instanceof Error && error.message.includes('aborted'));
+        // If it was aborted, mark it so we don't try to abort again
+        if (isAbortError) {
+            isAborted = true;
+        }
+        let apiError;
+        if (isAbortError) {
+            // An external abort (Next.js client navigation, tab close, React Query
+            // cancelling an in-flight request, a dropped connection) is NOT a
+            // timeout — surfacing it as one produced the mysterious, URL-less
+            // "Request timeout" toasts/Sentry events. Swallow it silently.
+            if (!didTimeout) {
+                return {
+                    error: new ApiError('Request aborted', { name: 'AbortError', code: 'ABORTED' }),
+                    success: false,
+                };
+            }
+            // Genuine timeout — our timer fired. Attach the endpoint so it's clear
+            // *what* timed out (the previous error carried no URL).
+            const endpoint = url.replace(getApiUrl(), '') || url;
+            apiError = new ApiError(`Request timed out after ${Math.round(timeout / 1000)}s: ${endpoint}`, {
+                code: 'TIMEOUT',
+                url,
+                endpoint,
+                timeout,
+            });
+            // Only show timeout errors if showErrors is true
+            // This prevents spam from multiple concurrent timeouts or React Query cancellations
+            if (showErrors) {
+                platformConfig().onError?.(apiError, errorContext);
+            }
+        }
+        else if (error instanceof Error) {
+            apiError = new ApiError(error.message, {
+                name: error.name || 'ApiError',
+                stack: error.stack,
+            });
+            if (showErrors) {
+                platformConfig().onError?.(apiError, errorContext);
+            }
+        }
+        else {
+            apiError = new ApiError(String(error));
+            if (showErrors) {
+                platformConfig().onError?.(apiError, errorContext);
+            }
+        }
+        return {
+            error: apiError,
+            success: false,
+        };
+    }
+}
+export const supabaseClient = {
+    async execute(queryFn, errorContext) {
+        try {
+            const { data, error } = await queryFn();
+            if (error) {
+                const apiError = new ApiError(error.message || 'Database error', {
+                    code: error.code,
+                    details: error,
+                });
+                platformConfig().onError?.(apiError, errorContext);
+                return {
+                    error: apiError,
+                    success: false,
+                };
+            }
+            return {
+                data: data,
+                success: true,
+            };
+        }
+        catch (error) {
+            const apiError = error instanceof Error
+                ? new ApiError(error.message, { name: error.name || 'ApiError', stack: error.stack })
+                : new ApiError(String(error));
+            platformConfig().onError?.(apiError, errorContext);
+            return {
+                error: apiError,
+                success: false,
+            };
+        }
+    },
+};
+export const backendApi = {
+    get: (endpoint, options) => makeRequest(`${getApiUrl()}${endpoint}`, { ...options, method: 'GET' }),
+    post: (endpoint, data, options) => makeRequest(`${getApiUrl()}${endpoint}`, {
+        ...options,
+        method: 'POST',
+        body: data ? JSON.stringify(data) : undefined,
+    }),
+    put: (endpoint, data, options) => makeRequest(`${getApiUrl()}${endpoint}`, {
+        ...options,
+        method: 'PUT',
+        body: data ? JSON.stringify(data) : undefined,
+    }),
+    patch: (endpoint, data, options) => makeRequest(`${getApiUrl()}${endpoint}`, {
+        ...options,
+        method: 'PATCH',
+        body: data ? JSON.stringify(data) : undefined,
+    }),
+    delete: (endpoint, options) => makeRequest(`${getApiUrl()}${endpoint}`, { ...options, method: 'DELETE' }),
+    upload: (endpoint, formData, options) => {
+        const { headers, ...restOptions } = options || {};
+        const uploadHeaders = { ...headers };
+        delete uploadHeaders['Content-Type'];
+        return makeRequest(`${getApiUrl()}${endpoint}`, {
+            ...restOptions,
+            method: 'POST',
+            body: formData,
+            headers: uploadHeaders,
+        });
+    },
+    uploadPut: (endpoint, formData, options) => {
+        const { headers, ...restOptions } = options || {};
+        const uploadHeaders = { ...headers };
+        delete uploadHeaders['Content-Type'];
+        return makeRequest(`${getApiUrl()}${endpoint}`, {
+            ...restOptions,
+            method: 'PUT',
+            body: formData,
+            headers: uploadHeaders,
+        });
+    },
+};
+//# sourceMappingURL=api-client.js.map

package/dist/platform/api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-client.js","sourceRoot":"","sources":["../../src/platform/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,+BAA+B,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAE5F,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC;AAE1D,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,oEAAoE;AACpE,OAAO,EACL,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,GAGxB,MAAM,cAAc,CAAC;AAoBtB,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,0EAA0E;AAC1E,+EAA+E;AAC/E,yDAAyD;AACzD,IAAI,kBAAkB,GAAG,KAAK,CAAC;AAE/B,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,kBAAkB,GAAG,OAAO,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,UAA0C,EAAE;IAE5C,MAAM,EACJ,UAAU,GAAG,IAAI,EACjB,YAAY,EACZ,OAAO,GAAG,KAAK,EACf,GAAG,YAAY,EAChB,GAAG,OAAO,CAAC;IAEZ,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,SAAS,GAA0B,IAAI,CAAC;IAC5C,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,oEAAoE;IACpE,2EAA2E;IAC3E,wDAAwD;IACxD,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,IAAI,CAAC;QACH,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7C,SAAS,GAAG,IAAI,CAAC;gBACjB,UAAU,GAAG,IAAI,CAAC;gBAClB,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,MAAM,KAAK,GAAG,MAAM,+BAA+B,EAAE,CAAC;QAEtD,wFAAwF;QACxF,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,YAAY,QAAQ,CAAC;QACzD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,2CAA2C;QAC3C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,OAAiC,CAAC,CAAC;QAEvE,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,uBAAuB,CAAC,GAAG,GAAG,CAAC;QACzC,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,0DAA0D;YAC1D,4EAA4E;YAC5E,wEAAwE;YACxE,mDAAmD;YACnD,OAAO;gBACL,KAAK,EAAE,IAAI,SAAS,EAAE;gBACtB,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED,uFAAuF;QACvF,2DAA2D;QAE3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,GAAG,YAAY;YACf,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,oEAAoE;YACpE,uEAAuE;YACvE,sCAAsC;YACtC,WAAW,EAAE,YAAY,CAAC,WAAW,IAAI,MAAM;SAChD,CAAC,CAAC;QAEH,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,YAAY,GAAG,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrE,IAAI,SAAS,GAAQ,IAAI,CAAC;YAE1B,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;oBACtB,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC;gBACnC,CAAC;qBAAM,IAAI,SAAS,CAAC,KAAK,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAClE,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC;gBACjC,CAAC;qBAAM,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAChD,8CAA8C;oBAC9C,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC;gBAClC,CAAC;qBAAM,IAAI,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;oBACrC,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC1C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YACT,CAAC;YAED,IAAI,KAAK,GAAqB,IAAI,QAAQ,CAAC,YAAY,EAAE;gBACvD,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,SAAS,IAAI,SAAS;gBAC/B,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS,EAAE,MAAM;gBACzB,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,UAAU,IAAI,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE;aAC9G,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAED,oDAAoD;YACpD,2DAA2D;YAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,KAAK,GAAG,IAAI,oBAAoB,CAAC,GAAG,EAAE;oBACpC,OAAO,EAAE,iCAAiC;oBAC1C,UAAU,EAAE,4FAA4F;iBACzG,CAAC,CAAC;YACL,CAAC;YAED,IAAI,UAAU,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;YAED,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QAED,IAAI,IAAO,CAAC;QACZ,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAEzD,IAAI,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9C,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;aAAM,IAAI,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAO,CAAC;QACpC,CAAC;QAED,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,IAAI;SACd,CAAC;IAEJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,gCAAgC;QAChC,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,4DAA4D;QAC5D,MAAM,YAAY,GAAG,KAAK,EAAE,IAAI,KAAK,YAAY;YAC5B,KAAK,EAAE,IAAI,KAAK,aAAa;YAC7B,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAEnF,4DAA4D;QAC5D,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,QAAkB,CAAC;QAEvB,IAAI,YAAY,EAAE,CAAC;YACjB,uEAAuE;YACvE,kEAAkE;YAClE,kEAAkE;YAClE,+DAA+D;YAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO;oBACL,KAAK,EAAE,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;oBAC/E,OAAO,EAAE,KAAK;iBACf,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,wDAAwD;YACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;YACrD,QAAQ,GAAG,IAAI,QAAQ,CAAC,2BAA2B,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,QAAQ,EAAE,EAAE;gBAC7F,IAAI,EAAE,SAAS;gBACf,GAAG;gBACH,QAAQ;gBACR,OAAO;aACR,CAAC,CAAC;YAEH,iDAAiD;YACjD,oFAAoF;YACpF,IAAI,UAAU,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAClC,QAAQ,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE;gBACrC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,UAAU;gBAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;YAEH,IAAI,UAAU,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAEvC,IAAI,UAAU,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,CAAC,OAAO,CACX,OAAsD,EACtD,YAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,EAAE,CAAC;YAExC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAa,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,EAAE;oBACzE,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;gBAEH,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;gBAEnD,OAAO;oBACL,KAAK,EAAE,QAAQ;oBACf,OAAO,EAAE,KAAK;iBACf,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,IAAI,EAAE,IAAS;gBACf,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAa,KAAK,YAAY,KAAK;gBAC/C,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;gBACrF,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAEhC,cAAc,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAEnD,OAAO;gBACL,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,GAAG,EAAE,CAAU,QAAgB,EAAE,OAAiE,EAAE,EAAE,CACpG,WAAW,CAAI,GAAG,SAAS,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAE5E,IAAI,EAAE,CAAU,QAAgB,EAAE,IAAU,EAAE,OAAwD,EAAE,EAAE,CACxG,WAAW,CAAI,GAAG,SAAS,EAAE,GAAG,QAAQ,EAAE,EAAE;QAC1C,GAAG,OAAO;QACV,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC;IAEJ,GAAG,EAAE,CAAU,QAAgB,EAAE,IAAU,EAAE,OAAwD,EAAE,EAAE,CACvG,WAAW,CAAI,GAAG,SAAS,EAAE,GAAG,QAAQ,EAAE,EAAE;QAC1C,GAAG,OAAO;QACV,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC;IAEJ,KAAK,EAAE,CAAU,QAAgB,EAAE,IAAU,EAAE,OAAwD,EAAE,EAAE,CACzG,WAAW,CAAI,GAAG,SAAS,EAAE,GAAG,QAAQ,EAAE,EAAE;QAC1C,GAAG,OAAO;QACV,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9C,CAAC;IAEJ,MAAM,EAAE,CAAU,QAAgB,EAAE,OAAiE,EAAE,EAAE,CACvG,WAAW,CAAI,GAAG,SAAS,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAE/E,MAAM,EAAE,CAAU,QAAgB,EAAE,QAAkB,EAAE,OAAiE,EAAE,EAAE;QAC3H,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAClD,MAAM,aAAa,GAAG,EAAE,GAAG,OAAiC,EAAE,CAAC;QAC/D,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC;QAErC,OAAO,WAAW,CAAI,GAAG,SAAS,EAAE,GAAG,QAAQ,EAAE,EAAE;YACjD,GAAG,WAAW;YACd,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;IAED,SAAS,EAAE,CAAU,QAAgB,EAAE,QAAkB,EAAE,OAAiE,EAAE,EAAE;QAC9H,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAClD,MAAM,aAAa,GAAG,EAAE,GAAG,OAAiC,EAAE,CAAC;QAC/D,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC;QAErC,OAAO,WAAW,CAAI,GAAG,SAAS,EAAE,GAAG,QAAQ,EAAE,EAAE;YACjD,GAAG,WAAW;YACd,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/platform/auth-core.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Pure, dependency-free building blocks for `auth.ts` — extracted so they can
+ * be unit-tested against the REAL implementation regardless of test-file
+ * ordering.
+ *
+ * Why this file exists: several test suites register process-wide
+ * `mock.module('../platform/auth', …)` stubs (Bun's `mock.module` replaces a
+ * specifier for the remainder of the process, for every importer — see the
+ * note in `opencode/client.test.ts`). Any test that wants to exercise the real
+ * retry/timeout semantics therefore can't import them from `./auth` — on some
+ * Bun versions/orderings it would receive a stub. Nothing mocks THIS module,
+ * so `auth-core.test.ts` always tests the genuine article, and `auth.ts` stays
+ * a thin delegating shell whose behavior is pinned here.
+ */
+/** Options accepted by the token-retry helpers (`getAuthTokenWithRetry` et al). */
+export interface TokenRetryOptions {
+    attempts?: number;
+    baseDelayMs?: number;
+    invalidateBetweenAttempts?: boolean;
+}
+/**
+ * Retry `getToken` up to `attempts` times (default 1 = no retry) until it
+ * returns a truthy token, waiting `baseDelayMs` between attempts. When
+ * `invalidateBetweenAttempts` is set, `onInvalidate` runs before each retry —
+ * a host that layers its own cache on `getToken` wires cache invalidation
+ * there. Returns the last (possibly falsy) result after exhausting attempts.
+ */
+export declare function withTokenRetry(getToken: () => Promise<string | null>, options?: TokenRetryOptions, onInvalidate?: () => void): Promise<string | null>;
+export declare const DEFAULT_FETCH_TIMEOUT_MS = 30000;
+/**
+ * The one long-lived streaming call reached through the auth fetch injection
+ * point — `openEventStream` (`state/event-stream.ts`) drives the opencode
+ * client's `global.event(...)` SSE endpoint (`GET {runtimeUrl}/global/event`).
+ * It manages its own lifecycle (heartbeat watchdog + explicit abort/reconnect
+ * loop) and must stay open far longer than any request timeout.
+ */
+export declare function isStreamingRequest(input: RequestInfo | URL): boolean;
+/**
+ * Compose the request's own abort signal with a default 30s timeout, so a
+ * hung non-streaming call can't wedge a "Kortix as a Backend" server-side
+ * handler forever. The SSE event stream is exempted (see
+ * `isStreamingRequest`): its caller signal — if any — passes through
+ * untouched. Falls back to the caller's bare signal on a runtime without
+ * `AbortSignal.any` (older Node/engines) — guarded so a caller-supplied
+ * signal is never silently dropped.
+ */
+export declare function withDefaultTimeout(input: RequestInfo | URL, init: RequestInit | undefined, timeoutMs?: number): AbortSignal | undefined;
+/**
+ * Build a Headers object from request input + init, injecting the auth token
+ * as a Bearer Authorization header (unless one is already present).
+ */
+export declare function buildAuthHeaders(input: RequestInfo | URL, init?: RequestInit, token?: string | null): Headers;
+/**
+ * The synthetic 401 returned when no token is available — safe for all
+ * callers including the OpenCode SDK, which expects fetch() semantics
+ * (returns a Response, never throws), and it means the request never goes
+ * out on the wire unauthenticated.
+ */
+export declare function syntheticUnauthenticatedResponse(): Response;
+//# sourceMappingURL=auth-core.d.ts.map

package/dist/platform/auth-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-core.d.ts","sourceRoot":"","sources":["../../src/platform/auth-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACpC;AAMD;;;;;;GAMG;AACH,wBAAsB,cAAc,CACnC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EACtC,OAAO,CAAC,EAAE,iBAAiB,EAC3B,YAAY,CAAC,EAAE,MAAM,IAAI,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,GAAG,OAAO,CAGpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,EAAE,WAAW,GAAG,SAAS,EAC7B,SAAS,GAAE,MAAiC,GAC1C,WAAW,GAAG,SAAS,CAUzB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC/B,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,EAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACnB,OAAO,CAWT;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,IAAI,QAAQ,CAK3D"}

package/dist/platform/auth-core.js

@@ -0,0 +1,104 @@
+/**
+ * Pure, dependency-free building blocks for `auth.ts` — extracted so they can
+ * be unit-tested against the REAL implementation regardless of test-file
+ * ordering.
+ *
+ * Why this file exists: several test suites register process-wide
+ * `mock.module('../platform/auth', …)` stubs (Bun's `mock.module` replaces a
+ * specifier for the remainder of the process, for every importer — see the
+ * note in `opencode/client.test.ts`). Any test that wants to exercise the real
+ * retry/timeout semantics therefore can't import them from `./auth` — on some
+ * Bun versions/orderings it would receive a stub. Nothing mocks THIS module,
+ * so `auth-core.test.ts` always tests the genuine article, and `auth.ts` stays
+ * a thin delegating shell whose behavior is pinned here.
+ */
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Retry `getToken` up to `attempts` times (default 1 = no retry) until it
+ * returns a truthy token, waiting `baseDelayMs` between attempts. When
+ * `invalidateBetweenAttempts` is set, `onInvalidate` runs before each retry —
+ * a host that layers its own cache on `getToken` wires cache invalidation
+ * there. Returns the last (possibly falsy) result after exhausting attempts.
+ */
+export async function withTokenRetry(getToken, options, onInvalidate) {
+    const attempts = Math.max(1, options?.attempts ?? 1);
+    const baseDelayMs = options?.baseDelayMs ?? 0;
+    const invalidateBetweenAttempts = options?.invalidateBetweenAttempts ?? false;
+    let token = null;
+    for (let attempt = 0; attempt < attempts; attempt++) {
+        if (attempt > 0) {
+            if (invalidateBetweenAttempts)
+                onInvalidate?.();
+            if (baseDelayMs > 0)
+                await delay(baseDelayMs);
+        }
+        token = await getToken();
+        if (token)
+            return token;
+    }
+    return token;
+}
+export const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
+/**
+ * The one long-lived streaming call reached through the auth fetch injection
+ * point — `openEventStream` (`state/event-stream.ts`) drives the opencode
+ * client's `global.event(...)` SSE endpoint (`GET {runtimeUrl}/global/event`).
+ * It manages its own lifecycle (heartbeat watchdog + explicit abort/reconnect
+ * loop) and must stay open far longer than any request timeout.
+ */
+export function isStreamingRequest(input) {
+    const url = input instanceof Request ? input.url : String(input);
+    return url.includes('/global/event');
+}
+/**
+ * Compose the request's own abort signal with a default 30s timeout, so a
+ * hung non-streaming call can't wedge a "Kortix as a Backend" server-side
+ * handler forever. The SSE event stream is exempted (see
+ * `isStreamingRequest`): its caller signal — if any — passes through
+ * untouched. Falls back to the caller's bare signal on a runtime without
+ * `AbortSignal.any` (older Node/engines) — guarded so a caller-supplied
+ * signal is never silently dropped.
+ */
+export function withDefaultTimeout(input, init, timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+    const callerSignal = input instanceof Request ? input.signal : init?.signal;
+    if (isStreamingRequest(input))
+        return callerSignal ?? undefined;
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    if (!callerSignal)
+        return timeoutSignal;
+    if (typeof AbortSignal.any === 'function') {
+        return AbortSignal.any([callerSignal, timeoutSignal]);
+    }
+    return callerSignal;
+}
+/**
+ * Build a Headers object from request input + init, injecting the auth token
+ * as a Bearer Authorization header (unless one is already present).
+ */
+export function buildAuthHeaders(input, init, token) {
+    const headers = new Headers(input instanceof Request ? input.headers : undefined);
+    if (init?.headers) {
+        new Headers(init.headers).forEach((value, key) => {
+            headers.set(key, value);
+        });
+    }
+    if (token && !headers.has('Authorization')) {
+        headers.set('Authorization', `Bearer ${token}`);
+    }
+    return headers;
+}
+/**
+ * The synthetic 401 returned when no token is available — safe for all
+ * callers including the OpenCode SDK, which expects fetch() semantics
+ * (returns a Response, never throws), and it means the request never goes
+ * out on the wire unauthenticated.
+ */
+export function syntheticUnauthenticatedResponse() {
+    return new Response(JSON.stringify({ error: 'Not authenticated' }), {
+        status: 401,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+//# sourceMappingURL=auth-core.js.map

package/dist/platform/auth-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-core.js","sourceRoot":"","sources":["../../src/platform/auth-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH,SAAS,KAAK,CAAC,EAAU;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,QAAsC,EACtC,OAA2B,EAC3B,YAAyB;IAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,CAAC,CAAC;IAC9C,MAAM,yBAAyB,GAAG,OAAO,EAAE,yBAAyB,IAAI,KAAK,CAAC;IAE9E,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACjB,IAAI,yBAAyB;gBAAE,YAAY,EAAE,EAAE,CAAC;YAChD,IAAI,WAAW,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;QACzB,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IAC1D,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CACjC,KAAwB,EACxB,IAA6B,EAC7B,YAAoB,wBAAwB;IAE5C,MAAM,YAAY,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IAC5E,IAAI,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,IAAI,SAAS,CAAC;IAEhE,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,OAAO,WAAW,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC3C,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC/B,KAAwB,EACxB,IAAkB,EAClB,KAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClF,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAChD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;QACnE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAC/C,CAAC,CAAC;AACJ,CAAC"}

package/dist/platform/auth.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Shared auth token helpers.
+ *
+ * Every function below is a thin delegate to `platformConfig().getToken()` —
+ * the SDK holds no token state of its own. Token acquisition (Supabase
+ * getSession/refreshSession or any other provider), caching, deduplicating
+ * concurrent callers (SSE, health check, session fetch, etc. all racing for a
+ * token on page load), and the install/bootstrap seam are entirely the host
+ * app's responsibility, implemented inside the `getToken` it passes to
+ * `configureKortix`/`createKortix`. A host that wants the old 30s-TTL +
+ * inflight-dedup behavior re-implements it in its own `getToken`; the SDK
+ * itself does not cache, dedupe, or retry beyond calling `getToken()` again.
+ *
+ * `getAuthToken()` is the unified getter: returns whatever token the host's
+ * `getToken()` resolves. `getSupabaseAccessToken()` is kept as an alias for
+ * callers that historically asked for "the Supabase token" specifically —
+ * same delegate, same value.
+ *
+ * `invalidateTokenCache()` / `setCachedAuthToken()` / `setBootstrapAuthToken()`
+ * are no-ops here (there is no SDK-side cache to invalidate or seed); they're
+ * kept as exported names so existing call sites compile unchanged, and a host
+ * that layers its own caching on top of `getToken()` can wire these to that
+ * cache if it wants the "invalidate on 401" / "seed before hydration" hooks to
+ * do something.
+ */
+import { type TokenRetryOptions } from './auth-core.js';
+/**
+ * Get the current auth token. Delegates directly to `platformConfig().getToken()`
+ * — any caching/deduplication the host wants happens inside that function.
+ */
+export declare function getSupabaseAccessToken(): Promise<string | null>;
+/**
+ * Retry variant — actually retries now. Previously accepted `attempts`/
+ * `baseDelayMs`/`invalidateBetweenAttempts` and silently ignored all three
+ * (always a single `getToken()` call), which quietly broke every caller that
+ * depended on retry semantics around a flaky/cold token provider (e.g. right
+ * after sign-in, before a host's own session has hydrated — see the retry
+ * call in `authenticatedFetch`'s 401 handler below).
+ *
+ * Retries up to `attempts` times (default 1 = no retry) until `getToken()`
+ * returns a truthy token, waiting `baseDelayMs` between attempts (default 0).
+ * When `invalidateBetweenAttempts` is set, calls `invalidateTokenCache()`
+ * before each retry — a no-op in this file (there's no SDK-side cache), but
+ * kept as a real call so a host that layers its own cache on `getToken()` (and
+ * wires `invalidateTokenCache`/`setCachedAuthToken` to it, per this file's
+ * top-of-file doc comment) gets invalidated between attempts as intended.
+ */
+export declare function getSupabaseAccessTokenWithRetry(options?: TokenRetryOptions): Promise<string | null>;
+/**
+ * Invalidate the cached token (e.g. after a 401 response).
+ * The next getSupabaseAccessToken() call will fetch fresh.
+ */
+export declare function invalidateTokenCache(): void;
+/**
+ * Sync the resolved auth token cache without affecting bootstrap mode.
+ */
+export declare function setCachedAuthToken(token: string | null): void;
+/**
+ * Seed auth for setup/install flows that receive a JWT from server actions
+ * before the browser Supabase client has established local session state.
+ */
+export declare function setBootstrapAuthToken(token: string | null): void;
+/**
+ * Unified auth token getter.
+ *
+ * Returns the Supabase JWT. All requests go through kortix-api which
+ * authenticates via Supabase JWT — no additional sandbox lock/key needed.
+ */
+export declare function getAuthToken(): Promise<string | null>;
+export declare function getAuthTokenWithRetry(options?: TokenRetryOptions): Promise<string | null>;
+/**
+ * Shared authenticated fetch — injects auth tokens and handles 401 responses.
+ *
+ * Centralizes the pattern duplicated across opencode-sdk, use-sandbox-connection,
+ * and server-selector. All three auth injection points now go through this.
+ *
+ * Behavior:
+ *   1. Gets the current auth token (Supabase JWT)
+ *   2. Injects it as Bearer token on the request
+ *   3. On 401: invalidates the token cache, gets fresh, retries once
+ *
+ * Options:
+ *   - `retryOnAuthError`: if false, skips stale-token retry (default: true)
+ */
+export declare function authenticatedFetch(input: RequestInfo | URL, init?: RequestInit, options?: {
+    retryOnAuthError?: boolean;
+}): Promise<Response>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/platform/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/platform/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAKN,KAAK,iBAAiB,EACtB,MAAM,aAAa,CAAC;AAGrB;;;GAGG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAErE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,+BAA+B,CACpD,OAAO,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE7D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAEhE;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAE3D;AAED,wBAAsB,qBAAqB,CAC1C,OAAO,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAmCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,EAClB,OAAO,CAAC,EAAE;IACR,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GACA,OAAO,CAAC,QAAQ,CAAC,CAuCnB"}