@multiplatform.one/frappe 6.1.0 → 6.4.0

package/README.md

@@ -8,12 +8,16 @@ Real-time sync for Frappe with **TanStack DB integration**, **virtual pagination
 
 Comprehensive technical reference containing architecture, implementation details, server specification, and production deployment.
 
+### Live protocol spec (of record)
+
+The wire protocol — change stream ordering, compound cursors, tombstones, idempotency, and Keycloak auth — is specified in `agent-os/specs/2026-08-12-frappe-live-protocol/spec.md` in the [multiplatform.one repo](https://gitlab.com/bitspur/frappe/multiplatform.one). Where this README and the spec disagree, the spec wins.
+
 ## Core Features
 
 ### Virtual Pagination
 
 - Progressive cache with page islands for efficient large datasets
-- Cursor-based pagination via `frappe_live` extension
+- Cursor-based pagination via the Frappe Live extension app (`live`)
 - Opt-in via `progressive: true` on subscription queries
 - Automatic consistency across pages
 
@@ -21,7 +25,7 @@ Comprehensive technical reference containing architecture, implementation detail
 
 - **Version checking** with 409/412 errors (OCC via `If-Match` header)
 - **Three-way merge** conflict resolution with field-level strategies
-- **Idempotency** via `Idempotency-Key` headers for safe retries
+- **Idempotency** via `Idempotency-Key` headers — the server dedupes replayed create/delete requests (24h retention)
 - **CRDT-like field merging** (sum, max, min, union-set, custom)
 
 ### Offline Support
@@ -53,15 +57,33 @@ Comprehensive technical reference containing architecture, implementation detail
 npm install @multiplatform.one/frappe
 ```
 
+## Authentication
+
+`auth.token` accepts a string **or an async getter** — pass a getter so rotated tokens are resolved lazily per request (e.g. a Keycloak access token from `@multiplatform.one/keycloak`'s `getKeycloakBearerToken()`):
+
+```typescript
+import { AuthType, FrappeApp } from "@multiplatform.one/frappe";
+
+const app = new FrappeApp("https://your-instance.frappe.cloud", {
+  useToken: true,
+  type: AuthType.Bearer,
+  token: async () => (await getToken()) ?? "", // empty = guest, no bare header
+});
+```
+
+The same `Authorization` header authenticates the realtime socket. Browsers cannot set headers on a WebSocket handshake, so on web the client handshakes over Socket.IO polling (the XHR carries the header) and upgrades to websocket afterwards; Node/native attach it to the websocket directly. On `disconnect`, `connect_error`, and every reconnect attempt the token getter is re-resolved into the live socket manager, so subscriptions and rooms survive token expiry mid-session (`updateAuth()` covers explicit rotation). With Keycloak, the bench validates the JWT via the `frappe_keycloak` app — REST and socket connections take the same validation path.
+
 ## React Hooks
 
 ### When to Use What
 
-| Hook                    | Use Case                                                       | Updates      |
-| ----------------------- | -------------------------------------------------------------- | ------------ |
-| `useFrappeCollection`   | Creates a TanStack DB collection backed by a Frappe doctype    | Auto-updates |
-| `useLiveQuery`          | Reactive TanStack DB query with `.where()`, `.orderBy()`, etc. | Auto-updates |
-| `useFrappeInfiniteList` | Infinite scroll with full sync (realtime, offline, CDC)        | Auto-updates |
+| Hook                    | Use Case                                                                     | Updates               |
+| ----------------------- | ---------------------------------------------------------------------------- | --------------------- |
+| `useFrappeCollection`   | Creates a TanStack DB collection backed by a Frappe doctype                  | Auto-updates          |
+| `useLiveQuery`          | Reactive TanStack DB query with `.where()`, `.orderBy()`, etc.               | Auto-updates          |
+| `useFrappeInfiniteList` | Infinite scroll with full sync (realtime, offline, CDC)                      | Auto-updates          |
+| `useLinkSearch`         | Debounced backend link search (`frappe.desk.search.search_link`) for pickers | Per query (debounced) |
+| `useLinkTitle`          | Resolve a link value's display title (`get_link_title`, session-cached)      | On value change       |
 
 ### useFrappeCollection + useLiveQuery
 
@@ -204,14 +226,17 @@ const sync = new SyncModule(db, realtime, {
 
 ## Server Requirements
 
-The SDK works with standard Frappe REST API for reads and uses the `frappe_live` extension app for enhanced write operations. The extension provides:
+The SDK works with standard Frappe REST API for reads and uses the Frappe Live extension app (`live`, endpoints `live.live.api.*`) for enhanced write operations. The extension provides:
 
-- **Idempotent create/delete** via `Idempotency-Key` header
-- **OCC update** via `If-Match` header (409/412 on version mismatch)
+- **Idempotent create/delete** — the server records each successful `create_doc`/`delete_doc` outcome against its `Idempotency-Key` (scoped per user and per endpoint, 24h TTL) and a retry with the same key returns the recorded outcome instead of re-executing. The SDK sends its `client_mutation_id` as this header on every mutation.
+- **OCC update** via `If-Match` header (409/412 on version mismatch) — update retries are guarded by version checking, not idempotency dedup
 - **Cursor-based pagination** via `get_list_with_cursor`
 - **Batch mutations** via `batch_mutations`
-- **CDC endpoints** via `list_since` and `backfill`
-- **Tombstone tracking** via `Deleted Document` doctype
+- **CDC endpoints** via `list_since` and `backfill` — one merged change stream of rows + deletions, ordered by an opaque compound `"timestamp|name"` checkpoint that never advances past an undelivered change
+- **Tombstone feed** — names-only deletions sourced from frappe core's `Deleted Document` rows (30-day retention; older cursors full-refresh) plus a `doc_deleted` realtime event after the deleting transaction commits
+- **Permission-checked reads** — the change feed goes through frappe's permission engine; unauthorized doctypes raise instead of leaking rows
+
+For Keycloak bearer auth, the bench additionally needs the `frappe_keycloak` app (JWT validation + role mapping on REST and socket connections).
 
 ## Production Configuration
 
@@ -219,6 +244,7 @@ The SDK works with standard Frappe REST API for reads and uses the `frappe_live`
 const sync = new SyncModule(db, realtime, {
   persistKey: "my-app", // Enable IndexedDB persistence
   cdcInterval: 30000, // Periodic CDC every 30s (safety net)
+  backfillMaxPages: 20, // Max CDC pages drained per backfill (bounds both drain paths)
   maxCacheSize: 5000, // LRU eviction threshold
   mutationTTL: 24 * 60 * 60 * 1000, // 24hr mutation journal TTL
   enableBatching: false, // Opt-in mutation batching

package/dist/cjs/auth.cjs

@@ -26,10 +26,10 @@ __export(auth_exports, {
 });
 module.exports = __toCommonJS(auth_exports);
 class AuthModule {
+  http;
   constructor(http) {
     this.http = http;
   }
-  http;
   async loginWithUsernamePassword(input) {
     return this.http.post("/api/method/login", {
       usr: input.username,

package/dist/cjs/auth.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","auth_exports","__export","AuthModule","module","exports","_class_call_check","instance","Constructor","TypeError","_defineProperties","target","props","i","length","descriptor","enumerable","configurable","writable","Object","defineProperty","key","_create_class","protoProps","staticProps","prototype","_define_property","obj"],"sources":["../../src/auth.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,YAAA;AAAAC,QAAA,CAAAD,YAAA;EAAAE,UAAA,EAAAA,CAAA,KAAAA;AAAA;AAEOC,MAAM,CAAAC,OAAA,GAAWT,YAAA,CAAAK,YAAA;AAAA,SACtBK,iBAA+CA,CAAAC,QAAA,EAAAC,WAAA;EAAlB,MAAAD,QAAA,YAAAC,WAAA;IAAmB,UAAAC,SAAA;EAAnB;AAAA;AAG3B,SAAAC,iBAAsBA,CAAAC,MAAA,EAAAC,KAAA;EAAqB,KACzC,IAAKC,CAAA,MAAMA,CAAA,GAAAD,KAAA,CAAAE,MAAA,EAAAD,CAAA;IAAA,IACXE,UAAW,GAAAH,KAAA,CAAAC,CAAA;IACbE,UAAC,CAAAC,UAAA,GAAAD,UAAA,CAAAC,UAAA;IACHD,UAAA,CAAAE,YAAA;IAEA,IAAM,WAAAF,UAAmC,EAAAA,UAAA,CAAAG,QAAA;IACvCC,MAAA,CAAAC,cACc,CAAAT,MAA8B,EAAAI,UAAA,CAAAM,GAAA,EAAAN,UAAA;EAG9C;AAAA;AAGE,SAAAO,aAAiBA,CAAAd,WAAK,EAAAe,UAAoB,EAAAC,WAAA;EAC5C,IAAAD,UAAA,EAAAb,iBAAA,CAAAF,WAAA,CAAAiB,SAAA,EAAAF,UAAA;EAEA,IAAAC,WAAM,EAAAd,iBAA8B,CAAAF,WAAA,EAAAgB,WAAA;EAClC,OAAAhB,WAAY;AAAsE;AAC1E,SACPkB,iBAAAC,GAAA,EAAAN,GAAA,EAAArB,KAAA;EACH,IAAAqB,GAAA,IAAAM,GAAA;IACFR,MAAA,CAAAC,cAAA,CAAAO,GAAA,EAAAN,GAAA","ignoreList":[]}
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","auth_exports","__export","AuthModule","module","exports","_class_call_check","instance","Constructor","TypeError","_defineProperties","target","props","i","length","descriptor","enumerable","configurable","writable","Object","defineProperty","key","_create_class","protoProps","staticProps","prototype","_define_property","obj"],"sources":["../../src/auth.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,YAAA;AAAAC,QAAA,CAAAD,YAAA;EAAAE,UAAA,EAAAA,CAAA,KAAAA;AAAA;AAEOC,MAAM,CAAAC,OAAA,GAAWT,YAAA,CAAAK,YAAA;AAAA,SACLK,kBAAAC,QAAA,EAAAC,WAAA;EAEjB,MAAAD,QAAY,YAAkBC,WAAA;IAC5B,MAAK,IAAAC,SAAO;EACd;AAAA;AAGE,SAAAC,iBAAsBA,CAAAC,MAAA,EAAAC,KAAA;EAAqB,KACzC,IAAKC,CAAA,MAAMA,CAAA,GAAAD,KAAA,CAAAE,MAAA,EAAAD,CAAA;IAAA,IACXE,UAAW,GAAAH,KAAA,CAAAC,CAAA;IACbE,UAAC,CAAAC,UAAA,GAAAD,UAAA,CAAAC,UAAA;IACHD,UAAA,CAAAE,YAAA;IAEA,IAAM,WAAAF,UAAmC,EAAAA,UAAA,CAAAG,QAAA;IACvCC,MAAA,CAAAC,cACc,CAAAT,MAA8B,EAAAI,UAAA,CAAAM,GAAA,EAAAN,UAAA;EAG9C;AAAA;AAGE,SAAAO,aAAiBA,CAAAd,WAAK,EAAAe,UAAoB,EAAAC,WAAA;EAC5C,IAAAD,UAAA,EAAAb,iBAAA,CAAAF,WAAA,CAAAiB,SAAA,EAAAF,UAAA;EAEA,IAAAC,WAAM,EAAAd,iBAA8B,CAAAF,WAAA,EAAAgB,WAAA;EAClC,OAAAhB,WAAY;AAAsE;AAC1E,SACPkB,iBAAAC,GAAA,EAAAN,GAAA,EAAArB,KAAA;EACH,IAAAqB,GAAA,IAAAM,GAAA;IACFR,MAAA,CAAAC,cAAA,CAAAO,GAAA,EAAAN,GAAA","ignoreList":[]}

package/dist/cjs/call.cjs

@@ -26,10 +26,10 @@ __export(call_exports, {
 });
 module.exports = __toCommonJS(call_exports);
 class CallModule {
+  http;
   constructor(http) {
     this.http = http;
   }
-  http;
   get(method, params) {
     return this.http.get(`/api/method/${method}`, params);
   }

package/dist/cjs/call.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","call_exports","__export","CallModule","module","exports","_class_call_check","instance","Constructor","TypeError","_defineProperties","target","props","i","length","descriptor","enumerable","configurable","writable","Object","defineProperty","key","_create_class","protoProps","staticProps","prototype"],"sources":["../../src/call.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,YAAA;AAAAC,QAAA,CAAAD,YAAA;EAAAE,UAAA,EAAAA,CAAA,KAAAA;AAAA;AAEOC,MAAM,CAAAC,OAAA,GAAWT,YAAA,CAAAK,YAAA;AAAA,SACtBK,iBAA+CA,CAAAC,QAAA,EAAAC,WAAA;EAAlB,MAAAD,QAAA,YAAAC,WAAA;IAAmB,UAAAC,SAAA;EAAnB;AAAA;AAG3B,SAAAC,iBAAwBA,CAAAC,MAAA,EAAAC,KAAe;EACzC,SAAAC,CAAA,MAAAA,CAAA,GAAAD,KAAA,CAAAE,MAAA,EAAAD,CAAA;IAEA,IAAQE,UAAgB,GAAYH,KAAA,CAAAC,CAAA;IAClCE,UAAO,CAAAC,UAAU,GAAQD,UAAA,CAAAC,UAAqB,IAAI,KAAI;IACxDD,UAAA,CAAAE,YAAA;IAEA,IAAO,OAAgB,IAAAF,UAAY,EAAAA,UAAA,CAAAG,QAAA;IACjCC,MAAA,CAAOC,cAAiB,CAAAT,MAAA,EAAAI,UAAe,CAAAM,GAAM,EAAIN,UAAI;EACvD;AAAA;AAGE,SAAAO,aAAiBA,CAAAd,WAAU,EAAAe,UAAe,EAAAC,WAAc;EAC1D,IAAAD,UAAA,EAAAb,iBAAA,CAAAF,WAAA,CAAAiB,SAAA,EAAAF,UAAA;EACF,IAAAC,WAAA,EAAAd,iBAAA,CAAAF,WAAA,EAAAgB,WAAA","ignoreList":[]}
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","call_exports","__export","CallModule","module","exports","_class_call_check","instance","Constructor","TypeError","_defineProperties","target","props","i","length","descriptor","enumerable","configurable","writable","Object","defineProperty","key","_create_class","protoProps","staticProps","prototype"],"sources":["../../src/call.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,YAAA;AAAAC,QAAA,CAAAD,YAAA;EAAAE,UAAA,EAAAA,CAAA,KAAAA;AAAA;AAEOC,MAAM,CAAAC,OAAA,GAAWT,YAAA,CAAAK,YAAA;AAAA,SACLK,kBAAAC,QAAA,EAAAC,WAAA;EAEjB,MAAAD,QAAY,YAAkBC,WAAA;IAC5B,MAAK,IAAAC,SAAO;EACd;AAAA;AAGE,SAAAC,iBAAwBA,CAAAC,MAAA,EAAAC,KAAe;EACzC,SAAAC,CAAA,MAAAA,CAAA,GAAAD,KAAA,CAAAE,MAAA,EAAAD,CAAA;IAEA,IAAQE,UAAgB,GAAYH,KAAA,CAAAC,CAAA;IAClCE,UAAO,CAAAC,UAAU,GAAQD,UAAA,CAAAC,UAAqB,IAAI,KAAI;IACxDD,UAAA,CAAAE,YAAA;IAEA,IAAO,OAAgB,IAAAF,UAAY,EAAAA,UAAA,CAAAG,QAAA;IACjCC,MAAA,CAAOC,cAAiB,CAAAT,MAAA,EAAAI,UAAe,CAAAM,GAAM,EAAIN,UAAI;EACvD;AAAA;AAGE,SAAAO,aAAiBA,CAAAd,WAAU,EAAAe,UAAe,EAAAC,WAAc;EAC1D,IAAAD,UAAA,EAAAb,iBAAA,CAAAF,WAAA,CAAAiB,SAAA,EAAAF,UAAA;EACF,IAAAC,WAAA,EAAAd,iBAAA,CAAAF,WAAA,EAAAgB,WAAA","ignoreList":[]}

package/dist/cjs/collection.cjs

@@ -36,7 +36,8 @@ function frappeCollectionOptions(doctype, config) {
     fields,
     filters,
     orderBy,
-    limit
+    limit,
+    onSyncError
   } = config;
   const syncFn = params => {
     const {
@@ -48,6 +49,7 @@ function frappeCollectionOptions(doctype, config) {
     let subscriptionId;
     let storeUnsubscribe;
     let lastKnownNames = /* @__PURE__ */new Set();
+    let cancelled = false;
     async function initSync() {
       try {
         const query = {
@@ -58,6 +60,10 @@ function frappeCollectionOptions(doctype, config) {
           limit
         };
         const result = await syncModule.subscribe(query);
+        if (cancelled) {
+          syncModule.unsubscribe(result.subscriptionId);
+          return;
+        }
         subscriptionId = result.subscriptionId;
         const initialDocs = syncModule.getDocsForSubscription(subscriptionId);
         if (initialDocs.length > 0) {
@@ -104,13 +110,16 @@ function frappeCollectionOptions(doctype, config) {
           lastKnownNames = currentNames;
         });
       } catch (error) {
+        if (cancelled) return;
         console.error(`[frappe-collection] Initial sync failed for ${doctype}:`, error);
+        onSyncError?.(error);
       } finally {
-        markReady();
+        if (!cancelled) markReady();
       }
     }
     initSync();
     return () => {
+      cancelled = true;
       if (storeUnsubscribe) {
         storeUnsubscribe();
         storeUnsubscribe = void 0;
@@ -195,6 +204,7 @@ function fixtureCollectionOptions(doctype, config) {
       commit,
       markReady
     } = params;
+    let cancelled = false;
     async function initSync() {
       try {
         const orderByForFixture = orderBy && !Array.isArray(orderBy) ? {
@@ -211,6 +221,7 @@ function fixtureCollectionOptions(doctype, config) {
           limitStart,
           limit
         });
+        if (cancelled) return;
         if (docs.length > 0) {
           begin();
           for (const doc of docs) {
@@ -226,13 +237,16 @@ function fixtureCollectionOptions(doctype, config) {
           commit();
         }
       } catch (error) {
+        if (cancelled) return;
         console.error(`[frappe-collection] Fixture sync failed for ${doctype}:`, error);
       } finally {
-        markReady();
+        if (!cancelled) markReady();
       }
     }
     initSync();
-    return () => {};
+    return () => {
+      cancelled = true;
+    };
   };
   return {
     id: config.id ?? doctype,

package/dist/cjs/collection.native.js

@@ -39,7 +39,8 @@ function frappeCollectionOptions(doctype, config) {
     fields,
     filters,
     orderBy,
-    limit
+    limit,
+    onSyncError
   } = config;
   var syncFn = function syncFn2(params) {
     var {
@@ -51,6 +52,7 @@ function frappeCollectionOptions(doctype, config) {
     var subscriptionId;
     var storeUnsubscribe;
     var lastKnownNames = /* @__PURE__ */new Set();
+    var cancelled = false;
     async function initSync() {
       try {
         var query = {
@@ -61,6 +63,10 @@ function frappeCollectionOptions(doctype, config) {
           limit
         };
         var result = await syncModule.subscribe(query);
+        if (cancelled) {
+          syncModule.unsubscribe(result.subscriptionId);
+          return;
+        }
         subscriptionId = result.subscriptionId;
         var initialDocs = syncModule.getDocsForSubscription(subscriptionId);
         if (initialDocs.length > 0) {
@@ -166,13 +172,16 @@ function frappeCollectionOptions(doctype, config) {
           lastKnownNames = currentNames;
         });
       } catch (error) {
+        if (cancelled) return;
         console.error(`[frappe-collection] Initial sync failed for ${doctype}:`, error);
+        onSyncError === null || onSyncError === void 0 ? void 0 : onSyncError(error);
       } finally {
-        markReady();
+        if (!cancelled) markReady();
       }
     }
     initSync();
     return function () {
+      cancelled = true;
       if (storeUnsubscribe) {
         storeUnsubscribe();
         storeUnsubscribe = void 0;
@@ -326,6 +335,7 @@ function fixtureCollectionOptions(doctype, config) {
       commit,
       markReady
     } = params;
+    var cancelled = false;
     async function initSync() {
       try {
         var orderByForFixture = orderBy && !Array.isArray(orderBy) ? {
@@ -344,6 +354,7 @@ function fixtureCollectionOptions(doctype, config) {
           limitStart,
           limit
         });
+        if (cancelled) return;
         if (docs.length > 0) {
           begin();
           var _iteratorNormalCompletion = true,
@@ -378,13 +389,16 @@ function fixtureCollectionOptions(doctype, config) {
           commit();
         }
       } catch (error) {
+        if (cancelled) return;
         console.error(`[frappe-collection] Fixture sync failed for ${doctype}:`, error);
       } finally {
-        markReady();
+        if (!cancelled) markReady();
       }
     }
     initSync();
-    return function () {};
+    return function () {
+      cancelled = true;
+    };
   };
   return {
     id: (_config_id = config.id) !== null && _config_id !== void 0 ? _config_id : doctype,

package/dist/cjs/collection.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","collection_exports","__export","createFixtureCollection","createFrappeCollection","fixtureCollectionOptions","frappeCollectionOptions","module","exports","import_db","require","import_types","doctype","config","_config_id","sync","syncModule","fields","filters","orderBy","limit","syncFn","syncFn2","params","begin","write","commit","markReady","subscriptionId","storeUnsubscribe","lastKnownNames","Set","initSync","query","result","subscribe","initialDocs","getDocsForSubscription","length","_iteratorNormalCompletion","_didIteratorError","_iteratorError","_iterator","Symbol","iterator","_step","next","done","doc","type","add","name","err","return","subscribeStore","currentDocs","currentNames","map","d","_iteratorNormalCompletion2","_didIteratorError2","_iteratorError2","_iterator2","_step2","doc2","has","_iteratorNormalCompletion1","_didIteratorError1","_iteratorError1","_iterator1","_step1","error","console","unsubscribe","id","getKey","onInsert","param","transaction","mutations","mutation","_ref","_crypto_randomUUID","_crypto","modified","mutate","mutationId","crypto","randomUUID","call","Math","random","toString","substring","operation","Operation","Create"],"sources":["../../src/collection.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,kBAAA;AAAAC,QAAA,CAAAD,kBAAA;EAAAE,uBAAA,EAAAA,CAAA,KAAAA,uBAAA;EAAAC,sBAAA,EAAAA,CAAA,KAAAA,sBAAA;EAAAC,wBAAA,EAAAA,CAAA,KAAAA,wBAAA;EAAAC,uBAAA,EAAAA,CAAA,KAAAA;AAAA;AACAC,MAAA,CAAAC,OAAA,GAAiCZ,YAAA,CAAAK,kBAAA;AAIjC,IAAAQ,SAAA,GAAAC,OAA0B;AA8CnB,IAAAC,YAAS,GAAAD,OAAA,yBACd,CACA;AAEA,SAAMJ,uBAAoBA,CAAAM,OAAQ,EAAAC,MAAS;EAE3C,IAAAC,UAAM;EACJ;IAAAC,IAAQ,EAAAC,UAAO;IAAOC,MAAA;IAAQC,OAAA;IAAAC,OAAc;IAAAC;EAAA,IAAAP,MAAA;EAE5C,IAAAQ,MAAI,YAAAC,QAAAC,MAAA;IACJ,IAAI;MAAAC,KAAA;MAAAC,KAAA;MAAAC,MAAA;MAAAC;IAAA,IAAAJ,MAAA;IACJ,IAAIK,cAAA;IAEJ,IAAAC,gBAAe;IACb,IAAAC,cAAI,sBAAAC,GAAA;IAEF,eAAMC,QAA2BA,CAAA;MAAA,IAC/B;QAAA,IACAC,KAAA;UACArB,OAAA;UACAK,MAAA;UACAC,OAAA;UACFC,OAAA;UAEAC;QACA;QAGA,IAAAc,MAAM,SAAAlB,UAAc,CAAAmB,SAAW,CAAAF,KAAA;QAC/BL,cAAI,GAAYM,MAAA,CAAAN,cAAY;QAC1B,IAAAQ,WAAM,GAAApB,UAAA,CAAAqB,sBAAA,CAAAT,cAAA;QACN,IAAAQ,WAAW,CAAAE,MAAO;UAChBd,KAAA;UACA,IAAAe,yBAA2B;YAAAC,iBAAA;YAAAC,cAAA;UAC7B;YACA,KAAO,IAAAC,SAAA,GAAAN,WAAA,CAAAO,MAAA,CAAAC,QAAA,KAAAC,KAAA,IAAAN,yBAAA,IAAAM,KAAA,GAAAH,SAAA,CAAAI,IAAA,IAAAC,IAAA,GAAAR,yBAAA;cACT,IAAAS,GAAA,GAAAH,KAAA,CAAA7C,KAAA;cAGAyB,KAAA;gBACOwB,IAAA,UAAgB;gBAEfjD,KAAA,EAAAgD;cACN,EAAM;cAENlB,cAAM,CAAAoB,GAAA,CAAAF,GAAA,CAAAG,IAAA;YAGN;UACE,SAAIC,GAAA;YACFZ,iBAAc;YAChBC,cAAO,GAAAW,GAAA;UACL,UAAM;YACR;cACF,KAAAb,yBAAA,IAAAG,SAAA,CAAAW,MAAA;gBAGAX,SAAW,CAAAW,MAAQ;cACjB;YACE,UAAM;cAAA,IACJb,iBAAM;gBACN,MAAAC,cAAe;cACjB;YACF;UACF;UAEAf,MAAA,CAAO;QACP;QACFG,gBAAC,GAAAb,UAAA,CAAAsC,cAAA;UACH,KAAS1B,cAAO;UACd,IAAA2B,WAAc,GAAAvC,UAAA,CAAAqB,sBAAA,CAAAT,cAAsD;UACtE,IAAA4B,YAAE,OAAAzB,GAAA,CAAAwB,WAAA,CAAAE,GAAA,WAAAC,CAAA;YACA,OAAUA,CAAA,CAAAP,IAAA;UACZ;UACF3B,KAAA;UAEA,IAASmC,0BAAA;YAAAC,kBAAA;YAAAC,eAAA;UAGT,IAAO;YACD,SAAAC,UAAkB,GAAAP,WAAA,CAAAZ,MAAA,CAAAC,QAAA,KAAAmB,MAAA,IAAAJ,0BAAA,IAAAI,MAAA,GAAAD,UAAA,CAAAhB,IAAA,IAAAC,IAAA,GAAAY,0BAAA;cACpB,IAAAK,IAAA,GAAiBD,MAAA,CAAA/D,KAAA;cACjB,IAAA8B,cAAmB,CAAAmC,GAAA,CAAAD,IAAA,CAAAb,IAAA;gBACrB1B,KAAA;kBACIwB,IAAA,UAAgB;kBAClBjD,KAAW,EAAAgE;gBACX;cACF;gBACFvC,KAAA;kBACFwB,IAAA;kBAEOjD,KAAA,EAAAgE;gBACM;cACF;YACD;UAER,SAAUZ,GAAO,EAAE;YACjBQ,kBAAuB;YACrBC,eAAY,GAAST,GAAA;UACrB,UAAM;YACJ;cACA,KAAAO,0BAAqB,IAAAG,UAAA,CAAAT,MAAA;gBAChBS,UAAU,CAAAT,MAAQ;cACxB;YACH;cACF,IAAAO,kBAAA;gBAEU,MAAOC,eAAc;cAC7B;YACE;UACA;UACA,IAAMK,0BAAkB;YAAAC,kBAAA;YAAAC,eAAA;UACtB;YACA,SAAWC,UAAA,GAAAvC,cAAU,CAAAa,MAAA,CAAAC,QAAA,KAAA0B,MAAA,IAAAJ,0BAAA,IAAAI,MAAA,GAAAD,UAAA,CAAAvB,IAAA,IAAAC,IAAA,GAAAmB,0BAAA;cACrB,IAAOf,IAAG,GAAKmB,MAAA,CAAAtE,KAAS;cACzB,KAAAwD,YAAA,CAAAS,GAAA,CAAAd,IAAA;gBACH1B,KAAA;kBACFwB,IAAA;kBAEUjD,KAAS;oBACNmD,IAAA;oBACHvC;kBACA;gBACJ;cACA;YACA;UACD,SAAAwC,GAAA;YACHe,kBAAA;YACFC,eAAA,GAAAhB,GAAA;UACF;YACF;cA4BgB,KAAAc,0BAEd,IACAG,UAAA,CAAAhB,MAAA;gBACOgB,UAAA,CAAAhB,MAAA;cACT;YA6BgB;cAIN,IAAAc,kBAAkB,EAAS;gBAE7B,MAA4CC,eAAW;cACnD;YAER;UACM;UACF1C,MAAM;UAONI,cAAa,GAAM0B,YAAS;QAAuB,EACjD;MAAA,SACAe,KAAA;QAAAC,OACA,CAAAD,KAAS,gDAAA3D,OAAA,KAAA2D,KAAA;MAAA,UACT;QAAA5C,SACA;MAAA;IAGF;IACEK,QAAA;IACA,mBAAW;MACT,IAAAH,gBAAM,EAAU;QAChBA,gBAAQ,EAAM;QAA0BA,gBAC1C;MACA;MAAO,IACTD,cAAA;QACFZ,UAAS,CAAAyD,WAAO,CAAA7C,cAAA;QACdA,cAAc;MAChB;IACE;EAAU;EACZ,OACF;IAEA8C,EAAA,GAAA5D,UAAS,GAAAD,MAAA,CAAA6D,EAAA,cAAA5D,UAAA,cAAAA,UAAA,GAAAF,OAAA;IAET+D,MAAA,EAAO,SAAMA,OAAA3B,GAAA;MAAC,OAAAA,GAAA,CAAAG,IAAA;IAChB;IAEApC,IAAA,EAAO;MACLA,IAAI,EAAAM;IACJ;IACAuD,QAAQ,iBAAaA,SAAAC,KAAA;MAErB;QAAAC;MAAmB,IAAAD,KAAA;MACjB,IAAAtC,yBAAuB,OAAY;QAAAC,iBAAW;QAAAC,cAAA;MAC5C;QACA,SAAMC,SAAS,GAAAoC,WAAU,CAAAC,SAAc,CAAApC,MAAK,CAAAC,QAAS,KAAAC,KAAA,IAAAN,yBAAA,IAAAM,KAAA,GAAAH,SAAA,CAAAI,IAAA,IAAAC,IAAA,GAAAR,yBAAA;UACvD,IAAAyC,QAAA,GAAAnC,KAAA,CAAA7C,KAAA;UACF,IAAAiF,IAAA;UAEA,IAAUC,kBAAS,EAAAC,OAAkB;UACnC,IAAAnC,GAAW,GAAAgC,QAAA,CAAYI,QAAA;UACrB,MAAMpE,UAAM,CAAAqE,MAAS;YACrBC,UAAa,GAAAL,IAAA,GAAS,CAAAC,kBAAA,IAAAC,OAAA,GAAAI,MAAA,EAAAC,UAAA,cAAAN,kBAAA,uBAAAA,kBAAA,CAAAO,IAAA,CAAAN,OAAA,eAAAF,IAAA,cAAAA,IAAA,GAAAS,IAAA,CAAAC,MAAA,GAAAC,QAAA,KAAAC,SAAA;YACtBC,SAAM,EAASnF,YAAU,CAAAoF,SAAS,CAAAC,MAAQ;YAC5ChD,GAAA;cACF,GAAAA,GAAA;cAEUpC;YACR;UACE;QACA;MACF,SAAAwC,GAAA;QACFZ,iBAAA;QACFC,cAAA,GAAAW,GAAA;MACF;QAMO,IAAS;UAId,IAAO,CAAAb,yBAAA,IAA+BG,SAAA,CAAAW,MAAA,QAA+B;YACvEX,SAAA,CAAAW,MAAA","ignoreList":[]}
+{"version":3,"names":["__toCommonJS","mod","__copyProps","__defProp","value","collection_exports","__export","createFixtureCollection","createFrappeCollection","fixtureCollectionOptions","frappeCollectionOptions","module","exports","import_db","require","import_types","doctype","config","_config_id","sync","syncModule","fields","filters","orderBy","limit","onSyncError","syncFn","syncFn2","params","begin","write","commit","markReady","subscriptionId","storeUnsubscribe","lastKnownNames","Set","cancelled","initSync","query","result","subscribe","unsubscribe","initialDocs","getDocsForSubscription","length","_iteratorNormalCompletion","_didIteratorError","_iteratorError","_iterator","Symbol","iterator","_step","next","done","doc","type","add","name","err","return","subscribeStore","currentDocs","currentNames","map","d","_iteratorNormalCompletion2","_didIteratorError2","_iteratorError2","_iterator2","_step2","doc2","has","_iteratorNormalCompletion1","_didIteratorError1","_iteratorError1","_iterator1","_step1","error","console","id","getKey","onInsert","param","transaction","mutations","mutation","_ref","_crypto_randomUUID","_crypto","modified","mutate","mutationId","crypto","randomUUID","call","Math","random","toString","substring","operation","Operation","Create"],"sources":["../../src/collection.ts"],"sourcesContent":[null],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,YAAA,GAAAC,GAAA,IAAAC,WAAA,CAAAC,SAAA;EAAAC,KAAA;AAAA,IAAAH,GAAA;AAAA,IAAAI,kBAAA;AAAAC,QAAA,CAAAD,kBAAA;EAAAE,uBAAA,EAAAA,CAAA,KAAAA,uBAAA;EAAAC,sBAAA,EAAAA,CAAA,KAAAA,sBAAA;EAAAC,wBAAA,EAAAA,CAAA,KAAAA,wBAAA;EAAAC,uBAAA,EAAAA,CAAA,KAAAA;AAAA;AACAC,MAAA,CAAAC,OAAA,GAAiCZ,YAAA,CAAAK,kBAAA;AAIjC,IAAAQ,SAAA,GAAAC,OAA0B;AAoDnB,IAAAC,YAAS,GAAAD,OAAA,yBACd,CACA;AAEA,SAAMJ,uBAAoBA,CAAAM,OAAQ,EAAAC,MAAS;EAE3C,IAAAC,UAAM;EACJ;IAAAC,IAAQ,EAAAC,UAAO;IAAOC,MAAA;IAAQC,OAAA;IAAAC,OAAc;IAAAC,KAAA;IAAAC;EAAA,IAAAR,MAAA;EAE5C,IAAAS,MAAI,YAAAC,QAAAC,MAAA;IACJ,IAAI;MAAAC,KAAA;MAAAC,KAAA;MAAAC,MAAA;MAAAC;IAAA,IAAAJ,MAAA;IACJ,IAAIK,cAAA;IAMJ,IAAIC,gBAAY;IAEhB,IAAAC,cAAe,kBAAW,IAAAC,GAAA;IACxB,IAAAC,SAAI;IAEF,eAAMC,QAA2BA,CAAA;MAAA,IAC/B;QAAA,IACAC,KAAA;UACAvB,OAAA;UACAK,MAAA;UACAC,OAAA;UACFC,OAAA;UAEAC;QACA;QACE,IAAAgB,MAAA,GAAW,MAAApB,UAAY,CAAAqB,SAAO,CAAAF,KAAA,CAAc;QAC5C,IAAAF,SAAA;UACFjB,UAAA,CAAAsB,WAAA,CAAAF,MAAA,CAAAP,cAAA;UACA;QAGA;QACAA,cAAI,GAAYO,MAAA,CAAAP,cAAY;QAC1B,IAAAU,WAAM,GAAAvB,UAAA,CAAAwB,sBAAA,CAAAX,cAAA;QACN,IAAAU,WAAW,CAAAE,MAAO;UAChBhB,KAAA;UACA,IAAAiB,yBAA2B;YAAAC,iBAAA;YAAAC,cAAA;UAC7B;YACA,KAAO,IAAAC,SAAA,GAAAN,WAAA,CAAAO,MAAA,CAAAC,QAAA,KAAAC,KAAA,IAAAN,yBAAA,IAAAM,KAAA,GAAAH,SAAA,CAAAI,IAAA,IAAAC,IAAA,GAAAR,yBAAA;cACT,IAAAS,GAAA,GAAAH,KAAA,CAAAhD,KAAA;cAGA0B,KAAA;gBACO0B,IAAA,UAAgB;gBAEfpD,KAAA,EAAAmD;cACN,EAAM;cAENpB,cAAM,CAAAsB,GAAA,CAAAF,GAAA,CAAAG,IAAA;YAGN;UACE,SAAIC,GAAA;YACFZ,iBAAc;YAChBC,cAAO,GAAAW,GAAA;UACL,UAAM;YACR;cACF,KAAAb,yBAAA,IAAAG,SAAA,CAAAW,MAAA;gBAGAX,SAAW,CAAAW,MAAQ;cACjB;YACE,UAAM;cAAA,IACJb,iBAAM;gBACN,MAAAC,cAAe;cACjB;YACF;UACF;UAEAjB,MAAA,CAAO;QACP;QACFG,gBAAC,GAAAd,UAAA,CAAAyC,cAAA;UACH,KAAS5B,cAAO;UACd,IAAI6B,WAAW,GAAA1C,UAAA,CAAAwB,sBAAA,CAAAX,cAAA;UACf,IAAA8B,YAAc,OAAA3B,GAAA,CAAA0B,WAAA,CAAAE,GAAA,WAAAC,CAAA;YACd,OAAAA,CAAA,CAAAP,IAAc;UAChB;UACE7B,KAAK;UACP,IAAAqC,0BAAA;YAAAC,kBAAA;YAAAC,eAAA;UACF;YAEA,KAAS,IAAAC,UAAA,GAAAP,WAAA,CAAAZ,MAAA,CAAAC,QAAA,KAAAmB,MAAA,IAAAJ,0BAAA,IAAAI,MAAA,GAAAD,UAAA,CAAAhB,IAAA,IAAAC,IAAA,GAAAY,0BAAA;cAGF,IAAMK,IAAA,GAAAD,MAAA,CAAAlE,KAAA;cACX,IAAY+B,cAAA,CAAAqC,GAAA,CAAAD,IAAA,CAAAb,IAAA;gBACR5B,KAAA;kBACF0B,IAAA,UAAiB;kBACjBpD,KAAA,EAAAmE;gBACF;cACI;gBACFzC,KAAW;kBACX0B,IAAA,UAAiB;kBACnBpD,KAAA,EAAAmE;gBACF;cACF;YAEO;UACD,SAAOZ,GAAM;YACTQ,kBAAmB;YACnBC,eAAa,GAAAT,GAAA;UAErB,UAAU;YACR;cACQ,KAAAO,0BAAe,IAAAG,UAAA,CAAAT,MAAA;gBACfS,UAAW,CAAAT,MAAO;cACtB;YACA,UAAW;cACX,IAAOO,kBAAgB;gBACxB,MAAAC,eAAA;cACH;YACF;UAEA;UACE,IAAAK,0BAAuB,GAAY;YAAAC,kBAAW;YAAAC,eAAA;UAC5C,IAAM;YACN,KAAM,IAAOC,UAAS,GAAAzC,cAAA,CAAAe,MAAA,CAAAC,QAAA,KAAA0B,MAAA,IAAAJ,0BAAA,IAAAI,MAAA,GAAAD,UAAA,CAAAvB,IAAA,IAAAC,IAAA,GAAAmB,0BAAA;cAChB,IAAAf,IAAA,GAAWmB,MAAA,CAAOzE,KAAA;cACtB,KAAA2D,YAAmB,CAAAS,GAAA,CAAAd,IAAA,GAAa;gBAChC5B,KAAW;kBACJ0B,IAAG,UAAK;kBAChBpD,KAAA;oBACHsD,IAAA;oBACF1C;kBAEU;gBACR,CAAW;cACH;YACN;UACE,SAAA2C,GAAY;YACZe,kBAAW;YACXC,eAAgB,GAAAhB,GAAK;UACtB;YACH;cACF,KAAAc,0BAAA,IAAAG,UAAA,CAAAhB,MAAA;gBACFgB,UAAA,CAAAhB,MAAA;cACF;YA4BgB;cAIP,IAAAc,kBAAA;gBACT,MAAAC,eAAA;cA6BgB;YAIN;UAEF;UACE5C,MAAE;UAMJI,cAAY,GAAA4B,YAAA;QAEhB;MACE,SAAIe,KAAA;QACF,IAAAzC,SAAM;QAON0C,OAAM,CAAAD,KAAO,gDAAsC9D,OAAA,KAAA8D,KAAA;QAAArD,WACjD,aAAAA,WAAA,uBAAAA,WAAA,CAAAqD,KAAA;MAAA,UACA;QAAA,IACA,CAAAzC,SAAS,EAAAL,SAAA;MAAA;IACT;IACAM,QACD;IAED,mBAAe;MACfD,SAAI,GAAK;MACP,IAAAH,gBAAM;QACNA,gBAAW;QACTA,gBAAM,QAAY,CAAG;MACrB;MAAwC,IAC1CD,cAAA;QACAb,UAAO,CAAAsB,WAAA,CAAAT,cAAA;QACTA,cAAA;MACF;IACE;EACA;EAA8E,OAChF;IACE+C,EAAA,GAAA9D,UAAK,GAAAD,MAAW,CAAA+D,EAAA,MAAU,QAAA9D,UAAA,cAAAA,UAAA,GAAAF,OAAA;IAAAiE,MAC5B,WAAAA,OAAA1B,GAAA;MACF,OAAAA,GAAA,CAAAG,IAAA;IAEA;IAEAvC,IAAA;MACEA,IAAA,EAAAO;IACF;IACFwD,QAAA,iBAAAA,SAAAC,KAAA;MAEA,IAAO;QAAAC;MAAA,IAAAD,KAAA;MACL,IAAIrC,yBAAa;QAAAC,iBAAA;QAAAC,cAAA;MACjB;QACA,KAAQ,IAAAC,SAAa,GAAAmC,WAAA,CAAAC,SAAA,CAAAnC,MAAA,CAAAC,QAAA,KAAAC,KAAA,IAAAN,yBAAA,IAAAM,KAAA,GAAAH,SAAA,CAAAI,IAAA,IAAAC,IAAA,GAAAR,yBAAA;UAErB,IAAUwC,QAAO,GAAElC,KAAA,CAAAhD,KAAY;UAC7B,IAAAmF,IAAW;UACT,IAAMC,kBAAe,EAAAC,OAAA;UACrB,IAAMlC,GAAA,GAAA+B,QAAS,CAAAI,QAAU;UAC3B,MAAAtE,UAAA,CAAAuE,MAAA;YACFC,UAAA,GAAAL,IAAA,IAAAC,kBAAA,IAAAC,OAAA,GAAAI,MAAA,EAAAC,UAAA,cAAAN,kBAAA,uBAAAA,kBAAA,CAAAO,IAAA,CAAAN,OAAA,eAAAF,IAAA,cAAAA,IAAA,GAAAS,IAAA,CAAAC,MAAA,GAAAC,QAAA,KAAAC,SAAA;YAEAC,SAAiB,EAAErF,YAAY,CAAAsF,SAAM,CAAAC,MAAA;YACnC/C,GAAA,EAAW;cACH,GAAAA,GAAM;cACNvC;YACN;UACF;QACF;MAEA,SAAU2C,GAAA;QACRZ,iBAAW,OAAY;QACrBC,cAAa,GAAAW,GAAA;MACb,UAAM;QACR;UACF,KAAAb,yBAAA,IAAAG,SAAA,CAAAW,MAAA;YACFX,SAAA,CAAAW,MAAA;UACF;QAMO,CAAS;UAId,IAAOb,iBAAA;YACT,MAAAC,cAAA","ignoreList":[]}

package/dist/cjs/core/http.cjs

@@ -42,7 +42,22 @@ const defaultRetryConfig = {
   retryOnNetworkError: true,
   retryStatusCodes: [408, 429, 500, 502, 503, 504]
 };
+function isAbortError(err, signal) {
+  if (signal?.aborted) return true;
+  return err instanceof Error && err.name === "AbortError";
+}
 class HttpClient {
+  retryConfig;
+  // Language preference for Accept-Language header (used in SSR / React Native)
+  _language;
+  /** Server-bootstrapped CSRF token for React Native cookie auth (see ensureNativeCsrfToken). */
+  csrfToken;
+  /** True once a native CSRF bootstrap attempt completed (even if it yielded no token). */
+  csrfBootstrapDone = false;
+  /** In-flight CSRF bootstrap, deduped across concurrent mutating requests. */
+  csrfBootstrap;
+  baseURL;
+  auth;
   constructor(baseURL, auth, retryConfig) {
     this.baseURL = baseURL;
     this.auth = auth;
@@ -51,11 +66,6 @@ class HttpClient {
       ...retryConfig
     };
   }
-  baseURL;
-  auth;
-  retryConfig;
-  // Language preference for Accept-Language header (used in SSR / React Native)
-  _language;
   /** Set language preference for Accept-Language header on all requests. */
   setLanguage(lang) {
     this._language = lang;
@@ -76,6 +86,71 @@ class HttpClient {
       value: lang
     });
   }
+  /**
+   * React Native cookie-auth CSRF bootstrap.
+   *
+   * RN's fetch sends the OS cookie jar (so cookie-auth sessions work), but
+   * JS cannot READ those cookies — the platform `getCookie` shim is an
+   * in-memory map that never sees the `sid`/CSRF cookies — so mutating
+   * requests would 400 once the session has a CSRF token. Fetch the token
+   * from the server instead and cache it per client:
+   *
+   *   1. `GET /api/method/frappe.sessions.get_csrf_token` — whitelisted on
+   *      newer frappe versions; cheap JSON round-trip.
+   *   2. Fallback: `GET /app` and parse the `frappe.csrf_token = "…"` boot
+   *      script — works on every frappe (this repo's bench does NOT
+   *      whitelist the RPC above) and also generates the token server-side
+   *      when the session lacks one.
+   *
+   * Resolves undefined when neither source works (e.g. website-only session
+   * without desk access); requests then proceed without the header, which
+   * frappe accepts for sessions that have no CSRF token yet. The cache is
+   * dropped on auth change and on a 400 from a mutating request so a
+   * rotated session re-bootstraps.
+   */
+  async ensureNativeCsrfToken() {
+    if (this.csrfBootstrapDone) return this.csrfToken;
+    if (!this.csrfBootstrap) {
+      this.csrfBootstrap = this.fetchNativeCsrfToken().then(token => {
+        this.csrfToken = token;
+        this.csrfBootstrapDone = true;
+      }).finally(() => {
+        this.csrfBootstrap = void 0;
+      });
+    }
+    await this.csrfBootstrap;
+    return this.csrfToken;
+  }
+  async fetchNativeCsrfToken() {
+    try {
+      const rpcUrl = new URL("/api/method/frappe.sessions.get_csrf_token", this.baseURL).toString();
+      const res = await fetch(rpcUrl, {
+        method: "GET",
+        credentials: "include"
+      });
+      if (res.ok) {
+        const payload = await res.json();
+        if (typeof payload?.message === "string" && payload.message) return payload.message;
+      }
+    } catch {}
+    try {
+      const appUrl = new URL("/app", this.baseURL).toString();
+      const res = await fetch(appUrl, {
+        method: "GET",
+        credentials: "include"
+      });
+      if (res.ok) {
+        const html = await res.text();
+        const match = html.match(/frappe\.csrf_token\s*=\s*"([^"]+)"/);
+        if (match?.[1]) return match[1];
+      }
+    } catch {}
+    return void 0;
+  }
+  invalidateNativeCsrfToken() {
+    this.csrfToken = void 0;
+    this.csrfBootstrapDone = false;
+  }
   async getAuthHeaders() {
     if (!this.auth?.useToken) return {};
     const raw = typeof this.auth.token === "function" ? await this.auth.token() : this.auth?.token;
@@ -165,7 +240,8 @@ class HttpClient {
       headers.set("Accept-Language", lang);
     }
     if (!this.auth?.useToken && (0, import_util.isBrowser)() && method !== import_types.HttpMethod.Get) {
-      const csrf = (0, import_platform.getCookie)("frappe-csrf-token") || (0, import_platform.getCookie)("csrf_token") || globalThis.frappe?.csrf_token;
+      let csrf = (0, import_platform.getCookie)("frappe-csrf-token") || (0, import_platform.getCookie)("csrf_token") || globalThis.frappe?.csrf_token;
+      if (!csrf && import_platform.isNative) csrf = await this.ensureNativeCsrfToken();
       if (csrf) headers.set("X-Frappe-CSRF-Token", csrf);
     }
     const makeRequest = () => {
@@ -173,7 +249,8 @@ class HttpClient {
         method,
         headers,
         credentials: this.auth?.useToken ? "omit" : "include",
-        body
+        body,
+        signal: request?.signal
       });
     };
     let lastError;
@@ -186,6 +263,9 @@ class HttpClient {
           const payload2 = contentType3?.includes("application/json") ? await res.json() : await res.text();
           const message = payload2 && (payload2.message || payload2.exc || payload2._server_messages) || res.statusText;
           const err = new import_types.FrappeError(message, res.status, payload2);
+          if (import_platform.isNative && res.status === 400 && !this.auth?.useToken && method !== import_types.HttpMethod.Get) {
+            this.invalidateNativeCsrfToken();
+          }
           if (this.shouldRetryError(err, attempt)) {
             lastError = err;
             attempt++;
@@ -205,6 +285,7 @@ class HttpClient {
           _res: res
         };
       } catch (err) {
+        if (isAbortError(err, request?.signal)) throw err;
         if (this.shouldRetryError(err, attempt)) {
           lastError = err;
           attempt++;
@@ -218,10 +299,11 @@ class HttpClient {
     }
     throw lastError;
   }
-  get(path, params, headers) {
+  get(path, params, headers, signal) {
     const qs = params ? `?${new URLSearchParams(normalizeParams(params)).toString()}` : "";
     return this.request(import_types.HttpMethod.Get, `${path}${qs}`, {
-      headers
+      headers,
+      signal
     });
   }
   post(path, body, headers) {
@@ -253,6 +335,7 @@ class HttpClient {
   }
   updateAuth(auth) {
     this.auth = auth;
+    this.invalidateNativeCsrfToken();
   }
 }
 function normalizeParams(params) {