@teaflask/assistant 0.3.0 → 0.6.0

package/dist/transport/stream-resume.js

@@ -13,129 +13,30 @@ import { EMPTY_TOOL_REFUSAL_ANCHORS, withToolRefusalAnchored, } from "../core/to
 import { EMPTY_TOOL_OFFLOAD_ANCHORS, withToolOffloadAnchored, } from "../core/tool-offload-anchors.js";
 import { EMPTY_SUBAGENT_DELIVERY_ANCHORS, withSubagentDeliveryAnchored, } from "../core/subagent-delivery-anchors.js";
 import { EMPTY_TURN_FAILED_ANCHORS, withTurnFailedAnchored, } from "../core/turn-failed-anchors.js";
-/**
- * A conversation's resume state, held above the Transcript remount
- * boundary: reconnect works by remounting a fresh agent, so anything the
- * next connection needs must outlive the current one.
- *
- * A snapshot is a consistent pair — the applied message list and the
- * cursor of the newest received frame — recorded at any BLOCK-COMPLETE,
- * non-failed close that committed a cursor: a settled terminal, or the
- * parked contract's quiet close (a background attach seeds its
- * fresh agent from this pair, and a parked page whose close recorded
- * nothing would re-seed an EMPTY transcript). A snapshot is never proof
- * the run settled — only that the pair is consistent. A mid-BLOCK
- * interruption keeps the previous pair; the server re-delivers the
- * unsettled run in full from its boundary, and the seeded agent de-dupes
- * by the contract's stable ids.
- */
 export class StreamResumeStore {
     snapshot = null;
-    // Resume anchors survive remounts here: a resumed stream never replays
-    // the historical run_resumed markers the severance scan reads.
-    // Each anchor keeps its marker's raw payload as provenance — the wire
-    // (round, attempt) the arbitration key was derived from.
     resumeAnchors = new Map();
-    // Failure-receipt anchors survive remounts for a sharper reason than
-    // their siblings: a failed run's recorded RUN_ERROR demotes to
-    // RUN_FINISHED on replay, but the turn_failed marker replays verbatim,
-    // so a reconnect re-anchors it idempotently. Same degrade seam.
     turnFailedAnchors = EMPTY_TURN_FAILED_ANCHORS;
-    // The four tool-outcome anchor families below survive remounts for the
-    // same reason: the transport lifts the wire's TOOL_CALL_RESULT extras
-    // into event metadata (core/tool-outcome.ts) and the 1.0 client carries
-    // that metadata onto the tool message it mints, but a snapshot-seeded
-    // reconnect replays only past the cursor — so these maps and sets are
-    // what re-anchors historical calls, and the read path the projection
-    // consults for every call.
     toolErrorAnchors = EMPTY_TOOL_ERROR_ANCHORS;
     toolRefusalAnchors = EMPTY_TOOL_REFUSAL_ANCHORS;
     toolCancelAnchors = EMPTY_TOOL_CANCEL_ANCHORS;
     toolOffloadAnchors = EMPTY_TOOL_OFFLOAD_ANCHORS;
-    // Tool-decision anchors: the durable "a member decision rode
-    // this call" record the placement hold reads. The card stores prune at
-    // the gated call's result and the turn's settle by design, and a
-    // snapshot-seeded reconnect replays only past the cursor, so this set
-    // is the decision-bearing calls' only durable home.
     toolDecisionAnchors = EMPTY_TOOL_DECISION_ANCHORS;
-    // The tool-denial ledger: the durable "a member declined this
-    // call's approval" record the state ladder reads, joined from the two
-    // approval markers. The inbox card that knew the same fact dies to the
-    // gated call's cancelled result by design, and a snapshot-seeded
-    // reconnect replays only past the cursor — so this ledger is the
-    // denied calls' only durable home, and its ask map is what lets a
-    // resolution streamed after the cursor still find its call.
     toolDenialLedger = EMPTY_TOOL_DENIAL_LEDGER;
-    // Display anchors survive remounts for the same reason: the
-    // tool_call_annotated marker never becomes a message, and a
-    // snapshot-seeded reconnect replays only past the cursor, so this map
-    // is historical rows' only source of backend-authored copy.
     toolCallDisplayAnchors = EMPTY_TOOL_CALL_DISPLAY_ANCHORS;
-    // Schema anchors survive remounts for the same reason: the
-    // schemas ride the same marker's siblings (and the approval card's
-    // fields), never a message, so this map is the calls' only client home
-    // for argsSchema / resultSchema.
     toolSchemaAnchors = EMPTY_TOOL_SCHEMA_ANCHORS;
-    // Delivery-receipt anchors survive remounts for the same reason: a
-    // snapshot-seeded reconnect replays only past the cursor, so the
-    // historical subagent_results_delivered markers the dividers were
-    // derived from never re-arrive on the wire. Same degrade seam: the
-    // transcript re-validates on seed, so a malformed entry becomes a
-    // missing row, never a wedged resume.
     subagentDeliveryAnchors = EMPTY_SUBAGENT_DELIVERY_ANCHORS;
-    // Block-timing anchors survive remounts for the same reason:
-    // the client carries no per-event server timestamp onto the messages it
-    // builds, and a snapshot-seeded reconnect replays only past the cursor,
-    // so this map is historical blocks' only timing home.
-    // Unlike every sibling anchor, the backing map MUTATES: timing moves
-    // on every block boundary, and a copy-per-write would cost O(N) per
-    // event — O(N²) over an N-block replay — so blockTimingRevision, not
-    // map identity, is the change signal (entries stay immutable; the
-    // snapshot derivation copies before publishing).
     blockTimingRevision = 0;
     _blockTimingAnchors = new Map();
     get blockTimingAnchors() {
         return this._blockTimingAnchors;
     }
-    // Turn-usage anchors survive remounts for the same reason:
-    // the turn_usage_recorded marker never becomes a message. Absence
-    // means usage unknown — the number hides, never estimates.
     turnUsageAnchors = EMPTY_TURN_USAGE_ANCHORS;
-    // Memory-provenance anchors survive remounts for the same
-    // reason: the memory_updated marker never becomes a message. Keyed by
-    // the durable memory id, so re-deliveries reconcile, never duplicate.
     memoryProvenanceAnchors = EMPTY_MEMORY_PROVENANCE_ANCHORS;
-    // Memory-attribution anchors: memory id → the assistant
-    // prose message its footer renders under. Survives remounts with its
-    // provenance sibling; first attribution wins (the anchor family's
-    // drifted-message arbitration), so a re-delivery never moves a footer.
     memoryAttributionAnchors = EMPTY_MEMORY_ATTRIBUTION_ANCHORS;
-    // One anchor per RESUMPTION, ever: the parked snapshot's
-    // cursor sits inside an unsettled run, so a background attach's
-    // boundary-snap re-delivers that run in full — content filtered,
-    // CUSTOM markers passed by design — and an unarbitrated run_resumed
-    // would flush under a drifted message id (the first post-attach
-    // message). Keyed by run id plus the payload's own (round, attempt)
-    // — round-less legacy rows by their event's stamped timestamp — wire
-    // data either way, no client-side counting; the premise
-    // lives at recordResumeAnchor.
     anchoredResumptions = new Set();
-    // One receipt row per failed run, ever: re-deliveries (StrictMode's
-    // double connection, every reconnect's replay) flush against whatever
-    // the message list holds at that moment, so the same receipt can try
-    // to anchor under a different message id. First anchor wins.
     anchoredFailedRuns = new Set();
-    // One divider per delivery run, ever: a re-delivery flushes against
-    // whatever the message list holds at that moment, so the same divider
-    // can try to anchor under a drifted message id — the run's own id
-    // arbitrates, first anchor wins.
     anchoredDeliveryRuns = new Set();
-    /** Returns false when this resumption already anchored. Keyed by run id
-     *  plus the payload's own (round, attempt) — a round-less legacy row by the
-     *  marker's stamped timestamp; premises: docs/stream-resume.md. */
-    // markerTimestamp is REQUIRED, not defaulted: the untimed collapse
-    // branch is a documented degradation, and a caller must say null out
-    // loud to land on it — never arrive there by omitting an argument.
     recordResumeAnchor(runId, messageId, markerValue, markerTimestamp) {
         const attempt = _wireCounterOf(markerValue, "attempt");
         const carriesRound = typeof markerValue === "object" &&
@@ -148,12 +49,9 @@ export class StreamResumeStore {
             return false;
         }
         this.anchoredResumptions.add(key);
-        // Null, never undefined: consumers read presence with .get(), and a
-        // payload-less legacy marker must still read as anchored.
         this.resumeAnchors.set(messageId, markerValue ?? null);
         return true;
     }
-    /** Returns false when this failed run's receipt already anchored. */
     recordTurnFailedReceipts(failedRunId, messageId, position, receipts) {
         if (this.anchoredFailedRuns.has(failedRunId)) {
             return false;
@@ -162,7 +60,6 @@ export class StreamResumeStore {
         this.turnFailedAnchors = withTurnFailedAnchored(this.turnFailedAnchors, messageId, position, receipts);
         return true;
     }
-    /** Returns false when this delivery run's receipt already anchored. */
     recordSubagentDelivery(deliveryRunId, messageId, results) {
         if (this.anchoredDeliveryRuns.has(deliveryRunId)) {
             return false;
@@ -209,19 +106,10 @@ export class StreamResumeStore {
     recordMemoryAttribution(memoryId, messageId) {
         this.memoryAttributionAnchors = withMemoryAttributed(this.memoryAttributionAnchors, memoryId, messageId);
     }
-    /** Records the resume pair. Named for what it records — a consistent
-     *  (messages, cursor) PAIR, at any block-complete close, terminal or
-     *  quiet — never an assertion that the run settled (the recording
-     *  rule lives at resumeSnapshotRecorder). */
     recordPair(afterId, messages) {
         this.snapshot = { afterId, messages: structuredClone([...messages]) };
     }
 }
-/** The tolerant wire read behind the resume arbitration key (the
- *  approval-inbox idiom): legacy markers may carry no payload at all,
- *  so a missing or non-numeric field reads as 0. Round-less rows never
- *  reach the round read — the key's legacy branch uses the event's
- *  stamped timestamp instead (see recordResumeAnchor). */
 function _wireCounterOf(payload, field) {
     if (typeof payload !== "object" || payload === null) {
         return 0;
@@ -229,21 +117,7 @@ function _wireCounterOf(payload, field) {
     const value = payload[field];
     return typeof value === "number" ? value : 0;
 }
-/**
- * A run_resumed CUSTOM event never becomes a message, so it cannot be
- * read from the message list alone. This subscriber anchors each marker
- * to the first message that appears after it; the transcript's
- * severance scan reads the anchor to mark the prior attempt's
- * open calls as interrupted.
- */
 export function resumeMarkerRecorder(onResumeAnchored) {
-    // Null (never undefined) doubles as both "no marker pending" reset and
-    // a payload-less legacy marker; pendingMarker tracks presence itself.
-    // The marker remembers the run it rode in on, plus the event's own
-    // stamped timestamp (read off the raw event, because the apply pipeline
-    // drops it); the store derives the arbitration key from the run id and the
-    // payload's own (round, attempt), falling back to the timestamp for
-    // round-less legacy rows — no ordinal is counted here.
     let pendingMarker = null;
     let currentRunId = null;
     return {
@@ -270,23 +144,6 @@ export function resumeMarkerRecorder(onResumeAnchored) {
         },
     };
 }
-/**
- * The subscriber that records a resume pair: at any close that is
- * BLOCK-COMPLETE (every block START this connection applied has its END),
- * non-failed, and committed a cursor — terminal or quiet. The
- * premises, and what breaks if the gate is wrong: docs/stream-resume.md.
- *
- * A resumed stream that closed silently applied nothing and committed
- * no cursor — the cursor guard keeps the previous pair. The state
- * resets per run: one agent can be connected more than once, and a
- * stale failure must not veto (or stale completeness approve) a later
- * run's recording.
- *
- * Subscribe this through the component tree, never on a bare agent: only
- * the mounted agent's message list carries the injector's spliced user
- * messages, and an orphaned connection recording its bare list would
- * poison the store.
- */
 export function resumeSnapshotRecorder(cursorOf, store) {
     let failed = false;
     const openBlocks = new Set();
@@ -295,9 +152,6 @@ export function resumeSnapshotRecorder(cursorOf, store) {
             failed = false;
             openBlocks.clear();
         },
-        // The pipeline routes run lifecycle to the dedicated handlers and
-        // everything else (content, markers) through onEvent — where the
-        // block ledger tracks every START against its END.
         onEvent({ event }) {
             const edge = _blockEdgeOf(event);
             if (edge === null) {
@@ -314,8 +168,6 @@ export function resumeSnapshotRecorder(cursorOf, store) {
             failed = true;
         },
         onRunFinalized({ messages }) {
-            // By finalize the scanner has seen every byte the parser
-            // dispatched, so the cursor and the applied messages agree.
             const cursor = cursorOf();
             if (!failed && openBlocks.size === 0 && cursor !== null) {
                 store.recordPair(cursor, messages);
@@ -323,10 +175,6 @@ export function resumeSnapshotRecorder(cursorOf, store) {
         },
     };
 }
-/** The block ledger's edges: which events open a content block and which
- *  close it, keyed so unrelated block families cannot cancel each other.
- *  Atomic events (TOOL_CALL_RESULT, markers, lifecycle) hold no open
- *  state and return null. */
 function _blockEdgeOf(event) {
     const messageKey = () => `message:${event.messageId}`;
     const toolKey = () => `tool:${event.toolCallId}`;
@@ -351,26 +199,9 @@ function _blockEdgeOf(event) {
             return null;
     }
 }
-// The id: line carries a decimal integer by contract; anything else on
-// the wire is not a cursor and must not be echoed back.
 const DECIMAL_ID = /^\d+$/;
-/**
- * Reads the SSE `id:` lines off the raw response bytes. `@ag-ui/client`'s
- * parser surfaces only `data:` lines, so the cursor is captured by teeing
- * the body through a pass-through transform — bytes reach the parser
- * untouched. An id is committed only at its frame's terminating blank
- * line: an `id:` whose frame never completed was never dispatched by the
- * parser either, and must not advance the cursor.
- */
 export class SseFrameIdScanner {
     lastEventId = null;
-    // Whether THIS connection's SSE body has delivered any bytes at all —
-    // keepalive comment frames included, since they never commit a cursor
-    // but do prove the wire was alive past the headers. The liveness fact
-    // for failure classification, kept apart from lastEventId on
-    // purpose: the replay cursor answers "what do we replay past", not
-    // "did bytes flow", and overloading it misread keepalive-only
-    // connections as never-responded.
     bodyBytesSeen = false;
     buffer = "";
     pendingId = null;
@@ -390,9 +221,6 @@ export class SseFrameIdScanner {
             });
         };
     }
-    // A hand-rolled pump instead of pipeThrough(TransformStream): the pipe's
-    // internal promise surfaces source errors as unhandled rejections (Node),
-    // while a rejecting pull() errors the stream through a handled path.
     _scannedCopyOf(body) {
         const reader = body.getReader();
         return new ReadableStream({
@@ -405,14 +233,9 @@ export class SseFrameIdScanner {
                 this._scan(value);
                 controller.enqueue(value);
             },
-            // Cancelling an already-errored source rejects; the stream is being
-            // abandoned either way, so that rejection must not escape.
             cancel: (reason) => reader.cancel(reason).catch(() => undefined),
         });
     }
-    // A retried connection must not inherit the previous body's partial
-    // line or frame — nor its liveness fact; the committed cursor survives
-    // on purpose.
     _resetConnectionState() {
         this.buffer = "";
         this.pendingId = null;
@@ -451,4 +274,3 @@ function _isEventStream(response) {
     const contentType = response.headers.get("content-type") ?? "";
     return contentType.startsWith("text/event-stream");
 }
-//# sourceMappingURL=stream-resume.js.map

package/dist/transport/token-session.d.ts

@@ -1,29 +1,23 @@
 import type { MintVisitorTokenResponse } from "../contract/identity.js";
 import { ServingApiError } from "./serving-error.js";
+export declare const END_USER_ID_MISMATCH = "END_USER_ID_MISMATCH";
 export interface TokenSessionConfig {
     publishableKey: string;
     baseUrl: string;
     getEndUserToken?: () => string | null | Promise<string | null>;
+    expectedEndUserId?: string;
     claimThreadId?: () => string | null;
     onMinted?: (response: MintVisitorTokenResponse) => void;
     onMintFailed?: (error: ServingApiError) => void;
 }
-/**
- * The visitor-token lifecycle in one place: mint on first need, re-mint
- * proactively before expiry, retry any 401 exactly once after a forced
- * re-mint, and retry the sign-in-required 403 exactly once when the
- * forced re-mint comes back identified (the visitor signed in after the
- * cached token was minted; without this the widget would keep serving
- * the stale anonymous token until the proactive re-mint). Every other
- * transport call goes through `authorizedFetch`, so streams and REST
- * calls share the same lifecycle.
- */
 export declare class TokenSession {
     readonly baseUrl: string;
     private readonly config;
     private visitorToken;
     private mintInFlight;
     private remintTimer;
+    private transientFailureReported;
+    private _generation;
     constructor(config: TokenSessionConfig);
     readonly authorizedFetch: (url: string, requestInit?: RequestInit) => Promise<Response>;
     dispose(): void;
@@ -31,8 +25,9 @@ export declare class TokenSession {
     private _remintAfterRejection;
     private _mintSingleFlight;
     private _mint;
+    private _reportMintFailure;
     private _buildMintRequest;
     private _scheduleProactiveRemint;
+    private _armRemint;
     private _clearRemintTimer;
 }
-//# sourceMappingURL=token-session.d.ts.map

package/dist/transport/token-session.js

@@ -1,29 +1,22 @@
 import { getMintVisitorTokenUrl } from "../generated/serving.js";
 import { parseServingError, ServingApiError } from "./serving-error.js";
-// Re-mint at 80% of the token's lifetime: early enough that a healthy tab
-// never sends with an expired token, late enough to keep mints rare.
 const PROACTIVE_REMINT_FRACTION = 0.8;
-/**
- * The visitor-token lifecycle in one place: mint on first need, re-mint
- * proactively before expiry, retry any 401 exactly once after a forced
- * re-mint, and retry the sign-in-required 403 exactly once when the
- * forced re-mint comes back identified (the visitor signed in after the
- * cached token was minted; without this the widget would keep serving
- * the stale anonymous token until the proactive re-mint). Every other
- * transport call goes through `authorizedFetch`, so streams and REST
- * calls share the same lifecycle.
- */
+const EXPIRY_MARGIN_SECONDS = 30;
+const REMINT_RETRY_BASE_MS = 15_000;
+const REMINT_RETRY_CAP_MS = 300_000;
+export const END_USER_ID_MISMATCH = "END_USER_ID_MISMATCH";
 export class TokenSession {
     baseUrl;
     config;
     visitorToken = null;
     mintInFlight = null;
     remintTimer = null;
+    transientFailureReported = false;
+    _generation = 0;
     constructor(config) {
         this.config = config;
         this.baseUrl = config.baseUrl;
     }
-    // Bound so it can be handed to HttpAgent's `fetch` option directly.
     authorizedFetch = async (url, requestInit = {}) => {
         const token = await this._currentToken();
         const response = await fetch(url, _withBearer(requestInit, token));
@@ -32,12 +25,6 @@ export class TokenSession {
             return fetch(url, _withBearer(requestInit, minted.visitor_token));
         }
         if (response.status === 403 && (await _saysSignInRequired(response))) {
-            // A re-mint can only help if the host can vouch NOW: ask the
-            // identity callback first. Unwired hosts, signed-out visitors, and
-            // a callback that fails (their token endpoint down) alike surface
-            // the sentence — the actionable copy — without burning a mint
-            // against the shared mint windows or dropping a still-valid
-            // cached token.
             let vouch;
             try {
                 vouch = (await this.config.getEndUserToken?.()) ?? null;
@@ -48,11 +35,6 @@ export class TokenSession {
             if (vouch === null) {
                 return response;
             }
-            // The visitor signed in after this token was minted: one forced
-            // re-mint picks the vouch up now. A mint that fails (it already
-            // notified onMintFailed) or comes back still anonymous means
-            // there is nothing to retry with — surface the sentence, never a
-            // mint error, never a loop.
             let minted;
             try {
                 minted = await this._remintAfterRejection(vouch);
@@ -68,34 +50,38 @@ export class TokenSession {
         return response;
     };
     dispose() {
+        this._generation += 1;
         this._clearRemintTimer();
+        this.visitorToken = null;
+        this.mintInFlight = null;
+        this.transientFailureReported = false;
     }
     async _currentToken() {
-        if (this.visitorToken !== null) {
-            return this.visitorToken;
+        if (this.visitorToken !== null &&
+            Date.now() < this.visitorToken.expiresAtMs) {
+            return this.visitorToken.value;
         }
         const minted = await this._mintSingleFlight();
         return minted.visitor_token;
     }
-    // The token was rejected, so it must not be served again; the single
-    // retry rides the fresh mint (which re-invokes getEndUserToken, so a
-    // rotated customer JWT — or a sign-in since the last mint — is picked
-    // up; a vouch the caller already probed threads through instead of a
-    // second host round-trip). Answers the whole mint so the caller can
-    // read the tier.
     async _remintAfterRejection(vouch) {
         this.visitorToken = null;
         return this._mintSingleFlight(vouch);
     }
     _mintSingleFlight(vouch) {
-        this.mintInFlight ??= this._mint(vouch).finally(() => {
-            this.mintInFlight = null;
-        });
+        if (this.mintInFlight === null) {
+            const flight = this._mint(vouch).finally(() => {
+                if (this.mintInFlight === flight) {
+                    this.mintInFlight = null;
+                }
+            });
+            this.mintInFlight = flight;
+        }
         return this.mintInFlight;
     }
-    // Raw fetch on purpose: the mint IS the session bootstrap, so it cannot
-    // ride the generated client (whose mutator requires a minted session).
-    async _mint(vouch) {
+    async _mint(vouch, retriedForUser = false) {
+        const generation = this._generation;
+        const disposed = () => generation !== this._generation;
         const response = await fetch(`${this.config.baseUrl}${getMintVisitorTokenUrl()}`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
@@ -103,15 +89,47 @@ export class TokenSession {
         });
         if (!response.ok) {
             const error = await parseServingError(response);
-            this.config.onMintFailed?.(error);
+            if (!disposed()) {
+                this._reportMintFailure(error);
+            }
             throw error;
         }
         const minted = (await response.json());
-        this.visitorToken = minted.visitor_token;
+        if (disposed()) {
+            return minted;
+        }
+        if (_namesAnotherUser(minted, this.config.expectedEndUserId)) {
+            if (!retriedForUser) {
+                return this._mint(undefined, true);
+            }
+            this.visitorToken = null;
+            const error = new ServingApiError({
+                code: END_USER_ID_MISMATCH,
+                status: response.status,
+                message: "The signed-in user this page names is not the user the server verified. Keep userId in step with the user your backend signs the end-user token for.",
+                retryAfterSeconds: null,
+            });
+            this.config.onMintFailed?.(error);
+            throw error;
+        }
+        this.visitorToken = {
+            value: minted.visitor_token,
+            expiresAtMs: Date.now() + (minted.expires_in - EXPIRY_MARGIN_SECONDS) * 1000,
+        };
+        this.transientFailureReported = false;
         this._scheduleProactiveRemint(minted.expires_in);
         this.config.onMinted?.(minted);
         return minted;
     }
+    _reportMintFailure(error) {
+        if (_mayClearOnItsOwn(error)) {
+            if (this.transientFailureReported) {
+                return;
+            }
+            this.transientFailureReported = true;
+        }
+        this.config.onMintFailed?.(error);
+    }
     async _buildMintRequest(vouch) {
         const endUserToken = vouch ?? (await this.config.getEndUserToken?.()) ?? null;
         const request = {
@@ -127,17 +145,20 @@ export class TokenSession {
         return request;
     }
     _scheduleProactiveRemint(expiresInSeconds) {
+        this._armRemint(expiresInSeconds * PROACTIVE_REMINT_FRACTION * 1000, 0);
+    }
+    _armRemint(delayMs, failedAttempts) {
         if (typeof window === "undefined") {
             return;
         }
         this._clearRemintTimer();
-        const delayMs = expiresInSeconds * PROACTIVE_REMINT_FRACTION * 1000;
+        const generation = this._generation;
         this.remintTimer = setTimeout(() => {
-            // The old token keeps serving until the fresh one lands — it is
-            // still valid for the remaining ~20% of its lifetime. A failed
-            // proactive mint already notified onMintFailed; the next request
-            // mints again.
-            this._mintSingleFlight().catch(() => undefined);
+            this._mintSingleFlight().catch((error) => {
+                if (generation === this._generation && _mayClearOnItsOwn(error)) {
+                    this._armRemint(_remintRetryDelayMs(failedAttempts, error), failedAttempts + 1);
+                }
+            });
         }, delayMs);
     }
     _clearRemintTimer() {
@@ -147,13 +168,30 @@ export class TokenSession {
         }
     }
 }
+function _mayClearOnItsOwn(error) {
+    if (!(error instanceof ServingApiError)) {
+        return true;
+    }
+    return error.status >= 500 || error.status === 429;
+}
+function _remintRetryDelayMs(failedAttempts, error) {
+    const backoffMs = Math.min(REMINT_RETRY_BASE_MS * 2 ** failedAttempts, REMINT_RETRY_CAP_MS);
+    const retryAfterMs = error instanceof ServingApiError && error.retryAfterSeconds !== null
+        ? error.retryAfterSeconds * 1000
+        : 0;
+    return Math.max(backoffMs, retryAfterMs) * (1 + Math.random() * 0.4);
+}
+function _namesAnotherUser(minted, expectedEndUserId) {
+    return (minted.tier === "identified" &&
+        expectedEndUserId !== undefined &&
+        typeof minted.end_user_id === "string" &&
+        minted.end_user_id !== expectedEndUserId);
+}
 function _withBearer(requestInit, token) {
     const headers = new Headers(requestInit.headers);
     headers.set("Authorization", `Bearer ${token}`);
     return { ...requestInit, headers };
 }
-// Reads a clone, so the caller can still hand the original response (and
-// its unread body) up to the surface's error copy.
 async function _saysSignInRequired(response) {
     try {
         const body = (await response.clone().json());
@@ -163,4 +201,3 @@ async function _saysSignInRequired(response) {
         return false;
     }
 }
-//# sourceMappingURL=token-session.js.map