assistant-cloud 0.1.42 → 0.1.43

package/dist/AssistantCloudAuthStrategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AssistantCloudAuthStrategy.d.ts","names":[],"sources":["../src/AssistantCloudAuthStrategy.ts"],"mappings":";KAMY;WACD;EACT,kBAAkB,QAAQ;EAC1B,gBAAgB,SAAS;;cAmFd,yCAAyC;;WACpC;UAER;UACA;UACA;EAGI,YAAA,yBAAyB;EAIxB,kBAAkB,QAAQ;UA0BzB;EAUP,gBAAgB,SAAS;;cAcrB,4CAA4C;;WACvC;EAMJ,YAAA,gBAAgB,gBAAgB;EAM/B,kBAAkB,QAAQ;EAQhC;;cA0EI,+CAA+C;WAC1C;UAER;UACA;EAEI,YAAA;EAoEC,kBAAkB,QAAQ;EAIhC,gBAAgB,SAAS"}
+{"version":3,"file":"AssistantCloudAuthStrategy.d.ts","names":[],"sources":["../src/AssistantCloudAuthStrategy.ts"],"mappings":";KAkCY;WACD;EACT,kBAAkB,QAAQ;EAC1B,gBAAgB,SAAS;;cAmFd,yCAAyC;;WACpC;UAER;UACA;UACA;EAGI,YAAA,yBAAyB;EAIxB,kBAAkB,QAAQ;UA0BzB;EAUP,gBAAgB,SAAS;;cAcrB,4CAA4C;;WACvC;EAMJ,YAAA,gBAAgB,gBAAgB;EAM/B,kBAAkB,QAAQ;EAQhC;;cAwHI,+CAA+C;WAC1C;UAER;UACA;EAEI,YAAA;EAwFC,kBAAkB,QAAQ;EAIhC,gBAAgB,SAAS"}

package/dist/AssistantCloudAuthStrategy.js

@@ -1,5 +1,22 @@
 import { CloudResponseError, readCloudRecord, readCloudString } from "./cloudResponse.js";
 //#region src/AssistantCloudAuthStrategy.ts
+const AUTH_TOKEN_REQUEST_TIMEOUT_MS = 3e4;
+const withAuthTokenDeadline = async (operation, run) => {
+	const controller = new AbortController();
+	let timedOut = false;
+	const timeout = setTimeout(() => {
+		timedOut = true;
+		controller.abort();
+	}, AUTH_TOKEN_REQUEST_TIMEOUT_MS);
+	try {
+		return await run(controller.signal);
+	} catch (error) {
+		if (timedOut) throw new Error(`Assistant Cloud ${operation} timed out after ${AUTH_TOKEN_REQUEST_TIMEOUT_MS}ms`, { cause: error });
+		throw error;
+	} finally {
+		clearTimeout(timeout);
+	}
+};
 const getJwtExpiry = (jwt) => {
 	try {
 		const bodyPart = jwt.split(".")[1];
@@ -149,36 +166,70 @@ const removeRefreshToken = (baseUrl) => {
 		storage.removeItem(getRefreshTokenName(baseUrl));
 	} catch {}
 };
+const anonymousAuthTokenRequests = /* @__PURE__ */ new WeakMap();
+const getWebLockManager = () => {
+	if (!("navigator" in globalThis)) return null;
+	return globalThis.navigator?.locks ?? null;
+};
+const getAnonymousAuthLockName = (baseUrl) => `assistant-cloud:anonymous-auth:${baseUrl}`;
+const getSharedAnonymousAuthToken = (baseUrl, requestToken) => {
+	const storage = getLocalStorage();
+	if (!storage) return requestToken();
+	let storageRequests = anonymousAuthTokenRequests.get(storage);
+	if (!storageRequests) {
+		storageRequests = /* @__PURE__ */ new Map();
+		anonymousAuthTokenRequests.set(storage, storageRequests);
+	}
+	const activeRequest = storageRequests.get(baseUrl);
+	if (activeRequest) return activeRequest;
+	const locks = getWebLockManager();
+	const sharedRequest = (locks ? locks.request(getAnonymousAuthLockName(baseUrl), requestToken) : requestToken()).finally(() => {
+		if (storageRequests.get(baseUrl) === sharedRequest) storageRequests.delete(baseUrl);
+	});
+	storageRequests.set(baseUrl, sharedRequest);
+	return sharedRequest;
+};
 var AssistantCloudAnonymousAuthStrategy = class {
 	strategy = "anon";
 	baseUrl;
 	jwtStrategy;
 	constructor(baseUrl) {
 		this.baseUrl = baseUrl;
-		this.jwtStrategy = new AssistantCloudJWTAuthStrategy(async () => {
+		const requestAuthToken = async () => {
 			const currentTime = Date.now();
 			const storedRefreshToken = readRefreshToken(this.baseUrl);
 			if (storedRefreshToken) {
 				if (new Date(storedRefreshToken.expires_at).getTime() - currentTime > 3e4) {
-					const response = await fetch(`${this.baseUrl}/v1/auth/tokens/refresh`, {
-						method: "POST",
-						headers: { "Content-Type": "application/json" },
-						body: JSON.stringify({ refresh_token: storedRefreshToken.token })
+					const refreshedAccessToken = await withAuthTokenDeadline("refresh token request", async (signal) => {
+						const response = await fetch(`${this.baseUrl}/v1/auth/tokens/refresh`, {
+							method: "POST",
+							headers: { "Content-Type": "application/json" },
+							body: JSON.stringify({ refresh_token: storedRefreshToken.token }),
+							signal
+						});
+						if (response.ok) {
+							const { data, accessToken } = await readAuthTokenResponse(response, "refresh auth token response");
+							if (data.refresh_token != null) writeRefreshToken(this.baseUrl, readRefreshTokenResponse(data.refresh_token, "refresh auth token response.refresh_token"));
+							return accessToken;
+						}
+						if (response.status === 429 || response.status >= 500) throw new Error(`Assistant Cloud token refresh failed with status ${response.status}`);
+						return null;
 					});
-					if (response.ok) {
-						const { data, accessToken } = await readAuthTokenResponse(response, "refresh auth token response");
-						if (data.refresh_token != null) writeRefreshToken(this.baseUrl, readRefreshTokenResponse(data.refresh_token, "refresh auth token response.refresh_token"));
-						return accessToken;
-					}
-					if (response.status === 429 || response.status >= 500) throw new Error(`Assistant Cloud token refresh failed with status ${response.status}`);
+					if (refreshedAccessToken !== null) return refreshedAccessToken;
 				} else removeRefreshToken(this.baseUrl);
 			}
-			const response = await fetch(`${this.baseUrl}/v1/auth/tokens/anonymous`, { method: "POST" });
-			if (!response.ok) return null;
-			const { data, accessToken } = await readAuthTokenResponse(response, "anonymous auth token response");
-			writeRefreshToken(this.baseUrl, readRefreshTokenResponse(data.refresh_token, "anonymous auth token response.refresh_token"));
-			return accessToken;
-		});
+			return withAuthTokenDeadline("anonymous token request", async (signal) => {
+				const response = await fetch(`${this.baseUrl}/v1/auth/tokens/anonymous`, {
+					method: "POST",
+					signal
+				});
+				if (!response.ok) return null;
+				const { data, accessToken } = await readAuthTokenResponse(response, "anonymous auth token response");
+				writeRefreshToken(this.baseUrl, readRefreshTokenResponse(data.refresh_token, "anonymous auth token response.refresh_token"));
+				return accessToken;
+			});
+		};
+		this.jwtStrategy = new AssistantCloudJWTAuthStrategy(() => getSharedAnonymousAuthToken(this.baseUrl, requestAuthToken));
 	}
 	async getAuthHeaders() {
 		return this.jwtStrategy.getAuthHeaders();

package/dist/AssistantCloudAuthStrategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"AssistantCloudAuthStrategy.js","names":["#authTokenCallback","#apiKey","#userId","#workspaceId"],"sources":["../src/AssistantCloudAuthStrategy.ts"],"sourcesContent":["import {\n  CloudResponseError,\n  readCloudRecord,\n  readCloudString,\n} from \"./cloudResponse\";\n\nexport type AssistantCloudAuthStrategy = {\n  readonly strategy: \"anon\" | \"jwt\" | \"api-key\";\n  getAuthHeaders(): Promise<Record<string, string> | false>;\n  readAuthHeaders(headers: Headers): void;\n};\n\nconst getJwtExpiry = (jwt: string): number => {\n  try {\n    const parts = jwt.split(\".\");\n    const bodyPart = parts[1];\n    if (!bodyPart) {\n      throw new Error(\"Invalid JWT format\");\n    }\n\n    // Convert from Base64Url to Base64 and add padding if necessary\n    let base64 = bodyPart.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    while (base64.length % 4 !== 0) {\n      base64 += \"=\";\n    }\n\n    // Decode the Base64 string and parse the payload\n    const payload = atob(base64);\n    const payloadObj = JSON.parse(payload);\n    const exp = payloadObj.exp;\n\n    if (!exp || typeof exp !== \"number\") {\n      throw new Error('JWT does not contain a valid \"exp\" field');\n    }\n\n    // Convert expiration time to milliseconds\n    return exp * 1000;\n  } catch (error) {\n    throw new Error(`Unable to determine the token expiry: ${error}`);\n  }\n};\n\ntype RefreshToken = {\n  token: string;\n  expires_at: string;\n};\n\nconst readNonEmptyCloudString = (value: unknown, field: string): string => {\n  const result = readCloudString(value, field);\n  if (result.length === 0) {\n    throw new CloudResponseError(\n      `Invalid Assistant Cloud response for \"${field}\": expected a non-empty string`,\n    );\n  }\n  return result;\n};\n\nconst readRefreshTokenResponse = (\n  value: unknown,\n  field: string,\n): RefreshToken => {\n  const refreshToken = readCloudRecord(value, field);\n  return {\n    token: readNonEmptyCloudString(refreshToken.token, `${field}.token`),\n    expires_at: readNonEmptyCloudString(\n      refreshToken.expires_at,\n      `${field}.expires_at`,\n    ),\n  };\n};\n\nconst readAuthTokenResponse = async (\n  response: Response,\n  field: string,\n): Promise<{ data: Record<string, unknown>; accessToken: string }> => {\n  let value: unknown;\n  try {\n    value = await response.json();\n  } catch {\n    throw new CloudResponseError(\n      `Invalid Assistant Cloud response for \"${field}\": expected valid JSON`,\n    );\n  }\n\n  const data = readCloudRecord(value, field);\n  const accessToken = readNonEmptyCloudString(\n    data.access_token,\n    `${field}.access_token`,\n  );\n  return { data, accessToken };\n};\n\nexport class AssistantCloudJWTAuthStrategy implements AssistantCloudAuthStrategy {\n  public readonly strategy = \"jwt\";\n\n  private cachedToken: string | null = null;\n  private tokenExpiry: number | null = null;\n  private tokenRequest: Promise<Record<string, string> | false> | null = null;\n  #authTokenCallback: () => Promise<string | null>;\n\n  constructor(authTokenCallback: () => Promise<string | null>) {\n    this.#authTokenCallback = authTokenCallback;\n  }\n\n  public async getAuthHeaders(): Promise<Record<string, string> | false> {\n    const currentTime = Date.now();\n\n    // Use cached token if it's valid for at least 30 more seconds\n    if (\n      this.cachedToken &&\n      this.tokenExpiry &&\n      this.tokenExpiry - currentTime > 30 * 1000\n    ) {\n      return { Authorization: `Bearer ${this.cachedToken}` };\n    }\n\n    if (!this.tokenRequest) {\n      this.tokenRequest = this.fetchAuthHeaders();\n    }\n\n    const tokenRequest = this.tokenRequest;\n    try {\n      return await tokenRequest;\n    } finally {\n      if (this.tokenRequest === tokenRequest) {\n        this.tokenRequest = null;\n      }\n    }\n  }\n\n  private async fetchAuthHeaders(): Promise<Record<string, string> | false> {\n    const token = await this.#authTokenCallback();\n    if (!token) return false;\n\n    this.cachedToken = token;\n    this.tokenExpiry = getJwtExpiry(token);\n\n    return { Authorization: `Bearer ${token}` };\n  }\n\n  public readAuthHeaders(headers: Headers) {\n    const authHeader = headers.get(\"Authorization\");\n    if (!authHeader) return;\n\n    const [scheme, token] = authHeader.split(\" \");\n    if (scheme !== \"Bearer\" || !token) {\n      throw new Error(\"Invalid auth header received\");\n    }\n\n    this.cachedToken = token;\n    this.tokenExpiry = getJwtExpiry(token);\n  }\n}\n\nexport class AssistantCloudAPIKeyAuthStrategy implements AssistantCloudAuthStrategy {\n  public readonly strategy = \"api-key\";\n\n  #apiKey: string;\n  #userId: string;\n  #workspaceId: string;\n\n  constructor(apiKey: string, userId: string, workspaceId: string) {\n    this.#apiKey = apiKey;\n    this.#userId = userId;\n    this.#workspaceId = workspaceId;\n  }\n\n  public async getAuthHeaders(): Promise<Record<string, string>> {\n    return {\n      Authorization: `Bearer ${this.#apiKey}`,\n      \"Aui-User-Id\": this.#userId,\n      \"Aui-Workspace-Id\": this.#workspaceId,\n    };\n  }\n\n  public readAuthHeaders() {\n    // No operation needed for API key auth\n  }\n}\n\nconst LEGACY_AUI_REFRESH_TOKEN_NAME = \"aui:refresh_token\";\n\nconst getRefreshTokenName = (baseUrl: string): string =>\n  `${LEGACY_AUI_REFRESH_TOKEN_NAME}:${baseUrl}`;\n\nconst removeLegacyRefreshToken = (storage: Storage): void => {\n  try {\n    storage.removeItem(LEGACY_AUI_REFRESH_TOKEN_NAME);\n  } catch {}\n};\n\nconst getLocalStorage = (): Storage | null => {\n  if (!(\"localStorage\" in globalThis)) return null;\n  try {\n    return (globalThis as { localStorage: Storage }).localStorage;\n  } catch {\n    return null;\n  }\n};\n\nconst readRefreshToken = (baseUrl: string): RefreshToken | undefined => {\n  const storage = getLocalStorage();\n  if (!storage) return undefined;\n  try {\n    const name = getRefreshTokenName(baseUrl);\n    const value = storage.getItem(name);\n    if (value) {\n      removeLegacyRefreshToken(storage);\n      return JSON.parse(value) as RefreshToken;\n    }\n\n    const legacyValue = storage.getItem(LEGACY_AUI_REFRESH_TOKEN_NAME);\n    if (!legacyValue) return undefined;\n\n    let refreshToken: RefreshToken;\n    try {\n      refreshToken = JSON.parse(legacyValue) as RefreshToken;\n    } catch {\n      removeLegacyRefreshToken(storage);\n      return undefined;\n    }\n\n    storage.setItem(name, legacyValue);\n    removeLegacyRefreshToken(storage);\n    return refreshToken;\n  } catch {\n    return undefined;\n  }\n};\n\nconst writeRefreshToken = (\n  baseUrl: string,\n  refreshToken: RefreshToken,\n): void => {\n  const storage = getLocalStorage();\n  if (!storage) return;\n  try {\n    storage.setItem(getRefreshTokenName(baseUrl), JSON.stringify(refreshToken));\n  } catch {}\n};\n\nconst removeRefreshToken = (baseUrl: string): void => {\n  const storage = getLocalStorage();\n  if (!storage) return;\n  try {\n    storage.removeItem(getRefreshTokenName(baseUrl));\n  } catch {}\n};\n\nexport class AssistantCloudAnonymousAuthStrategy implements AssistantCloudAuthStrategy {\n  public readonly strategy = \"anon\";\n\n  private baseUrl: string;\n  private jwtStrategy: AssistantCloudJWTAuthStrategy;\n\n  constructor(baseUrl: string) {\n    this.baseUrl = baseUrl;\n    this.jwtStrategy = new AssistantCloudJWTAuthStrategy(async () => {\n      const currentTime = Date.now();\n      const storedRefreshToken = readRefreshToken(this.baseUrl);\n\n      if (storedRefreshToken) {\n        const refreshExpiry = new Date(storedRefreshToken.expires_at).getTime();\n        if (refreshExpiry - currentTime > 30 * 1000) {\n          const response = await fetch(\n            `${this.baseUrl}/v1/auth/tokens/refresh`,\n            {\n              method: \"POST\",\n              headers: { \"Content-Type\": \"application/json\" },\n              body: JSON.stringify({ refresh_token: storedRefreshToken.token }),\n            },\n          );\n\n          if (response.ok) {\n            const { data, accessToken } = await readAuthTokenResponse(\n              response,\n              \"refresh auth token response\",\n            );\n            if (data.refresh_token != null) {\n              writeRefreshToken(\n                this.baseUrl,\n                readRefreshTokenResponse(\n                  data.refresh_token,\n                  \"refresh auth token response.refresh_token\",\n                ),\n              );\n            }\n            return accessToken;\n          }\n\n          if (response.status === 429 || response.status >= 500) {\n            throw new Error(\n              `Assistant Cloud token refresh failed with status ${response.status}`,\n            );\n          }\n        } else {\n          removeRefreshToken(this.baseUrl);\n        }\n      }\n\n      // No valid refresh token; request a new anonymous token\n      const response = await fetch(`${this.baseUrl}/v1/auth/tokens/anonymous`, {\n        method: \"POST\",\n      });\n\n      if (!response.ok) return null;\n\n      const { data, accessToken } = await readAuthTokenResponse(\n        response,\n        \"anonymous auth token response\",\n      );\n\n      writeRefreshToken(\n        this.baseUrl,\n        readRefreshTokenResponse(\n          data.refresh_token,\n          \"anonymous auth token response.refresh_token\",\n        ),\n      );\n      return accessToken;\n    });\n  }\n\n  public async getAuthHeaders(): Promise<Record<string, string> | false> {\n    return this.jwtStrategy.getAuthHeaders();\n  }\n\n  public readAuthHeaders(headers: Headers): void {\n    this.jwtStrategy.readAuthHeaders(headers);\n  }\n}\n"],"mappings":";;AAYA,MAAM,gBAAgB,QAAwB;CAC5C,IAAI;EAEF,MAAM,WADQ,IAAI,MAAM,GACH,CAAC,CAAC;EACvB,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,oBAAoB;EAItC,IAAI,SAAS,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EAC1D,OAAO,OAAO,SAAS,MAAM,GAC3B,UAAU;EAIZ,MAAM,UAAU,KAAK,MAAM;EAE3B,MAAM,MADa,KAAK,MAAM,OACT,CAAC,CAAC;EAEvB,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,MAAM,IAAI,MAAM,4CAA0C;EAI5D,OAAO,MAAM;CACf,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,yCAAyC,OAAO;CAClE;AACF;AAOA,MAAM,2BAA2B,OAAgB,UAA0B;CACzE,MAAM,SAAS,gBAAgB,OAAO,KAAK;CAC3C,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,mBACR,yCAAyC,MAAM,+BACjD;CAEF,OAAO;AACT;AAEA,MAAM,4BACJ,OACA,UACiB;CACjB,MAAM,eAAe,gBAAgB,OAAO,KAAK;CACjD,OAAO;EACL,OAAO,wBAAwB,aAAa,OAAO,GAAG,MAAM,OAAO;EACnE,YAAY,wBACV,aAAa,YACb,GAAG,MAAM,YACX;CACF;AACF;AAEA,MAAM,wBAAwB,OAC5B,UACA,UACoE;CACpE,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,SAAS,KAAK;CAC9B,QAAQ;EACN,MAAM,IAAI,mBACR,yCAAyC,MAAM,uBACjD;CACF;CAEA,MAAM,OAAO,gBAAgB,OAAO,KAAK;CAKzC,OAAO;EAAE;EAAM,aAJK,wBAClB,KAAK,cACL,GAAG,MAAM,cAEc;CAAE;AAC7B;AAEA,IAAa,gCAAb,MAAiF;CAC/E,WAA2B;CAE3B,cAAqC;CACrC,cAAqC;CACrC,eAAuE;CACvE;CAEA,YAAY,mBAAiD;EAC3D,KAAKA,qBAAqB;CAC5B;CAEA,MAAa,iBAA0D;EACrE,MAAM,cAAc,KAAK,IAAI;EAG7B,IACE,KAAK,eACL,KAAK,eACL,KAAK,cAAc,cAAc,KAEjC,OAAO,EAAE,eAAe,UAAU,KAAK,cAAc;EAGvD,IAAI,CAAC,KAAK,cACR,KAAK,eAAe,KAAK,iBAAiB;EAG5C,MAAM,eAAe,KAAK;EAC1B,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,iBAAiB,cACxB,KAAK,eAAe;EAExB;CACF;CAEA,MAAc,mBAA4D;EACxE,MAAM,QAAQ,MAAM,KAAKA,mBAAmB;EAC5C,IAAI,CAAC,OAAO,OAAO;EAEnB,KAAK,cAAc;EACnB,KAAK,cAAc,aAAa,KAAK;EAErC,OAAO,EAAE,eAAe,UAAU,QAAQ;CAC5C;CAEA,gBAAuB,SAAkB;EACvC,MAAM,aAAa,QAAQ,IAAI,eAAe;EAC9C,IAAI,CAAC,YAAY;EAEjB,MAAM,CAAC,QAAQ,SAAS,WAAW,MAAM,GAAG;EAC5C,IAAI,WAAW,YAAY,CAAC,OAC1B,MAAM,IAAI,MAAM,8BAA8B;EAGhD,KAAK,cAAc;EACnB,KAAK,cAAc,aAAa,KAAK;CACvC;AACF;AAEA,IAAa,mCAAb,MAAoF;CAClF,WAA2B;CAE3B;CACA;CACA;CAEA,YAAY,QAAgB,QAAgB,aAAqB;EAC/D,KAAKC,UAAU;EACf,KAAKC,UAAU;EACf,KAAKC,eAAe;CACtB;CAEA,MAAa,iBAAkD;EAC7D,OAAO;GACL,eAAe,UAAU,KAAKF;GAC9B,eAAe,KAAKC;GACpB,oBAAoB,KAAKC;EAC3B;CACF;CAEA,kBAAyB,CAEzB;AACF;AAEA,MAAM,gCAAgC;AAEtC,MAAM,uBAAuB,YAC3B,GAAG,8BAA8B,GAAG;AAEtC,MAAM,4BAA4B,YAA2B;CAC3D,IAAI;EACF,QAAQ,WAAW,6BAA6B;CAClD,QAAQ,CAAC;AACX;AAEA,MAAM,wBAAwC;CAC5C,IAAI,EAAE,kBAAkB,aAAa,OAAO;CAC5C,IAAI;EACF,OAAQ,WAAyC;CACnD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,oBAAoB,YAA8C;CACtE,MAAM,UAAU,gBAAgB;CAChC,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,IAAI;EACF,MAAM,OAAO,oBAAoB,OAAO;EACxC,MAAM,QAAQ,QAAQ,QAAQ,IAAI;EAClC,IAAI,OAAO;GACT,yBAAyB,OAAO;GAChC,OAAO,KAAK,MAAM,KAAK;EACzB;EAEA,MAAM,cAAc,QAAQ,QAAQ,6BAA6B;EACjE,IAAI,CAAC,aAAa,OAAO,KAAA;EAEzB,IAAI;EACJ,IAAI;GACF,eAAe,KAAK,MAAM,WAAW;EACvC,QAAQ;GACN,yBAAyB,OAAO;GAChC;EACF;EAEA,QAAQ,QAAQ,MAAM,WAAW;EACjC,yBAAyB,OAAO;EAChC,OAAO;CACT,QAAQ;EACN;CACF;AACF;AAEA,MAAM,qBACJ,SACA,iBACS;CACT,MAAM,UAAU,gBAAgB;CAChC,IAAI,CAAC,SAAS;CACd,IAAI;EACF,QAAQ,QAAQ,oBAAoB,OAAO,GAAG,KAAK,UAAU,YAAY,CAAC;CAC5E,QAAQ,CAAC;AACX;AAEA,MAAM,sBAAsB,YAA0B;CACpD,MAAM,UAAU,gBAAgB;CAChC,IAAI,CAAC,SAAS;CACd,IAAI;EACF,QAAQ,WAAW,oBAAoB,OAAO,CAAC;CACjD,QAAQ,CAAC;AACX;AAEA,IAAa,sCAAb,MAAuF;CACrF,WAA2B;CAE3B;CACA;CAEA,YAAY,SAAiB;EAC3B,KAAK,UAAU;EACf,KAAK,cAAc,IAAI,8BAA8B,YAAY;GAC/D,MAAM,cAAc,KAAK,IAAI;GAC7B,MAAM,qBAAqB,iBAAiB,KAAK,OAAO;GAExD,IAAI,oBAAoB;IAEtB,IADsB,IAAI,KAAK,mBAAmB,UAAU,CAAC,CAAC,QAC9C,IAAI,cAAc,KAAW;KAC3C,MAAM,WAAW,MAAM,MACrB,GAAG,KAAK,QAAQ,0BAChB;MACE,QAAQ;MACR,SAAS,EAAE,gBAAgB,mBAAmB;MAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,mBAAmB,MAAM,CAAC;KAClE,CACF;KAEA,IAAI,SAAS,IAAI;MACf,MAAM,EAAE,MAAM,gBAAgB,MAAM,sBAClC,UACA,6BACF;MACA,IAAI,KAAK,iBAAiB,MACxB,kBACE,KAAK,SACL,yBACE,KAAK,eACL,2CACF,CACF;MAEF,OAAO;KACT;KAEA,IAAI,SAAS,WAAW,OAAO,SAAS,UAAU,KAChD,MAAM,IAAI,MACR,oDAAoD,SAAS,QAC/D;IAEJ,OACE,mBAAmB,KAAK,OAAO;GAEnC;GAGA,MAAM,WAAW,MAAM,MAAM,GAAG,KAAK,QAAQ,4BAA4B,EACvE,QAAQ,OACV,CAAC;GAED,IAAI,CAAC,SAAS,IAAI,OAAO;GAEzB,MAAM,EAAE,MAAM,gBAAgB,MAAM,sBAClC,UACA,+BACF;GAEA,kBACE,KAAK,SACL,yBACE,KAAK,eACL,6CACF,CACF;GACA,OAAO;EACT,CAAC;CACH;CAEA,MAAa,iBAA0D;EACrE,OAAO,KAAK,YAAY,eAAe;CACzC;CAEA,gBAAuB,SAAwB;EAC7C,KAAK,YAAY,gBAAgB,OAAO;CAC1C;AACF"}
+{"version":3,"file":"AssistantCloudAuthStrategy.js","names":[],"sources":["../src/AssistantCloudAuthStrategy.ts"],"sourcesContent":["import {\n  CloudResponseError,\n  readCloudRecord,\n  readCloudString,\n} from \"./cloudResponse\";\n\nconst AUTH_TOKEN_REQUEST_TIMEOUT_MS = 30_000;\n\nconst withAuthTokenDeadline = async <T>(\n  operation: string,\n  run: (signal: AbortSignal) => Promise<T>,\n): Promise<T> => {\n  const controller = new AbortController();\n  let timedOut = false;\n  const timeout = setTimeout(() => {\n    timedOut = true;\n    controller.abort();\n  }, AUTH_TOKEN_REQUEST_TIMEOUT_MS);\n\n  try {\n    return await run(controller.signal);\n  } catch (error) {\n    if (timedOut) {\n      throw new Error(\n        `Assistant Cloud ${operation} timed out after ${AUTH_TOKEN_REQUEST_TIMEOUT_MS}ms`,\n        { cause: error },\n      );\n    }\n    throw error;\n  } finally {\n    clearTimeout(timeout);\n  }\n};\n\nexport type AssistantCloudAuthStrategy = {\n  readonly strategy: \"anon\" | \"jwt\" | \"api-key\";\n  getAuthHeaders(): Promise<Record<string, string> | false>;\n  readAuthHeaders(headers: Headers): void;\n};\n\nconst getJwtExpiry = (jwt: string): number => {\n  try {\n    const parts = jwt.split(\".\");\n    const bodyPart = parts[1];\n    if (!bodyPart) {\n      throw new Error(\"Invalid JWT format\");\n    }\n\n    // Convert from Base64Url to Base64 and add padding if necessary\n    let base64 = bodyPart.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    while (base64.length % 4 !== 0) {\n      base64 += \"=\";\n    }\n\n    // Decode the Base64 string and parse the payload\n    const payload = atob(base64);\n    const payloadObj = JSON.parse(payload);\n    const exp = payloadObj.exp;\n\n    if (!exp || typeof exp !== \"number\") {\n      throw new Error('JWT does not contain a valid \"exp\" field');\n    }\n\n    // Convert expiration time to milliseconds\n    return exp * 1000;\n  } catch (error) {\n    throw new Error(`Unable to determine the token expiry: ${error}`);\n  }\n};\n\ntype RefreshToken = {\n  token: string;\n  expires_at: string;\n};\n\nconst readNonEmptyCloudString = (value: unknown, field: string): string => {\n  const result = readCloudString(value, field);\n  if (result.length === 0) {\n    throw new CloudResponseError(\n      `Invalid Assistant Cloud response for \"${field}\": expected a non-empty string`,\n    );\n  }\n  return result;\n};\n\nconst readRefreshTokenResponse = (\n  value: unknown,\n  field: string,\n): RefreshToken => {\n  const refreshToken = readCloudRecord(value, field);\n  return {\n    token: readNonEmptyCloudString(refreshToken.token, `${field}.token`),\n    expires_at: readNonEmptyCloudString(\n      refreshToken.expires_at,\n      `${field}.expires_at`,\n    ),\n  };\n};\n\nconst readAuthTokenResponse = async (\n  response: Response,\n  field: string,\n): Promise<{ data: Record<string, unknown>; accessToken: string }> => {\n  let value: unknown;\n  try {\n    value = await response.json();\n  } catch {\n    throw new CloudResponseError(\n      `Invalid Assistant Cloud response for \"${field}\": expected valid JSON`,\n    );\n  }\n\n  const data = readCloudRecord(value, field);\n  const accessToken = readNonEmptyCloudString(\n    data.access_token,\n    `${field}.access_token`,\n  );\n  return { data, accessToken };\n};\n\nexport class AssistantCloudJWTAuthStrategy implements AssistantCloudAuthStrategy {\n  public readonly strategy = \"jwt\";\n\n  private cachedToken: string | null = null;\n  private tokenExpiry: number | null = null;\n  private tokenRequest: Promise<Record<string, string> | false> | null = null;\n  #authTokenCallback: () => Promise<string | null>;\n\n  constructor(authTokenCallback: () => Promise<string | null>) {\n    this.#authTokenCallback = authTokenCallback;\n  }\n\n  public async getAuthHeaders(): Promise<Record<string, string> | false> {\n    const currentTime = Date.now();\n\n    // Use cached token if it's valid for at least 30 more seconds\n    if (\n      this.cachedToken &&\n      this.tokenExpiry &&\n      this.tokenExpiry - currentTime > 30 * 1000\n    ) {\n      return { Authorization: `Bearer ${this.cachedToken}` };\n    }\n\n    if (!this.tokenRequest) {\n      this.tokenRequest = this.fetchAuthHeaders();\n    }\n\n    const tokenRequest = this.tokenRequest;\n    try {\n      return await tokenRequest;\n    } finally {\n      if (this.tokenRequest === tokenRequest) {\n        this.tokenRequest = null;\n      }\n    }\n  }\n\n  private async fetchAuthHeaders(): Promise<Record<string, string> | false> {\n    const token = await this.#authTokenCallback();\n    if (!token) return false;\n\n    this.cachedToken = token;\n    this.tokenExpiry = getJwtExpiry(token);\n\n    return { Authorization: `Bearer ${token}` };\n  }\n\n  public readAuthHeaders(headers: Headers) {\n    const authHeader = headers.get(\"Authorization\");\n    if (!authHeader) return;\n\n    const [scheme, token] = authHeader.split(\" \");\n    if (scheme !== \"Bearer\" || !token) {\n      throw new Error(\"Invalid auth header received\");\n    }\n\n    this.cachedToken = token;\n    this.tokenExpiry = getJwtExpiry(token);\n  }\n}\n\nexport class AssistantCloudAPIKeyAuthStrategy implements AssistantCloudAuthStrategy {\n  public readonly strategy = \"api-key\";\n\n  #apiKey: string;\n  #userId: string;\n  #workspaceId: string;\n\n  constructor(apiKey: string, userId: string, workspaceId: string) {\n    this.#apiKey = apiKey;\n    this.#userId = userId;\n    this.#workspaceId = workspaceId;\n  }\n\n  public async getAuthHeaders(): Promise<Record<string, string>> {\n    return {\n      Authorization: `Bearer ${this.#apiKey}`,\n      \"Aui-User-Id\": this.#userId,\n      \"Aui-Workspace-Id\": this.#workspaceId,\n    };\n  }\n\n  public readAuthHeaders() {\n    // No operation needed for API key auth\n  }\n}\n\nconst LEGACY_AUI_REFRESH_TOKEN_NAME = \"aui:refresh_token\";\n\nconst getRefreshTokenName = (baseUrl: string): string =>\n  `${LEGACY_AUI_REFRESH_TOKEN_NAME}:${baseUrl}`;\n\nconst removeLegacyRefreshToken = (storage: Storage): void => {\n  try {\n    storage.removeItem(LEGACY_AUI_REFRESH_TOKEN_NAME);\n  } catch {}\n};\n\nconst getLocalStorage = (): Storage | null => {\n  if (!(\"localStorage\" in globalThis)) return null;\n  try {\n    return (globalThis as { localStorage: Storage }).localStorage;\n  } catch {\n    return null;\n  }\n};\n\nconst readRefreshToken = (baseUrl: string): RefreshToken | undefined => {\n  const storage = getLocalStorage();\n  if (!storage) return undefined;\n  try {\n    const name = getRefreshTokenName(baseUrl);\n    const value = storage.getItem(name);\n    if (value) {\n      removeLegacyRefreshToken(storage);\n      return JSON.parse(value) as RefreshToken;\n    }\n\n    const legacyValue = storage.getItem(LEGACY_AUI_REFRESH_TOKEN_NAME);\n    if (!legacyValue) return undefined;\n\n    let refreshToken: RefreshToken;\n    try {\n      refreshToken = JSON.parse(legacyValue) as RefreshToken;\n    } catch {\n      removeLegacyRefreshToken(storage);\n      return undefined;\n    }\n\n    storage.setItem(name, legacyValue);\n    removeLegacyRefreshToken(storage);\n    return refreshToken;\n  } catch {\n    return undefined;\n  }\n};\n\nconst writeRefreshToken = (\n  baseUrl: string,\n  refreshToken: RefreshToken,\n): void => {\n  const storage = getLocalStorage();\n  if (!storage) return;\n  try {\n    storage.setItem(getRefreshTokenName(baseUrl), JSON.stringify(refreshToken));\n  } catch {}\n};\n\nconst removeRefreshToken = (baseUrl: string): void => {\n  const storage = getLocalStorage();\n  if (!storage) return;\n  try {\n    storage.removeItem(getRefreshTokenName(baseUrl));\n  } catch {}\n};\n\n// In-flight sharing follows refresh-token storage scope to isolate server requests.\nconst anonymousAuthTokenRequests = new WeakMap<\n  Storage,\n  Map<string, Promise<string | null>>\n>();\n\nconst getWebLockManager = (): LockManager | null => {\n  if (!(\"navigator\" in globalThis)) return null;\n  return (\n    (globalThis as { navigator?: { locks?: LockManager } }).navigator?.locks ??\n    null\n  );\n};\n\nconst getAnonymousAuthLockName = (baseUrl: string): string =>\n  `assistant-cloud:anonymous-auth:${baseUrl}`;\n\nconst getSharedAnonymousAuthToken = (\n  baseUrl: string,\n  requestToken: () => Promise<string | null>,\n): Promise<string | null> => {\n  const storage = getLocalStorage();\n  if (!storage) return requestToken();\n\n  let storageRequests = anonymousAuthTokenRequests.get(storage);\n  if (!storageRequests) {\n    storageRequests = new Map();\n    anonymousAuthTokenRequests.set(storage, storageRequests);\n  }\n\n  const activeRequest = storageRequests.get(baseUrl);\n  if (activeRequest) return activeRequest;\n\n  const locks = getWebLockManager();\n  const request = locks\n    ? locks.request(getAnonymousAuthLockName(baseUrl), requestToken)\n    : requestToken();\n  const sharedRequest = request.finally(() => {\n    if (storageRequests.get(baseUrl) === sharedRequest) {\n      storageRequests.delete(baseUrl);\n    }\n  });\n  storageRequests.set(baseUrl, sharedRequest);\n  return sharedRequest;\n};\n\nexport class AssistantCloudAnonymousAuthStrategy implements AssistantCloudAuthStrategy {\n  public readonly strategy = \"anon\";\n\n  private baseUrl: string;\n  private jwtStrategy: AssistantCloudJWTAuthStrategy;\n\n  constructor(baseUrl: string) {\n    this.baseUrl = baseUrl;\n    const requestAuthToken = async (): Promise<string | null> => {\n      const currentTime = Date.now();\n      const storedRefreshToken = readRefreshToken(this.baseUrl);\n\n      if (storedRefreshToken) {\n        const refreshExpiry = new Date(storedRefreshToken.expires_at).getTime();\n        if (refreshExpiry - currentTime > 30 * 1000) {\n          const refreshedAccessToken = await withAuthTokenDeadline(\n            \"refresh token request\",\n            async (signal) => {\n              const response = await fetch(\n                `${this.baseUrl}/v1/auth/tokens/refresh`,\n                {\n                  method: \"POST\",\n                  headers: { \"Content-Type\": \"application/json\" },\n                  body: JSON.stringify({\n                    refresh_token: storedRefreshToken.token,\n                  }),\n                  signal,\n                },\n              );\n\n              if (response.ok) {\n                const { data, accessToken } = await readAuthTokenResponse(\n                  response,\n                  \"refresh auth token response\",\n                );\n                if (data.refresh_token != null) {\n                  writeRefreshToken(\n                    this.baseUrl,\n                    readRefreshTokenResponse(\n                      data.refresh_token,\n                      \"refresh auth token response.refresh_token\",\n                    ),\n                  );\n                }\n                return accessToken;\n              }\n\n              if (response.status === 429 || response.status >= 500) {\n                throw new Error(\n                  `Assistant Cloud token refresh failed with status ${response.status}`,\n                );\n              }\n\n              return null;\n            },\n          );\n          if (refreshedAccessToken !== null) return refreshedAccessToken;\n        } else {\n          removeRefreshToken(this.baseUrl);\n        }\n      }\n\n      // No valid refresh token; request a new anonymous token\n      return withAuthTokenDeadline(\n        \"anonymous token request\",\n        async (signal) => {\n          const response = await fetch(\n            `${this.baseUrl}/v1/auth/tokens/anonymous`,\n            { method: \"POST\", signal },\n          );\n\n          if (!response.ok) return null;\n\n          const { data, accessToken } = await readAuthTokenResponse(\n            response,\n            \"anonymous auth token response\",\n          );\n\n          writeRefreshToken(\n            this.baseUrl,\n            readRefreshTokenResponse(\n              data.refresh_token,\n              \"anonymous auth token response.refresh_token\",\n            ),\n          );\n          return accessToken;\n        },\n      );\n    };\n    this.jwtStrategy = new AssistantCloudJWTAuthStrategy(() =>\n      getSharedAnonymousAuthToken(this.baseUrl, requestAuthToken),\n    );\n  }\n\n  public async getAuthHeaders(): Promise<Record<string, string> | false> {\n    return this.jwtStrategy.getAuthHeaders();\n  }\n\n  public readAuthHeaders(headers: Headers): void {\n    this.jwtStrategy.readAuthHeaders(headers);\n  }\n}\n"],"mappings":";;AAMA,MAAM,gCAAgC;AAEtC,MAAM,wBAAwB,OAC5B,WACA,QACe;CACf,MAAM,aAAa,IAAI,gBAAgB;CACvC,IAAI,WAAW;CACf,MAAM,UAAU,iBAAiB;EAC/B,WAAW;EACX,WAAW,MAAM;CACnB,GAAG,6BAA6B;CAEhC,IAAI;EACF,OAAO,MAAM,IAAI,WAAW,MAAM;CACpC,SAAS,OAAO;EACd,IAAI,UACF,MAAM,IAAI,MACR,mBAAmB,UAAU,mBAAmB,8BAA8B,KAC9E,EAAE,OAAO,MAAM,CACjB;EAEF,MAAM;CACR,UAAU;EACR,aAAa,OAAO;CACtB;AACF;AAQA,MAAM,gBAAgB,QAAwB;CAC5C,IAAI;EAEF,MAAM,WADQ,IAAI,MAAM,GACH,CAAC,CAAC;EACvB,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,oBAAoB;EAItC,IAAI,SAAS,SAAS,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG;EAC1D,OAAO,OAAO,SAAS,MAAM,GAC3B,UAAU;EAIZ,MAAM,UAAU,KAAK,MAAM;EAE3B,MAAM,MADa,KAAK,MAAM,OACT,CAAC,CAAC;EAEvB,IAAI,CAAC,OAAO,OAAO,QAAQ,UACzB,MAAM,IAAI,MAAM,4CAA0C;EAI5D,OAAO,MAAM;CACf,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,yCAAyC,OAAO;CAClE;AACF;AAOA,MAAM,2BAA2B,OAAgB,UAA0B;CACzE,MAAM,SAAS,gBAAgB,OAAO,KAAK;CAC3C,IAAI,OAAO,WAAW,GACpB,MAAM,IAAI,mBACR,yCAAyC,MAAM,+BACjD;CAEF,OAAO;AACT;AAEA,MAAM,4BACJ,OACA,UACiB;CACjB,MAAM,eAAe,gBAAgB,OAAO,KAAK;CACjD,OAAO;EACL,OAAO,wBAAwB,aAAa,OAAO,GAAG,MAAM,OAAO;EACnE,YAAY,wBACV,aAAa,YACb,GAAG,MAAM,YACX;CACF;AACF;AAEA,MAAM,wBAAwB,OAC5B,UACA,UACoE;CACpE,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,SAAS,KAAK;CAC9B,QAAQ;EACN,MAAM,IAAI,mBACR,yCAAyC,MAAM,uBACjD;CACF;CAEA,MAAM,OAAO,gBAAgB,OAAO,KAAK;CAKzC,OAAO;EAAE;EAAM,aAJK,wBAClB,KAAK,cACL,GAAG,MAAM,cAEc;CAAE;AAC7B;AAEA,IAAa,gCAAb,MAAiF;CAC/E,WAA2B;CAE3B,cAAqC;CACrC,cAAqC;CACrC,eAAuE;CACvE;CAEA,YAAY,mBAAiD;EAC3D,KAAK,qBAAqB;CAC5B;CAEA,MAAa,iBAA0D;EACrE,MAAM,cAAc,KAAK,IAAI;EAG7B,IACE,KAAK,eACL,KAAK,eACL,KAAK,cAAc,cAAc,KAEjC,OAAO,EAAE,eAAe,UAAU,KAAK,cAAc;EAGvD,IAAI,CAAC,KAAK,cACR,KAAK,eAAe,KAAK,iBAAiB;EAG5C,MAAM,eAAe,KAAK;EAC1B,IAAI;GACF,OAAO,MAAM;EACf,UAAU;GACR,IAAI,KAAK,iBAAiB,cACxB,KAAK,eAAe;EAExB;CACF;CAEA,MAAc,mBAA4D;EACxE,MAAM,QAAQ,MAAM,KAAK,mBAAmB;EAC5C,IAAI,CAAC,OAAO,OAAO;EAEnB,KAAK,cAAc;EACnB,KAAK,cAAc,aAAa,KAAK;EAErC,OAAO,EAAE,eAAe,UAAU,QAAQ;CAC5C;CAEA,gBAAuB,SAAkB;EACvC,MAAM,aAAa,QAAQ,IAAI,eAAe;EAC9C,IAAI,CAAC,YAAY;EAEjB,MAAM,CAAC,QAAQ,SAAS,WAAW,MAAM,GAAG;EAC5C,IAAI,WAAW,YAAY,CAAC,OAC1B,MAAM,IAAI,MAAM,8BAA8B;EAGhD,KAAK,cAAc;EACnB,KAAK,cAAc,aAAa,KAAK;CACvC;AACF;AAEA,IAAa,mCAAb,MAAoF;CAClF,WAA2B;CAE3B;CACA;CACA;CAEA,YAAY,QAAgB,QAAgB,aAAqB;EAC/D,KAAK,UAAU;EACf,KAAK,UAAU;EACf,KAAK,eAAe;CACtB;CAEA,MAAa,iBAAkD;EAC7D,OAAO;GACL,eAAe,UAAU,KAAK;GAC9B,eAAe,KAAK;GACpB,oBAAoB,KAAK;EAC3B;CACF;CAEA,kBAAyB,CAEzB;AACF;AAEA,MAAM,gCAAgC;AAEtC,MAAM,uBAAuB,YAC3B,GAAG,8BAA8B,GAAG;AAEtC,MAAM,4BAA4B,YAA2B;CAC3D,IAAI;EACF,QAAQ,WAAW,6BAA6B;CAClD,QAAQ,CAAC;AACX;AAEA,MAAM,wBAAwC;CAC5C,IAAI,EAAE,kBAAkB,aAAa,OAAO;CAC5C,IAAI;EACF,OAAQ,WAAyC;CACnD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,oBAAoB,YAA8C;CACtE,MAAM,UAAU,gBAAgB;CAChC,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,IAAI;EACF,MAAM,OAAO,oBAAoB,OAAO;EACxC,MAAM,QAAQ,QAAQ,QAAQ,IAAI;EAClC,IAAI,OAAO;GACT,yBAAyB,OAAO;GAChC,OAAO,KAAK,MAAM,KAAK;EACzB;EAEA,MAAM,cAAc,QAAQ,QAAQ,6BAA6B;EACjE,IAAI,CAAC,aAAa,OAAO,KAAA;EAEzB,IAAI;EACJ,IAAI;GACF,eAAe,KAAK,MAAM,WAAW;EACvC,QAAQ;GACN,yBAAyB,OAAO;GAChC;EACF;EAEA,QAAQ,QAAQ,MAAM,WAAW;EACjC,yBAAyB,OAAO;EAChC,OAAO;CACT,QAAQ;EACN;CACF;AACF;AAEA,MAAM,qBACJ,SACA,iBACS;CACT,MAAM,UAAU,gBAAgB;CAChC,IAAI,CAAC,SAAS;CACd,IAAI;EACF,QAAQ,QAAQ,oBAAoB,OAAO,GAAG,KAAK,UAAU,YAAY,CAAC;CAC5E,QAAQ,CAAC;AACX;AAEA,MAAM,sBAAsB,YAA0B;CACpD,MAAM,UAAU,gBAAgB;CAChC,IAAI,CAAC,SAAS;CACd,IAAI;EACF,QAAQ,WAAW,oBAAoB,OAAO,CAAC;CACjD,QAAQ,CAAC;AACX;AAGA,MAAM,6CAA6B,IAAI,QAGrC;AAEF,MAAM,0BAA8C;CAClD,IAAI,EAAE,eAAe,aAAa,OAAO;CACzC,OACG,WAAuD,WAAW,SACnE;AAEJ;AAEA,MAAM,4BAA4B,YAChC,kCAAkC;AAEpC,MAAM,+BACJ,SACA,iBAC2B;CAC3B,MAAM,UAAU,gBAAgB;CAChC,IAAI,CAAC,SAAS,OAAO,aAAa;CAElC,IAAI,kBAAkB,2BAA2B,IAAI,OAAO;CAC5D,IAAI,CAAC,iBAAiB;EACpB,kCAAkB,IAAI,IAAI;EAC1B,2BAA2B,IAAI,SAAS,eAAe;CACzD;CAEA,MAAM,gBAAgB,gBAAgB,IAAI,OAAO;CACjD,IAAI,eAAe,OAAO;CAE1B,MAAM,QAAQ,kBAAkB;CAIhC,MAAM,iBAHU,QACZ,MAAM,QAAQ,yBAAyB,OAAO,GAAG,YAAY,IAC7D,aAAa,EAAA,CACa,cAAc;EAC1C,IAAI,gBAAgB,IAAI,OAAO,MAAM,eACnC,gBAAgB,OAAO,OAAO;CAElC,CAAC;CACD,gBAAgB,IAAI,SAAS,aAAa;CAC1C,OAAO;AACT;AAEA,IAAa,sCAAb,MAAuF;CACrF,WAA2B;CAE3B;CACA;CAEA,YAAY,SAAiB;EAC3B,KAAK,UAAU;EACf,MAAM,mBAAmB,YAAoC;GAC3D,MAAM,cAAc,KAAK,IAAI;GAC7B,MAAM,qBAAqB,iBAAiB,KAAK,OAAO;GAExD,IAAI,oBAAoB;IAEtB,IADsB,IAAI,KAAK,mBAAmB,UAAU,CAAC,CAAC,QAC9C,IAAI,cAAc,KAAW;KAC3C,MAAM,uBAAuB,MAAM,sBACjC,yBACA,OAAO,WAAW;MAChB,MAAM,WAAW,MAAM,MACrB,GAAG,KAAK,QAAQ,0BAChB;OACE,QAAQ;OACR,SAAS,EAAE,gBAAgB,mBAAmB;OAC9C,MAAM,KAAK,UAAU,EACnB,eAAe,mBAAmB,MACpC,CAAC;OACD;MACF,CACF;MAEA,IAAI,SAAS,IAAI;OACf,MAAM,EAAE,MAAM,gBAAgB,MAAM,sBAClC,UACA,6BACF;OACA,IAAI,KAAK,iBAAiB,MACxB,kBACE,KAAK,SACL,yBACE,KAAK,eACL,2CACF,CACF;OAEF,OAAO;MACT;MAEA,IAAI,SAAS,WAAW,OAAO,SAAS,UAAU,KAChD,MAAM,IAAI,MACR,oDAAoD,SAAS,QAC/D;MAGF,OAAO;KACT,CACF;KACA,IAAI,yBAAyB,MAAM,OAAO;IAC5C,OACE,mBAAmB,KAAK,OAAO;GAEnC;GAGA,OAAO,sBACL,2BACA,OAAO,WAAW;IAChB,MAAM,WAAW,MAAM,MACrB,GAAG,KAAK,QAAQ,4BAChB;KAAE,QAAQ;KAAQ;IAAO,CAC3B;IAEA,IAAI,CAAC,SAAS,IAAI,OAAO;IAEzB,MAAM,EAAE,MAAM,gBAAgB,MAAM,sBAClC,UACA,+BACF;IAEA,kBACE,KAAK,SACL,yBACE,KAAK,eACL,6CACF,CACF;IACA,OAAO;GACT,CACF;EACF;EACA,KAAK,cAAc,IAAI,oCACrB,4BAA4B,KAAK,SAAS,gBAAgB,CAC5D;CACF;CAEA,MAAa,iBAA0D;EACrE,OAAO,KAAK,YAAY,eAAe;CACzC;CAEA,gBAAuB,SAAwB;EAC7C,KAAK,YAAY,gBAAgB,OAAO;CAC1C;AACF"}

package/dist/CloudMessagePersistence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CloudMessagePersistence.d.ts","names":[],"sources":["../src/CloudMessagePersistence.ts"],"mappings":";;;;;;;;;;;;;;;cAca;UACH;UACA;EAEI,YAAA,OAAO;EACP,YAAA,gBAAgB;;;;;;;;;;EActB,OACJ,kBACA,mBACA,yBACA,gBACA,SAAS,qBACR;;;;EAiCG,OACJ,kBACA,mBACA,iBACA,SAAS,qBACR;;;;EAeH,YAAY;;;;;EAQN,YAAY,oBAAoB;;;;;;;;;;;EAgBhC,KAAK,kBAAkB,kBAAe,QAhBN;;;;EAgCtC"}
+{"version":3,"file":"CloudMessagePersistence.d.ts","names":[],"sources":["../src/CloudMessagePersistence.ts"],"mappings":";;;;;;;;;;;;;;;cAca;UACH;UACA;EAEI,YAAA,OAAO;EACP,YAAA,gBAAgB;;;;;;;;;;EActB,OACJ,kBACA,mBACA,yBACA,gBACA,SAAS,qBACR;;;;EAqCG,OACJ,kBACA,mBACA,iBACA,SAAS,qBACR;;;;EAeH,YAAY;;;;;EAQN,YAAY,oBAAoB;;;;;;;;;;;EAgBhC,KAAK,kBAAkB,kBAAe,QAhBN;;;;EAgCtC"}

package/dist/CloudMessagePersistence.js

@@ -27,20 +27,28 @@ var CloudMessagePersistence = class {
 	*/
 	async append(threadId, messageId, parentId, format, content) {
 		const cloud = this.getCloud();
-		const resolvedParentId = parentId ? await this.idMapping[parentId] ?? parentId : null;
-		const task = cloud.threads.messages.create(threadId, {
-			parent_id: resolvedParentId,
-			format,
-			content
-		}).then(({ message_id }) => {
-			this.idMapping[messageId] = message_id;
+		const existing = this.idMapping[messageId];
+		if (existing instanceof Promise) {
+			await existing;
+			return;
+		}
+		const task = (async () => {
+			const resolvedParentId = parentId ? await this.idMapping[parentId] ?? parentId : null;
+			const { message_id } = await cloud.threads.messages.create(threadId, {
+				parent_id: resolvedParentId,
+				format,
+				content
+			});
 			return message_id;
-		}).catch((err) => {
+		})();
+		this.idMapping[messageId] = task;
+		try {
+			const remoteId = await task;
+			if (this.idMapping[messageId] === task) this.idMapping[messageId] = remoteId;
+		} catch (err) {
 			if (this.idMapping[messageId] === task) delete this.idMapping[messageId];
 			throw err;
-		});
-		this.idMapping[messageId] = task;
-		return task.then(() => {});
+		}
 	}
 	/**
 	* Update an already-persisted message in the cloud.

package/dist/CloudMessagePersistence.js.map

@@ -1 +1 @@
-{"version":3,"file":"CloudMessagePersistence.js","names":[],"sources":["../src/CloudMessagePersistence.ts"],"sourcesContent":["import type { ReadonlyJSONObject } from \"assistant-stream/utils\";\nimport type { AssistantCloud } from \"./AssistantCloud\";\n\n/**\n * Shared persistence logic for cloud message storage.\n *\n * Handles ID mapping (local → remote) and parent_id chaining for both:\n * - AssistantCloudThreadHistoryAdapter (assistant-ui runtime)\n * - useCloudChat (standalone AI SDK hook)\n *\n * The promise-based ID resolution handles concurrent appends — if message B's\n * parent is message A, and A is still being created, we await A's promise\n * to get its remote ID before creating B.\n */\nexport class CloudMessagePersistence {\n  private idMapping: Record<string, string | Promise<string>> = {};\n  private getCloud: () => AssistantCloud;\n\n  constructor(cloud: AssistantCloud);\n  constructor(getCloud: () => AssistantCloud);\n  constructor(cloud: AssistantCloud | (() => AssistantCloud)) {\n    this.getCloud = typeof cloud === \"function\" ? cloud : () => cloud;\n  }\n\n  /**\n   * Persist a message to the cloud.\n   *\n   * @param threadId - Remote thread ID\n   * @param messageId - Local message ID (used for tracking)\n   * @param parentId - Local parent message ID (or null for first message)\n   * @param format - Message format (e.g., \"aui/v0\", \"ai-sdk/v6\")\n   * @param content - Message content (format-specific)\n   */\n  async append(\n    threadId: string,\n    messageId: string,\n    parentId: string | null,\n    format: string,\n    content: ReadonlyJSONObject,\n  ): Promise<void> {\n    const cloud = this.getCloud();\n    // Resolve parent's remote ID if it exists (may be a promise if concurrent)\n    const resolvedParentId = parentId\n      ? ((await this.idMapping[parentId]) ?? parentId)\n      : null;\n\n    const task = cloud.threads.messages\n      .create(threadId, {\n        parent_id: resolvedParentId,\n        format,\n        content,\n      })\n      .then(({ message_id }) => {\n        this.idMapping[messageId] = message_id;\n        return message_id;\n      })\n      .catch((err) => {\n        // Only delete if we're still the active task (avoids clobbering a retry)\n        if (this.idMapping[messageId] === task) {\n          delete this.idMapping[messageId];\n        }\n        throw err;\n      });\n\n    // Store the promise immediately so concurrent appends can await it\n    this.idMapping[messageId] = task;\n    return task.then(() => {});\n  }\n\n  /**\n   * Update an already-persisted message in the cloud.\n   */\n  async update(\n    threadId: string,\n    messageId: string,\n    _format: string,\n    content: ReadonlyJSONObject,\n  ): Promise<void> {\n    const cloud = this.getCloud();\n    const remoteId = await this.getRemoteId(messageId);\n    if (!remoteId) {\n      console.warn(\n        `Skipping update for message ${messageId}: no remote id is mapped.`,\n      );\n      return;\n    }\n    await cloud.threads.messages.update(threadId, remoteId, { content });\n  }\n\n  /**\n   * Check if a message has been persisted (or is currently being persisted).\n   */\n  isPersisted(messageId: string): boolean {\n    return messageId in this.idMapping;\n  }\n\n  /**\n   * Get the remote ID for a local message ID (resolved).\n   * Returns undefined if not persisted.\n   */\n  async getRemoteId(messageId: string): Promise<string | undefined> {\n    const entry = this.idMapping[messageId];\n    if (!entry) return undefined;\n    return entry;\n  }\n\n  /**\n   * Load messages from the cloud and populate the ID mapping.\n   *\n   * The ID mapping is populated so that `isPersisted()` returns true for\n   * loaded messages, preventing re-persistence of already-stored messages.\n   *\n   * @param threadId - Remote thread ID\n   * @param format - Optional format filter\n   * @returns Array of cloud messages\n   */\n  async load(threadId: string, format?: string) {\n    const cloud = this.getCloud();\n    const { messages } = await cloud.threads.messages.list(\n      threadId,\n      format ? { format } : undefined,\n    );\n    // Populate ID mapping so isPersisted() recognizes loaded messages\n    for (const m of messages) {\n      this.idMapping[m.id] = m.id;\n    }\n    return messages;\n  }\n\n  /**\n   * Reset the ID mapping (call when switching threads).\n   */\n  reset() {\n    this.idMapping = {};\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAcA,IAAa,0BAAb,MAAqC;CACnC,YAA8D,CAAC;CAC/D;CAIA,YAAY,OAAgD;EAC1D,KAAK,WAAW,OAAO,UAAU,aAAa,cAAc;CAC9D;;;;;;;;;;CAWA,MAAM,OACJ,UACA,WACA,UACA,QACA,SACe;EACf,MAAM,QAAQ,KAAK,SAAS;EAE5B,MAAM,mBAAmB,WACnB,MAAM,KAAK,UAAU,aAAc,WACrC;EAEJ,MAAM,OAAO,MAAM,QAAQ,SACxB,OAAO,UAAU;GAChB,WAAW;GACX;GACA;EACF,CAAC,CAAC,CACD,MAAM,EAAE,iBAAiB;GACxB,KAAK,UAAU,aAAa;GAC5B,OAAO;EACT,CAAC,CAAC,CACD,OAAO,QAAQ;GAEd,IAAI,KAAK,UAAU,eAAe,MAChC,OAAO,KAAK,UAAU;GAExB,MAAM;EACR,CAAC;EAGH,KAAK,UAAU,aAAa;EAC5B,OAAO,KAAK,WAAW,CAAC,CAAC;CAC3B;;;;CAKA,MAAM,OACJ,UACA,WACA,SACA,SACe;EACf,MAAM,QAAQ,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,KAAK,YAAY,SAAS;EACjD,IAAI,CAAC,UAAU;GACb,QAAQ,KACN,+BAA+B,UAAU,0BAC3C;GACA;EACF;EACA,MAAM,MAAM,QAAQ,SAAS,OAAO,UAAU,UAAU,EAAE,QAAQ,CAAC;CACrE;;;;CAKA,YAAY,WAA4B;EACtC,OAAO,aAAa,KAAK;CAC3B;;;;;CAMA,MAAM,YAAY,WAAgD;EAChE,MAAM,QAAQ,KAAK,UAAU;EAC7B,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,OAAO;CACT;;;;;;;;;;;CAYA,MAAM,KAAK,UAAkB,QAAiB;EAE5C,MAAM,EAAE,aAAa,MADP,KAAK,SACY,CAAC,CAAC,QAAQ,SAAS,KAChD,UACA,SAAS,EAAE,OAAO,IAAI,KAAA,CACxB;EAEA,KAAK,MAAM,KAAK,UACd,KAAK,UAAU,EAAE,MAAM,EAAE;EAE3B,OAAO;CACT;;;;CAKA,QAAQ;EACN,KAAK,YAAY,CAAC;CACpB;AACF"}
+{"version":3,"file":"CloudMessagePersistence.js","names":[],"sources":["../src/CloudMessagePersistence.ts"],"sourcesContent":["import type { ReadonlyJSONObject } from \"assistant-stream/utils\";\nimport type { AssistantCloud } from \"./AssistantCloud\";\n\n/**\n * Shared persistence logic for cloud message storage.\n *\n * Handles ID mapping (local → remote) and parent_id chaining for both:\n * - AssistantCloudThreadHistoryAdapter (assistant-ui runtime)\n * - useCloudChat (standalone AI SDK hook)\n *\n * The promise-based ID resolution handles concurrent appends — if message B's\n * parent is message A, and A is still being created, we await A's promise\n * to get its remote ID before creating B.\n */\nexport class CloudMessagePersistence {\n  private idMapping: Record<string, string | Promise<string>> = {};\n  private getCloud: () => AssistantCloud;\n\n  constructor(cloud: AssistantCloud);\n  constructor(getCloud: () => AssistantCloud);\n  constructor(cloud: AssistantCloud | (() => AssistantCloud)) {\n    this.getCloud = typeof cloud === \"function\" ? cloud : () => cloud;\n  }\n\n  /**\n   * Persist a message to the cloud.\n   *\n   * @param threadId - Remote thread ID\n   * @param messageId - Local message ID (used for tracking)\n   * @param parentId - Local parent message ID (or null for first message)\n   * @param format - Message format (e.g., \"aui/v0\", \"ai-sdk/v6\")\n   * @param content - Message content (format-specific)\n   */\n  async append(\n    threadId: string,\n    messageId: string,\n    parentId: string | null,\n    format: string,\n    content: ReadonlyJSONObject,\n  ): Promise<void> {\n    const cloud = this.getCloud();\n    const existing = this.idMapping[messageId];\n    if (existing instanceof Promise) {\n      await existing;\n      return;\n    }\n\n    const task = (async () => {\n      const resolvedParentId = parentId\n        ? ((await this.idMapping[parentId]) ?? parentId)\n        : null;\n      const { message_id } = await cloud.threads.messages.create(threadId, {\n        parent_id: resolvedParentId,\n        format,\n        content,\n      });\n      return message_id;\n    })();\n\n    this.idMapping[messageId] = task;\n    try {\n      const remoteId = await task;\n      if (this.idMapping[messageId] === task) {\n        this.idMapping[messageId] = remoteId;\n      }\n    } catch (err) {\n      if (this.idMapping[messageId] === task) {\n        delete this.idMapping[messageId];\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Update an already-persisted message in the cloud.\n   */\n  async update(\n    threadId: string,\n    messageId: string,\n    _format: string,\n    content: ReadonlyJSONObject,\n  ): Promise<void> {\n    const cloud = this.getCloud();\n    const remoteId = await this.getRemoteId(messageId);\n    if (!remoteId) {\n      console.warn(\n        `Skipping update for message ${messageId}: no remote id is mapped.`,\n      );\n      return;\n    }\n    await cloud.threads.messages.update(threadId, remoteId, { content });\n  }\n\n  /**\n   * Check if a message has been persisted (or is currently being persisted).\n   */\n  isPersisted(messageId: string): boolean {\n    return messageId in this.idMapping;\n  }\n\n  /**\n   * Get the remote ID for a local message ID (resolved).\n   * Returns undefined if not persisted.\n   */\n  async getRemoteId(messageId: string): Promise<string | undefined> {\n    const entry = this.idMapping[messageId];\n    if (!entry) return undefined;\n    return entry;\n  }\n\n  /**\n   * Load messages from the cloud and populate the ID mapping.\n   *\n   * The ID mapping is populated so that `isPersisted()` returns true for\n   * loaded messages, preventing re-persistence of already-stored messages.\n   *\n   * @param threadId - Remote thread ID\n   * @param format - Optional format filter\n   * @returns Array of cloud messages\n   */\n  async load(threadId: string, format?: string) {\n    const cloud = this.getCloud();\n    const { messages } = await cloud.threads.messages.list(\n      threadId,\n      format ? { format } : undefined,\n    );\n    // Populate ID mapping so isPersisted() recognizes loaded messages\n    for (const m of messages) {\n      this.idMapping[m.id] = m.id;\n    }\n    return messages;\n  }\n\n  /**\n   * Reset the ID mapping (call when switching threads).\n   */\n  reset() {\n    this.idMapping = {};\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAcA,IAAa,0BAAb,MAAqC;CACnC,YAA8D,CAAC;CAC/D;CAIA,YAAY,OAAgD;EAC1D,KAAK,WAAW,OAAO,UAAU,aAAa,cAAc;CAC9D;;;;;;;;;;CAWA,MAAM,OACJ,UACA,WACA,UACA,QACA,SACe;EACf,MAAM,QAAQ,KAAK,SAAS;EAC5B,MAAM,WAAW,KAAK,UAAU;EAChC,IAAI,oBAAoB,SAAS;GAC/B,MAAM;GACN;EACF;EAEA,MAAM,QAAQ,YAAY;GACxB,MAAM,mBAAmB,WACnB,MAAM,KAAK,UAAU,aAAc,WACrC;GACJ,MAAM,EAAE,eAAe,MAAM,MAAM,QAAQ,SAAS,OAAO,UAAU;IACnE,WAAW;IACX;IACA;GACF,CAAC;GACD,OAAO;EACT,EAAA,CAAG;EAEH,KAAK,UAAU,aAAa;EAC5B,IAAI;GACF,MAAM,WAAW,MAAM;GACvB,IAAI,KAAK,UAAU,eAAe,MAChC,KAAK,UAAU,aAAa;EAEhC,SAAS,KAAK;GACZ,IAAI,KAAK,UAAU,eAAe,MAChC,OAAO,KAAK,UAAU;GAExB,MAAM;EACR;CACF;;;;CAKA,MAAM,OACJ,UACA,WACA,SACA,SACe;EACf,MAAM,QAAQ,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,KAAK,YAAY,SAAS;EACjD,IAAI,CAAC,UAAU;GACb,QAAQ,KACN,+BAA+B,UAAU,0BAC3C;GACA;EACF;EACA,MAAM,MAAM,QAAQ,SAAS,OAAO,UAAU,UAAU,EAAE,QAAQ,CAAC;CACrE;;;;CAKA,YAAY,WAA4B;EACtC,OAAO,aAAa,KAAK;CAC3B;;;;;CAMA,MAAM,YAAY,WAAgD;EAChE,MAAM,QAAQ,KAAK,UAAU;EAC7B,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,OAAO;CACT;;;;;;;;;;;CAYA,MAAM,KAAK,UAAkB,QAAiB;EAE5C,MAAM,EAAE,aAAa,MADP,KAAK,SACY,CAAC,CAAC,QAAQ,SAAS,KAChD,UACA,SAAS,EAAE,OAAO,IAAI,KAAA,CACxB;EAEA,KAAK,MAAM,KAAK,UACd,KAAK,UAAU,EAAE,MAAM,EAAE;EAE3B,OAAO;CACT;;;;CAKA,QAAQ;EACN,KAAK,YAAY,CAAC;CACpB;AACF"}

package/dist/runTelemetry.d.ts

@@ -42,10 +42,17 @@ type RunTelemetryUsage = {
 type RunTelemetryUsageInit = RunTelemetryUsage & {
   promptTokens?: number;
   completionTokens?: number;
+  inputTokenDetails?: {
+    cacheReadTokens?: number;
+  };
+  outputTokenDetails?: {
+    reasoningTokens?: number;
+  };
 };
 /**
- * Resolves the token counts a provider reports under either the current or the
- * legacy prompt/completion names. Returns undefined when no count is present,
+ * Resolves the token counts a provider reports under any of the names the AI
+ * SDK has used: the current top-level ones, the legacy prompt/completion pair,
+ * and the v7 token detail objects. Returns undefined when no count is present,
  * so callers can tell an empty usage object from a zeroed one.
  */
 declare function normalizeRunTelemetryUsage(usage: RunTelemetryUsageInit): RunTelemetryUsage | undefined;

package/dist/runTelemetry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runTelemetry.d.ts","names":[],"sources":["../src/runTelemetry.ts"],"mappings":";;KAMY;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA,iBAAiB;;;;;;iBAOH,yBAAyB;KAwC7B;EACV;EACA;EACA;;;;;EAKA;EACA;EACA;;;;;;;iBAQc,2BACd,MAAM,2BACL;KAgBS;EACV;EACA;EACA;EACA;;KAGU,wBAAwB;EAClC;EACA;;;;;;;iBAQc,2BACd,OAAO,wBACN"}
+{"version":3,"file":"runTelemetry.d.ts","names":[],"sources":["../src/runTelemetry.ts"],"mappings":";;KAMY;EACV;EACA;EACA;EACA;EACA;EACA;EACA;EACA,iBAAiB;;;;;;iBAOH,yBAAyB;KAwC7B;EACV;EACA;EACA;;;;;EAKA;EACA;EACA;;;;;;;iBAQc,2BACd,MAAM,2BACL;KAgBS;EACV;EACA;EACA;EACA;;KAGU,wBAAwB;EAClC;EACA;EACA;IAAsB;;EACtB;IAAuB;;;;;;;;;iBAST,2BACd,OAAO,wBACN"}

package/dist/runTelemetry.js

@@ -58,19 +58,22 @@ function createRunTelemetryToolCall(init) {
 	return call;
 }
 /**
-* Resolves the token counts a provider reports under either the current or the
-* legacy prompt/completion names. Returns undefined when no count is present,
+* Resolves the token counts a provider reports under any of the names the AI
+* SDK has used: the current top-level ones, the legacy prompt/completion pair,
+* and the v7 token detail objects. Returns undefined when no count is present,
 * so callers can tell an empty usage object from a zeroed one.
 */
 function normalizeRunTelemetryUsage(usage) {
 	const inputTokens = usage.inputTokens ?? usage.promptTokens;
 	const outputTokens = usage.outputTokens ?? usage.completionTokens;
-	if (inputTokens == null && outputTokens == null && usage.reasoningTokens == null && usage.cachedInputTokens == null) return;
+	const reasoningTokens = usage.reasoningTokens ?? usage.outputTokenDetails?.reasoningTokens;
+	const cachedInputTokens = usage.cachedInputTokens ?? usage.inputTokenDetails?.cacheReadTokens;
+	if (inputTokens == null && outputTokens == null && reasoningTokens == null && cachedInputTokens == null) return;
 	return {
 		...inputTokens != null ? { inputTokens } : void 0,
 		...outputTokens != null ? { outputTokens } : void 0,
-		...usage.reasoningTokens != null ? { reasoningTokens: usage.reasoningTokens } : void 0,
-		...usage.cachedInputTokens != null ? { cachedInputTokens: usage.cachedInputTokens } : void 0
+		...reasoningTokens != null ? { reasoningTokens } : void 0,
+		...cachedInputTokens != null ? { cachedInputTokens } : void 0
 	};
 }
 //#endregion

package/dist/runTelemetry.js.map

@@ -1 +1 @@
-{"version":3,"file":"runTelemetry.js","names":[],"sources":["../src/runTelemetry.ts"],"sourcesContent":["import type { SamplingCallData } from \"./instrumentMcpSampling\";\n\nconst MAX_TELEMETRY_TEXT_LENGTH = 50_000;\n\nconst BASE64_PATTERN = /^[A-Za-z0-9+/]{100,}={0,2}$/;\n\nexport type AssistantCloudRunReportToolCall = {\n  tool_name: string;\n  tool_call_id: string;\n  tool_args?: string;\n  tool_result?: string;\n  tool_source?: \"mcp\" | \"frontend\" | \"backend\";\n  start_ms?: number;\n  end_ms?: number;\n  sampling_calls?: SamplingCallData[];\n};\n\n/**\n * Clamps a string to the size the runs endpoint accepts for a single span\n * field.\n */\nexport function truncateRunTelemetryText(value: string): string {\n  if (value.length <= MAX_TELEMETRY_TEXT_LENGTH) return value;\n  return value.slice(0, MAX_TELEMETRY_TEXT_LENGTH);\n}\n\nfunction safeStringify(value: unknown): string | undefined {\n  if (value == null) return undefined;\n  try {\n    return truncateRunTelemetryText(JSON.stringify(value));\n  } catch {\n    return undefined;\n  }\n}\n\nfunction summarizeMcpResult(value: unknown): string | undefined {\n  if (value == null) return undefined;\n  try {\n    const parsed = typeof value === \"string\" ? JSON.parse(value) : value;\n    if (Array.isArray(parsed)) {\n      const summarized = parsed.map((item) => {\n        if (item && typeof item === \"object\" && item.type) {\n          if (\n            (item.type === \"image\" || item.type === \"audio\") &&\n            typeof item.data === \"string\" &&\n            BASE64_PATTERN.test(item.data.slice(0, 200))\n          ) {\n            const sizeKB = ((item.data.length * 3) / 4 / 1024).toFixed(1);\n            return { ...item, data: `[${item.type}: ${sizeKB}KB]` };\n          }\n        }\n        return item;\n      });\n      return truncateRunTelemetryText(JSON.stringify(summarized));\n    }\n  } catch {\n    // not JSON array, fall through\n  }\n  return safeStringify(value);\n}\n\nexport type RunTelemetryToolCallInit = {\n  toolName: string;\n  toolCallId: string;\n  args?: unknown;\n  /**\n   * Pre-serialized arguments, used in place of serializing `args`. Values over\n   * the span size are clamped before they are included in the report.\n   */\n  argsText?: string | undefined;\n  result?: unknown;\n  toolSource?: \"mcp\" | \"frontend\" | \"backend\" | undefined;\n};\n\n/**\n * Serializes one tool call into the shape the runs endpoint accepts. An `mcp`\n * source has its result summarized, because MCP content blocks carry inline\n * base64 image and audio payloads that would otherwise dominate the report.\n */\nexport function createRunTelemetryToolCall(\n  init: RunTelemetryToolCallInit,\n): AssistantCloudRunReportToolCall {\n  const { toolName, toolCallId, args, argsText, result, toolSource } = init;\n  const call: AssistantCloudRunReportToolCall = {\n    tool_name: toolName,\n    tool_call_id: toolCallId,\n  };\n  const toolArgs =\n    argsText != null ? truncateRunTelemetryText(argsText) : safeStringify(args);\n  if (toolArgs !== undefined) call.tool_args = toolArgs;\n  const toolResult =\n    toolSource === \"mcp\" ? summarizeMcpResult(result) : safeStringify(result);\n  if (toolResult !== undefined) call.tool_result = toolResult;\n  if (toolSource) call.tool_source = toolSource;\n  return call;\n}\n\nexport type RunTelemetryUsage = {\n  inputTokens?: number;\n  outputTokens?: number;\n  reasoningTokens?: number;\n  cachedInputTokens?: number;\n};\n\nexport type RunTelemetryUsageInit = RunTelemetryUsage & {\n  promptTokens?: number;\n  completionTokens?: number;\n};\n\n/**\n * Resolves the token counts a provider reports under either the current or the\n * legacy prompt/completion names. Returns undefined when no count is present,\n * so callers can tell an empty usage object from a zeroed one.\n */\nexport function normalizeRunTelemetryUsage(\n  usage: RunTelemetryUsageInit,\n): RunTelemetryUsage | undefined {\n  const inputTokens = usage.inputTokens ?? usage.promptTokens;\n  const outputTokens = usage.outputTokens ?? usage.completionTokens;\n\n  if (\n    inputTokens == null &&\n    outputTokens == null &&\n    usage.reasoningTokens == null &&\n    usage.cachedInputTokens == null\n  ) {\n    return undefined;\n  }\n\n  return {\n    ...(inputTokens != null ? { inputTokens } : undefined),\n    ...(outputTokens != null ? { outputTokens } : undefined),\n    ...(usage.reasoningTokens != null\n      ? { reasoningTokens: usage.reasoningTokens }\n      : undefined),\n    ...(usage.cachedInputTokens != null\n      ? { cachedInputTokens: usage.cachedInputTokens }\n      : undefined),\n  };\n}\n"],"mappings":";AAEA,MAAM,4BAA4B;AAElC,MAAM,iBAAiB;;;;;AAiBvB,SAAgB,yBAAyB,OAAuB;CAC9D,IAAI,MAAM,UAAU,2BAA2B,OAAO;CACtD,OAAO,MAAM,MAAM,GAAG,yBAAyB;AACjD;AAEA,SAAS,cAAc,OAAoC;CACzD,IAAI,SAAS,MAAM,OAAO,KAAA;CAC1B,IAAI;EACF,OAAO,yBAAyB,KAAK,UAAU,KAAK,CAAC;CACvD,QAAQ;EACN;CACF;AACF;AAEA,SAAS,mBAAmB,OAAoC;CAC9D,IAAI,SAAS,MAAM,OAAO,KAAA;CAC1B,IAAI;EACF,MAAM,SAAS,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;EAC/D,IAAI,MAAM,QAAQ,MAAM,GAAG;GACzB,MAAM,aAAa,OAAO,KAAK,SAAS;IACtC,IAAI,QAAQ,OAAO,SAAS,YAAY,KAAK,MAExC;UAAA,KAAK,SAAS,WAAW,KAAK,SAAS,YACxC,OAAO,KAAK,SAAS,YACrB,eAAe,KAAK,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAC3C;MACA,MAAM,UAAW,KAAK,KAAK,SAAS,IAAK,IAAI,KAAA,CAAM,QAAQ,CAAC;MAC5D,OAAO;OAAE,GAAG;OAAM,MAAM,IAAI,KAAK,KAAK,IAAI,OAAO;MAAK;KACxD;;IAEF,OAAO;GACT,CAAC;GACD,OAAO,yBAAyB,KAAK,UAAU,UAAU,CAAC;EAC5D;CACF,QAAQ,CAER;CACA,OAAO,cAAc,KAAK;AAC5B;;;;;;AAoBA,SAAgB,2BACd,MACiC;CACjC,MAAM,EAAE,UAAU,YAAY,MAAM,UAAU,QAAQ,eAAe;CACrE,MAAM,OAAwC;EAC5C,WAAW;EACX,cAAc;CAChB;CACA,MAAM,WACJ,YAAY,OAAO,yBAAyB,QAAQ,IAAI,cAAc,IAAI;CAC5E,IAAI,aAAa,KAAA,GAAW,KAAK,YAAY;CAC7C,MAAM,aACJ,eAAe,QAAQ,mBAAmB,MAAM,IAAI,cAAc,MAAM;CAC1E,IAAI,eAAe,KAAA,GAAW,KAAK,cAAc;CACjD,IAAI,YAAY,KAAK,cAAc;CACnC,OAAO;AACT;;;;;;AAmBA,SAAgB,2BACd,OAC+B;CAC/B,MAAM,cAAc,MAAM,eAAe,MAAM;CAC/C,MAAM,eAAe,MAAM,gBAAgB,MAAM;CAEjD,IACE,eAAe,QACf,gBAAgB,QAChB,MAAM,mBAAmB,QACzB,MAAM,qBAAqB,MAE3B;CAGF,OAAO;EACL,GAAI,eAAe,OAAO,EAAE,YAAY,IAAI,KAAA;EAC5C,GAAI,gBAAgB,OAAO,EAAE,aAAa,IAAI,KAAA;EAC9C,GAAI,MAAM,mBAAmB,OACzB,EAAE,iBAAiB,MAAM,gBAAgB,IACzC,KAAA;EACJ,GAAI,MAAM,qBAAqB,OAC3B,EAAE,mBAAmB,MAAM,kBAAkB,IAC7C,KAAA;CACN;AACF"}
+{"version":3,"file":"runTelemetry.js","names":[],"sources":["../src/runTelemetry.ts"],"sourcesContent":["import type { SamplingCallData } from \"./instrumentMcpSampling\";\n\nconst MAX_TELEMETRY_TEXT_LENGTH = 50_000;\n\nconst BASE64_PATTERN = /^[A-Za-z0-9+/]{100,}={0,2}$/;\n\nexport type AssistantCloudRunReportToolCall = {\n  tool_name: string;\n  tool_call_id: string;\n  tool_args?: string;\n  tool_result?: string;\n  tool_source?: \"mcp\" | \"frontend\" | \"backend\";\n  start_ms?: number;\n  end_ms?: number;\n  sampling_calls?: SamplingCallData[];\n};\n\n/**\n * Clamps a string to the size the runs endpoint accepts for a single span\n * field.\n */\nexport function truncateRunTelemetryText(value: string): string {\n  if (value.length <= MAX_TELEMETRY_TEXT_LENGTH) return value;\n  return value.slice(0, MAX_TELEMETRY_TEXT_LENGTH);\n}\n\nfunction safeStringify(value: unknown): string | undefined {\n  if (value == null) return undefined;\n  try {\n    return truncateRunTelemetryText(JSON.stringify(value));\n  } catch {\n    return undefined;\n  }\n}\n\nfunction summarizeMcpResult(value: unknown): string | undefined {\n  if (value == null) return undefined;\n  try {\n    const parsed = typeof value === \"string\" ? JSON.parse(value) : value;\n    if (Array.isArray(parsed)) {\n      const summarized = parsed.map((item) => {\n        if (item && typeof item === \"object\" && item.type) {\n          if (\n            (item.type === \"image\" || item.type === \"audio\") &&\n            typeof item.data === \"string\" &&\n            BASE64_PATTERN.test(item.data.slice(0, 200))\n          ) {\n            const sizeKB = ((item.data.length * 3) / 4 / 1024).toFixed(1);\n            return { ...item, data: `[${item.type}: ${sizeKB}KB]` };\n          }\n        }\n        return item;\n      });\n      return truncateRunTelemetryText(JSON.stringify(summarized));\n    }\n  } catch {\n    // not JSON array, fall through\n  }\n  return safeStringify(value);\n}\n\nexport type RunTelemetryToolCallInit = {\n  toolName: string;\n  toolCallId: string;\n  args?: unknown;\n  /**\n   * Pre-serialized arguments, used in place of serializing `args`. Values over\n   * the span size are clamped before they are included in the report.\n   */\n  argsText?: string | undefined;\n  result?: unknown;\n  toolSource?: \"mcp\" | \"frontend\" | \"backend\" | undefined;\n};\n\n/**\n * Serializes one tool call into the shape the runs endpoint accepts. An `mcp`\n * source has its result summarized, because MCP content blocks carry inline\n * base64 image and audio payloads that would otherwise dominate the report.\n */\nexport function createRunTelemetryToolCall(\n  init: RunTelemetryToolCallInit,\n): AssistantCloudRunReportToolCall {\n  const { toolName, toolCallId, args, argsText, result, toolSource } = init;\n  const call: AssistantCloudRunReportToolCall = {\n    tool_name: toolName,\n    tool_call_id: toolCallId,\n  };\n  const toolArgs =\n    argsText != null ? truncateRunTelemetryText(argsText) : safeStringify(args);\n  if (toolArgs !== undefined) call.tool_args = toolArgs;\n  const toolResult =\n    toolSource === \"mcp\" ? summarizeMcpResult(result) : safeStringify(result);\n  if (toolResult !== undefined) call.tool_result = toolResult;\n  if (toolSource) call.tool_source = toolSource;\n  return call;\n}\n\nexport type RunTelemetryUsage = {\n  inputTokens?: number;\n  outputTokens?: number;\n  reasoningTokens?: number;\n  cachedInputTokens?: number;\n};\n\nexport type RunTelemetryUsageInit = RunTelemetryUsage & {\n  promptTokens?: number;\n  completionTokens?: number;\n  inputTokenDetails?: { cacheReadTokens?: number };\n  outputTokenDetails?: { reasoningTokens?: number };\n};\n\n/**\n * Resolves the token counts a provider reports under any of the names the AI\n * SDK has used: the current top-level ones, the legacy prompt/completion pair,\n * and the v7 token detail objects. Returns undefined when no count is present,\n * so callers can tell an empty usage object from a zeroed one.\n */\nexport function normalizeRunTelemetryUsage(\n  usage: RunTelemetryUsageInit,\n): RunTelemetryUsage | undefined {\n  const inputTokens = usage.inputTokens ?? usage.promptTokens;\n  const outputTokens = usage.outputTokens ?? usage.completionTokens;\n  // AI SDK v7 moved these under token detail objects; v6 kept them top-level.\n  const reasoningTokens =\n    usage.reasoningTokens ?? usage.outputTokenDetails?.reasoningTokens;\n  const cachedInputTokens =\n    usage.cachedInputTokens ?? usage.inputTokenDetails?.cacheReadTokens;\n\n  if (\n    inputTokens == null &&\n    outputTokens == null &&\n    reasoningTokens == null &&\n    cachedInputTokens == null\n  ) {\n    return undefined;\n  }\n\n  return {\n    ...(inputTokens != null ? { inputTokens } : undefined),\n    ...(outputTokens != null ? { outputTokens } : undefined),\n    ...(reasoningTokens != null ? { reasoningTokens } : undefined),\n    ...(cachedInputTokens != null ? { cachedInputTokens } : undefined),\n  };\n}\n"],"mappings":";AAEA,MAAM,4BAA4B;AAElC,MAAM,iBAAiB;;;;;AAiBvB,SAAgB,yBAAyB,OAAuB;CAC9D,IAAI,MAAM,UAAU,2BAA2B,OAAO;CACtD,OAAO,MAAM,MAAM,GAAG,yBAAyB;AACjD;AAEA,SAAS,cAAc,OAAoC;CACzD,IAAI,SAAS,MAAM,OAAO,KAAA;CAC1B,IAAI;EACF,OAAO,yBAAyB,KAAK,UAAU,KAAK,CAAC;CACvD,QAAQ;EACN;CACF;AACF;AAEA,SAAS,mBAAmB,OAAoC;CAC9D,IAAI,SAAS,MAAM,OAAO,KAAA;CAC1B,IAAI;EACF,MAAM,SAAS,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;EAC/D,IAAI,MAAM,QAAQ,MAAM,GAAG;GACzB,MAAM,aAAa,OAAO,KAAK,SAAS;IACtC,IAAI,QAAQ,OAAO,SAAS,YAAY,KAAK,MAExC;UAAA,KAAK,SAAS,WAAW,KAAK,SAAS,YACxC,OAAO,KAAK,SAAS,YACrB,eAAe,KAAK,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAC3C;MACA,MAAM,UAAW,KAAK,KAAK,SAAS,IAAK,IAAI,KAAA,CAAM,QAAQ,CAAC;MAC5D,OAAO;OAAE,GAAG;OAAM,MAAM,IAAI,KAAK,KAAK,IAAI,OAAO;MAAK;KACxD;;IAEF,OAAO;GACT,CAAC;GACD,OAAO,yBAAyB,KAAK,UAAU,UAAU,CAAC;EAC5D;CACF,QAAQ,CAER;CACA,OAAO,cAAc,KAAK;AAC5B;;;;;;AAoBA,SAAgB,2BACd,MACiC;CACjC,MAAM,EAAE,UAAU,YAAY,MAAM,UAAU,QAAQ,eAAe;CACrE,MAAM,OAAwC;EAC5C,WAAW;EACX,cAAc;CAChB;CACA,MAAM,WACJ,YAAY,OAAO,yBAAyB,QAAQ,IAAI,cAAc,IAAI;CAC5E,IAAI,aAAa,KAAA,GAAW,KAAK,YAAY;CAC7C,MAAM,aACJ,eAAe,QAAQ,mBAAmB,MAAM,IAAI,cAAc,MAAM;CAC1E,IAAI,eAAe,KAAA,GAAW,KAAK,cAAc;CACjD,IAAI,YAAY,KAAK,cAAc;CACnC,OAAO;AACT;;;;;;;AAsBA,SAAgB,2BACd,OAC+B;CAC/B,MAAM,cAAc,MAAM,eAAe,MAAM;CAC/C,MAAM,eAAe,MAAM,gBAAgB,MAAM;CAEjD,MAAM,kBACJ,MAAM,mBAAmB,MAAM,oBAAoB;CACrD,MAAM,oBACJ,MAAM,qBAAqB,MAAM,mBAAmB;CAEtD,IACE,eAAe,QACf,gBAAgB,QAChB,mBAAmB,QACnB,qBAAqB,MAErB;CAGF,OAAO;EACL,GAAI,eAAe,OAAO,EAAE,YAAY,IAAI,KAAA;EAC5C,GAAI,gBAAgB,OAAO,EAAE,aAAa,IAAI,KAAA;EAC9C,GAAI,mBAAmB,OAAO,EAAE,gBAAgB,IAAI,KAAA;EACpD,GAAI,qBAAqB,OAAO,EAAE,kBAAkB,IAAI,KAAA;CAC1D;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "assistant-cloud",
-  "version": "0.1.42",
+  "version": "0.1.43",
   "description": "Cloud integration for assistant-ui",
   "keywords": [
     "assistant",
@@ -27,11 +27,11 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "assistant-stream": "^0.3.40"
+    "assistant-stream": "^0.3.41"
   },
   "devDependencies": {
-    "@assistant-ui/x-buildutils": "0.0.24",
-    "@types/node": "^26.2.0",
+    "@assistant-ui/x-buildutils": "0.0.25",
+    "@types/node": "^26.4.0",
     "vitest": "^4.1.11"
   },
   "publishConfig": {

package/src/AssistantCloudAuthStrategy.ts

@@ -4,6 +4,34 @@ import {
   readCloudString,
 } from "./cloudResponse";
 
+const AUTH_TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+
+const withAuthTokenDeadline = async <T>(
+  operation: string,
+  run: (signal: AbortSignal) => Promise<T>,
+): Promise<T> => {
+  const controller = new AbortController();
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, AUTH_TOKEN_REQUEST_TIMEOUT_MS);
+
+  try {
+    return await run(controller.signal);
+  } catch (error) {
+    if (timedOut) {
+      throw new Error(
+        `Assistant Cloud ${operation} timed out after ${AUTH_TOKEN_REQUEST_TIMEOUT_MS}ms`,
+        { cause: error },
+      );
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+};
+
 export type AssistantCloudAuthStrategy = {
   readonly strategy: "anon" | "jwt" | "api-key";
   getAuthHeaders(): Promise<Record<string, string> | false>;
@@ -247,6 +275,52 @@ const removeRefreshToken = (baseUrl: string): void => {
   } catch {}
 };
 
+// In-flight sharing follows refresh-token storage scope to isolate server requests.
+const anonymousAuthTokenRequests = new WeakMap<
+  Storage,
+  Map<string, Promise<string | null>>
+>();
+
+const getWebLockManager = (): LockManager | null => {
+  if (!("navigator" in globalThis)) return null;
+  return (
+    (globalThis as { navigator?: { locks?: LockManager } }).navigator?.locks ??
+    null
+  );
+};
+
+const getAnonymousAuthLockName = (baseUrl: string): string =>
+  `assistant-cloud:anonymous-auth:${baseUrl}`;
+
+const getSharedAnonymousAuthToken = (
+  baseUrl: string,
+  requestToken: () => Promise<string | null>,
+): Promise<string | null> => {
+  const storage = getLocalStorage();
+  if (!storage) return requestToken();
+
+  let storageRequests = anonymousAuthTokenRequests.get(storage);
+  if (!storageRequests) {
+    storageRequests = new Map();
+    anonymousAuthTokenRequests.set(storage, storageRequests);
+  }
+
+  const activeRequest = storageRequests.get(baseUrl);
+  if (activeRequest) return activeRequest;
+
+  const locks = getWebLockManager();
+  const request = locks
+    ? locks.request(getAnonymousAuthLockName(baseUrl), requestToken)
+    : requestToken();
+  const sharedRequest = request.finally(() => {
+    if (storageRequests.get(baseUrl) === sharedRequest) {
+      storageRequests.delete(baseUrl);
+    }
+  });
+  storageRequests.set(baseUrl, sharedRequest);
+  return sharedRequest;
+};
+
 export class AssistantCloudAnonymousAuthStrategy implements AssistantCloudAuthStrategy {
   public readonly strategy = "anon";
 
@@ -255,70 +329,90 @@ export class AssistantCloudAnonymousAuthStrategy implements AssistantCloudAuthSt
 
   constructor(baseUrl: string) {
     this.baseUrl = baseUrl;
-    this.jwtStrategy = new AssistantCloudJWTAuthStrategy(async () => {
+    const requestAuthToken = async (): Promise<string | null> => {
       const currentTime = Date.now();
       const storedRefreshToken = readRefreshToken(this.baseUrl);
 
       if (storedRefreshToken) {
         const refreshExpiry = new Date(storedRefreshToken.expires_at).getTime();
         if (refreshExpiry - currentTime > 30 * 1000) {
-          const response = await fetch(
-            `${this.baseUrl}/v1/auth/tokens/refresh`,
-            {
-              method: "POST",
-              headers: { "Content-Type": "application/json" },
-              body: JSON.stringify({ refresh_token: storedRefreshToken.token }),
+          const refreshedAccessToken = await withAuthTokenDeadline(
+            "refresh token request",
+            async (signal) => {
+              const response = await fetch(
+                `${this.baseUrl}/v1/auth/tokens/refresh`,
+                {
+                  method: "POST",
+                  headers: { "Content-Type": "application/json" },
+                  body: JSON.stringify({
+                    refresh_token: storedRefreshToken.token,
+                  }),
+                  signal,
+                },
+              );
+
+              if (response.ok) {
+                const { data, accessToken } = await readAuthTokenResponse(
+                  response,
+                  "refresh auth token response",
+                );
+                if (data.refresh_token != null) {
+                  writeRefreshToken(
+                    this.baseUrl,
+                    readRefreshTokenResponse(
+                      data.refresh_token,
+                      "refresh auth token response.refresh_token",
+                    ),
+                  );
+                }
+                return accessToken;
+              }
+
+              if (response.status === 429 || response.status >= 500) {
+                throw new Error(
+                  `Assistant Cloud token refresh failed with status ${response.status}`,
+                );
+              }
+
+              return null;
             },
           );
-
-          if (response.ok) {
-            const { data, accessToken } = await readAuthTokenResponse(
-              response,
-              "refresh auth token response",
-            );
-            if (data.refresh_token != null) {
-              writeRefreshToken(
-                this.baseUrl,
-                readRefreshTokenResponse(
-                  data.refresh_token,
-                  "refresh auth token response.refresh_token",
-                ),
-              );
-            }
-            return accessToken;
-          }
-
-          if (response.status === 429 || response.status >= 500) {
-            throw new Error(
-              `Assistant Cloud token refresh failed with status ${response.status}`,
-            );
-          }
+          if (refreshedAccessToken !== null) return refreshedAccessToken;
         } else {
           removeRefreshToken(this.baseUrl);
         }
       }
 
       // No valid refresh token; request a new anonymous token
-      const response = await fetch(`${this.baseUrl}/v1/auth/tokens/anonymous`, {
-        method: "POST",
-      });
+      return withAuthTokenDeadline(
+        "anonymous token request",
+        async (signal) => {
+          const response = await fetch(
+            `${this.baseUrl}/v1/auth/tokens/anonymous`,
+            { method: "POST", signal },
+          );
 
-      if (!response.ok) return null;
+          if (!response.ok) return null;
 
-      const { data, accessToken } = await readAuthTokenResponse(
-        response,
-        "anonymous auth token response",
-      );
+          const { data, accessToken } = await readAuthTokenResponse(
+            response,
+            "anonymous auth token response",
+          );
 
-      writeRefreshToken(
-        this.baseUrl,
-        readRefreshTokenResponse(
-          data.refresh_token,
-          "anonymous auth token response.refresh_token",
-        ),
+          writeRefreshToken(
+            this.baseUrl,
+            readRefreshTokenResponse(
+              data.refresh_token,
+              "anonymous auth token response.refresh_token",
+            ),
+          );
+          return accessToken;
+        },
       );
-      return accessToken;
-    });
+    };
+    this.jwtStrategy = new AssistantCloudJWTAuthStrategy(() =>
+      getSharedAnonymousAuthToken(this.baseUrl, requestAuthToken),
+    );
   }
 
   public async getAuthHeaders(): Promise<Record<string, string> | false> {

package/src/CloudMessagePersistence.ts

@@ -39,32 +39,36 @@ export class CloudMessagePersistence {
     content: ReadonlyJSONObject,
   ): Promise<void> {
     const cloud = this.getCloud();
-    // Resolve parent's remote ID if it exists (may be a promise if concurrent)
-    const resolvedParentId = parentId
-      ? ((await this.idMapping[parentId]) ?? parentId)
-      : null;
+    const existing = this.idMapping[messageId];
+    if (existing instanceof Promise) {
+      await existing;
+      return;
+    }
 
-    const task = cloud.threads.messages
-      .create(threadId, {
+    const task = (async () => {
+      const resolvedParentId = parentId
+        ? ((await this.idMapping[parentId]) ?? parentId)
+        : null;
+      const { message_id } = await cloud.threads.messages.create(threadId, {
         parent_id: resolvedParentId,
         format,
         content,
-      })
-      .then(({ message_id }) => {
-        this.idMapping[messageId] = message_id;
-        return message_id;
-      })
-      .catch((err) => {
-        // Only delete if we're still the active task (avoids clobbering a retry)
-        if (this.idMapping[messageId] === task) {
-          delete this.idMapping[messageId];
-        }
-        throw err;
       });
+      return message_id;
+    })();
 
-    // Store the promise immediately so concurrent appends can await it
     this.idMapping[messageId] = task;
-    return task.then(() => {});
+    try {
+      const remoteId = await task;
+      if (this.idMapping[messageId] === task) {
+        this.idMapping[messageId] = remoteId;
+      }
+    } catch (err) {
+      if (this.idMapping[messageId] === task) {
+        delete this.idMapping[messageId];
+      }
+      throw err;
+    }
   }
 
   /**

package/src/runTelemetry.test.ts

@@ -124,7 +124,48 @@ describe("normalizeRunTelemetryUsage", () => {
     ).toEqual({ inputTokens: 0, cachedInputTokens: 5 });
   });
 
+  it("reads the AI SDK v7 token detail objects", () => {
+    expect(
+      normalizeRunTelemetryUsage({
+        inputTokens: 12,
+        outputTokens: 7,
+        inputTokenDetails: { cacheReadTokens: 5 },
+        outputTokenDetails: { reasoningTokens: 3 },
+      }),
+    ).toEqual({
+      inputTokens: 12,
+      outputTokens: 7,
+      reasoningTokens: 3,
+      cachedInputTokens: 5,
+    });
+  });
+
+  it("prefers the top-level detail counts over the nested ones", () => {
+    expect(
+      normalizeRunTelemetryUsage({
+        reasoningTokens: 3,
+        cachedInputTokens: 5,
+        inputTokenDetails: { cacheReadTokens: 90 },
+        outputTokenDetails: { reasoningTokens: 90 },
+      }),
+    ).toEqual({ reasoningTokens: 3, cachedInputTokens: 5 });
+  });
+
+  it("returns a usage object when only the nested counts are present", () => {
+    expect(
+      normalizeRunTelemetryUsage({
+        inputTokenDetails: { cacheReadTokens: 5 },
+      }),
+    ).toEqual({ cachedInputTokens: 5 });
+  });
+
   it("returns undefined when no count is present", () => {
     expect(normalizeRunTelemetryUsage({})).toBeUndefined();
+    expect(
+      normalizeRunTelemetryUsage({
+        inputTokenDetails: {},
+        outputTokenDetails: {},
+      }),
+    ).toBeUndefined();
   });
 });

package/src/runTelemetry.ts

@@ -105,11 +105,14 @@ export type RunTelemetryUsage = {
 export type RunTelemetryUsageInit = RunTelemetryUsage & {
   promptTokens?: number;
   completionTokens?: number;
+  inputTokenDetails?: { cacheReadTokens?: number };
+  outputTokenDetails?: { reasoningTokens?: number };
 };
 
 /**
- * Resolves the token counts a provider reports under either the current or the
- * legacy prompt/completion names. Returns undefined when no count is present,
+ * Resolves the token counts a provider reports under any of the names the AI
+ * SDK has used: the current top-level ones, the legacy prompt/completion pair,
+ * and the v7 token detail objects. Returns undefined when no count is present,
  * so callers can tell an empty usage object from a zeroed one.
  */
 export function normalizeRunTelemetryUsage(
@@ -117,12 +120,17 @@ export function normalizeRunTelemetryUsage(
 ): RunTelemetryUsage | undefined {
   const inputTokens = usage.inputTokens ?? usage.promptTokens;
   const outputTokens = usage.outputTokens ?? usage.completionTokens;
+  // AI SDK v7 moved these under token detail objects; v6 kept them top-level.
+  const reasoningTokens =
+    usage.reasoningTokens ?? usage.outputTokenDetails?.reasoningTokens;
+  const cachedInputTokens =
+    usage.cachedInputTokens ?? usage.inputTokenDetails?.cacheReadTokens;
 
   if (
     inputTokens == null &&
     outputTokens == null &&
-    usage.reasoningTokens == null &&
-    usage.cachedInputTokens == null
+    reasoningTokens == null &&
+    cachedInputTokens == null
   ) {
     return undefined;
   }
@@ -130,11 +138,7 @@ export function normalizeRunTelemetryUsage(
   return {
     ...(inputTokens != null ? { inputTokens } : undefined),
     ...(outputTokens != null ? { outputTokens } : undefined),
-    ...(usage.reasoningTokens != null
-      ? { reasoningTokens: usage.reasoningTokens }
-      : undefined),
-    ...(usage.cachedInputTokens != null
-      ? { cachedInputTokens: usage.cachedInputTokens }
-      : undefined),
+    ...(reasoningTokens != null ? { reasoningTokens } : undefined),
+    ...(cachedInputTokens != null ? { cachedInputTokens } : undefined),
   };
 }

package/src/tests/AssistantCloudAuthStrategy.test.ts

@@ -43,6 +43,7 @@ describe("AssistantCloudAnonymousAuthStrategy", () => {
   });
 
   afterEach(() => {
+    vi.useRealTimers();
     vi.unstubAllGlobals();
     if (originalLocalStorageDescriptor) {
       Object.defineProperty(
@@ -83,7 +84,7 @@ describe("AssistantCloudAnonymousAuthStrategy", () => {
     expect(values.get(refreshTokenKey)).toBe(JSON.stringify(nextRefreshToken));
     expect(fetchMock).toHaveBeenCalledWith(
       `${baseUrl}/v1/auth/tokens/anonymous`,
-      { method: "POST" },
+      { method: "POST", signal: expect.any(AbortSignal) },
     );
   });
 
@@ -106,6 +107,276 @@ describe("AssistantCloudAnonymousAuthStrategy", () => {
     expect(fetchMock).toHaveBeenCalledTimes(1);
   });
 
+  it("deduplicates anonymous token requests across strategy instances", async () => {
+    const values = new Map<string, string>();
+    installLocalStorage({
+      getItem: (key) => values.get(key) ?? null,
+      setItem: (key, value) => {
+        values.set(key, value);
+      },
+      removeItem: (key) => {
+        values.delete(key);
+      },
+    } as Storage);
+    const fetchMock = mockAnonymousTokenFetch();
+    const first = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+    const second = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+
+    await expect(
+      Promise.all([first.getAuthHeaders(), second.getAuthHeaders()]),
+    ).resolves.toEqual([
+      { Authorization: `Bearer ${accessToken}` },
+      { Authorization: `Bearer ${accessToken}` },
+    ]);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(values.get(refreshTokenKey)).toBe(JSON.stringify(refreshToken));
+  });
+
+  it("coordinates anonymous token requests across realms", async () => {
+    const values = new Map<string, string>();
+    installLocalStorage({
+      getItem: (key) => values.get(key) ?? null,
+      setItem: (key, value) => {
+        values.set(key, value);
+      },
+      removeItem: (key) => {
+        values.delete(key);
+      },
+    } as Storage);
+    let lockTail: Promise<unknown> = Promise.resolve();
+    const lockRequest = vi.fn(
+      (_name: string, callback: () => Promise<string | null>) => {
+        const request = lockTail.then(callback);
+        lockTail = request.then(
+          () => undefined,
+          () => undefined,
+        );
+        return request;
+      },
+    );
+    vi.stubGlobal("navigator", { locks: { request: lockRequest } });
+    const rotatedRefreshToken = { token: "r2", expires_at: "2099-01-01" };
+    const response = (refreshTokenValue: typeof refreshToken) => ({
+      ok: true,
+      json: vi.fn().mockResolvedValue({
+        access_token: accessToken,
+        refresh_token: refreshTokenValue,
+      }),
+    });
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(response(refreshToken))
+      .mockResolvedValueOnce(response(rotatedRefreshToken));
+    vi.stubGlobal("fetch", fetchMock);
+
+    const first = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+    vi.resetModules();
+    const { AssistantCloudAnonymousAuthStrategy: Second } =
+      await import("../AssistantCloudAuthStrategy");
+
+    await expect(
+      Promise.all([
+        first.getAuthHeaders(),
+        new Second(baseUrl).getAuthHeaders(),
+      ]),
+    ).resolves.toEqual([
+      { Authorization: `Bearer ${accessToken}` },
+      { Authorization: `Bearer ${accessToken}` },
+    ]);
+    expect(fetchMock).toHaveBeenNthCalledWith(
+      1,
+      `${baseUrl}/v1/auth/tokens/anonymous`,
+      { method: "POST", signal: expect.any(AbortSignal) },
+    );
+    expect(fetchMock).toHaveBeenNthCalledWith(
+      2,
+      `${baseUrl}/v1/auth/tokens/refresh`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ refresh_token: refreshToken.token }),
+        signal: expect.any(AbortSignal),
+      },
+    );
+    expect(lockRequest).toHaveBeenCalledTimes(2);
+    expect(values.get(refreshTokenKey)).toBe(
+      JSON.stringify(rotatedRefreshToken),
+    );
+  });
+
+  it("retries shared anonymous token requests after a failure", async () => {
+    const values = new Map<string, string>();
+    installLocalStorage({
+      getItem: (key) => values.get(key) ?? null,
+      setItem: (key, value) => {
+        values.set(key, value);
+      },
+      removeItem: (key) => {
+        values.delete(key);
+      },
+    } as Storage);
+    const failure = new Error("authentication unavailable");
+    const fetchMock = vi
+      .fn()
+      .mockRejectedValueOnce(failure)
+      .mockResolvedValueOnce({
+        ok: true,
+        json: vi.fn().mockResolvedValue({
+          access_token: accessToken,
+          refresh_token: refreshToken,
+        }),
+      });
+    vi.stubGlobal("fetch", fetchMock);
+    const first = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+    const second = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+
+    await Promise.all([
+      expect(first.getAuthHeaders()).rejects.toBe(failure),
+      expect(second.getAuthHeaders()).rejects.toBe(failure),
+    ]);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+
+    await expect(
+      new AssistantCloudAnonymousAuthStrategy(baseUrl).getAuthHeaders(),
+    ).resolves.toEqual({ Authorization: `Bearer ${accessToken}` });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("aborts timed out shared anonymous token requests before retrying", async () => {
+    vi.useFakeTimers();
+    const values = new Map<string, string>();
+    installLocalStorage({
+      getItem: (key) => values.get(key) ?? null,
+      setItem: (key, value) => {
+        values.set(key, value);
+      },
+      removeItem: (key) => {
+        values.delete(key);
+      },
+    } as Storage);
+    let requestSignal: AbortSignal | null | undefined;
+    const fetchMock = vi
+      .fn()
+      .mockImplementationOnce((_input: RequestInfo | URL, init?: RequestInit) =>
+        Promise.resolve({
+          ok: true,
+          json: () =>
+            new Promise<never>((_resolve, reject) => {
+              requestSignal = init?.signal;
+              requestSignal?.addEventListener(
+                "abort",
+                () => reject(requestSignal?.reason),
+                { once: true },
+              );
+            }),
+        } as Response),
+      )
+      .mockResolvedValueOnce({
+        ok: true,
+        json: vi.fn().mockResolvedValue({
+          access_token: accessToken,
+          refresh_token: refreshToken,
+        }),
+      });
+    vi.stubGlobal("fetch", fetchMock);
+    const first = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+    const second = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+
+    const firstRequest = expect(first.getAuthHeaders()).rejects.toThrow(
+      "Assistant Cloud anonymous token request timed out after 30000ms",
+    );
+    const secondRequest = expect(second.getAuthHeaders()).rejects.toThrow(
+      "Assistant Cloud anonymous token request timed out after 30000ms",
+    );
+    await vi.advanceTimersByTimeAsync(0);
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(requestSignal).toBeInstanceOf(AbortSignal);
+
+    await vi.advanceTimersByTimeAsync(30_000);
+    await Promise.all([firstRequest, secondRequest]);
+    expect(requestSignal?.aborted).toBe(true);
+    expect(values.has(refreshTokenKey)).toBe(false);
+
+    await expect(
+      new AssistantCloudAnonymousAuthStrategy(baseUrl).getAuthHeaders(),
+    ).resolves.toEqual({ Authorization: `Bearer ${accessToken}` });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("aborts timed out refresh requests without replacing the identity", async () => {
+    vi.useFakeTimers();
+    const values = new Map([[refreshTokenKey, JSON.stringify(refreshToken)]]);
+    installLocalStorage({
+      getItem: (key) => values.get(key) ?? null,
+      setItem: (key, value) => {
+        values.set(key, value);
+      },
+      removeItem: (key) => {
+        values.delete(key);
+      },
+    } as Storage);
+    let requestSignal: AbortSignal | null | undefined;
+    const rotatedRefreshToken = { token: "r2", expires_at: "2099-02-01" };
+    const fetchMock = vi
+      .fn()
+      .mockImplementationOnce(
+        (_input: RequestInfo | URL, init?: RequestInit) =>
+          new Promise<Response>((_resolve, reject) => {
+            requestSignal = init?.signal;
+            requestSignal?.addEventListener(
+              "abort",
+              () => reject(requestSignal?.reason),
+              { once: true },
+            );
+          }),
+      )
+      .mockResolvedValueOnce({
+        ok: true,
+        json: vi.fn().mockResolvedValue({
+          access_token: accessToken,
+          refresh_token: rotatedRefreshToken,
+        }),
+      });
+    vi.stubGlobal("fetch", fetchMock);
+    const strategy = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+
+    const request = expect(strategy.getAuthHeaders()).rejects.toThrow(
+      "Assistant Cloud refresh token request timed out after 30000ms",
+    );
+    expect(requestSignal).toBeInstanceOf(AbortSignal);
+
+    await vi.advanceTimersByTimeAsync(30_000);
+    await request;
+    expect(requestSignal?.aborted).toBe(true);
+    expect(values.get(refreshTokenKey)).toBe(JSON.stringify(refreshToken));
+
+    await expect(strategy.getAuthHeaders()).resolves.toEqual({
+      Authorization: `Bearer ${accessToken}`,
+    });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(values.get(refreshTokenKey)).toBe(
+      JSON.stringify(rotatedRefreshToken),
+    );
+  });
+
+  it("keeps anonymous token requests independent without localStorage", async () => {
+    delete (globalThis as { localStorage?: Storage }).localStorage;
+    const lockRequest = vi.fn();
+    vi.stubGlobal("navigator", { locks: { request: lockRequest } });
+    const fetchMock = mockAnonymousTokenFetch();
+    const first = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+    const second = new AssistantCloudAnonymousAuthStrategy(baseUrl);
+
+    await expect(
+      Promise.all([first.getAuthHeaders(), second.getAuthHeaders()]),
+    ).resolves.toEqual([
+      { Authorization: `Bearer ${accessToken}` },
+      { Authorization: `Bearer ${accessToken}` },
+    ]);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(lockRequest).not.toHaveBeenCalled();
+  });
+
   it("scopes anonymous refresh tokens by backend", async () => {
     const secondBaseUrl = "https://other.example.com";
     const values = new Map<string, string>();
@@ -140,20 +411,20 @@ describe("AssistantCloudAnonymousAuthStrategy", () => {
       });
     vi.stubGlobal("fetch", fetchMock);
 
-    await new AssistantCloudAnonymousAuthStrategy(baseUrl).getAuthHeaders();
-    await new AssistantCloudAnonymousAuthStrategy(
-      secondBaseUrl,
-    ).getAuthHeaders();
+    await Promise.all([
+      new AssistantCloudAnonymousAuthStrategy(baseUrl).getAuthHeaders(),
+      new AssistantCloudAnonymousAuthStrategy(secondBaseUrl).getAuthHeaders(),
+    ]);
 
     expect(fetchMock).toHaveBeenNthCalledWith(
       1,
       `${baseUrl}/v1/auth/tokens/anonymous`,
-      { method: "POST" },
+      { method: "POST", signal: expect.any(AbortSignal) },
     );
     expect(fetchMock).toHaveBeenNthCalledWith(
       2,
       `${secondBaseUrl}/v1/auth/tokens/anonymous`,
-      { method: "POST" },
+      { method: "POST", signal: expect.any(AbortSignal) },
     );
     expect(values.get(refreshTokenKey)).toBe(JSON.stringify(refreshToken));
     expect(values.get(`aui:refresh_token:${secondBaseUrl}`)).toBe(
@@ -206,12 +477,13 @@ describe("AssistantCloudAnonymousAuthStrategy", () => {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ refresh_token: refreshToken.token }),
+        signal: expect.any(AbortSignal),
       },
     );
     expect(fetchMock).toHaveBeenNthCalledWith(
       2,
       `${secondBaseUrl}/v1/auth/tokens/anonymous`,
-      { method: "POST" },
+      { method: "POST", signal: expect.any(AbortSignal) },
     );
     expect(values.get(refreshTokenKey)).toBe(JSON.stringify(refreshToken));
     expect(values.get(`aui:refresh_token:${secondBaseUrl}`)).toBe(
@@ -270,12 +542,13 @@ describe("AssistantCloudAnonymousAuthStrategy", () => {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ refresh_token: scopedRefreshToken.token }),
+        signal: expect.any(AbortSignal),
       },
     );
     expect(fetchMock).toHaveBeenNthCalledWith(
       2,
       `${secondBaseUrl}/v1/auth/tokens/anonymous`,
-      { method: "POST" },
+      { method: "POST", signal: expect.any(AbortSignal) },
     );
     expect(values.has("aui:refresh_token")).toBe(false);
     expect(values.get(`aui:refresh_token:${secondBaseUrl}`)).toBe(
@@ -470,6 +743,7 @@ describe("AssistantCloudAnonymousAuthStrategy", () => {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ refresh_token: refreshToken.token }),
+        signal: expect.any(AbortSignal),
       },
     );
     expect(setItem).not.toHaveBeenCalled();
@@ -538,7 +812,7 @@ describe("AssistantCloudAnonymousAuthStrategy", () => {
       expect(fetchMock).toHaveBeenNthCalledWith(
         2,
         `${baseUrl}/v1/auth/tokens/anonymous`,
-        { method: "POST" },
+        { method: "POST", signal: expect.any(AbortSignal) },
       );
       expect(values.get(refreshTokenKey)).toBe(
         JSON.stringify(replacementRefreshToken),

package/src/tests/CloudMessagePersistence.test.ts

@@ -108,6 +108,99 @@ describe("CloudMessagePersistence", () => {
     });
   });
 
+  it("deduplicates concurrent child appends while the parent is pending", async () => {
+    let resolveParent!: (value: { message_id: string }) => void;
+    vi.mocked(cloud.threads.messages.create)
+      .mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveParent = resolve;
+          }),
+      )
+      .mockResolvedValue({ message_id: "remote-child" });
+
+    const parent = persistence.append("thread-1", "parent", null, "aui/v0", {
+      text: "parent",
+    });
+    const firstChild = persistence.append(
+      "thread-1",
+      "child",
+      "parent",
+      "aui/v0",
+      { text: "child" },
+    );
+    const secondChild = persistence.append(
+      "thread-1",
+      "child",
+      "parent",
+      "aui/v0",
+      { text: "child" },
+    );
+
+    expect(persistence.isPersisted("child")).toBe(true);
+    resolveParent({ message_id: "remote-parent" });
+    await Promise.all([parent, firstChild, secondChild]);
+
+    expect(cloud.threads.messages.create).toHaveBeenCalledTimes(2);
+  });
+
+  it("resolves remote IDs throughout a concurrent message chain", async () => {
+    let resolveParent!: (value: { message_id: string }) => void;
+    vi.mocked(cloud.threads.messages.create)
+      .mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveParent = resolve;
+          }),
+      )
+      .mockResolvedValueOnce({ message_id: "remote-child" })
+      .mockResolvedValueOnce({ message_id: "remote-grandchild" });
+
+    const parent = persistence.append("thread-1", "parent", null, "aui/v0", {
+      text: "parent",
+    });
+    const child = persistence.append("thread-1", "child", "parent", "aui/v0", {
+      text: "child",
+    });
+    const grandchild = persistence.append(
+      "thread-1",
+      "grandchild",
+      "child",
+      "aui/v0",
+      { text: "grandchild" },
+    );
+
+    resolveParent({ message_id: "remote-parent" });
+    await Promise.all([parent, child, grandchild]);
+
+    expect(cloud.threads.messages.create).toHaveBeenCalledWith("thread-1", {
+      parent_id: "remote-parent",
+      format: "aui/v0",
+      content: { text: "child" },
+    });
+    expect(cloud.threads.messages.create).toHaveBeenCalledWith("thread-1", {
+      parent_id: "remote-child",
+      format: "aui/v0",
+      content: { text: "grandchild" },
+    });
+  });
+
+  it("re-appends a message after its mapping has settled", async () => {
+    vi.mocked(cloud.threads.messages.create)
+      .mockResolvedValueOnce({ message_id: "remote-1" })
+      .mockResolvedValueOnce({ message_id: "remote-2" });
+
+    await persistence.append("thread-1", "local-1", null, "aui/v0", {
+      text: "first",
+    });
+    await persistence.append("thread-1", "local-1", null, "aui/v0", {
+      text: "second",
+    });
+
+    expect(cloud.threads.messages.create).toHaveBeenCalledTimes(2);
+    expect(await persistence.getRemoteId("local-1")).toBe("remote-2");
+  });
+
   it("loaded messages are marked as persisted and not re-created", async () => {
     vi.mocked(cloud.threads.messages.list).mockResolvedValue({
       messages: [