naystack 1.8.3 → 1.8.4

package/dist/graphql/client.esm.js

@@ -4,7 +4,6 @@
 import {
   ApolloClient,
   ApolloProvider,
-  HttpLink,
   InMemoryCache,
   useLazyQuery,
   useMutation
@@ -16,6 +15,30 @@ import React, {
   useRef as useRef2
 } from "react";
 
+// src/graphql/clear-store.tsx
+import { useApolloClient } from "@apollo/client";
+import { useToken } from "naystack/auth/client";
+import { useEffect, useRef } from "react";
+function ClearStoreOnLogout() {
+  const client = useApolloClient();
+  const token = useToken();
+  const hadToken = useRef(false);
+  useEffect(() => {
+    if (token) {
+      hadToken.current = true;
+    } else if (token === null && hadToken.current) {
+      hadToken.current = false;
+      void client.clearStore();
+    }
+  }, [client, token]);
+  return null;
+}
+
+// src/graphql/links.ts
+import { ApolloLink, fromPromise, HttpLink } from "@apollo/client";
+import { setContext } from "@apollo/client/link/context";
+import { onError } from "@apollo/client/link/error";
+
 // src/env.ts
 var EXTRA_ENV = globalThis.__NAYSTACK_ENV__ || (globalThis.__NAYSTACK_ENV__ = {});
 var getEnvValue = (key) => {
@@ -66,32 +89,83 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
-// src/graphql/clear-store.tsx
-import { useApolloClient } from "@apollo/client";
-import { useToken } from "naystack/auth/client";
-import { useEffect, useRef } from "react";
-function ClearStoreOnLogout() {
-  const client = useApolloClient();
-  const token = useToken();
-  const hadToken = useRef(false);
-  useEffect(() => {
-    if (token) {
-      hadToken.current = true;
-    } else if (token === null && hadToken.current) {
-      hadToken.current = false;
-      void client.clearStore();
-    }
-  }, [client, token]);
-  return null;
+// src/auth/token-store.ts
+var currentToken;
+var listeners = /* @__PURE__ */ new Set();
+var inFlightRefresh = null;
+function getAccessToken() {
+  return currentToken;
+}
+function setAccessToken(token) {
+  if (token === currentToken) return;
+  currentToken = token;
+  listeners.forEach((listener) => listener(token));
+}
+function refreshAccessToken() {
+  if (inFlightRefresh) return inFlightRefresh;
+  inFlightRefresh = (async () => {
+    const res = await fetch(
+      getEnv("NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */),
+      { credentials: "include" }
+    );
+    if (!res.ok) throw new Error(`Token refresh failed: ${res.status}`);
+    const token = await res.text() || null;
+    setAccessToken(token);
+    return token;
+  })().finally(() => {
+    inFlightRefresh = null;
+  });
+  return inFlightRefresh;
+}
+
+// src/graphql/links.ts
+var RETRY_CONTEXT_KEY = "__naystackRetried";
+function isExpiredTokenError(error) {
+  return error.extensions?.code === "UNAUTHENTICATED";
+}
+var authLink = setContext((_, previousContext) => {
+  const token = getAccessToken();
+  if (!token || previousContext.credentials === "include")
+    return previousContext;
+  return {
+    ...previousContext,
+    headers: {
+      ...previousContext.headers,
+      authorization: `Bearer ${token}`
+    },
+    credentials: "omit"
+  };
+});
+var refreshLink = onError(({ graphQLErrors, operation, forward }) => {
+  if (!graphQLErrors?.some(isExpiredTokenError)) return;
+  if (operation.getContext()[RETRY_CONTEXT_KEY]) return;
+  return fromPromise(
+    // A failed refresh still replays once: the retry reproduces the original
+    // error for the caller instead of surfacing the refresh's error in its place.
+    refreshAccessToken().catch(() => null)
+  ).flatMap(() => {
+    operation.setContext((previousContext) => ({
+      ...previousContext,
+      [RETRY_CONTEXT_KEY]: true
+    }));
+    return forward(operation);
+  });
+});
+function makeAuthLink() {
+  return ApolloLink.from([
+    refreshLink,
+    authLink,
+    new HttpLink({
+      uri: getEnv("NEXT_PUBLIC_GRAPHQL_ENDPOINT" /* NEXT_PUBLIC_GRAPHQL_ENDPOINT */)
+    })
+  ]);
 }
 
 // src/graphql/client.tsx
 function makeClient(cacheConfig) {
   return new ApolloClient({
     cache: new InMemoryCache(cacheConfig),
-    link: new HttpLink({
-      uri: getEnv("NEXT_PUBLIC_GRAPHQL_ENDPOINT" /* NEXT_PUBLIC_GRAPHQL_ENDPOINT */)
-    })
+    link: makeAuthLink()
   });
 }
 var ApolloWrapper = ({
@@ -112,7 +186,7 @@ var tokenContext = (token) => {
   };
 };
 function useAuthQuery(query, variables, options) {
-  const [fetch, result] = useLazyQuery(query, {
+  const [fetch2, result] = useLazyQuery(query, {
     fetchPolicy: "no-cache",
     ...options
   });
@@ -121,7 +195,7 @@ function useAuthQuery(query, variables, options) {
     const serialized = JSON.stringify(variables);
     if (variables && prevVarsRef.current !== serialized) {
       prevVarsRef.current = serialized;
-      void fetch({
+      void fetch2({
         // @ts-expect-error -- to allow dynamic props
         variables: { input: variables },
         context: {
@@ -129,16 +203,16 @@ function useAuthQuery(query, variables, options) {
         }
       });
     }
-  }, [fetch, variables]);
+  }, [fetch2, variables]);
   const reFetch = useCallback(
-    (input) => fetch({
+    (input) => fetch2({
       // @ts-expect-error -- to allow dynamic props
       variables: { input },
       context: {
         credentials: `include`
       }
     }),
-    [fetch]
+    [fetch2]
   );
   return [reFetch, result];
 }
@@ -148,10 +222,9 @@ function useAuthMutation(mutation, options) {
   const method = useCallback(
     (input) => mutate({
       // @ts-expect-error -- to allow dynamic props
-      variables: { input },
-      context: tokenContext(token)
+      variables: { input }
     }),
-    [token]
+    [mutate]
   );
   return [method, { ...result, hasAuth: !!token }];
 }

package/dist/graphql/links.cjs.js

@@ -0,0 +1,154 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/graphql/links.ts
+var links_exports = {};
+__export(links_exports, {
+  makeAuthLink: () => makeAuthLink
+});
+module.exports = __toCommonJS(links_exports);
+var import_client = require("@apollo/client");
+var import_context = require("@apollo/client/link/context");
+var import_error = require("@apollo/client/link/error");
+
+// src/env.ts
+var EXTRA_ENV = globalThis.__NAYSTACK_ENV__ || (globalThis.__NAYSTACK_ENV__ = {});
+var getEnvValue = (key) => {
+  switch (key) {
+    case "NEXT_PUBLIC_GRAPHQL_ENDPOINT" /* NEXT_PUBLIC_GRAPHQL_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_GRAPHQL_ENDPOINT || EXTRA_ENV.GRAPHQL_ENDPOINT;
+    case "NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT || EXTRA_ENV.EMAIL_AUTH_ENDPOINT;
+    case "NEXT_PUBLIC_GOOGLE_AUTH_ENDPOINT" /* NEXT_PUBLIC_GOOGLE_AUTH_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_GOOGLE_AUTH_ENDPOINT || EXTRA_ENV.GOOGLE_AUTH_ENDPOINT;
+    case "NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT" /* NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT || EXTRA_ENV.INSTAGRAM_AUTH_ENDPOINT;
+    case "NEXT_PUBLIC_FILE_ENDPOINT" /* NEXT_PUBLIC_FILE_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_FILE_ENDPOINT || EXTRA_ENV.FILE_ENDPOINT;
+    case "NEXT_PUBLIC_BASE_URL" /* NEXT_PUBLIC_BASE_URL */:
+      return process.env.NEXT_PUBLIC_BASE_URL || EXTRA_ENV.BASE_URL;
+    case "REFRESH_KEY" /* REFRESH_KEY */:
+      return process.env.REFRESH_KEY;
+    case "SIGNING_KEY" /* SIGNING_KEY */:
+      return process.env.SIGNING_KEY;
+    case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
+      return process.env.INSTAGRAM_CLIENT_SECRET;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
+    case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
+      return process.env.GOOGLE_CLIENT_SECRET;
+    case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:
+      return process.env.GOOGLE_CLIENT_ID;
+    case "TURNSTILE_KEY" /* TURNSTILE_KEY */:
+      return process.env.TURNSTILE_KEY;
+    case "S3_ACCESS_KEY_ID" /* S3_ACCESS_KEY_ID */:
+      return process.env.S3_ACCESS_KEY_ID;
+    case "S3_ACCESS_KEY_SECRET" /* S3_ACCESS_KEY_SECRET */:
+      return process.env.S3_ACCESS_KEY_SECRET;
+    case "S3_REGION" /* S3_REGION */:
+      return process.env.S3_REGION;
+    case "S3_BUCKET" /* S3_BUCKET */:
+      return process.env.S3_BUCKET;
+    case "NODE_ENV" /* NODE_ENV */:
+      return process.env.NODE_ENV;
+    default:
+      return process.env[key];
+  }
+};
+function getEnv(key, skipCheck) {
+  const value = getEnvValue(key);
+  if (!skipCheck && !value) throw new Error(`${key} is not defined`);
+  return value;
+}
+
+// src/auth/token-store.ts
+var currentToken;
+var listeners = /* @__PURE__ */ new Set();
+var inFlightRefresh = null;
+function getAccessToken() {
+  return currentToken;
+}
+function setAccessToken(token) {
+  if (token === currentToken) return;
+  currentToken = token;
+  listeners.forEach((listener) => listener(token));
+}
+function refreshAccessToken() {
+  if (inFlightRefresh) return inFlightRefresh;
+  inFlightRefresh = (async () => {
+    const res = await fetch(
+      getEnv("NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */),
+      { credentials: "include" }
+    );
+    if (!res.ok) throw new Error(`Token refresh failed: ${res.status}`);
+    const token = await res.text() || null;
+    setAccessToken(token);
+    return token;
+  })().finally(() => {
+    inFlightRefresh = null;
+  });
+  return inFlightRefresh;
+}
+
+// src/graphql/links.ts
+var RETRY_CONTEXT_KEY = "__naystackRetried";
+function isExpiredTokenError(error) {
+  return error.extensions?.code === "UNAUTHENTICATED";
+}
+var authLink = (0, import_context.setContext)((_, previousContext) => {
+  const token = getAccessToken();
+  if (!token || previousContext.credentials === "include")
+    return previousContext;
+  return {
+    ...previousContext,
+    headers: {
+      ...previousContext.headers,
+      authorization: `Bearer ${token}`
+    },
+    credentials: "omit"
+  };
+});
+var refreshLink = (0, import_error.onError)(({ graphQLErrors, operation, forward }) => {
+  if (!graphQLErrors?.some(isExpiredTokenError)) return;
+  if (operation.getContext()[RETRY_CONTEXT_KEY]) return;
+  return (0, import_client.fromPromise)(
+    // A failed refresh still replays once: the retry reproduces the original
+    // error for the caller instead of surfacing the refresh's error in its place.
+    refreshAccessToken().catch(() => null)
+  ).flatMap(() => {
+    operation.setContext((previousContext) => ({
+      ...previousContext,
+      [RETRY_CONTEXT_KEY]: true
+    }));
+    return forward(operation);
+  });
+});
+function makeAuthLink() {
+  return import_client.ApolloLink.from([
+    refreshLink,
+    authLink,
+    new import_client.HttpLink({
+      uri: getEnv("NEXT_PUBLIC_GRAPHQL_ENDPOINT" /* NEXT_PUBLIC_GRAPHQL_ENDPOINT */)
+    })
+  ]);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  makeAuthLink
+});

package/dist/graphql/links.d.mts

@@ -0,0 +1,14 @@
+import { ApolloLink } from '@apollo/client';
+
+/**
+ * Builds the client link chain: refresh-and-retry → auth header → HTTP.
+ *
+ * `refreshLink` sits outermost so its replayed operation passes back through
+ * `authLink` and picks up the refreshed token.
+ *
+ * @returns An `ApolloLink` for the `link` option of `ApolloClient`.
+ * @category GraphQL
+ */
+declare function makeAuthLink(): ApolloLink;
+
+export { makeAuthLink };

package/dist/graphql/links.d.ts

@@ -0,0 +1,14 @@
+import { ApolloLink } from '@apollo/client';
+
+/**
+ * Builds the client link chain: refresh-and-retry → auth header → HTTP.
+ *
+ * `refreshLink` sits outermost so its replayed operation passes back through
+ * `authLink` and picks up the refreshed token.
+ *
+ * @returns An `ApolloLink` for the `link` option of `ApolloClient`.
+ * @category GraphQL
+ */
+declare function makeAuthLink(): ApolloLink;
+
+export { makeAuthLink };

package/dist/graphql/links.esm.js

@@ -0,0 +1,129 @@
+// src/graphql/links.ts
+import { ApolloLink, fromPromise, HttpLink } from "@apollo/client";
+import { setContext } from "@apollo/client/link/context";
+import { onError } from "@apollo/client/link/error";
+
+// src/env.ts
+var EXTRA_ENV = globalThis.__NAYSTACK_ENV__ || (globalThis.__NAYSTACK_ENV__ = {});
+var getEnvValue = (key) => {
+  switch (key) {
+    case "NEXT_PUBLIC_GRAPHQL_ENDPOINT" /* NEXT_PUBLIC_GRAPHQL_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_GRAPHQL_ENDPOINT || EXTRA_ENV.GRAPHQL_ENDPOINT;
+    case "NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT || EXTRA_ENV.EMAIL_AUTH_ENDPOINT;
+    case "NEXT_PUBLIC_GOOGLE_AUTH_ENDPOINT" /* NEXT_PUBLIC_GOOGLE_AUTH_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_GOOGLE_AUTH_ENDPOINT || EXTRA_ENV.GOOGLE_AUTH_ENDPOINT;
+    case "NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT" /* NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_INSTAGRAM_AUTH_ENDPOINT || EXTRA_ENV.INSTAGRAM_AUTH_ENDPOINT;
+    case "NEXT_PUBLIC_FILE_ENDPOINT" /* NEXT_PUBLIC_FILE_ENDPOINT */:
+      return process.env.NEXT_PUBLIC_FILE_ENDPOINT || EXTRA_ENV.FILE_ENDPOINT;
+    case "NEXT_PUBLIC_BASE_URL" /* NEXT_PUBLIC_BASE_URL */:
+      return process.env.NEXT_PUBLIC_BASE_URL || EXTRA_ENV.BASE_URL;
+    case "REFRESH_KEY" /* REFRESH_KEY */:
+      return process.env.REFRESH_KEY;
+    case "SIGNING_KEY" /* SIGNING_KEY */:
+      return process.env.SIGNING_KEY;
+    case "INSTAGRAM_CLIENT_SECRET" /* INSTAGRAM_CLIENT_SECRET */:
+      return process.env.INSTAGRAM_CLIENT_SECRET;
+    case "INSTAGRAM_CLIENT_ID" /* INSTAGRAM_CLIENT_ID */:
+      return process.env.INSTAGRAM_CLIENT_ID;
+    case "GOOGLE_CLIENT_SECRET" /* GOOGLE_CLIENT_SECRET */:
+      return process.env.GOOGLE_CLIENT_SECRET;
+    case "GOOGLE_CLIENT_ID" /* GOOGLE_CLIENT_ID */:
+      return process.env.GOOGLE_CLIENT_ID;
+    case "TURNSTILE_KEY" /* TURNSTILE_KEY */:
+      return process.env.TURNSTILE_KEY;
+    case "S3_ACCESS_KEY_ID" /* S3_ACCESS_KEY_ID */:
+      return process.env.S3_ACCESS_KEY_ID;
+    case "S3_ACCESS_KEY_SECRET" /* S3_ACCESS_KEY_SECRET */:
+      return process.env.S3_ACCESS_KEY_SECRET;
+    case "S3_REGION" /* S3_REGION */:
+      return process.env.S3_REGION;
+    case "S3_BUCKET" /* S3_BUCKET */:
+      return process.env.S3_BUCKET;
+    case "NODE_ENV" /* NODE_ENV */:
+      return process.env.NODE_ENV;
+    default:
+      return process.env[key];
+  }
+};
+function getEnv(key, skipCheck) {
+  const value = getEnvValue(key);
+  if (!skipCheck && !value) throw new Error(`${key} is not defined`);
+  return value;
+}
+
+// src/auth/token-store.ts
+var currentToken;
+var listeners = /* @__PURE__ */ new Set();
+var inFlightRefresh = null;
+function getAccessToken() {
+  return currentToken;
+}
+function setAccessToken(token) {
+  if (token === currentToken) return;
+  currentToken = token;
+  listeners.forEach((listener) => listener(token));
+}
+function refreshAccessToken() {
+  if (inFlightRefresh) return inFlightRefresh;
+  inFlightRefresh = (async () => {
+    const res = await fetch(
+      getEnv("NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */),
+      { credentials: "include" }
+    );
+    if (!res.ok) throw new Error(`Token refresh failed: ${res.status}`);
+    const token = await res.text() || null;
+    setAccessToken(token);
+    return token;
+  })().finally(() => {
+    inFlightRefresh = null;
+  });
+  return inFlightRefresh;
+}
+
+// src/graphql/links.ts
+var RETRY_CONTEXT_KEY = "__naystackRetried";
+function isExpiredTokenError(error) {
+  return error.extensions?.code === "UNAUTHENTICATED";
+}
+var authLink = setContext((_, previousContext) => {
+  const token = getAccessToken();
+  if (!token || previousContext.credentials === "include")
+    return previousContext;
+  return {
+    ...previousContext,
+    headers: {
+      ...previousContext.headers,
+      authorization: `Bearer ${token}`
+    },
+    credentials: "omit"
+  };
+});
+var refreshLink = onError(({ graphQLErrors, operation, forward }) => {
+  if (!graphQLErrors?.some(isExpiredTokenError)) return;
+  if (operation.getContext()[RETRY_CONTEXT_KEY]) return;
+  return fromPromise(
+    // A failed refresh still replays once: the retry reproduces the original
+    // error for the caller instead of surfacing the refresh's error in its place.
+    refreshAccessToken().catch(() => null)
+  ).flatMap(() => {
+    operation.setContext((previousContext) => ({
+      ...previousContext,
+      [RETRY_CONTEXT_KEY]: true
+    }));
+    return forward(operation);
+  });
+});
+function makeAuthLink() {
+  return ApolloLink.from([
+    refreshLink,
+    authLink,
+    new HttpLink({
+      uri: getEnv("NEXT_PUBLIC_GRAPHQL_ENDPOINT" /* NEXT_PUBLIC_GRAPHQL_ENDPOINT */)
+    })
+  ]);
+}
+export {
+  makeAuthLink
+};

package/dist/graphql/next.cjs.js

@@ -34,10 +34,33 @@ __export(next_exports, {
   ApolloWrapper: () => ApolloWrapper
 });
 module.exports = __toCommonJS(next_exports);
-var import_client3 = require("@apollo/client");
 var import_client_integration_nextjs = require("@apollo/client-integration-nextjs");
 var import_react2 = __toESM(require("react"));
 
+// src/graphql/clear-store.tsx
+var import_client = require("@apollo/client");
+var import_client2 = require("naystack/auth/client");
+var import_react = require("react");
+function ClearStoreOnLogout() {
+  const client = (0, import_client.useApolloClient)();
+  const token = (0, import_client2.useToken)();
+  const hadToken = (0, import_react.useRef)(false);
+  (0, import_react.useEffect)(() => {
+    if (token) {
+      hadToken.current = true;
+    } else if (token === null && hadToken.current) {
+      hadToken.current = false;
+      void client.clearStore();
+    }
+  }, [client, token]);
+  return null;
+}
+
+// src/graphql/links.ts
+var import_client3 = require("@apollo/client");
+var import_context = require("@apollo/client/link/context");
+var import_error = require("@apollo/client/link/error");
+
 // src/env.ts
 var EXTRA_ENV = globalThis.__NAYSTACK_ENV__ || (globalThis.__NAYSTACK_ENV__ = {});
 var getEnvValue = (key) => {
@@ -88,32 +111,83 @@ function getEnv(key, skipCheck) {
   return value;
 }
 
-// src/graphql/clear-store.tsx
-var import_client = require("@apollo/client");
-var import_client2 = require("naystack/auth/client");
-var import_react = require("react");
-function ClearStoreOnLogout() {
-  const client = (0, import_client.useApolloClient)();
-  const token = (0, import_client2.useToken)();
-  const hadToken = (0, import_react.useRef)(false);
-  (0, import_react.useEffect)(() => {
-    if (token) {
-      hadToken.current = true;
-    } else if (token === null && hadToken.current) {
-      hadToken.current = false;
-      void client.clearStore();
-    }
-  }, [client, token]);
-  return null;
+// src/auth/token-store.ts
+var currentToken;
+var listeners = /* @__PURE__ */ new Set();
+var inFlightRefresh = null;
+function getAccessToken() {
+  return currentToken;
+}
+function setAccessToken(token) {
+  if (token === currentToken) return;
+  currentToken = token;
+  listeners.forEach((listener) => listener(token));
+}
+function refreshAccessToken() {
+  if (inFlightRefresh) return inFlightRefresh;
+  inFlightRefresh = (async () => {
+    const res = await fetch(
+      getEnv("NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT" /* NEXT_PUBLIC_EMAIL_AUTH_ENDPOINT */),
+      { credentials: "include" }
+    );
+    if (!res.ok) throw new Error(`Token refresh failed: ${res.status}`);
+    const token = await res.text() || null;
+    setAccessToken(token);
+    return token;
+  })().finally(() => {
+    inFlightRefresh = null;
+  });
+  return inFlightRefresh;
+}
+
+// src/graphql/links.ts
+var RETRY_CONTEXT_KEY = "__naystackRetried";
+function isExpiredTokenError(error) {
+  return error.extensions?.code === "UNAUTHENTICATED";
+}
+var authLink = (0, import_context.setContext)((_, previousContext) => {
+  const token = getAccessToken();
+  if (!token || previousContext.credentials === "include")
+    return previousContext;
+  return {
+    ...previousContext,
+    headers: {
+      ...previousContext.headers,
+      authorization: `Bearer ${token}`
+    },
+    credentials: "omit"
+  };
+});
+var refreshLink = (0, import_error.onError)(({ graphQLErrors, operation, forward }) => {
+  if (!graphQLErrors?.some(isExpiredTokenError)) return;
+  if (operation.getContext()[RETRY_CONTEXT_KEY]) return;
+  return (0, import_client3.fromPromise)(
+    // A failed refresh still replays once: the retry reproduces the original
+    // error for the caller instead of surfacing the refresh's error in its place.
+    refreshAccessToken().catch(() => null)
+  ).flatMap(() => {
+    operation.setContext((previousContext) => ({
+      ...previousContext,
+      [RETRY_CONTEXT_KEY]: true
+    }));
+    return forward(operation);
+  });
+});
+function makeAuthLink() {
+  return import_client3.ApolloLink.from([
+    refreshLink,
+    authLink,
+    new import_client3.HttpLink({
+      uri: getEnv("NEXT_PUBLIC_GRAPHQL_ENDPOINT" /* NEXT_PUBLIC_GRAPHQL_ENDPOINT */)
+    })
+  ]);
 }
 
 // src/graphql/next.tsx
 function makeClient(cacheConfig) {
   return new import_client_integration_nextjs.ApolloClient({
     cache: new import_client_integration_nextjs.InMemoryCache(cacheConfig),
-    link: new import_client3.HttpLink({
-      uri: getEnv("NEXT_PUBLIC_GRAPHQL_ENDPOINT" /* NEXT_PUBLIC_GRAPHQL_ENDPOINT */)
-    })
+    link: makeAuthLink()
   });
 }
 var ApolloWrapper = ({