rivetkit 2.3.20 → 2.3.21

package/dist/tsup/{chunk-A36FMKOV.cjs → chunk-B5SNXPSS.cjs}

@@ -5,7 +5,7 @@ var _chunkMYWZCDMLcjs = require('./chunk-MYWZCDML.cjs');
 
 
 
-var _chunk3WS7Z64Ucjs = require('./chunk-3WS7Z64U.cjs');
+var _chunkLWSLKKZ5cjs = require('./chunk-LWSLKKZ5.cjs');
 
 
 var _chunkKVFIONKQcjs = require('./chunk-KVFIONKQ.cjs');
@@ -35,7 +35,7 @@ var _chunkKVFIONKQcjs = require('./chunk-KVFIONKQ.cjs');
 
 
 
-var _chunk2CE5UNWKcjs = require('./chunk-2CE5UNWK.cjs');
+var _chunkKWGN2ZBJcjs = require('./chunk-KWGN2ZBJ.cjs');
 
 
 
@@ -2131,7 +2131,7 @@ async function checkForSchedulingError(group, code, actorId, query, driver, rayI
   try {
     const actor = await driver.getForId({ name, actorId });
     if (actor == null ? void 0 : actor.error) {
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).info({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).info({
         msg: "found actor scheduling error",
         actorId,
         error: actor.error
@@ -2145,10 +2145,10 @@ async function checkForSchedulingError(group, code, actorId, query, driver, rayI
       );
     }
   } catch (err) {
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
       msg: "failed to fetch actor details for scheduling error check",
       actorId,
-      error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+      error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
     });
   }
   return null;
@@ -2456,7 +2456,7 @@ function parseWebSocketCloseReason(reason) {
   const [mainPart, rayId] = reason.split("#");
   const [group, code] = mainPart.split(".");
   if (!group || !code) {
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({ msg: "failed to parse close reason", reason });
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({ msg: "failed to parse close reason", reason });
     return void 0;
   }
   return {
@@ -2478,11 +2478,11 @@ function messageLength(message) {
   if (typeof message === "string") {
     return message.length;
   }
-  _chunk2CE5UNWKcjs.assertUnreachable.call(void 0, message);
+  _chunkKWGN2ZBJcjs.assertUnreachable.call(void 0, message);
 }
 async function sendHttpRequest(opts) {
   var _a, _b, _c;
-  _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+  _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
     msg: "sending http request",
     url: opts.url,
     encoding: opts.encoding
@@ -2491,8 +2491,8 @@ async function sendHttpRequest(opts) {
   let bodyData;
   if (opts.method === "POST" || opts.method === "PUT") {
     _invariant2.default.call(void 0, opts.body !== void 0, "missing body");
-    contentType = _chunk2CE5UNWKcjs.contentTypeForEncoding.call(void 0, opts.encoding);
-    bodyData = _chunk2CE5UNWKcjs.serializeWithEncoding.call(void 0, 
+    contentType = _chunkKWGN2ZBJcjs.contentTypeForEncoding.call(void 0, opts.encoding);
+    bodyData = _chunkKWGN2ZBJcjs.serializeWithEncoding.call(void 0, 
       opts.encoding,
       opts.body,
       opts.requestVersionedDataHandler,
@@ -2512,7 +2512,7 @@ async function sendHttpRequest(opts) {
           ...contentType ? {
             "Content-Type": contentType
           } : {},
-          "User-Agent": _chunk2CE5UNWKcjs.httpUserAgent.call(void 0, )
+          "User-Agent": _chunkKWGN2ZBJcjs.httpUserAgent.call(void 0, )
         },
         body: bodyData,
         credentials: "include",
@@ -2530,7 +2530,7 @@ async function sendHttpRequest(opts) {
     const rayId = response.headers.get("x-rivet-ray-id");
     const encoding = (contentType2 == null ? void 0 : contentType2.includes("application/json")) ? "json" : opts.encoding;
     try {
-      const responseData = _chunk2CE5UNWKcjs.deserializeWithEncoding.call(void 0, 
+      const responseData = _chunkKWGN2ZBJcjs.deserializeWithEncoding.call(void 0, 
         encoding,
         new Uint8Array(bufferResponse),
         HTTP_RESPONSE_ERROR_VERSIONED,
@@ -2548,7 +2548,7 @@ async function sendHttpRequest(opts) {
           group: bare5.group,
           code: bare5.code,
           message: bare5.message,
-          metadata: bare5.metadata ? _chunk2CE5UNWKcjs.decodeCborCompat.call(void 0, new Uint8Array(bare5.metadata)) : void 0,
+          metadata: bare5.metadata ? _chunkKWGN2ZBJcjs.decodeCborCompat.call(void 0, new Uint8Array(bare5.metadata)) : void 0,
           actor: bare5.actor ? {
             actorId: bare5.actor.actorId,
             generation: Number(bare5.actor.generation),
@@ -2556,7 +2556,7 @@ async function sendHttpRequest(opts) {
           } : void 0
         })
       );
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
         msg: "http error response",
         group: responseData.group,
         code: responseData.code,
@@ -2574,7 +2574,8 @@ async function sendHttpRequest(opts) {
         {
           metadata: responseData.metadata,
           rayId: _nullishCoalesce(rayId, () => ( void 0)),
-          actor: responseData.actor
+          actor: responseData.actor,
+          statusCode: response.status
         }
       );
     } catch (error) {
@@ -2602,7 +2603,7 @@ ${textResponse}`
   }
   try {
     const buffer = new Uint8Array(await response.arrayBuffer());
-    return _chunk2CE5UNWKcjs.deserializeWithEncoding.call(void 0, 
+    return _chunkKWGN2ZBJcjs.deserializeWithEncoding.call(void 0, 
       opts.encoding,
       buffer,
       opts.responseVersionedDataHandler,
@@ -2650,8 +2651,8 @@ function createQueueSender(senderOptions) {
       }),
       requestToBare: (value) => ({
         name: _nullishCoalesce(value.name, () => ( name)),
-        body: _chunk2CE5UNWKcjs.bufferToArrayBuffer.call(void 0, 
-          _chunk2CE5UNWKcjs.encodeCborCompat.call(void 0, value.body)
+        body: _chunkKWGN2ZBJcjs.bufferToArrayBuffer.call(void 0, 
+          _chunkKWGN2ZBJcjs.encodeCborCompat.call(void 0, value.body)
         ),
         wait: _nullishCoalesce(value.wait, () => ( false)),
         timeout: value.timeout !== void 0 ? BigInt(value.timeout) : null
@@ -2671,7 +2672,7 @@ function createQueueSender(senderOptions) {
         }
         return {
           status: bare5.status,
-          response: _chunk2CE5UNWKcjs.decodeCborCompat.call(void 0, new Uint8Array(bare5.response))
+          response: _chunkKWGN2ZBJcjs.decodeCborCompat.call(void 0, new Uint8Array(bare5.response))
         };
       }
     });
@@ -2737,7 +2738,7 @@ async function rawHttpFetch(driver, target, params, input, init, options = {}, t
     throw new TypeError("Invalid input type for fetch");
   }
   try {
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug(
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug(
       "directId" in target ? {
         msg: "sending raw http request to actor",
         actorId: target.directId
@@ -2763,7 +2764,7 @@ async function rawHttpFetch(driver, target, params, input, init, options = {}, t
     });
     return driver.sendRequest(target, proxyRequest, options);
   } catch (err) {
-    const { group, code, message, metadata, rayId, actor } = _chunk2CE5UNWKcjs.deconstructError.call(void 0, err, true);
+    const { group, code, message, metadata, rayId, actor } = _chunkKWGN2ZBJcjs.deconstructError.call(void 0, err, true);
     throw new (0, _chunkJX2ITWAVcjs.RivetError)(group, code, message, { metadata, rayId, actor });
   }
 }
@@ -2784,7 +2785,7 @@ async function rawWebSocket(driver, target, params, path, _protocols, options =
     }
   }
   const fullPath = `${PATH_WEBSOCKET_PREFIX}${pathPortion}${queryPortion}`;
-  _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+  _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
     msg: "opening websocket",
     target,
     encoding,
@@ -2921,7 +2922,7 @@ var ActorHandleRaw = class {
             }
           }).send(name, body, options);
         } catch (err) {
-          const { group, code, message, metadata, rayId, actor } = _chunk2CE5UNWKcjs.deconstructError.call(void 0, err, true);
+          const { group, code, message, metadata, rayId, actor } = _chunkKWGN2ZBJcjs.deconstructError.call(void 0, err, true);
           if (this.#shouldRetryQueueDispatchOverload(
             group,
             code,
@@ -3036,13 +3037,13 @@ var ActorHandleRaw = class {
           gatewayOptions
         );
         actorId = "directId" in target ? target.directId : void 0;
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug(
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug(
           actorId ? { msg: "using direct actor gateway target", actorId } : {
             msg: "using query gateway target for action",
             query: this.#actorResolutionState
           }
         );
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
           msg: "handling action",
           name: opts.name,
           encoding: this.#encoding
@@ -3079,19 +3080,19 @@ var ActorHandleRaw = class {
             args
           }),
           requestToBare: (args) => ({
-            args: _chunk2CE5UNWKcjs.bufferToArrayBuffer.call(void 0, 
-              _chunk2CE5UNWKcjs.encodeCborCompat.call(void 0, args)
+            args: _chunkKWGN2ZBJcjs.bufferToArrayBuffer.call(void 0, 
+              _chunkKWGN2ZBJcjs.encodeCborCompat.call(void 0, args)
             )
           }),
           responseFromJson: (json) => json.output,
-          responseFromBare: (bare5) => _chunk2CE5UNWKcjs.decodeCborCompat.call(void 0, new Uint8Array(bare5.output))
+          responseFromBare: (bare5) => _chunkKWGN2ZBJcjs.decodeCborCompat.call(void 0, new Uint8Array(bare5.output))
         });
         if (opts.name === "destroy" && actorId) {
           await this.#waitForDestroyActionToSettle(actorId);
         }
         return output;
       } catch (err) {
-        const { group, code, message, metadata, rayId, actor } = _chunk2CE5UNWKcjs.deconstructError.call(void 0, err, true);
+        const { group, code, message, metadata, rayId, actor } = _chunkKWGN2ZBJcjs.deconstructError.call(void 0, err, true);
         if (await this.#shouldRetrySchedulingError(
           group,
           code,
@@ -3247,7 +3248,7 @@ var ActorHandleRaw = class {
    * @returns {ActorConn<AD>} A connection to the actor.
    */
   connect(params, options = {}) {
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "establishing connection from handle",
       query: this.#actorResolutionState
     });
@@ -3324,7 +3325,7 @@ var ActorHandleRaw = class {
         }
         return response;
       } catch (err) {
-        const { group, code, message, metadata, rayId, actor } = _chunk2CE5UNWKcjs.deconstructError.call(void 0, err, true);
+        const { group, code, message, metadata, rayId, actor } = _chunkKWGN2ZBJcjs.deconstructError.call(void 0, err, true);
         if (await this.#shouldRetrySchedulingError(
           group,
           code,
@@ -3420,7 +3421,7 @@ var ActorHandleRaw = class {
     const contentType = response.headers.get("content-type");
     const encoding = (contentType == null ? void 0 : contentType.includes("application/json")) ? "json" : this.#encoding;
     try {
-      const error = _chunk2CE5UNWKcjs.deserializeWithEncoding.call(void 0, 
+      const error = _chunkKWGN2ZBJcjs.deserializeWithEncoding.call(void 0, 
         encoding,
         new Uint8Array(await response.clone().arrayBuffer()),
         HTTP_RESPONSE_ERROR_VERSIONED,
@@ -3436,7 +3437,7 @@ var ActorHandleRaw = class {
           group: bare5.group,
           code: bare5.code,
           message: bare5.message,
-          metadata: bare5.metadata ? _chunk2CE5UNWKcjs.decodeCborCompat.call(void 0, new Uint8Array(bare5.metadata)) : void 0,
+          metadata: bare5.metadata ? _chunkKWGN2ZBJcjs.decodeCborCompat.call(void 0, new Uint8Array(bare5.metadata)) : void 0,
           actor: bare5.actor ? {
             actorId: bare5.actor.actorId,
             generation: Number(bare5.actor.generation),
@@ -3490,6 +3491,22 @@ var ActorHandleRaw = class {
       "dynamic actor resolution did not produce a direct actor id"
     );
   }
+  /** Issue a token scoped to this actor. Defaults to actor gateway read access. */
+  async issueToken(options = {}) {
+    const actorId = await this.resolve();
+    const permissions = _nullishCoalesce(options.permissions, () => ( {
+      actor_gateway: ["read"]
+    }));
+    const grants = Object.keys(permissions).flatMap((resource) => {
+      const operations = permissions[resource];
+      return operations ? [{ resource, target: { id: actorId }, operations }] : [];
+    });
+    return this.#driver.issueToken({
+      subject: options.subject,
+      expiresIn: options.expiresIn,
+      grants
+    });
+  }
   /**
    * Returns the raw URL for routing traffic to the actor.
    */
@@ -3524,6 +3541,8 @@ var ACTOR_CONNS_SYMBOL = /* @__PURE__ */ Symbol("actorConns");
 var CREATE_ACTOR_CONN_PROXY = /* @__PURE__ */ Symbol("createActorConnProxy");
 var ClientRaw = (_class = class {
   #disposed = false;
+  /** Issue namespace-scoped tokens with an explicit grant list. */
+  
   __init() {this[ACTOR_CONNS_SYMBOL] = /* @__PURE__ */ new Set()}
   #driver;
   #encodingKind;
@@ -3535,6 +3554,9 @@ var ClientRaw = (_class = class {
    */
   constructor(driver, options = {}) {;_class.prototype.__init.call(this);
     this.#driver = driver;
+    this.auth = {
+      issueToken: (issueOptions) => this.#driver.issueToken(issueOptions)
+    };
     this.#encodingKind = _nullishCoalesce(options.encoding, () => ( "bare"));
     this.#gatewayOptions = _nullishCoalesce(options.gateway, () => ( {}));
     this.#currentActorInvocation = options.currentActorInvocation;
@@ -3550,7 +3572,7 @@ var ClientRaw = (_class = class {
    * @returns {ActorHandle<AD>} - A handle to the actor.
    */
   getForId(name, actorId, opts) {
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "get handle to actor with id",
       name,
       actorId,
@@ -3581,7 +3603,7 @@ var ClientRaw = (_class = class {
    */
   get(name, key, opts) {
     const keyArray = typeof key === "string" ? [key] : key || [];
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "get handle to actor",
       name,
       key: keyArray,
@@ -3612,7 +3634,7 @@ var ClientRaw = (_class = class {
    */
   getOrCreate(name, key, opts) {
     const keyArray = typeof key === "string" ? [key] : key || [];
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "get or create handle to actor",
       name,
       key: keyArray,
@@ -3656,7 +3678,7 @@ var ClientRaw = (_class = class {
         key: keyArray
       }
     };
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "create actor handle",
       name,
       key: keyArray,
@@ -3664,7 +3686,7 @@ var ClientRaw = (_class = class {
       create: createQuery.create
     });
     const actorId = await resolveGatewayTarget(this.#driver, createQuery);
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "created actor with ID",
       name,
       key: keyArray,
@@ -3711,11 +3733,11 @@ var ClientRaw = (_class = class {
    */
   async dispose() {
     if (this.#disposed) {
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({ msg: "client already disconnected" });
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({ msg: "client already disconnected" });
       return;
     }
     this.#disposed = true;
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({ msg: "disposing client" });
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({ msg: "disposing client" });
     const disposePromises = [];
     for (const conn of this[ACTOR_CONNS_SYMBOL].values()) {
       disposePromises.push(conn.dispose());
@@ -3827,6 +3849,74 @@ function createActorProxy(handle) {
   });
 }
 
+// src/client/token-provider.ts
+function isInvalidToken(group, code) {
+  return group === "auth" && (code === "invalid_token" || code === "token_expired");
+}
+function isInvalidTokenResponse(response) {
+  if (response.status !== 401) return false;
+  const error = response.headers.get("x-rivet-error");
+  if (!error) return false;
+  const separator = error.indexOf(".");
+  return separator > 0 && isInvalidToken(error.slice(0, separator), error.slice(separator + 1));
+}
+var TokenProvider = class {
+  constructor(getToken) {
+    this.getToken = getToken;
+  }
+  #cached;
+  #pending;
+  #pendingForce = false;
+  async current() {
+    if (this.#cached && (this.#cached.expiresAt === void 0 || Date.now() < this.#cached.expiresAt - 5e3)) {
+      return this.#cached.token;
+    }
+    return this.#load(false);
+  }
+  /** A late rejection for an older token must never erase a newer credential. */
+  async refreshIfCurrent(failedToken) {
+    var _a;
+    if (this.#pending !== void 0) {
+      const wasForced = this.#pendingForce;
+      const refreshed = await this.#pending;
+      if (wasForced || refreshed !== failedToken) return refreshed;
+    }
+    if (((_a = this.#cached) == null ? void 0 : _a.token) !== failedToken) {
+      return this.current();
+    }
+    return this.#load(true);
+  }
+  #load(forceRefresh) {
+    if (this.#pending !== void 0) return this.#pending;
+    const pending = Promise.resolve().then(() => this.getToken({ forceRefresh })).then((token) => {
+      if (typeof token !== "string" || token.length === 0) {
+        throw new Error(
+          "getToken must resolve to a nonempty string"
+        );
+      }
+      this.#cached = { token, expiresAt: jwtExpiration(token) };
+      return token;
+    }).finally(() => {
+      if (this.#pending === pending) this.#pending = void 0;
+    });
+    this.#pending = pending;
+    this.#pendingForce = forceRefresh;
+    return pending;
+  }
+};
+function jwtExpiration(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return void 0;
+    const claims = JSON.parse(
+      atob(payload.replace(/-/g, "+").replace(/_/g, "/"))
+    );
+    return typeof claims.exp === "number" && Number.isSafeInteger(claims.exp) ? claims.exp * 1e3 : void 0;
+  } catch (e3) {
+    return void 0;
+  }
+}
+
 // src/client/actor-conn.ts
 var CONNECT_SYMBOL = /* @__PURE__ */ Symbol("connect");
 var ActorConnRaw = class {
@@ -3856,6 +3946,7 @@ var ActorConnRaw = class {
   /** Promise used to indicate the socket has connected successfully. This will be rejected if the connection fails. */
   #onOpenPromise;
   #websocket;
+  #authRetryAvailable = true;
   #client;
   #driver;
   #currentActorInvocation;
@@ -3884,8 +3975,8 @@ var ActorConnRaw = class {
     if ("getForId" in actorResolutionState) {
       this.#actorId = actorResolutionState.getForId.actorId;
     }
-    this.#readyPromise = _chunk2CE5UNWKcjs.promiseWithResolvers.call(void 0, 
-      (reason) => _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+    this.#readyPromise = _chunkKWGN2ZBJcjs.promiseWithResolvers.call(void 0, 
+      (reason) => _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
         msg: "unhandled ready promise rejection",
         reason
       })
@@ -3952,11 +4043,11 @@ var ActorConnRaw = class {
         `Invalid action call: expected an options object { name, args }, got ${typeof opts}. Use conn.actionName(...args) for the shorthand API.`
       );
     }
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({ msg: "action", name: opts.name, args: opts.args });
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({ msg: "action", name: opts.name, args: opts.args });
     const actionId = this.#actionIdCounter;
     this.#actionIdCounter += 1;
-    const { promise, resolve, reject } = _chunk2CE5UNWKcjs.promiseWithResolvers.call(void 0, 
-      (reason) => _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+    const { promise, resolve, reject } = _chunkKWGN2ZBJcjs.promiseWithResolvers.call(void 0, 
+      (reason) => _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
         msg: "unhandled action promise rejection",
         reason
       })
@@ -3966,7 +4057,7 @@ var ActorConnRaw = class {
       resolve,
       reject
     });
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "added action to in-flight map",
       actionId,
       actionName: opts.name,
@@ -4006,9 +4097,9 @@ var ActorConnRaw = class {
       try {
         handler(status);
       } catch (err) {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
           msg: "error in status change handler",
-          error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+          error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
         });
       }
     }
@@ -4018,9 +4109,9 @@ var ActorConnRaw = class {
         try {
           handler();
         } catch (err) {
-          _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+          _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
             msg: "error in open handler",
-            error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+            error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
           });
         }
       }
@@ -4030,9 +4121,9 @@ var ActorConnRaw = class {
         try {
           handler();
         } catch (err) {
-          _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+          _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
             msg: "error in close handler",
-            error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+            error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
           });
         }
       }
@@ -4045,21 +4136,21 @@ var ActorConnRaw = class {
       minTimeout: 250,
       maxTimeout: 3e4,
       onFailedAttempt: (error) => {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
           msg: "failed to reconnect",
           attempt: error.attemptNumber,
-          error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, error)
+          error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, error)
         });
       },
       // Cancel retry if aborted
       signal: this.#abortController.signal
     }).catch((err) => {
       if (err instanceof _pretry.AbortError || err.name === "AbortError" || !this.#shouldRetryConnectionOpenError(err)) {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).info({ msg: "connection retry aborted" });
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).info({ msg: "connection retry aborted" });
       } else {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
           msg: "unexpected error in connection retry",
-          error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+          error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
         });
       }
     });
@@ -4068,8 +4159,8 @@ var ActorConnRaw = class {
     try {
       if (this.#onOpenPromise)
         throw new Error("#onOpenPromise already defined");
-      this.#onOpenPromise = _chunk2CE5UNWKcjs.promiseWithResolvers.call(void 0, 
-        (reason) => _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+      this.#onOpenPromise = _chunkKWGN2ZBJcjs.promiseWithResolvers.call(void 0, 
+        (reason) => _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
           msg: "unhandled open promise rejection",
           reason
         })
@@ -4083,15 +4174,15 @@ var ActorConnRaw = class {
       const actorError = error instanceof _chunkJX2ITWAVcjs.RivetError ? error : new (0, _chunkJX2ITWAVcjs.RivetError)(
         "client",
         "connection_open_failed",
-        `Failed to open connection: ${_chunk2CE5UNWKcjs.stringifyError.call(void 0, error)}`,
-        { error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, error) }
+        `Failed to open connection: ${_chunkKWGN2ZBJcjs.stringifyError.call(void 0, error)}`,
+        { error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, error) }
       );
       this.#clearQueuedMessages();
       this.#rejectPendingPromises(actorError, false);
       this.#dispatchActorError(actorError);
       this.#setConnStatus("idle");
       throw new (0, _pretry.AbortError)(
-        error instanceof Error ? error : new Error(_chunk2CE5UNWKcjs.stringifyError.call(void 0, error))
+        error instanceof Error ? error : new Error(_chunkKWGN2ZBJcjs.stringifyError.call(void 0, error))
       );
     } finally {
       this.#onOpenPromise = void 0;
@@ -4101,6 +4192,10 @@ var ActorConnRaw = class {
     if (error instanceof ActorConnDisposed) {
       return false;
     }
+    if (error instanceof _chunkJX2ITWAVcjs.RivetError && isInvalidToken(error.group, error.code) && this.#driver.refreshAuthToken && this.#authRetryAvailable) {
+      this.#authRetryAvailable = false;
+      return true;
+    }
     if (error instanceof _chunkJX2ITWAVcjs.RivetError && this.#shouldReconnectForStaleActor(error.group, error.code)) {
       return true;
     }
@@ -4111,7 +4206,7 @@ var ActorConnRaw = class {
   }
   #clearQueuedMessages() {
     if (this.#messageQueue.length === 0) return;
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "clearing queued connection messages",
       queueLength: this.#messageQueue.length
     });
@@ -4124,7 +4219,7 @@ var ActorConnRaw = class {
     try {
       return await this.#getParams();
     } catch (err) {
-      const errorMessage = _chunk2CE5UNWKcjs.stringifyError.call(void 0, err);
+      const errorMessage = _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err);
       const error = new (0, _chunkJX2ITWAVcjs.RivetError)(
         "client",
         "get_params_failed",
@@ -4148,7 +4243,7 @@ var ActorConnRaw = class {
       this.#gatewayOptions
     );
     _invariant2.default.call(void 0, ws, "websocket should have been created");
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "opened websocket",
       connId: this.#connId,
       readyState: ws.readyState,
@@ -4156,7 +4251,7 @@ var ActorConnRaw = class {
     });
     this.#websocket = ws;
     ws.addEventListener("open", () => {
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
         msg: "client websocket open",
         connId: this.#connId
       });
@@ -4165,9 +4260,9 @@ var ActorConnRaw = class {
       try {
         await this.#handleOnMessage(ev.data);
       } catch (err) {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
           msg: "error in websocket message handler",
-          error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+          error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
         });
       }
     });
@@ -4175,9 +4270,9 @@ var ActorConnRaw = class {
       try {
         await this.#handleOnClose(ev);
       } catch (err) {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
           msg: "error in websocket close handler",
-          error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+          error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
         });
       }
     });
@@ -4185,9 +4280,9 @@ var ActorConnRaw = class {
       try {
         this.#handleOnError();
       } catch (err) {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
           msg: "error in websocket error handler",
-          error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+          error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
         });
       }
     });
@@ -4195,7 +4290,7 @@ var ActorConnRaw = class {
   /** Called by the onopen event from drivers. */
   #handleOnOpen() {
     if (this.#disposed) {
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
         msg: "handleOnOpen called after dispose, closing websocket"
       });
       if (this.#websocket) {
@@ -4211,7 +4306,7 @@ var ActorConnRaw = class {
     queueMicrotask(() => {
       this.#openScheduled = false;
       if (this.#disposed) {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
           msg: "handleOnOpen scheduled after dispose, closing websocket"
         });
         if (this.#websocket) {
@@ -4220,23 +4315,24 @@ var ActorConnRaw = class {
         }
         return;
       }
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
         msg: "socket open",
         messageQueueLength: this.#messageQueue.length,
         connId: this.#connId
       });
+      this.#authRetryAvailable = true;
       this.#setConnStatus("connected");
       if (this.#onOpenPromise) {
         this.#onOpenPromise.resolve(void 0);
       } else {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({ msg: "#onOpenPromise is undefined" });
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({ msg: "#onOpenPromise is undefined" });
       }
       for (const eventName of this.#eventSubscriptions.keys()) {
         this.#sendSubscription(eventName, true);
       }
       const queue = this.#messageQueue;
       this.#messageQueue = [];
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
         msg: "flushing message queue",
         queueLength: queue.length
       });
@@ -4248,23 +4344,23 @@ var ActorConnRaw = class {
   /** Called by the onmessage event from drivers. */
   async #handleOnMessage(data) {
     var _a;
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).trace({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).trace({
       msg: "received message",
       dataType: typeof data,
       isBlob: data instanceof Blob,
       isArrayBuffer: data instanceof ArrayBuffer
     });
     const response = await this.#parseMessage(data);
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).trace(
-      _chunk2CE5UNWKcjs.getLogMessage.call(void 0, ) ? {
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).trace(
+      _chunkKWGN2ZBJcjs.getLogMessage.call(void 0, ) ? {
         msg: "parsed message",
-        message: _chunk2CE5UNWKcjs.jsonStringifyCompat.call(void 0, response).substring(0, 100) + "..."
+        message: _chunkKWGN2ZBJcjs.jsonStringifyCompat.call(void 0, response).substring(0, 100) + "..."
       } : { msg: "parsed message" }
     );
     if (response.body.tag === "Init") {
       this.#actorId = response.body.val.actorId;
       this.#connId = response.body.val.connectionId;
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).trace({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).trace({
         msg: "received init message",
         actorId: this.#actorId,
         connId: this.#connId
@@ -4275,7 +4371,7 @@ var ActorConnRaw = class {
       if (actionId !== null) {
         const inFlight = this.#takeActionInFlight(Number(actionId));
         this.#invalidateActorIfStale(group, code);
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
           msg: "action error",
           actionId,
           actionName: inFlight == null ? void 0 : inFlight.name,
@@ -4294,7 +4390,7 @@ var ActorConnRaw = class {
           })
         );
       } else {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
           msg: "connection error",
           group,
           code,
@@ -4342,36 +4438,37 @@ var ActorConnRaw = class {
       }
     } else if (response.body.tag === "ActionResponse") {
       const { id: actionId } = response.body.val;
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
         msg: "received action response",
         actionId: Number(actionId),
         inFlightCount: this.#actionsInFlight.size,
         inFlightIds: Array.from(this.#actionsInFlight.keys())
       });
       const inFlight = this.#takeActionInFlight(Number(actionId));
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).trace({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).trace({
         msg: "resolving action promise",
         actionId,
         actionName: inFlight == null ? void 0 : inFlight.name
       });
       inFlight.resolve(response.body.val);
     } else if (response.body.tag === "Event") {
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).trace({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).trace({
         msg: "received event",
         name: response.body.val.name
       });
       this.#dispatchEvent(response.body.val);
     } else {
-      _chunk2CE5UNWKcjs.assertUnreachable.call(void 0, response.body);
+      _chunkKWGN2ZBJcjs.assertUnreachable.call(void 0, response.body);
     }
   }
   /** Called by the onclose event from drivers. */
   async #handleOnClose(event) {
-    var _a;
+    var _a, _b, _c;
+    const failedSocket = this.#websocket;
     const closeEvent = event;
     const wasClean = closeEvent.wasClean;
     const wasConnected = this.#connStatus === "connected";
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).info({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).info({
       msg: "socket closed",
       code: closeEvent.code,
       reason: closeEvent.reason,
@@ -4389,9 +4486,24 @@ var ActorConnRaw = class {
       const parsed = parseWebSocketCloseReason(reason);
       if (parsed) {
         const { group, code, rayId } = parsed;
+        if (isInvalidToken(group, code) && closeEvent.code === 1008 && failedSocket) {
+          try {
+            if (!await ((_b = (_a = this.#driver).refreshAuthToken) == null ? void 0 : _b.call(
+              _a,
+              failedSocket
+            ))) {
+              this.#authRetryAvailable = false;
+            }
+          } catch (e4) {
+            _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn("token renewal failed");
+            this.#authRetryAvailable = false;
+          }
+        } else if (isInvalidToken(group, code)) {
+          this.#authRetryAvailable = false;
+        }
         if (this.#shouldReconnectForStaleActor(group, code)) {
           this.#clearResolvedActorIdentity();
-          (_a = this.#onOpenPromise) == null ? void 0 : _a.reject(
+          (_c = this.#onOpenPromise) == null ? void 0 : _c.reject(
             new (0, _chunkJX2ITWAVcjs.RivetError)(
               group,
               code,
@@ -4438,8 +4550,8 @@ var ActorConnRaw = class {
       if (error instanceof _chunkJX2ITWAVcjs.RivetError) {
         this.#dispatchActorError(error);
       }
-      if (wasConnected) {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+      if (wasConnected && this.#authRetryAvailable) {
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
           msg: "triggering reconnect",
           connId: this.#connId
         });
@@ -4463,12 +4575,12 @@ var ActorConnRaw = class {
   /** Called by the onerror event from drivers. */
   #handleOnError() {
     if (this.#disposed) return;
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn("socket error");
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn("socket error");
   }
   #takeActionInFlight(id) {
     const inFlight = this.#actionsInFlight.get(id);
     if (!inFlight) {
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
         msg: "action not found in in-flight map",
         lookupId: id,
         inFlightCount: this.#actionsInFlight.size,
@@ -4483,7 +4595,7 @@ var ActorConnRaw = class {
       throw internalClientError(`No in flight response for ${id}`);
     }
     this.#actionsInFlight.delete(id);
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
       msg: "removed action from in-flight map",
       actionId: id,
       actionName: inFlight.name,
@@ -4510,9 +4622,9 @@ var ActorConnRaw = class {
       try {
         handler(error);
       } catch (err) {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
           msg: "error in connection error handler",
-          error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+          error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
         });
       }
     }
@@ -4617,9 +4729,9 @@ var ActorConnRaw = class {
         try {
           callback();
         } catch (err) {
-          _chunk3WS7Z64Ucjs.logger.call(void 0, ).error({
+          _chunkLWSLKKZ5cjs.logger.call(void 0, ).error({
             msg: "error in open handler",
-            error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, err)
+            error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, err)
           });
         }
       });
@@ -4669,7 +4781,7 @@ var ActorConnRaw = class {
     let queueMessage = false;
     if (this.#websocket) {
       const readyState = this.#websocket.readyState;
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
         msg: "websocket send attempt",
         readyState,
         readyStateString: readyState === 0 ? "CONNECTING" : readyState === 1 ? "OPEN" : readyState === 2 ? "CLOSING" : "CLOSED",
@@ -4678,7 +4790,7 @@ var ActorConnRaw = class {
         actionName: (_a = message.body.val) == null ? void 0 : _a.name
       });
       if (this.#connStatus !== "connected") {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
           msg: "websocket init pending, queueing message",
           connStatus: this.#connStatus,
           messageType: message.body.tag
@@ -4686,7 +4798,7 @@ var ActorConnRaw = class {
         queueMessage = true;
       } else if (readyState === 1) {
         try {
-          const messageSerialized = _chunk2CE5UNWKcjs.serializeWithEncoding.call(void 0, 
+          const messageSerialized = _chunkKWGN2ZBJcjs.serializeWithEncoding.call(void 0, 
             this.#encoding,
             message,
             CLIENT_PROTOCOL_TO_SERVER,
@@ -4703,8 +4815,8 @@ var ActorConnRaw = class {
                     val: {
                       id: msg.body.val.id,
                       name: msg.body.val.name,
-                      args: _chunk2CE5UNWKcjs.bufferToArrayBuffer.call(void 0, 
-                        _chunk2CE5UNWKcjs.encodeCborCompat.call(void 0, 
+                      args: _chunkKWGN2ZBJcjs.bufferToArrayBuffer.call(void 0, 
+                        _chunkKWGN2ZBJcjs.encodeCborCompat.call(void 0, 
                           msg.body.val.args
                         )
                       )
@@ -4718,12 +4830,12 @@ var ActorConnRaw = class {
           );
           this.#websocket.send(messageSerialized);
           const serializedLength = messageLength(messageSerialized);
-          _chunk3WS7Z64Ucjs.logger.call(void 0, ).trace({
+          _chunkLWSLKKZ5cjs.logger.call(void 0, ).trace({
             msg: "sent websocket message",
             len: serializedLength
           });
         } catch (error) {
-          _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+          _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
             msg: "failed to send message, added to queue",
             error,
             connId: this.#connId
@@ -4731,19 +4843,19 @@ var ActorConnRaw = class {
           queueMessage = true;
         }
       } else {
-        _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+        _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
           msg: "websocket not open, queueing message",
           readyState
         });
         queueMessage = true;
       }
     } else {
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({ msg: "no websocket, queueing message" });
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({ msg: "no websocket, queueing message" });
       queueMessage = true;
     }
     if (!(opts == null ? void 0 : opts.ephemeral) && queueMessage) {
       this.#messageQueue.push(message);
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({
         msg: "queued connection message",
         queueLength: this.#messageQueue.length,
         connId: this.#connId,
@@ -4754,8 +4866,8 @@ var ActorConnRaw = class {
   }
   async #parseMessage(data) {
     _invariant2.default.call(void 0, this.#websocket, "websocket must be defined");
-    const buffer = await _chunk2CE5UNWKcjs.inputDataToBuffer.call(void 0, data);
-    return _chunk2CE5UNWKcjs.deserializeWithEncoding.call(void 0, 
+    const buffer = await _chunkKWGN2ZBJcjs.inputDataToBuffer.call(void 0, data);
+    return _chunkKWGN2ZBJcjs.deserializeWithEncoding.call(void 0, 
       this.#encoding,
       buffer,
       CLIENT_PROTOCOL_TO_CLIENT,
@@ -4790,7 +4902,7 @@ var ActorConnRaw = class {
                 group: msg.body.val.group,
                 code: msg.body.val.code,
                 message: msg.body.val.message,
-                metadata: msg.body.val.metadata ? _chunk2CE5UNWKcjs.decodeCborCompat.call(void 0, 
+                metadata: msg.body.val.metadata ? _chunkKWGN2ZBJcjs.decodeCborCompat.call(void 0, 
                   new Uint8Array(
                     msg.body.val.metadata
                   )
@@ -4812,7 +4924,7 @@ var ActorConnRaw = class {
               tag: "ActionResponse",
               val: {
                 id: msg.body.val.id,
-                output: _chunk2CE5UNWKcjs.decodeCborCompat.call(void 0, 
+                output: _chunkKWGN2ZBJcjs.decodeCborCompat.call(void 0, 
                   new Uint8Array(msg.body.val.output)
                 )
               }
@@ -4824,7 +4936,7 @@ var ActorConnRaw = class {
               tag: "Event",
               val: {
                 name: msg.body.val.name,
-                args: _chunk2CE5UNWKcjs.decodeCborCompat.call(void 0, 
+                args: _chunkKWGN2ZBJcjs.decodeCborCompat.call(void 0, 
                   new Uint8Array(msg.body.val.args)
                 )
               }
@@ -4865,11 +4977,11 @@ var ActorConnRaw = class {
    */
   async dispose() {
     if (this.#disposed) {
-      _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({ msg: "connection already disconnected" });
+      _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({ msg: "connection already disconnected" });
       return;
     }
     this.#disposed = true;
-    _chunk3WS7Z64Ucjs.logger.call(void 0, ).debug({ msg: "disposing actor conn" });
+    _chunkLWSLKKZ5cjs.logger.call(void 0, ).debug({ msg: "disposing actor conn" });
     this.#setConnStatus("idle");
     clearInterval(this.#keepNodeAliveInterval);
     this.#abortController.abort();
@@ -4877,8 +4989,8 @@ var ActorConnRaw = class {
     if (this.#websocket) {
       const ws = this.#websocket;
       if (ws.readyState !== 2 && ws.readyState !== 3) {
-        const { promise, resolve } = _chunk2CE5UNWKcjs.promiseWithResolvers.call(void 0, 
-          (reason) => _chunk3WS7Z64Ucjs.logger.call(void 0, ).warn({
+        const { promise, resolve } = _chunkKWGN2ZBJcjs.promiseWithResolvers.call(void 0, 
+          (reason) => _chunkLWSLKKZ5cjs.logger.call(void 0, ).warn({
             msg: "unhandled websocket close promise rejection",
             reason
           })
@@ -4911,6 +5023,25 @@ var ActorConnRaw = class {
 // src/client/config.ts
 
 
+// src/common/engine.ts
+var ENGINE_HOST = "127.0.0.1";
+var ENGINE_PORT = 6420;
+var ENGINE_ENDPOINT = buildEngineEndpoint(ENGINE_HOST, ENGINE_PORT);
+function buildEngineEndpoint(host, port) {
+  const urlHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+  return `http://${urlHost}:${port}`;
+}
+function isLocalEngineEndpoint(endpoint) {
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch (e5) {
+    return false;
+  }
+  const hostname = url.hostname.toLowerCase();
+  return hostname === "localhost" || hostname === "0.0.0.0" || hostname === "::" || hostname === "[::]" || hostname === "::1" || hostname === "[::1]" || /^127(?:\.\d{1,3}){0,3}$/.test(hostname);
+}
+
 // src/utils/endpoint-parser.ts
 function tryParseEndpoint(ctx, options) {
   const {
@@ -4922,7 +5053,7 @@ function tryParseEndpoint(ctx, options) {
   let url;
   try {
     url = new URL(endpoint);
-  } catch (e3) {
+  } catch (e6) {
     ctx.addIssue({
       code: "custom",
       message: `invalid URL: ${endpoint}`,
@@ -4997,7 +5128,7 @@ var ClientConfigSchemaBase = _v42.default.object({
    * Defaults to http://localhost:6420.
    */
   endpoint: _v42.default.string().optional().transform((val) => {
-    const resolved = _nullishCoalesce(_nullishCoalesce(val, () => ( _chunk2CE5UNWKcjs.getRivetEngine.call(void 0, ))), () => ( _chunk2CE5UNWKcjs.getRivetEndpoint.call(void 0, )));
+    const resolved = _nullishCoalesce(_nullishCoalesce(val, () => ( _chunkKWGN2ZBJcjs.getRivetEngine.call(void 0, ))), () => ( _chunkKWGN2ZBJcjs.getRivetEndpoint.call(void 0, )));
     if (!resolved && !hasWarnedMissingEndpoint) {
       hasWarnedMissingEndpoint = true;
       console.warn(
@@ -5007,12 +5138,14 @@ var ClientConfigSchemaBase = _v42.default.object({
     return _nullishCoalesce(resolved, () => ( DEFAULT_ENDPOINT));
   }),
   /** Token to use to authenticate with the API. */
-  token: _v42.default.string().optional().transform((val) => _nullishCoalesce(val, () => ( _chunk2CE5UNWKcjs.getRivetToken.call(void 0, )))),
+  token: _v42.default.string().optional().transform((val) => _nullishCoalesce(val, () => ( _chunkKWGN2ZBJcjs.getRivetToken.call(void 0, )))),
+  /** Issue and renew a client token on demand. Overrides the static token when provided. */
+  getToken: _v42.default.custom().optional(),
   /** Namespace to connect to. */
-  namespace: _v42.default.string().optional().transform((val) => _nullishCoalesce(val, () => ( _chunk2CE5UNWKcjs.getRivetNamespace.call(void 0, )))),
+  namespace: _v42.default.string().optional().transform((val) => _nullishCoalesce(val, () => ( _chunkKWGN2ZBJcjs.getRivetNamespace.call(void 0, )))),
   /** Name of the envoy pool. This is used to group together envoys in to different pools. */
-  poolName: _v42.default.string().default(() => _nullishCoalesce(_chunk2CE5UNWKcjs.getRivetPool.call(void 0, ), () => ( "default"))),
-  encoding: _chunk2CE5UNWKcjs.EncodingSchema.default("bare"),
+  poolName: _v42.default.string().default(() => _nullishCoalesce(_chunkKWGN2ZBJcjs.getRivetPool.call(void 0, ), () => ( "default"))),
+  encoding: _chunkKWGN2ZBJcjs.EncodingSchema.default("bare"),
   headers: _v42.default.record(_v42.default.string(), _v42.default.string()).optional().default(() => ({})),
   gateway: _v42.default.object({
     skipReadyWait: _v42.default.boolean().optional().default(false)
@@ -5052,7 +5185,7 @@ function transformClientConfig(config, ctx) {
     ...config,
     endpoint: parsedEndpoint == null ? void 0 : parsedEndpoint.endpoint,
     namespace: _nullishCoalesce(_nullishCoalesce((parsedEndpoint == null ? void 0 : parsedEndpoint.namespace), () => ( config.namespace)), () => ( "default")),
-    token: _nullishCoalesce((parsedEndpoint == null ? void 0 : parsedEndpoint.token), () => ( config.token))
+    token: _nullishCoalesce(_nullishCoalesce((parsedEndpoint == null ? void 0 : parsedEndpoint.token), () => ( config.token)), () => ( (config.endpoint && isLocalEngineEndpoint(config.endpoint) ? "default" : void 0)))
   };
 }
 function convertRegistryConfigToClientConfig(config) {
@@ -5060,6 +5193,7 @@ function convertRegistryConfigToClientConfig(config) {
   return {
     endpoint: config.endpoint,
     token: config.token,
+    getToken: void 0,
     namespace: config.namespace,
     poolName: config.envoy.poolName,
     headers: config.headers,
@@ -5178,7 +5312,7 @@ function setRemoteHibernatableWebSocketAckTestHooks(websocket, token, enabled) {
 
 // src/engine-client/log.ts
 function logger2() {
-  return _chunk2CE5UNWKcjs.getLogger.call(void 0, "engine-client");
+  return _chunkKWGN2ZBJcjs.getLogger.call(void 0, "engine-client");
 }
 
 // src/engine-client/actor-websocket-client.ts
@@ -5311,7 +5445,7 @@ var BufferedRemoteWebSocket = (_class2 = class {
 function buildActorGatewayUrl(endpoint, actorId, token, path = "") {
   const tokenSegment = token !== void 0 ? `@${encodeURIComponent(token)}` : "";
   const gatewayPath = `/gateway/${encodeURIComponent(actorId)}${tokenSegment}${path}`;
-  return _chunk2CE5UNWKcjs.combineUrlPath.call(void 0, endpoint, gatewayPath);
+  return _chunkKWGN2ZBJcjs.combineUrlPath.call(void 0, endpoint, gatewayPath);
 }
 function buildActorQueryGatewayUrl(endpoint, namespace, query, token, path = "", maxInputSize = DEFAULT_MAX_QUERY_INPUT_SIZE, crashPolicy = void 0, runnerName, options = {}) {
   if (namespace.length === 0) {
@@ -5377,7 +5511,7 @@ function buildActorQueryGatewayUrl(endpoint, namespace, query, token, path = "",
     separator = "?";
   }
   const gatewayPath = `/gateway/${encodeURIComponent(name)}${path}${separator}${queryString}`;
-  return _chunk2CE5UNWKcjs.combineUrlPath.call(void 0, endpoint, gatewayPath);
+  return _chunkKWGN2ZBJcjs.combineUrlPath.call(void 0, endpoint, gatewayPath);
 }
 function pushKeyQueryParams(params, key) {
   if (key.length > 0) {
@@ -5388,7 +5522,7 @@ function pushInputQueryParam(params, input, maxInputSize) {
   if (input === void 0) {
     return;
   }
-  const encodedInput = _chunk2CE5UNWKcjs.encodeCborCompat.call(void 0, input);
+  const encodedInput = _chunkKWGN2ZBJcjs.encodeCborCompat.call(void 0, input);
   if (encodedInput.byteLength > maxInputSize) {
     throw new Error(
       `Actor query input exceeds maxInputSize (${encodedInput.byteLength} > ${maxInputSize} bytes). Increase client maxInputSize to allow larger query payloads.`
@@ -5397,14 +5531,15 @@ function pushInputQueryParam(params, input, maxInputSize) {
   params.append("rvt-input", uint8ArrayToBase64Url(encodedInput));
 }
 function uint8ArrayToBase64Url(value) {
-  return _chunk2CE5UNWKcjs.uint8ArrayToBase64.call(void 0, value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  return _chunkKWGN2ZBJcjs.uint8ArrayToBase64.call(void 0, value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
 }
 async function openWebSocketToGateway(runConfig, gatewayUrl, encoding, params, options = {}) {
-  const WebSocket2 = await _chunk3WS7Z64Ucjs.importWebSocket.call(void 0, );
+  const WebSocket2 = await _chunkLWSLKKZ5cjs.importWebSocket.call(void 0, );
   const ackHookToken = typeof process !== "undefined" && process.env.VITEST ? crypto.randomUUID() : void 0;
   logger2().debug({
     msg: "opening websocket to actor via guard",
-    gatewayUrl
+    // Gateway URLs can embed credentials; never include the path or query in logs.
+    origin: new URL(gatewayUrl).origin
   });
   const ws = new WebSocket2(
     gatewayUrl,
@@ -5467,7 +5602,7 @@ function getEndpoint(config) {
 }
 async function apiCall(config, method, path, body) {
   const endpoint = getEndpoint(config);
-  const url = _chunk2CE5UNWKcjs.combineUrlPath.call(void 0, endpoint, path, {
+  const url = _chunkKWGN2ZBJcjs.combineUrlPath.call(void 0, endpoint, path, {
     namespace: config.namespace
   });
   logger2().debug({ msg: "making api call", method, url });
@@ -5499,6 +5634,14 @@ async function apiCall(config, method, path, body) {
 }
 
 // src/engine-client/api-endpoints.ts
+async function issueToken(config, options) {
+  return apiCall(config, "POST", "/auth/tokens", {
+    namespace: config.namespace,
+    subject: options.subject,
+    duration: options.expiresIn,
+    grants: options.grants
+  });
+}
 async function getActor(config, _, actorId) {
   return apiCall(
     config,
@@ -5592,7 +5735,7 @@ async function lookupMetadataCached(config) {
             msg: "failed to fetch metadata, retrying",
             endpoint,
             attempt: error.attemptNumber,
-            error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, error)
+            error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, error)
           });
         }
       }
@@ -5604,7 +5747,7 @@ async function lookupMetadataCached(config) {
 
 // src/engine-client/ws-proxy.ts
 async function createWebSocketProxy(_c, targetUrl, protocols) {
-  const WebSocket2 = await _chunk3WS7Z64Ucjs.importWebSocket.call(void 0, );
+  const WebSocket2 = await _chunkLWSLKKZ5cjs.importWebSocket.call(void 0, );
   const state = {};
   return {
     onOpen: async (_event, clientWs) => {
@@ -5669,7 +5812,7 @@ async function createWebSocketProxy(_c, targetUrl, protocols) {
         logger2().error({
           msg: "target websocket error",
           targetUrl,
-          error: _chunk2CE5UNWKcjs.stringifyError.call(void 0, error)
+          error: _chunkKWGN2ZBJcjs.stringifyError.call(void 0, error)
         });
         closeWebSocketIfOpen(clientWs, 1011, "Target WebSocket error");
       });
@@ -5747,14 +5890,18 @@ function closeWebSocketIfOpen(ws, code, reason) {
 var RemoteEngineControlClient = class {
   #config;
   #metadataPromise;
+  #tokenProvider;
+  #webSocketTokens = /* @__PURE__ */ new WeakMap();
   constructor(runConfig) {
-    if (_chunk2CE5UNWKcjs.getNextPhase.call(void 0, ) === "phase-production-build") {
+    if (_chunkKWGN2ZBJcjs.getNextPhase.call(void 0, ) === "phase-production-build") {
       logger2().info(
         "detected next.js build phase, disabling health check"
       );
       runConfig.disableMetadataLookup = true;
     }
     this.#config = { ...runConfig };
+    if (runConfig.getToken)
+      this.#tokenProvider = new TokenProvider(runConfig.getToken);
     if (!runConfig.disableMetadataLookup) {
       this.#metadataPromise = lookupMetadataCached(this.#config).then(
         (metadataData) => {
@@ -5763,14 +5910,13 @@ var RemoteEngineControlClient = class {
             if (metadataData.clientNamespace) {
               this.#config.namespace = metadataData.clientNamespace;
             }
-            if (metadataData.clientToken) {
+            if (metadataData.clientToken && !this.#tokenProvider) {
               this.#config.token = metadataData.clientToken;
             }
             logger2().info({
               msg: "overriding client endpoint",
               endpoint: metadataData.clientEndpoint,
-              namespace: metadataData.clientNamespace,
-              token: metadataData.clientToken
+              namespace: metadataData.clientNamespace
             });
           }
           logger2().info({
@@ -5783,12 +5929,47 @@ var RemoteEngineControlClient = class {
       );
     }
   }
+  async #authorizedConfig() {
+    if (!this.#tokenProvider) return this.#config;
+    return { ...this.#config, token: await this.#tokenProvider.current() };
+  }
+  async #withCredential(request, readOnly = false) {
+    const config = await this.#authorizedConfig();
+    try {
+      return await request(config);
+    } catch (error) {
+      if (this.#tokenProvider && config.token && error instanceof _chunkJX2ITWAVcjs.RivetError && error.statusCode === 401 && isInvalidToken(error.group, error.code)) {
+        if (readOnly) {
+          const token = await this.#tokenProvider.refreshIfCurrent(
+            config.token
+          );
+          return request({ ...this.#config, token });
+        }
+        await this.#tokenProvider.refreshIfCurrent(config.token);
+      }
+      throw error;
+    }
+  }
+  async issueToken(options) {
+    await this.#metadataPromise;
+    const response = await this.#withCredential(
+      (config) => issueToken(config, options)
+    );
+    return {
+      token: response.token,
+      issuedAt: response.issued_ts,
+      expiresAt: response.expires_ts
+    };
+  }
   async getForId({
     name,
     actorId
   }) {
     await this.#metadataPromise;
-    const response = await getActor(this.#config, name, actorId);
+    const response = await this.#withCredential(
+      (config) => getActor(config, name, actorId),
+      true
+    );
     const actor = response.actors[0];
     if (!actor) return void 0;
     if (actor.name !== name) {
@@ -5809,7 +5990,10 @@ var RemoteEngineControlClient = class {
     await this.#metadataPromise;
     logger2().debug({ msg: "getWithKey: searching for actor", name, key });
     try {
-      const response = await getActorByKey(this.#config, name, key);
+      const response = await this.#withCredential(
+        (config) => getActorByKey(config, name, key),
+        true
+      );
       const actor = response.actors[0];
       if (!actor) return void 0;
       logger2().debug({
@@ -5842,16 +6026,18 @@ var RemoteEngineControlClient = class {
       key
     });
     try {
-      const { actor, created } = await getOrCreateActor(this.#config, {
-        datacenter: region,
-        name,
-        key: _chunkMYWZCDMLcjs.serializeActorKey.call(void 0, key),
-        runner_name_selector: _nullishCoalesce(poolName, () => ( this.#config.poolName)),
-        input: actorInput ? _chunk2CE5UNWKcjs.uint8ArrayToBase64.call(void 0, 
-          _chunk2CE5UNWKcjs.encodeCborCompat.call(void 0, actorInput)
-        ) : void 0,
-        crash_policy: _nullishCoalesce(crashPolicy, () => ( "sleep"))
-      });
+      const { actor, created } = await this.#withCredential(
+        (config) => getOrCreateActor(config, {
+          datacenter: region,
+          name,
+          key: _chunkMYWZCDMLcjs.serializeActorKey.call(void 0, key),
+          runner_name_selector: _nullishCoalesce(poolName, () => ( this.#config.poolName)),
+          input: actorInput ? _chunkKWGN2ZBJcjs.uint8ArrayToBase64.call(void 0, 
+            _chunkKWGN2ZBJcjs.encodeCborCompat.call(void 0, actorInput)
+          ) : void 0,
+          crash_policy: _nullishCoalesce(crashPolicy, () => ( "sleep"))
+        })
+      );
       logger2().info({
         msg: "getOrCreateWithKey: actor ready",
         actorId: actor.actor_id,
@@ -5867,7 +6053,10 @@ var RemoteEngineControlClient = class {
           name,
           key
         });
-        const response = await getActorByKey(this.#config, name, key);
+        const response = await this.#withCredential(
+          (config) => getActorByKey(config, name, key),
+          true
+        );
         const existing = response.actors[0];
         if (!existing) throw error;
         logger2().info({
@@ -5891,14 +6080,18 @@ var RemoteEngineControlClient = class {
   }) {
     await this.#metadataPromise;
     logger2().info({ msg: "creating actor via engine api", name, key });
-    const result = await createActor(this.#config, {
-      datacenter: region,
-      name,
-      runner_name_selector: _nullishCoalesce(poolName, () => ( this.#config.poolName)),
-      key: _chunkMYWZCDMLcjs.serializeActorKey.call(void 0, key),
-      input: input ? _chunk2CE5UNWKcjs.uint8ArrayToBase64.call(void 0, _chunk2CE5UNWKcjs.encodeCborCompat.call(void 0, input)) : void 0,
-      crash_policy: _nullishCoalesce(crashPolicy, () => ( "sleep"))
-    });
+    const result = await this.#withCredential(
+      (config) => createActor(config, {
+        datacenter: region,
+        name,
+        runner_name_selector: _nullishCoalesce(poolName, () => ( this.#config.poolName)),
+        key: _chunkMYWZCDMLcjs.serializeActorKey.call(void 0, key),
+        input: input ? _chunkKWGN2ZBJcjs.uint8ArrayToBase64.call(void 0, 
+          _chunkKWGN2ZBJcjs.encodeCborCompat.call(void 0, input)
+        ) : void 0,
+        crash_policy: _nullishCoalesce(crashPolicy, () => ( "sleep"))
+      })
+    );
     logger2().info({
       msg: "actor created",
       actorId: result.actor.actor_id,
@@ -5910,43 +6103,61 @@ var RemoteEngineControlClient = class {
   async listActors({ name }) {
     await this.#metadataPromise;
     logger2().debug({ msg: "listing actors via engine api", name });
-    const response = await listActorsByName(this.#config, name);
+    const response = await this.#withCredential(
+      (config) => listActorsByName(config, name),
+      true
+    );
     return response.actors.map(apiActorToOutput);
   }
   async destroyActor(actorId) {
     await this.#metadataPromise;
     logger2().info({ msg: "destroying actor via engine api", actorId });
-    await destroyActor(this.#config, actorId);
+    await this.#withCredential((config) => destroyActor(config, actorId));
     logger2().info({ msg: "actor destroyed", actorId });
   }
   async sendRequest(target, actorRequest, options = {}) {
+    var _a;
     await this.#metadataPromise;
-    const path = requestPath(actorRequest);
-    const gatewayUrl = this.#buildGatewayUrlForTarget(
-      target,
-      path,
-      options
-    );
+    const config = await this.#authorizedConfig();
     const httpOptions = {
       ...options,
       directActorId: shouldSkipReadyWait(options) ? directActorIdFromTarget(target) : void 0
     };
-    return sendHttpRequestToGateway(
-      this.#config,
-      gatewayUrl,
+    const send = (current) => sendHttpRequestToGateway(
+      current,
+      this.#buildGatewayUrlForTarget(
+        current,
+        target,
+        requestPath(actorRequest),
+        options
+      ),
       actorRequest,
       httpOptions
     );
+    const response = await send(config);
+    if (!this.#tokenProvider || !config.token || !isInvalidTokenResponse(response))
+      return response;
+    if ((actorRequest.method === "GET" || actorRequest.method === "HEAD") && !("getOrCreateForKey" in target)) {
+      const token = await this.#tokenProvider.refreshIfCurrent(
+        config.token
+      );
+      await ((_a = response.body) == null ? void 0 : _a.cancel());
+      return send({ ...this.#config, token });
+    }
+    await this.#tokenProvider.refreshIfCurrent(config.token);
+    return response;
   }
   async openWebSocket(path, target, encoding, params, options = {}) {
     await this.#metadataPromise;
+    const config = await this.#authorizedConfig();
     const gatewayUrl = this.#buildGatewayUrlForTarget(
+      config,
       target,
       path,
       options
     );
-    return openWebSocketToGateway(
-      this.#config,
+    const ws = await openWebSocketToGateway(
+      config,
       gatewayUrl,
       encoding,
       params,
@@ -5955,26 +6166,60 @@ var RemoteEngineControlClient = class {
         directActorId: shouldSkipReadyWait(options) ? directActorIdFromTarget(target) : void 0
       }
     );
+    this.#watchWebSocketAuth(ws, config.token);
+    return ws;
+  }
+  async refreshAuthToken(ws) {
+    const context2 = this.#webSocketTokens.get(ws);
+    if (!(context2 == null ? void 0 : context2.refresh)) return false;
+    await context2.refresh;
+    return true;
+  }
+  #watchWebSocketAuth(ws, token) {
+    const tokenProvider = this.#tokenProvider;
+    if (!tokenProvider || !token) return;
+    const context2 = {};
+    this.#webSocketTokens.set(ws, context2);
+    ws.addEventListener(
+      "close",
+      (event) => {
+        if (event.code !== 1008 || !event.reason) return;
+        const separator = event.reason.indexOf(".");
+        if (separator < 0) return;
+        const code = event.reason.slice(separator + 1).split(/[\s:#]/, 1)[0];
+        if (isInvalidToken(event.reason.slice(0, separator), code)) {
+          context2.refresh = tokenProvider.refreshIfCurrent(token).catch((error) => {
+            logger2().warn(
+              "failed to renew authentication token"
+            );
+            throw error;
+          });
+          context2.refresh.catch(() => {
+          });
+        }
+      }
+    );
   }
   async buildGatewayUrl(target, options = {}) {
     await this.#metadataPromise;
-    return this.#buildGatewayUrlForTarget(target, "", options);
+    return this.#buildGatewayUrlForTarget(
+      await this.#authorizedConfig(),
+      target,
+      "",
+      options
+    );
   }
   async proxyRequest(_c, actorRequest, actorId) {
-    await this.#metadataPromise;
-    const gatewayUrl = this.#buildGatewayUrlForTarget(
-      { directId: actorId },
-      requestPath(actorRequest)
-    );
-    return sendHttpRequestToGateway(this.#config, gatewayUrl, actorRequest);
+    return this.sendRequest({ directId: actorId }, actorRequest);
   }
   async proxyWebSocket(c, path, actorId, encoding, params) {
-    var _a, _b;
+    var _a;
     await this.#metadataPromise;
-    const upgradeWebSocket = (_b = (_a = this.#config).getUpgradeWebSocket) == null ? void 0 : _b.call(_a);
+    const config = await this.#authorizedConfig();
+    const upgradeWebSocket = (_a = config.getUpgradeWebSocket) == null ? void 0 : _a.call(config);
     _invariant2.default.call(void 0, upgradeWebSocket, "missing getUpgradeWebSocket");
-    const endpoint = getEndpoint(this.#config);
-    const guardUrl = _chunk2CE5UNWKcjs.combineUrlPath.call(void 0, endpoint, path);
+    const endpoint = getEndpoint(config);
+    const guardUrl = _chunkKWGN2ZBJcjs.combineUrlPath.call(void 0, endpoint, path);
     const wsGuardUrl = guardUrl.replace("http://", "ws://");
     logger2().debug({
       msg: "forwarding websocket to actor via guard",
@@ -5983,7 +6228,7 @@ var RemoteEngineControlClient = class {
       guardUrl
     });
     const protocols = buildWebSocketProtocols(
-      this.#config,
+      config,
       encoding,
       params,
       void 0,
@@ -5993,7 +6238,7 @@ var RemoteEngineControlClient = class {
       }
     );
     const args = await createWebSocketProxy(c, wsGuardUrl, protocols);
-    return await upgradeWebSocket(() => args)(c, _chunk2CE5UNWKcjs.noopNext.call(void 0, ));
+    return await upgradeWebSocket(() => args)(c, _chunkKWGN2ZBJcjs.noopNext.call(void 0, ));
   }
   displayInformation() {
     return { properties: {} };
@@ -6001,16 +6246,16 @@ var RemoteEngineControlClient = class {
   setGetUpgradeWebSocket(getUpgradeWebSocket) {
     this.#config.getUpgradeWebSocket = getUpgradeWebSocket;
   }
-  #buildGatewayUrlForTarget(target, path, options = {}) {
-    const endpoint = getEndpoint(this.#config);
+  #buildGatewayUrlForTarget(config, target, path, options = {}) {
+    const endpoint = getEndpoint(config);
     if (shouldSkipReadyWait(options) && directActorIdFromTarget(target) && canUseDirectSkipReadyWaitPath(path)) {
-      return _chunk2CE5UNWKcjs.combineUrlPath.call(void 0, endpoint, path);
+      return _chunkKWGN2ZBJcjs.combineUrlPath.call(void 0, endpoint, path);
     }
     if ("directId" in target) {
       return buildActorGatewayUrl(
         endpoint,
         target.directId,
-        this.#config.token,
+        config.token,
         path
       );
     }
@@ -6018,20 +6263,20 @@ var RemoteEngineControlClient = class {
       return buildActorGatewayUrl(
         endpoint,
         target.getForId.actorId,
-        this.#config.token,
+        config.token,
         path
       );
     }
     if ("getForKey" in target || "getOrCreateForKey" in target) {
       return buildActorQueryGatewayUrl(
         endpoint,
-        this.#config.namespace,
+        config.namespace,
         target,
-        this.#config.token,
+        config.token,
         path,
-        this.#config.maxInputSize,
+        config.maxInputSize,
         void 0,
-        "getOrCreateForKey" in target ? _nullishCoalesce(target.getOrCreateForKey.poolName, () => ( this.#config.poolName)) : void 0,
+        "getOrCreateForKey" in target ? _nullishCoalesce(target.getOrCreateForKey.poolName, () => ( config.poolName)) : void 0,
         options
       );
     }
@@ -6100,5 +6345,9 @@ function apiActorToOutput(actor) {
 
 
 
-exports.HEADER_CONN_PARAMS = HEADER_CONN_PARAMS; exports.HEADER_ORIGINAL_REQUEST_URL = HEADER_ORIGINAL_REQUEST_URL; exports.ALLOWED_PUBLIC_HEADERS = ALLOWED_PUBLIC_HEADERS; exports.ActorClientError = ActorClientError; exports.ManagerError = ManagerError; exports.MalformedResponseMessage = MalformedResponseMessage; exports.ActorConnDisposed = ActorConnDisposed; exports.readActiveTraceHeaders = readActiveTraceHeaders; exports.runWithActorInvocationSpan = runWithActorInvocationSpan; exports.ActorConnRaw = ActorConnRaw; exports.isResponseLike = isResponseLike; exports.ActorHandleRaw = ActorHandleRaw; exports.createClientWithDriver = createClientWithDriver; exports.tryParseEndpoint = tryParseEndpoint; exports.ClientConfigSchema = ClientConfigSchema; exports.convertRegistryConfigToClientConfig = convertRegistryConfigToClientConfig; exports.getDatacenters = getDatacenters; exports.updateRunnerConfig = updateRunnerConfig; exports.RemoteEngineControlClient = RemoteEngineControlClient;
-//# sourceMappingURL=chunk-A36FMKOV.cjs.map
+
+
+
+
+exports.HEADER_CONN_PARAMS = HEADER_CONN_PARAMS; exports.HEADER_ORIGINAL_REQUEST_URL = HEADER_ORIGINAL_REQUEST_URL; exports.ALLOWED_PUBLIC_HEADERS = ALLOWED_PUBLIC_HEADERS; exports.ActorClientError = ActorClientError; exports.ManagerError = ManagerError; exports.MalformedResponseMessage = MalformedResponseMessage; exports.ActorConnDisposed = ActorConnDisposed; exports.readActiveTraceHeaders = readActiveTraceHeaders; exports.runWithActorInvocationSpan = runWithActorInvocationSpan; exports.ActorConnRaw = ActorConnRaw; exports.isResponseLike = isResponseLike; exports.ActorHandleRaw = ActorHandleRaw; exports.createClientWithDriver = createClientWithDriver; exports.ENGINE_HOST = ENGINE_HOST; exports.ENGINE_PORT = ENGINE_PORT; exports.buildEngineEndpoint = buildEngineEndpoint; exports.isLocalEngineEndpoint = isLocalEngineEndpoint; exports.tryParseEndpoint = tryParseEndpoint; exports.ClientConfigSchema = ClientConfigSchema; exports.convertRegistryConfigToClientConfig = convertRegistryConfigToClientConfig; exports.getDatacenters = getDatacenters; exports.updateRunnerConfig = updateRunnerConfig; exports.RemoteEngineControlClient = RemoteEngineControlClient;
+//# sourceMappingURL=chunk-B5SNXPSS.cjs.map