@astralbeam/sdk 0.1.0 → 0.3.0

package/README.md

@@ -26,7 +26,7 @@ const handle = mountAstralBeamChat(document.getElementById("sidebar"), {})
 ```
 
 - The widget fills its container, so give it a parent with a definite height (`min-h-0` in a flex column).
-- Two origins by design: chat streams to the hosted cloud by default, while the token comes from your own app's endpoint. Self-hosted deployments set `chatEndpoint` to their own origin.
+- Two origins by design: chat streams to the hosted cloud by default, while the token comes from your own app's endpoint. Self-hosted deployments set `apiUrl` to their own origin.
 - `@astralbeam/sdk/client` ships no React; the chat loads as a lazy chunk with its own bundled copy.
 - `react` and `react-dom` are optional peer dependencies used only by `@astralbeam/sdk/react`.
 - Mount it above your router if the transcript should survive page navigation.
@@ -40,36 +40,48 @@ import { createAstralBeamTokenRoute } from "@astralbeam/sdk/server"
 
 export const POST = createAstralBeamTokenRoute({
   apiKey: () => process.env.ASTRALBEAM_API_KEY, // key_<organization>_<key>_abo_<secret>
-  tenantUser: async (request) => {
-    const session = await getApplicationSession(request)
-    return session && { id: session.user.id, name: session.user.name }
-  },
+  authenticate: (request) => getApplicationSession(request),
+  user: (session) => ({
+    id: session.user.id,
+    name: session.user.name,
+    metadata: { email: session.user.email },
+  }),
+  tenant: (session) => ({
+    id: session.tenant.id,
+    name: session.tenant.name,
+    metadata: { plan: session.tenant.plan },
+  }),
 })
 ```
 
 - Add one endpoint, `/api/astralbeam/token` by default, that authenticates your own session first.
 - The factory owns the method check, the unconfigured 503, the unauthenticated 401, and `no-store`.
-- Derive `tenantUser` from trusted server-side state, never from anything the browser sent.
+- Authenticate once, then derive `user` and `tenant` separately from that same application session.
+- Derive `user` and `tenant` from trusted server-side state, never from anything the browser sent.
+- Provide stable tenant-local `user.id` and stable `tenant.id` values; names are optional, and set `user.admin` only from trusted state.
+- Put custom tenant and tenant-user fields in their respective `metadata` JSON objects; never include secrets.
+- SDK fields use camelCase; AstralBeam-owned JWT claims use snake_case, while `metadata` keys are preserved verbatim.
+- Tokens use the API key's organization slug as issuer and the platform audience `astralbeam`; AstralBeam does not require or interpret `sub`.
 - Tokens are signed, not encrypted: never put a secret in them.
 - Lifetimes are 60–600 seconds; the SDK renews in memory before expiry.
 
 ## Options
 
-Every option is also a prop on `<AstralBeamChat>`; `handle.update(options)` applies any subset in place. `agentId`, `chatEndpoint`, and `authEndpoint` are fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
-
-| Option                               | Default                              | Meaning                                                         |
-| ------------------------------------ | ------------------------------------ | --------------------------------------------------------------- |
-| `agentId`                            | organization's default               | `agt_<organization>_<agent>` from the dashboard                 |
-| `chatEndpoint`                       | `https://app.astralbeam.ai/api/chat` | The AstralBeam chat endpoint the widget streams from            |
-| `authEndpoint`                       | `/api/astralbeam/token`              | Your token endpoint                                             |
-| `title`, `showHeader`                | `"AstralBeam"`, `true`               | Header text, and whether the header and reset button show       |
-| `emptyTitle`, `emptyDescription`     | generic copy                         | Headline and subtitle of the empty transcript                   |
-| `colorScheme`, `theme`               | `"system"`, built-in palette         | Light/dark/system, and shadcn token overrides                   |
-| `attachments`                        | `true`                               | `false` hides the feature, or pass limits                       |
-| `tools`, `widgets`                   | none                                 | What the agent can do and draw in your app                      |
-| `sandboxPanel`                       | `false`                              | Collected sandbox panel: files with downloads, command log      |
-| `header`, `empty`, `composerActions` | widget's own chrome                  | Host-rendered replacements (React props; `slots` on the handle) |
-| `debug`                              | `false`                              | Log every SDK action in the browser and on the server           |
+Every option is also a prop on `<AstralBeamChat>`; `handle.update(options)` applies any subset in place. `agentId`, `apiUrl`, and `authTokenUrl` are fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
+
+| Option                               | Default                         | Meaning                                                         |
+| ------------------------------------ | ------------------------------- | --------------------------------------------------------------- |
+| `agentId`                            | organization's default          | `agt_<organization>_<agent>` from the dashboard                 |
+| `apiUrl`                             | `https://app.astralbeam.ai/api` | Base URL of the AstralBeam API; the widget calls `/chat` there  |
+| `authTokenUrl`                       | `/api/astralbeam/token`         | Your token endpoint                                             |
+| `title`, `showHeader`                | `"AstralBeam"`, `true`          | Header text, and whether the header and reset button show       |
+| `emptyTitle`, `emptyDescription`     | generic copy                    | Headline and subtitle of the empty transcript                   |
+| `colorScheme`, `theme`               | `"system"`, built-in palette    | Light/dark/system, and shadcn token overrides                   |
+| `attachments`                        | `true`                          | `false` hides the feature, or pass limits                       |
+| `tools`, `widgets`                   | none                            | What the agent can do and draw in your app                      |
+| `sandboxPanel`                       | `false`                         | Collected sandbox panel: files with downloads, command log      |
+| `header`, `empty`, `composerActions` | widget's own chrome             | Host-rendered replacements (React props; `slots` on the handle) |
+| `debug`                              | `false`                         | Log every SDK action in the browser and on the server           |
 
 A `ref` on `<AstralBeamChat>` (and the vanilla handle) exposes `reset()` and `stop()` for hosts that draw their own controls.
 

package/dist/client.d.ts

@@ -126,13 +126,13 @@ interface MountAstralBeamChatOptions {
   /** Subtitle shown under the empty transcript's headline. Default describes the app's tools and widgets. */
   emptyDescription?: string | undefined;
   /**
-   * URL of the AstralBeam chat endpoint the widget streams from. Fixed at mount. Default
-   * `"https://app.astralbeam.ai/api/chat"`, the hosted cloud; self-hosted deployments must set
-   * their own origin.
+   * Base URL of the AstralBeam API; the widget calls `/chat` and its subroutes under it. Fixed at
+   * mount. Default `"https://app.astralbeam.ai/api"`, the hosted cloud; self-hosted deployments
+   * must set their own origin.
    */
-  chatEndpoint?: string | undefined;
+  apiUrl?: string | undefined;
   /** Application endpoint that mints a short-lived chat JWT. Fixed at mount. Default `"/api/astralbeam/token"`. */
-  authEndpoint?: string | undefined;
+  authTokenUrl?: string | undefined;
   /** Host-defined tools the agent can call, executed in the host page, keyed by tool name. */
   tools?: Record<string, ToolDefinition> | undefined;
   /** Host-defined widgets the agent can render inline in the conversation, keyed by identifier. */
@@ -161,10 +161,10 @@ interface MountAstralBeamChatOptions {
   debug?: boolean | undefined;
 }
 /**
- * Mount options the handle can change afterwards. The agent and transport endpoints are fixed:
+ * Mount options the handle can change afterwards. The agent and the transport URLs are fixed:
  * changing any of them would mean a new client and a discarded transcript.
  */
-type AstralBeamChatUpdate = Partial<Omit<MountAstralBeamChatOptions, "agentId" | "chatEndpoint" | "authEndpoint">>;
+type AstralBeamChatUpdate = Partial<Omit<MountAstralBeamChatOptions, "agentId" | "apiUrl" | "authTokenUrl">>;
 interface AstralBeamChatHandle {
   unmount: () => void;
   /**

package/dist/client.js

@@ -1 +1 @@
-import{c as e,t}from"./debug-DBysy3en.js";function n(e){return e}function r(e){return e}function i(n,r){let i={...r},a=t(i.debug);a?.(`mount`,`mounting chat widget`,{agentId:i.agentId??`(organization default)`,title:i.title??`AstralBeam`,showHeader:i.showHeader??!0,emptyTitle:i.emptyTitle??`Ask the assistant`,emptyDescription:i.emptyDescription??`It can answer questions and act through this app's own tools and widgets.`,chatEndpoint:i.chatEndpoint??`https://app.astralbeam.ai/api/chat`,authentication:`configured`,colorScheme:i.colorScheme??`system`,theme:i.theme,tools:Object.keys(i.tools??{}),widgets:Object.keys(i.widgets??{}),attachments:i.attachments??!0});let o=n.shadowRoot??n.attachShadow({mode:`open`}),s=document.createElement(`div`);s.className=e,s.style.height=`100%`,o.append(s);let c=matchMedia(`(prefers-color-scheme: dark)`),l=new Set,u=e=>{for(let e of l)s.style.removeProperty(e);l.clear();let t={...i.theme?.light,...e?i.theme?.dark:void 0};for(let[e,n]of Object.entries(t))e.startsWith(`--`)&&(s.style.setProperty(e,n),l.add(e))},d=()=>{let e=i.colorScheme??`system`,t=e===`dark`||e===`system`&&c.matches;s.classList.toggle(`dark`,t),u(t),a?.(`theme`,`color scheme "${e}" resolved to ${t?`dark`:`light`}`,{themeVariables:[...l]})};d(),c.addEventListener(`change`,d);let f=!1,p;return import(`./widget-C7XKsfTv.js`).then(({renderChat:e})=>{a?.(`mount`,`chat chunk loaded`),f||(p=e(o,s,i))}),{update:e=>{if(Object.hasOwn(e,`agentId`)||Object.hasOwn(e,`chatEndpoint`)||Object.hasOwn(e,`authEndpoint`))throw Error(`agentId, chatEndpoint, and authEndpoint are fixed at mount`);i={...i,...e},a=t(i.debug),a?.(`mount`,`options updated`,{changed:Object.keys(e)}),d(),p?.update(i)},reset:()=>p?.reset(),stop:()=>p?.stop(),unmount:()=>{a?.(`mount`,`unmounting chat widget`),f=!0,c.removeEventListener(`change`,d),p?.dispose(),p=void 0,s.remove()}}}export{n as defineTool,r as defineWidget,i as mountAstralBeamChat};
+import{c as e,t}from"./debug-DyjRg3e0.js";function n(e){return e}function r(e){return e}function i(n,r){let i={...r},a=t(i.debug);a?.(`mount`,`mounting chat widget`,{agentId:i.agentId??`(organization default)`,title:i.title??`AstralBeam`,showHeader:i.showHeader??!0,emptyTitle:i.emptyTitle??`Ask the assistant`,emptyDescription:i.emptyDescription??`It can answer questions and act through this app's own tools and widgets.`,apiUrl:i.apiUrl??`https://app.astralbeam.ai/api`,authentication:`configured`,colorScheme:i.colorScheme??`system`,theme:i.theme,tools:Object.keys(i.tools??{}),widgets:Object.keys(i.widgets??{}),attachments:i.attachments??!0});let o=n.shadowRoot??n.attachShadow({mode:`open`}),s=document.createElement(`div`);s.className=e,s.style.height=`100%`,o.append(s);let c=matchMedia(`(prefers-color-scheme: dark)`),l=new Set,u=e=>{for(let e of l)s.style.removeProperty(e);l.clear();let t={...i.theme?.light,...e?i.theme?.dark:void 0};for(let[e,n]of Object.entries(t))e.startsWith(`--`)&&(s.style.setProperty(e,n),l.add(e))},d=()=>{let e=i.colorScheme??`system`,t=e===`dark`||e===`system`&&c.matches;s.classList.toggle(`dark`,t),u(t),a?.(`theme`,`color scheme "${e}" resolved to ${t?`dark`:`light`}`,{themeVariables:[...l]})};d(),c.addEventListener(`change`,d);let f=!1,p;return import(`./widget-CncI3L44.js`).then(({renderChat:e})=>{a?.(`mount`,`chat chunk loaded`),f||(p=e(o,s,i))}),{update:e=>{if(Object.hasOwn(e,`agentId`)||Object.hasOwn(e,`apiUrl`)||Object.hasOwn(e,`authTokenUrl`))throw Error(`agentId, apiUrl, and authTokenUrl are fixed at mount`);i={...i,...e},a=t(i.debug),a?.(`mount`,`options updated`,{changed:Object.keys(e)}),d(),p?.update(i)},reset:()=>p?.reset(),stop:()=>p?.stop(),unmount:()=>{a?.(`mount`,`unmounting chat widget`),f=!0,c.removeEventListener(`change`,d),p?.dispose(),p=void 0,s.remove()}}}export{n as defineTool,r as defineWidget,i as mountAstralBeamChat};

package/dist/{core-9Q6FGvSX.js → core-BVlttAaO.js}

@@ -1,5 +1,17 @@
 //#region \0rolldown/runtime.js
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+/**
+* The chat API's URLs under an API base: the stream itself, the agent capability handshake,
+* and artifact downloads. Chat is one API under the base; others will sit beside it.
+*/
+function chatApiUrls(apiUrl) {
+	const chat = `${(apiUrl ?? "https://app.astralbeam.ai/api").replace(/\/+$/, "")}/chat`;
+	return {
+		chat,
+		config: `${chat}/config`,
+		files: `${chat}/files`
+	};
+}
 /** Color scheme used when the mount options and the React prop give none. */
 const DEFAULT_COLOR_SCHEME = "system";
 //#endregion
@@ -7850,10 +7862,10 @@ function bearerToken(headers) {
 	return authorization?.startsWith("Bearer ") ? authorization.slice(7) : void 0;
 }
 async function fetchChatToken(options) {
-	const { authEndpoint, session, onStateChange, fetchClient, debug } = options;
+	const { authTokenUrl, session, onStateChange, fetchClient, debug } = options;
 	const { signal } = session.abortController;
 	try {
-		const response = await fetchClient(authEndpoint, {
+		const response = await fetchClient(authTokenUrl, {
 			method: "POST",
 			headers: { accept: "application/json" },
 			credentials: "include",
@@ -8061,7 +8073,7 @@ function describeSandboxCommandRun(run) {
 */
 function createAstralBeamChat(options) {
 	const debug = createDebugLogger(options.debug);
-	const endpoint = (options.chatEndpoint ?? "https://app.astralbeam.ai/api/chat").replace(/\/+$/, "");
+	const urls = chatApiUrls(options.apiUrl);
 	const widgets = options.widgets ?? {};
 	const listeners = /* @__PURE__ */ new Set();
 	let state = {
@@ -8084,7 +8096,7 @@ function createAstralBeamChat(options) {
 		for (const listener of listeners) listener();
 	};
 	const authentication = {
-		authEndpoint: options.authEndpoint ?? "/api/astralbeam/token",
+		authTokenUrl: options.authTokenUrl ?? "/api/astralbeam/token",
 		session: {
 			cached: void 0,
 			refreshPromise: void 0,
@@ -8097,7 +8109,7 @@ function createAstralBeamChat(options) {
 	initializeChatAuthentication(authentication).catch(() => void 0);
 	(async () => {
 		try {
-			const url = new URL(`${endpoint}/config`, globalThis.location?.href);
+			const url = new URL(urls.config, globalThis.location?.href);
 			if (options.agentId) url.searchParams.set("agentId", options.agentId);
 			const token = await getValidChatToken(authentication);
 			const response = await fetch(url, { headers: { authorization: `Bearer ${token}` } });
@@ -8132,7 +8144,7 @@ function createAstralBeamChat(options) {
 		};
 	};
 	const client = new ChatClient({
-		connection: fetchServerSentEvents(endpoint, async () => ({
+		connection: fetchServerSentEvents(urls.chat, async () => ({
 			headers: { authorization: `Bearer ${await getValidChatToken(authentication)}` },
 			fetchClient: (input, init) => fetchAuthenticatedChat({
 				...authentication,

package/dist/core.d.ts

@@ -1,2 +1,2 @@
-import { A as SandboxActivity, C as AstralBeamChatState, D as WidgetDeclaration, E as ChatAuthenticationState, F as InferParameters, I as JsonSchemaObject, L as ParametersSchema, M as SandboxCommandRun, N as SandboxFileWrite, O as buildAgentTools, P as SandboxStatus, R as StandardSchemaV1, S as AstralBeamChatCoreOptions, T as createAstralBeamChat, _ as sandboxRefusal, a as SANDBOX_LIST_FILES_TOOL, b as lastPartInProgress, c as SANDBOX_RUN_COMMAND_TOOL, d as collectSandboxActivity, f as describeSandboxCommandRun, g as readSandboxFileWrite, h as readSandboxCommandRun, i as RENDER_WIDGET_TOOL, j as SandboxArtifact, k as RenderWidgetInput, l as SANDBOX_STATUS_EVENT, m as readSandboxArtifact, n as defineWidget, o as SANDBOX_PUBLISH_ARTIFACT_TOOL, p as isSandboxTool, r as ASK_QUESTIONNAIRE_TOOL, s as SANDBOX_READ_FILE_TOOL, t as defineTool, u as SANDBOX_WRITE_FILE_TOOL, v as hasPendingToolRun, w as WidgetRenderRequest, x as AstralBeamChatCore, y as isSettledToolCall, z as ToolDefinition } from "./index-BBBBbB1x.js";
+import { A as SandboxActivity, C as AstralBeamChatState, D as WidgetDeclaration, E as ChatAuthenticationState, F as InferParameters, I as JsonSchemaObject, L as ParametersSchema, M as SandboxCommandRun, N as SandboxFileWrite, O as buildAgentTools, P as SandboxStatus, R as StandardSchemaV1, S as AstralBeamChatCoreOptions, T as createAstralBeamChat, _ as sandboxRefusal, a as SANDBOX_LIST_FILES_TOOL, b as lastPartInProgress, c as SANDBOX_RUN_COMMAND_TOOL, d as collectSandboxActivity, f as describeSandboxCommandRun, g as readSandboxFileWrite, h as readSandboxCommandRun, i as RENDER_WIDGET_TOOL, j as SandboxArtifact, k as RenderWidgetInput, l as SANDBOX_STATUS_EVENT, m as readSandboxArtifact, n as defineWidget, o as SANDBOX_PUBLISH_ARTIFACT_TOOL, p as isSandboxTool, r as ASK_QUESTIONNAIRE_TOOL, s as SANDBOX_READ_FILE_TOOL, t as defineTool, u as SANDBOX_WRITE_FILE_TOOL, v as hasPendingToolRun, w as WidgetRenderRequest, x as AstralBeamChatCore, y as isSettledToolCall, z as ToolDefinition } from "./index-DtIS-V14.js";
 export { ASK_QUESTIONNAIRE_TOOL, type AstralBeamChatCore, type AstralBeamChatCoreOptions, type AstralBeamChatState, type ChatAuthenticationState, type InferParameters, type JsonSchemaObject, type ParametersSchema, RENDER_WIDGET_TOOL, type RenderWidgetInput, SANDBOX_LIST_FILES_TOOL, SANDBOX_PUBLISH_ARTIFACT_TOOL, SANDBOX_READ_FILE_TOOL, SANDBOX_RUN_COMMAND_TOOL, SANDBOX_STATUS_EVENT, SANDBOX_WRITE_FILE_TOOL, type SandboxActivity, type SandboxArtifact, type SandboxCommandRun, type SandboxFileWrite, type SandboxStatus, type StandardSchemaV1, type ToolDefinition, type WidgetDeclaration, type WidgetRenderRequest, buildAgentTools, collectSandboxActivity, createAstralBeamChat, defineTool, defineWidget, describeSandboxCommandRun, hasPendingToolRun, isSandboxTool, isSettledToolCall, lastPartInProgress, readSandboxArtifact, readSandboxCommandRun, readSandboxFileWrite, sandboxRefusal };

package/dist/core.js

@@ -1,2 +1,2 @@
-import { S as SANDBOX_WRITE_FILE_TOOL, _ as SANDBOX_LIST_FILES_TOOL, a as describeSandboxCommandRun, b as SANDBOX_RUN_COMMAND_TOOL, c as readSandboxCommandRun, d as hasPendingToolRun, f as isSettledToolCall, g as RENDER_WIDGET_TOOL, h as ASK_QUESTIONNAIRE_TOOL, i as collectSandboxActivity, l as readSandboxFileWrite, m as buildAgentTools, n as defineWidget, o as isSandboxTool, p as lastPartInProgress, r as createAstralBeamChat, s as readSandboxArtifact, t as defineTool, u as sandboxRefusal, v as SANDBOX_PUBLISH_ARTIFACT_TOOL, x as SANDBOX_STATUS_EVENT, y as SANDBOX_READ_FILE_TOOL } from "./core-9Q6FGvSX.js";
+import { S as SANDBOX_WRITE_FILE_TOOL, _ as SANDBOX_LIST_FILES_TOOL, a as describeSandboxCommandRun, b as SANDBOX_RUN_COMMAND_TOOL, c as readSandboxCommandRun, d as hasPendingToolRun, f as isSettledToolCall, g as RENDER_WIDGET_TOOL, h as ASK_QUESTIONNAIRE_TOOL, i as collectSandboxActivity, l as readSandboxFileWrite, m as buildAgentTools, n as defineWidget, o as isSandboxTool, p as lastPartInProgress, r as createAstralBeamChat, s as readSandboxArtifact, t as defineTool, u as sandboxRefusal, v as SANDBOX_PUBLISH_ARTIFACT_TOOL, x as SANDBOX_STATUS_EVENT, y as SANDBOX_READ_FILE_TOOL } from "./core-BVlttAaO.js";
 export { ASK_QUESTIONNAIRE_TOOL, RENDER_WIDGET_TOOL, SANDBOX_LIST_FILES_TOOL, SANDBOX_PUBLISH_ARTIFACT_TOOL, SANDBOX_READ_FILE_TOOL, SANDBOX_RUN_COMMAND_TOOL, SANDBOX_STATUS_EVENT, SANDBOX_WRITE_FILE_TOOL, buildAgentTools, collectSandboxActivity, createAstralBeamChat, defineTool, defineWidget, describeSandboxCommandRun, hasPendingToolRun, isSandboxTool, isSettledToolCall, lastPartInProgress, readSandboxArtifact, readSandboxCommandRun, readSandboxFileWrite, sandboxRefusal };

package/dist/debug-DyjRg3e0.js

@@ -0,0 +1 @@
+const e=`AstralBeam`,t=`Ask the assistant`,n=`It can answer questions and act through this app's own tools and widgets.`,r=`https://app.astralbeam.ai/api`,i=`/api/astralbeam/token`;function a(e){let t=`${(e??`https://app.astralbeam.ai/api`).replace(/\/+$/,``)}/chat`;return{chat:t,config:`${t}/config`,files:`${t}/files`}}const o=`system`,s=`astralbeam-root`,c=e=>`background:${e};color:#fff;border-radius:3px;padding:1px 5px`,l=`${c(`#7c3aed`)};font-weight:600`,u={mount:`#7c3aed`,auth:`#be185d`,theme:`#8b5cf6`,send:`#2563eb`,run:`#0891b2`,stream:`#0e7490`,text:`#16a34a`,reasoning:`#64748b`,tool:`#d97706`,widget:`#db2777`,attachment:`#0d9488`,sandbox:`#0369a1`,questionnaire:`#9333ea`,status:`#475569`,error:`#dc2626`};function d(e){if(e)return(e,t,n)=>{console.log(`%cAstralBeam%c ${new Date().toISOString().slice(11,19)} %c${e}%c ${t}`,l,`color:#94a3b8;font-weight:400`,c(u[e]),``,...n===void 0?[]:[n])}}export{n as a,s as c,o as i,a as l,r as n,t as o,i as r,e as s,d as t};

package/dist/{index-BBBBbB1x.d.ts → index-DtIS-V14.d.ts}

@@ -3590,10 +3590,10 @@ interface WidgetRenderRequest {
 interface AstralBeamChatCoreOptions {
   /** Public ID of the organization-owned agent; omitted, the organization's default answers. */
   agentId?: string | undefined;
-  /** The AstralBeam chat endpoint. Default the hosted cloud endpoint. */
-  chatEndpoint?: string | undefined;
+  /** Base URL of the AstralBeam API; `/chat` hangs off it. Default the hosted cloud. */
+  apiUrl?: string | undefined;
   /** The application endpoint that mints short-lived chat JWTs. Default `/api/astralbeam/token`. */
-  authEndpoint?: string | undefined;
+  authTokenUrl?: string | undefined;
   /** Host tools the agent can call; `execute` runs wherever this session lives. */
   tools?: Record<string, ToolDefinition> | undefined;
   /** Widgets declared to the agent; `onRenderWidget` is asked to draw them. */

package/dist/react.d.ts

@@ -1,4 +1,4 @@
-import { C as AstralBeamChatState, S as AstralBeamChatCoreOptions, x as AstralBeamChatCore } from "./index-BBBBbB1x.js";
+import { C as AstralBeamChatState, S as AstralBeamChatCoreOptions, x as AstralBeamChatCore } from "./index-DtIS-V14.js";
 import { ReactNode } from "react";
 import { AstralBeamChatAttachmentOptions, AstralBeamChatColorScheme, AstralBeamChatTheme, InferParameters, JsonSchemaObject, ParametersSchema, ToolDefinition, WidgetDefinition as WidgetDefinition$1, defineTool } from "@astralbeam/sdk/client";
 
@@ -63,10 +63,10 @@ interface AstralBeamChatProps {
   emptyTitle?: string;
   /** Subtitle under the empty transcript's headline; prop changes apply immediately. */
   emptyDescription?: string;
-  /** URL of the AstralBeam chat endpoint the widget streams from. Default the hosted cloud endpoint. */
-  chatEndpoint?: string;
+  /** Base URL of the AstralBeam API; the widget calls `/chat` under it. Default the hosted cloud. */
+  apiUrl?: string;
   /** Application endpoint that mints a short-lived chat JWT. Default `"/api/astralbeam/token"`. */
-  authEndpoint?: string;
+  authTokenUrl?: string;
   /** Host-defined tools the agent can call, executed in the host's React app, keyed by name. */
   tools?: Record<string, ToolDefinition>;
   /** Host-defined widgets the agent can render inline in the conversation, keyed by identifier. */

package/dist/react.js

@@ -1,4 +1,4 @@
-import { C as DEFAULT_COLOR_SCHEME, r as createAstralBeamChat } from "./core-9Q6FGvSX.js";
+import { C as DEFAULT_COLOR_SCHEME, r as createAstralBeamChat } from "./core-BVlttAaO.js";
 import { forwardRef, useEffect, useImperativeHandle, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { createPortal } from "react-dom";
 import { defineTool, mountAstralBeamChat } from "@astralbeam/sdk/client";
@@ -42,7 +42,7 @@ function useAstralBeamChat(options) {
 		core
 	};
 }
-const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, showHeader, header, empty, composerActions, emptyTitle, emptyDescription, chatEndpoint, authEndpoint, tools, widgets = {}, colorScheme = DEFAULT_COLOR_SCHEME, theme, attachments, sandboxPanel, debug }, ref) {
+const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, showHeader, header, empty, composerActions, emptyTitle, emptyDescription, apiUrl, authTokenUrl, tools, widgets = {}, colorScheme = DEFAULT_COLOR_SCHEME, theme, attachments, sandboxPanel, debug }, ref) {
 	const targetRef = useRef(null);
 	const handleRef = useRef(null);
 	const [activeRenders, setActiveRenders] = useState(/* @__PURE__ */ new Map());
@@ -140,8 +140,8 @@ const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, show
 		const handle = mountAstralBeamChat(targetRef.current, {
 			...liveRef.current,
 			agentId,
-			chatEndpoint,
-			authEndpoint
+			apiUrl,
+			authTokenUrl
 		});
 		handleRef.current = handle;
 		return () => {

package/dist/server.d.ts

@@ -1,39 +1,57 @@
+import * as Schema from "effect/Schema";
+
 //#region src/server/index.d.ts
-declare const ASTRALBEAM_CHAT_TOKEN_AUDIENCE = "astralbeam-chat";
-declare const ASTRALBEAM_CHAT_TOKEN_ISSUER = "astralbeam-api-key";
-declare const ASTRALBEAM_CHAT_TOKEN_TYPE = "astralbeam-chat+jwt";
-declare const ASTRALBEAM_CHAT_TOKEN_VERSION = 2;
+declare const ASTRALBEAM_TOKEN_AUDIENCE = "astralbeam";
+declare const ASTRALBEAM_CHAT_TOKEN_TYPE = "astralbeam+jwt";
+declare const ASTRALBEAM_CHAT_TOKEN_VERSION = 4;
 declare const ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS = 300;
 declare const ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS = 600;
-interface TenantUser {
-  /** User of an Organization's Tenant who interacts with the embedded agent sidebar. */
-  readonly id: string;
-}
-interface CreateAstralBeamChatTokenOptions<TTenantUser extends TenantUser = TenantUser> {
+declare const TenantSchema: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly name: Schema.optional<Schema.String>;
+  readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+}>;
+declare const TenantUserSchema: Schema.Struct<{
+  readonly id: Schema.String;
+  readonly name: Schema.optional<Schema.String>;
+  readonly admin: Schema.optional<Schema.Boolean>;
+  readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+}>;
+/** Tenant identity from the Organization's application, including JSON metadata. */
+type Tenant = typeof TenantSchema.Type;
+/** User of an Organization's Tenant who interacts with AstralBeam. */
+type TenantUser = typeof TenantUserSchema.Type;
+interface CreateAstralBeamChatTokenOptions<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant> {
   readonly apiKey: string;
-  readonly tenantUser: TTenantUser;
+  readonly user: TTenantUser;
+  readonly tenant: TTenant;
   readonly expiresInSeconds?: number | undefined;
 }
-interface CreateAstralBeamTokenRouteOptions<TTenantUser extends TenantUser = TenantUser> {
+interface CreateAstralBeamTokenRouteOptions<TSession extends object = object, TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant> {
   /** The full API key, or a thunk read per request; missing or empty answers 503. */
   readonly apiKey: string | undefined | (() => string | undefined);
   /**
-   * Authenticates the request against the application's own session and returns the tenant
-   * user minted into the token. Returning nothing, or throwing, answers 401.
+   * Authenticates the request against the application's own session. Returning nothing, or
+   * throwing, answers 401.
    */
-  readonly tenantUser: (request: Request) => TTenantUser | null | undefined | Promise<TTenantUser | null | undefined>;
+  readonly authenticate: (request: Request) => TSession | null | undefined | Promise<TSession | null | undefined>;
+  /** Maps the authenticated session to the tenant user minted into the token. */
+  readonly user: (session: TSession) => TTenantUser;
+  /** Maps the same authenticated session to the tenant minted into the token. */
+  readonly tenant: (session: TSession) => TTenant;
   readonly expiresInSeconds?: number | undefined;
 }
 /**
  * Builds the fetch-standard `POST` handler for an application's token endpoint, owning the
  * method check, the unconfigured-key 503, the unauthenticated 401, and the `no-store` header.
  */
-declare function createAstralBeamTokenRoute<TTenantUser extends TenantUser = TenantUser>(options: CreateAstralBeamTokenRouteOptions<TTenantUser>): (request: Request) => Promise<Response>;
+declare function createAstralBeamTokenRoute<TSession extends object, TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant>(options: CreateAstralBeamTokenRouteOptions<TSession, TTenantUser, TTenant>): (request: Request) => Promise<Response>;
 /** Creates the short-lived bearer token returned by an application's server auth endpoint. */
-declare function createAstralBeamChatToken<TTenantUser extends TenantUser = TenantUser>({
+declare function createAstralBeamChatToken<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant>({
   apiKey,
-  tenantUser,
+  user,
+  tenant,
   expiresInSeconds
-}: CreateAstralBeamChatTokenOptions<TTenantUser>): Promise<string>;
+}: CreateAstralBeamChatTokenOptions<TTenantUser, TTenant>): Promise<string>;
 //#endregion
-export { ASTRALBEAM_CHAT_TOKEN_AUDIENCE, ASTRALBEAM_CHAT_TOKEN_ISSUER, ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_TYPE, ASTRALBEAM_CHAT_TOKEN_VERSION, CreateAstralBeamChatTokenOptions, CreateAstralBeamTokenRouteOptions, TenantUser, createAstralBeamChatToken, createAstralBeamTokenRoute };
+export { ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_TYPE, ASTRALBEAM_CHAT_TOKEN_VERSION, ASTRALBEAM_TOKEN_AUDIENCE, CreateAstralBeamChatTokenOptions, CreateAstralBeamTokenRouteOptions, Tenant, TenantSchema, TenantUser, TenantUserSchema, createAstralBeamChatToken, createAstralBeamTokenRoute };

package/dist/server.js

@@ -638,54 +638,64 @@ var SignJWT = class {
 };
 //#endregion
 //#region src/server/index.ts
-const ASTRALBEAM_CHAT_TOKEN_AUDIENCE = "astralbeam-chat";
-const ASTRALBEAM_CHAT_TOKEN_ISSUER = "astralbeam-api-key";
-const ASTRALBEAM_CHAT_TOKEN_TYPE = "astralbeam-chat+jwt";
-const ASTRALBEAM_CHAT_TOKEN_VERSION = 2;
+const ASTRALBEAM_TOKEN_AUDIENCE = "astralbeam";
+const ASTRALBEAM_CHAT_TOKEN_TYPE = "astralbeam+jwt";
+const ASTRALBEAM_CHAT_TOKEN_VERSION = 4;
 const ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS = 300;
 const ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS = 600;
-const API_KEY_ID_PATTERN = /^key_[0-9a-z]{1,63}_([0-9a-z]{1,63})$/;
-const API_KEY_SECRET_PATTERN = /^abo_[A-Za-z]{64}$/;
 const CHAT_TOKEN_MAX_BYTES = 16384;
-const TENANT_USER_MAX_BYTES = 8192;
-const TENANT_USER_MAX_DEPTH = 10;
+const IDENTITY_MAX_BYTES = 8192;
 const textEncoder = new TextEncoder();
-const TenantUserJsonSchema = Schema.Json.annotate({ message: "tenantUser must contain only JSON values" });
-const TenantUserSchema = Schema.StructWithRest(Schema.Struct({ id: Schema.String.pipe(Schema.check(Schema.makeFilter((value) => value.length >= 1 && value.length <= 255, { message: "tenantUser.id must be a 1-255 character string" }))) }), [Schema.Record(Schema.String, TenantUserJsonSchema)]).pipe(Schema.check(Schema.makeFilter((value) => !exceedsJsonDepth(value, TENANT_USER_MAX_DEPTH), { message: `tenantUser must not exceed ${TENANT_USER_MAX_DEPTH} levels` })), Schema.check(Schema.makeFilter((value) => textEncoder.encode(JSON.stringify(value)).byteLength <= TENANT_USER_MAX_BYTES, { message: `tenantUser must not exceed ${TENANT_USER_MAX_BYTES} bytes` })));
-const decodeTenantUser = Schema.decodeUnknownSync(TenantUserSchema, {
+const SlugSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[0-9a-z-]{1,63}$/)));
+const ApiKeySecretSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^abo_[A-Za-z]{64}$/)));
+const ApiKeySchema = Schema.TemplateLiteral([
+	"key_",
+	SlugSchema,
+	"_",
+	SlugSchema,
+	"_",
+	ApiKeySecretSchema
+]);
+const isApiKey = Schema.is(ApiKeySchema);
+const MetadataSchema = Schema.JsonObject.annotate({ message: "metadata must be a JSON object" });
+const TenantExternalIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => value.length >= 1 && value.length <= 255, { message: "tenant.id must be a 1-255 character string" })));
+const TenantUserExternalIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => value.length >= 1 && value.length <= 255, { message: "user.id must be a 1-255 character string" })));
+const TenantSchema = Schema.Struct({
+	id: TenantExternalIdSchema,
+	name: Schema.optional(Schema.String),
+	metadata: Schema.optional(MetadataSchema)
+});
+const TenantUserSchema = Schema.Struct({
+	id: TenantUserExternalIdSchema,
+	name: Schema.optional(Schema.String),
+	admin: Schema.optional(Schema.Boolean),
+	metadata: Schema.optional(MetadataSchema)
+});
+const IdentitySchema = Schema.Struct({
+	user: TenantUserSchema,
+	tenant: TenantSchema
+}).pipe(Schema.check(Schema.makeFilter((value) => textEncoder.encode(JSON.stringify(value)).byteLength <= IDENTITY_MAX_BYTES, { message: `user and tenant must not exceed ${IDENTITY_MAX_BYTES} bytes` })));
+const decodeIdentity = Schema.decodeUnknownSync(IdentitySchema, {
 	errors: "all",
 	onExcessProperty: "error",
 	reportInput: false
 });
 function parseApiKey(apiKey) {
+	if (!isApiKey(apiKey)) throw new Error("apiKey must match key_<organization>_<key>_abo_<secret>");
 	const separator = apiKey.lastIndexOf("_abo_");
-	const id = apiKey.slice(0, separator);
-	const secret = apiKey.slice(separator + 1);
-	if (!API_KEY_ID_PATTERN.test(id) || !API_KEY_SECRET_PATTERN.test(secret)) throw new Error("apiKey must match key_<organization>_<key>_abo_<secret>");
+	const keyId = apiKey.slice(0, separator);
+	const keySecret = apiKey.slice(separator + 1);
 	return {
-		id,
-		secret
+		keyId,
+		organizationSlug: keyId.slice(4, keyId.indexOf("_", 4)),
+		keySecret
 	};
 }
-function exceedsJsonDepth(value, maximumDepth) {
-	const stack = [{
-		value,
-		depth: 1
-	}];
-	while (stack.length > 0) {
-		const current = stack.pop();
-		if (current.depth > maximumDepth) return true;
-		if (typeof current.value !== "object" || current.value === null) continue;
-		const children = Array.isArray(current.value) ? current.value : Object.values(current.value);
-		for (const child of children) stack.push({
-			value: child,
-			depth: current.depth + 1
-		});
-	}
-	return false;
-}
-function validatedTenantUser(value) {
-	return JSON.parse(JSON.stringify(decodeTenantUser(value)));
+function validatedIdentity(user, tenant) {
+	return JSON.parse(JSON.stringify(decodeIdentity({
+		user,
+		tenant
+	})));
 }
 async function signingKey(secret) {
 	const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(secret));
@@ -706,17 +716,18 @@ function createAstralBeamTokenRoute(options) {
 		if (request.method !== "POST") return tokenRouteResponse({ error: "Use POST" }, 405);
 		const apiKey = typeof options.apiKey === "function" ? options.apiKey() : options.apiKey;
 		if (!apiKey) return tokenRouteResponse({ error: "The AstralBeam API key is not configured" }, 503);
-		let tenantUser;
+		let session;
 		try {
-			tenantUser = await options.tenantUser(request);
+			session = await options.authenticate(request);
 		} catch {
-			tenantUser = void 0;
+			session = void 0;
 		}
-		if (!tenantUser) return tokenRouteResponse({ error: "The session could not be verified" }, 401);
+		if (!session) return tokenRouteResponse({ error: "The session could not be verified" }, 401);
 		try {
 			return tokenRouteResponse({ token: await createAstralBeamChatToken({
 				apiKey,
-				tenantUser,
+				user: options.user(session),
+				tenant: options.tenant(session),
 				...options.expiresInSeconds === void 0 ? {} : { expiresInSeconds: options.expiresInSeconds }
 			}) }, 200);
 		} catch {
@@ -725,21 +736,22 @@ function createAstralBeamTokenRoute(options) {
 	};
 }
 /** Creates the short-lived bearer token returned by an application's server auth endpoint. */
-async function createAstralBeamChatToken({ apiKey, tenantUser, expiresInSeconds = 300 }) {
+async function createAstralBeamChatToken({ apiKey, user, tenant, expiresInSeconds = 300 }) {
 	if (!Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > 600) throw new Error("AstralBeam chat tokens must live for 60-600 seconds");
-	const { id: apiKeyId, secret } = parseApiKey(apiKey);
-	const identity = validatedTenantUser(tenantUser);
+	const { keyId, organizationSlug, keySecret } = parseApiKey(apiKey);
+	const identity = validatedIdentity(user, tenant);
 	const now = Math.floor(Date.now() / 1e3);
 	const token = await new SignJWT({
-		ver: 2,
-		tenantUser: identity
+		ver: 4,
+		user: identity.user,
+		tenant: identity.tenant
 	}).setProtectedHeader({
 		alg: "HS256",
 		typ: ASTRALBEAM_CHAT_TOKEN_TYPE,
-		kid: apiKeyId
-	}).setIssuer(ASTRALBEAM_CHAT_TOKEN_ISSUER).setAudience(ASTRALBEAM_CHAT_TOKEN_AUDIENCE).setSubject(tenantUser.id).setIssuedAt(now).setExpirationTime(now + expiresInSeconds).sign(await signingKey(secret));
+		kid: keyId
+	}).setIssuer(organizationSlug).setAudience(ASTRALBEAM_TOKEN_AUDIENCE).setIssuedAt(now).setExpirationTime(now + expiresInSeconds).sign(await signingKey(keySecret));
 	if (textEncoder.encode(token).byteLength > CHAT_TOKEN_MAX_BYTES) throw new Error(`AstralBeam chat tokens must not exceed ${CHAT_TOKEN_MAX_BYTES} bytes`);
 	return token;
 }
 //#endregion
-export { ASTRALBEAM_CHAT_TOKEN_AUDIENCE, ASTRALBEAM_CHAT_TOKEN_ISSUER, ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_TYPE, ASTRALBEAM_CHAT_TOKEN_VERSION, createAstralBeamChatToken, createAstralBeamTokenRoute };
+export { ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_TYPE, ASTRALBEAM_CHAT_TOKEN_VERSION, ASTRALBEAM_TOKEN_AUDIENCE, TenantSchema, TenantUserSchema, createAstralBeamChatToken, createAstralBeamTokenRoute };