@astralbeam/sdk 0.4.2 → 0.5.0

package/README.md

@@ -64,26 +64,26 @@ export const POST = createAstralBeamTokenRoute({
 - Tokens use the API key's organization slug as issuer and the platform audience `astralbeam`; AstralBeam does not require or interpret `sub`.
 - Tokens are signed, not encrypted: never put a secret in them.
 - Lifetimes are 60–600 seconds; the SDK renews in memory before expiry.
-- The widget POSTs `authTokenUrl` with the page's cookies; pass `authTokenHeaders` (an object, or a function for a rotating credential) when your backend is on another origin behind header auth.
+- `generateAuthToken` says where the token comes from: `{ url, ...init }`, which the widget calls as `fetch(url, init)` with a standard `RequestInit`, or a function returning `{ token }` (or a promise of it, or `undefined` when it cannot mint one).
+- It defaults to `{ url: "/api/astralbeam/token" }`, posted with the page's cookies, and runs again on every renewal, so a rotating credential stays current.
 
 ## Options
 
-Every option is also a prop on `<AstralBeamChat>`; `handle.update(options)` applies any subset in place. `agentId`, `apiUrl`, `authTokenUrl`, and `authTokenHeaders` are fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
-
-| Option                               | Default                         | Meaning                                                         |
-| ------------------------------------ | ------------------------------- | --------------------------------------------------------------- |
-| `agentId`                            | organization's default          | `agt_<organization>_<agent>` from the dashboard                 |
-| `apiUrl`                             | `https://app.astralbeam.ai/api` | Base URL of the AstralBeam API; the widget calls `/chat` there  |
-| `authTokenUrl`                       | `/api/astralbeam/token`         | Your token endpoint                                             |
-| `authTokenHeaders`                   | none                            | Extra token-request headers, for a backend on another origin    |
-| `title`, `showHeader`                | `"AstralBeam"`, `true`          | Header text, and whether the header and reset button show       |
-| `emptyTitle`, `emptyDescription`     | generic copy                    | Headline and subtitle of the empty transcript                   |
-| `colorScheme`, `theme`               | `"system"`, built-in palette    | Light/dark/system, and shadcn token overrides                   |
-| `attachments`                        | `true`                          | `false` hides the feature, or pass limits                       |
-| `tools`, `widgets`                   | none                            | What the agent can do and draw in your app                      |
-| `sandboxPanel`                       | `false`                         | Collected sandbox panel: files with downloads, command log      |
-| `header`, `empty`, `composerActions` | widget's own chrome             | Host-rendered replacements (React props; `slots` on the handle) |
-| `debug`                              | `false`                         | Log every SDK action in the browser and on the server           |
+Every option is also a prop on `<AstralBeamChat>`; `handle.update(options)` applies any subset in place, and no option is fixed at mount. Details in [Configuration](https://app.astralbeam.ai/docs/sdk/configuration).
+
+| Option                               | Default                            | Meaning                                                            |
+| ------------------------------------ | ---------------------------------- | ------------------------------------------------------------------ |
+| `agentId`                            | organization's default             | `agt_<organization>_<agent>` from the dashboard                    |
+| `apiUrl`                             | `https://app.astralbeam.ai/api`    | Base URL of the AstralBeam API; the widget calls `/chat` there     |
+| `generateAuthToken`                  | `{ url: "/api/astralbeam/token" }` | Token endpoint as `{ url, ...RequestInit }`, or a minting function |
+| `title`, `showHeader`                | `"AstralBeam"`, `true`             | Header text, and whether the header and reset button show          |
+| `emptyTitle`, `emptyDescription`     | generic copy                       | Headline and subtitle of the empty transcript                      |
+| `colorScheme`, `theme`               | `"system"`, built-in palette       | Light/dark/system, and shadcn token overrides                      |
+| `attachments`                        | `true`                             | `false` hides the feature, or pass limits                          |
+| `tools`, `widgets`                   | none                               | What the agent can do and draw in your app                         |
+| `sandboxPanel`                       | `false`                            | Collected sandbox panel: files with downloads, command log         |
+| `header`, `empty`, `composerActions` | widget's own chrome                | Host-rendered replacements (React props; `slots` on the handle)    |
+| `debug`                              | `false`                            | Log every SDK action in the browser and on the server              |
 
 A `ref` on `<AstralBeamChat>` (and the vanilla handle) exposes `reset()` and `stop()` for hosts that draw their own controls.
 

package/dist/client.d.ts

@@ -99,10 +99,27 @@ type AstralBeamChatColorScheme = "light" | "dark" | "system";
 /** Overrides for the widget's theming CSS variables, keyed by custom-property name (`"--primary"`). */
 type AstralBeamChatThemeVariables = Record<`--${string}`, string>;
 /**
- * Headers added to the token request: an object for a fixed credential, or a function for one the
- * host must read or await per request, such as a rotating access token.
+ * A token endpoint to call: `{ url, ...init }`, which the widget calls as `fetch(url, init)` with
+ * this object's remaining, standard `RequestInit` fields. The init defaults to `POST`,
+ * `credentials: "include"`, `cache: "no-store"`, and an `accept: application/json` header, each
+ * overridable here, and the response is expected to carry `{ token }` as JSON.
  */
-type AstralBeamChatAuthTokenHeaders = Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);
+interface AstralBeamChatAuthTokenRequest extends RequestInit {
+  url: string;
+}
+/**
+ * Where the widget's short-lived chat JWT comes from: an endpoint to POST, or a function that
+ * mints the token in the host page and returns `{ token }`, optionally as a promise.
+ *
+ * Either form runs again on every renewal — near expiry and after a token is rejected — so a
+ * rotating credential stays current rather than being captured once. A function that returns
+ * `undefined`, or throws, fails authentication closed; the composer's retry link asks again.
+ */
+type AstralBeamChatGenerateAuthToken = AstralBeamChatAuthTokenRequest | (() => {
+  token: string;
+} | undefined | Promise<{
+  token: string;
+} | undefined>);
 /**
  * Custom values for the CSS variables the widget's shadcn theme exposes (`--background`,
  * `--primary`, `--radius`, and the `--font-sans`/`--font-heading`/`--font-mono` stacks, ...),
@@ -115,8 +132,9 @@ interface AstralBeamChatTheme {
 }
 interface MountAstralBeamChatOptions {
   /**
-   * Public ID of the organization-owned agent, fixed for this mounted chat. Omit it to use the
-   * organization's default agent, which the dashboard's agents page selects.
+   * Public ID of the organization-owned agent. Omit it to use the organization's default agent,
+   * which the dashboard's agents page selects. A change answers the next run with the new agent
+   * and keeps the transcript, which that agent then sees as history.
    */
   agentId?: string | undefined;
   /** Name shown in the widget's header. Default `"AstralBeam"`. */
@@ -131,20 +149,18 @@ interface MountAstralBeamChatOptions {
   /** Subtitle shown under the empty transcript's headline. Default describes the app's tools and widgets. */
   emptyDescription?: string | undefined;
   /**
-   * Base URL of the AstralBeam API; the widget calls `/chat` and its subroutes under it. Fixed at
-   * mount. Default `"https://app.astralbeam.ai/api"`, the hosted cloud; self-hosted deployments
-   * must set their own origin.
+   * Base URL of the AstralBeam API; the widget calls `/chat` and its subroutes under it. Read for
+   * every request, so a change moves the next one. Default `"https://app.astralbeam.ai/api"`, the
+   * hosted cloud; self-hosted deployments must set their own origin.
    */
   apiUrl?: string | undefined;
-  /** Application endpoint that mints a short-lived chat JWT. Fixed at mount. Default `"/api/astralbeam/token"`. */
-  authTokenUrl?: string | undefined;
   /**
-   * Extra request headers for `authTokenUrl`, for hosts whose backend sits on another origin and
-   * authenticates with a bearer token or a custom header rather than the page's cookies. Resolved
-   * again on every token request, so pass the function form for a credential that rotates.
-   * Fixed at mount.
+   * Where the short-lived chat JWT comes from: `{ url, ...RequestInit }` for a token endpoint, or
+   * a function that mints `{ token }` in the host page. Read for every token, so a change applies
+   * to the next one, which is minted when the cached token nears expiry. Default
+   * `{ url: "/api/astralbeam/token" }`, posted with the page's cookies.
    */
-  authTokenHeaders?: AstralBeamChatAuthTokenHeaders | undefined;
+  generateAuthToken?: AstralBeamChatGenerateAuthToken | undefined;
   /** Host-defined tools the agent can call, executed in the host page, keyed by tool name. */
   tools?: Record<string, ToolDefinition> | undefined;
   /** Host-defined widgets the agent can render inline in the conversation, keyed by identifier. */
@@ -173,10 +189,11 @@ interface MountAstralBeamChatOptions {
   debug?: boolean | undefined;
 }
 /**
- * Mount options the handle can change afterwards. The agent and the transport URLs are fixed:
- * changing any of them would mean a new client and a discarded transcript.
+ * What the handle's `update` takes: every mount option, none of them fixed. The transport options
+ * are re-read per request rather than captured, so changing them keeps the transcript and the
+ * chat session instead of forcing a fresh mount.
  */
-type AstralBeamChatUpdate = Partial<Omit<MountAstralBeamChatOptions, "agentId" | "apiUrl" | "authTokenUrl" | "authTokenHeaders">>;
+type AstralBeamChatUpdate = Partial<MountAstralBeamChatOptions>;
 interface AstralBeamChatHandle {
   unmount: () => void;
   /**
@@ -210,4 +227,4 @@ declare function defineWidget<const S extends ParametersSchema = JsonSchemaObjec
 //#region src/client/index.d.ts
 declare function mountAstralBeamChat(target: HTMLElement, options: MountAstralBeamChatOptions): AstralBeamChatHandle;
 //#endregion
-export { type AstralBeamChatAttachmentOptions, type AstralBeamChatAuthTokenHeaders, type AstralBeamChatColorScheme, type AstralBeamChatHandle, type AstralBeamChatSlotRenderer, type AstralBeamChatSlots, type AstralBeamChatTheme, type AstralBeamChatThemeVariables, type AstralBeamChatUpdate, type InferParameters, type JsonSchemaObject, type MountAstralBeamChatOptions, type ParametersSchema, type StandardSchemaV1, type ToolDefinition, type TypedToolDefinition, type TypedWidgetDefinition, type WidgetDefinition, defineTool, defineWidget, mountAstralBeamChat };
+export { type AstralBeamChatAttachmentOptions, type AstralBeamChatAuthTokenRequest, type AstralBeamChatColorScheme, type AstralBeamChatGenerateAuthToken, type AstralBeamChatHandle, type AstralBeamChatSlotRenderer, type AstralBeamChatSlots, type AstralBeamChatTheme, type AstralBeamChatThemeVariables, type AstralBeamChatUpdate, type InferParameters, type JsonSchemaObject, type MountAstralBeamChatOptions, type ParametersSchema, type StandardSchemaV1, type ToolDefinition, type TypedToolDefinition, type TypedWidgetDefinition, type WidgetDefinition, defineTool, defineWidget, mountAstralBeamChat };

package/dist/client.js

@@ -1 +1 @@
-import{c as e,t}from"./debug-DyjRg3e0.js";function n(e){return e}function r(e){return e}function i(n,r){let i={...r},a=t(i.debug);a?.(`mount`,`mounting chat widget`,{agentId:i.agentId??`(organization default)`,title:i.title??`AstralBeam`,showHeader:i.showHeader??!0,emptyTitle:i.emptyTitle??`Ask the assistant`,emptyDescription:i.emptyDescription??`It can answer questions and act through this app's own tools and widgets.`,apiUrl:i.apiUrl??`https://app.astralbeam.ai/api`,authentication:`configured`,colorScheme:i.colorScheme??`system`,theme:i.theme,tools:Object.keys(i.tools??{}),widgets:Object.keys(i.widgets??{}),attachments:i.attachments??!0});let o=n.shadowRoot??n.attachShadow({mode:`open`}),s=document.createElement(`div`);s.className=e,s.style.height=`100%`,o.append(s);let c=matchMedia(`(prefers-color-scheme: dark)`),l=new Set,u=e=>{for(let e of l)s.style.removeProperty(e);l.clear();let t={...i.theme?.light,...e?i.theme?.dark:void 0};for(let[e,n]of Object.entries(t))e.startsWith(`--`)&&(s.style.setProperty(e,n),l.add(e))},d=()=>{let e=i.colorScheme??`system`,t=e===`dark`||e===`system`&&c.matches;s.classList.toggle(`dark`,t),u(t),a?.(`theme`,`color scheme "${e}" resolved to ${t?`dark`:`light`}`,{themeVariables:[...l]})};d(),c.addEventListener(`change`,d);let f=!1,p;return import(`./widget-C6NW94JW.js`).then(({renderChat:e})=>{a?.(`mount`,`chat chunk loaded`),f||(p=e(o,s,i))}),{update:e=>{if(Object.hasOwn(e,`agentId`)||Object.hasOwn(e,`apiUrl`)||Object.hasOwn(e,`authTokenUrl`)||Object.hasOwn(e,`authTokenHeaders`))throw Error(`agentId, apiUrl, authTokenUrl, and authTokenHeaders are fixed at mount`);i={...i,...e},a=t(i.debug),a?.(`mount`,`options updated`,{changed:Object.keys(e)}),d(),p?.update(i)},reset:()=>p?.reset(),stop:()=>p?.stop(),unmount:()=>{a?.(`mount`,`unmounting chat widget`),f=!0,c.removeEventListener(`change`,d),p?.dispose(),p=void 0,s.remove()}}}export{n as defineTool,r as defineWidget,i as mountAstralBeamChat};
+import{c as e,t}from"./debug-DyjRg3e0.js";function n(e){return e}function r(e){return e}function i(n,r){let i={...r},a=t(i.debug);a?.(`mount`,`mounting chat widget`,{agentId:i.agentId??`(organization default)`,title:i.title??`AstralBeam`,showHeader:i.showHeader??!0,emptyTitle:i.emptyTitle??`Ask the assistant`,emptyDescription:i.emptyDescription??`It can answer questions and act through this app's own tools and widgets.`,apiUrl:i.apiUrl??`https://app.astralbeam.ai/api`,authentication:`configured`,colorScheme:i.colorScheme??`system`,theme:i.theme,tools:Object.keys(i.tools??{}),widgets:Object.keys(i.widgets??{}),attachments:i.attachments??!0});let o=n.shadowRoot??n.attachShadow({mode:`open`}),s=document.createElement(`div`);s.className=e,s.style.height=`100%`,o.append(s);let c=matchMedia(`(prefers-color-scheme: dark)`),l=new Set,u=e=>{for(let e of l)s.style.removeProperty(e);l.clear();let t={...i.theme?.light,...e?i.theme?.dark:void 0};for(let[e,n]of Object.entries(t))e.startsWith(`--`)&&(s.style.setProperty(e,n),l.add(e))},d=()=>{let e=i.colorScheme??`system`,t=e===`dark`||e===`system`&&c.matches;s.classList.toggle(`dark`,t),u(t),a?.(`theme`,`color scheme "${e}" resolved to ${t?`dark`:`light`}`,{themeVariables:[...l]})};d(),c.addEventListener(`change`,d);let f=!1,p;return import(`./widget-DiGFLZyX.js`).then(({renderChat:e})=>{a?.(`mount`,`chat chunk loaded`),f||(p=e(o,s,i))}),{update:e=>{i={...i,...e},a=t(i.debug),a?.(`mount`,`options updated`,{changed:Object.keys(e)}),d(),p?.update(i)},reset:()=>p?.reset(),stop:()=>p?.stop(),unmount:()=>{a?.(`mount`,`unmounting chat widget`),f=!0,c.removeEventListener(`change`,d),p?.dispose(),p=void 0,s.remove()}}}export{n as defineTool,r as defineWidget,i as mountAstralBeamChat};

package/dist/{core-2LtbAqiQ.js → core-BZxnUlwg.js}

@@ -7861,19 +7861,19 @@ function bearerToken(headers) {
 	const authorization = headers.get("authorization");
 	return authorization?.startsWith("Bearer ") ? authorization.slice(7) : void 0;
 }
-async function postChatToken(options, signal) {
-	const { authTokenUrl, authTokenHeaders, fetchClient } = options;
-	const headers = new Headers({ accept: "application/json" });
-	if (authTokenHeaders) {
-		const extra = typeof authTokenHeaders === "function" ? await authTokenHeaders() : authTokenHeaders;
-		for (const [name, value] of Object.entries(extra)) headers.set(name, value);
-	}
-	const response = await fetchClient(authTokenUrl, {
+async function requestChatToken(options, signal) {
+	const { generateAuthToken, fetchClient } = options;
+	if (typeof generateAuthToken === "function") return (await generateAuthToken())?.token;
+	const { url, ...init } = generateAuthToken;
+	const headers = new Headers(init.headers);
+	if (!headers.has("accept")) headers.set("accept", "application/json");
+	const response = await fetchClient(url, {
 		method: "POST",
-		headers,
 		credentials: "include",
 		cache: "no-store",
-		signal
+		...init,
+		headers,
+		signal: init.signal ? AbortSignal.any([signal, init.signal]) : signal
 	});
 	if (!response.ok) throw new Error(`Authentication endpoint returned HTTP ${response.status}`);
 	return (await response.json())?.token;
@@ -7881,11 +7881,12 @@ async function postChatToken(options, signal) {
 async function fetchChatToken(options) {
 	const { session, onStateChange, debug } = options;
 	const { signal } = session.abortController;
+	const source = typeof options.generateAuthToken === "function" ? "generateAuthToken" : "Authentication endpoint";
 	try {
-		const token = await postChatToken(options, signal);
-		if (typeof token !== "string" || !token) throw new Error("Authentication endpoint did not return a token");
+		const token = await requestChatToken(options, signal);
+		if (typeof token !== "string" || !token) throw new Error(`${source} did not return a token`);
 		const expiresAt = tokenExpiry(token);
-		if (expiresAt <= Date.now()) throw new Error("Authentication endpoint returned an expired token");
+		if (expiresAt <= Date.now()) throw new Error(`${source} returned an expired token`);
 		session.cached = {
 			value: token,
 			expiresAt
@@ -8081,9 +8082,8 @@ function describeSandboxCommandRun(run) {
 * whole UI is another.
 */
 function createAstralBeamChat(options) {
-	const debug = createDebugLogger(options.debug);
-	const urls = chatApiUrls(options.apiUrl);
-	const widgets = options.widgets ?? {};
+	let live = { ...options };
+	let debug = createDebugLogger(live.debug);
 	const listeners = /* @__PURE__ */ new Set();
 	let state = {
 		messages: [],
@@ -8105,8 +8105,7 @@ function createAstralBeamChat(options) {
 		for (const listener of listeners) listener();
 	};
 	const authentication = {
-		authTokenUrl: options.authTokenUrl ?? "/api/astralbeam/token",
-		authTokenHeaders: options.authTokenHeaders,
+		generateAuthToken: live.generateAuthToken ?? { url: "/api/astralbeam/token" },
 		session: {
 			cached: void 0,
 			refreshPromise: void 0,
@@ -8117,10 +8116,10 @@ function createAstralBeamChat(options) {
 		debug
 	};
 	initializeChatAuthentication(authentication).catch(() => void 0);
-	(async () => {
+	const resolveCapabilities = async () => {
 		try {
-			const url = new URL(urls.config, globalThis.location?.href);
-			if (options.agentId) url.searchParams.set("agentId", options.agentId);
+			const url = new URL(chatApiUrls(live.apiUrl).config, globalThis.location?.href);
+			if (live.agentId) url.searchParams.set("agentId", live.agentId);
 			const token = await getValidChatToken(authentication);
 			const response = await fetch(url, { headers: { authorization: `Bearer ${token}` } });
 			if (!response.ok) throw new Error(`The config request answered ${response.status}`);
@@ -8129,20 +8128,22 @@ function createAstralBeamChat(options) {
 		} catch (error) {
 			debug?.("error", "agent capabilities could not be resolved; keeping the defaults", error);
 		}
-	})();
+	};
+	resolveCapabilities();
 	const renderCleanups = /* @__PURE__ */ new Map();
 	const disposeRenders = () => {
 		for (const cleanup of renderCleanups.values()) cleanup();
 		renderCleanups.clear();
 	};
 	const renderWidget = async (input, toolCallId) => {
+		const widgets = live.widgets ?? {};
 		if (!Object.hasOwn(widgets, input.widget)) throw new Error(`Unknown widget "${input.widget}"`);
 		const declaration = widgets[input.widget];
 		const validated = await validateParameters(declaration?.parameters, input.props ?? {});
 		if (validated == null) throw new Error(`Props for widget "${input.widget}" failed validation`);
 		renderCleanups.get(toolCallId)?.();
 		renderCleanups.delete(toolCallId);
-		const cleanup = options.onRenderWidget?.({
+		const cleanup = live.onRenderWidget?.({
 			widget: input.widget,
 			props: validated,
 			toolCallId
@@ -8150,11 +8151,16 @@ function createAstralBeamChat(options) {
 		if (cleanup) renderCleanups.set(toolCallId, cleanup);
 		return {
 			widget: input.widget,
-			rendered: options.onRenderWidget !== void 0
+			rendered: live.onRenderWidget !== void 0
 		};
 	};
+	const agentTools = () => buildAgentTools(live.widgets ?? {}, live.tools ?? {}, renderWidget, debug);
+	const forwardedProps = () => ({
+		...live.agentId ? { agentId: live.agentId } : {},
+		...live.debug ? { debug: true } : {}
+	});
 	const client = new ChatClient({
-		connection: fetchServerSentEvents(urls.chat, async () => ({
+		connection: fetchServerSentEvents(() => chatApiUrls(live.apiUrl).chat, async () => ({
 			headers: { authorization: `Bearer ${await getValidChatToken(authentication)}` },
 			fetchClient: (input, init) => fetchAuthenticatedChat({
 				...authentication,
@@ -8162,11 +8168,8 @@ function createAstralBeamChat(options) {
 				init
 			})
 		})),
-		tools: buildAgentTools(widgets, options.tools ?? {}, renderWidget, debug),
-		forwardedProps: {
-			...options.agentId ? { agentId: options.agentId } : {},
-			...options.debug ? { debug: true } : {}
-		},
+		tools: agentTools(),
+		forwardedProps: forwardedProps(),
 		onMessagesChange: (messages) => {
 			update({
 				messages,
@@ -8213,6 +8216,22 @@ function createAstralBeamChat(options) {
 			listeners.add(listener);
 			return () => listeners.delete(listener);
 		},
+		updateOptions: (next) => {
+			const agent = live.agentId;
+			const apiUrl = live.apiUrl;
+			live = {
+				...live,
+				...next
+			};
+			debug = createDebugLogger(live.debug);
+			authentication.generateAuthToken = live.generateAuthToken ?? { url: "/api/astralbeam/token" };
+			authentication.debug = debug;
+			client.updateOptions({
+				tools: agentTools(),
+				forwardedProps: forwardedProps()
+			});
+			if (live.agentId !== agent || live.apiUrl !== apiUrl) resolveCapabilities();
+		},
 		sendMessage: (content) => {
 			settleDanglingToolCalls();
 			return client.sendMessage(content);

package/dist/core.d.ts

@@ -1,2 +1,2 @@
-import { A as SandboxActivity, C as AstralBeamChatState, D as WidgetDeclaration, E as ChatAuthenticationState, F as InferParameters, I as JsonSchemaObject, L as ParametersSchema, M as SandboxCommandRun, N as SandboxFileWrite, O as buildAgentTools, P as SandboxStatus, R as StandardSchemaV1, S as AstralBeamChatCoreOptions, T as createAstralBeamChat, _ as sandboxRefusal, a as SANDBOX_LIST_FILES_TOOL, b as lastPartInProgress, c as SANDBOX_RUN_COMMAND_TOOL, d as collectSandboxActivity, f as describeSandboxCommandRun, g as readSandboxFileWrite, h as readSandboxCommandRun, i as RENDER_WIDGET_TOOL, j as SandboxArtifact, k as RenderWidgetInput, l as SANDBOX_STATUS_EVENT, m as readSandboxArtifact, n as defineWidget, o as SANDBOX_PUBLISH_ARTIFACT_TOOL, p as isSandboxTool, r as ASK_QUESTIONNAIRE_TOOL, s as SANDBOX_READ_FILE_TOOL, t as defineTool, u as SANDBOX_WRITE_FILE_TOOL, v as hasPendingToolRun, w as WidgetRenderRequest, x as AstralBeamChatCore, y as isSettledToolCall, z as ToolDefinition } from "./index-DJWIt_VP.js";
+import { A as SandboxActivity, C as AstralBeamChatState, D as WidgetDeclaration, E as ChatAuthenticationState, F as InferParameters, I as JsonSchemaObject, L as ParametersSchema, M as SandboxCommandRun, N as SandboxFileWrite, O as buildAgentTools, P as SandboxStatus, R as StandardSchemaV1, S as AstralBeamChatCoreOptions, T as createAstralBeamChat, _ as sandboxRefusal, a as SANDBOX_LIST_FILES_TOOL, b as lastPartInProgress, c as SANDBOX_RUN_COMMAND_TOOL, d as collectSandboxActivity, f as describeSandboxCommandRun, g as readSandboxFileWrite, h as readSandboxCommandRun, i as RENDER_WIDGET_TOOL, j as SandboxArtifact, k as RenderWidgetInput, l as SANDBOX_STATUS_EVENT, m as readSandboxArtifact, n as defineWidget, o as SANDBOX_PUBLISH_ARTIFACT_TOOL, p as isSandboxTool, r as ASK_QUESTIONNAIRE_TOOL, s as SANDBOX_READ_FILE_TOOL, t as defineTool, u as SANDBOX_WRITE_FILE_TOOL, v as hasPendingToolRun, w as WidgetRenderRequest, x as AstralBeamChatCore, y as isSettledToolCall, z as ToolDefinition } from "./index-8NUgB59m.js";
 export { ASK_QUESTIONNAIRE_TOOL, type AstralBeamChatCore, type AstralBeamChatCoreOptions, type AstralBeamChatState, type ChatAuthenticationState, type InferParameters, type JsonSchemaObject, type ParametersSchema, RENDER_WIDGET_TOOL, type RenderWidgetInput, SANDBOX_LIST_FILES_TOOL, SANDBOX_PUBLISH_ARTIFACT_TOOL, SANDBOX_READ_FILE_TOOL, SANDBOX_RUN_COMMAND_TOOL, SANDBOX_STATUS_EVENT, SANDBOX_WRITE_FILE_TOOL, type SandboxActivity, type SandboxArtifact, type SandboxCommandRun, type SandboxFileWrite, type SandboxStatus, type StandardSchemaV1, type ToolDefinition, type WidgetDeclaration, type WidgetRenderRequest, buildAgentTools, collectSandboxActivity, createAstralBeamChat, defineTool, defineWidget, describeSandboxCommandRun, hasPendingToolRun, isSandboxTool, isSettledToolCall, lastPartInProgress, readSandboxArtifact, readSandboxCommandRun, readSandboxFileWrite, sandboxRefusal };

package/dist/core.js

@@ -1,2 +1,2 @@
-import { S as SANDBOX_WRITE_FILE_TOOL, _ as SANDBOX_LIST_FILES_TOOL, a as describeSandboxCommandRun, b as SANDBOX_RUN_COMMAND_TOOL, c as readSandboxCommandRun, d as hasPendingToolRun, f as isSettledToolCall, g as RENDER_WIDGET_TOOL, h as ASK_QUESTIONNAIRE_TOOL, i as collectSandboxActivity, l as readSandboxFileWrite, m as buildAgentTools, n as defineWidget, o as isSandboxTool, p as lastPartInProgress, r as createAstralBeamChat, s as readSandboxArtifact, t as defineTool, u as sandboxRefusal, v as SANDBOX_PUBLISH_ARTIFACT_TOOL, x as SANDBOX_STATUS_EVENT, y as SANDBOX_READ_FILE_TOOL } from "./core-2LtbAqiQ.js";
+import { S as SANDBOX_WRITE_FILE_TOOL, _ as SANDBOX_LIST_FILES_TOOL, a as describeSandboxCommandRun, b as SANDBOX_RUN_COMMAND_TOOL, c as readSandboxCommandRun, d as hasPendingToolRun, f as isSettledToolCall, g as RENDER_WIDGET_TOOL, h as ASK_QUESTIONNAIRE_TOOL, i as collectSandboxActivity, l as readSandboxFileWrite, m as buildAgentTools, n as defineWidget, o as isSandboxTool, p as lastPartInProgress, r as createAstralBeamChat, s as readSandboxArtifact, t as defineTool, u as sandboxRefusal, v as SANDBOX_PUBLISH_ARTIFACT_TOOL, x as SANDBOX_STATUS_EVENT, y as SANDBOX_READ_FILE_TOOL } from "./core-BZxnUlwg.js";
 export { ASK_QUESTIONNAIRE_TOOL, RENDER_WIDGET_TOOL, SANDBOX_LIST_FILES_TOOL, SANDBOX_PUBLISH_ARTIFACT_TOOL, SANDBOX_READ_FILE_TOOL, SANDBOX_RUN_COMMAND_TOOL, SANDBOX_STATUS_EVENT, SANDBOX_WRITE_FILE_TOOL, buildAgentTools, collectSandboxActivity, createAstralBeamChat, defineTool, defineWidget, describeSandboxCommandRun, hasPendingToolRun, isSandboxTool, isSettledToolCall, lastPartInProgress, readSandboxArtifact, readSandboxCommandRun, readSandboxFileWrite, sandboxRefusal };

package/dist/{index-DJWIt_VP.d.ts → index-8NUgB59m.d.ts}

@@ -3306,10 +3306,27 @@ interface ToolDefinition {
   execute: (input: Record<string, unknown>) => unknown | Promise<unknown>;
 }
 /**
- * Headers added to the token request: an object for a fixed credential, or a function for one the
- * host must read or await per request, such as a rotating access token.
+ * A token endpoint to call: `{ url, ...init }`, which the widget calls as `fetch(url, init)` with
+ * this object's remaining, standard `RequestInit` fields. The init defaults to `POST`,
+ * `credentials: "include"`, `cache: "no-store"`, and an `accept: application/json` header, each
+ * overridable here, and the response is expected to carry `{ token }` as JSON.
  */
-type AstralBeamChatAuthTokenHeaders = Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);
+interface AstralBeamChatAuthTokenRequest extends RequestInit {
+  url: string;
+}
+/**
+ * Where the widget's short-lived chat JWT comes from: an endpoint to POST, or a function that
+ * mints the token in the host page and returns `{ token }`, optionally as a promise.
+ *
+ * Either form runs again on every renewal — near expiry and after a token is rejected — so a
+ * rotating credential stays current rather than being captured once. A function that returns
+ * `undefined`, or throws, fails authentication closed; the composer's retry link asks again.
+ */
+type AstralBeamChatGenerateAuthToken = AstralBeamChatAuthTokenRequest | (() => {
+  token: string;
+} | undefined | Promise<{
+  token: string;
+} | undefined>);
 //#endregion
 //#region src/lib/debug.d.ts
 declare const CATEGORY_COLORS: {
@@ -3597,14 +3614,12 @@ interface AstralBeamChatCoreOptions {
   agentId?: string | undefined;
   /** Base URL of the AstralBeam API; `/chat` hangs off it. Default the hosted cloud. */
   apiUrl?: string | undefined;
-  /** The application endpoint that mints short-lived chat JWTs. Default `/api/astralbeam/token`. */
-  authTokenUrl?: string | undefined;
   /**
-   * Extra headers for the token request, for a backend on another origin that authenticates with a
-   * bearer token or custom header instead of cookies. Resolved on every token request, so pass the
-   * function form for a credential that rotates.
+   * Where short-lived chat JWTs come from: `{ url, ...RequestInit }` for a token endpoint, or a
+   * function minting `{ token }` in the host page. Either runs again on every renewal.
+   * Default `{ url: "/api/astralbeam/token" }`.
    */
-  authTokenHeaders?: AstralBeamChatAuthTokenHeaders | undefined;
+  generateAuthToken?: AstralBeamChatGenerateAuthToken | undefined;
   /** Host tools the agent can call; `execute` runs wherever this session lives. */
   tools?: Record<string, ToolDefinition> | undefined;
   /** Widgets declared to the agent; `onRenderWidget` is asked to draw them. */
@@ -3631,6 +3646,11 @@ interface AstralBeamChatCore {
   getState: () => AstralBeamChatState;
   /** Notifies on every state change; returns the unsubscribe. */
   subscribe: (listener: () => void) => () => void;
+  /**
+   * Merges option changes into the session and applies them in place, keeping the transcript and
+   * the chat session. Only the keys given are replaced.
+   */
+  updateOptions: (options: Partial<AstralBeamChatCoreOptions>) => void;
   /** Sends a message, first settling any dangling tool calls so the run can proceed. */
   sendMessage: (content: string | MultimodalContent) => Promise<void>;
   /** Resolves a client tool call the host executed itself (a questionnaire, an approval). */

package/dist/react.d.ts

@@ -1,6 +1,6 @@
-import { C as AstralBeamChatState, S as AstralBeamChatCoreOptions, x as AstralBeamChatCore } from "./index-DJWIt_VP.js";
+import { C as AstralBeamChatState, S as AstralBeamChatCoreOptions, x as AstralBeamChatCore } from "./index-8NUgB59m.js";
 import { ReactNode } from "react";
-import { AstralBeamChatAttachmentOptions, AstralBeamChatAuthTokenHeaders, AstralBeamChatColorScheme, AstralBeamChatTheme, InferParameters, JsonSchemaObject, ParametersSchema, ToolDefinition, WidgetDefinition as WidgetDefinition$1, defineTool } from "@astralbeam/sdk/client";
+import { AstralBeamChatAttachmentOptions, AstralBeamChatAuthTokenRequest, AstralBeamChatColorScheme, AstralBeamChatGenerateAuthToken, AstralBeamChatTheme, InferParameters, JsonSchemaObject, ParametersSchema, ToolDefinition, WidgetDefinition as WidgetDefinition$1, defineTool } from "@astralbeam/sdk/client";
 
 //#region src/react/index.d.ts
 interface WidgetDefinition extends Omit<WidgetDefinition$1, "render"> {
@@ -26,11 +26,9 @@ interface UseAstralBeamChatResult extends AstralBeamChatState {
 }
 /**
  * The headless chat session as a React hook: authentication, transport, tools, and transcript
- * state with no markup, for hosts that own their whole chat UI. Transport identity (endpoints,
- * agent) and the declared tool/widget set are fixed for the component's lifetime — remount with
- * a React `key` to change them — but `execute` and `onRenderWidget` read the latest render, so
- * ordinary closures over props and state stay live. Whether a widget renderer exists at all is
- * part of the declared surface and is read at mount.
+ * state with no markup, for hosts that own their whole chat UI. Every option follows the props it
+ * is given, keeping the transcript and the chat session, so ordinary closures over props and
+ * state stay live and nothing needs a remount.
  */
 declare function useAstralBeamChat(options: AstralBeamChatCoreOptions): UseAstralBeamChatResult;
 /** Imperative surface of a mounted `<AstralBeamChat>`, for hosts that draw their own controls. */
@@ -42,15 +40,16 @@ interface AstralBeamChatRef {
 }
 interface AstralBeamChatProps {
   /**
-   * Public ID of the organization-owned agent, fixed for this mounted chat. Omit it to use the
-   * organization's default agent, which the dashboard's agents page selects.
+   * Public ID of the organization-owned agent. Omit it to use the organization's default agent,
+   * which the dashboard's agents page selects. A change answers the next run with the new agent
+   * and keeps the transcript, which that agent then sees as history.
    */
   agentId?: string;
-  /** Name shown in the widget's header; prop changes apply immediately. Default `"AstralBeam"`. */
+  /** Name shown in the widget's header. Default `"AstralBeam"`. */
   title?: string;
   /**
    * Shows the widget's header with the title and the reset button; `false` hides both and gives
-   * the transcript the full height. Prop changes apply immediately. Default `true`.
+   * the transcript the full height. Default `true`.
    */
   showHeader?: boolean;
   /** Replaces the header's content with the host's own React content; `showHeader` still applies. */
@@ -59,28 +58,29 @@ interface AstralBeamChatProps {
   empty?: ReactNode;
   /** Extra host controls at the end of the composer's button row, next to send. */
   composerActions?: ReactNode;
-  /** Headline shown on the empty transcript; prop changes apply immediately. Default `"Ask the assistant"`. */
+  /** Headline shown on the empty transcript. Default `"Ask the assistant"`. */
   emptyTitle?: string;
-  /** Subtitle under the empty transcript's headline; prop changes apply immediately. */
+  /** Subtitle under the empty transcript's headline. */
   emptyDescription?: string;
-  /** Base URL of the AstralBeam API; the widget calls `/chat` under it. Default the hosted cloud. */
+  /**
+   * Base URL of the AstralBeam API; the widget calls `/chat` under it. Read per request, so a
+   * change moves the next one. Default the hosted cloud.
+   */
   apiUrl?: string;
-  /** Application endpoint that mints a short-lived chat JWT. Default `"/api/astralbeam/token"`. */
-  authTokenUrl?: string;
   /**
-   * Extra headers for the token request, for a backend on another origin that authenticates with a
-   * bearer token or custom header instead of cookies. Always read from the latest render, so an
-   * inline object or callback over current auth state is fine, needs no memoization, and may
-   * start out undefined while the host's own credential loads.
+   * Where the short-lived chat JWT comes from: `{ url, ...RequestInit }` for a token endpoint, or
+   * a function minting `{ token }`, optionally a promise, in the host app. Read per token, and
+   * the function form runs in the host's React tree, so an inline closure over current auth state
+   * is fine and needs no memoization. Default `{ url: "/api/astralbeam/token" }`.
    */
-  authTokenHeaders?: AstralBeamChatAuthTokenHeaders;
+  generateAuthToken?: AstralBeamChatGenerateAuthToken;
   /** Host-defined tools the agent can call, executed in the host's React app, keyed by name. */
   tools?: Record<string, ToolDefinition>;
   /** Host-defined widgets the agent can render inline in the conversation, keyed by identifier. */
   widgets?: Record<string, WidgetDefinition>;
-  /** Color scheme of the chat widget; prop changes apply immediately. Default `"system"`. */
+  /** Color scheme of the chat widget. Default `"system"`. */
   colorScheme?: AstralBeamChatColorScheme;
-  /** Custom values for the widget's theming CSS variables, per color scheme; changes apply immediately. */
+  /** Custom values for the widget's theming CSS variables, per color scheme. */
   theme?: AstralBeamChatTheme | undefined;
   /** File attachments in the composer, on by default; `false` turns them off. */
   attachments?: boolean | AstralBeamChatAttachmentOptions;
@@ -88,10 +88,10 @@ interface AstralBeamChatProps {
   sandboxPanel?: boolean;
   /**
    * Logs every SDK action to the browser console with UTC timestamps and full payloads,
-   * and asks the endpoint to log its side of the run too; prop changes apply immediately.
+   * and asks the endpoint to log its side of the run too.
    */
   debug?: boolean;
 }
 declare const AstralBeamChat: import("react").ForwardRefExoticComponent<AstralBeamChatProps & import("react").RefAttributes<AstralBeamChatRef>>;
 //#endregion
-export { AstralBeamChat, type AstralBeamChatAttachmentOptions, type AstralBeamChatAuthTokenHeaders, type AstralBeamChatColorScheme, type AstralBeamChatCore, type AstralBeamChatCoreOptions, AstralBeamChatProps, AstralBeamChatRef, type AstralBeamChatState, type AstralBeamChatTheme, type InferParameters, type ParametersSchema, type ToolDefinition, TypedReactWidgetDefinition, UseAstralBeamChatResult, WidgetDefinition, defineTool, defineWidget, useAstralBeamChat };
+export { AstralBeamChat, type AstralBeamChatAttachmentOptions, type AstralBeamChatAuthTokenRequest, type AstralBeamChatColorScheme, type AstralBeamChatCore, type AstralBeamChatCoreOptions, type AstralBeamChatGenerateAuthToken, AstralBeamChatProps, AstralBeamChatRef, type AstralBeamChatState, type AstralBeamChatTheme, type InferParameters, type ParametersSchema, type ToolDefinition, TypedReactWidgetDefinition, UseAstralBeamChatResult, WidgetDefinition, defineTool, defineWidget, useAstralBeamChat };

package/dist/react.js

@@ -1,4 +1,4 @@
-import { C as DEFAULT_COLOR_SCHEME, r as createAstralBeamChat } from "./core-2LtbAqiQ.js";
+import { C as DEFAULT_COLOR_SCHEME, r as createAstralBeamChat } from "./core-BZxnUlwg.js";
 import { forwardRef, useEffect, useImperativeHandle, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { createPortal } from "react-dom";
 import { defineTool, mountAstralBeamChat } from "@astralbeam/sdk/client";
@@ -10,27 +10,24 @@ function defineWidget(widget) {
 }
 /**
 * The headless chat session as a React hook: authentication, transport, tools, and transcript
-* state with no markup, for hosts that own their whole chat UI. Transport identity (endpoints,
-* agent) and the declared tool/widget set are fixed for the component's lifetime — remount with
-* a React `key` to change them — but `execute` and `onRenderWidget` read the latest render, so
-* ordinary closures over props and state stay live. Whether a widget renderer exists at all is
-* part of the declared surface and is read at mount.
+* state with no markup, for hosts that own their whole chat UI. Every option follows the props it
+* is given, keeping the transcript and the chat session, so ordinary closures over props and
+* state stay live and nothing needs a remount.
 */
 function useAstralBeamChat(options) {
-	const optionsRef = useRef(options);
-	optionsRef.current = options;
-	const [core] = useState(() => createAstralBeamChat({
-		...options,
-		tools: Object.fromEntries(Object.entries(options.tools ?? {}).map(([name, definition]) => [name, {
-			...definition,
-			execute: (input) => {
-				const current = optionsRef.current.tools?.[name];
-				if (!current) throw new Error(`Tool "${name}" is no longer registered`);
-				return current.execute(input);
-			}
-		}])),
-		onRenderWidget: options.onRenderWidget === void 0 ? void 0 : (request) => optionsRef.current.onRenderWidget?.(request)
-	}));
+	const [core] = useState(() => createAstralBeamChat(options));
+	useEffect(() => {
+		core.updateOptions(options);
+	}, [
+		core,
+		options.agentId,
+		options.apiUrl,
+		options.generateAuthToken,
+		options.tools,
+		options.widgets,
+		options.onRenderWidget,
+		options.debug
+	]);
 	useEffect(() => () => core.dispose(), [core]);
 	return {
 		...useSyncExternalStore(core.subscribe, core.getState, core.getState),
@@ -42,7 +39,7 @@ function useAstralBeamChat(options) {
 		core
 	};
 }
-const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, showHeader, header, empty, composerActions, emptyTitle, emptyDescription, apiUrl, authTokenUrl, authTokenHeaders, tools, widgets = {}, colorScheme = DEFAULT_COLOR_SCHEME, theme, attachments, sandboxPanel, debug }, ref) {
+const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, showHeader, header, empty, composerActions, emptyTitle, emptyDescription, apiUrl, generateAuthToken, tools, widgets = {}, colorScheme = DEFAULT_COLOR_SCHEME, theme, attachments, sandboxPanel, debug }, ref) {
 	const targetRef = useRef(null);
 	const handleRef = useRef(null);
 	const [activeRenders, setActiveRenders] = useState(/* @__PURE__ */ new Map());
@@ -54,10 +51,6 @@ const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, show
 	useEffect(() => {
 		toolsRef.current = tools;
 	});
-	const authTokenHeadersRef = useRef(authTokenHeaders);
-	useEffect(() => {
-		authTokenHeadersRef.current = authTokenHeaders;
-	});
 	const nextRenderKey = useRef(0);
 	const hostTools = useMemo(() => Object.fromEntries(Object.entries(tools ?? {}).map(([name, definition]) => [name, {
 		...definition,
@@ -111,6 +104,9 @@ const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, show
 		hasComposerActions
 	]);
 	const live = useMemo(() => ({
+		agentId,
+		apiUrl,
+		generateAuthToken,
 		title,
 		showHeader,
 		emptyTitle,
@@ -124,6 +120,9 @@ const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, show
 		widgets: hostWidgets,
 		slots: chromeSlots
 	}), [
+		agentId,
+		apiUrl,
+		generateAuthToken,
 		title,
 		showHeader,
 		emptyTitle,
@@ -141,16 +140,7 @@ const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, show
 	liveRef.current = live;
 	useEffect(() => {
 		if (!targetRef.current) return;
-		const handle = mountAstralBeamChat(targetRef.current, {
-			...liveRef.current,
-			agentId,
-			apiUrl,
-			authTokenUrl,
-			authTokenHeaders: () => {
-				const current = authTokenHeadersRef.current;
-				return typeof current === "function" ? current() : current ?? {};
-			}
-		});
+		const handle = mountAstralBeamChat(targetRef.current, liveRef.current);
 		handleRef.current = handle;
 		return () => {
 			handleRef.current = null;