@astralbeam/sdk 0.5.0 → 0.7.0

package/dist/{index-8NUgB59m.d.ts → index-CudekMKM.d.ts}

@@ -3305,6 +3305,47 @@ interface ToolDefinition {
    */
   execute: (input: Record<string, unknown>) => unknown | Promise<unknown>;
 }
+/**
+ * Limits and accepted types for the composer's file attachments. Every field is optional;
+ * omitting the whole option leaves attachments enabled with the defaults below.
+ */
+interface AstralBeamChatAttachmentOptions {
+  /** Hides the attach button (and ignores drops and pastes) when `false`. Default `true`. */
+  enabled?: boolean | undefined;
+  /** How many files one message may carry. Default `5`. */
+  maxFiles?: number | undefined;
+  /**
+   * Ceiling for a single file, in bytes. The widget also applies its own per-kind caps
+   * (5 MB image, 10 MB PDF, 1 MB text file), so the smaller of the two wins.
+   */
+  maxFileBytes?: number | undefined;
+  /** Ceiling for all files on one message, in bytes. Default 20 MB. */
+  maxTotalBytes?: number | undefined;
+  /**
+   * Narrows what the composer takes, as MIME types or `type/*` patterns (`["image/*"]` for
+   * images only). Omit to accept everything the chat endpoint supports: PNG, JPEG, WebP and
+   * GIF images, PDFs, and text files (which the endpoint reads as text for the agent).
+   */
+  accept?: readonly string[] | undefined;
+}
+/**
+ * Draws host content into `container`, a light-DOM element the widget projects into the
+ * named area. May return a cleanup, called when the slot is replaced and on unmount.
+ */
+type AstralBeamChatSlotRenderer = (container: HTMLElement) => (() => void) | void;
+/** Host-rendered replacements for the widget's own chrome; each renders in the host page's style. */
+interface AstralBeamChatSlots {
+  /** Replaces the header's content (title and reset button); `showHeader: false` still hides the row. */
+  header?: AstralBeamChatSlotRenderer | undefined;
+  /** Replaces the empty-transcript state (icon, headline, and subtitle). */
+  empty?: AstralBeamChatSlotRenderer | undefined;
+  /** Extra controls at the end of the composer's button row, next to send. */
+  composerActions?: AstralBeamChatSlotRenderer | undefined;
+}
+/** Color scheme of the chat widget; `"system"` follows the OS `prefers-color-scheme` setting. */
+type AstralBeamChatColorScheme = "light" | "dark" | "system";
+/** Overrides for the widget's theming CSS variables, keyed by custom-property name (`"--primary"`). */
+type AstralBeamChatThemeVariables = Record<`--${string}`, string>;
 /**
  * A token endpoint to call: `{ url, ...init }`, which the widget calls as `fetch(url, init)` with
  * this object's remaining, standard `RequestInit` fields. The init defaults to `POST`,
@@ -3315,18 +3356,91 @@ interface AstralBeamChatAuthTokenRequest extends RequestInit {
   url: string;
 }
 /**
- * Where the widget's short-lived chat JWT comes from: an endpoint to POST, or a function that
+ * Where the widget's short-lived chat auth token comes from: an endpoint to POST, or a function that
  * mints the token in the host page and returns `{ token }`, optionally as a promise.
  *
  * Either form runs again on every renewal — near expiry and after a token is rejected — so a
  * rotating credential stays current rather than being captured once. A function that returns
  * `undefined`, or throws, fails authentication closed; the composer's retry link asks again.
  */
-type AstralBeamChatGenerateAuthToken = AstralBeamChatAuthTokenRequest | (() => {
+type AstralBeamChatAuthTokenSource = AstralBeamChatAuthTokenRequest | (() => {
   token: string;
 } | undefined | Promise<{
   token: string;
 } | undefined>);
+/**
+ * Custom values for the CSS variables the widget's shadcn theme exposes (`--background`,
+ * `--primary`, `--radius`, and the `--font-sans`/`--font-heading`/`--font-mono` stacks, ...),
+ * mirroring shadcn's `:root`/`.dark` split: `light` is the base applied in both color schemes,
+ * and `dark` overrides it when the resolved scheme is dark.
+ */
+interface AstralBeamChatTheme {
+  light?: AstralBeamChatThemeVariables | undefined;
+  dark?: AstralBeamChatThemeVariables | undefined;
+}
+/**
+ * Every option of the drop-in chat widget, and the one documented source the React props and the
+ * headless core options are derived from. Each is optional and accepts an explicit `undefined`, so
+ * a host with `exactOptionalPropertyTypes` can pass a value it does not have yet.
+ */
+interface MountAstralBeamChatOptions {
+  /**
+   * Public ID of the organization-owned agent. Omit it to use the organization's default agent,
+   * which the dashboard's agents page selects. A change answers the next run with the new agent
+   * and keeps the transcript, which that agent then sees as history.
+   */
+  agentId?: string | undefined;
+  /** Name shown in the widget's header. Default `"AstralBeam"`. */
+  title?: string | undefined;
+  /**
+   * Shows the widget's header, which carries the title and the reset button. `false` hides both
+   * and gives the transcript the full height. Default `true`.
+   */
+  showHeader?: boolean | undefined;
+  /** Headline shown on the empty transcript. Default `"Ask the assistant"`. */
+  emptyTitle?: string | undefined;
+  /** Subtitle shown under the empty transcript's headline. Default describes the app's tools and widgets. */
+  emptyDescription?: string | undefined;
+  /**
+   * Base URL of the AstralBeam API; the widget calls `/chat` and its subroutes under it. Read for
+   * every request, so a change moves the next one. Default `"https://app.astralbeam.ai/api"`, the
+   * hosted cloud; self-hosted deployments must set their own origin.
+   */
+  apiUrl?: string | undefined;
+  /**
+   * Where the short-lived chat auth token comes from: `{ url, ...RequestInit }` for a token
+   * endpoint, or a function that mints `{ token }` in the host page. Read for every token, so a
+   * change applies to the next one, which is minted when the cached token nears expiry. Default
+   * `{ url: "/api/astralbeam/token" }`, posted with the page's cookies.
+   */
+  fetchChatAuthToken?: AstralBeamChatAuthTokenSource | undefined;
+  /** Host-defined tools the agent can call, executed in the host page, keyed by tool name. */
+  tools?: Record<string, ToolDefinition> | undefined;
+  /** Host-defined widgets the agent can render inline in the conversation, keyed by identifier. */
+  widgets?: Record<string, WidgetDefinition> | undefined;
+  /** Host-rendered replacements for parts of the widget's chrome; see `AstralBeamChatSlots`. */
+  slots?: AstralBeamChatSlots | undefined;
+  /**
+   * Shows the collected sandbox panel (every file the agent wrote, with downloads, and the full
+   * command log) above the composer once the sandbox has done work. Off by default: the
+   * transcript already shows each step where it happened. Default `false`.
+   */
+  sandboxPanel?: boolean | undefined;
+  /**
+   * File attachments in the composer, on by default. `false` turns them off; an options object
+   * narrows the limits and accepted types.
+   */
+  attachments?: boolean | AstralBeamChatAttachmentOptions | undefined;
+  /** Color scheme of the widget. Default `"system"`. */
+  colorScheme?: AstralBeamChatColorScheme | undefined;
+  /** Custom values for the widget's theming CSS variables, per color scheme. */
+  theme?: AstralBeamChatTheme | undefined;
+  /**
+   * Logs every SDK action to the browser console with UTC timestamps and full payloads,
+   * and asks the endpoint (via the forwarded props) to log its side of the run too.
+   */
+  debug?: boolean | undefined;
+}
 //#endregion
 //#region src/lib/debug.d.ts
 declare const CATEGORY_COLORS: {
@@ -3608,26 +3722,38 @@ interface WidgetRenderRequest {
   props: Record<string, unknown>;
   /** Keys the render: a repeat of the same call replaces its own render, not another's. */
   toolCallId: string;
-}
-interface AstralBeamChatCoreOptions {
-  /** Public ID of the organization-owned agent; omitted, the organization's default answers. */
-  agentId?: string | undefined;
-  /** Base URL of the AstralBeam API; `/chat` hangs off it. Default the hosted cloud. */
-  apiUrl?: string | undefined;
   /**
-   * Where short-lived chat JWTs come from: `{ url, ...RequestInit }` for a token endpoint, or a
-   * function minting `{ token }` in the host page. Either runs again on every renewal.
-   * Default `{ url: "/api/astralbeam/token" }`.
+   * Drops this session's copy of the render's cleanup, for a host that disposed the render itself;
+   * without it the cleanup — and the DOM it captures — is held until the next reset.
    */
-  generateAuthToken?: AstralBeamChatGenerateAuthToken | undefined;
-  /** Host tools the agent can call; `execute` runs wherever this session lives. */
-  tools?: Record<string, ToolDefinition> | undefined;
-  /** Widgets declared to the agent; `onRenderWidget` is asked to draw them. */
+  release: () => void;
+}
+/**
+ * Mirrors of the underlying chat client's stream lifecycle, for a consumer that logs or traces the
+ * raw run; the drop-in widget passes its debug console logger here.
+ */
+interface ChatStreamCallbacks {
+  onChunk?: ((chunk: StreamChunk) => void) | undefined;
+  onResponse?: ((response?: Response) => void) | undefined;
+  onFinish?: ((message: UIMessage) => void) | undefined;
+  onError?: ((error: Error) => void) | undefined;
+}
+/**
+ * The transport and tool options of the drop-in widget, minus everything about its UI, plus this
+ * session's own rendering hooks. The shared options are documented on `MountAstralBeamChatOptions`.
+ */
+interface AstralBeamChatCoreOptions extends Pick<MountAstralBeamChatOptions, "agentId" | "apiUrl" | "fetchChatAuthToken" | "tools" | "debug"> {
+  /** Widgets declared to the agent, without a `render`; `onRenderWidget` is asked to draw them. */
   widgets?: Record<string, WidgetDeclaration> | undefined;
   /** Draws an agent-requested widget however the host wants; may return a cleanup. */
   onRenderWidget?: ((request: WidgetRenderRequest) => (() => void) | void) | undefined;
-  /** Logs every action to the console and asks the endpoint to log its side too. */
-  debug?: boolean | undefined;
+  /** Stream lifecycle callbacks, read per event so they follow an update. */
+  streamCallbacks?: ChatStreamCallbacks | undefined;
+}
+/** One tool as declared to the agent: its name, and the `metadata.title` that labels it. */
+interface AgentToolInfo {
+  name: string;
+  title: string | undefined;
 }
 interface AstralBeamChatState {
   messages: UIMessage[];
@@ -3639,6 +3765,8 @@ interface AstralBeamChatState {
   capabilities: {
     attachments: boolean;
   };
+  /** The tool set currently declared to the agent, in declaration order. */
+  agentTools: readonly AgentToolInfo[];
   sandboxStatus: SandboxStatus | undefined;
   sandbox: SandboxActivity;
 }
@@ -3657,6 +3785,8 @@ interface AstralBeamChatCore {
   addToolResult: ChatClient["addToolResult"];
   /** Stops the in-flight generation; the transcript keeps what already streamed. */
   stop: () => void;
+  /** Mints a fresh chat auth token, ignoring the cached one; for a retry after a failure. */
+  retryAuthentication: () => void;
   /** Re-runs the last exchange. */
   reload: () => Promise<void>;
   /** Clears the conversation and disposes live widget renders. */
@@ -3724,14 +3854,7 @@ interface TypedToolDefinition<S extends ParametersSchema = JsonSchemaObject> {
   parameters?: S;
   execute: (input: InferParameters<S>) => unknown | Promise<unknown>;
 }
-interface TypedWidgetDefinition<S extends ParametersSchema = JsonSchemaObject> {
-  description: string;
-  parameters?: S;
-  render: (props: InferParameters<S>, container: HTMLElement) => (() => void) | void;
-}
 /** Declares a host tool; a Standard Schema `parameters` types (and validates) `execute`'s input. */
 declare function defineTool<const S extends ParametersSchema = JsonSchemaObject>(tool: TypedToolDefinition<S>): ToolDefinition;
-/** Declares a host widget; a Standard Schema `parameters` types (and validates) `render`'s props. */
-declare function defineWidget<const S extends ParametersSchema = JsonSchemaObject>(widget: TypedWidgetDefinition<S>): WidgetDefinition;
 //#endregion
-export { SandboxActivity as A, AstralBeamChatState as C, WidgetDeclaration as D, ChatAuthenticationState as E, InferParameters as F, JsonSchemaObject as I, ParametersSchema as L, SandboxCommandRun as M, SandboxFileWrite as N, buildAgentTools as O, SandboxStatus as P, StandardSchemaV1 as R, AstralBeamChatCoreOptions as S, createAstralBeamChat as T, sandboxRefusal as _, SANDBOX_LIST_FILES_TOOL as a, lastPartInProgress as b, SANDBOX_RUN_COMMAND_TOOL as c, collectSandboxActivity as d, describeSandboxCommandRun as f, readSandboxFileWrite as g, readSandboxCommandRun as h, RENDER_WIDGET_TOOL as i, SandboxArtifact as j, RenderWidgetInput as k, SANDBOX_STATUS_EVENT as l, readSandboxArtifact as m, defineWidget as n, SANDBOX_PUBLISH_ARTIFACT_TOOL as o, isSandboxTool as p, ASK_QUESTIONNAIRE_TOOL as r, SANDBOX_READ_FILE_TOOL as s, defineTool as t, SANDBOX_WRITE_FILE_TOOL as u, hasPendingToolRun as v, WidgetRenderRequest as w, AstralBeamChatCore as x, isSettledToolCall as y, ToolDefinition as z };
+export { RenderWidgetInput as A, ToolDefinition as B, AstralBeamChatState as C, ChatAuthenticationState as D, createAstralBeamChat as E, SandboxStatus as F, InferParameters as I, JsonSchemaObject as L, SandboxArtifact as M, SandboxCommandRun as N, WidgetDeclaration as O, SandboxFileWrite as P, ParametersSchema as R, AstralBeamChatCoreOptions as S, WidgetRenderRequest as T, hasPendingToolRun as _, SANDBOX_PUBLISH_ARTIFACT_TOOL as a, AgentToolInfo as b, SANDBOX_STATUS_EVENT as c, describeSandboxCommandRun as d, isSandboxTool as f, sandboxRefusal as g, readSandboxFileWrite as h, SANDBOX_LIST_FILES_TOOL as i, SandboxActivity as j, buildAgentTools as k, SANDBOX_WRITE_FILE_TOOL as l, readSandboxCommandRun as m, ASK_QUESTIONNAIRE_TOOL as n, SANDBOX_READ_FILE_TOOL as o, readSandboxArtifact as p, RENDER_WIDGET_TOOL as r, SANDBOX_RUN_COMMAND_TOOL as s, defineTool as t, collectSandboxActivity as u, isSettledToolCall as v, ChatStreamCallbacks as w, AstralBeamChatCore as x, lastPartInProgress as y, StandardSchemaV1 as z };

package/dist/react.d.ts

@@ -1,6 +1,6 @@
-import { C as AstralBeamChatState, S as AstralBeamChatCoreOptions, x as AstralBeamChatCore } from "./index-8NUgB59m.js";
+import { C as AstralBeamChatState, S as AstralBeamChatCoreOptions, x as AstralBeamChatCore } from "./index-CudekMKM.js";
 import { ReactNode } from "react";
-import { AstralBeamChatAttachmentOptions, AstralBeamChatAuthTokenRequest, AstralBeamChatColorScheme, AstralBeamChatGenerateAuthToken, AstralBeamChatTheme, InferParameters, JsonSchemaObject, ParametersSchema, ToolDefinition, WidgetDefinition as WidgetDefinition$1, defineTool } from "@astralbeam/sdk/client";
+import { AstralBeamChatAttachmentOptions, AstralBeamChatAuthTokenRequest, AstralBeamChatAuthTokenSource, AstralBeamChatColorScheme, AstralBeamChatTheme, InferParameters, JsonSchemaObject, MountAstralBeamChatOptions, ParametersSchema, ToolDefinition, WidgetDefinition as WidgetDefinition$1, defineTool } from "@astralbeam/sdk/client";
 
 //#region src/react/index.d.ts
 interface WidgetDefinition extends Omit<WidgetDefinition$1, "render"> {
@@ -38,60 +38,21 @@ interface AstralBeamChatRef {
   /** Stops the in-flight generation, if any; the transcript keeps what already streamed. */
   stop: () => void;
 }
-interface AstralBeamChatProps {
-  /**
-   * Public ID of the organization-owned agent. Omit it to use the organization's default agent,
-   * which the dashboard's agents page selects. A change answers the next run with the new agent
-   * and keeps the transcript, which that agent then sees as history.
-   */
-  agentId?: string;
-  /** Name shown in the widget's header. Default `"AstralBeam"`. */
-  title?: string;
-  /**
-   * Shows the widget's header with the title and the reset button; `false` hides both and gives
-   * the transcript the full height. Default `true`.
-   */
-  showHeader?: boolean;
+/**
+ * Every mount option as a prop, with the DOM-rendering fields replaced by React ones: a widget
+ * renders JSX, and the chrome slots take nodes instead of renderers. The shared options are
+ * documented once, on `MountAstralBeamChatOptions`.
+ */
+interface AstralBeamChatProps extends Omit<MountAstralBeamChatOptions, "widgets" | "slots"> {
+  /** Host-defined widgets the agent can render inline in the conversation, keyed by identifier. */
+  widgets?: Record<string, WidgetDefinition> | undefined;
   /** Replaces the header's content with the host's own React content; `showHeader` still applies. */
   header?: ReactNode;
   /** Replaces the empty-transcript state with the host's own React content. */
   empty?: ReactNode;
   /** Extra host controls at the end of the composer's button row, next to send. */
   composerActions?: ReactNode;
-  /** Headline shown on the empty transcript. Default `"Ask the assistant"`. */
-  emptyTitle?: string;
-  /** Subtitle under the empty transcript's headline. */
-  emptyDescription?: string;
-  /**
-   * Base URL of the AstralBeam API; the widget calls `/chat` under it. Read per request, so a
-   * change moves the next one. Default the hosted cloud.
-   */
-  apiUrl?: string;
-  /**
-   * Where the short-lived chat JWT comes from: `{ url, ...RequestInit }` for a token endpoint, or
-   * a function minting `{ token }`, optionally a promise, in the host app. Read per token, and
-   * the function form runs in the host's React tree, so an inline closure over current auth state
-   * is fine and needs no memoization. Default `{ url: "/api/astralbeam/token" }`.
-   */
-  generateAuthToken?: AstralBeamChatGenerateAuthToken;
-  /** Host-defined tools the agent can call, executed in the host's React app, keyed by name. */
-  tools?: Record<string, ToolDefinition>;
-  /** Host-defined widgets the agent can render inline in the conversation, keyed by identifier. */
-  widgets?: Record<string, WidgetDefinition>;
-  /** Color scheme of the chat widget. Default `"system"`. */
-  colorScheme?: AstralBeamChatColorScheme;
-  /** Custom values for the widget's theming CSS variables, per color scheme. */
-  theme?: AstralBeamChatTheme | undefined;
-  /** File attachments in the composer, on by default; `false` turns them off. */
-  attachments?: boolean | AstralBeamChatAttachmentOptions;
-  /** Shows the collected sandbox panel (files with downloads, command log) above the composer. Default `false`. */
-  sandboxPanel?: boolean;
-  /**
-   * Logs every SDK action to the browser console with UTC timestamps and full payloads,
-   * and asks the endpoint to log its side of the run too.
-   */
-  debug?: boolean;
 }
 declare const AstralBeamChat: import("react").ForwardRefExoticComponent<AstralBeamChatProps & import("react").RefAttributes<AstralBeamChatRef>>;
 //#endregion
-export { AstralBeamChat, type AstralBeamChatAttachmentOptions, type AstralBeamChatAuthTokenRequest, type AstralBeamChatColorScheme, type AstralBeamChatCore, type AstralBeamChatCoreOptions, type AstralBeamChatGenerateAuthToken, AstralBeamChatProps, AstralBeamChatRef, type AstralBeamChatState, type AstralBeamChatTheme, type InferParameters, type ParametersSchema, type ToolDefinition, TypedReactWidgetDefinition, UseAstralBeamChatResult, WidgetDefinition, defineTool, defineWidget, useAstralBeamChat };
+export { AstralBeamChat, type AstralBeamChatAttachmentOptions, type AstralBeamChatAuthTokenRequest, type AstralBeamChatAuthTokenSource, type AstralBeamChatColorScheme, type AstralBeamChatCore, type AstralBeamChatCoreOptions, AstralBeamChatProps, AstralBeamChatRef, type AstralBeamChatState, type AstralBeamChatTheme, type InferParameters, type ParametersSchema, type ToolDefinition, TypedReactWidgetDefinition, UseAstralBeamChatResult, WidgetDefinition, defineTool, defineWidget, useAstralBeamChat };

package/dist/react.js

@@ -1,4 +1,4 @@
-import { C as DEFAULT_COLOR_SCHEME, r as createAstralBeamChat } from "./core-BZxnUlwg.js";
+import { C as DEFAULT_COLOR_SCHEME, n as CORE_OPTION_KEYS, r as createAstralBeamChat } from "./core-BF1G1dLe.js";
 import { forwardRef, useEffect, useImperativeHandle, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { createPortal } from "react-dom";
 import { defineTool, mountAstralBeamChat } from "@astralbeam/sdk/client";
@@ -15,19 +15,12 @@ function defineWidget(widget) {
 * state stay live and nothing needs a remount.
 */
 function useAstralBeamChat(options) {
-	const [core] = useState(() => createAstralBeamChat(options));
+	const coreRef = useRef(null);
+	coreRef.current ??= createAstralBeamChat(options);
+	const core = coreRef.current;
 	useEffect(() => {
 		core.updateOptions(options);
-	}, [
-		core,
-		options.agentId,
-		options.apiUrl,
-		options.generateAuthToken,
-		options.tools,
-		options.widgets,
-		options.onRenderWidget,
-		options.debug
-	]);
+	}, [core, ...CORE_OPTION_KEYS.map((key) => options[key])]);
 	useEffect(() => () => core.dispose(), [core]);
 	return {
 		...useSyncExternalStore(core.subscribe, core.getState, core.getState),
@@ -39,7 +32,7 @@ function useAstralBeamChat(options) {
 		core
 	};
 }
-const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, showHeader, header, empty, composerActions, emptyTitle, emptyDescription, apiUrl, generateAuthToken, tools, widgets = {}, colorScheme = DEFAULT_COLOR_SCHEME, theme, attachments, sandboxPanel, debug }, ref) {
+const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, showHeader, header, empty, composerActions, emptyTitle, emptyDescription, apiUrl, fetchChatAuthToken, tools, widgets = {}, colorScheme = DEFAULT_COLOR_SCHEME, theme, attachments, sandboxPanel, debug }, ref) {
 	const targetRef = useRef(null);
 	const handleRef = useRef(null);
 	const [activeRenders, setActiveRenders] = useState(/* @__PURE__ */ new Map());
@@ -106,7 +99,7 @@ const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, show
 	const live = useMemo(() => ({
 		agentId,
 		apiUrl,
-		generateAuthToken,
+		fetchChatAuthToken,
 		title,
 		showHeader,
 		emptyTitle,
@@ -122,7 +115,7 @@ const AstralBeamChat = forwardRef(function AstralBeamChat({ agentId, title, show
 	}), [
 		agentId,
 		apiUrl,
-		generateAuthToken,
+		fetchChatAuthToken,
 		title,
 		showHeader,
 		emptyTitle,

package/dist/server.d.ts

@@ -1,57 +1,42 @@
-import * as Schema from "effect/Schema";
-
 //#region src/server/index.d.ts
-declare const ASTRALBEAM_TOKEN_AUDIENCE = "astralbeam";
-declare const ASTRALBEAM_CHAT_TOKEN_TYPE = "astralbeam+jwt";
-declare const ASTRALBEAM_CHAT_TOKEN_VERSION = 4;
-declare const ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS = 300;
-declare const ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS = 600;
-declare const TenantSchema: Schema.Struct<{
-  readonly id: Schema.String;
-  readonly name: Schema.optional<Schema.String>;
-  readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-}>;
-declare const TenantUserSchema: Schema.Struct<{
-  readonly id: Schema.String;
-  readonly name: Schema.optional<Schema.String>;
-  readonly admin: Schema.optional<Schema.Boolean>;
-  readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-}>;
+declare const CHAT_AUTH_TOKEN_AUDIENCE = "astralbeam";
+declare const CHAT_AUTH_TOKEN_TYPE = "astralbeam+jwt";
+declare const CHAT_AUTH_TOKEN_VERSION = 4;
+declare const CHAT_AUTH_TOKEN_LIFETIME_SECONDS = 300;
+declare const CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS = 600;
+/** A JSON value, which is all a `metadata` object may hold: the token carries it verbatim. */
+type JsonValue = string | number | boolean | null | readonly JsonValue[] | {
+  readonly [key: string]: JsonValue;
+};
+/** A `metadata` object: caller-owned keys, preserved verbatim in the token's claims. */
+type JsonMetadata = {
+  readonly [key: string]: JsonValue;
+};
 /** Tenant identity from the Organization's application, including JSON metadata. */
-type Tenant = typeof TenantSchema.Type;
+interface Tenant {
+  readonly id: string;
+  readonly name?: string | undefined;
+  readonly metadata?: JsonMetadata | undefined;
+}
 /** User of an Organization's Tenant who interacts with AstralBeam. */
-type TenantUser = typeof TenantUserSchema.Type;
-interface CreateAstralBeamChatTokenOptions<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant> {
+interface TenantUser {
+  readonly id: string;
+  readonly name?: string | undefined;
+  readonly admin?: boolean | undefined;
+  readonly metadata?: JsonMetadata | undefined;
+}
+interface CreateChatAuthTokenOptions<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant> {
   readonly apiKey: string;
   readonly user: TTenantUser;
   readonly tenant: TTenant;
   readonly expiresInSeconds?: number | undefined;
 }
-interface CreateAstralBeamTokenRouteOptions<TSession extends object = object, TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant> {
-  /** The full API key, or a thunk read per request; missing or empty answers 503. */
-  readonly apiKey: string | undefined | (() => string | undefined);
-  /**
-   * Authenticates the request against the application's own session. Returning nothing, or
-   * throwing, answers 401.
-   */
-  readonly authenticate: (request: Request) => TSession | null | undefined | Promise<TSession | null | undefined>;
-  /** Maps the authenticated session to the tenant user minted into the token. */
-  readonly user: (session: TSession) => TTenantUser;
-  /** Maps the same authenticated session to the tenant minted into the token. */
-  readonly tenant: (session: TSession) => TTenant;
-  readonly expiresInSeconds?: number | undefined;
-}
-/**
- * Builds the fetch-standard `POST` handler for an application's token endpoint, owning the
- * method check, the unconfigured-key 503, the unauthenticated 401, and the `no-store` header.
- */
-declare function createAstralBeamTokenRoute<TSession extends object, TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant>(options: CreateAstralBeamTokenRouteOptions<TSession, TTenantUser, TTenant>): (request: Request) => Promise<Response>;
 /** Creates the short-lived bearer token returned by an application's server auth endpoint. */
-declare function createAstralBeamChatToken<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant>({
+declare function createChatAuthToken<TTenantUser extends TenantUser = TenantUser, TTenant extends Tenant = Tenant>({
   apiKey,
   user,
   tenant,
   expiresInSeconds
-}: CreateAstralBeamChatTokenOptions<TTenantUser, TTenant>): Promise<string>;
+}: CreateChatAuthTokenOptions<TTenantUser, TTenant>): Promise<string>;
 //#endregion
-export { ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_TYPE, ASTRALBEAM_CHAT_TOKEN_VERSION, ASTRALBEAM_TOKEN_AUDIENCE, CreateAstralBeamChatTokenOptions, CreateAstralBeamTokenRouteOptions, Tenant, TenantSchema, TenantUser, TenantUserSchema, createAstralBeamChatToken, createAstralBeamTokenRoute };
+export { CHAT_AUTH_TOKEN_AUDIENCE, CHAT_AUTH_TOKEN_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_TYPE, CHAT_AUTH_TOKEN_VERSION, CreateChatAuthTokenOptions, JsonMetadata, JsonValue, Tenant, TenantUser, createChatAuthToken };

package/dist/server.js

@@ -1,4 +1,3 @@
-import * as Schema from "effect/Schema";
 //#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/buffer_utils.js
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
@@ -638,50 +637,29 @@ var SignJWT = class {
 };
 //#endregion
 //#region src/server/index.ts
-const ASTRALBEAM_TOKEN_AUDIENCE = "astralbeam";
-const ASTRALBEAM_CHAT_TOKEN_TYPE = "astralbeam+jwt";
-const ASTRALBEAM_CHAT_TOKEN_VERSION = 4;
-const ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS = 300;
-const ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS = 600;
-const CHAT_TOKEN_MAX_BYTES = 16384;
+const CHAT_AUTH_TOKEN_AUDIENCE = "astralbeam";
+const CHAT_AUTH_TOKEN_TYPE = "astralbeam+jwt";
+const CHAT_AUTH_TOKEN_VERSION = 4;
+const CHAT_AUTH_TOKEN_LIFETIME_SECONDS = 300;
+const CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS = 600;
+const CHAT_AUTH_TOKEN_MAX_BYTES = 16384;
 const IDENTITY_MAX_BYTES = 8192;
+const EXTERNAL_ID_MAX_LENGTH = 255;
+const API_KEY_PATTERN = /^key_[0-9a-z-]{1,63}_[0-9a-z-]{1,63}_abo_[A-Za-z]{64}$/;
+const TENANT_FIELDS = [
+	"id",
+	"name",
+	"metadata"
+];
+const TENANT_USER_FIELDS = [
+	"id",
+	"name",
+	"admin",
+	"metadata"
+];
 const textEncoder = new TextEncoder();
-const SlugSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^[0-9a-z-]{1,63}$/)));
-const ApiKeySecretSchema = Schema.String.pipe(Schema.check(Schema.isPattern(/^abo_[A-Za-z]{64}$/)));
-const ApiKeySchema = Schema.TemplateLiteral([
-	"key_",
-	SlugSchema,
-	"_",
-	SlugSchema,
-	"_",
-	ApiKeySecretSchema
-]);
-const isApiKey = Schema.is(ApiKeySchema);
-const MetadataSchema = Schema.JsonObject.annotate({ message: "metadata must be a JSON object" });
-const TenantExternalIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => value.length >= 1 && value.length <= 255, { message: "tenant.id must be a 1-255 character string" })));
-const TenantUserExternalIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => value.length >= 1 && value.length <= 255, { message: "user.id must be a 1-255 character string" })));
-const TenantSchema = Schema.Struct({
-	id: TenantExternalIdSchema,
-	name: Schema.optional(Schema.String),
-	metadata: Schema.optional(MetadataSchema)
-});
-const TenantUserSchema = Schema.Struct({
-	id: TenantUserExternalIdSchema,
-	name: Schema.optional(Schema.String),
-	admin: Schema.optional(Schema.Boolean),
-	metadata: Schema.optional(MetadataSchema)
-});
-const IdentitySchema = Schema.Struct({
-	user: TenantUserSchema,
-	tenant: TenantSchema
-}).pipe(Schema.check(Schema.makeFilter((value) => textEncoder.encode(JSON.stringify(value)).byteLength <= IDENTITY_MAX_BYTES, { message: `user and tenant must not exceed ${IDENTITY_MAX_BYTES} bytes` })));
-const decodeIdentity = Schema.decodeUnknownSync(IdentitySchema, {
-	errors: "all",
-	onExcessProperty: "error",
-	reportInput: false
-});
 function parseApiKey(apiKey) {
-	if (!isApiKey(apiKey)) throw new Error("apiKey must match key_<organization>_<key>_abo_<secret>");
+	if (!API_KEY_PATTERN.test(apiKey)) throw new Error("apiKey must match key_<organization>_<key>_abo_<secret>");
 	const separator = apiKey.lastIndexOf("_abo_");
 	const keyId = apiKey.slice(0, separator);
 	const keySecret = apiKey.slice(separator + 1);
@@ -691,53 +669,44 @@ function parseApiKey(apiKey) {
 		keySecret
 	};
 }
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function isJsonValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return value.every(isJsonValue);
+	return isPlainObject(value) && Object.values(value).every(isJsonValue);
+}
+function validateIdentity(label, value, isUser) {
+	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
+	const fields = isUser ? TENANT_USER_FIELDS : TENANT_FIELDS;
+	for (const key of Object.keys(value)) if (!fields.includes(key)) throw new Error(`${label} has an unknown field "${key}"`);
+	const { id, name, admin, metadata } = value;
+	if (typeof id !== "string" || id.length < 1 || id.length > EXTERNAL_ID_MAX_LENGTH) throw new Error(`${label}.id must be a 1-${EXTERNAL_ID_MAX_LENGTH} character string`);
+	if (name !== void 0 && typeof name !== "string") throw new Error(`${label}.name must be a string`);
+	if (isUser && admin !== void 0 && typeof admin !== "boolean") throw new Error(`${label}.admin must be a boolean`);
+	if (metadata !== void 0 && !(isPlainObject(metadata) && isJsonValue(metadata))) throw new Error(`${label}.metadata must be a JSON object`);
+}
 function validatedIdentity(user, tenant) {
-	return JSON.parse(JSON.stringify(decodeIdentity({
+	validateIdentity("user", user, true);
+	validateIdentity("tenant", tenant, false);
+	const json = JSON.stringify({
 		user,
 		tenant
-	})));
+	});
+	if (textEncoder.encode(json).byteLength > IDENTITY_MAX_BYTES) throw new Error(`user and tenant must not exceed ${IDENTITY_MAX_BYTES} bytes`);
+	return JSON.parse(json);
 }
 async function signingKey(secret) {
 	const digest = await crypto.subtle.digest("SHA-256", textEncoder.encode(secret));
 	return textEncoder.encode(encode(new Uint8Array(digest)));
 }
-function tokenRouteResponse(body, status) {
-	return Response.json(body, {
-		status,
-		headers: { "cache-control": "no-store" }
-	});
-}
-/**
-* Builds the fetch-standard `POST` handler for an application's token endpoint, owning the
-* method check, the unconfigured-key 503, the unauthenticated 401, and the `no-store` header.
-*/
-function createAstralBeamTokenRoute(options) {
-	return async (request) => {
-		if (request.method !== "POST") return tokenRouteResponse({ error: "Use POST" }, 405);
-		const apiKey = typeof options.apiKey === "function" ? options.apiKey() : options.apiKey;
-		if (!apiKey) return tokenRouteResponse({ error: "The AstralBeam API key is not configured" }, 503);
-		let session;
-		try {
-			session = await options.authenticate(request);
-		} catch {
-			session = void 0;
-		}
-		if (!session) return tokenRouteResponse({ error: "The session could not be verified" }, 401);
-		try {
-			return tokenRouteResponse({ token: await createAstralBeamChatToken({
-				apiKey,
-				user: options.user(session),
-				tenant: options.tenant(session),
-				...options.expiresInSeconds === void 0 ? {} : { expiresInSeconds: options.expiresInSeconds }
-			}) }, 200);
-		} catch {
-			return tokenRouteResponse({ error: "The chat token could not be created" }, 500);
-		}
-	};
-}
 /** Creates the short-lived bearer token returned by an application's server auth endpoint. */
-async function createAstralBeamChatToken({ apiKey, user, tenant, expiresInSeconds = 300 }) {
-	if (!Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > 600) throw new Error("AstralBeam chat tokens must live for 60-600 seconds");
+async function createChatAuthToken({ apiKey, user, tenant, expiresInSeconds = 300 }) {
+	if (!Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > 600) throw new Error("chat auth tokens must live for 60-600 seconds");
 	const { keyId, organizationSlug, keySecret } = parseApiKey(apiKey);
 	const identity = validatedIdentity(user, tenant);
 	const now = Math.floor(Date.now() / 1e3);
@@ -747,11 +716,11 @@ async function createAstralBeamChatToken({ apiKey, user, tenant, expiresInSecond
 		tenant: identity.tenant
 	}).setProtectedHeader({
 		alg: "HS256",
-		typ: ASTRALBEAM_CHAT_TOKEN_TYPE,
+		typ: CHAT_AUTH_TOKEN_TYPE,
 		kid: keyId
-	}).setIssuer(organizationSlug).setAudience(ASTRALBEAM_TOKEN_AUDIENCE).setIssuedAt(now).setExpirationTime(now + expiresInSeconds).sign(await signingKey(keySecret));
-	if (textEncoder.encode(token).byteLength > CHAT_TOKEN_MAX_BYTES) throw new Error(`AstralBeam chat tokens must not exceed ${CHAT_TOKEN_MAX_BYTES} bytes`);
+	}).setIssuer(organizationSlug).setAudience(CHAT_AUTH_TOKEN_AUDIENCE).setIssuedAt(now).setExpirationTime(now + expiresInSeconds).sign(await signingKey(keySecret));
+	if (textEncoder.encode(token).byteLength > CHAT_AUTH_TOKEN_MAX_BYTES) throw new Error(`chat auth tokens must not exceed ${CHAT_AUTH_TOKEN_MAX_BYTES} bytes`);
 	return token;
 }
 //#endregion
-export { ASTRALBEAM_CHAT_TOKEN_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_MAX_LIFETIME_SECONDS, ASTRALBEAM_CHAT_TOKEN_TYPE, ASTRALBEAM_CHAT_TOKEN_VERSION, ASTRALBEAM_TOKEN_AUDIENCE, TenantSchema, TenantUserSchema, createAstralBeamChatToken, createAstralBeamTokenRoute };
+export { CHAT_AUTH_TOKEN_AUDIENCE, CHAT_AUTH_TOKEN_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_MAX_LIFETIME_SECONDS, CHAT_AUTH_TOKEN_TYPE, CHAT_AUTH_TOKEN_VERSION, createChatAuthToken };