@athenaintel/react 0.19.0 → 0.21.0

package/dist/runtime/auth.js

@@ -0,0 +1,309 @@
+import { useMemo, useState, useRef, useEffect } from "react";
+import { athenaDiagnostics } from "../diagnostics/athena-diagnostics.js";
+function isTrustedOrigin({
+  origin,
+  trustedOrigins
+}) {
+  try {
+    const normalizedOrigin = new URL(origin).origin;
+    if (trustedOrigins.includes(normalizedOrigin)) {
+      return true;
+    }
+    const { hostname } = new URL(normalizedOrigin);
+    return hostname === "athenaintel.com" || hostname.endsWith(".athenaintel.com") || hostname === "localhost";
+  } catch {
+    return false;
+  }
+}
+const BRIDGE_URL_FIELDS = ["statewireSyncUrl", "backendBaseUrl", "appUrl"];
+const EMPTY_BRIDGE_URLS = {
+  statewireSyncUrl: null,
+  backendBaseUrl: null,
+  appUrl: null
+};
+function mergeBridgeConfigMessage(previous, payload) {
+  const next = {
+    statewireSyncUrl: previous.statewireSyncUrl,
+    backendBaseUrl: previous.backendBaseUrl,
+    appUrl: previous.appUrl
+  };
+  for (const field of BRIDGE_URL_FIELDS) {
+    const value = payload[field];
+    if (typeof value === "string") {
+      next[field] = value;
+    }
+  }
+  return next;
+}
+function readAuthMintUrls(data) {
+  return mergeBridgeConfigMessage(EMPTY_BRIDGE_URLS, data);
+}
+const BRIDGE_TIMEOUT_MS = 2e3;
+const TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+const TOKEN_REFRESH_RETRY_BASE_MS = 60 * 1e3;
+const TOKEN_REFRESH_RETRY_MAX_MS = 5 * 60 * 1e3;
+const DEFAULT_TOKEN_REFRESH_MS = 55 * 60 * 1e3;
+const EMPTY_TRUSTED_ORIGINS = [];
+const normalizeOrigin = (value) => {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+};
+const getTokenRefreshDelay = (expiresAt, nowMs) => {
+  if (typeof expiresAt !== "string") {
+    return DEFAULT_TOKEN_REFRESH_MS;
+  }
+  const expiresAtMs = Date.parse(expiresAt);
+  if (!Number.isFinite(expiresAtMs)) {
+    return DEFAULT_TOKEN_REFRESH_MS;
+  }
+  return Math.max(TOKEN_REFRESH_RETRY_BASE_MS, expiresAtMs - nowMs - TOKEN_REFRESH_BUFFER_MS);
+};
+const getAuthRetryDelay = (retryAttempt) => {
+  const safeAttempt = Number.isFinite(retryAttempt) ? Math.max(0, Math.floor(retryAttempt)) : 0;
+  return Math.min(TOKEN_REFRESH_RETRY_MAX_MS, TOKEN_REFRESH_RETRY_BASE_MS * 2 ** safeAttempt);
+};
+function useParentBridge({
+  trustedOrigins = EMPTY_TRUSTED_ORIGINS
+} = {}) {
+  const isInIframe = typeof window !== "undefined" && window.parent !== window;
+  const runtimeTrustedOrigins = useMemo(() => {
+    const origins = /* @__PURE__ */ new Set();
+    if (typeof window !== "undefined") {
+      origins.add(window.location.origin);
+    }
+    for (const trustedOrigin of trustedOrigins) {
+      const normalizedOrigin = normalizeOrigin(trustedOrigin);
+      if (normalizedOrigin) {
+        origins.add(normalizedOrigin);
+      }
+    }
+    return [...origins];
+  }, [trustedOrigins]);
+  const [state, setState] = useState({
+    token: null,
+    ...EMPTY_BRIDGE_URLS,
+    hostAnswered: false,
+    ready: false
+  });
+  const readySignalSent = useRef(false);
+  const configReceived = useRef(false);
+  useEffect(() => {
+    if (!isInIframe) return;
+    const endBridgeSpan = athenaDiagnostics.span("auth.bridge", "auth.bridge.start", {
+      mode: "iframe"
+    });
+    let spanEnded = false;
+    const endOnce = (name, options) => {
+      if (spanEnded) return 0;
+      spanEnded = true;
+      return endBridgeSpan(name, options);
+    };
+    const handler = (event) => {
+      if (!isTrustedOrigin({ origin: event.origin, trustedOrigins: runtimeTrustedOrigins })) {
+        return;
+      }
+      if (!event.data || typeof event.data !== "object") return;
+      if (event.data.type === "athena-config") {
+        configReceived.current = true;
+        setState((prev) => ({
+          ...prev,
+          ...mergeBridgeConfigMessage(prev, event.data),
+          hostAnswered: true
+          // Don't set ready here — wait for athena-auth (token) or the timeout.
+          // Setting ready on config alone causes a race: the thread list fires
+          // before the token arrives, falling back to X-API-KEY.
+        }));
+      }
+      if (event.data.type === "athena-auth" && typeof event.data.token === "string") {
+        endOnce("auth.bridge.ready", { data: { mode: "iframe" } });
+        athenaDiagnostics.emit("auth.token.acquired", {
+          level: "debug",
+          data: { source: "iframe-postmessage" }
+        });
+        setState((prev) => ({
+          ...prev,
+          token: event.data.token,
+          ready: true
+        }));
+      }
+    };
+    window.addEventListener("message", handler);
+    if (!readySignalSent.current) {
+      window.parent.postMessage({ type: "athena-auth-ready" }, "*");
+      readySignalSent.current = true;
+    }
+    const timer = setTimeout(() => {
+      endOnce("auth.bridge.timeout", {
+        data: {
+          mode: "iframe",
+          timeout_ms: BRIDGE_TIMEOUT_MS,
+          config_received: configReceived.current
+        }
+      });
+      setState((prev) => prev.ready ? prev : { ...prev, ready: true });
+    }, BRIDGE_TIMEOUT_MS);
+    return () => {
+      window.removeEventListener("message", handler);
+      clearTimeout(timer);
+    };
+  }, [isInIframe, runtimeTrustedOrigins]);
+  useEffect(() => {
+    if (isInIframe) return;
+    if (typeof window === "undefined") return;
+    let cancelled = false;
+    let requestTimer = null;
+    let refreshTimer = null;
+    let controller = null;
+    let retryAttempt = 0;
+    const clearRequestTimer = () => {
+      if (requestTimer) {
+        clearTimeout(requestTimer);
+        requestTimer = null;
+      }
+    };
+    const clearRefreshTimer = () => {
+      if (refreshTimer) {
+        clearTimeout(refreshTimer);
+        refreshTimer = null;
+      }
+    };
+    const markReady = () => {
+      if (cancelled) return;
+      setState((prev) => prev.ready ? prev : { ...prev, ready: true });
+    };
+    const scheduleRefresh = (expiresAt) => {
+      clearRefreshTimer();
+      retryAttempt = 0;
+      const delay = getTokenRefreshDelay(expiresAt, Date.now());
+      refreshTimer = setTimeout(() => {
+        void fetchAuth({ markReadyOnFailure: false });
+      }, delay);
+    };
+    const scheduleRetry = () => {
+      clearRefreshTimer();
+      const delay = getAuthRetryDelay(retryAttempt);
+      retryAttempt += 1;
+      refreshTimer = setTimeout(() => {
+        void fetchAuth({ markReadyOnFailure: false });
+      }, delay);
+    };
+    const fetchAuth = async ({
+      markReadyOnFailure
+    }) => {
+      controller == null ? void 0 : controller.abort();
+      controller = new AbortController();
+      const isInitial = markReadyOnFailure;
+      const rawEndSpan = isInitial ? athenaDiagnostics.span("auth.bridge", "auth.bridge.start", { mode: "marathon" }) : null;
+      let spanEnded = false;
+      const endBridgeSpan = rawEndSpan ? (name, options) => {
+        if (spanEnded) return 0;
+        spanEnded = true;
+        return rawEndSpan(name, options);
+      } : null;
+      clearRequestTimer();
+      requestTimer = setTimeout(() => {
+        controller == null ? void 0 : controller.abort();
+        endBridgeSpan == null ? void 0 : endBridgeSpan("auth.bridge.timeout", {
+          data: { mode: "marathon", timeout_ms: BRIDGE_TIMEOUT_MS }
+        });
+        if (markReadyOnFailure) {
+          markReady();
+        }
+      }, BRIDGE_TIMEOUT_MS);
+      try {
+        const resp = await fetch("/_athena/auth", {
+          credentials: "include",
+          headers: { Accept: "application/json" },
+          signal: controller.signal
+        });
+        if (cancelled) return;
+        if (!resp.ok) {
+          if (resp.status === 404) {
+            endBridgeSpan == null ? void 0 : endBridgeSpan("auth.bridge.absent", {
+              data: { mode: "marathon", status: resp.status }
+            });
+            markReady();
+          } else {
+            const failure = {
+              level: "warn",
+              data: { mode: "marathon", status: resp.status }
+            };
+            if (endBridgeSpan) {
+              endBridgeSpan("auth.bridge.error", failure);
+            } else {
+              athenaDiagnostics.emit("auth.token.refresh_failed", failure);
+            }
+            if (markReadyOnFailure) {
+              markReady();
+            }
+            scheduleRetry();
+          }
+          return;
+        }
+        const data = await resp.json();
+        if (cancelled) return;
+        if (endBridgeSpan) {
+          endBridgeSpan("auth.bridge.ready", {
+            data: { mode: "marathon", has_token: typeof data.token === "string" }
+          });
+          athenaDiagnostics.emit("auth.token.acquired", {
+            level: "debug",
+            data: { source: "marathon", expires_at: data.expires_at }
+          });
+        } else {
+          athenaDiagnostics.emit("auth.token.refreshed", {
+            level: "debug",
+            data: { source: "marathon", expires_at: data.expires_at }
+          });
+        }
+        setState({
+          token: typeof data.token === "string" ? data.token : null,
+          ...readAuthMintUrls(data),
+          hostAnswered: true,
+          ready: true
+        });
+        scheduleRefresh(data.expires_at);
+      } catch (error) {
+        if (!cancelled && !(error instanceof DOMException && error.name === "AbortError")) {
+          const failure = { level: "warn", data: { mode: "marathon" }, error };
+          if (endBridgeSpan) {
+            endBridgeSpan("auth.bridge.error", failure);
+          } else {
+            athenaDiagnostics.emit("auth.token.refresh_failed", failure);
+          }
+        }
+        if (markReadyOnFailure) {
+          markReady();
+        }
+        if (!cancelled) {
+          scheduleRetry();
+        }
+      } finally {
+        clearRequestTimer();
+      }
+    };
+    void fetchAuth({ markReadyOnFailure: true });
+    return () => {
+      cancelled = true;
+      controller == null ? void 0 : controller.abort();
+      clearRequestTimer();
+      clearRefreshTimer();
+    };
+  }, [isInIframe]);
+  return state;
+}
+function useParentAuth() {
+  return useParentBridge().token;
+}
+export {
+  getAuthRetryDelay,
+  getTokenRefreshDelay,
+  mergeBridgeConfigMessage,
+  readAuthMintUrls,
+  useParentAuth,
+  useParentBridge
+};
+//# sourceMappingURL=auth.js.map

package/dist/runtime/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sources":["../../src/runtime/auth.ts"],"sourcesContent":["import { useEffect, useMemo, useRef, useState } from 'react';\nimport { athenaDiagnostics } from '../diagnostics/athena-diagnostics';\n\n/**\n * Check whether a PostMessage origin is trusted.\n * Accepts:\n * - explicit trusted origins passed by the host app\n * - the current iframe origin (for same-origin wrappers like Marathon)\n * - any *.athenaintel.com subdomain and localhost (legacy/default behavior)\n */\nfunction isTrustedOrigin({\n  origin,\n  trustedOrigins,\n}: {\n  origin: string;\n  trustedOrigins: string[];\n}): boolean {\n  try {\n    const normalizedOrigin = new URL(origin).origin;\n    if (trustedOrigins.includes(normalizedOrigin)) {\n      return true;\n    }\n\n    const { hostname } = new URL(normalizedOrigin);\n    return (\n      hostname === 'athenaintel.com' ||\n      hostname.endsWith('.athenaintel.com') ||\n      hostname === 'localhost'\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport interface ParentBridgeState {\n  /** PropelAuth access token from the parent window. */\n  token: string | null;\n  /**\n   * Statewire sync mount (`…/v2/threads`) minted by the host. `null` when the\n   * host minted none; the provider then derives it from the configured\n   * `apiUrl`'s origin (or the environment preset).\n   */\n  statewireSyncUrl: string | null;\n  /**\n   * Bare Agora API base (no path) minted by the host. `null` when the host\n   * minted none; the provider then uses the configured `backendUrl` (or the\n   * environment preset).\n   */\n  backendBaseUrl: string | null;\n  /** Athena frontend origin provided by the parent wrapper. */\n  appUrl: string | null;\n  /**\n   * True once a host answered the bridge — a `/_athena/auth` mint or an\n   * `athena-config` message — whether or not it minted the statewire fields.\n   * Lets the provider tell an outdated host (answered, no mount) from no host\n   * at all (the environment preset applies).\n   */\n  hostAnswered: boolean;\n  /** True once config has been received from the parent (or timeout fired). */\n  ready: boolean;\n}\n\nconst BRIDGE_URL_FIELDS = ['statewireSyncUrl', 'backendBaseUrl', 'appUrl'] as const;\n\ntype BridgeUrlField = (typeof BRIDGE_URL_FIELDS)[number];\n\n/** The URL half of {@link ParentBridgeState} — what a host can hand the SDK. */\nexport type ParentBridgeUrls = Pick<ParentBridgeState, BridgeUrlField>;\n\nconst EMPTY_BRIDGE_URLS: ParentBridgeUrls = {\n  statewireSyncUrl: null,\n  backendBaseUrl: null,\n  appUrl: null,\n};\n\n/**\n * Fold an `athena-config` postMessage payload over the current URL set. A\n * field is taken only when it is a string; anything else keeps the previous\n * value. Keys outside {@link BridgeUrlField} (a legacy parent's `apiUrl` /\n * `backendUrl` among them) are dropped.\n */\nexport function mergeBridgeConfigMessage(\n  previous: ParentBridgeUrls,\n  payload: Partial<Record<BridgeUrlField, unknown>>,\n): ParentBridgeUrls {\n  const next: ParentBridgeUrls = {\n    statewireSyncUrl: previous.statewireSyncUrl,\n    backendBaseUrl: previous.backendBaseUrl,\n    appUrl: previous.appUrl,\n  };\n  for (const field of BRIDGE_URL_FIELDS) {\n    const value = payload[field];\n    if (typeof value === 'string') {\n      next[field] = value;\n    }\n  }\n  return next;\n}\n\n/**\n * Read the URL set out of a `/_athena/auth` mint body. Non-string fields are\n * `null`.\n */\nexport function readAuthMintUrls(data: Partial<Record<BridgeUrlField, unknown>>): ParentBridgeUrls {\n  return mergeBridgeConfigMessage(EMPTY_BRIDGE_URLS, data);\n}\n\nexport interface ParentBridgeOptions {\n  /**\n   * Exact parent origins that are allowed to send auth/config via postMessage.\n   * Useful for private-cloud or custom-domain deployments.\n   */\n  trustedOrigins?: string[];\n}\n\n/** How long to wait for the parent bridge before falling back to defaults. */\nconst BRIDGE_TIMEOUT_MS = 2000;\nconst TOKEN_REFRESH_BUFFER_MS = 5 * 60 * 1000;\nconst TOKEN_REFRESH_RETRY_BASE_MS = 60 * 1000;\nconst TOKEN_REFRESH_RETRY_MAX_MS = 5 * 60 * 1000;\nconst DEFAULT_TOKEN_REFRESH_MS = 55 * 60 * 1000;\nconst EMPTY_TRUSTED_ORIGINS: string[] = [];\n\n/** Untrusted shape of the `/_athena/auth` mint body; every field is type-guarded on read. */\ninterface AthenaAuthResponse {\n  token?: unknown;\n  statewireSyncUrl?: unknown;\n  backendBaseUrl?: unknown;\n  appUrl?: unknown;\n  expires_at?: unknown;\n}\n\nconst normalizeOrigin = (value: string): string | null => {\n  try {\n    return new URL(value).origin;\n  } catch {\n    return null;\n  }\n};\n\nexport const getTokenRefreshDelay = (expiresAt: unknown, nowMs: number): number => {\n  if (typeof expiresAt !== 'string') {\n    return DEFAULT_TOKEN_REFRESH_MS;\n  }\n\n  const expiresAtMs = Date.parse(expiresAt);\n  if (!Number.isFinite(expiresAtMs)) {\n    return DEFAULT_TOKEN_REFRESH_MS;\n  }\n\n  return Math.max(TOKEN_REFRESH_RETRY_BASE_MS, expiresAtMs - nowMs - TOKEN_REFRESH_BUFFER_MS);\n};\n\nexport const getAuthRetryDelay = (retryAttempt: number): number => {\n  const safeAttempt = Number.isFinite(retryAttempt) ? Math.max(0, Math.floor(retryAttempt)) : 0;\n  return Math.min(TOKEN_REFRESH_RETRY_MAX_MS, TOKEN_REFRESH_RETRY_BASE_MS * 2 ** safeAttempt);\n};\n\n/**\n * Listens for auth tokens AND environment config from the host environment.\n *\n * Two transport modes, picked automatically:\n *\n * 1. **Iframe (legacy / Olympus inline preview)**: a parent window posts\n *    `athena-config` and `athena-auth` via PostMessage. The hook also posts\n *    `athena-auth-ready` so the parent knows when to (re-)send.\n *\n * 2. **Standalone (Marathon-served deploy URL)**: top-level navigation, no\n *    parent. The hook fetches `/_athena/auth` on its own origin. Marathon\n *    validates its session cookie (sent by the browser automatically) and\n *    returns `{ token, statewireSyncUrl, backendBaseUrl, appUrl }` — the\n *    statewire mount, the bare Agora base and the app origin. A 404 means\n *    we're not on a Marathon origin — the hook falls through with empty\n *    state.\n *\n * In both modes a timeout safety net flips `ready: true` so the app never\n * blocks indefinitely.\n */\nexport function useParentBridge({\n  trustedOrigins = EMPTY_TRUSTED_ORIGINS,\n}: ParentBridgeOptions = {}): ParentBridgeState {\n  const isInIframe = typeof window !== 'undefined' && window.parent !== window;\n  const runtimeTrustedOrigins = useMemo(() => {\n    const origins = new Set<string>();\n\n    if (typeof window !== 'undefined') {\n      origins.add(window.location.origin);\n    }\n\n    for (const trustedOrigin of trustedOrigins) {\n      const normalizedOrigin = normalizeOrigin(trustedOrigin);\n      if (normalizedOrigin) {\n        origins.add(normalizedOrigin);\n      }\n    }\n\n    return [...origins];\n  }, [trustedOrigins]);\n\n  const [state, setState] = useState<ParentBridgeState>({\n    token: null,\n    ...EMPTY_BRIDGE_URLS,\n    hostAnswered: false,\n    ready: false,\n  });\n  const readySignalSent = useRef(false);\n  const configReceived = useRef(false);\n\n  useEffect(() => {\n    if (!isInIframe) return;\n\n    const endBridgeSpan = athenaDiagnostics.span('auth.bridge', 'auth.bridge.start', {\n      mode: 'iframe',\n    });\n    let spanEnded = false;\n    const endOnce: typeof endBridgeSpan = (name, options) => {\n      if (spanEnded) return 0;\n      spanEnded = true;\n      return endBridgeSpan(name, options);\n    };\n\n    const handler = (event: MessageEvent) => {\n      if (!isTrustedOrigin({ origin: event.origin, trustedOrigins: runtimeTrustedOrigins })) {\n        return;\n      }\n      if (!event.data || typeof event.data !== 'object') return;\n\n      if (event.data.type === 'athena-config') {\n        configReceived.current = true;\n        setState((prev) => ({\n          ...prev,\n          ...mergeBridgeConfigMessage(prev, event.data),\n          hostAnswered: true,\n          // Don't set ready here — wait for athena-auth (token) or the timeout.\n          // Setting ready on config alone causes a race: the thread list fires\n          // before the token arrives, falling back to X-API-KEY.\n        }));\n      }\n\n      if (event.data.type === 'athena-auth' && typeof event.data.token === 'string') {\n        endOnce('auth.bridge.ready', { data: { mode: 'iframe' } });\n        athenaDiagnostics.emit('auth.token.acquired', {\n          level: 'debug',\n          data: { source: 'iframe-postmessage' },\n        });\n        setState((prev) => ({\n          ...prev,\n          token: event.data.token,\n          ready: true,\n        }));\n      }\n    };\n    window.addEventListener('message', handler);\n\n    if (!readySignalSent.current) {\n      window.parent.postMessage({ type: 'athena-auth-ready' }, '*');\n      readySignalSent.current = true;\n    }\n\n    const timer = setTimeout(() => {\n      endOnce('auth.bridge.timeout', {\n        data: {\n          mode: 'iframe',\n          timeout_ms: BRIDGE_TIMEOUT_MS,\n          config_received: configReceived.current,\n        },\n      });\n      setState((prev) => (prev.ready ? prev : { ...prev, ready: true }));\n    }, BRIDGE_TIMEOUT_MS);\n\n    return () => {\n      window.removeEventListener('message', handler);\n      clearTimeout(timer);\n    };\n  }, [isInIframe, runtimeTrustedOrigins]);\n\n  useEffect(() => {\n    if (isInIframe) return;\n    if (typeof window === 'undefined') return;\n\n    let cancelled = false;\n    let requestTimer: ReturnType<typeof setTimeout> | null = null;\n    let refreshTimer: ReturnType<typeof setTimeout> | null = null;\n    let controller: AbortController | null = null;\n    let retryAttempt = 0;\n\n    const clearRequestTimer = () => {\n      if (requestTimer) {\n        clearTimeout(requestTimer);\n        requestTimer = null;\n      }\n    };\n\n    const clearRefreshTimer = () => {\n      if (refreshTimer) {\n        clearTimeout(refreshTimer);\n        refreshTimer = null;\n      }\n    };\n\n    const markReady = () => {\n      if (cancelled) return;\n      setState((prev) => (prev.ready ? prev : { ...prev, ready: true }));\n    };\n\n    const scheduleRefresh = (expiresAt: unknown) => {\n      clearRefreshTimer();\n      retryAttempt = 0;\n      const delay = getTokenRefreshDelay(expiresAt, Date.now());\n      refreshTimer = setTimeout(() => {\n        void fetchAuth({ markReadyOnFailure: false });\n      }, delay);\n    };\n\n    const scheduleRetry = () => {\n      clearRefreshTimer();\n      const delay = getAuthRetryDelay(retryAttempt);\n      retryAttempt += 1;\n      refreshTimer = setTimeout(() => {\n        void fetchAuth({ markReadyOnFailure: false });\n      }, delay);\n    };\n\n    const fetchAuth = async ({\n      markReadyOnFailure,\n    }: {\n      markReadyOnFailure: boolean;\n    }) => {\n      controller?.abort();\n      controller = new AbortController();\n\n      // `markReadyOnFailure` distinguishes the initial acquisition (a span the\n      // provider blocks on) from a background refresh. Idempotent: the abort\n      // timer and the catch path can both reach an end call.\n      const isInitial = markReadyOnFailure;\n      const rawEndSpan = isInitial\n        ? athenaDiagnostics.span('auth.bridge', 'auth.bridge.start', { mode: 'marathon' })\n        : null;\n      let spanEnded = false;\n      const endBridgeSpan: typeof rawEndSpan = rawEndSpan\n        ? (name, options) => {\n            if (spanEnded) return 0;\n            spanEnded = true;\n            return rawEndSpan(name, options);\n          }\n        : null;\n\n      clearRequestTimer();\n      requestTimer = setTimeout(() => {\n        controller?.abort();\n        endBridgeSpan?.('auth.bridge.timeout', {\n          data: { mode: 'marathon', timeout_ms: BRIDGE_TIMEOUT_MS },\n        });\n        if (markReadyOnFailure) {\n          markReady();\n        }\n      }, BRIDGE_TIMEOUT_MS);\n\n      try {\n        const resp = await fetch('/_athena/auth', {\n          credentials: 'include',\n          headers: { Accept: 'application/json' },\n          signal: controller.signal,\n        });\n        if (cancelled) return;\n\n        if (!resp.ok) {\n          if (resp.status === 404) {\n            // Not a Marathon origin — expected for standalone/local dev.\n            endBridgeSpan?.('auth.bridge.absent', {\n              data: { mode: 'marathon', status: resp.status },\n            });\n            markReady();\n          } else {\n            const failure = {\n              level: 'warn' as const,\n              data: { mode: 'marathon', status: resp.status },\n            };\n            if (endBridgeSpan) {\n              endBridgeSpan('auth.bridge.error', failure);\n            } else {\n              athenaDiagnostics.emit('auth.token.refresh_failed', failure);\n            }\n            if (markReadyOnFailure) {\n              markReady();\n            }\n            scheduleRetry();\n          }\n          return;\n        }\n\n        const data = (await resp.json()) as AthenaAuthResponse;\n        if (cancelled) return;\n\n        if (endBridgeSpan) {\n          endBridgeSpan('auth.bridge.ready', {\n            data: { mode: 'marathon', has_token: typeof data.token === 'string' },\n          });\n          athenaDiagnostics.emit('auth.token.acquired', {\n            level: 'debug',\n            data: { source: 'marathon', expires_at: data.expires_at },\n          });\n        } else {\n          athenaDiagnostics.emit('auth.token.refreshed', {\n            level: 'debug',\n            data: { source: 'marathon', expires_at: data.expires_at },\n          });\n        }\n\n        setState({\n          token: typeof data.token === 'string' ? data.token : null,\n          ...readAuthMintUrls(data),\n          hostAnswered: true,\n          ready: true,\n        });\n        scheduleRefresh(data.expires_at);\n      } catch (error) {\n        if (!cancelled && !(error instanceof DOMException && error.name === 'AbortError')) {\n          const failure = { level: 'warn' as const, data: { mode: 'marathon' }, error };\n          if (endBridgeSpan) {\n            endBridgeSpan('auth.bridge.error', failure);\n          } else {\n            athenaDiagnostics.emit('auth.token.refresh_failed', failure);\n          }\n        }\n        if (markReadyOnFailure) {\n          markReady();\n        }\n        if (!cancelled) {\n          scheduleRetry();\n        }\n      } finally {\n        clearRequestTimer();\n      }\n    };\n\n    void fetchAuth({ markReadyOnFailure: true });\n\n    return () => {\n      cancelled = true;\n      controller?.abort();\n      clearRequestTimer();\n      clearRefreshTimer();\n    };\n  }, [isInIframe]);\n\n  return state;\n}\n\n/**\n * Legacy hook — returns just the auth token from the parent bridge.\n * Prefer useParentBridge() for new code.\n */\nexport function useParentAuth(): string | null {\n  return useParentBridge().token;\n}\n"],"names":[],"mappings":";;AAUA,SAAS,gBAAgB;AAAA,EACvB;AAAA,EACA;AACF,GAGY;AACV,MAAI;AACF,UAAM,mBAAmB,IAAI,IAAI,MAAM,EAAE;AACzC,QAAI,eAAe,SAAS,gBAAgB,GAAG;AAC7C,aAAO;AAAA,IACT;AAEA,UAAM,EAAE,SAAA,IAAa,IAAI,IAAI,gBAAgB;AAC7C,WACE,aAAa,qBACb,SAAS,SAAS,kBAAkB,KACpC,aAAa;AAAA,EAEjB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA8BA,MAAM,oBAAoB,CAAC,oBAAoB,kBAAkB,QAAQ;AAOzE,MAAM,oBAAsC;AAAA,EAC1C,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,QAAQ;AACV;AAQO,SAAS,yBACd,UACA,SACkB;AAClB,QAAM,OAAyB;AAAA,IAC7B,kBAAkB,SAAS;AAAA,IAC3B,gBAAgB,SAAS;AAAA,IACzB,QAAQ,SAAS;AAAA,EAAA;AAEnB,aAAW,SAAS,mBAAmB;AACrC,UAAM,QAAQ,QAAQ,KAAK;AAC3B,QAAI,OAAO,UAAU,UAAU;AAC7B,WAAK,KAAK,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,iBAAiB,MAAkE;AACjG,SAAO,yBAAyB,mBAAmB,IAAI;AACzD;AAWA,MAAM,oBAAoB;AAC1B,MAAM,0BAA0B,IAAI,KAAK;AACzC,MAAM,8BAA8B,KAAK;AACzC,MAAM,6BAA6B,IAAI,KAAK;AAC5C,MAAM,2BAA2B,KAAK,KAAK;AAC3C,MAAM,wBAAkC,CAAA;AAWxC,MAAM,kBAAkB,CAAC,UAAiC;AACxD,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,MAAM,uBAAuB,CAAC,WAAoB,UAA0B;AACjF,MAAI,OAAO,cAAc,UAAU;AACjC,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,KAAK,MAAM,SAAS;AACxC,MAAI,CAAC,OAAO,SAAS,WAAW,GAAG;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,KAAK,IAAI,6BAA6B,cAAc,QAAQ,uBAAuB;AAC5F;AAEO,MAAM,oBAAoB,CAAC,iBAAiC;AACjE,QAAM,cAAc,OAAO,SAAS,YAAY,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,CAAC,IAAI;AAC5F,SAAO,KAAK,IAAI,4BAA4B,8BAA8B,KAAK,WAAW;AAC5F;AAsBO,SAAS,gBAAgB;AAAA,EAC9B,iBAAiB;AACnB,IAAyB,IAAuB;AAC9C,QAAM,aAAa,OAAO,WAAW,eAAe,OAAO,WAAW;AACtE,QAAM,wBAAwB,QAAQ,MAAM;AAC1C,UAAM,8BAAc,IAAA;AAEpB,QAAI,OAAO,WAAW,aAAa;AACjC,cAAQ,IAAI,OAAO,SAAS,MAAM;AAAA,IACpC;AAEA,eAAW,iBAAiB,gBAAgB;AAC1C,YAAM,mBAAmB,gBAAgB,aAAa;AACtD,UAAI,kBAAkB;AACpB,gBAAQ,IAAI,gBAAgB;AAAA,MAC9B;AAAA,IACF;AAEA,WAAO,CAAC,GAAG,OAAO;AAAA,EACpB,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,CAAC,OAAO,QAAQ,IAAI,SAA4B;AAAA,IACpD,OAAO;AAAA,IACP,GAAG;AAAA,IACH,cAAc;AAAA,IACd,OAAO;AAAA,EAAA,CACR;AACD,QAAM,kBAAkB,OAAO,KAAK;AACpC,QAAM,iBAAiB,OAAO,KAAK;AAEnC,YAAU,MAAM;AACd,QAAI,CAAC,WAAY;AAEjB,UAAM,gBAAgB,kBAAkB,KAAK,eAAe,qBAAqB;AAAA,MAC/E,MAAM;AAAA,IAAA,CACP;AACD,QAAI,YAAY;AAChB,UAAM,UAAgC,CAAC,MAAM,YAAY;AACvD,UAAI,UAAW,QAAO;AACtB,kBAAY;AACZ,aAAO,cAAc,MAAM,OAAO;AAAA,IACpC;AAEA,UAAM,UAAU,CAAC,UAAwB;AACvC,UAAI,CAAC,gBAAgB,EAAE,QAAQ,MAAM,QAAQ,gBAAgB,sBAAA,CAAuB,GAAG;AACrF;AAAA,MACF;AACA,UAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,SAAS,SAAU;AAEnD,UAAI,MAAM,KAAK,SAAS,iBAAiB;AACvC,uBAAe,UAAU;AACzB,iBAAS,CAAC,UAAU;AAAA,UAClB,GAAG;AAAA,UACH,GAAG,yBAAyB,MAAM,MAAM,IAAI;AAAA,UAC5C,cAAc;AAAA;AAAA;AAAA;AAAA,QAAA,EAId;AAAA,MACJ;AAEA,UAAI,MAAM,KAAK,SAAS,iBAAiB,OAAO,MAAM,KAAK,UAAU,UAAU;AAC7E,gBAAQ,qBAAqB,EAAE,MAAM,EAAE,MAAM,SAAA,GAAY;AACzD,0BAAkB,KAAK,uBAAuB;AAAA,UAC5C,OAAO;AAAA,UACP,MAAM,EAAE,QAAQ,qBAAA;AAAA,QAAqB,CACtC;AACD,iBAAS,CAAC,UAAU;AAAA,UAClB,GAAG;AAAA,UACH,OAAO,MAAM,KAAK;AAAA,UAClB,OAAO;AAAA,QAAA,EACP;AAAA,MACJ;AAAA,IACF;AACA,WAAO,iBAAiB,WAAW,OAAO;AAE1C,QAAI,CAAC,gBAAgB,SAAS;AAC5B,aAAO,OAAO,YAAY,EAAE,MAAM,oBAAA,GAAuB,GAAG;AAC5D,sBAAgB,UAAU;AAAA,IAC5B;AAEA,UAAM,QAAQ,WAAW,MAAM;AAC7B,cAAQ,uBAAuB;AAAA,QAC7B,MAAM;AAAA,UACJ,MAAM;AAAA,UACN,YAAY;AAAA,UACZ,iBAAiB,eAAe;AAAA,QAAA;AAAA,MAClC,CACD;AACD,eAAS,CAAC,SAAU,KAAK,QAAQ,OAAO,EAAE,GAAG,MAAM,OAAO,MAAO;AAAA,IACnE,GAAG,iBAAiB;AAEpB,WAAO,MAAM;AACX,aAAO,oBAAoB,WAAW,OAAO;AAC7C,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,YAAY,qBAAqB,CAAC;AAEtC,YAAU,MAAM;AACd,QAAI,WAAY;AAChB,QAAI,OAAO,WAAW,YAAa;AAEnC,QAAI,YAAY;AAChB,QAAI,eAAqD;AACzD,QAAI,eAAqD;AACzD,QAAI,aAAqC;AACzC,QAAI,eAAe;AAEnB,UAAM,oBAAoB,MAAM;AAC9B,UAAI,cAAc;AAChB,qBAAa,YAAY;AACzB,uBAAe;AAAA,MACjB;AAAA,IACF;AAEA,UAAM,oBAAoB,MAAM;AAC9B,UAAI,cAAc;AAChB,qBAAa,YAAY;AACzB,uBAAe;AAAA,MACjB;AAAA,IACF;AAEA,UAAM,YAAY,MAAM;AACtB,UAAI,UAAW;AACf,eAAS,CAAC,SAAU,KAAK,QAAQ,OAAO,EAAE,GAAG,MAAM,OAAO,MAAO;AAAA,IACnE;AAEA,UAAM,kBAAkB,CAAC,cAAuB;AAC9C,wBAAA;AACA,qBAAe;AACf,YAAM,QAAQ,qBAAqB,WAAW,KAAK,KAAK;AACxD,qBAAe,WAAW,MAAM;AAC9B,aAAK,UAAU,EAAE,oBAAoB,OAAO;AAAA,MAC9C,GAAG,KAAK;AAAA,IACV;AAEA,UAAM,gBAAgB,MAAM;AAC1B,wBAAA;AACA,YAAM,QAAQ,kBAAkB,YAAY;AAC5C,sBAAgB;AAChB,qBAAe,WAAW,MAAM;AAC9B,aAAK,UAAU,EAAE,oBAAoB,OAAO;AAAA,MAC9C,GAAG,KAAK;AAAA,IACV;AAEA,UAAM,YAAY,OAAO;AAAA,MACvB;AAAA,IAAA,MAGI;AACJ,+CAAY;AACZ,mBAAa,IAAI,gBAAA;AAKjB,YAAM,YAAY;AAClB,YAAM,aAAa,YACf,kBAAkB,KAAK,eAAe,qBAAqB,EAAE,MAAM,WAAA,CAAY,IAC/E;AACJ,UAAI,YAAY;AAChB,YAAM,gBAAmC,aACrC,CAAC,MAAM,YAAY;AACjB,YAAI,UAAW,QAAO;AACtB,oBAAY;AACZ,eAAO,WAAW,MAAM,OAAO;AAAA,MACjC,IACA;AAEJ,wBAAA;AACA,qBAAe,WAAW,MAAM;AAC9B,iDAAY;AACZ,uDAAgB,uBAAuB;AAAA,UACrC,MAAM,EAAE,MAAM,YAAY,YAAY,kBAAA;AAAA,QAAkB;AAE1D,YAAI,oBAAoB;AACtB,oBAAA;AAAA,QACF;AAAA,MACF,GAAG,iBAAiB;AAEpB,UAAI;AACF,cAAM,OAAO,MAAM,MAAM,iBAAiB;AAAA,UACxC,aAAa;AAAA,UACb,SAAS,EAAE,QAAQ,mBAAA;AAAA,UACnB,QAAQ,WAAW;AAAA,QAAA,CACpB;AACD,YAAI,UAAW;AAEf,YAAI,CAAC,KAAK,IAAI;AACZ,cAAI,KAAK,WAAW,KAAK;AAEvB,2DAAgB,sBAAsB;AAAA,cACpC,MAAM,EAAE,MAAM,YAAY,QAAQ,KAAK,OAAA;AAAA,YAAO;AAEhD,sBAAA;AAAA,UACF,OAAO;AACL,kBAAM,UAAU;AAAA,cACd,OAAO;AAAA,cACP,MAAM,EAAE,MAAM,YAAY,QAAQ,KAAK,OAAA;AAAA,YAAO;AAEhD,gBAAI,eAAe;AACjB,4BAAc,qBAAqB,OAAO;AAAA,YAC5C,OAAO;AACL,gCAAkB,KAAK,6BAA6B,OAAO;AAAA,YAC7D;AACA,gBAAI,oBAAoB;AACtB,wBAAA;AAAA,YACF;AACA,0BAAA;AAAA,UACF;AACA;AAAA,QACF;AAEA,cAAM,OAAQ,MAAM,KAAK,KAAA;AACzB,YAAI,UAAW;AAEf,YAAI,eAAe;AACjB,wBAAc,qBAAqB;AAAA,YACjC,MAAM,EAAE,MAAM,YAAY,WAAW,OAAO,KAAK,UAAU,SAAA;AAAA,UAAS,CACrE;AACD,4BAAkB,KAAK,uBAAuB;AAAA,YAC5C,OAAO;AAAA,YACP,MAAM,EAAE,QAAQ,YAAY,YAAY,KAAK,WAAA;AAAA,UAAW,CACzD;AAAA,QACH,OAAO;AACL,4BAAkB,KAAK,wBAAwB;AAAA,YAC7C,OAAO;AAAA,YACP,MAAM,EAAE,QAAQ,YAAY,YAAY,KAAK,WAAA;AAAA,UAAW,CACzD;AAAA,QACH;AAEA,iBAAS;AAAA,UACP,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;AAAA,UACrD,GAAG,iBAAiB,IAAI;AAAA,UACxB,cAAc;AAAA,UACd,OAAO;AAAA,QAAA,CACR;AACD,wBAAgB,KAAK,UAAU;AAAA,MACjC,SAAS,OAAO;AACd,YAAI,CAAC,aAAa,EAAE,iBAAiB,gBAAgB,MAAM,SAAS,eAAe;AACjF,gBAAM,UAAU,EAAE,OAAO,QAAiB,MAAM,EAAE,MAAM,WAAA,GAAc,MAAA;AACtE,cAAI,eAAe;AACjB,0BAAc,qBAAqB,OAAO;AAAA,UAC5C,OAAO;AACL,8BAAkB,KAAK,6BAA6B,OAAO;AAAA,UAC7D;AAAA,QACF;AACA,YAAI,oBAAoB;AACtB,oBAAA;AAAA,QACF;AACA,YAAI,CAAC,WAAW;AACd,wBAAA;AAAA,QACF;AAAA,MACF,UAAA;AACE,0BAAA;AAAA,MACF;AAAA,IACF;AAEA,SAAK,UAAU,EAAE,oBAAoB,MAAM;AAE3C,WAAO,MAAM;AACX,kBAAY;AACZ,+CAAY;AACZ,wBAAA;AACA,wBAAA;AAAA,IACF;AAAA,EACF,GAAG,CAAC,UAAU,CAAC;AAEf,SAAO;AACT;AAMO,SAAS,gBAA+B;AAC7C,SAAO,kBAAkB;AAC3B;"}

package/dist/runtime/statewire-auth-headers.cjs

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+async function resolveStatewireAuthToken(source, { staleAuth }) {
+  return source.getToken ? await source.getToken({ force: staleAuth }) ?? source.token : source.token;
+}
+async function resolveStatewireAuthHeaders(source, { staleAuth }) {
+  const currentToken = await resolveStatewireAuthToken(source, { staleAuth });
+  if (currentToken) {
+    return { Authorization: `Bearer ${currentToken}` };
+  }
+  if (source.apiKey) {
+    return { "X-API-KEY": source.apiKey };
+  }
+  return {};
+}
+exports.resolveStatewireAuthHeaders = resolveStatewireAuthHeaders;
+exports.resolveStatewireAuthToken = resolveStatewireAuthToken;
+//# sourceMappingURL=statewire-auth-headers.cjs.map

package/dist/runtime/statewire-auth-headers.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"statewire-auth-headers.cjs","sources":["../../src/runtime/statewire-auth-headers.ts"],"sourcesContent":["/**\n * Resolves the caller's current auth token immediately before a statewire\n * attach or request. `force` is true right after the statewire host refused\n * the previous credential (the transport's `staleAuth` signal): a getter that\n * caches must then mint a fresh token instead of returning the one that was\n * just refused. `force: false` (or no argument) may serve a cached token.\n */\nexport type AthenaStatewireTokenGetter = (options?: {\n  force?: boolean;\n}) => string | null | Promise<string | null>;\n\nexport interface StatewireAuthSource {\n  /** API key for standalone authentication; used when no token resolves. */\n  apiKey?: string;\n  /** A token the host already holds; `getToken` takes priority when it resolves one. */\n  token?: string | null;\n  /** Live token resolver for expiring credentials. */\n  getToken?: AthenaStatewireTokenGetter;\n}\n\n/**\n * The token a statewire attach or REST request presents: `getToken` (with the\n * transport's `staleAuth` as `force`) when provided, falling back to the\n * host-held `token` when the getter resolves nothing. A getter failure\n * propagates — a request must fail rather than silently go anonymous.\n */\nexport async function resolveStatewireAuthToken(\n  source: StatewireAuthSource,\n  { staleAuth }: { staleAuth: boolean },\n): Promise<string | null | undefined> {\n  return source.getToken\n    ? ((await source.getToken({ force: staleAuth })) ?? source.token)\n    : source.token;\n}\n\n/**\n * The auth headers a statewire attach or request carries — the same credential\n * plumbing the legacy transport used: a token (resolved live through\n * `getToken` when provided, with the transport's `staleAuth` passed as `force`)\n * rides `Authorization: Bearer`, and an API key falls back to `X-API-KEY`. Both\n * are accepted by the statewire host. Credential rotation reaches the next\n * request because callers read `source` fresh per resolve.\n */\nexport async function resolveStatewireAuthHeaders(\n  source: StatewireAuthSource,\n  { staleAuth }: { staleAuth: boolean },\n): Promise<Record<string, string>> {\n  const currentToken = await resolveStatewireAuthToken(source, { staleAuth });\n  if (currentToken) {\n    return { Authorization: `Bearer ${currentToken}` };\n  }\n  if (source.apiKey) {\n    return { 'X-API-KEY': source.apiKey };\n  }\n  return {};\n}\n"],"names":[],"mappings":";;AA0BA,eAAsB,0BACpB,QACA,EAAE,aACkC;AACpC,SAAO,OAAO,WACR,MAAM,OAAO,SAAS,EAAE,OAAO,UAAA,CAAW,KAAM,OAAO,QACzD,OAAO;AACb;AAUA,eAAsB,4BACpB,QACA,EAAE,aAC+B;AACjC,QAAM,eAAe,MAAM,0BAA0B,QAAQ,EAAE,WAAW;AAC1E,MAAI,cAAc;AAChB,WAAO,EAAE,eAAe,UAAU,YAAY,GAAA;AAAA,EAChD;AACA,MAAI,OAAO,QAAQ;AACjB,WAAO,EAAE,aAAa,OAAO,OAAA;AAAA,EAC/B;AACA,SAAO,CAAA;AACT;;;"}

package/dist/runtime/statewire-auth-headers.js

@@ -0,0 +1,18 @@
+async function resolveStatewireAuthToken(source, { staleAuth }) {
+  return source.getToken ? await source.getToken({ force: staleAuth }) ?? source.token : source.token;
+}
+async function resolveStatewireAuthHeaders(source, { staleAuth }) {
+  const currentToken = await resolveStatewireAuthToken(source, { staleAuth });
+  if (currentToken) {
+    return { Authorization: `Bearer ${currentToken}` };
+  }
+  if (source.apiKey) {
+    return { "X-API-KEY": source.apiKey };
+  }
+  return {};
+}
+export {
+  resolveStatewireAuthHeaders,
+  resolveStatewireAuthToken
+};
+//# sourceMappingURL=statewire-auth-headers.js.map

package/dist/runtime/statewire-auth-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statewire-auth-headers.js","sources":["../../src/runtime/statewire-auth-headers.ts"],"sourcesContent":["/**\n * Resolves the caller's current auth token immediately before a statewire\n * attach or request. `force` is true right after the statewire host refused\n * the previous credential (the transport's `staleAuth` signal): a getter that\n * caches must then mint a fresh token instead of returning the one that was\n * just refused. `force: false` (or no argument) may serve a cached token.\n */\nexport type AthenaStatewireTokenGetter = (options?: {\n  force?: boolean;\n}) => string | null | Promise<string | null>;\n\nexport interface StatewireAuthSource {\n  /** API key for standalone authentication; used when no token resolves. */\n  apiKey?: string;\n  /** A token the host already holds; `getToken` takes priority when it resolves one. */\n  token?: string | null;\n  /** Live token resolver for expiring credentials. */\n  getToken?: AthenaStatewireTokenGetter;\n}\n\n/**\n * The token a statewire attach or REST request presents: `getToken` (with the\n * transport's `staleAuth` as `force`) when provided, falling back to the\n * host-held `token` when the getter resolves nothing. A getter failure\n * propagates — a request must fail rather than silently go anonymous.\n */\nexport async function resolveStatewireAuthToken(\n  source: StatewireAuthSource,\n  { staleAuth }: { staleAuth: boolean },\n): Promise<string | null | undefined> {\n  return source.getToken\n    ? ((await source.getToken({ force: staleAuth })) ?? source.token)\n    : source.token;\n}\n\n/**\n * The auth headers a statewire attach or request carries — the same credential\n * plumbing the legacy transport used: a token (resolved live through\n * `getToken` when provided, with the transport's `staleAuth` passed as `force`)\n * rides `Authorization: Bearer`, and an API key falls back to `X-API-KEY`. Both\n * are accepted by the statewire host. Credential rotation reaches the next\n * request because callers read `source` fresh per resolve.\n */\nexport async function resolveStatewireAuthHeaders(\n  source: StatewireAuthSource,\n  { staleAuth }: { staleAuth: boolean },\n): Promise<Record<string, string>> {\n  const currentToken = await resolveStatewireAuthToken(source, { staleAuth });\n  if (currentToken) {\n    return { Authorization: `Bearer ${currentToken}` };\n  }\n  if (source.apiKey) {\n    return { 'X-API-KEY': source.apiKey };\n  }\n  return {};\n}\n"],"names":[],"mappings":"AA0BA,eAAsB,0BACpB,QACA,EAAE,aACkC;AACpC,SAAO,OAAO,WACR,MAAM,OAAO,SAAS,EAAE,OAAO,UAAA,CAAW,KAAM,OAAO,QACzD,OAAO;AACb;AAUA,eAAsB,4BACpB,QACA,EAAE,aAC+B;AACjC,QAAM,eAAe,MAAM,0BAA0B,QAAQ,EAAE,WAAW;AAC1E,MAAI,cAAc;AAChB,WAAO,EAAE,eAAe,UAAU,YAAY,GAAA;AAAA,EAChD;AACA,MAAI,OAAO,QAAQ;AACjB,WAAO,EAAE,aAAa,OAAO,OAAA;AAAA,EAC/B;AACA,SAAO,CAAA;AACT;"}

package/dist/runtime/statewire-lifecycle.cjs

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../packages/agent-runtime/src/generated/runconfig-contract.cjs");
+require("react");
+require("@assistant-ui/tap");
+require("statewire");
+const errors = require("../packages/agent-runtime/src/errors.cjs");
+require("../packages/agent-runtime/src/statewire-suspended.cjs");
+require("@tanstack/react-query");
+require("../packages/agent-runtime/src/statewire-state.cjs");
+require("../packages/agent-runtime/src/messages.cjs");
+require("@assistant-ui/react-statewire");
+require("@assistant-ui/store");
+require("../packages/agent-runtime/src/quota-safe-local-storage-session.cjs");
+require("../packages/agent-runtime/src/statewire-attach-observer.cjs");
+require("../packages/agent-runtime/src/thread-status.cjs");
+require("@assistant-ui/core");
+require("../packages/agent-runtime/src/thread-handoff.cjs");
+function athenaStatewireErrorNotice(error) {
+  if (errors.isStatewireChannelTeardown(error)) return null;
+  const rejection = errors.statewireRejectionPayload(error);
+  const detail = errors.statewireRejectionDetailMessage(error);
+  if ((rejection == null ? void 0 : rejection.status) === 402) {
+    return {
+      kind: "paywall",
+      title: "Usage limit reached",
+      message: detail ?? "Athena could not start this run. Review usage or billing to continue."
+    };
+  }
+  if (errors.isLegacyThreadReadOnlyRejection(error)) {
+    return {
+      kind: "read-only",
+      title: "Message was not sent",
+      message: detail ?? "This conversation cannot take new messages right now. Try again shortly, or start a new chat."
+    };
+  }
+  return {
+    kind: "command",
+    title: "Message was not sent",
+    message: detail ?? (error instanceof Error && error.message.length > 0 ? error.message : "The chat runtime rejected the command. Please try again.")
+  };
+}
+const initialStatewireLifecycle = {
+  connection: null,
+  error: null,
+  reconnect: null
+};
+function statewireLifecycleReducer(state, action) {
+  var _a, _b;
+  switch (action.type) {
+    case "connection": {
+      const healthy = ((_a = action.connection) == null ? void 0 : _a.status) === "connected" || ((_b = action.connection) == null ? void 0 : _b.status) === "standby";
+      return {
+        ...state,
+        connection: action.connection,
+        error: healthy ? null : state.error
+      };
+    }
+    case "error":
+      return { ...state, error: action.error };
+    case "raw-connection":
+      return { ...state, reconnect: action.reconnect };
+  }
+}
+exports.athenaStatewireErrorNotice = athenaStatewireErrorNotice;
+exports.initialStatewireLifecycle = initialStatewireLifecycle;
+exports.statewireLifecycleReducer = statewireLifecycleReducer;
+//# sourceMappingURL=statewire-lifecycle.cjs.map

package/dist/runtime/statewire-lifecycle.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"statewire-lifecycle.cjs","sources":["../../src/runtime/statewire-lifecycle.ts"],"sourcesContent":["import {\n  isLegacyThreadReadOnlyRejection,\n  isStatewireChannelTeardown,\n  statewireRejectionDetailMessage,\n  statewireRejectionPayload,\n} from '@athenaintel/agent-runtime';\nimport type { DeepAgentConnectionState } from '@athenaintel/agent-runtime';\n\n/** A user-visible notice mapped from a statewire transport error. */\nexport interface AthenaStatewireErrorNotice {\n  kind: 'paywall' | 'read-only' | 'command';\n  title: string;\n  message: string;\n}\n\n/**\n * Map the statewire failure envelope to a concise, actionable notice.\n * Returns null for expected channel teardowns (thread switch, unmount),\n * which must not surface as errors.\n */\nexport function athenaStatewireErrorNotice(\n  error: unknown,\n): AthenaStatewireErrorNotice | null {\n  if (isStatewireChannelTeardown(error)) return null;\n  const rejection = statewireRejectionPayload(error);\n  // The server's own detail names the actionable reason; the Error message is\n  // generic client-side text like `command rejected (500)`.\n  const detail = statewireRejectionDetailMessage(error);\n\n  if (rejection?.status === 402) {\n    return {\n      kind: 'paywall',\n      title: 'Usage limit reached',\n      message:\n        detail ?? 'Athena could not start this run. Review usage or billing to continue.',\n    };\n  }\n\n  // Legacy-thread dispatch fence: an out-of-band run is writing this\n  // pre-cutover thread (or its adoption failed). A per-send failure, not a\n  // standing state — the server's detail names the actionable reason (wait\n  // for the run vs. start a new chat).\n  if (isLegacyThreadReadOnlyRejection(error)) {\n    return {\n      kind: 'read-only',\n      title: 'Message was not sent',\n      message:\n        detail ??\n        'This conversation cannot take new messages right now. Try again shortly, or start a new chat.',\n    };\n  }\n\n  return {\n    kind: 'command',\n    title: 'Message was not sent',\n    message:\n      detail ??\n      (error instanceof Error && error.message.length > 0\n        ? error.message\n        : 'The chat runtime rejected the command. Please try again.'),\n  };\n}\n\n/** Shared lifecycle state for the statewire transport, provided by\n *  `AthenaProvider` in statewire mode and read by the chat banners. */\nexport interface AthenaStatewireLifecycleState {\n  connection: DeepAgentConnectionState | null;\n  error: AthenaStatewireErrorNotice | null;\n  reconnect: (() => void) | null;\n  dismissError: () => void;\n}\n\n/** The provider's reducer state behind {@link AthenaStatewireLifecycleState}. */\nexport interface StatewireLifecycleReducerState {\n  connection: DeepAgentConnectionState | null;\n  error: AthenaStatewireErrorNotice | null;\n  reconnect: (() => void) | null;\n}\n\nexport type StatewireLifecycleAction =\n  | { type: 'connection'; connection: DeepAgentConnectionState | null }\n  | { type: 'error'; error: AthenaStatewireErrorNotice | null }\n  | { type: 'raw-connection'; reconnect: () => void };\n\nexport const initialStatewireLifecycle: StatewireLifecycleReducerState = {\n  connection: null,\n  error: null,\n  reconnect: null,\n};\n\n/**\n * Folds the runtime's lifecycle observations into the banner state. A healthy\n * channel — connected, or disconnected only because the instance is quiet\n * (`idle`) or the chat has not sent yet (`deferred`) — clears a stale\n * send/transport error: leaving it up tells the user the chat is broken after\n * it has come back.\n */\nexport function statewireLifecycleReducer(\n  state: StatewireLifecycleReducerState,\n  action: StatewireLifecycleAction,\n): StatewireLifecycleReducerState {\n  switch (action.type) {\n    case 'connection': {\n      const healthy =\n        action.connection?.status === 'connected' ||\n        action.connection?.status === 'standby';\n      return {\n        ...state,\n        connection: action.connection,\n        error: healthy ? null : state.error,\n      };\n    }\n    case 'error':\n      return { ...state, error: action.error };\n    case 'raw-connection':\n      return { ...state, reconnect: action.reconnect };\n  }\n}\n"],"names":["isStatewireChannelTeardown","statewireRejectionPayload","statewireRejectionDetailMessage","isLegacyThreadReadOnlyRejection"],"mappings":";;;;;;;;;;;;;;;;;;AAoBO,SAAS,2BACd,OACmC;AACnC,MAAIA,OAAAA,2BAA2B,KAAK,EAAG,QAAO;AAC9C,QAAM,YAAYC,OAAAA,0BAA0B,KAAK;AAGjD,QAAM,SAASC,OAAAA,gCAAgC,KAAK;AAEpD,OAAI,uCAAW,YAAW,KAAK;AAC7B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SACE,UAAU;AAAA,IAAA;AAAA,EAEhB;AAMA,MAAIC,OAAAA,gCAAgC,KAAK,GAAG;AAC1C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SACE,UACA;AAAA,IAAA;AAAA,EAEN;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SACE,WACC,iBAAiB,SAAS,MAAM,QAAQ,SAAS,IAC9C,MAAM,UACN;AAAA,EAAA;AAEV;AAuBO,MAAM,4BAA4D;AAAA,EACvE,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,WAAW;AACb;AASO,SAAS,0BACd,OACA,QACgC;;AAChC,UAAQ,OAAO,MAAA;AAAA,IACb,KAAK,cAAc;AACjB,YAAM,YACJ,YAAO,eAAP,mBAAmB,YAAW,iBAC9B,YAAO,eAAP,mBAAmB,YAAW;AAChC,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY,OAAO;AAAA,QACnB,OAAO,UAAU,OAAO,MAAM;AAAA,MAAA;AAAA,IAElC;AAAA,IACA,KAAK;AACH,aAAO,EAAE,GAAG,OAAO,OAAO,OAAO,MAAA;AAAA,IACnC,KAAK;AACH,aAAO,EAAE,GAAG,OAAO,WAAW,OAAO,UAAA;AAAA,EAAU;AAErD;;;;"}

package/dist/runtime/statewire-lifecycle.js

@@ -0,0 +1,68 @@
+import "../packages/agent-runtime/src/generated/runconfig-contract.js";
+import "react";
+import "@assistant-ui/tap";
+import "statewire";
+import { isStatewireChannelTeardown, statewireRejectionPayload, statewireRejectionDetailMessage, isLegacyThreadReadOnlyRejection } from "../packages/agent-runtime/src/errors.js";
+import "../packages/agent-runtime/src/statewire-suspended.js";
+import "@tanstack/react-query";
+import "../packages/agent-runtime/src/statewire-state.js";
+import "../packages/agent-runtime/src/messages.js";
+import "@assistant-ui/react-statewire";
+import "@assistant-ui/store";
+import "../packages/agent-runtime/src/quota-safe-local-storage-session.js";
+import "../packages/agent-runtime/src/statewire-attach-observer.js";
+import "../packages/agent-runtime/src/thread-status.js";
+import "@assistant-ui/core";
+import "../packages/agent-runtime/src/thread-handoff.js";
+function athenaStatewireErrorNotice(error) {
+  if (isStatewireChannelTeardown(error)) return null;
+  const rejection = statewireRejectionPayload(error);
+  const detail = statewireRejectionDetailMessage(error);
+  if ((rejection == null ? void 0 : rejection.status) === 402) {
+    return {
+      kind: "paywall",
+      title: "Usage limit reached",
+      message: detail ?? "Athena could not start this run. Review usage or billing to continue."
+    };
+  }
+  if (isLegacyThreadReadOnlyRejection(error)) {
+    return {
+      kind: "read-only",
+      title: "Message was not sent",
+      message: detail ?? "This conversation cannot take new messages right now. Try again shortly, or start a new chat."
+    };
+  }
+  return {
+    kind: "command",
+    title: "Message was not sent",
+    message: detail ?? (error instanceof Error && error.message.length > 0 ? error.message : "The chat runtime rejected the command. Please try again.")
+  };
+}
+const initialStatewireLifecycle = {
+  connection: null,
+  error: null,
+  reconnect: null
+};
+function statewireLifecycleReducer(state, action) {
+  var _a, _b;
+  switch (action.type) {
+    case "connection": {
+      const healthy = ((_a = action.connection) == null ? void 0 : _a.status) === "connected" || ((_b = action.connection) == null ? void 0 : _b.status) === "standby";
+      return {
+        ...state,
+        connection: action.connection,
+        error: healthy ? null : state.error
+      };
+    }
+    case "error":
+      return { ...state, error: action.error };
+    case "raw-connection":
+      return { ...state, reconnect: action.reconnect };
+  }
+}
+export {
+  athenaStatewireErrorNotice,
+  initialStatewireLifecycle,
+  statewireLifecycleReducer
+};
+//# sourceMappingURL=statewire-lifecycle.js.map

package/dist/runtime/statewire-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statewire-lifecycle.js","sources":["../../src/runtime/statewire-lifecycle.ts"],"sourcesContent":["import {\n  isLegacyThreadReadOnlyRejection,\n  isStatewireChannelTeardown,\n  statewireRejectionDetailMessage,\n  statewireRejectionPayload,\n} from '@athenaintel/agent-runtime';\nimport type { DeepAgentConnectionState } from '@athenaintel/agent-runtime';\n\n/** A user-visible notice mapped from a statewire transport error. */\nexport interface AthenaStatewireErrorNotice {\n  kind: 'paywall' | 'read-only' | 'command';\n  title: string;\n  message: string;\n}\n\n/**\n * Map the statewire failure envelope to a concise, actionable notice.\n * Returns null for expected channel teardowns (thread switch, unmount),\n * which must not surface as errors.\n */\nexport function athenaStatewireErrorNotice(\n  error: unknown,\n): AthenaStatewireErrorNotice | null {\n  if (isStatewireChannelTeardown(error)) return null;\n  const rejection = statewireRejectionPayload(error);\n  // The server's own detail names the actionable reason; the Error message is\n  // generic client-side text like `command rejected (500)`.\n  const detail = statewireRejectionDetailMessage(error);\n\n  if (rejection?.status === 402) {\n    return {\n      kind: 'paywall',\n      title: 'Usage limit reached',\n      message:\n        detail ?? 'Athena could not start this run. Review usage or billing to continue.',\n    };\n  }\n\n  // Legacy-thread dispatch fence: an out-of-band run is writing this\n  // pre-cutover thread (or its adoption failed). A per-send failure, not a\n  // standing state — the server's detail names the actionable reason (wait\n  // for the run vs. start a new chat).\n  if (isLegacyThreadReadOnlyRejection(error)) {\n    return {\n      kind: 'read-only',\n      title: 'Message was not sent',\n      message:\n        detail ??\n        'This conversation cannot take new messages right now. Try again shortly, or start a new chat.',\n    };\n  }\n\n  return {\n    kind: 'command',\n    title: 'Message was not sent',\n    message:\n      detail ??\n      (error instanceof Error && error.message.length > 0\n        ? error.message\n        : 'The chat runtime rejected the command. Please try again.'),\n  };\n}\n\n/** Shared lifecycle state for the statewire transport, provided by\n *  `AthenaProvider` in statewire mode and read by the chat banners. */\nexport interface AthenaStatewireLifecycleState {\n  connection: DeepAgentConnectionState | null;\n  error: AthenaStatewireErrorNotice | null;\n  reconnect: (() => void) | null;\n  dismissError: () => void;\n}\n\n/** The provider's reducer state behind {@link AthenaStatewireLifecycleState}. */\nexport interface StatewireLifecycleReducerState {\n  connection: DeepAgentConnectionState | null;\n  error: AthenaStatewireErrorNotice | null;\n  reconnect: (() => void) | null;\n}\n\nexport type StatewireLifecycleAction =\n  | { type: 'connection'; connection: DeepAgentConnectionState | null }\n  | { type: 'error'; error: AthenaStatewireErrorNotice | null }\n  | { type: 'raw-connection'; reconnect: () => void };\n\nexport const initialStatewireLifecycle: StatewireLifecycleReducerState = {\n  connection: null,\n  error: null,\n  reconnect: null,\n};\n\n/**\n * Folds the runtime's lifecycle observations into the banner state. A healthy\n * channel — connected, or disconnected only because the instance is quiet\n * (`idle`) or the chat has not sent yet (`deferred`) — clears a stale\n * send/transport error: leaving it up tells the user the chat is broken after\n * it has come back.\n */\nexport function statewireLifecycleReducer(\n  state: StatewireLifecycleReducerState,\n  action: StatewireLifecycleAction,\n): StatewireLifecycleReducerState {\n  switch (action.type) {\n    case 'connection': {\n      const healthy =\n        action.connection?.status === 'connected' ||\n        action.connection?.status === 'standby';\n      return {\n        ...state,\n        connection: action.connection,\n        error: healthy ? null : state.error,\n      };\n    }\n    case 'error':\n      return { ...state, error: action.error };\n    case 'raw-connection':\n      return { ...state, reconnect: action.reconnect };\n  }\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAoBO,SAAS,2BACd,OACmC;AACnC,MAAI,2BAA2B,KAAK,EAAG,QAAO;AAC9C,QAAM,YAAY,0BAA0B,KAAK;AAGjD,QAAM,SAAS,gCAAgC,KAAK;AAEpD,OAAI,uCAAW,YAAW,KAAK;AAC7B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SACE,UAAU;AAAA,IAAA;AAAA,EAEhB;AAMA,MAAI,gCAAgC,KAAK,GAAG;AAC1C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,SACE,UACA;AAAA,IAAA;AAAA,EAEN;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SACE,WACC,iBAAiB,SAAS,MAAM,QAAQ,SAAS,IAC9C,MAAM,UACN;AAAA,EAAA;AAEV;AAuBO,MAAM,4BAA4D;AAAA,EACvE,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,WAAW;AACb;AASO,SAAS,0BACd,OACA,QACgC;;AAChC,UAAQ,OAAO,MAAA;AAAA,IACb,KAAK,cAAc;AACjB,YAAM,YACJ,YAAO,eAAP,mBAAmB,YAAW,iBAC9B,YAAO,eAAP,mBAAmB,YAAW;AAChC,aAAO;AAAA,QACL,GAAG;AAAA,QACH,YAAY,OAAO;AAAA,QACnB,OAAO,UAAU,OAAO,MAAM;AAAA,MAAA;AAAA,IAElC;AAAA,IACA,KAAK;AACH,aAAO,EAAE,GAAG,OAAO,OAAO,OAAO,MAAA;AAAA,IACnC,KAAK;AACH,aAAO,EAAE,GAAG,OAAO,WAAW,OAAO,UAAA;AAAA,EAAU;AAErD;"}

package/dist/runtime/statewire-run-config.cjs

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const DEEP_AGENT_RUNTIME_MARKER = "athena_deep_agent";
+const STATEWIRE_START_CHANNEL = "web";
+const STATEWIRE_RUN_LABEL = "Athena SDK";
+const DEFAULT_STATEWIRE_MODEL = "claude-sonnet-5";
+const COLLAB_AGENT_REF_PREFIX = "collab_agent:";
+const COLLAB_AGENT_REF_SHAPE = "collab_agent:<asset_id>";
+function parseCollabAgentRef(agent) {
+  if (typeof agent !== "string" || !agent.startsWith(COLLAB_AGENT_REF_PREFIX)) return null;
+  const assetId = agent.slice(COLLAB_AGENT_REF_PREFIX.length).trim();
+  return assetId || null;
+}
+function resolveAgentProp({ agent }) {
+  if (agent === void 0 || agent === null || agent.trim() === "") return null;
+  const assetId = parseCollabAgentRef(agent.trim());
+  if (assetId) return assetId;
+  throw new Error(
+    `[AthenaSDK] Unsupported \`agent\` prop ${JSON.stringify(agent)}. The only accepted shape is '${COLLAB_AGENT_REF_SHAPE}' (the asset id of a published collab agent). Named agents are not supported — the statewire host always runs the Athena deep agent; omit \`agent\` to use it.`
+  );
+}
+function buildStatewireRunConfig(options = {}) {
+  var _a, _b, _c, _d, _e;
+  const collabAgentId = resolveAgentProp({ agent: options.agent });
+  const collabChannelId = collabAgentId && ((_a = options.channel) == null ? void 0 : _a.trim()) ? options.channel.trim() : void 0;
+  const model = options.model ?? (collabAgentId ? void 0 : DEFAULT_STATEWIRE_MODEL);
+  const panelModel = model ?? DEFAULT_STATEWIRE_MODEL;
+  const enabledTools = Array.from(
+    /* @__PURE__ */ new Set([...options.tools ?? [], ...options.frontendToolIds ?? []])
+  );
+  const systemPrompt = ((_b = options.systemPrompt) == null ? void 0 : _b.trim()) ?? "";
+  return {
+    custom: {
+      runtime: DEEP_AGENT_RUNTIME_MARKER,
+      // With a collab channel selected, omit the SDK's own 'web' stamp: the
+      // request's explicit start_channel would win over the backend overlay's
+      // kind-mapped provenance (a custom SMS channel must stamp 'sms').
+      ...collabChannelId ? {} : { start_channel: STATEWIRE_START_CHANNEL },
+      ...model ? { model } : {},
+      // An empty list is behavior-identical to an absent key for the parser
+      // (both coerce to []), but the collab-agent overlay merges request keys
+      // OVER the agent definition — so an explicit empty list would erase the
+      // agent's configured tools. Omit it when empty.
+      ...enabledTools.length > 0 ? { enabled_tools: enabledTools } : {},
+      panel_config: {
+        model: panelModel,
+        enabled_tools: enabledTools,
+        system_prompt: systemPrompt,
+        run_label: STATEWIRE_RUN_LABEL
+      },
+      ...collabAgentId ? { collab_agent_id: collabAgentId } : {},
+      ...collabChannelId ? { collab_channel_id: collabChannelId } : {},
+      ...systemPrompt ? { system_prompt: systemPrompt } : {},
+      ...((_c = options.workbench) == null ? void 0 : _c.length) ? { workbench: options.workbench } : {},
+      ...((_d = options.knowledgeBase) == null ? void 0 : _d.length) ? { knowledge_base: options.knowledgeBase } : {},
+      ...options.appId ? { app_id: options.appId } : {},
+      ...((_e = options.clientTools) == null ? void 0 : _e.length) ? { client_tools: options.clientTools } : {},
+      ...options.extraRunConfig ?? {}
+    }
+  };
+}
+exports.COLLAB_AGENT_REF_PREFIX = COLLAB_AGENT_REF_PREFIX;
+exports.COLLAB_AGENT_REF_SHAPE = COLLAB_AGENT_REF_SHAPE;
+exports.DEFAULT_STATEWIRE_MODEL = DEFAULT_STATEWIRE_MODEL;
+exports.buildStatewireRunConfig = buildStatewireRunConfig;
+exports.parseCollabAgentRef = parseCollabAgentRef;
+exports.resolveAgentProp = resolveAgentProp;
+//# sourceMappingURL=statewire-run-config.cjs.map