@athenaintel/react 0.24.0 → 0.25.0

package/dist/chat-ui/mentions/suggestions/data/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","sources":["../../../../../src/chat-ui/mentions/suggestions/data/api-client.ts"],"sourcesContent":["/**\n * API client for mention data fetching.\n *\n * Wraps raw fetch() with GraphQL support. Hosts authenticate with either a\n * bearer token or a workspace API key; agora's /graphql accepts both.\n */\n\nimport { createContext, useContext } from \"react\";\n\n// ── Auth context ──\n\nexport interface MentionAuthContext {\n  backendUrl: string;\n  appUrl?: string;\n  /** Bearer credential; hosts without one authenticate with `apiKey`. */\n  accessToken?: string;\n  /** Resolve a current bearer before each query (for rotating Office sessions). */\n  getAccessToken?: () => Promise<string>;\n  apiKey?: string;\n  /**\n   * With neither credential, ride the browser's same-origin session cookie\n   * instead of failing — the SDK's AthenaChat, whose REST helpers make the\n   * same choice for a host that configured no token and no API key. Hosts\n   * that always hold a credential leave this unset so an accidental anonymous\n   * query fails loudly.\n   */\n  credentials?: \"include\";\n  workspaceId?: string;\n  userId?: string;\n}\n\n/** Credential headers (or the cookie lane) for a mention fetch. */\nexport function mentionRequestInit(\n  auth: MentionAuthContext,\n): Pick<RequestInit, \"headers\" | \"credentials\"> {\n  if (auth.accessToken) {\n    return { headers: { Authorization: `Bearer ${auth.accessToken}` } };\n  }\n  if (auth.apiKey) return { headers: { \"X-API-KEY\": auth.apiKey } };\n  if (auth.credentials) return { headers: {}, credentials: auth.credentials };\n  throw new Error(\"MentionAuthCtx needs either an accessToken or an apiKey\");\n}\n\nexport const MentionAuthCtx = createContext<MentionAuthContext | null>(null);\n\nexport function useMentionAuth(): MentionAuthContext {\n  const ctx = useContext(MentionAuthCtx);\n  if (!ctx) throw new Error(\"MentionAuthCtx not provided\");\n  return ctx;\n}\n\n// ── GraphQL client ──\n\nexport async function fetchGraphQL<T = any>(\n  auth: MentionAuthContext,\n  query: string,\n  variables: Record<string, any> = {},\n): Promise<T> {\n  const url = `${auth.backendUrl.replace(/\\/+$/, \"\")}/graphql`;\n  const requestAuth = auth.getAccessToken\n    ? { ...auth, accessToken: await auth.getAccessToken() }\n    : auth;\n  const { headers, credentials } = mentionRequestInit(requestAuth);\n  const response = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/json\",\n      ...headers,\n    },\n    ...(credentials ? { credentials } : {}),\n    body: JSON.stringify({ query, variables }),\n  });\n\n  if (!response.ok) {\n    throw new Error(`GraphQL HTTP ${response.status}: ${response.statusText}`);\n  }\n\n  const result = await response.json();\n  if (result.errors?.length) {\n    throw new Error(`GraphQL error: ${result.errors[0].message}`);\n  }\n\n  return result.data as T;\n}\n\n// ── GraphQL Queries ──\n\n/**\n * Lightweight asset fragment for mention menu items.\n * Only fetches fields needed for display + navigation.\n */\nconst MENTION_ASSET_FIELDS = `\n  id\n  title\n  athenaOriginalType\n  athenaConvertedType\n  parentFolderId\n  updatedAt\n  isFavorited\n  isArchived\n  isHidden\n`;\n\nexport const SIMPLE_SEARCH_QUERY = `\n  query SimpleSearch($input: SimpleSearchRequestInput!) {\n    simpleSearch(input: $input) {\n      assets {\n        ${MENTION_ASSET_FIELDS}\n      }\n      totalCount\n    }\n  }\n`;\n\nexport const PAGINATED_ASSETS_QUERY = `\n  query GetPaginatedAssetsForWorkspace(\n    $limit: Int!\n    $offset: Int!\n    $parentFolderId: String\n    $filterTypes: [String!]\n    $filterColumns: ColumnFilter\n  ) {\n    getPaginatedAssetsForWorkspace(\n      limit: $limit\n      offset: $offset\n      parentFolderId: $parentFolderId\n      filterTypes: $filterTypes\n      filterColumns: $filterColumns\n    ) {\n      ${MENTION_ASSET_FIELDS}\n    }\n  }\n`;\n\nexport const WORKSPACE_MEMBERS_QUERY = `\n  query GetUsersInWorkspace($workspaceId: String!) {\n    getUsersInWorkspace(workspaceId: $workspaceId) {\n      id\n      email\n      firstName\n      lastName\n      isAdmin\n      avatarUrl\n    }\n  }\n`;\n\nexport const TOOL_CATALOG_QUERY = `\n  query MentionToolCatalog {\n    getToolkitToToolsMapping {\n      tools {\n        id\n        name\n        description\n        icon\n        adminOnly\n        isMentionable\n      }\n      toolkits {\n        name\n        displayName\n        description\n        icon\n        onlyAdmin\n        hideFromMenu\n        isMentionable\n      }\n    }\n  }\n`;\n\n// ── Response types ──\n\nexport interface ToolCatalogTool {\n  id: string;\n  name: string;\n  description: string | null;\n  icon: string;\n  adminOnly: boolean;\n  isMentionable: boolean;\n}\n\nexport interface ToolCatalogToolkit {\n  name: string;\n  displayName: string;\n  description: string;\n  icon: string;\n  onlyAdmin: boolean;\n  hideFromMenu: boolean;\n  isMentionable: boolean;\n}\n\nexport interface ToolCatalogResult {\n  getToolkitToToolsMapping: {\n    tools: ToolCatalogTool[];\n    toolkits: ToolCatalogToolkit[];\n  };\n}\n\nexport interface AssetResult {\n  id: string;\n  title: string | null;\n  athenaOriginalType: string | null;\n  athenaConvertedType: string | null;\n  parentFolderId: string | null;\n  updatedAt: string | null;\n  isFavorited: boolean | null;\n  isArchived: boolean | null;\n  isHidden: boolean | null;\n}\n\nexport interface WorkspaceMember {\n  id: string;\n  email: string | null;\n  firstName: string | null;\n  lastName: string | null;\n  isAdmin: boolean;\n  avatarUrl: string | null;\n}\n"],"names":[],"mappings":";AAgCO,SAAS,mBACd,MAC8C;AAC9C,MAAI,KAAK,aAAa;AACpB,WAAO,EAAE,SAAS,EAAE,eAAe,UAAU,KAAK,WAAW,KAAG;AAAA,EAClE;AACA,MAAI,KAAK,OAAQ,QAAO,EAAE,SAAS,EAAE,aAAa,KAAK,SAAO;AAC9D,MAAI,KAAK,YAAa,QAAO,EAAE,SAAS,CAAA,GAAI,aAAa,KAAK,YAAA;AAC9D,QAAM,IAAI,MAAM,yDAAyD;AAC3E;AAEO,MAAM,iBAAiB,cAAyC,IAAI;AAEpE,SAAS,iBAAqC;AACnD,QAAM,MAAM,WAAW,cAAc;AACrC,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,6BAA6B;AACvD,SAAO;AACT;AAIA,eAAsB,aACpB,MACA,OACA,YAAiC,CAAA,GACrB;;AACZ,QAAM,MAAM,GAAG,KAAK,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAClD,QAAM,cAAc,KAAK,iBACrB,EAAE,GAAG,MAAM,aAAa,MAAM,KAAK,eAAA,EAAe,IAClD;AACJ,QAAM,EAAE,SAAS,gBAAgB,mBAAmB,WAAW;AAC/D,QAAM,WAAW,MAAM,MAAM,KAAK;AAAA,IAChC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,GAAG;AAAA,IAAA;AAAA,IAEL,GAAI,cAAc,EAAE,YAAA,IAAgB,CAAA;AAAA,IACpC,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW;AAAA,EAAA,CAC1C;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,gBAAgB,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE;AAAA,EAC3E;AAEA,QAAM,SAAS,MAAM,SAAS,KAAA;AAC9B,OAAI,YAAO,WAAP,mBAAe,QAAQ;AACzB,UAAM,IAAI,MAAM,kBAAkB,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE;AAAA,EAC9D;AAEA,SAAO,OAAO;AAChB;AAQA,MAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYtB,MAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA,UAIzB,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAOvB,MAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAe9B,oBAAoB;AAAA;AAAA;AAAA;AAKrB,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAahC,MAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;"}
+{"version":3,"file":"api-client.js","sources":["../../../../../src/chat-ui/mentions/suggestions/data/api-client.ts"],"sourcesContent":["/**\n * API client for mention data fetching.\n *\n * Wraps raw fetch() with GraphQL support. Hosts authenticate with either a\n * bearer token or a workspace API key; agora's /graphql accepts both.\n */\n\nimport { createContext, useContext } from \"react\";\n\n// ── Auth context ──\n\nexport interface MentionAuthContext {\n  backendUrl: string;\n  appUrl?: string;\n  /** Bearer credential; hosts without one authenticate with `apiKey`. */\n  accessToken?: string;\n  /**\n   * Resolve a current bearer before each query (for rotating Office sessions).\n   * Resolving nothing falls back to `accessToken`, then the API key.\n   */\n  getAccessToken?: () => Promise<string | null | undefined>;\n  /**\n   * Renew the bearer after the backend refused it (401), for one resend of\n   * the query. Without it, or when it resolves nothing, a refused query fails\n   * as before.\n   */\n  renewAccessToken?: () => Promise<string | null | undefined>;\n  apiKey?: string;\n  /**\n   * With neither credential, ride the browser's same-origin session cookie\n   * instead of failing — the SDK's AthenaChat, whose REST helpers make the\n   * same choice for a host that configured no token and no API key. Hosts\n   * that always hold a credential leave this unset so an accidental anonymous\n   * query fails loudly.\n   */\n  credentials?: \"include\";\n  workspaceId?: string;\n  userId?: string;\n}\n\n/** Credential headers (or the cookie lane) for a mention fetch. */\nexport function mentionRequestInit(\n  auth: MentionAuthContext,\n): Pick<RequestInit, \"headers\" | \"credentials\"> {\n  if (auth.accessToken) {\n    return { headers: { Authorization: `Bearer ${auth.accessToken}` } };\n  }\n  if (auth.apiKey) return { headers: { \"X-API-KEY\": auth.apiKey } };\n  if (auth.credentials) return { headers: {}, credentials: auth.credentials };\n  throw new Error(\"MentionAuthCtx needs either an accessToken or an apiKey\");\n}\n\nexport const MentionAuthCtx = createContext<MentionAuthContext | null>(null);\n\nexport function useMentionAuth(): MentionAuthContext {\n  const ctx = useContext(MentionAuthCtx);\n  if (!ctx) throw new Error(\"MentionAuthCtx not provided\");\n  return ctx;\n}\n\n// ── GraphQL client ──\n\nexport async function fetchGraphQL<T = any>(\n  auth: MentionAuthContext,\n  query: string,\n  variables: Record<string, any> = {},\n): Promise<T> {\n  const url = `${auth.backendUrl.replace(/\\/+$/, \"\")}/graphql`;\n  const send = (requestAuth: MentionAuthContext) => {\n    const { headers, credentials } = mentionRequestInit(requestAuth);\n    return fetch(url, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        ...headers,\n      },\n      ...(credentials ? { credentials } : {}),\n      body: JSON.stringify({ query, variables }),\n    });\n  };\n  const requestAuth = auth.getAccessToken\n    ? { ...auth, accessToken: (await auth.getAccessToken()) ?? auth.accessToken }\n    : auth;\n  let response = await send(requestAuth);\n  // A refused bearer gets one renewal and a resend (the statewire transport's\n  // `staleAuth` contract); an API-key or cookie request has nothing to renew.\n  if (response.status === 401 && requestAuth.accessToken && auth.renewAccessToken) {\n    const renewed = await auth.renewAccessToken();\n    // The same token again (a static one) would only be refused again.\n    if (renewed && renewed !== requestAuth.accessToken) {\n      response = await send({ ...auth, accessToken: renewed });\n    }\n  }\n\n  if (!response.ok) {\n    throw new Error(`GraphQL HTTP ${response.status}: ${response.statusText}`);\n  }\n\n  const result = await response.json();\n  if (result.errors?.length) {\n    throw new Error(`GraphQL error: ${result.errors[0].message}`);\n  }\n\n  return result.data as T;\n}\n\n// ── GraphQL Queries ──\n\n/**\n * Lightweight asset fragment for mention menu items.\n * Only fetches fields needed for display + navigation.\n */\nconst MENTION_ASSET_FIELDS = `\n  id\n  title\n  athenaOriginalType\n  athenaConvertedType\n  parentFolderId\n  updatedAt\n  isFavorited\n  isArchived\n  isHidden\n`;\n\nexport const SIMPLE_SEARCH_QUERY = `\n  query SimpleSearch($input: SimpleSearchRequestInput!) {\n    simpleSearch(input: $input) {\n      assets {\n        ${MENTION_ASSET_FIELDS}\n      }\n      totalCount\n    }\n  }\n`;\n\nexport const PAGINATED_ASSETS_QUERY = `\n  query GetPaginatedAssetsForWorkspace(\n    $limit: Int!\n    $offset: Int!\n    $parentFolderId: String\n    $filterTypes: [String!]\n    $filterColumns: ColumnFilter\n  ) {\n    getPaginatedAssetsForWorkspace(\n      limit: $limit\n      offset: $offset\n      parentFolderId: $parentFolderId\n      filterTypes: $filterTypes\n      filterColumns: $filterColumns\n    ) {\n      ${MENTION_ASSET_FIELDS}\n    }\n  }\n`;\n\nexport const WORKSPACE_MEMBERS_QUERY = `\n  query GetUsersInWorkspace($workspaceId: String!) {\n    getUsersInWorkspace(workspaceId: $workspaceId) {\n      id\n      email\n      firstName\n      lastName\n      isAdmin\n      avatarUrl\n    }\n  }\n`;\n\nexport const TOOL_CATALOG_QUERY = `\n  query MentionToolCatalog {\n    getToolkitToToolsMapping {\n      tools {\n        id\n        name\n        description\n        icon\n        adminOnly\n        isMentionable\n      }\n      toolkits {\n        name\n        displayName\n        description\n        icon\n        onlyAdmin\n        hideFromMenu\n        isMentionable\n      }\n    }\n  }\n`;\n\n// ── Response types ──\n\nexport interface ToolCatalogTool {\n  id: string;\n  name: string;\n  description: string | null;\n  icon: string;\n  adminOnly: boolean;\n  isMentionable: boolean;\n}\n\nexport interface ToolCatalogToolkit {\n  name: string;\n  displayName: string;\n  description: string;\n  icon: string;\n  onlyAdmin: boolean;\n  hideFromMenu: boolean;\n  isMentionable: boolean;\n}\n\nexport interface ToolCatalogResult {\n  getToolkitToToolsMapping: {\n    tools: ToolCatalogTool[];\n    toolkits: ToolCatalogToolkit[];\n  };\n}\n\nexport interface AssetResult {\n  id: string;\n  title: string | null;\n  athenaOriginalType: string | null;\n  athenaConvertedType: string | null;\n  parentFolderId: string | null;\n  updatedAt: string | null;\n  isFavorited: boolean | null;\n  isArchived: boolean | null;\n  isHidden: boolean | null;\n}\n\nexport interface WorkspaceMember {\n  id: string;\n  email: string | null;\n  firstName: string | null;\n  lastName: string | null;\n  isAdmin: boolean;\n  avatarUrl: string | null;\n}\n"],"names":["requestAuth"],"mappings":";AAyCO,SAAS,mBACd,MAC8C;AAC9C,MAAI,KAAK,aAAa;AACpB,WAAO,EAAE,SAAS,EAAE,eAAe,UAAU,KAAK,WAAW,KAAG;AAAA,EAClE;AACA,MAAI,KAAK,OAAQ,QAAO,EAAE,SAAS,EAAE,aAAa,KAAK,SAAO;AAC9D,MAAI,KAAK,YAAa,QAAO,EAAE,SAAS,CAAA,GAAI,aAAa,KAAK,YAAA;AAC9D,QAAM,IAAI,MAAM,yDAAyD;AAC3E;AAEO,MAAM,iBAAiB,cAAyC,IAAI;AAEpE,SAAS,iBAAqC;AACnD,QAAM,MAAM,WAAW,cAAc;AACrC,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,6BAA6B;AACvD,SAAO;AACT;AAIA,eAAsB,aACpB,MACA,OACA,YAAiC,CAAA,GACrB;;AACZ,QAAM,MAAM,GAAG,KAAK,WAAW,QAAQ,QAAQ,EAAE,CAAC;AAClD,QAAM,OAAO,CAACA,iBAAoC;AAChD,UAAM,EAAE,SAAS,gBAAgB,mBAAmBA,YAAW;AAC/D,WAAO,MAAM,KAAK;AAAA,MAChB,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MAAA;AAAA,MAEL,GAAI,cAAc,EAAE,YAAA,IAAgB,CAAA;AAAA,MACpC,MAAM,KAAK,UAAU,EAAE,OAAO,WAAW;AAAA,IAAA,CAC1C;AAAA,EACH;AACA,QAAM,cAAc,KAAK,iBACrB,EAAE,GAAG,MAAM,aAAc,MAAM,KAAK,eAAA,KAAqB,KAAK,gBAC9D;AACJ,MAAI,WAAW,MAAM,KAAK,WAAW;AAGrC,MAAI,SAAS,WAAW,OAAO,YAAY,eAAe,KAAK,kBAAkB;AAC/E,UAAM,UAAU,MAAM,KAAK,iBAAA;AAE3B,QAAI,WAAW,YAAY,YAAY,aAAa;AAClD,iBAAW,MAAM,KAAK,EAAE,GAAG,MAAM,aAAa,SAAS;AAAA,IACzD;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,gBAAgB,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE;AAAA,EAC3E;AAEA,QAAM,SAAS,MAAM,SAAS,KAAA;AAC9B,OAAI,YAAO,WAAP,mBAAe,QAAQ;AACzB,UAAM,IAAI,MAAM,kBAAkB,OAAO,OAAO,CAAC,EAAE,OAAO,EAAE;AAAA,EAC9D;AAEA,SAAO,OAAO;AAChB;AAQA,MAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYtB,MAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA,UAIzB,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAOvB,MAAM,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAe9B,oBAAoB;AAAA;AAAA;AAAA;AAKrB,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAahC,MAAM,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;"}

package/dist/chat-ui/statewire.d.ts

@@ -8,7 +8,7 @@
  *
  * Published as the `@athenaintel/react/chat-ui/statewire` sub-path.
  */
-export { StatewireApprovalCard, type StatewireApprovalCardProps, type StatewireApprovalRequestContext, } from "../chat/StatewireApprovalCard";
+export { StatewireApprovalCard, type StatewireApprovalCardProps, type StatewireApprovalEditorContext, type StatewireApprovalRequestContext, } from "../chat/StatewireApprovalCard";
 export { type StatewireApprovalRequest, type StatewireInterruptPredicate, type UseStatewireApprovalRequestOptions, useStatewireApprovalRequest, } from "../chat/use-statewire-approval-request";
 export { StatewireQueuedMessages, type StatewireQueueEditorContext, type StatewireQueueEvent, type StatewireQueueRowContentContext, type StatewireQueuedMessagesProps, } from "../chat/StatewireQueuedMessages";
 export { HistoryEdgeRow, type HistoryEdgeRowProps, StatewireHistoryEdge, type StatewireHistoryEdgeProps, } from "./thread/statewire-history-edge";

package/dist/collab/mint.cjs

@@ -3,6 +3,7 @@ var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const credentialRenewal = require("../runtime/credential-renewal.cjs");
 class CollabTokenError extends Error {
   constructor(status, message) {
     super(message);
@@ -11,15 +12,6 @@ class CollabTokenError extends Error {
     this.status = status;
   }
 }
-function getCollabAuthHeaders(auth) {
-  if (auth.token) {
-    return { Authorization: `Bearer ${auth.token}` };
-  }
-  if (auth.apiKey) {
-    return { "X-API-KEY": auth.apiKey };
-  }
-  return {};
-}
 async function collabErrorFromResponse(response, fallback) {
   let detail = "";
   try {
@@ -36,17 +28,17 @@ function getAthenaApiBaseUrl(backendUrl) {
 }
 async function mintCollabToken(args) {
   const base = getAthenaApiBaseUrl(args.auth.backendUrl);
-  const response = await fetch(
-    `${base}/api/v0/assets/${encodeURIComponent(args.assetId)}/collab-token`,
-    {
+  const response = await credentialRenewal.sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(`${base}/api/v0/assets/${encodeURIComponent(args.assetId)}/collab-token`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...getCollabAuthHeaders(args.auth)
+        ...headers
       },
       body: JSON.stringify({ access: args.access }),
       signal: args.signal
-    }
+    })
   );
   if (!response.ok) {
     throw await collabErrorFromResponse(
@@ -59,6 +51,5 @@ async function mintCollabToken(args) {
 exports.CollabTokenError = CollabTokenError;
 exports.collabErrorFromResponse = collabErrorFromResponse;
 exports.getAthenaApiBaseUrl = getAthenaApiBaseUrl;
-exports.getCollabAuthHeaders = getCollabAuthHeaders;
 exports.mintCollabToken = mintCollabToken;
 //# sourceMappingURL=mint.cjs.map

package/dist/collab/mint.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"mint.cjs","sources":["../../src/collab/mint.ts"],"sourcesContent":["/**\n * Collab-token mint client for Generic Doc assets.\n *\n * Calls `POST /api/v0/assets/{assetId}/collab-token` — the only public surface\n * that issues Keryx capability tokens, allowlisted server-side to the\n * `generic_doc` asset type and admin-only during the initial rollout. Tokens\n * are room-bound and short-lived; `connectGenericDoc` re-mints automatically\n * before expiry.\n */\n\nexport interface CollabAuth {\n  /** Athena API base or any Athena backend URL (e.g. the AthenaProvider `backendUrl`). */\n  backendUrl: string;\n  /** Personal or sandbox API key. Used when no bearer token is provided. */\n  apiKey?: string;\n  /** Per-viewer bearer token. Takes precedence over the API key. */\n  token?: string | null;\n}\n\nexport interface CollabTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  rest_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport class CollabTokenError extends Error {\n  readonly status: number;\n\n  constructor(status: number, message: string) {\n    super(message);\n    this.name = 'CollabTokenError';\n    this.status = status;\n  }\n}\n\n/**\n * Credential headers for a public-API call. The per-viewer bearer token wins\n * over the API key so a viewer never acts with the app's own identity.\n */\nexport function getCollabAuthHeaders(auth: CollabAuth): Record<string, string> {\n  if (auth.token) {\n    return { Authorization: `Bearer ${auth.token}` };\n  }\n  if (auth.apiKey) {\n    return { 'X-API-KEY': auth.apiKey };\n  }\n  return {};\n}\n\n/**\n * Turn a non-2xx public-API response into a `CollabTokenError`, carrying the\n * FastAPI `detail` string when the body has one and the bare status otherwise.\n */\nexport async function collabErrorFromResponse(\n  response: Response,\n  fallback: string\n): Promise<CollabTokenError> {\n  let detail = '';\n  try {\n    const body: unknown = await response.json();\n    if (body && typeof body === 'object' && 'detail' in body) {\n      detail = String((body as { detail: unknown }).detail);\n    }\n  } catch {\n    // non-JSON error body; status alone tells the story\n  }\n  return new CollabTokenError(response.status, detail || fallback);\n}\n\n/**\n * Trim a nested Athena endpoint back to the API origin. Accepts the\n * AthenaProvider `backendUrl` (`…/api/assistant-ui`), the sandbox\n * `ATHENA_API_URL` convention (`…/api/v0`), or a bare origin.\n */\nexport function getAthenaApiBaseUrl(backendUrl: string): string {\n  return backendUrl\n    .replace(/\\/api\\/assistant-ui\\/?$/, '')\n    .replace(/\\/api\\/v0\\/?$/, '')\n    .replace(/\\/$/, '');\n}\n\nexport async function mintCollabToken(args: {\n  auth: CollabAuth;\n  assetId: string;\n  access: 'view' | 'edit';\n  signal?: AbortSignal;\n}): Promise<CollabTokenResponse> {\n  const base = getAthenaApiBaseUrl(args.auth.backendUrl);\n  const response = await fetch(\n    `${base}/api/v0/assets/${encodeURIComponent(args.assetId)}/collab-token`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify({ access: args.access }),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Collab token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as CollabTokenResponse;\n}\n"],"names":[],"mappings":";;;;;AA8BO,MAAM,yBAAyB,MAAM;AAAA,EAG1C,YAAY,QAAgB,SAAiB;AAC3C,UAAM,OAAO;AAHN;AAIP,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAMO,SAAS,qBAAqB,MAA0C;AAC7E,MAAI,KAAK,OAAO;AACd,WAAO,EAAE,eAAe,UAAU,KAAK,KAAK,GAAA;AAAA,EAC9C;AACA,MAAI,KAAK,QAAQ;AACf,WAAO,EAAE,aAAa,KAAK,OAAA;AAAA,EAC7B;AACA,SAAO,CAAA;AACT;AAMA,eAAsB,wBACpB,UACA,UAC2B;AAC3B,MAAI,SAAS;AACb,MAAI;AACF,UAAM,OAAgB,MAAM,SAAS,KAAA;AACrC,QAAI,QAAQ,OAAO,SAAS,YAAY,YAAY,MAAM;AACxD,eAAS,OAAQ,KAA6B,MAAM;AAAA,IACtD;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,iBAAiB,SAAS,QAAQ,UAAU,QAAQ;AACjE;AAOO,SAAS,oBAAoB,YAA4B;AAC9D,SAAO,WACJ,QAAQ,2BAA2B,EAAE,EACrC,QAAQ,iBAAiB,EAAE,EAC3B,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAsB,gBAAgB,MAKL;AAC/B,QAAM,OAAO,oBAAoB,KAAK,KAAK,UAAU;AACrD,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,IAAI,kBAAkB,mBAAmB,KAAK,OAAO,CAAC;AAAA,IACzD;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,EAAE,QAAQ,KAAK,QAAQ;AAAA,MAC5C,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,wCAAwC,SAAS,MAAM;AAAA,IAAA;AAAA,EAE3D;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;;;;;;"}
+{"version":3,"file":"mint.cjs","sources":["../../src/collab/mint.ts"],"sourcesContent":["/**\n * Collab-token mint client for Generic Doc assets.\n *\n * Calls `POST /api/v0/assets/{assetId}/collab-token` — the only public surface\n * that issues Keryx capability tokens, allowlisted server-side to the\n * `generic_doc` asset type and admin-only during the initial rollout. Tokens\n * are room-bound and short-lived; `connectGenericDoc` re-mints automatically\n * before expiry.\n */\n\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\n\nexport interface CollabAuth {\n  /** Athena API base or any Athena backend URL (e.g. the AthenaProvider `backendUrl`). */\n  backendUrl: string;\n  /** Personal or sandbox API key. Used when no bearer token is provided. */\n  apiKey?: string;\n  /** Per-viewer bearer token. Takes precedence over the API key. */\n  token?: string | null;\n  /**\n   * Live token resolver (the AthenaProvider's `getToken`), read before every\n   * mint so a re-mint never presents a rotated-out token; called with\n   * `{ force: true }` after a 401 to renew it. Takes precedence over `token`\n   * when it resolves one.\n   */\n  getToken?: AthenaStatewireTokenGetter;\n}\n\nexport interface CollabTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  rest_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport class CollabTokenError extends Error {\n  readonly status: number;\n\n  constructor(status: number, message: string) {\n    super(message);\n    this.name = 'CollabTokenError';\n    this.status = status;\n  }\n}\n\n/**\n * Credential headers for a public-API call. The per-viewer bearer token wins\n * over the API key so a viewer never acts with the app's own identity.\n */\nexport function getCollabAuthHeaders(auth: CollabAuth): Record<string, string> {\n  if (auth.token) {\n    return { Authorization: `Bearer ${auth.token}` };\n  }\n  if (auth.apiKey) {\n    return { 'X-API-KEY': auth.apiKey };\n  }\n  return {};\n}\n\n/**\n * Turn a non-2xx public-API response into a `CollabTokenError`, carrying the\n * FastAPI `detail` string when the body has one and the bare status otherwise.\n */\nexport async function collabErrorFromResponse(\n  response: Response,\n  fallback: string\n): Promise<CollabTokenError> {\n  let detail = '';\n  try {\n    const body: unknown = await response.json();\n    if (body && typeof body === 'object' && 'detail' in body) {\n      detail = String((body as { detail: unknown }).detail);\n    }\n  } catch {\n    // non-JSON error body; status alone tells the story\n  }\n  return new CollabTokenError(response.status, detail || fallback);\n}\n\n/**\n * Trim a nested Athena endpoint back to the API origin. Accepts the\n * AthenaProvider `backendUrl` (`…/api/assistant-ui`), the sandbox\n * `ATHENA_API_URL` convention (`…/api/v0`), or a bare origin.\n */\nexport function getAthenaApiBaseUrl(backendUrl: string): string {\n  return backendUrl\n    .replace(/\\/api\\/assistant-ui\\/?$/, '')\n    .replace(/\\/api\\/v0\\/?$/, '')\n    .replace(/\\/$/, '');\n}\n\nexport async function mintCollabToken(args: {\n  auth: CollabAuth;\n  assetId: string;\n  access: 'view' | 'edit';\n  signal?: AbortSignal;\n}): Promise<CollabTokenResponse> {\n  const base = getAthenaApiBaseUrl(args.auth.backendUrl);\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(`${base}/api/v0/assets/${encodeURIComponent(args.assetId)}/collab-token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n      body: JSON.stringify({ access: args.access }),\n      signal: args.signal,\n    })\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Collab token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as CollabTokenResponse;\n}\n"],"names":["sendWithCredentialRenewal"],"mappings":";;;;;;AAwCO,MAAM,yBAAyB,MAAM;AAAA,EAG1C,YAAY,QAAgB,SAAiB;AAC3C,UAAM,OAAO;AAHN;AAIP,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAoBA,eAAsB,wBACpB,UACA,UAC2B;AAC3B,MAAI,SAAS;AACb,MAAI;AACF,UAAM,OAAgB,MAAM,SAAS,KAAA;AACrC,QAAI,QAAQ,OAAO,SAAS,YAAY,YAAY,MAAM;AACxD,eAAS,OAAQ,KAA6B,MAAM;AAAA,IACtD;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,iBAAiB,SAAS,QAAQ,UAAU,QAAQ;AACjE;AAOO,SAAS,oBAAoB,YAA4B;AAC9D,SAAO,WACJ,QAAQ,2BAA2B,EAAE,EACrC,QAAQ,iBAAiB,EAAE,EAC3B,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAsB,gBAAgB,MAKL;AAC/B,QAAM,OAAO,oBAAoB,KAAK,KAAK,UAAU;AACrD,QAAM,WAAW,MAAMA,kBAAAA;AAAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D,MAAM,GAAG,IAAI,kBAAkB,mBAAmB,KAAK,OAAO,CAAC,iBAAiB;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MAAA;AAAA,MAEL,MAAM,KAAK,UAAU,EAAE,QAAQ,KAAK,QAAQ;AAAA,MAC5C,QAAQ,KAAK;AAAA,IAAA,CACd;AAAA,EAAA;AAEH,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,wCAAwC,SAAS,MAAM;AAAA,IAAA;AAAA,EAE3D;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;;;;;"}

package/dist/collab/mint.d.ts

@@ -7,6 +7,7 @@
  * are room-bound and short-lived; `connectGenericDoc` re-mints automatically
  * before expiry.
  */
+import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';
 export interface CollabAuth {
     /** Athena API base or any Athena backend URL (e.g. the AthenaProvider `backendUrl`). */
     backendUrl: string;
@@ -14,6 +15,13 @@ export interface CollabAuth {
     apiKey?: string;
     /** Per-viewer bearer token. Takes precedence over the API key. */
     token?: string | null;
+    /**
+     * Live token resolver (the AthenaProvider's `getToken`), read before every
+     * mint so a re-mint never presents a rotated-out token; called with
+     * `{ force: true }` after a 401 to renew it. Takes precedence over `token`
+     * when it resolves one.
+     */
+    getToken?: AthenaStatewireTokenGetter;
 }
 export interface CollabTokenResponse {
     token: string;

package/dist/collab/mint.js

@@ -1,6 +1,7 @@
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+import { sendWithCredentialRenewal } from "../runtime/credential-renewal.js";
 class CollabTokenError extends Error {
   constructor(status, message) {
     super(message);
@@ -9,15 +10,6 @@ class CollabTokenError extends Error {
     this.status = status;
   }
 }
-function getCollabAuthHeaders(auth) {
-  if (auth.token) {
-    return { Authorization: `Bearer ${auth.token}` };
-  }
-  if (auth.apiKey) {
-    return { "X-API-KEY": auth.apiKey };
-  }
-  return {};
-}
 async function collabErrorFromResponse(response, fallback) {
   let detail = "";
   try {
@@ -34,17 +26,17 @@ function getAthenaApiBaseUrl(backendUrl) {
 }
 async function mintCollabToken(args) {
   const base = getAthenaApiBaseUrl(args.auth.backendUrl);
-  const response = await fetch(
-    `${base}/api/v0/assets/${encodeURIComponent(args.assetId)}/collab-token`,
-    {
+  const response = await sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(`${base}/api/v0/assets/${encodeURIComponent(args.assetId)}/collab-token`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...getCollabAuthHeaders(args.auth)
+        ...headers
       },
       body: JSON.stringify({ access: args.access }),
       signal: args.signal
-    }
+    })
   );
   if (!response.ok) {
     throw await collabErrorFromResponse(
@@ -58,7 +50,6 @@ export {
   CollabTokenError,
   collabErrorFromResponse,
   getAthenaApiBaseUrl,
-  getCollabAuthHeaders,
   mintCollabToken
 };
 //# sourceMappingURL=mint.js.map

package/dist/collab/mint.js.map

@@ -1 +1 @@
-{"version":3,"file":"mint.js","sources":["../../src/collab/mint.ts"],"sourcesContent":["/**\n * Collab-token mint client for Generic Doc assets.\n *\n * Calls `POST /api/v0/assets/{assetId}/collab-token` — the only public surface\n * that issues Keryx capability tokens, allowlisted server-side to the\n * `generic_doc` asset type and admin-only during the initial rollout. Tokens\n * are room-bound and short-lived; `connectGenericDoc` re-mints automatically\n * before expiry.\n */\n\nexport interface CollabAuth {\n  /** Athena API base or any Athena backend URL (e.g. the AthenaProvider `backendUrl`). */\n  backendUrl: string;\n  /** Personal or sandbox API key. Used when no bearer token is provided. */\n  apiKey?: string;\n  /** Per-viewer bearer token. Takes precedence over the API key. */\n  token?: string | null;\n}\n\nexport interface CollabTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  rest_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport class CollabTokenError extends Error {\n  readonly status: number;\n\n  constructor(status: number, message: string) {\n    super(message);\n    this.name = 'CollabTokenError';\n    this.status = status;\n  }\n}\n\n/**\n * Credential headers for a public-API call. The per-viewer bearer token wins\n * over the API key so a viewer never acts with the app's own identity.\n */\nexport function getCollabAuthHeaders(auth: CollabAuth): Record<string, string> {\n  if (auth.token) {\n    return { Authorization: `Bearer ${auth.token}` };\n  }\n  if (auth.apiKey) {\n    return { 'X-API-KEY': auth.apiKey };\n  }\n  return {};\n}\n\n/**\n * Turn a non-2xx public-API response into a `CollabTokenError`, carrying the\n * FastAPI `detail` string when the body has one and the bare status otherwise.\n */\nexport async function collabErrorFromResponse(\n  response: Response,\n  fallback: string\n): Promise<CollabTokenError> {\n  let detail = '';\n  try {\n    const body: unknown = await response.json();\n    if (body && typeof body === 'object' && 'detail' in body) {\n      detail = String((body as { detail: unknown }).detail);\n    }\n  } catch {\n    // non-JSON error body; status alone tells the story\n  }\n  return new CollabTokenError(response.status, detail || fallback);\n}\n\n/**\n * Trim a nested Athena endpoint back to the API origin. Accepts the\n * AthenaProvider `backendUrl` (`…/api/assistant-ui`), the sandbox\n * `ATHENA_API_URL` convention (`…/api/v0`), or a bare origin.\n */\nexport function getAthenaApiBaseUrl(backendUrl: string): string {\n  return backendUrl\n    .replace(/\\/api\\/assistant-ui\\/?$/, '')\n    .replace(/\\/api\\/v0\\/?$/, '')\n    .replace(/\\/$/, '');\n}\n\nexport async function mintCollabToken(args: {\n  auth: CollabAuth;\n  assetId: string;\n  access: 'view' | 'edit';\n  signal?: AbortSignal;\n}): Promise<CollabTokenResponse> {\n  const base = getAthenaApiBaseUrl(args.auth.backendUrl);\n  const response = await fetch(\n    `${base}/api/v0/assets/${encodeURIComponent(args.assetId)}/collab-token`,\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify({ access: args.access }),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Collab token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as CollabTokenResponse;\n}\n"],"names":[],"mappings":";;;AA8BO,MAAM,yBAAyB,MAAM;AAAA,EAG1C,YAAY,QAAgB,SAAiB;AAC3C,UAAM,OAAO;AAHN;AAIP,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAMO,SAAS,qBAAqB,MAA0C;AAC7E,MAAI,KAAK,OAAO;AACd,WAAO,EAAE,eAAe,UAAU,KAAK,KAAK,GAAA;AAAA,EAC9C;AACA,MAAI,KAAK,QAAQ;AACf,WAAO,EAAE,aAAa,KAAK,OAAA;AAAA,EAC7B;AACA,SAAO,CAAA;AACT;AAMA,eAAsB,wBACpB,UACA,UAC2B;AAC3B,MAAI,SAAS;AACb,MAAI;AACF,UAAM,OAAgB,MAAM,SAAS,KAAA;AACrC,QAAI,QAAQ,OAAO,SAAS,YAAY,YAAY,MAAM;AACxD,eAAS,OAAQ,KAA6B,MAAM;AAAA,IACtD;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,iBAAiB,SAAS,QAAQ,UAAU,QAAQ;AACjE;AAOO,SAAS,oBAAoB,YAA4B;AAC9D,SAAO,WACJ,QAAQ,2BAA2B,EAAE,EACrC,QAAQ,iBAAiB,EAAE,EAC3B,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAsB,gBAAgB,MAKL;AAC/B,QAAM,OAAO,oBAAoB,KAAK,KAAK,UAAU;AACrD,QAAM,WAAW,MAAM;AAAA,IACrB,GAAG,IAAI,kBAAkB,mBAAmB,KAAK,OAAO,CAAC;AAAA,IACzD;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,EAAE,QAAQ,KAAK,QAAQ;AAAA,MAC5C,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,wCAAwC,SAAS,MAAM;AAAA,IAAA;AAAA,EAE3D;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;"}
+{"version":3,"file":"mint.js","sources":["../../src/collab/mint.ts"],"sourcesContent":["/**\n * Collab-token mint client for Generic Doc assets.\n *\n * Calls `POST /api/v0/assets/{assetId}/collab-token` — the only public surface\n * that issues Keryx capability tokens, allowlisted server-side to the\n * `generic_doc` asset type and admin-only during the initial rollout. Tokens\n * are room-bound and short-lived; `connectGenericDoc` re-mints automatically\n * before expiry.\n */\n\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\n\nexport interface CollabAuth {\n  /** Athena API base or any Athena backend URL (e.g. the AthenaProvider `backendUrl`). */\n  backendUrl: string;\n  /** Personal or sandbox API key. Used when no bearer token is provided. */\n  apiKey?: string;\n  /** Per-viewer bearer token. Takes precedence over the API key. */\n  token?: string | null;\n  /**\n   * Live token resolver (the AthenaProvider's `getToken`), read before every\n   * mint so a re-mint never presents a rotated-out token; called with\n   * `{ force: true }` after a 401 to renew it. Takes precedence over `token`\n   * when it resolves one.\n   */\n  getToken?: AthenaStatewireTokenGetter;\n}\n\nexport interface CollabTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  rest_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport class CollabTokenError extends Error {\n  readonly status: number;\n\n  constructor(status: number, message: string) {\n    super(message);\n    this.name = 'CollabTokenError';\n    this.status = status;\n  }\n}\n\n/**\n * Credential headers for a public-API call. The per-viewer bearer token wins\n * over the API key so a viewer never acts with the app's own identity.\n */\nexport function getCollabAuthHeaders(auth: CollabAuth): Record<string, string> {\n  if (auth.token) {\n    return { Authorization: `Bearer ${auth.token}` };\n  }\n  if (auth.apiKey) {\n    return { 'X-API-KEY': auth.apiKey };\n  }\n  return {};\n}\n\n/**\n * Turn a non-2xx public-API response into a `CollabTokenError`, carrying the\n * FastAPI `detail` string when the body has one and the bare status otherwise.\n */\nexport async function collabErrorFromResponse(\n  response: Response,\n  fallback: string\n): Promise<CollabTokenError> {\n  let detail = '';\n  try {\n    const body: unknown = await response.json();\n    if (body && typeof body === 'object' && 'detail' in body) {\n      detail = String((body as { detail: unknown }).detail);\n    }\n  } catch {\n    // non-JSON error body; status alone tells the story\n  }\n  return new CollabTokenError(response.status, detail || fallback);\n}\n\n/**\n * Trim a nested Athena endpoint back to the API origin. Accepts the\n * AthenaProvider `backendUrl` (`…/api/assistant-ui`), the sandbox\n * `ATHENA_API_URL` convention (`…/api/v0`), or a bare origin.\n */\nexport function getAthenaApiBaseUrl(backendUrl: string): string {\n  return backendUrl\n    .replace(/\\/api\\/assistant-ui\\/?$/, '')\n    .replace(/\\/api\\/v0\\/?$/, '')\n    .replace(/\\/$/, '');\n}\n\nexport async function mintCollabToken(args: {\n  auth: CollabAuth;\n  assetId: string;\n  access: 'view' | 'edit';\n  signal?: AbortSignal;\n}): Promise<CollabTokenResponse> {\n  const base = getAthenaApiBaseUrl(args.auth.backendUrl);\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(`${base}/api/v0/assets/${encodeURIComponent(args.assetId)}/collab-token`, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n      body: JSON.stringify({ access: args.access }),\n      signal: args.signal,\n    })\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Collab token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as CollabTokenResponse;\n}\n"],"names":[],"mappings":";;;;AAwCO,MAAM,yBAAyB,MAAM;AAAA,EAG1C,YAAY,QAAgB,SAAiB;AAC3C,UAAM,OAAO;AAHN;AAIP,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAoBA,eAAsB,wBACpB,UACA,UAC2B;AAC3B,MAAI,SAAS;AACb,MAAI;AACF,UAAM,OAAgB,MAAM,SAAS,KAAA;AACrC,QAAI,QAAQ,OAAO,SAAS,YAAY,YAAY,MAAM;AACxD,eAAS,OAAQ,KAA6B,MAAM;AAAA,IACtD;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,IAAI,iBAAiB,SAAS,QAAQ,UAAU,QAAQ;AACjE;AAOO,SAAS,oBAAoB,YAA4B;AAC9D,SAAO,WACJ,QAAQ,2BAA2B,EAAE,EACrC,QAAQ,iBAAiB,EAAE,EAC3B,QAAQ,OAAO,EAAE;AACtB;AAEA,eAAsB,gBAAgB,MAKL;AAC/B,QAAM,OAAO,oBAAoB,KAAK,KAAK,UAAU;AACrD,QAAM,WAAW,MAAM;AAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D,MAAM,GAAG,IAAI,kBAAkB,mBAAmB,KAAK,OAAO,CAAC,iBAAiB;AAAA,MAC9E,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MAAA;AAAA,MAEL,MAAM,KAAK,UAAU,EAAE,QAAQ,KAAK,QAAQ;AAAA,MAC5C,QAAQ,KAAK;AAAA,IAAA,CACd;AAAA,EAAA;AAEH,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,wCAAwC,SAAS,MAAM;AAAA,IAAA;AAAA,EAE3D;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;"}

package/dist/collab/presence-mint.cjs

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const credentialRenewal = require("../runtime/credential-renewal.cjs");
 const mint = require("./mint.cjs");
 function workspaceUrl({
   auth,
@@ -10,17 +11,17 @@ function workspaceUrl({
   return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;
 }
 async function mintWorkspacePresenceToken(args) {
-  const response = await fetch(
-    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence-token" }),
-    {
+  const response = await credentialRenewal.sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence-token" }), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...mint.getCollabAuthHeaders(args.auth)
+        ...headers
       },
       body: JSON.stringify({}),
       signal: args.signal
-    }
+    })
   );
   if (!response.ok) {
     throw await mint.collabErrorFromResponse(
@@ -34,17 +35,20 @@ function arrayOrEmpty(value) {
   return Array.isArray(value) ? value : [];
 }
 async function resolveWorkspacePresence(args) {
-  const response = await fetch(
-    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence/resolve" }),
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...mint.getCollabAuthHeaders(args.auth)
-      },
-      body: JSON.stringify(args.request),
-      signal: args.signal
-    }
+  const response = await credentialRenewal.sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(
+      workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence/resolve" }),
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...headers
+        },
+        body: JSON.stringify(args.request),
+        signal: args.signal
+      }
+    )
   );
   if (!response.ok) {
     throw await mint.collabErrorFromResponse(

package/dist/collab/presence-mint.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"presence-mint.cjs","sources":["../../src/collab/presence-mint.ts"],"sourcesContent":["/**\n * Public-API clients for the workspace presence feed.\n *\n * Two endpoints, both admin-only and both under the workspace:\n *\n * - `POST /api/v0/workspaces/{workspaceId}/presence-token` mints a\n *   **read-only** Keryx token for the workspace awareness room\n *   (`<workspaceId>/awareness`) — the same per-recipient-filtered presence\n *   feed the Olympus People page renders. The holder can receive presence and\n *   broadcast nothing; `connectWorkspacePresence` re-mints before expiry.\n * - `POST /api/v0/workspaces/{workspaceId}/presence/resolve` turns the opaque\n *   ids carried in awareness contexts (asset ids, session thread ids, project\n *   ids) into titles the caller may see. Only things the caller may open come\n *   back; missing ids are simply absent.\n *\n * Wire shapes are snake_case, matching `CollabTokenResponse`.\n */\n\nimport {\n  type CollabAuth,\n  CollabTokenError,\n  collabErrorFromResponse,\n  getAthenaApiBaseUrl,\n  getCollabAuthHeaders,\n} from './mint';\n\n/** Grant for the workspace awareness room. Always read-only (`access_type: 'r'`). */\nexport interface WorkspacePresenceTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport interface WorkspacePresenceResolveRequest {\n  asset_ids?: string[];\n  /** Thread ids, as published in `session` awareness contexts. */\n  session_ids?: string[];\n  project_ids?: string[];\n  include_projects?: boolean;\n  include_members?: boolean;\n}\n\nexport interface WorkspacePresenceResolvedAsset {\n  id: string;\n  title: string;\n  asset_type: string;\n}\n\nexport interface WorkspacePresenceResolvedSession {\n  thread_id: string;\n  asset_id: string;\n  title: string;\n}\n\nexport interface WorkspacePresenceResolvedProject {\n  id: string;\n  title: string;\n  assets: WorkspacePresenceResolvedAsset[];\n}\n\nexport interface WorkspacePresenceResolvedMember {\n  id: string;\n  name: string;\n  email: string;\n  avatar_url: string | null;\n}\n\nexport interface WorkspacePresenceResolveResponse {\n  assets: WorkspacePresenceResolvedAsset[];\n  sessions: WorkspacePresenceResolvedSession[];\n  projects: WorkspacePresenceResolvedProject[];\n  members: WorkspacePresenceResolvedMember[];\n}\n\nfunction workspaceUrl({\n  auth,\n  workspaceId,\n  path,\n}: {\n  auth: CollabAuth;\n  workspaceId: string;\n  path: string;\n}): string {\n  const base = getAthenaApiBaseUrl(auth.backendUrl);\n  return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;\n}\n\n/**\n * Mint a read-only token for the workspace awareness room.\n *\n * Rejects with `CollabTokenError` on 401 (bad credential) and 403 (admin\n * required, roster not enabled for this workspace, or a sandbox credential\n * that may not read presence), carrying the server's `detail`.\n */\nexport async function mintWorkspacePresenceToken(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceTokenResponse> {\n  const response = await fetch(\n    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence-token' }),\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify({}),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as WorkspacePresenceTokenResponse;\n}\n\nfunction arrayOrEmpty<T>(value: T[] | undefined | null): T[] {\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Resolve awareness ids to titles. Every section of the response is always\n * present on the returned object (an omitted section reads as empty), so\n * callers can index without guarding. Failures reject with `CollabTokenError`\n * — the same status + detail shape as the mint.\n */\nexport async function resolveWorkspacePresence(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  request: WorkspacePresenceResolveRequest;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceResolveResponse> {\n  const response = await fetch(\n    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence/resolve' }),\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify(args.request),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence resolve failed with status ${response.status}`\n    );\n  }\n  const body = (await response.json()) as Partial<WorkspacePresenceResolveResponse> | null;\n  if (!body || typeof body !== 'object') {\n    throw new CollabTokenError(response.status, 'Workspace presence resolve returned no body');\n  }\n  return {\n    assets: arrayOrEmpty(body.assets),\n    sessions: arrayOrEmpty(body.sessions),\n    projects: arrayOrEmpty(body.projects),\n    members: arrayOrEmpty(body.members),\n  };\n}\n"],"names":["getAthenaApiBaseUrl","getCollabAuthHeaders","collabErrorFromResponse","CollabTokenError"],"mappings":";;;AA8EA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,QAAM,OAAOA,KAAAA,oBAAoB,KAAK,UAAU;AAChD,SAAO,GAAG,IAAI,sBAAsB,mBAAmB,WAAW,CAAC,IAAI,IAAI;AAC7E;AASA,eAAsB,2BAA2B,MAIL;AAC1C,QAAM,WAAW,MAAM;AAAA,IACrB,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,kBAAkB;AAAA,IACvF;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAGC,KAAAA,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,EAAE;AAAA,MACvB,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAMC,KAAAA;AAAAA,MACV;AAAA,MACA,oDAAoD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEvE;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;AAEA,SAAS,aAAgB,OAAoC;AAC3D,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA;AACxC;AAQA,eAAsB,yBAAyB,MAKD;AAC5C,QAAM,WAAW,MAAM;AAAA,IACrB,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,oBAAoB;AAAA,IACzF;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAGD,KAAAA,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,MACjC,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAMC,KAAAA;AAAAA,MACV;AAAA,MACA,iDAAiD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEpE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAA;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAIC,KAAAA,iBAAiB,SAAS,QAAQ,6CAA6C;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,SAAS,aAAa,KAAK,OAAO;AAAA,EAAA;AAEtC;;;"}
+{"version":3,"file":"presence-mint.cjs","sources":["../../src/collab/presence-mint.ts"],"sourcesContent":["/**\n * Public-API clients for the workspace presence feed.\n *\n * Two endpoints, both admin-only and both under the workspace:\n *\n * - `POST /api/v0/workspaces/{workspaceId}/presence-token` mints a\n *   **read-only** Keryx token for the workspace awareness room\n *   (`<workspaceId>/awareness`) — the same per-recipient-filtered presence\n *   feed the Olympus People page renders. The holder can receive presence and\n *   broadcast nothing; `connectWorkspacePresence` re-mints before expiry.\n * - `POST /api/v0/workspaces/{workspaceId}/presence/resolve` turns the opaque\n *   ids carried in awareness contexts (asset ids, session thread ids, project\n *   ids) into titles the caller may see. Only things the caller may open come\n *   back; missing ids are simply absent.\n *\n * Wire shapes are snake_case, matching `CollabTokenResponse`.\n */\n\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport {\n  type CollabAuth,\n  CollabTokenError,\n  collabErrorFromResponse,\n  getAthenaApiBaseUrl,\n} from './mint';\n\n/** Grant for the workspace awareness room. Always read-only (`access_type: 'r'`). */\nexport interface WorkspacePresenceTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport interface WorkspacePresenceResolveRequest {\n  asset_ids?: string[];\n  /** Thread ids, as published in `session` awareness contexts. */\n  session_ids?: string[];\n  project_ids?: string[];\n  include_projects?: boolean;\n  include_members?: boolean;\n}\n\nexport interface WorkspacePresenceResolvedAsset {\n  id: string;\n  title: string;\n  asset_type: string;\n}\n\nexport interface WorkspacePresenceResolvedSession {\n  thread_id: string;\n  asset_id: string;\n  title: string;\n}\n\nexport interface WorkspacePresenceResolvedProject {\n  id: string;\n  title: string;\n  assets: WorkspacePresenceResolvedAsset[];\n}\n\nexport interface WorkspacePresenceResolvedMember {\n  id: string;\n  name: string;\n  email: string;\n  avatar_url: string | null;\n}\n\nexport interface WorkspacePresenceResolveResponse {\n  assets: WorkspacePresenceResolvedAsset[];\n  sessions: WorkspacePresenceResolvedSession[];\n  projects: WorkspacePresenceResolvedProject[];\n  members: WorkspacePresenceResolvedMember[];\n}\n\nfunction workspaceUrl({\n  auth,\n  workspaceId,\n  path,\n}: {\n  auth: CollabAuth;\n  workspaceId: string;\n  path: string;\n}): string {\n  const base = getAthenaApiBaseUrl(auth.backendUrl);\n  return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;\n}\n\n/**\n * Mint a read-only token for the workspace awareness room.\n *\n * Rejects with `CollabTokenError` on 401 (bad credential) and 403 (admin\n * required, roster not enabled for this workspace, or a sandbox credential\n * that may not read presence), carrying the server's `detail`.\n */\nexport async function mintWorkspacePresenceToken(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceTokenResponse> {\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence-token' }), {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n      body: JSON.stringify({}),\n      signal: args.signal,\n    })\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as WorkspacePresenceTokenResponse;\n}\n\nfunction arrayOrEmpty<T>(value: T[] | undefined | null): T[] {\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Resolve awareness ids to titles. Every section of the response is always\n * present on the returned object (an omitted section reads as empty), so\n * callers can index without guarding. Failures reject with `CollabTokenError`\n * — the same status + detail shape as the mint.\n */\nexport async function resolveWorkspacePresence(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  request: WorkspacePresenceResolveRequest;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceResolveResponse> {\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(\n      workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence/resolve' }),\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: JSON.stringify(args.request),\n        signal: args.signal,\n      }\n    )\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence resolve failed with status ${response.status}`\n    );\n  }\n  const body = (await response.json()) as Partial<WorkspacePresenceResolveResponse> | null;\n  if (!body || typeof body !== 'object') {\n    throw new CollabTokenError(response.status, 'Workspace presence resolve returned no body');\n  }\n  return {\n    assets: arrayOrEmpty(body.assets),\n    sessions: arrayOrEmpty(body.sessions),\n    projects: arrayOrEmpty(body.projects),\n    members: arrayOrEmpty(body.members),\n  };\n}\n"],"names":["getAthenaApiBaseUrl","sendWithCredentialRenewal","collabErrorFromResponse","CollabTokenError"],"mappings":";;;;AA8EA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,QAAM,OAAOA,KAAAA,oBAAoB,KAAK,UAAU;AAChD,SAAO,GAAG,IAAI,sBAAsB,mBAAmB,WAAW,CAAC,IAAI,IAAI;AAC7E;AASA,eAAsB,2BAA2B,MAIL;AAC1C,QAAM,WAAW,MAAMC,kBAAAA;AAAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D,MAAM,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,iBAAA,CAAkB,GAAG;AAAA,MAC9F,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MAAA;AAAA,MAEL,MAAM,KAAK,UAAU,EAAE;AAAA,MACvB,QAAQ,KAAK;AAAA,IAAA,CACd;AAAA,EAAA;AAEH,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAMC,KAAAA;AAAAA,MACV;AAAA,MACA,oDAAoD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEvE;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;AAEA,SAAS,aAAgB,OAAoC;AAC3D,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA;AACxC;AAQA,eAAsB,yBAAyB,MAKD;AAC5C,QAAM,WAAW,MAAMD,kBAAAA;AAAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D;AAAA,MACE,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,oBAAoB;AAAA,MACzF;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAG;AAAA,QAAA;AAAA,QAEL,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,QACjC,QAAQ,KAAK;AAAA,MAAA;AAAA,IACf;AAAA,EACF;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAMC,KAAAA;AAAAA,MACV;AAAA,MACA,iDAAiD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEpE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAA;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAIC,KAAAA,iBAAiB,SAAS,QAAQ,6CAA6C;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,SAAS,aAAa,KAAK,OAAO;AAAA,EAAA;AAEtC;;;"}

package/dist/collab/presence-mint.js

@@ -1,4 +1,5 @@
-import { getCollabAuthHeaders, collabErrorFromResponse, CollabTokenError, getAthenaApiBaseUrl } from "./mint.js";
+import { sendWithCredentialRenewal } from "../runtime/credential-renewal.js";
+import { collabErrorFromResponse, CollabTokenError, getAthenaApiBaseUrl } from "./mint.js";
 function workspaceUrl({
   auth,
   workspaceId,
@@ -8,17 +9,17 @@ function workspaceUrl({
   return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;
 }
 async function mintWorkspacePresenceToken(args) {
-  const response = await fetch(
-    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence-token" }),
-    {
+  const response = await sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence-token" }), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...getCollabAuthHeaders(args.auth)
+        ...headers
       },
       body: JSON.stringify({}),
       signal: args.signal
-    }
+    })
   );
   if (!response.ok) {
     throw await collabErrorFromResponse(
@@ -32,17 +33,20 @@ function arrayOrEmpty(value) {
   return Array.isArray(value) ? value : [];
 }
 async function resolveWorkspacePresence(args) {
-  const response = await fetch(
-    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence/resolve" }),
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...getCollabAuthHeaders(args.auth)
-      },
-      body: JSON.stringify(args.request),
-      signal: args.signal
-    }
+  const response = await sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(
+      workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence/resolve" }),
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...headers
+        },
+        body: JSON.stringify(args.request),
+        signal: args.signal
+      }
+    )
   );
   if (!response.ok) {
     throw await collabErrorFromResponse(

package/dist/collab/presence-mint.js.map

@@ -1 +1 @@
-{"version":3,"file":"presence-mint.js","sources":["../../src/collab/presence-mint.ts"],"sourcesContent":["/**\n * Public-API clients for the workspace presence feed.\n *\n * Two endpoints, both admin-only and both under the workspace:\n *\n * - `POST /api/v0/workspaces/{workspaceId}/presence-token` mints a\n *   **read-only** Keryx token for the workspace awareness room\n *   (`<workspaceId>/awareness`) — the same per-recipient-filtered presence\n *   feed the Olympus People page renders. The holder can receive presence and\n *   broadcast nothing; `connectWorkspacePresence` re-mints before expiry.\n * - `POST /api/v0/workspaces/{workspaceId}/presence/resolve` turns the opaque\n *   ids carried in awareness contexts (asset ids, session thread ids, project\n *   ids) into titles the caller may see. Only things the caller may open come\n *   back; missing ids are simply absent.\n *\n * Wire shapes are snake_case, matching `CollabTokenResponse`.\n */\n\nimport {\n  type CollabAuth,\n  CollabTokenError,\n  collabErrorFromResponse,\n  getAthenaApiBaseUrl,\n  getCollabAuthHeaders,\n} from './mint';\n\n/** Grant for the workspace awareness room. Always read-only (`access_type: 'r'`). */\nexport interface WorkspacePresenceTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport interface WorkspacePresenceResolveRequest {\n  asset_ids?: string[];\n  /** Thread ids, as published in `session` awareness contexts. */\n  session_ids?: string[];\n  project_ids?: string[];\n  include_projects?: boolean;\n  include_members?: boolean;\n}\n\nexport interface WorkspacePresenceResolvedAsset {\n  id: string;\n  title: string;\n  asset_type: string;\n}\n\nexport interface WorkspacePresenceResolvedSession {\n  thread_id: string;\n  asset_id: string;\n  title: string;\n}\n\nexport interface WorkspacePresenceResolvedProject {\n  id: string;\n  title: string;\n  assets: WorkspacePresenceResolvedAsset[];\n}\n\nexport interface WorkspacePresenceResolvedMember {\n  id: string;\n  name: string;\n  email: string;\n  avatar_url: string | null;\n}\n\nexport interface WorkspacePresenceResolveResponse {\n  assets: WorkspacePresenceResolvedAsset[];\n  sessions: WorkspacePresenceResolvedSession[];\n  projects: WorkspacePresenceResolvedProject[];\n  members: WorkspacePresenceResolvedMember[];\n}\n\nfunction workspaceUrl({\n  auth,\n  workspaceId,\n  path,\n}: {\n  auth: CollabAuth;\n  workspaceId: string;\n  path: string;\n}): string {\n  const base = getAthenaApiBaseUrl(auth.backendUrl);\n  return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;\n}\n\n/**\n * Mint a read-only token for the workspace awareness room.\n *\n * Rejects with `CollabTokenError` on 401 (bad credential) and 403 (admin\n * required, roster not enabled for this workspace, or a sandbox credential\n * that may not read presence), carrying the server's `detail`.\n */\nexport async function mintWorkspacePresenceToken(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceTokenResponse> {\n  const response = await fetch(\n    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence-token' }),\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify({}),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as WorkspacePresenceTokenResponse;\n}\n\nfunction arrayOrEmpty<T>(value: T[] | undefined | null): T[] {\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Resolve awareness ids to titles. Every section of the response is always\n * present on the returned object (an omitted section reads as empty), so\n * callers can index without guarding. Failures reject with `CollabTokenError`\n * — the same status + detail shape as the mint.\n */\nexport async function resolveWorkspacePresence(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  request: WorkspacePresenceResolveRequest;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceResolveResponse> {\n  const response = await fetch(\n    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence/resolve' }),\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify(args.request),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence resolve failed with status ${response.status}`\n    );\n  }\n  const body = (await response.json()) as Partial<WorkspacePresenceResolveResponse> | null;\n  if (!body || typeof body !== 'object') {\n    throw new CollabTokenError(response.status, 'Workspace presence resolve returned no body');\n  }\n  return {\n    assets: arrayOrEmpty(body.assets),\n    sessions: arrayOrEmpty(body.sessions),\n    projects: arrayOrEmpty(body.projects),\n    members: arrayOrEmpty(body.members),\n  };\n}\n"],"names":[],"mappings":";AA8EA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,QAAM,OAAO,oBAAoB,KAAK,UAAU;AAChD,SAAO,GAAG,IAAI,sBAAsB,mBAAmB,WAAW,CAAC,IAAI,IAAI;AAC7E;AASA,eAAsB,2BAA2B,MAIL;AAC1C,QAAM,WAAW,MAAM;AAAA,IACrB,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,kBAAkB;AAAA,IACvF;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,EAAE;AAAA,MACvB,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,oDAAoD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEvE;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;AAEA,SAAS,aAAgB,OAAoC;AAC3D,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA;AACxC;AAQA,eAAsB,yBAAyB,MAKD;AAC5C,QAAM,WAAW,MAAM;AAAA,IACrB,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,oBAAoB;AAAA,IACzF;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,MACjC,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,iDAAiD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEpE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAA;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAI,iBAAiB,SAAS,QAAQ,6CAA6C;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,SAAS,aAAa,KAAK,OAAO;AAAA,EAAA;AAEtC;"}
+{"version":3,"file":"presence-mint.js","sources":["../../src/collab/presence-mint.ts"],"sourcesContent":["/**\n * Public-API clients for the workspace presence feed.\n *\n * Two endpoints, both admin-only and both under the workspace:\n *\n * - `POST /api/v0/workspaces/{workspaceId}/presence-token` mints a\n *   **read-only** Keryx token for the workspace awareness room\n *   (`<workspaceId>/awareness`) — the same per-recipient-filtered presence\n *   feed the Olympus People page renders. The holder can receive presence and\n *   broadcast nothing; `connectWorkspacePresence` re-mints before expiry.\n * - `POST /api/v0/workspaces/{workspaceId}/presence/resolve` turns the opaque\n *   ids carried in awareness contexts (asset ids, session thread ids, project\n *   ids) into titles the caller may see. Only things the caller may open come\n *   back; missing ids are simply absent.\n *\n * Wire shapes are snake_case, matching `CollabTokenResponse`.\n */\n\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport {\n  type CollabAuth,\n  CollabTokenError,\n  collabErrorFromResponse,\n  getAthenaApiBaseUrl,\n} from './mint';\n\n/** Grant for the workspace awareness room. Always read-only (`access_type: 'r'`). */\nexport interface WorkspacePresenceTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport interface WorkspacePresenceResolveRequest {\n  asset_ids?: string[];\n  /** Thread ids, as published in `session` awareness contexts. */\n  session_ids?: string[];\n  project_ids?: string[];\n  include_projects?: boolean;\n  include_members?: boolean;\n}\n\nexport interface WorkspacePresenceResolvedAsset {\n  id: string;\n  title: string;\n  asset_type: string;\n}\n\nexport interface WorkspacePresenceResolvedSession {\n  thread_id: string;\n  asset_id: string;\n  title: string;\n}\n\nexport interface WorkspacePresenceResolvedProject {\n  id: string;\n  title: string;\n  assets: WorkspacePresenceResolvedAsset[];\n}\n\nexport interface WorkspacePresenceResolvedMember {\n  id: string;\n  name: string;\n  email: string;\n  avatar_url: string | null;\n}\n\nexport interface WorkspacePresenceResolveResponse {\n  assets: WorkspacePresenceResolvedAsset[];\n  sessions: WorkspacePresenceResolvedSession[];\n  projects: WorkspacePresenceResolvedProject[];\n  members: WorkspacePresenceResolvedMember[];\n}\n\nfunction workspaceUrl({\n  auth,\n  workspaceId,\n  path,\n}: {\n  auth: CollabAuth;\n  workspaceId: string;\n  path: string;\n}): string {\n  const base = getAthenaApiBaseUrl(auth.backendUrl);\n  return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;\n}\n\n/**\n * Mint a read-only token for the workspace awareness room.\n *\n * Rejects with `CollabTokenError` on 401 (bad credential) and 403 (admin\n * required, roster not enabled for this workspace, or a sandbox credential\n * that may not read presence), carrying the server's `detail`.\n */\nexport async function mintWorkspacePresenceToken(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceTokenResponse> {\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence-token' }), {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n      body: JSON.stringify({}),\n      signal: args.signal,\n    })\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as WorkspacePresenceTokenResponse;\n}\n\nfunction arrayOrEmpty<T>(value: T[] | undefined | null): T[] {\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Resolve awareness ids to titles. Every section of the response is always\n * present on the returned object (an omitted section reads as empty), so\n * callers can index without guarding. Failures reject with `CollabTokenError`\n * — the same status + detail shape as the mint.\n */\nexport async function resolveWorkspacePresence(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  request: WorkspacePresenceResolveRequest;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceResolveResponse> {\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(\n      workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence/resolve' }),\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: JSON.stringify(args.request),\n        signal: args.signal,\n      }\n    )\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence resolve failed with status ${response.status}`\n    );\n  }\n  const body = (await response.json()) as Partial<WorkspacePresenceResolveResponse> | null;\n  if (!body || typeof body !== 'object') {\n    throw new CollabTokenError(response.status, 'Workspace presence resolve returned no body');\n  }\n  return {\n    assets: arrayOrEmpty(body.assets),\n    sessions: arrayOrEmpty(body.sessions),\n    projects: arrayOrEmpty(body.projects),\n    members: arrayOrEmpty(body.members),\n  };\n}\n"],"names":[],"mappings":";;AA8EA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,QAAM,OAAO,oBAAoB,KAAK,UAAU;AAChD,SAAO,GAAG,IAAI,sBAAsB,mBAAmB,WAAW,CAAC,IAAI,IAAI;AAC7E;AASA,eAAsB,2BAA2B,MAIL;AAC1C,QAAM,WAAW,MAAM;AAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D,MAAM,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,iBAAA,CAAkB,GAAG;AAAA,MAC9F,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MAAA;AAAA,MAEL,MAAM,KAAK,UAAU,EAAE;AAAA,MACvB,QAAQ,KAAK;AAAA,IAAA,CACd;AAAA,EAAA;AAEH,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,oDAAoD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEvE;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;AAEA,SAAS,aAAgB,OAAoC;AAC3D,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA;AACxC;AAQA,eAAsB,yBAAyB,MAKD;AAC5C,QAAM,WAAW,MAAM;AAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D;AAAA,MACE,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,oBAAoB;AAAA,MACzF;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAG;AAAA,QAAA;AAAA,QAEL,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,QACjC,QAAQ,KAAK;AAAA,MAAA;AAAA,IACf;AAAA,EACF;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,iDAAiD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEpE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAA;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAI,iBAAiB,SAAS,QAAQ,6CAA6C;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,SAAS,aAAa,KAAK,OAAO;AAAA,EAAA;AAEtC;"}

package/dist/collab/presence-react.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const react = require("react");
+const AthenaCredentialSourceContext = require("../auth/AthenaCredentialSourceContext.cjs");
 const AthenaContext = require("../provider/AthenaContext.cjs");
 const presenceClient = require("./presence-client.cjs");
 const presenceMint = require("./presence-mint.cjs");
@@ -11,6 +12,7 @@ const NO_HUMANS = [];
 const NO_AGENTS = [];
 function useWorkspacePresence(workspaceId, options) {
   const config = AthenaContext.useAthenaConfig();
+  const identityEpoch = AthenaCredentialSourceContext.useAthenaCredentialIdentityEpoch();
   const enabled = (options == null ? void 0 : options.enabled) !== false && workspaceId !== null;
   const tickMs = (options == null ? void 0 : options.tickMs) ?? PRESENCE_DEFAULT_TICK_MS;
   const [entry, setEntry] = react.useState(null);
@@ -25,7 +27,8 @@ function useWorkspacePresence(workspaceId, options) {
       auth: {
         backendUrl: config.backendUrl,
         apiKey: config.apiKey,
-        token: config.token
+        token: config.token,
+        getToken: config.getToken
       }
     });
     handleRef.current = next;
@@ -34,7 +37,7 @@ function useWorkspacePresence(workspaceId, options) {
       handleRef.current = null;
       next.destroy();
     };
-  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.token]);
+  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);
   const handle = enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;
   const subscribe = react.useMemo(() => {
     return (onStoreChange) => {
@@ -90,7 +93,6 @@ function useWorkspacePresence(workspaceId, options) {
 }
 function useWorkspacePresenceResolver(workspaceId) {
   const config = AthenaContext.useAthenaConfig();
-  const { backendUrl, apiKey, token } = config;
   return react.useCallback(
     (request, signal) => {
       if (workspaceId === null) {
@@ -99,13 +101,18 @@ function useWorkspacePresenceResolver(workspaceId) {
         );
       }
       return presenceMint.resolveWorkspacePresence({
-        auth: { backendUrl, apiKey, token },
+        auth: {
+          backendUrl: config.backendUrl,
+          apiKey: config.apiKey,
+          token: config.token,
+          getToken: config.getToken
+        },
         workspaceId,
         request,
         signal
       });
     },
-    [workspaceId, backendUrl, apiKey, token]
+    [workspaceId, config]
   );
 }
 exports.PRESENCE_DEFAULT_TICK_MS = PRESENCE_DEFAULT_TICK_MS;

package/dist/collab/presence-react.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"presence-react.cjs","sources":["../../src/collab/presence-react.ts"],"sourcesContent":["/**\n * React bindings for the workspace presence feed.\n *\n * `useWorkspacePresence(workspaceId)` opens (and owns) a\n * `connectWorkspacePresence` handle, resolving auth from the surrounding\n * `AthenaProvider` (per-viewer bearer when present, API key otherwise), and\n * re-renders on status/roster changes via `useSyncExternalStore`. Each person\n * carries a `state` on the intent ladder, recomputed against a clock that\n * ticks every `tickMs` so `active` decays to `idle` and `away` between\n * awareness events.\n *\n * `useWorkspacePresenceResolver(workspaceId)` returns the batch id→title\n * resolver bound to the same auth. It is deliberately thin: callers own\n * caching (TanStack Query is the expected home for it).\n */\n\nimport { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type WorkspacePresenceHandle,\n  type WorkspacePresenceStatus,\n  connectWorkspacePresence,\n} from './presence-client';\nimport {\n  type WorkspacePresenceResolveRequest,\n  type WorkspacePresenceResolveResponse,\n  resolveWorkspacePresence,\n} from './presence-mint';\nimport {\n  type PresenceAgent,\n  type PresenceHuman,\n  type PresenceState,\n  derivePresenceState,\n} from './presence-slots';\n\n/** Default cadence for re-deriving each person's intent state. */\nexport const PRESENCE_DEFAULT_TICK_MS = 10_000;\n\nexport interface PresenceHumanWithState extends PresenceHuman {\n  /** Where the person sits on the intent ladder as of the last tick. */\n  state: PresenceState;\n}\n\nexport interface UseWorkspacePresenceOptions {\n  /** `false` closes the feed without unmounting the caller. Default `true`. */\n  enabled?: boolean;\n  /** How often `state` is re-derived from `lastIntentAt`. Default 10 s. */\n  tickMs?: number;\n}\n\nexport interface UseWorkspacePresenceResult {\n  /** `'closed'` while disabled or without a workspace; `'connecting'` until the first mint resolves. */\n  status: WorkspacePresenceStatus;\n  error: Error | null;\n  accessType: 'r' | 'rw' | null;\n  humans: PresenceHumanWithState[];\n  agents: PresenceAgent[];\n  /** Force an early token refresh; resolves immediately when no feed is open. */\n  refreshNow: () => Promise<void>;\n}\n\nconst EMPTY_SNAPSHOT = 'init||0';\nconst NO_HUMANS: PresenceHuman[] = [];\nconst NO_AGENTS: PresenceAgent[] = [];\n\nexport function useWorkspacePresence(\n  workspaceId: string | null,\n  options?: UseWorkspacePresenceOptions\n): UseWorkspacePresenceResult {\n  const config = useAthenaConfig();\n  const enabled = options?.enabled !== false && workspaceId !== null;\n  const tickMs = options?.tickMs ?? PRESENCE_DEFAULT_TICK_MS;\n  const [entry, setEntry] = useState<{\n    workspaceId: string;\n    handle: WorkspacePresenceHandle;\n  } | null>(null);\n  const handleRef = useRef<WorkspacePresenceHandle | null>(null);\n\n  useEffect(() => {\n    if (!enabled || workspaceId === null) {\n      setEntry(null);\n      return;\n    }\n    const next = connectWorkspacePresence({\n      workspaceId,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n      },\n    });\n    handleRef.current = next;\n    setEntry({ workspaceId, handle: next });\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or credentials change; the handle re-mints on\n    // its own schedule otherwise.\n  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.token]);\n\n  // React renders with the new arguments before the effect above runs, so a\n  // handle opened for a previous workspace, or before the feed was disabled,\n  // still sits in state for that one render. Expose it only while it is the\n  // handle this render asked for; otherwise the closed / connecting empty\n  // result wins, and a disabled feed never leaks a roster.\n  const handle =\n    enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  // The ladder decays with wall-clock time, not with awareness events; a\n  // person who stops typing must drift to idle even when nothing arrives.\n  const [now, setNow] = useState(() => Date.now());\n  useEffect(() => {\n    if (!enabled) return;\n    setNow(Date.now());\n    const timer = setInterval(() => {\n      setNow(Date.now());\n    }, tickMs);\n    return () => {\n      clearInterval(timer);\n    };\n  }, [enabled, tickMs]);\n\n  const rosterHumans = handle?.humans ?? NO_HUMANS;\n  const humans = useMemo(\n    () =>\n      rosterHumans.map((human) => ({\n        ...human,\n        state: derivePresenceState({\n          lastIntentAt: human.lastIntentAt,\n          hidden: human.hidden,\n          manualAway: human.manualAway,\n          now,\n        }),\n      })),\n    [rosterHumans, now]\n  );\n\n  const refreshNow = useCallback(() => handleRef.current?.refreshNow() ?? Promise.resolve(), []);\n\n  return {\n    status: handle ? handle.status : enabled ? 'connecting' : 'closed',\n    error: handle?.error ?? null,\n    accessType: handle?.accessType ?? null,\n    humans,\n    agents: handle?.agents ?? NO_AGENTS,\n    refreshNow,\n  };\n}\n\nexport type WorkspacePresenceResolver = (\n  request: WorkspacePresenceResolveRequest,\n  signal?: AbortSignal\n) => Promise<WorkspacePresenceResolveResponse>;\n\n/**\n * A stable resolver bound to the provider's auth and the given workspace.\n * Rejects when called without a workspace; no caching — callers own that.\n */\nexport function useWorkspacePresenceResolver(\n  workspaceId: string | null\n): WorkspacePresenceResolver {\n  const config = useAthenaConfig();\n  const { backendUrl, apiKey, token } = config;\n  return useCallback<WorkspacePresenceResolver>(\n    (request, signal) => {\n      if (workspaceId === null) {\n        return Promise.reject(\n          new Error('[AthenaSDK] useWorkspacePresenceResolver: no workspace selected')\n        );\n      }\n      return resolveWorkspacePresence({\n        auth: { backendUrl, apiKey, token },\n        workspaceId,\n        request,\n        signal,\n      });\n    },\n    [workspaceId, backendUrl, apiKey, token]\n  );\n}\n"],"names":["useAthenaConfig","useState","useRef","useEffect","connectWorkspacePresence","useMemo","useSyncExternalStore","derivePresenceState","useCallback","resolveWorkspacePresence"],"mappings":";;;;;;;AAoCO,MAAM,2BAA2B;AAyBxC,MAAM,iBAAiB;AACvB,MAAM,YAA6B,CAAA;AACnC,MAAM,YAA6B,CAAA;AAE5B,SAAS,qBACd,aACA,SAC4B;AAC5B,QAAM,SAASA,cAAAA,gBAAA;AACf,QAAM,WAAU,mCAAS,aAAY,SAAS,gBAAgB;AAC9D,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,OAAO,QAAQ,IAAIC,MAAAA,SAGhB,IAAI;AACd,QAAM,YAAYC,MAAAA,OAAuC,IAAI;AAE7DC,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,WAAW,gBAAgB,MAAM;AACpC,eAAS,IAAI;AACb;AAAA,IACF;AACA,UAAM,OAAOC,eAAAA,yBAAyB;AAAA,MACpC;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,MAAA;AAAA,IAChB,CACD;AACD,cAAU,UAAU;AACpB,aAAS,EAAE,aAAa,QAAQ,KAAA,CAAM;AACtC,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAGF,GAAG,CAAC,SAAS,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC;AAOzE,QAAM,SACJ,WAAW,UAAU,QAAQ,MAAM,gBAAgB,cAAc,MAAM,SAAS;AAElF,QAAM,YAAYC,MAAAA,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEMC,QAAAA;AAAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACtE;AAAA,IACA,MAAM;AAAA,EAAA;AAMR,QAAM,CAAC,KAAK,MAAM,IAAIL,MAAAA,SAAS,MAAM,KAAK,KAAK;AAC/CE,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,KAAK;AACjB,UAAM,QAAQ,YAAY,MAAM;AAC9B,aAAO,KAAK,KAAK;AAAA,IACnB,GAAG,MAAM;AACT,WAAO,MAAM;AACX,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,SAAS,MAAM,CAAC;AAEpB,QAAM,gBAAe,iCAAQ,WAAU;AACvC,QAAM,SAASE,MAAAA;AAAAA,IACb,MACE,aAAa,IAAI,CAAC,WAAW;AAAA,MAC3B,GAAG;AAAA,MACH,OAAOE,cAAAA,oBAAoB;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,YAAY,MAAM;AAAA,QAClB;AAAA,MAAA,CACD;AAAA,IAAA,EACD;AAAA,IACJ,CAAC,cAAc,GAAG;AAAA,EAAA;AAGpB,QAAM,aAAaC,kBAAY,MAAA;;AAAM,4BAAU,YAAV,mBAAmB,iBAAgB,QAAQ,QAAA;AAAA,KAAW,EAAE;AAE7F,SAAO;AAAA,IACL,QAAQ,SAAS,OAAO,SAAS,UAAU,eAAe;AAAA,IAC1D,QAAO,iCAAQ,UAAS;AAAA,IACxB,aAAY,iCAAQ,eAAc;AAAA,IAClC;AAAA,IACA,SAAQ,iCAAQ,WAAU;AAAA,IAC1B;AAAA,EAAA;AAEJ;AAWO,SAAS,6BACd,aAC2B;AAC3B,QAAM,SAASR,cAAAA,gBAAA;AACf,QAAM,EAAE,YAAY,QAAQ,MAAA,IAAU;AACtC,SAAOQ,MAAAA;AAAAA,IACL,CAAC,SAAS,WAAW;AACnB,UAAI,gBAAgB,MAAM;AACxB,eAAO,QAAQ;AAAA,UACb,IAAI,MAAM,iEAAiE;AAAA,QAAA;AAAA,MAE/E;AACA,aAAOC,sCAAyB;AAAA,QAC9B,MAAM,EAAE,YAAY,QAAQ,MAAA;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,MAAA,CACD;AAAA,IACH;AAAA,IACA,CAAC,aAAa,YAAY,QAAQ,KAAK;AAAA,EAAA;AAE3C;;;;"}
+{"version":3,"file":"presence-react.cjs","sources":["../../src/collab/presence-react.ts"],"sourcesContent":["/**\n * React bindings for the workspace presence feed.\n *\n * `useWorkspacePresence(workspaceId)` opens (and owns) a\n * `connectWorkspacePresence` handle, resolving auth from the surrounding\n * `AthenaProvider` (per-viewer bearer when present, API key otherwise), and\n * re-renders on status/roster changes via `useSyncExternalStore`. Each person\n * carries a `state` on the intent ladder, recomputed against a clock that\n * ticks every `tickMs` so `active` decays to `idle` and `away` between\n * awareness events.\n *\n * `useWorkspacePresenceResolver(workspaceId)` returns the batch id→title\n * resolver bound to the same auth. It is deliberately thin: callers own\n * caching (TanStack Query is the expected home for it).\n */\n\nimport { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaCredentialIdentityEpoch } from '../auth/AthenaCredentialSourceContext';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type WorkspacePresenceHandle,\n  type WorkspacePresenceStatus,\n  connectWorkspacePresence,\n} from './presence-client';\nimport {\n  type WorkspacePresenceResolveRequest,\n  type WorkspacePresenceResolveResponse,\n  resolveWorkspacePresence,\n} from './presence-mint';\nimport {\n  type PresenceAgent,\n  type PresenceHuman,\n  type PresenceState,\n  derivePresenceState,\n} from './presence-slots';\n\n/** Default cadence for re-deriving each person's intent state. */\nexport const PRESENCE_DEFAULT_TICK_MS = 10_000;\n\nexport interface PresenceHumanWithState extends PresenceHuman {\n  /** Where the person sits on the intent ladder as of the last tick. */\n  state: PresenceState;\n}\n\nexport interface UseWorkspacePresenceOptions {\n  /** `false` closes the feed without unmounting the caller. Default `true`. */\n  enabled?: boolean;\n  /** How often `state` is re-derived from `lastIntentAt`. Default 10 s. */\n  tickMs?: number;\n}\n\nexport interface UseWorkspacePresenceResult {\n  /** `'closed'` while disabled or without a workspace; `'connecting'` until the first mint resolves. */\n  status: WorkspacePresenceStatus;\n  error: Error | null;\n  accessType: 'r' | 'rw' | null;\n  humans: PresenceHumanWithState[];\n  agents: PresenceAgent[];\n  /** Force an early token refresh; resolves immediately when no feed is open. */\n  refreshNow: () => Promise<void>;\n}\n\nconst EMPTY_SNAPSHOT = 'init||0';\nconst NO_HUMANS: PresenceHuman[] = [];\nconst NO_AGENTS: PresenceAgent[] = [];\n\nexport function useWorkspacePresence(\n  workspaceId: string | null,\n  options?: UseWorkspacePresenceOptions\n): UseWorkspacePresenceResult {\n  const config = useAthenaConfig();\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  const enabled = options?.enabled !== false && workspaceId !== null;\n  const tickMs = options?.tickMs ?? PRESENCE_DEFAULT_TICK_MS;\n  const [entry, setEntry] = useState<{\n    workspaceId: string;\n    handle: WorkspacePresenceHandle;\n  } | null>(null);\n  const handleRef = useRef<WorkspacePresenceHandle | null>(null);\n\n  useEffect(() => {\n    if (!enabled || workspaceId === null) {\n      setEntry(null);\n      return;\n    }\n    const next = connectWorkspacePresence({\n      workspaceId,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n        getToken: config.getToken,\n      },\n    });\n    handleRef.current = next;\n    setEntry({ workspaceId, handle: next });\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or the signed-in identity changes (the\n    // credential source's identity epoch). A renewed token for the same\n    // identity reaches the next re-mint through `getToken`, so a renewal\n    // does not tear the live connection down.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);\n\n  // React renders with the new arguments before the effect above runs, so a\n  // handle opened for a previous workspace, or before the feed was disabled,\n  // still sits in state for that one render. Expose it only while it is the\n  // handle this render asked for; otherwise the closed / connecting empty\n  // result wins, and a disabled feed never leaks a roster.\n  const handle =\n    enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  // The ladder decays with wall-clock time, not with awareness events; a\n  // person who stops typing must drift to idle even when nothing arrives.\n  const [now, setNow] = useState(() => Date.now());\n  useEffect(() => {\n    if (!enabled) return;\n    setNow(Date.now());\n    const timer = setInterval(() => {\n      setNow(Date.now());\n    }, tickMs);\n    return () => {\n      clearInterval(timer);\n    };\n  }, [enabled, tickMs]);\n\n  const rosterHumans = handle?.humans ?? NO_HUMANS;\n  const humans = useMemo(\n    () =>\n      rosterHumans.map((human) => ({\n        ...human,\n        state: derivePresenceState({\n          lastIntentAt: human.lastIntentAt,\n          hidden: human.hidden,\n          manualAway: human.manualAway,\n          now,\n        }),\n      })),\n    [rosterHumans, now]\n  );\n\n  const refreshNow = useCallback(() => handleRef.current?.refreshNow() ?? Promise.resolve(), []);\n\n  return {\n    status: handle ? handle.status : enabled ? 'connecting' : 'closed',\n    error: handle?.error ?? null,\n    accessType: handle?.accessType ?? null,\n    humans,\n    agents: handle?.agents ?? NO_AGENTS,\n    refreshNow,\n  };\n}\n\nexport type WorkspacePresenceResolver = (\n  request: WorkspacePresenceResolveRequest,\n  signal?: AbortSignal\n) => Promise<WorkspacePresenceResolveResponse>;\n\n/**\n * A stable resolver bound to the provider's auth and the given workspace.\n * Credentials are read on every call (the provider serves the current token\n * through getters), and `getToken` renews a refused one once. Rejects when\n * called without a workspace; no caching — callers own that.\n */\nexport function useWorkspacePresenceResolver(\n  workspaceId: string | null\n): WorkspacePresenceResolver {\n  const config = useAthenaConfig();\n  return useCallback<WorkspacePresenceResolver>(\n    (request, signal) => {\n      if (workspaceId === null) {\n        return Promise.reject(\n          new Error('[AthenaSDK] useWorkspacePresenceResolver: no workspace selected')\n        );\n      }\n      return resolveWorkspacePresence({\n        auth: {\n          backendUrl: config.backendUrl,\n          apiKey: config.apiKey,\n          token: config.token,\n          getToken: config.getToken,\n        },\n        workspaceId,\n        request,\n        signal,\n      });\n    },\n    [workspaceId, config]\n  );\n}\n"],"names":["useAthenaConfig","useAthenaCredentialIdentityEpoch","useState","useRef","useEffect","connectWorkspacePresence","useMemo","useSyncExternalStore","derivePresenceState","useCallback","resolveWorkspacePresence"],"mappings":";;;;;;;;AAqCO,MAAM,2BAA2B;AAyBxC,MAAM,iBAAiB;AACvB,MAAM,YAA6B,CAAA;AACnC,MAAM,YAA6B,CAAA;AAE5B,SAAS,qBACd,aACA,SAC4B;AAC5B,QAAM,SAASA,cAAAA,gBAAA;AACf,QAAM,gBAAgBC,8BAAAA,iCAAA;AACtB,QAAM,WAAU,mCAAS,aAAY,SAAS,gBAAgB;AAC9D,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,OAAO,QAAQ,IAAIC,MAAAA,SAGhB,IAAI;AACd,QAAM,YAAYC,MAAAA,OAAuC,IAAI;AAE7DC,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,WAAW,gBAAgB,MAAM;AACpC,eAAS,IAAI;AACb;AAAA,IACF;AACA,UAAM,OAAOC,eAAAA,yBAAyB;AAAA,MACpC;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,QACd,UAAU,OAAO;AAAA,MAAA;AAAA,IACnB,CACD;AACD,cAAU,UAAU;AACpB,aAAS,EAAE,aAAa,QAAQ,KAAA,CAAM;AACtC,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAMF,GAAG,CAAC,SAAS,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,aAAa,CAAC;AAO3F,QAAM,SACJ,WAAW,UAAU,QAAQ,MAAM,gBAAgB,cAAc,MAAM,SAAS;AAElF,QAAM,YAAYC,MAAAA,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEMC,QAAAA;AAAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACtE;AAAA,IACA,MAAM;AAAA,EAAA;AAMR,QAAM,CAAC,KAAK,MAAM,IAAIL,MAAAA,SAAS,MAAM,KAAK,KAAK;AAC/CE,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,KAAK;AACjB,UAAM,QAAQ,YAAY,MAAM;AAC9B,aAAO,KAAK,KAAK;AAAA,IACnB,GAAG,MAAM;AACT,WAAO,MAAM;AACX,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,SAAS,MAAM,CAAC;AAEpB,QAAM,gBAAe,iCAAQ,WAAU;AACvC,QAAM,SAASE,MAAAA;AAAAA,IACb,MACE,aAAa,IAAI,CAAC,WAAW;AAAA,MAC3B,GAAG;AAAA,MACH,OAAOE,cAAAA,oBAAoB;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,YAAY,MAAM;AAAA,QAClB;AAAA,MAAA,CACD;AAAA,IAAA,EACD;AAAA,IACJ,CAAC,cAAc,GAAG;AAAA,EAAA;AAGpB,QAAM,aAAaC,kBAAY,MAAA;;AAAM,4BAAU,YAAV,mBAAmB,iBAAgB,QAAQ,QAAA;AAAA,KAAW,EAAE;AAE7F,SAAO;AAAA,IACL,QAAQ,SAAS,OAAO,SAAS,UAAU,eAAe;AAAA,IAC1D,QAAO,iCAAQ,UAAS;AAAA,IACxB,aAAY,iCAAQ,eAAc;AAAA,IAClC;AAAA,IACA,SAAQ,iCAAQ,WAAU;AAAA,IAC1B;AAAA,EAAA;AAEJ;AAaO,SAAS,6BACd,aAC2B;AAC3B,QAAM,SAAST,cAAAA,gBAAA;AACf,SAAOS,MAAAA;AAAAA,IACL,CAAC,SAAS,WAAW;AACnB,UAAI,gBAAgB,MAAM;AACxB,eAAO,QAAQ;AAAA,UACb,IAAI,MAAM,iEAAiE;AAAA,QAAA;AAAA,MAE/E;AACA,aAAOC,sCAAyB;AAAA,QAC9B,MAAM;AAAA,UACJ,YAAY,OAAO;AAAA,UACnB,QAAQ,OAAO;AAAA,UACf,OAAO,OAAO;AAAA,UACd,UAAU,OAAO;AAAA,QAAA;AAAA,QAEnB;AAAA,QACA;AAAA,QACA;AAAA,MAAA,CACD;AAAA,IACH;AAAA,IACA,CAAC,aAAa,MAAM;AAAA,EAAA;AAExB;;;;"}

package/dist/collab/presence-react.d.ts

@@ -42,6 +42,8 @@ export declare function useWorkspacePresence(workspaceId: string | null, options
 export type WorkspacePresenceResolver = (request: WorkspacePresenceResolveRequest, signal?: AbortSignal) => Promise<WorkspacePresenceResolveResponse>;
 /**
  * A stable resolver bound to the provider's auth and the given workspace.
- * Rejects when called without a workspace; no caching — callers own that.
+ * Credentials are read on every call (the provider serves the current token
+ * through getters), and `getToken` renews a refused one once. Rejects when
+ * called without a workspace; no caching — callers own that.
  */
 export declare function useWorkspacePresenceResolver(workspaceId: string | null): WorkspacePresenceResolver;

package/dist/collab/presence-react.js

@@ -1,4 +1,5 @@
 import { useState, useRef, useEffect, useMemo, useSyncExternalStore, useCallback } from "react";
+import { useAthenaCredentialIdentityEpoch } from "../auth/AthenaCredentialSourceContext.js";
 import { useAthenaConfig } from "../provider/AthenaContext.js";
 import { connectWorkspacePresence } from "./presence-client.js";
 import { resolveWorkspacePresence } from "./presence-mint.js";
@@ -9,6 +10,7 @@ const NO_HUMANS = [];
 const NO_AGENTS = [];
 function useWorkspacePresence(workspaceId, options) {
   const config = useAthenaConfig();
+  const identityEpoch = useAthenaCredentialIdentityEpoch();
   const enabled = (options == null ? void 0 : options.enabled) !== false && workspaceId !== null;
   const tickMs = (options == null ? void 0 : options.tickMs) ?? PRESENCE_DEFAULT_TICK_MS;
   const [entry, setEntry] = useState(null);
@@ -23,7 +25,8 @@ function useWorkspacePresence(workspaceId, options) {
       auth: {
         backendUrl: config.backendUrl,
         apiKey: config.apiKey,
-        token: config.token
+        token: config.token,
+        getToken: config.getToken
       }
     });
     handleRef.current = next;
@@ -32,7 +35,7 @@ function useWorkspacePresence(workspaceId, options) {
       handleRef.current = null;
       next.destroy();
     };
-  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.token]);
+  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);
   const handle = enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;
   const subscribe = useMemo(() => {
     return (onStoreChange) => {
@@ -88,7 +91,6 @@ function useWorkspacePresence(workspaceId, options) {
 }
 function useWorkspacePresenceResolver(workspaceId) {
   const config = useAthenaConfig();
-  const { backendUrl, apiKey, token } = config;
   return useCallback(
     (request, signal) => {
       if (workspaceId === null) {
@@ -97,13 +99,18 @@ function useWorkspacePresenceResolver(workspaceId) {
         );
       }
       return resolveWorkspacePresence({
-        auth: { backendUrl, apiKey, token },
+        auth: {
+          backendUrl: config.backendUrl,
+          apiKey: config.apiKey,
+          token: config.token,
+          getToken: config.getToken
+        },
         workspaceId,
         request,
         signal
       });
     },
-    [workspaceId, backendUrl, apiKey, token]
+    [workspaceId, config]
   );
 }
 export {