@athenaintel/react 0.24.1 → 0.25.0

package/dist/auth/credential-source.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-source.cjs","sources":["../../src/auth/credential-source.ts"],"sourcesContent":["import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\n\n/**\n * Renews a token-backed sign-in. `force: true` means the token just presented\n * was refused, or has expired: the renewer must obtain a new one rather than\n * return the one it holds. Resolves `null` when it cannot produce a token.\n */\nexport type AthenaTokenRenewer = (options: { force: boolean }) => Promise<string | null>;\n\n/** What the credential source reads, fresh, on every resolve. */\nexport interface AthenaCredentialInputs {\n  /**\n   * The host's own getter (`config.getToken`). It owns renewal for its\n   * sign-in, so it always wins; the held `token` is its fallback when it\n   * resolves nothing.\n   */\n  hostGetToken?: AthenaStatewireTokenGetter;\n  /** The token currently held: the host's, the sign-in provider's or the host bridge's. */\n  token: string | null | undefined;\n  /** How that token renews (the sign-in provider or the host bridge); absent for a static token. */\n  renew?: AthenaTokenRenewer;\n}\n\n/**\n * The single place every SDK network path gets the token it presents — the\n * live thread connection, the session list's index and REST calls, uploads,\n * search, voice and the collaborative-document mint — read right before it is\n * presented.\n */\nexport interface AthenaCredentialSource {\n  /**\n   * The token to present now. `force` renews it first (the previous one was\n   * refused). A token that has expired, or expires within\n   * {@link TOKEN_EXPIRY_SKEW_MS}, is renewed before it is presented, so a tab\n   * waking from sleep never presents a dead token. Concurrent renewals share\n   * one in-flight request, and calls made while one is in flight wait for it\n   * instead of presenting the token it is replacing. A renewal never hands one\n   * account's token to a call made after the signed-in account changed.\n   */\n  getToken: (options?: { force?: boolean }) => Promise<string | null>;\n  /** Called, with no arguments, whenever a different token becomes current. */\n  subscribe: (listener: () => void) => () => void;\n  /**\n   * How many times the identity behind the token has changed: its JWT\n   * subject, or the token itself when it is opaque. Renewals for the same\n   * identity leave it alone. Long-lived connections key on it, so they keep\n   * running across renewals and are rebuilt when someone else signs in,\n   * including under a host `getToken`, whose identity is only known once a\n   * token has been resolved. Subscribers hear when it moves.\n   */\n  identityEpoch: () => number;\n  /** Tell subscribers the held token changed (the provider calls this when its inputs do). */\n  notifyTokenChanged: () => void;\n}\n\n/** A token this close to its expiry is renewed before it is presented. */\nexport const TOKEN_EXPIRY_SKEW_MS = 30_000;\n\n/**\n * The `exp` of a JWT, in milliseconds, or `null` for anything that is not a\n * JWT with a numeric `exp`. Read without verification: it only decides whether\n * to renew before presenting; the server still validates every token.\n */\nexport function jwtExpiresAtMs(token: string): number | null {\n  const payload = token.split('.')[1];\n  if (!payload) return null;\n  try {\n    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n    const exp: unknown = (JSON.parse(atob(padded)) as { exp?: unknown }).exp;\n    return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;\n  } catch {\n    return null;\n  }\n}\n\n/** The unverified `sub` of a JWT, or `null` for anything that is not a JWT with one. */\nexport function jwtSubject(token: string): string | null {\n  const payload = token.split('.')[1];\n  if (!payload) return null;\n  try {\n    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n    const sub: unknown = (JSON.parse(atob(padded)) as { sub?: unknown }).sub;\n    return typeof sub === 'string' && sub.length > 0 ? sub : null;\n  } catch {\n    return null;\n  }\n}\n\n/** True for a JWT that has expired or expires within {@link TOKEN_EXPIRY_SKEW_MS}. */\nexport function isTokenExpiring(token: string, now: number = Date.now()): boolean {\n  const expiresAt = jwtExpiresAtMs(token);\n  return expiresAt !== null && expiresAt - now <= TOKEN_EXPIRY_SKEW_MS;\n}\n\nexport function createAthenaCredentialSource(\n  read: () => AthenaCredentialInputs,\n): AthenaCredentialSource {\n  const listeners = new Set<() => void>();\n  // The renewal in flight, and whether the host's getter runs it (the host\n  // owns identity for its getter) or the sign-in provider's / bridge's renewer.\n  let renewal: { token: Promise<string | null>; byHost: boolean } | null = null;\n  let lastResolved: string | null = null;\n  let identity: string | null = null;\n  let identityEpoch = 0;\n\n  const notifyListeners = () => {\n    for (const listener of [...listeners]) listener();\n  };\n\n  /** Note who a token acts as; true when that is someone other than before. */\n  const observeIdentity = (token: string | null | undefined): boolean => {\n    if (!token) return false;\n    const next = jwtSubject(token) ?? token;\n    if (next === identity) return false;\n    const changed = identity !== null;\n    identity = next;\n    if (changed) identityEpoch += 1;\n    return changed;\n  };\n\n  const notifyTokenChanged = () => {\n    observeIdentity(read().token);\n    notifyListeners();\n  };\n\n  /** Record what a resolve produced; a different token than the last one is news. */\n  const settle = (token: string | null): string | null => {\n    const identityChanged = observeIdentity(token);\n    if (token !== null && token !== lastResolved) {\n      const replaced = lastResolved !== null;\n      lastResolved = token;\n      if (replaced || identityChanged) notifyListeners();\n    } else if (identityChanged) {\n      notifyListeners();\n    }\n    return token;\n  };\n\n  const shareRenewal = (\n    start: () => Promise<string | null>,\n    byHost: boolean,\n  ): { token: Promise<string | null>; byHost: boolean } => {\n    if (!renewal) {\n      const entry = {\n        token: start().finally(() => {\n          if (renewal === entry) renewal = null;\n        }),\n        byHost,\n      };\n      renewal = entry;\n    }\n    return renewal;\n  };\n\n  /**\n   * What a finished renewal hands one caller. A host getter's token is\n   * presented as is: the host owns identity for its getter. A sign-in\n   * provider's or bridge's renewed token is presented only while it acts as\n   * the account the provider holds now. When the account changed while the\n   * renewal was in flight (its JWT subject differs from the held token's, or\n   * the provider holds no token any more), the held token, the current\n   * account's, is presented instead. A renewal that produced nothing keeps\n   * the held token: the caller presents it and the host's refusal ends the\n   * attempt.\n   */\n  const presentable = (\n    { byHost }: { byHost: boolean },\n    renewed: string | null,\n  ): string | null => {\n    const held = read().token ?? null;\n    if (byHost) return renewed ?? held;\n    if (!renewed || !held) return held;\n    const heldSubject = jwtSubject(held);\n    const renewedSubject = jwtSubject(renewed);\n    return heldSubject && renewedSubject && heldSubject !== renewedSubject ? held : renewed;\n  };\n\n  const awaitRenewal = async (shared: {\n    token: Promise<string | null>;\n    byHost: boolean;\n  }): Promise<string | null> => settle(presentable(shared, await shared.token));\n\n  const getToken = async ({ force = false }: { force?: boolean } = {}): Promise<string | null> => {\n    if (renewal) return awaitRenewal(renewal);\n    const inputs = read();\n    const hostGetToken = inputs.hostGetToken;\n    if (hostGetToken) {\n      if (!force) return settle((await hostGetToken({ force: false })) ?? read().token ?? null);\n      return awaitRenewal(\n        shareRenewal(async () => (await hostGetToken({ force: true })) ?? null, true),\n      );\n    }\n    const current = inputs.token ?? null;\n    const renew = inputs.renew;\n    if (!renew) return settle(current);\n    const stale = force || (current !== null && isTokenExpiring(current));\n    if (!stale) return settle(current);\n    return awaitRenewal(shareRenewal(() => renew({ force: true }), false));\n  };\n\n  return {\n    getToken,\n    subscribe: (listener) => {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    notifyTokenChanged,\n    identityEpoch: () => identityEpoch,\n  };\n}\n"],"names":[],"mappings":";;AAwDO,MAAM,uBAAuB;AAO7B,SAAS,eAAe,OAA8B;AAC3D,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,UAAM,SAAS,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG;AAClE,UAAM,MAAgB,KAAK,MAAM,KAAK,MAAM,CAAC,EAAwB;AACrE,WAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM,MAAO;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,WAAW,OAA8B;AACvD,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,UAAM,SAAS,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG;AAClE,UAAM,MAAgB,KAAK,MAAM,KAAK,MAAM,CAAC,EAAwB;AACrE,WAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAAA,EAC3D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAAe,MAAc,KAAK,OAAgB;AAChF,QAAM,YAAY,eAAe,KAAK;AACtC,SAAO,cAAc,QAAQ,YAAY,OAAO;AAClD;AAEO,SAAS,6BACd,MACwB;AACxB,QAAM,gCAAgB,IAAA;AAGtB,MAAI,UAAqE;AACzE,MAAI,eAA8B;AAClC,MAAI,WAA0B;AAC9B,MAAI,gBAAgB;AAEpB,QAAM,kBAAkB,MAAM;AAC5B,eAAW,YAAY,CAAC,GAAG,SAAS,EAAG,UAAA;AAAA,EACzC;AAGA,QAAM,kBAAkB,CAAC,UAA8C;AACrE,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,OAAO,WAAW,KAAK,KAAK;AAClC,QAAI,SAAS,SAAU,QAAO;AAC9B,UAAM,UAAU,aAAa;AAC7B,eAAW;AACX,QAAI,QAAS,kBAAiB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,qBAAqB,MAAM;AAC/B,oBAAgB,KAAA,EAAO,KAAK;AAC5B,oBAAA;AAAA,EACF;AAGA,QAAM,SAAS,CAAC,UAAwC;AACtD,UAAM,kBAAkB,gBAAgB,KAAK;AAC7C,QAAI,UAAU,QAAQ,UAAU,cAAc;AAC5C,YAAM,WAAW,iBAAiB;AAClC,qBAAe;AACf,UAAI,YAAY,gBAAiB,iBAAA;AAAA,IACnC,WAAW,iBAAiB;AAC1B,sBAAA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,CACnB,OACA,WACuD;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,QAAQ;AAAA,QACZ,OAAO,QAAQ,QAAQ,MAAM;AAC3B,cAAI,YAAY,MAAO,WAAU;AAAA,QACnC,CAAC;AAAA,QACD;AAAA,MAAA;AAEF,gBAAU;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAaA,QAAM,cAAc,CAClB,EAAE,OAAA,GACF,YACkB;AAClB,UAAM,OAAO,OAAO,SAAS;AAC7B,QAAI,eAAe,WAAW;AAC9B,QAAI,CAAC,WAAW,CAAC,KAAM,QAAO;AAC9B,UAAM,cAAc,WAAW,IAAI;AACnC,UAAM,iBAAiB,WAAW,OAAO;AACzC,WAAO,eAAe,kBAAkB,gBAAgB,iBAAiB,OAAO;AAAA,EAClF;AAEA,QAAM,eAAe,OAAO,WAGE,OAAO,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAE5E,QAAM,WAAW,OAAO,EAAE,QAAQ,MAAA,IAA+B,CAAA,MAA+B;AAC9F,QAAI,QAAS,QAAO,aAAa,OAAO;AACxC,UAAM,SAAS,KAAA;AACf,UAAM,eAAe,OAAO;AAC5B,QAAI,cAAc;AAChB,UAAI,CAAC,MAAO,QAAO,OAAQ,MAAM,aAAa,EAAE,OAAO,MAAA,CAAO,KAAM,OAAO,SAAS,IAAI;AACxF,aAAO;AAAA,QACL,aAAa,YAAa,MAAM,aAAa,EAAE,OAAO,KAAA,CAAM,KAAM,MAAM,IAAI;AAAA,MAAA;AAAA,IAEhF;AACA,UAAM,UAAU,OAAO,SAAS;AAChC,UAAM,QAAQ,OAAO;AACrB,QAAI,CAAC,MAAO,QAAO,OAAO,OAAO;AACjC,UAAM,QAAQ,SAAU,YAAY,QAAQ,gBAAgB,OAAO;AACnE,QAAI,CAAC,MAAO,QAAO,OAAO,OAAO;AACjC,WAAO,aAAa,aAAa,MAAM,MAAM,EAAE,OAAO,KAAA,CAAM,GAAG,KAAK,CAAC;AAAA,EACvE;AAEA,SAAO;AAAA,IACL;AAAA,IACA,WAAW,CAAC,aAAa;AACvB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM;AACX,kBAAU,OAAO,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,IACA,eAAe,MAAM;AAAA,EAAA;AAEzB;;;;;;"}

package/dist/auth/credential-source.d.ts

@@ -0,0 +1,68 @@
+import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';
+/**
+ * Renews a token-backed sign-in. `force: true` means the token just presented
+ * was refused, or has expired: the renewer must obtain a new one rather than
+ * return the one it holds. Resolves `null` when it cannot produce a token.
+ */
+export type AthenaTokenRenewer = (options: {
+    force: boolean;
+}) => Promise<string | null>;
+/** What the credential source reads, fresh, on every resolve. */
+export interface AthenaCredentialInputs {
+    /**
+     * The host's own getter (`config.getToken`). It owns renewal for its
+     * sign-in, so it always wins; the held `token` is its fallback when it
+     * resolves nothing.
+     */
+    hostGetToken?: AthenaStatewireTokenGetter;
+    /** The token currently held: the host's, the sign-in provider's or the host bridge's. */
+    token: string | null | undefined;
+    /** How that token renews (the sign-in provider or the host bridge); absent for a static token. */
+    renew?: AthenaTokenRenewer;
+}
+/**
+ * The single place every SDK network path gets the token it presents — the
+ * live thread connection, the session list's index and REST calls, uploads,
+ * search, voice and the collaborative-document mint — read right before it is
+ * presented.
+ */
+export interface AthenaCredentialSource {
+    /**
+     * The token to present now. `force` renews it first (the previous one was
+     * refused). A token that has expired, or expires within
+     * {@link TOKEN_EXPIRY_SKEW_MS}, is renewed before it is presented, so a tab
+     * waking from sleep never presents a dead token. Concurrent renewals share
+     * one in-flight request, and calls made while one is in flight wait for it
+     * instead of presenting the token it is replacing. A renewal never hands one
+     * account's token to a call made after the signed-in account changed.
+     */
+    getToken: (options?: {
+        force?: boolean;
+    }) => Promise<string | null>;
+    /** Called, with no arguments, whenever a different token becomes current. */
+    subscribe: (listener: () => void) => () => void;
+    /**
+     * How many times the identity behind the token has changed: its JWT
+     * subject, or the token itself when it is opaque. Renewals for the same
+     * identity leave it alone. Long-lived connections key on it, so they keep
+     * running across renewals and are rebuilt when someone else signs in,
+     * including under a host `getToken`, whose identity is only known once a
+     * token has been resolved. Subscribers hear when it moves.
+     */
+    identityEpoch: () => number;
+    /** Tell subscribers the held token changed (the provider calls this when its inputs do). */
+    notifyTokenChanged: () => void;
+}
+/** A token this close to its expiry is renewed before it is presented. */
+export declare const TOKEN_EXPIRY_SKEW_MS = 30000;
+/**
+ * The `exp` of a JWT, in milliseconds, or `null` for anything that is not a
+ * JWT with a numeric `exp`. Read without verification: it only decides whether
+ * to renew before presenting; the server still validates every token.
+ */
+export declare function jwtExpiresAtMs(token: string): number | null;
+/** The unverified `sub` of a JWT, or `null` for anything that is not a JWT with one. */
+export declare function jwtSubject(token: string): string | null;
+/** True for a JWT that has expired or expires within {@link TOKEN_EXPIRY_SKEW_MS}. */
+export declare function isTokenExpiring(token: string, now?: number): boolean;
+export declare function createAthenaCredentialSource(read: () => AthenaCredentialInputs): AthenaCredentialSource;

package/dist/auth/credential-source.js

@@ -0,0 +1,120 @@
+const TOKEN_EXPIRY_SKEW_MS = 3e4;
+function jwtExpiresAtMs(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+  try {
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    const exp = JSON.parse(atob(padded)).exp;
+    return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+function jwtSubject(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return null;
+  try {
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    const sub = JSON.parse(atob(padded)).sub;
+    return typeof sub === "string" && sub.length > 0 ? sub : null;
+  } catch {
+    return null;
+  }
+}
+function isTokenExpiring(token, now = Date.now()) {
+  const expiresAt = jwtExpiresAtMs(token);
+  return expiresAt !== null && expiresAt - now <= TOKEN_EXPIRY_SKEW_MS;
+}
+function createAthenaCredentialSource(read) {
+  const listeners = /* @__PURE__ */ new Set();
+  let renewal = null;
+  let lastResolved = null;
+  let identity = null;
+  let identityEpoch = 0;
+  const notifyListeners = () => {
+    for (const listener of [...listeners]) listener();
+  };
+  const observeIdentity = (token) => {
+    if (!token) return false;
+    const next = jwtSubject(token) ?? token;
+    if (next === identity) return false;
+    const changed = identity !== null;
+    identity = next;
+    if (changed) identityEpoch += 1;
+    return changed;
+  };
+  const notifyTokenChanged = () => {
+    observeIdentity(read().token);
+    notifyListeners();
+  };
+  const settle = (token) => {
+    const identityChanged = observeIdentity(token);
+    if (token !== null && token !== lastResolved) {
+      const replaced = lastResolved !== null;
+      lastResolved = token;
+      if (replaced || identityChanged) notifyListeners();
+    } else if (identityChanged) {
+      notifyListeners();
+    }
+    return token;
+  };
+  const shareRenewal = (start, byHost) => {
+    if (!renewal) {
+      const entry = {
+        token: start().finally(() => {
+          if (renewal === entry) renewal = null;
+        }),
+        byHost
+      };
+      renewal = entry;
+    }
+    return renewal;
+  };
+  const presentable = ({ byHost }, renewed) => {
+    const held = read().token ?? null;
+    if (byHost) return renewed ?? held;
+    if (!renewed || !held) return held;
+    const heldSubject = jwtSubject(held);
+    const renewedSubject = jwtSubject(renewed);
+    return heldSubject && renewedSubject && heldSubject !== renewedSubject ? held : renewed;
+  };
+  const awaitRenewal = async (shared) => settle(presentable(shared, await shared.token));
+  const getToken = async ({ force = false } = {}) => {
+    if (renewal) return awaitRenewal(renewal);
+    const inputs = read();
+    const hostGetToken = inputs.hostGetToken;
+    if (hostGetToken) {
+      if (!force) return settle(await hostGetToken({ force: false }) ?? read().token ?? null);
+      return awaitRenewal(
+        shareRenewal(async () => await hostGetToken({ force: true }) ?? null, true)
+      );
+    }
+    const current = inputs.token ?? null;
+    const renew = inputs.renew;
+    if (!renew) return settle(current);
+    const stale = force || current !== null && isTokenExpiring(current);
+    if (!stale) return settle(current);
+    return awaitRenewal(shareRenewal(() => renew({ force: true }), false));
+  };
+  return {
+    getToken,
+    subscribe: (listener) => {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    notifyTokenChanged,
+    identityEpoch: () => identityEpoch
+  };
+}
+export {
+  TOKEN_EXPIRY_SKEW_MS,
+  createAthenaCredentialSource,
+  isTokenExpiring,
+  jwtExpiresAtMs,
+  jwtSubject
+};
+//# sourceMappingURL=credential-source.js.map

package/dist/auth/credential-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-source.js","sources":["../../src/auth/credential-source.ts"],"sourcesContent":["import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\n\n/**\n * Renews a token-backed sign-in. `force: true` means the token just presented\n * was refused, or has expired: the renewer must obtain a new one rather than\n * return the one it holds. Resolves `null` when it cannot produce a token.\n */\nexport type AthenaTokenRenewer = (options: { force: boolean }) => Promise<string | null>;\n\n/** What the credential source reads, fresh, on every resolve. */\nexport interface AthenaCredentialInputs {\n  /**\n   * The host's own getter (`config.getToken`). It owns renewal for its\n   * sign-in, so it always wins; the held `token` is its fallback when it\n   * resolves nothing.\n   */\n  hostGetToken?: AthenaStatewireTokenGetter;\n  /** The token currently held: the host's, the sign-in provider's or the host bridge's. */\n  token: string | null | undefined;\n  /** How that token renews (the sign-in provider or the host bridge); absent for a static token. */\n  renew?: AthenaTokenRenewer;\n}\n\n/**\n * The single place every SDK network path gets the token it presents — the\n * live thread connection, the session list's index and REST calls, uploads,\n * search, voice and the collaborative-document mint — read right before it is\n * presented.\n */\nexport interface AthenaCredentialSource {\n  /**\n   * The token to present now. `force` renews it first (the previous one was\n   * refused). A token that has expired, or expires within\n   * {@link TOKEN_EXPIRY_SKEW_MS}, is renewed before it is presented, so a tab\n   * waking from sleep never presents a dead token. Concurrent renewals share\n   * one in-flight request, and calls made while one is in flight wait for it\n   * instead of presenting the token it is replacing. A renewal never hands one\n   * account's token to a call made after the signed-in account changed.\n   */\n  getToken: (options?: { force?: boolean }) => Promise<string | null>;\n  /** Called, with no arguments, whenever a different token becomes current. */\n  subscribe: (listener: () => void) => () => void;\n  /**\n   * How many times the identity behind the token has changed: its JWT\n   * subject, or the token itself when it is opaque. Renewals for the same\n   * identity leave it alone. Long-lived connections key on it, so they keep\n   * running across renewals and are rebuilt when someone else signs in,\n   * including under a host `getToken`, whose identity is only known once a\n   * token has been resolved. Subscribers hear when it moves.\n   */\n  identityEpoch: () => number;\n  /** Tell subscribers the held token changed (the provider calls this when its inputs do). */\n  notifyTokenChanged: () => void;\n}\n\n/** A token this close to its expiry is renewed before it is presented. */\nexport const TOKEN_EXPIRY_SKEW_MS = 30_000;\n\n/**\n * The `exp` of a JWT, in milliseconds, or `null` for anything that is not a\n * JWT with a numeric `exp`. Read without verification: it only decides whether\n * to renew before presenting; the server still validates every token.\n */\nexport function jwtExpiresAtMs(token: string): number | null {\n  const payload = token.split('.')[1];\n  if (!payload) return null;\n  try {\n    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n    const exp: unknown = (JSON.parse(atob(padded)) as { exp?: unknown }).exp;\n    return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;\n  } catch {\n    return null;\n  }\n}\n\n/** The unverified `sub` of a JWT, or `null` for anything that is not a JWT with one. */\nexport function jwtSubject(token: string): string | null {\n  const payload = token.split('.')[1];\n  if (!payload) return null;\n  try {\n    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');\n    const sub: unknown = (JSON.parse(atob(padded)) as { sub?: unknown }).sub;\n    return typeof sub === 'string' && sub.length > 0 ? sub : null;\n  } catch {\n    return null;\n  }\n}\n\n/** True for a JWT that has expired or expires within {@link TOKEN_EXPIRY_SKEW_MS}. */\nexport function isTokenExpiring(token: string, now: number = Date.now()): boolean {\n  const expiresAt = jwtExpiresAtMs(token);\n  return expiresAt !== null && expiresAt - now <= TOKEN_EXPIRY_SKEW_MS;\n}\n\nexport function createAthenaCredentialSource(\n  read: () => AthenaCredentialInputs,\n): AthenaCredentialSource {\n  const listeners = new Set<() => void>();\n  // The renewal in flight, and whether the host's getter runs it (the host\n  // owns identity for its getter) or the sign-in provider's / bridge's renewer.\n  let renewal: { token: Promise<string | null>; byHost: boolean } | null = null;\n  let lastResolved: string | null = null;\n  let identity: string | null = null;\n  let identityEpoch = 0;\n\n  const notifyListeners = () => {\n    for (const listener of [...listeners]) listener();\n  };\n\n  /** Note who a token acts as; true when that is someone other than before. */\n  const observeIdentity = (token: string | null | undefined): boolean => {\n    if (!token) return false;\n    const next = jwtSubject(token) ?? token;\n    if (next === identity) return false;\n    const changed = identity !== null;\n    identity = next;\n    if (changed) identityEpoch += 1;\n    return changed;\n  };\n\n  const notifyTokenChanged = () => {\n    observeIdentity(read().token);\n    notifyListeners();\n  };\n\n  /** Record what a resolve produced; a different token than the last one is news. */\n  const settle = (token: string | null): string | null => {\n    const identityChanged = observeIdentity(token);\n    if (token !== null && token !== lastResolved) {\n      const replaced = lastResolved !== null;\n      lastResolved = token;\n      if (replaced || identityChanged) notifyListeners();\n    } else if (identityChanged) {\n      notifyListeners();\n    }\n    return token;\n  };\n\n  const shareRenewal = (\n    start: () => Promise<string | null>,\n    byHost: boolean,\n  ): { token: Promise<string | null>; byHost: boolean } => {\n    if (!renewal) {\n      const entry = {\n        token: start().finally(() => {\n          if (renewal === entry) renewal = null;\n        }),\n        byHost,\n      };\n      renewal = entry;\n    }\n    return renewal;\n  };\n\n  /**\n   * What a finished renewal hands one caller. A host getter's token is\n   * presented as is: the host owns identity for its getter. A sign-in\n   * provider's or bridge's renewed token is presented only while it acts as\n   * the account the provider holds now. When the account changed while the\n   * renewal was in flight (its JWT subject differs from the held token's, or\n   * the provider holds no token any more), the held token, the current\n   * account's, is presented instead. A renewal that produced nothing keeps\n   * the held token: the caller presents it and the host's refusal ends the\n   * attempt.\n   */\n  const presentable = (\n    { byHost }: { byHost: boolean },\n    renewed: string | null,\n  ): string | null => {\n    const held = read().token ?? null;\n    if (byHost) return renewed ?? held;\n    if (!renewed || !held) return held;\n    const heldSubject = jwtSubject(held);\n    const renewedSubject = jwtSubject(renewed);\n    return heldSubject && renewedSubject && heldSubject !== renewedSubject ? held : renewed;\n  };\n\n  const awaitRenewal = async (shared: {\n    token: Promise<string | null>;\n    byHost: boolean;\n  }): Promise<string | null> => settle(presentable(shared, await shared.token));\n\n  const getToken = async ({ force = false }: { force?: boolean } = {}): Promise<string | null> => {\n    if (renewal) return awaitRenewal(renewal);\n    const inputs = read();\n    const hostGetToken = inputs.hostGetToken;\n    if (hostGetToken) {\n      if (!force) return settle((await hostGetToken({ force: false })) ?? read().token ?? null);\n      return awaitRenewal(\n        shareRenewal(async () => (await hostGetToken({ force: true })) ?? null, true),\n      );\n    }\n    const current = inputs.token ?? null;\n    const renew = inputs.renew;\n    if (!renew) return settle(current);\n    const stale = force || (current !== null && isTokenExpiring(current));\n    if (!stale) return settle(current);\n    return awaitRenewal(shareRenewal(() => renew({ force: true }), false));\n  };\n\n  return {\n    getToken,\n    subscribe: (listener) => {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    notifyTokenChanged,\n    identityEpoch: () => identityEpoch,\n  };\n}\n"],"names":[],"mappings":"AAwDO,MAAM,uBAAuB;AAO7B,SAAS,eAAe,OAA8B;AAC3D,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,UAAM,SAAS,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG;AAClE,UAAM,MAAgB,KAAK,MAAM,KAAK,MAAM,CAAC,EAAwB;AACrE,WAAO,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,IAAI,MAAM,MAAO;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,WAAW,OAA8B;AACvD,QAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,UAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,UAAM,SAAS,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG;AAClE,UAAM,MAAgB,KAAK,MAAM,KAAK,MAAM,CAAC,EAAwB;AACrE,WAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAAA,EAC3D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAAe,MAAc,KAAK,OAAgB;AAChF,QAAM,YAAY,eAAe,KAAK;AACtC,SAAO,cAAc,QAAQ,YAAY,OAAO;AAClD;AAEO,SAAS,6BACd,MACwB;AACxB,QAAM,gCAAgB,IAAA;AAGtB,MAAI,UAAqE;AACzE,MAAI,eAA8B;AAClC,MAAI,WAA0B;AAC9B,MAAI,gBAAgB;AAEpB,QAAM,kBAAkB,MAAM;AAC5B,eAAW,YAAY,CAAC,GAAG,SAAS,EAAG,UAAA;AAAA,EACzC;AAGA,QAAM,kBAAkB,CAAC,UAA8C;AACrE,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,OAAO,WAAW,KAAK,KAAK;AAClC,QAAI,SAAS,SAAU,QAAO;AAC9B,UAAM,UAAU,aAAa;AAC7B,eAAW;AACX,QAAI,QAAS,kBAAiB;AAC9B,WAAO;AAAA,EACT;AAEA,QAAM,qBAAqB,MAAM;AAC/B,oBAAgB,KAAA,EAAO,KAAK;AAC5B,oBAAA;AAAA,EACF;AAGA,QAAM,SAAS,CAAC,UAAwC;AACtD,UAAM,kBAAkB,gBAAgB,KAAK;AAC7C,QAAI,UAAU,QAAQ,UAAU,cAAc;AAC5C,YAAM,WAAW,iBAAiB;AAClC,qBAAe;AACf,UAAI,YAAY,gBAAiB,iBAAA;AAAA,IACnC,WAAW,iBAAiB;AAC1B,sBAAA;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,CACnB,OACA,WACuD;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,QAAQ;AAAA,QACZ,OAAO,QAAQ,QAAQ,MAAM;AAC3B,cAAI,YAAY,MAAO,WAAU;AAAA,QACnC,CAAC;AAAA,QACD;AAAA,MAAA;AAEF,gBAAU;AAAA,IACZ;AACA,WAAO;AAAA,EACT;AAaA,QAAM,cAAc,CAClB,EAAE,OAAA,GACF,YACkB;AAClB,UAAM,OAAO,OAAO,SAAS;AAC7B,QAAI,eAAe,WAAW;AAC9B,QAAI,CAAC,WAAW,CAAC,KAAM,QAAO;AAC9B,UAAM,cAAc,WAAW,IAAI;AACnC,UAAM,iBAAiB,WAAW,OAAO;AACzC,WAAO,eAAe,kBAAkB,gBAAgB,iBAAiB,OAAO;AAAA,EAClF;AAEA,QAAM,eAAe,OAAO,WAGE,OAAO,YAAY,QAAQ,MAAM,OAAO,KAAK,CAAC;AAE5E,QAAM,WAAW,OAAO,EAAE,QAAQ,MAAA,IAA+B,CAAA,MAA+B;AAC9F,QAAI,QAAS,QAAO,aAAa,OAAO;AACxC,UAAM,SAAS,KAAA;AACf,UAAM,eAAe,OAAO;AAC5B,QAAI,cAAc;AAChB,UAAI,CAAC,MAAO,QAAO,OAAQ,MAAM,aAAa,EAAE,OAAO,MAAA,CAAO,KAAM,OAAO,SAAS,IAAI;AACxF,aAAO;AAAA,QACL,aAAa,YAAa,MAAM,aAAa,EAAE,OAAO,KAAA,CAAM,KAAM,MAAM,IAAI;AAAA,MAAA;AAAA,IAEhF;AACA,UAAM,UAAU,OAAO,SAAS;AAChC,UAAM,QAAQ,OAAO;AACrB,QAAI,CAAC,MAAO,QAAO,OAAO,OAAO;AACjC,UAAM,QAAQ,SAAU,YAAY,QAAQ,gBAAgB,OAAO;AACnE,QAAI,CAAC,MAAO,QAAO,OAAO,OAAO;AACjC,WAAO,aAAa,aAAa,MAAM,MAAM,EAAE,OAAO,KAAA,CAAM,GAAG,KAAK,CAAC;AAAA,EACvE;AAEA,SAAO;AAAA,IACL;AAAA,IACA,WAAW,CAAC,aAAa;AACvB,gBAAU,IAAI,QAAQ;AACtB,aAAO,MAAM;AACX,kBAAU,OAAO,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,IACA,eAAe,MAAM;AAAA,EAAA;AAEzB;"}

package/dist/auth/types.d.ts

@@ -1,3 +1,4 @@
+import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';
 /**
  * Athena user information — a simplified, PropelAuth-agnostic representation.
  */
@@ -63,4 +64,12 @@ export interface AthenaAuthState {
     orgs: AthenaOrg[];
     /** Log the user out. Redirects to the login page by default. */
     logout: (redirectOnLogout?: boolean) => Promise<void>;
+    /**
+     * Resolve a current access token, renewing it when it is about to expire.
+     * `{ force: true }` means the previous token was refused: renew it first.
+     * `AthenaAuthProvider` and `AthenaSSOProvider` supply it, and
+     * `AthenaProvider` uses it for every request and reconnect. A custom
+     * provider may omit it; `accessToken` is then used as it is.
+     */
+    getToken?: AthenaStatewireTokenGetter;
 }

package/dist/chat/AthenaChat.cjs

@@ -151,6 +151,14 @@ const AthenaChat = ({
       credentials: "include",
       get accessToken() {
         return athenaConfig.token ?? void 0;
+      },
+      getAccessToken: async () => {
+        var _a2;
+        return await ((_a2 = athenaConfig.getToken) == null ? void 0 : _a2.call(athenaConfig)) ?? void 0;
+      },
+      renewAccessToken: async () => {
+        var _a2;
+        return await ((_a2 = athenaConfig.getToken) == null ? void 0 : _a2.call(athenaConfig, { force: true })) ?? void 0;
       }
     }),
     [athenaConfig]