@athenaintel/react 0.24.1 → 0.26.0

package/dist/collab/presence-mint.cjs

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const credentialRenewal = require("../runtime/credential-renewal.cjs");
 const mint = require("./mint.cjs");
 function workspaceUrl({
   auth,
@@ -10,17 +11,17 @@ function workspaceUrl({
   return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;
 }
 async function mintWorkspacePresenceToken(args) {
-  const response = await fetch(
-    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence-token" }),
-    {
+  const response = await credentialRenewal.sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence-token" }), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...mint.getCollabAuthHeaders(args.auth)
+        ...headers
       },
       body: JSON.stringify({}),
       signal: args.signal
-    }
+    })
   );
   if (!response.ok) {
     throw await mint.collabErrorFromResponse(
@@ -34,17 +35,20 @@ function arrayOrEmpty(value) {
   return Array.isArray(value) ? value : [];
 }
 async function resolveWorkspacePresence(args) {
-  const response = await fetch(
-    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence/resolve" }),
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...mint.getCollabAuthHeaders(args.auth)
-      },
-      body: JSON.stringify(args.request),
-      signal: args.signal
-    }
+  const response = await credentialRenewal.sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(
+      workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence/resolve" }),
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...headers
+        },
+        body: JSON.stringify(args.request),
+        signal: args.signal
+      }
+    )
   );
   if (!response.ok) {
     throw await mint.collabErrorFromResponse(

package/dist/collab/presence-mint.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"presence-mint.cjs","sources":["../../src/collab/presence-mint.ts"],"sourcesContent":["/**\n * Public-API clients for the workspace presence feed.\n *\n * Two endpoints, both admin-only and both under the workspace:\n *\n * - `POST /api/v0/workspaces/{workspaceId}/presence-token` mints a\n *   **read-only** Keryx token for the workspace awareness room\n *   (`<workspaceId>/awareness`) — the same per-recipient-filtered presence\n *   feed the Olympus People page renders. The holder can receive presence and\n *   broadcast nothing; `connectWorkspacePresence` re-mints before expiry.\n * - `POST /api/v0/workspaces/{workspaceId}/presence/resolve` turns the opaque\n *   ids carried in awareness contexts (asset ids, session thread ids, project\n *   ids) into titles the caller may see. Only things the caller may open come\n *   back; missing ids are simply absent.\n *\n * Wire shapes are snake_case, matching `CollabTokenResponse`.\n */\n\nimport {\n  type CollabAuth,\n  CollabTokenError,\n  collabErrorFromResponse,\n  getAthenaApiBaseUrl,\n  getCollabAuthHeaders,\n} from './mint';\n\n/** Grant for the workspace awareness room. Always read-only (`access_type: 'r'`). */\nexport interface WorkspacePresenceTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport interface WorkspacePresenceResolveRequest {\n  asset_ids?: string[];\n  /** Thread ids, as published in `session` awareness contexts. */\n  session_ids?: string[];\n  project_ids?: string[];\n  include_projects?: boolean;\n  include_members?: boolean;\n}\n\nexport interface WorkspacePresenceResolvedAsset {\n  id: string;\n  title: string;\n  asset_type: string;\n}\n\nexport interface WorkspacePresenceResolvedSession {\n  thread_id: string;\n  asset_id: string;\n  title: string;\n}\n\nexport interface WorkspacePresenceResolvedProject {\n  id: string;\n  title: string;\n  assets: WorkspacePresenceResolvedAsset[];\n}\n\nexport interface WorkspacePresenceResolvedMember {\n  id: string;\n  name: string;\n  email: string;\n  avatar_url: string | null;\n}\n\nexport interface WorkspacePresenceResolveResponse {\n  assets: WorkspacePresenceResolvedAsset[];\n  sessions: WorkspacePresenceResolvedSession[];\n  projects: WorkspacePresenceResolvedProject[];\n  members: WorkspacePresenceResolvedMember[];\n}\n\nfunction workspaceUrl({\n  auth,\n  workspaceId,\n  path,\n}: {\n  auth: CollabAuth;\n  workspaceId: string;\n  path: string;\n}): string {\n  const base = getAthenaApiBaseUrl(auth.backendUrl);\n  return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;\n}\n\n/**\n * Mint a read-only token for the workspace awareness room.\n *\n * Rejects with `CollabTokenError` on 401 (bad credential) and 403 (admin\n * required, roster not enabled for this workspace, or a sandbox credential\n * that may not read presence), carrying the server's `detail`.\n */\nexport async function mintWorkspacePresenceToken(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceTokenResponse> {\n  const response = await fetch(\n    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence-token' }),\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify({}),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as WorkspacePresenceTokenResponse;\n}\n\nfunction arrayOrEmpty<T>(value: T[] | undefined | null): T[] {\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Resolve awareness ids to titles. Every section of the response is always\n * present on the returned object (an omitted section reads as empty), so\n * callers can index without guarding. Failures reject with `CollabTokenError`\n * — the same status + detail shape as the mint.\n */\nexport async function resolveWorkspacePresence(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  request: WorkspacePresenceResolveRequest;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceResolveResponse> {\n  const response = await fetch(\n    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence/resolve' }),\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify(args.request),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence resolve failed with status ${response.status}`\n    );\n  }\n  const body = (await response.json()) as Partial<WorkspacePresenceResolveResponse> | null;\n  if (!body || typeof body !== 'object') {\n    throw new CollabTokenError(response.status, 'Workspace presence resolve returned no body');\n  }\n  return {\n    assets: arrayOrEmpty(body.assets),\n    sessions: arrayOrEmpty(body.sessions),\n    projects: arrayOrEmpty(body.projects),\n    members: arrayOrEmpty(body.members),\n  };\n}\n"],"names":["getAthenaApiBaseUrl","getCollabAuthHeaders","collabErrorFromResponse","CollabTokenError"],"mappings":";;;AA8EA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,QAAM,OAAOA,KAAAA,oBAAoB,KAAK,UAAU;AAChD,SAAO,GAAG,IAAI,sBAAsB,mBAAmB,WAAW,CAAC,IAAI,IAAI;AAC7E;AASA,eAAsB,2BAA2B,MAIL;AAC1C,QAAM,WAAW,MAAM;AAAA,IACrB,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,kBAAkB;AAAA,IACvF;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAGC,KAAAA,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,EAAE;AAAA,MACvB,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAMC,KAAAA;AAAAA,MACV;AAAA,MACA,oDAAoD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEvE;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;AAEA,SAAS,aAAgB,OAAoC;AAC3D,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA;AACxC;AAQA,eAAsB,yBAAyB,MAKD;AAC5C,QAAM,WAAW,MAAM;AAAA,IACrB,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,oBAAoB;AAAA,IACzF;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAGD,KAAAA,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,MACjC,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAMC,KAAAA;AAAAA,MACV;AAAA,MACA,iDAAiD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEpE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAA;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAIC,KAAAA,iBAAiB,SAAS,QAAQ,6CAA6C;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,SAAS,aAAa,KAAK,OAAO;AAAA,EAAA;AAEtC;;;"}
+{"version":3,"file":"presence-mint.cjs","sources":["../../src/collab/presence-mint.ts"],"sourcesContent":["/**\n * Public-API clients for the workspace presence feed.\n *\n * Two endpoints, both admin-only and both under the workspace:\n *\n * - `POST /api/v0/workspaces/{workspaceId}/presence-token` mints a\n *   **read-only** Keryx token for the workspace awareness room\n *   (`<workspaceId>/awareness`) — the same per-recipient-filtered presence\n *   feed the Olympus People page renders. The holder can receive presence and\n *   broadcast nothing; `connectWorkspacePresence` re-mints before expiry.\n * - `POST /api/v0/workspaces/{workspaceId}/presence/resolve` turns the opaque\n *   ids carried in awareness contexts (asset ids, session thread ids, project\n *   ids) into titles the caller may see. Only things the caller may open come\n *   back; missing ids are simply absent.\n *\n * Wire shapes are snake_case, matching `CollabTokenResponse`.\n */\n\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport {\n  type CollabAuth,\n  CollabTokenError,\n  collabErrorFromResponse,\n  getAthenaApiBaseUrl,\n} from './mint';\n\n/** Grant for the workspace awareness room. Always read-only (`access_type: 'r'`). */\nexport interface WorkspacePresenceTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport interface WorkspacePresenceResolveRequest {\n  asset_ids?: string[];\n  /** Thread ids, as published in `session` awareness contexts. */\n  session_ids?: string[];\n  project_ids?: string[];\n  include_projects?: boolean;\n  include_members?: boolean;\n}\n\nexport interface WorkspacePresenceResolvedAsset {\n  id: string;\n  title: string;\n  asset_type: string;\n}\n\nexport interface WorkspacePresenceResolvedSession {\n  thread_id: string;\n  asset_id: string;\n  title: string;\n}\n\nexport interface WorkspacePresenceResolvedProject {\n  id: string;\n  title: string;\n  assets: WorkspacePresenceResolvedAsset[];\n}\n\nexport interface WorkspacePresenceResolvedMember {\n  id: string;\n  name: string;\n  email: string;\n  avatar_url: string | null;\n}\n\nexport interface WorkspacePresenceResolveResponse {\n  assets: WorkspacePresenceResolvedAsset[];\n  sessions: WorkspacePresenceResolvedSession[];\n  projects: WorkspacePresenceResolvedProject[];\n  members: WorkspacePresenceResolvedMember[];\n}\n\nfunction workspaceUrl({\n  auth,\n  workspaceId,\n  path,\n}: {\n  auth: CollabAuth;\n  workspaceId: string;\n  path: string;\n}): string {\n  const base = getAthenaApiBaseUrl(auth.backendUrl);\n  return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;\n}\n\n/**\n * Mint a read-only token for the workspace awareness room.\n *\n * Rejects with `CollabTokenError` on 401 (bad credential) and 403 (admin\n * required, roster not enabled for this workspace, or a sandbox credential\n * that may not read presence), carrying the server's `detail`.\n */\nexport async function mintWorkspacePresenceToken(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceTokenResponse> {\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence-token' }), {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n      body: JSON.stringify({}),\n      signal: args.signal,\n    })\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as WorkspacePresenceTokenResponse;\n}\n\nfunction arrayOrEmpty<T>(value: T[] | undefined | null): T[] {\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Resolve awareness ids to titles. Every section of the response is always\n * present on the returned object (an omitted section reads as empty), so\n * callers can index without guarding. Failures reject with `CollabTokenError`\n * — the same status + detail shape as the mint.\n */\nexport async function resolveWorkspacePresence(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  request: WorkspacePresenceResolveRequest;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceResolveResponse> {\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(\n      workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence/resolve' }),\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: JSON.stringify(args.request),\n        signal: args.signal,\n      }\n    )\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence resolve failed with status ${response.status}`\n    );\n  }\n  const body = (await response.json()) as Partial<WorkspacePresenceResolveResponse> | null;\n  if (!body || typeof body !== 'object') {\n    throw new CollabTokenError(response.status, 'Workspace presence resolve returned no body');\n  }\n  return {\n    assets: arrayOrEmpty(body.assets),\n    sessions: arrayOrEmpty(body.sessions),\n    projects: arrayOrEmpty(body.projects),\n    members: arrayOrEmpty(body.members),\n  };\n}\n"],"names":["getAthenaApiBaseUrl","sendWithCredentialRenewal","collabErrorFromResponse","CollabTokenError"],"mappings":";;;;AA8EA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,QAAM,OAAOA,KAAAA,oBAAoB,KAAK,UAAU;AAChD,SAAO,GAAG,IAAI,sBAAsB,mBAAmB,WAAW,CAAC,IAAI,IAAI;AAC7E;AASA,eAAsB,2BAA2B,MAIL;AAC1C,QAAM,WAAW,MAAMC,kBAAAA;AAAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D,MAAM,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,iBAAA,CAAkB,GAAG;AAAA,MAC9F,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MAAA;AAAA,MAEL,MAAM,KAAK,UAAU,EAAE;AAAA,MACvB,QAAQ,KAAK;AAAA,IAAA,CACd;AAAA,EAAA;AAEH,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAMC,KAAAA;AAAAA,MACV;AAAA,MACA,oDAAoD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEvE;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;AAEA,SAAS,aAAgB,OAAoC;AAC3D,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA;AACxC;AAQA,eAAsB,yBAAyB,MAKD;AAC5C,QAAM,WAAW,MAAMD,kBAAAA;AAAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D;AAAA,MACE,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,oBAAoB;AAAA,MACzF;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAG;AAAA,QAAA;AAAA,QAEL,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,QACjC,QAAQ,KAAK;AAAA,MAAA;AAAA,IACf;AAAA,EACF;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAMC,KAAAA;AAAAA,MACV;AAAA,MACA,iDAAiD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEpE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAA;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAIC,KAAAA,iBAAiB,SAAS,QAAQ,6CAA6C;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,SAAS,aAAa,KAAK,OAAO;AAAA,EAAA;AAEtC;;;"}

package/dist/collab/presence-mint.js

@@ -1,4 +1,5 @@
-import { getCollabAuthHeaders, collabErrorFromResponse, CollabTokenError, getAthenaApiBaseUrl } from "./mint.js";
+import { sendWithCredentialRenewal } from "../runtime/credential-renewal.js";
+import { collabErrorFromResponse, CollabTokenError, getAthenaApiBaseUrl } from "./mint.js";
 function workspaceUrl({
   auth,
   workspaceId,
@@ -8,17 +9,17 @@ function workspaceUrl({
   return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;
 }
 async function mintWorkspacePresenceToken(args) {
-  const response = await fetch(
-    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence-token" }),
-    {
+  const response = await sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence-token" }), {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        ...getCollabAuthHeaders(args.auth)
+        ...headers
       },
       body: JSON.stringify({}),
       signal: args.signal
-    }
+    })
   );
   if (!response.ok) {
     throw await collabErrorFromResponse(
@@ -32,17 +33,20 @@ function arrayOrEmpty(value) {
   return Array.isArray(value) ? value : [];
 }
 async function resolveWorkspacePresence(args) {
-  const response = await fetch(
-    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence/resolve" }),
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...getCollabAuthHeaders(args.auth)
-      },
-      body: JSON.stringify(args.request),
-      signal: args.signal
-    }
+  const response = await sendWithCredentialRenewal(
+    args.auth,
+    (headers) => fetch(
+      workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: "presence/resolve" }),
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...headers
+        },
+        body: JSON.stringify(args.request),
+        signal: args.signal
+      }
+    )
   );
   if (!response.ok) {
     throw await collabErrorFromResponse(

package/dist/collab/presence-mint.js.map

@@ -1 +1 @@
-{"version":3,"file":"presence-mint.js","sources":["../../src/collab/presence-mint.ts"],"sourcesContent":["/**\n * Public-API clients for the workspace presence feed.\n *\n * Two endpoints, both admin-only and both under the workspace:\n *\n * - `POST /api/v0/workspaces/{workspaceId}/presence-token` mints a\n *   **read-only** Keryx token for the workspace awareness room\n *   (`<workspaceId>/awareness`) — the same per-recipient-filtered presence\n *   feed the Olympus People page renders. The holder can receive presence and\n *   broadcast nothing; `connectWorkspacePresence` re-mints before expiry.\n * - `POST /api/v0/workspaces/{workspaceId}/presence/resolve` turns the opaque\n *   ids carried in awareness contexts (asset ids, session thread ids, project\n *   ids) into titles the caller may see. Only things the caller may open come\n *   back; missing ids are simply absent.\n *\n * Wire shapes are snake_case, matching `CollabTokenResponse`.\n */\n\nimport {\n  type CollabAuth,\n  CollabTokenError,\n  collabErrorFromResponse,\n  getAthenaApiBaseUrl,\n  getCollabAuthHeaders,\n} from './mint';\n\n/** Grant for the workspace awareness room. Always read-only (`access_type: 'r'`). */\nexport interface WorkspacePresenceTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport interface WorkspacePresenceResolveRequest {\n  asset_ids?: string[];\n  /** Thread ids, as published in `session` awareness contexts. */\n  session_ids?: string[];\n  project_ids?: string[];\n  include_projects?: boolean;\n  include_members?: boolean;\n}\n\nexport interface WorkspacePresenceResolvedAsset {\n  id: string;\n  title: string;\n  asset_type: string;\n}\n\nexport interface WorkspacePresenceResolvedSession {\n  thread_id: string;\n  asset_id: string;\n  title: string;\n}\n\nexport interface WorkspacePresenceResolvedProject {\n  id: string;\n  title: string;\n  assets: WorkspacePresenceResolvedAsset[];\n}\n\nexport interface WorkspacePresenceResolvedMember {\n  id: string;\n  name: string;\n  email: string;\n  avatar_url: string | null;\n}\n\nexport interface WorkspacePresenceResolveResponse {\n  assets: WorkspacePresenceResolvedAsset[];\n  sessions: WorkspacePresenceResolvedSession[];\n  projects: WorkspacePresenceResolvedProject[];\n  members: WorkspacePresenceResolvedMember[];\n}\n\nfunction workspaceUrl({\n  auth,\n  workspaceId,\n  path,\n}: {\n  auth: CollabAuth;\n  workspaceId: string;\n  path: string;\n}): string {\n  const base = getAthenaApiBaseUrl(auth.backendUrl);\n  return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;\n}\n\n/**\n * Mint a read-only token for the workspace awareness room.\n *\n * Rejects with `CollabTokenError` on 401 (bad credential) and 403 (admin\n * required, roster not enabled for this workspace, or a sandbox credential\n * that may not read presence), carrying the server's `detail`.\n */\nexport async function mintWorkspacePresenceToken(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceTokenResponse> {\n  const response = await fetch(\n    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence-token' }),\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify({}),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as WorkspacePresenceTokenResponse;\n}\n\nfunction arrayOrEmpty<T>(value: T[] | undefined | null): T[] {\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Resolve awareness ids to titles. Every section of the response is always\n * present on the returned object (an omitted section reads as empty), so\n * callers can index without guarding. Failures reject with `CollabTokenError`\n * — the same status + detail shape as the mint.\n */\nexport async function resolveWorkspacePresence(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  request: WorkspacePresenceResolveRequest;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceResolveResponse> {\n  const response = await fetch(\n    workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence/resolve' }),\n    {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...getCollabAuthHeaders(args.auth),\n      },\n      body: JSON.stringify(args.request),\n      signal: args.signal,\n    }\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence resolve failed with status ${response.status}`\n    );\n  }\n  const body = (await response.json()) as Partial<WorkspacePresenceResolveResponse> | null;\n  if (!body || typeof body !== 'object') {\n    throw new CollabTokenError(response.status, 'Workspace presence resolve returned no body');\n  }\n  return {\n    assets: arrayOrEmpty(body.assets),\n    sessions: arrayOrEmpty(body.sessions),\n    projects: arrayOrEmpty(body.projects),\n    members: arrayOrEmpty(body.members),\n  };\n}\n"],"names":[],"mappings":";AA8EA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,QAAM,OAAO,oBAAoB,KAAK,UAAU;AAChD,SAAO,GAAG,IAAI,sBAAsB,mBAAmB,WAAW,CAAC,IAAI,IAAI;AAC7E;AASA,eAAsB,2BAA2B,MAIL;AAC1C,QAAM,WAAW,MAAM;AAAA,IACrB,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,kBAAkB;AAAA,IACvF;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,EAAE;AAAA,MACvB,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,oDAAoD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEvE;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;AAEA,SAAS,aAAgB,OAAoC;AAC3D,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA;AACxC;AAQA,eAAsB,yBAAyB,MAKD;AAC5C,QAAM,WAAW,MAAM;AAAA,IACrB,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,oBAAoB;AAAA,IACzF;AAAA,MACE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG,qBAAqB,KAAK,IAAI;AAAA,MAAA;AAAA,MAEnC,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,MACjC,QAAQ,KAAK;AAAA,IAAA;AAAA,EACf;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,iDAAiD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEpE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAA;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAI,iBAAiB,SAAS,QAAQ,6CAA6C;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,SAAS,aAAa,KAAK,OAAO;AAAA,EAAA;AAEtC;"}
+{"version":3,"file":"presence-mint.js","sources":["../../src/collab/presence-mint.ts"],"sourcesContent":["/**\n * Public-API clients for the workspace presence feed.\n *\n * Two endpoints, both admin-only and both under the workspace:\n *\n * - `POST /api/v0/workspaces/{workspaceId}/presence-token` mints a\n *   **read-only** Keryx token for the workspace awareness room\n *   (`<workspaceId>/awareness`) — the same per-recipient-filtered presence\n *   feed the Olympus People page renders. The holder can receive presence and\n *   broadcast nothing; `connectWorkspacePresence` re-mints before expiry.\n * - `POST /api/v0/workspaces/{workspaceId}/presence/resolve` turns the opaque\n *   ids carried in awareness contexts (asset ids, session thread ids, project\n *   ids) into titles the caller may see. Only things the caller may open come\n *   back; missing ids are simply absent.\n *\n * Wire shapes are snake_case, matching `CollabTokenResponse`.\n */\n\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport {\n  type CollabAuth,\n  CollabTokenError,\n  collabErrorFromResponse,\n  getAthenaApiBaseUrl,\n} from './mint';\n\n/** Grant for the workspace awareness room. Always read-only (`access_type: 'r'`). */\nexport interface WorkspacePresenceTokenResponse {\n  token: string;\n  access_type: 'r' | 'rw';\n  expires_at_ms: number;\n  ws_url: string;\n  org: string;\n  doc_id: string;\n  branch: string;\n}\n\nexport interface WorkspacePresenceResolveRequest {\n  asset_ids?: string[];\n  /** Thread ids, as published in `session` awareness contexts. */\n  session_ids?: string[];\n  project_ids?: string[];\n  include_projects?: boolean;\n  include_members?: boolean;\n}\n\nexport interface WorkspacePresenceResolvedAsset {\n  id: string;\n  title: string;\n  asset_type: string;\n}\n\nexport interface WorkspacePresenceResolvedSession {\n  thread_id: string;\n  asset_id: string;\n  title: string;\n}\n\nexport interface WorkspacePresenceResolvedProject {\n  id: string;\n  title: string;\n  assets: WorkspacePresenceResolvedAsset[];\n}\n\nexport interface WorkspacePresenceResolvedMember {\n  id: string;\n  name: string;\n  email: string;\n  avatar_url: string | null;\n}\n\nexport interface WorkspacePresenceResolveResponse {\n  assets: WorkspacePresenceResolvedAsset[];\n  sessions: WorkspacePresenceResolvedSession[];\n  projects: WorkspacePresenceResolvedProject[];\n  members: WorkspacePresenceResolvedMember[];\n}\n\nfunction workspaceUrl({\n  auth,\n  workspaceId,\n  path,\n}: {\n  auth: CollabAuth;\n  workspaceId: string;\n  path: string;\n}): string {\n  const base = getAthenaApiBaseUrl(auth.backendUrl);\n  return `${base}/api/v0/workspaces/${encodeURIComponent(workspaceId)}/${path}`;\n}\n\n/**\n * Mint a read-only token for the workspace awareness room.\n *\n * Rejects with `CollabTokenError` on 401 (bad credential) and 403 (admin\n * required, roster not enabled for this workspace, or a sandbox credential\n * that may not read presence), carrying the server's `detail`.\n */\nexport async function mintWorkspacePresenceToken(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceTokenResponse> {\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence-token' }), {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/json',\n        ...headers,\n      },\n      body: JSON.stringify({}),\n      signal: args.signal,\n    })\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence token mint failed with status ${response.status}`\n    );\n  }\n  return (await response.json()) as WorkspacePresenceTokenResponse;\n}\n\nfunction arrayOrEmpty<T>(value: T[] | undefined | null): T[] {\n  return Array.isArray(value) ? value : [];\n}\n\n/**\n * Resolve awareness ids to titles. Every section of the response is always\n * present on the returned object (an omitted section reads as empty), so\n * callers can index without guarding. Failures reject with `CollabTokenError`\n * — the same status + detail shape as the mint.\n */\nexport async function resolveWorkspacePresence(args: {\n  auth: CollabAuth;\n  workspaceId: string;\n  request: WorkspacePresenceResolveRequest;\n  signal?: AbortSignal;\n}): Promise<WorkspacePresenceResolveResponse> {\n  const response = await sendWithCredentialRenewal(args.auth, (headers) =>\n    fetch(\n      workspaceUrl({ auth: args.auth, workspaceId: args.workspaceId, path: 'presence/resolve' }),\n      {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: JSON.stringify(args.request),\n        signal: args.signal,\n      }\n    )\n  );\n  if (!response.ok) {\n    throw await collabErrorFromResponse(\n      response,\n      `Workspace presence resolve failed with status ${response.status}`\n    );\n  }\n  const body = (await response.json()) as Partial<WorkspacePresenceResolveResponse> | null;\n  if (!body || typeof body !== 'object') {\n    throw new CollabTokenError(response.status, 'Workspace presence resolve returned no body');\n  }\n  return {\n    assets: arrayOrEmpty(body.assets),\n    sessions: arrayOrEmpty(body.sessions),\n    projects: arrayOrEmpty(body.projects),\n    members: arrayOrEmpty(body.members),\n  };\n}\n"],"names":[],"mappings":";;AA8EA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,QAAM,OAAO,oBAAoB,KAAK,UAAU;AAChD,SAAO,GAAG,IAAI,sBAAsB,mBAAmB,WAAW,CAAC,IAAI,IAAI;AAC7E;AASA,eAAsB,2BAA2B,MAIL;AAC1C,QAAM,WAAW,MAAM;AAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D,MAAM,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,iBAAA,CAAkB,GAAG;AAAA,MAC9F,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,GAAG;AAAA,MAAA;AAAA,MAEL,MAAM,KAAK,UAAU,EAAE;AAAA,MACvB,QAAQ,KAAK;AAAA,IAAA,CACd;AAAA,EAAA;AAEH,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,oDAAoD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEvE;AACA,SAAQ,MAAM,SAAS,KAAA;AACzB;AAEA,SAAS,aAAgB,OAAoC;AAC3D,SAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAA;AACxC;AAQA,eAAsB,yBAAyB,MAKD;AAC5C,QAAM,WAAW,MAAM;AAAA,IAA0B,KAAK;AAAA,IAAM,CAAC,YAC3D;AAAA,MACE,aAAa,EAAE,MAAM,KAAK,MAAM,aAAa,KAAK,aAAa,MAAM,oBAAoB;AAAA,MACzF;AAAA,QACE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAG;AAAA,QAAA;AAAA,QAEL,MAAM,KAAK,UAAU,KAAK,OAAO;AAAA,QACjC,QAAQ,KAAK;AAAA,MAAA;AAAA,IACf;AAAA,EACF;AAEF,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,MAAM;AAAA,MACV;AAAA,MACA,iDAAiD,SAAS,MAAM;AAAA,IAAA;AAAA,EAEpE;AACA,QAAM,OAAQ,MAAM,SAAS,KAAA;AAC7B,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,UAAM,IAAI,iBAAiB,SAAS,QAAQ,6CAA6C;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK,MAAM;AAAA,IAChC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,UAAU,aAAa,KAAK,QAAQ;AAAA,IACpC,SAAS,aAAa,KAAK,OAAO;AAAA,EAAA;AAEtC;"}

package/dist/collab/presence-react.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const react = require("react");
+const AthenaCredentialSourceContext = require("../auth/AthenaCredentialSourceContext.cjs");
 const AthenaContext = require("../provider/AthenaContext.cjs");
 const presenceClient = require("./presence-client.cjs");
 const presenceMint = require("./presence-mint.cjs");
@@ -11,6 +12,7 @@ const NO_HUMANS = [];
 const NO_AGENTS = [];
 function useWorkspacePresence(workspaceId, options) {
   const config = AthenaContext.useAthenaConfig();
+  const identityEpoch = AthenaCredentialSourceContext.useAthenaCredentialIdentityEpoch();
   const enabled = (options == null ? void 0 : options.enabled) !== false && workspaceId !== null;
   const tickMs = (options == null ? void 0 : options.tickMs) ?? PRESENCE_DEFAULT_TICK_MS;
   const [entry, setEntry] = react.useState(null);
@@ -25,7 +27,8 @@ function useWorkspacePresence(workspaceId, options) {
       auth: {
         backendUrl: config.backendUrl,
         apiKey: config.apiKey,
-        token: config.token
+        token: config.token,
+        getToken: config.getToken
       }
     });
     handleRef.current = next;
@@ -34,7 +37,7 @@ function useWorkspacePresence(workspaceId, options) {
       handleRef.current = null;
       next.destroy();
     };
-  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.token]);
+  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);
   const handle = enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;
   const subscribe = react.useMemo(() => {
     return (onStoreChange) => {
@@ -90,7 +93,6 @@ function useWorkspacePresence(workspaceId, options) {
 }
 function useWorkspacePresenceResolver(workspaceId) {
   const config = AthenaContext.useAthenaConfig();
-  const { backendUrl, apiKey, token } = config;
   return react.useCallback(
     (request, signal) => {
       if (workspaceId === null) {
@@ -99,13 +101,18 @@ function useWorkspacePresenceResolver(workspaceId) {
         );
       }
       return presenceMint.resolveWorkspacePresence({
-        auth: { backendUrl, apiKey, token },
+        auth: {
+          backendUrl: config.backendUrl,
+          apiKey: config.apiKey,
+          token: config.token,
+          getToken: config.getToken
+        },
         workspaceId,
         request,
         signal
       });
     },
-    [workspaceId, backendUrl, apiKey, token]
+    [workspaceId, config]
   );
 }
 exports.PRESENCE_DEFAULT_TICK_MS = PRESENCE_DEFAULT_TICK_MS;

package/dist/collab/presence-react.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"presence-react.cjs","sources":["../../src/collab/presence-react.ts"],"sourcesContent":["/**\n * React bindings for the workspace presence feed.\n *\n * `useWorkspacePresence(workspaceId)` opens (and owns) a\n * `connectWorkspacePresence` handle, resolving auth from the surrounding\n * `AthenaProvider` (per-viewer bearer when present, API key otherwise), and\n * re-renders on status/roster changes via `useSyncExternalStore`. Each person\n * carries a `state` on the intent ladder, recomputed against a clock that\n * ticks every `tickMs` so `active` decays to `idle` and `away` between\n * awareness events.\n *\n * `useWorkspacePresenceResolver(workspaceId)` returns the batch id→title\n * resolver bound to the same auth. It is deliberately thin: callers own\n * caching (TanStack Query is the expected home for it).\n */\n\nimport { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type WorkspacePresenceHandle,\n  type WorkspacePresenceStatus,\n  connectWorkspacePresence,\n} from './presence-client';\nimport {\n  type WorkspacePresenceResolveRequest,\n  type WorkspacePresenceResolveResponse,\n  resolveWorkspacePresence,\n} from './presence-mint';\nimport {\n  type PresenceAgent,\n  type PresenceHuman,\n  type PresenceState,\n  derivePresenceState,\n} from './presence-slots';\n\n/** Default cadence for re-deriving each person's intent state. */\nexport const PRESENCE_DEFAULT_TICK_MS = 10_000;\n\nexport interface PresenceHumanWithState extends PresenceHuman {\n  /** Where the person sits on the intent ladder as of the last tick. */\n  state: PresenceState;\n}\n\nexport interface UseWorkspacePresenceOptions {\n  /** `false` closes the feed without unmounting the caller. Default `true`. */\n  enabled?: boolean;\n  /** How often `state` is re-derived from `lastIntentAt`. Default 10 s. */\n  tickMs?: number;\n}\n\nexport interface UseWorkspacePresenceResult {\n  /** `'closed'` while disabled or without a workspace; `'connecting'` until the first mint resolves. */\n  status: WorkspacePresenceStatus;\n  error: Error | null;\n  accessType: 'r' | 'rw' | null;\n  humans: PresenceHumanWithState[];\n  agents: PresenceAgent[];\n  /** Force an early token refresh; resolves immediately when no feed is open. */\n  refreshNow: () => Promise<void>;\n}\n\nconst EMPTY_SNAPSHOT = 'init||0';\nconst NO_HUMANS: PresenceHuman[] = [];\nconst NO_AGENTS: PresenceAgent[] = [];\n\nexport function useWorkspacePresence(\n  workspaceId: string | null,\n  options?: UseWorkspacePresenceOptions\n): UseWorkspacePresenceResult {\n  const config = useAthenaConfig();\n  const enabled = options?.enabled !== false && workspaceId !== null;\n  const tickMs = options?.tickMs ?? PRESENCE_DEFAULT_TICK_MS;\n  const [entry, setEntry] = useState<{\n    workspaceId: string;\n    handle: WorkspacePresenceHandle;\n  } | null>(null);\n  const handleRef = useRef<WorkspacePresenceHandle | null>(null);\n\n  useEffect(() => {\n    if (!enabled || workspaceId === null) {\n      setEntry(null);\n      return;\n    }\n    const next = connectWorkspacePresence({\n      workspaceId,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n      },\n    });\n    handleRef.current = next;\n    setEntry({ workspaceId, handle: next });\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or credentials change; the handle re-mints on\n    // its own schedule otherwise.\n  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.token]);\n\n  // React renders with the new arguments before the effect above runs, so a\n  // handle opened for a previous workspace, or before the feed was disabled,\n  // still sits in state for that one render. Expose it only while it is the\n  // handle this render asked for; otherwise the closed / connecting empty\n  // result wins, and a disabled feed never leaks a roster.\n  const handle =\n    enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  // The ladder decays with wall-clock time, not with awareness events; a\n  // person who stops typing must drift to idle even when nothing arrives.\n  const [now, setNow] = useState(() => Date.now());\n  useEffect(() => {\n    if (!enabled) return;\n    setNow(Date.now());\n    const timer = setInterval(() => {\n      setNow(Date.now());\n    }, tickMs);\n    return () => {\n      clearInterval(timer);\n    };\n  }, [enabled, tickMs]);\n\n  const rosterHumans = handle?.humans ?? NO_HUMANS;\n  const humans = useMemo(\n    () =>\n      rosterHumans.map((human) => ({\n        ...human,\n        state: derivePresenceState({\n          lastIntentAt: human.lastIntentAt,\n          hidden: human.hidden,\n          manualAway: human.manualAway,\n          now,\n        }),\n      })),\n    [rosterHumans, now]\n  );\n\n  const refreshNow = useCallback(() => handleRef.current?.refreshNow() ?? Promise.resolve(), []);\n\n  return {\n    status: handle ? handle.status : enabled ? 'connecting' : 'closed',\n    error: handle?.error ?? null,\n    accessType: handle?.accessType ?? null,\n    humans,\n    agents: handle?.agents ?? NO_AGENTS,\n    refreshNow,\n  };\n}\n\nexport type WorkspacePresenceResolver = (\n  request: WorkspacePresenceResolveRequest,\n  signal?: AbortSignal\n) => Promise<WorkspacePresenceResolveResponse>;\n\n/**\n * A stable resolver bound to the provider's auth and the given workspace.\n * Rejects when called without a workspace; no caching — callers own that.\n */\nexport function useWorkspacePresenceResolver(\n  workspaceId: string | null\n): WorkspacePresenceResolver {\n  const config = useAthenaConfig();\n  const { backendUrl, apiKey, token } = config;\n  return useCallback<WorkspacePresenceResolver>(\n    (request, signal) => {\n      if (workspaceId === null) {\n        return Promise.reject(\n          new Error('[AthenaSDK] useWorkspacePresenceResolver: no workspace selected')\n        );\n      }\n      return resolveWorkspacePresence({\n        auth: { backendUrl, apiKey, token },\n        workspaceId,\n        request,\n        signal,\n      });\n    },\n    [workspaceId, backendUrl, apiKey, token]\n  );\n}\n"],"names":["useAthenaConfig","useState","useRef","useEffect","connectWorkspacePresence","useMemo","useSyncExternalStore","derivePresenceState","useCallback","resolveWorkspacePresence"],"mappings":";;;;;;;AAoCO,MAAM,2BAA2B;AAyBxC,MAAM,iBAAiB;AACvB,MAAM,YAA6B,CAAA;AACnC,MAAM,YAA6B,CAAA;AAE5B,SAAS,qBACd,aACA,SAC4B;AAC5B,QAAM,SAASA,cAAAA,gBAAA;AACf,QAAM,WAAU,mCAAS,aAAY,SAAS,gBAAgB;AAC9D,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,OAAO,QAAQ,IAAIC,MAAAA,SAGhB,IAAI;AACd,QAAM,YAAYC,MAAAA,OAAuC,IAAI;AAE7DC,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,WAAW,gBAAgB,MAAM;AACpC,eAAS,IAAI;AACb;AAAA,IACF;AACA,UAAM,OAAOC,eAAAA,yBAAyB;AAAA,MACpC;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,MAAA;AAAA,IAChB,CACD;AACD,cAAU,UAAU;AACpB,aAAS,EAAE,aAAa,QAAQ,KAAA,CAAM;AACtC,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAGF,GAAG,CAAC,SAAS,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC;AAOzE,QAAM,SACJ,WAAW,UAAU,QAAQ,MAAM,gBAAgB,cAAc,MAAM,SAAS;AAElF,QAAM,YAAYC,MAAAA,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEMC,QAAAA;AAAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACtE;AAAA,IACA,MAAM;AAAA,EAAA;AAMR,QAAM,CAAC,KAAK,MAAM,IAAIL,MAAAA,SAAS,MAAM,KAAK,KAAK;AAC/CE,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,KAAK;AACjB,UAAM,QAAQ,YAAY,MAAM;AAC9B,aAAO,KAAK,KAAK;AAAA,IACnB,GAAG,MAAM;AACT,WAAO,MAAM;AACX,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,SAAS,MAAM,CAAC;AAEpB,QAAM,gBAAe,iCAAQ,WAAU;AACvC,QAAM,SAASE,MAAAA;AAAAA,IACb,MACE,aAAa,IAAI,CAAC,WAAW;AAAA,MAC3B,GAAG;AAAA,MACH,OAAOE,cAAAA,oBAAoB;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,YAAY,MAAM;AAAA,QAClB;AAAA,MAAA,CACD;AAAA,IAAA,EACD;AAAA,IACJ,CAAC,cAAc,GAAG;AAAA,EAAA;AAGpB,QAAM,aAAaC,kBAAY,MAAA;;AAAM,4BAAU,YAAV,mBAAmB,iBAAgB,QAAQ,QAAA;AAAA,KAAW,EAAE;AAE7F,SAAO;AAAA,IACL,QAAQ,SAAS,OAAO,SAAS,UAAU,eAAe;AAAA,IAC1D,QAAO,iCAAQ,UAAS;AAAA,IACxB,aAAY,iCAAQ,eAAc;AAAA,IAClC;AAAA,IACA,SAAQ,iCAAQ,WAAU;AAAA,IAC1B;AAAA,EAAA;AAEJ;AAWO,SAAS,6BACd,aAC2B;AAC3B,QAAM,SAASR,cAAAA,gBAAA;AACf,QAAM,EAAE,YAAY,QAAQ,MAAA,IAAU;AACtC,SAAOQ,MAAAA;AAAAA,IACL,CAAC,SAAS,WAAW;AACnB,UAAI,gBAAgB,MAAM;AACxB,eAAO,QAAQ;AAAA,UACb,IAAI,MAAM,iEAAiE;AAAA,QAAA;AAAA,MAE/E;AACA,aAAOC,sCAAyB;AAAA,QAC9B,MAAM,EAAE,YAAY,QAAQ,MAAA;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,MAAA,CACD;AAAA,IACH;AAAA,IACA,CAAC,aAAa,YAAY,QAAQ,KAAK;AAAA,EAAA;AAE3C;;;;"}
+{"version":3,"file":"presence-react.cjs","sources":["../../src/collab/presence-react.ts"],"sourcesContent":["/**\n * React bindings for the workspace presence feed.\n *\n * `useWorkspacePresence(workspaceId)` opens (and owns) a\n * `connectWorkspacePresence` handle, resolving auth from the surrounding\n * `AthenaProvider` (per-viewer bearer when present, API key otherwise), and\n * re-renders on status/roster changes via `useSyncExternalStore`. Each person\n * carries a `state` on the intent ladder, recomputed against a clock that\n * ticks every `tickMs` so `active` decays to `idle` and `away` between\n * awareness events.\n *\n * `useWorkspacePresenceResolver(workspaceId)` returns the batch id→title\n * resolver bound to the same auth. It is deliberately thin: callers own\n * caching (TanStack Query is the expected home for it).\n */\n\nimport { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaCredentialIdentityEpoch } from '../auth/AthenaCredentialSourceContext';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type WorkspacePresenceHandle,\n  type WorkspacePresenceStatus,\n  connectWorkspacePresence,\n} from './presence-client';\nimport {\n  type WorkspacePresenceResolveRequest,\n  type WorkspacePresenceResolveResponse,\n  resolveWorkspacePresence,\n} from './presence-mint';\nimport {\n  type PresenceAgent,\n  type PresenceHuman,\n  type PresenceState,\n  derivePresenceState,\n} from './presence-slots';\n\n/** Default cadence for re-deriving each person's intent state. */\nexport const PRESENCE_DEFAULT_TICK_MS = 10_000;\n\nexport interface PresenceHumanWithState extends PresenceHuman {\n  /** Where the person sits on the intent ladder as of the last tick. */\n  state: PresenceState;\n}\n\nexport interface UseWorkspacePresenceOptions {\n  /** `false` closes the feed without unmounting the caller. Default `true`. */\n  enabled?: boolean;\n  /** How often `state` is re-derived from `lastIntentAt`. Default 10 s. */\n  tickMs?: number;\n}\n\nexport interface UseWorkspacePresenceResult {\n  /** `'closed'` while disabled or without a workspace; `'connecting'` until the first mint resolves. */\n  status: WorkspacePresenceStatus;\n  error: Error | null;\n  accessType: 'r' | 'rw' | null;\n  humans: PresenceHumanWithState[];\n  agents: PresenceAgent[];\n  /** Force an early token refresh; resolves immediately when no feed is open. */\n  refreshNow: () => Promise<void>;\n}\n\nconst EMPTY_SNAPSHOT = 'init||0';\nconst NO_HUMANS: PresenceHuman[] = [];\nconst NO_AGENTS: PresenceAgent[] = [];\n\nexport function useWorkspacePresence(\n  workspaceId: string | null,\n  options?: UseWorkspacePresenceOptions\n): UseWorkspacePresenceResult {\n  const config = useAthenaConfig();\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  const enabled = options?.enabled !== false && workspaceId !== null;\n  const tickMs = options?.tickMs ?? PRESENCE_DEFAULT_TICK_MS;\n  const [entry, setEntry] = useState<{\n    workspaceId: string;\n    handle: WorkspacePresenceHandle;\n  } | null>(null);\n  const handleRef = useRef<WorkspacePresenceHandle | null>(null);\n\n  useEffect(() => {\n    if (!enabled || workspaceId === null) {\n      setEntry(null);\n      return;\n    }\n    const next = connectWorkspacePresence({\n      workspaceId,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n        getToken: config.getToken,\n      },\n    });\n    handleRef.current = next;\n    setEntry({ workspaceId, handle: next });\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or the signed-in identity changes (the\n    // credential source's identity epoch). A renewed token for the same\n    // identity reaches the next re-mint through `getToken`, so a renewal\n    // does not tear the live connection down.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);\n\n  // React renders with the new arguments before the effect above runs, so a\n  // handle opened for a previous workspace, or before the feed was disabled,\n  // still sits in state for that one render. Expose it only while it is the\n  // handle this render asked for; otherwise the closed / connecting empty\n  // result wins, and a disabled feed never leaks a roster.\n  const handle =\n    enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  // The ladder decays with wall-clock time, not with awareness events; a\n  // person who stops typing must drift to idle even when nothing arrives.\n  const [now, setNow] = useState(() => Date.now());\n  useEffect(() => {\n    if (!enabled) return;\n    setNow(Date.now());\n    const timer = setInterval(() => {\n      setNow(Date.now());\n    }, tickMs);\n    return () => {\n      clearInterval(timer);\n    };\n  }, [enabled, tickMs]);\n\n  const rosterHumans = handle?.humans ?? NO_HUMANS;\n  const humans = useMemo(\n    () =>\n      rosterHumans.map((human) => ({\n        ...human,\n        state: derivePresenceState({\n          lastIntentAt: human.lastIntentAt,\n          hidden: human.hidden,\n          manualAway: human.manualAway,\n          now,\n        }),\n      })),\n    [rosterHumans, now]\n  );\n\n  const refreshNow = useCallback(() => handleRef.current?.refreshNow() ?? Promise.resolve(), []);\n\n  return {\n    status: handle ? handle.status : enabled ? 'connecting' : 'closed',\n    error: handle?.error ?? null,\n    accessType: handle?.accessType ?? null,\n    humans,\n    agents: handle?.agents ?? NO_AGENTS,\n    refreshNow,\n  };\n}\n\nexport type WorkspacePresenceResolver = (\n  request: WorkspacePresenceResolveRequest,\n  signal?: AbortSignal\n) => Promise<WorkspacePresenceResolveResponse>;\n\n/**\n * A stable resolver bound to the provider's auth and the given workspace.\n * Credentials are read on every call (the provider serves the current token\n * through getters), and `getToken` renews a refused one once. Rejects when\n * called without a workspace; no caching — callers own that.\n */\nexport function useWorkspacePresenceResolver(\n  workspaceId: string | null\n): WorkspacePresenceResolver {\n  const config = useAthenaConfig();\n  return useCallback<WorkspacePresenceResolver>(\n    (request, signal) => {\n      if (workspaceId === null) {\n        return Promise.reject(\n          new Error('[AthenaSDK] useWorkspacePresenceResolver: no workspace selected')\n        );\n      }\n      return resolveWorkspacePresence({\n        auth: {\n          backendUrl: config.backendUrl,\n          apiKey: config.apiKey,\n          token: config.token,\n          getToken: config.getToken,\n        },\n        workspaceId,\n        request,\n        signal,\n      });\n    },\n    [workspaceId, config]\n  );\n}\n"],"names":["useAthenaConfig","useAthenaCredentialIdentityEpoch","useState","useRef","useEffect","connectWorkspacePresence","useMemo","useSyncExternalStore","derivePresenceState","useCallback","resolveWorkspacePresence"],"mappings":";;;;;;;;AAqCO,MAAM,2BAA2B;AAyBxC,MAAM,iBAAiB;AACvB,MAAM,YAA6B,CAAA;AACnC,MAAM,YAA6B,CAAA;AAE5B,SAAS,qBACd,aACA,SAC4B;AAC5B,QAAM,SAASA,cAAAA,gBAAA;AACf,QAAM,gBAAgBC,8BAAAA,iCAAA;AACtB,QAAM,WAAU,mCAAS,aAAY,SAAS,gBAAgB;AAC9D,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,OAAO,QAAQ,IAAIC,MAAAA,SAGhB,IAAI;AACd,QAAM,YAAYC,MAAAA,OAAuC,IAAI;AAE7DC,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,WAAW,gBAAgB,MAAM;AACpC,eAAS,IAAI;AACb;AAAA,IACF;AACA,UAAM,OAAOC,eAAAA,yBAAyB;AAAA,MACpC;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,QACd,UAAU,OAAO;AAAA,MAAA;AAAA,IACnB,CACD;AACD,cAAU,UAAU;AACpB,aAAS,EAAE,aAAa,QAAQ,KAAA,CAAM;AACtC,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAMF,GAAG,CAAC,SAAS,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,aAAa,CAAC;AAO3F,QAAM,SACJ,WAAW,UAAU,QAAQ,MAAM,gBAAgB,cAAc,MAAM,SAAS;AAElF,QAAM,YAAYC,MAAAA,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEMC,QAAAA;AAAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACtE;AAAA,IACA,MAAM;AAAA,EAAA;AAMR,QAAM,CAAC,KAAK,MAAM,IAAIL,MAAAA,SAAS,MAAM,KAAK,KAAK;AAC/CE,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,KAAK;AACjB,UAAM,QAAQ,YAAY,MAAM;AAC9B,aAAO,KAAK,KAAK;AAAA,IACnB,GAAG,MAAM;AACT,WAAO,MAAM;AACX,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,SAAS,MAAM,CAAC;AAEpB,QAAM,gBAAe,iCAAQ,WAAU;AACvC,QAAM,SAASE,MAAAA;AAAAA,IACb,MACE,aAAa,IAAI,CAAC,WAAW;AAAA,MAC3B,GAAG;AAAA,MACH,OAAOE,cAAAA,oBAAoB;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,YAAY,MAAM;AAAA,QAClB;AAAA,MAAA,CACD;AAAA,IAAA,EACD;AAAA,IACJ,CAAC,cAAc,GAAG;AAAA,EAAA;AAGpB,QAAM,aAAaC,kBAAY,MAAA;;AAAM,4BAAU,YAAV,mBAAmB,iBAAgB,QAAQ,QAAA;AAAA,KAAW,EAAE;AAE7F,SAAO;AAAA,IACL,QAAQ,SAAS,OAAO,SAAS,UAAU,eAAe;AAAA,IAC1D,QAAO,iCAAQ,UAAS;AAAA,IACxB,aAAY,iCAAQ,eAAc;AAAA,IAClC;AAAA,IACA,SAAQ,iCAAQ,WAAU;AAAA,IAC1B;AAAA,EAAA;AAEJ;AAaO,SAAS,6BACd,aAC2B;AAC3B,QAAM,SAAST,cAAAA,gBAAA;AACf,SAAOS,MAAAA;AAAAA,IACL,CAAC,SAAS,WAAW;AACnB,UAAI,gBAAgB,MAAM;AACxB,eAAO,QAAQ;AAAA,UACb,IAAI,MAAM,iEAAiE;AAAA,QAAA;AAAA,MAE/E;AACA,aAAOC,sCAAyB;AAAA,QAC9B,MAAM;AAAA,UACJ,YAAY,OAAO;AAAA,UACnB,QAAQ,OAAO;AAAA,UACf,OAAO,OAAO;AAAA,UACd,UAAU,OAAO;AAAA,QAAA;AAAA,QAEnB;AAAA,QACA;AAAA,QACA;AAAA,MAAA,CACD;AAAA,IACH;AAAA,IACA,CAAC,aAAa,MAAM;AAAA,EAAA;AAExB;;;;"}

package/dist/collab/presence-react.d.ts

@@ -42,6 +42,8 @@ export declare function useWorkspacePresence(workspaceId: string | null, options
 export type WorkspacePresenceResolver = (request: WorkspacePresenceResolveRequest, signal?: AbortSignal) => Promise<WorkspacePresenceResolveResponse>;
 /**
  * A stable resolver bound to the provider's auth and the given workspace.
- * Rejects when called without a workspace; no caching — callers own that.
+ * Credentials are read on every call (the provider serves the current token
+ * through getters), and `getToken` renews a refused one once. Rejects when
+ * called without a workspace; no caching — callers own that.
  */
 export declare function useWorkspacePresenceResolver(workspaceId: string | null): WorkspacePresenceResolver;

package/dist/collab/presence-react.js

@@ -1,4 +1,5 @@
 import { useState, useRef, useEffect, useMemo, useSyncExternalStore, useCallback } from "react";
+import { useAthenaCredentialIdentityEpoch } from "../auth/AthenaCredentialSourceContext.js";
 import { useAthenaConfig } from "../provider/AthenaContext.js";
 import { connectWorkspacePresence } from "./presence-client.js";
 import { resolveWorkspacePresence } from "./presence-mint.js";
@@ -9,6 +10,7 @@ const NO_HUMANS = [];
 const NO_AGENTS = [];
 function useWorkspacePresence(workspaceId, options) {
   const config = useAthenaConfig();
+  const identityEpoch = useAthenaCredentialIdentityEpoch();
   const enabled = (options == null ? void 0 : options.enabled) !== false && workspaceId !== null;
   const tickMs = (options == null ? void 0 : options.tickMs) ?? PRESENCE_DEFAULT_TICK_MS;
   const [entry, setEntry] = useState(null);
@@ -23,7 +25,8 @@ function useWorkspacePresence(workspaceId, options) {
       auth: {
         backendUrl: config.backendUrl,
         apiKey: config.apiKey,
-        token: config.token
+        token: config.token,
+        getToken: config.getToken
       }
     });
     handleRef.current = next;
@@ -32,7 +35,7 @@ function useWorkspacePresence(workspaceId, options) {
       handleRef.current = null;
       next.destroy();
     };
-  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.token]);
+  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);
   const handle = enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;
   const subscribe = useMemo(() => {
     return (onStoreChange) => {
@@ -88,7 +91,6 @@ function useWorkspacePresence(workspaceId, options) {
 }
 function useWorkspacePresenceResolver(workspaceId) {
   const config = useAthenaConfig();
-  const { backendUrl, apiKey, token } = config;
   return useCallback(
     (request, signal) => {
       if (workspaceId === null) {
@@ -97,13 +99,18 @@ function useWorkspacePresenceResolver(workspaceId) {
         );
       }
       return resolveWorkspacePresence({
-        auth: { backendUrl, apiKey, token },
+        auth: {
+          backendUrl: config.backendUrl,
+          apiKey: config.apiKey,
+          token: config.token,
+          getToken: config.getToken
+        },
         workspaceId,
         request,
         signal
       });
     },
-    [workspaceId, backendUrl, apiKey, token]
+    [workspaceId, config]
   );
 }
 export {

package/dist/collab/presence-react.js.map

@@ -1 +1 @@
-{"version":3,"file":"presence-react.js","sources":["../../src/collab/presence-react.ts"],"sourcesContent":["/**\n * React bindings for the workspace presence feed.\n *\n * `useWorkspacePresence(workspaceId)` opens (and owns) a\n * `connectWorkspacePresence` handle, resolving auth from the surrounding\n * `AthenaProvider` (per-viewer bearer when present, API key otherwise), and\n * re-renders on status/roster changes via `useSyncExternalStore`. Each person\n * carries a `state` on the intent ladder, recomputed against a clock that\n * ticks every `tickMs` so `active` decays to `idle` and `away` between\n * awareness events.\n *\n * `useWorkspacePresenceResolver(workspaceId)` returns the batch id→title\n * resolver bound to the same auth. It is deliberately thin: callers own\n * caching (TanStack Query is the expected home for it).\n */\n\nimport { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type WorkspacePresenceHandle,\n  type WorkspacePresenceStatus,\n  connectWorkspacePresence,\n} from './presence-client';\nimport {\n  type WorkspacePresenceResolveRequest,\n  type WorkspacePresenceResolveResponse,\n  resolveWorkspacePresence,\n} from './presence-mint';\nimport {\n  type PresenceAgent,\n  type PresenceHuman,\n  type PresenceState,\n  derivePresenceState,\n} from './presence-slots';\n\n/** Default cadence for re-deriving each person's intent state. */\nexport const PRESENCE_DEFAULT_TICK_MS = 10_000;\n\nexport interface PresenceHumanWithState extends PresenceHuman {\n  /** Where the person sits on the intent ladder as of the last tick. */\n  state: PresenceState;\n}\n\nexport interface UseWorkspacePresenceOptions {\n  /** `false` closes the feed without unmounting the caller. Default `true`. */\n  enabled?: boolean;\n  /** How often `state` is re-derived from `lastIntentAt`. Default 10 s. */\n  tickMs?: number;\n}\n\nexport interface UseWorkspacePresenceResult {\n  /** `'closed'` while disabled or without a workspace; `'connecting'` until the first mint resolves. */\n  status: WorkspacePresenceStatus;\n  error: Error | null;\n  accessType: 'r' | 'rw' | null;\n  humans: PresenceHumanWithState[];\n  agents: PresenceAgent[];\n  /** Force an early token refresh; resolves immediately when no feed is open. */\n  refreshNow: () => Promise<void>;\n}\n\nconst EMPTY_SNAPSHOT = 'init||0';\nconst NO_HUMANS: PresenceHuman[] = [];\nconst NO_AGENTS: PresenceAgent[] = [];\n\nexport function useWorkspacePresence(\n  workspaceId: string | null,\n  options?: UseWorkspacePresenceOptions\n): UseWorkspacePresenceResult {\n  const config = useAthenaConfig();\n  const enabled = options?.enabled !== false && workspaceId !== null;\n  const tickMs = options?.tickMs ?? PRESENCE_DEFAULT_TICK_MS;\n  const [entry, setEntry] = useState<{\n    workspaceId: string;\n    handle: WorkspacePresenceHandle;\n  } | null>(null);\n  const handleRef = useRef<WorkspacePresenceHandle | null>(null);\n\n  useEffect(() => {\n    if (!enabled || workspaceId === null) {\n      setEntry(null);\n      return;\n    }\n    const next = connectWorkspacePresence({\n      workspaceId,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n      },\n    });\n    handleRef.current = next;\n    setEntry({ workspaceId, handle: next });\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or credentials change; the handle re-mints on\n    // its own schedule otherwise.\n  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.token]);\n\n  // React renders with the new arguments before the effect above runs, so a\n  // handle opened for a previous workspace, or before the feed was disabled,\n  // still sits in state for that one render. Expose it only while it is the\n  // handle this render asked for; otherwise the closed / connecting empty\n  // result wins, and a disabled feed never leaks a roster.\n  const handle =\n    enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  // The ladder decays with wall-clock time, not with awareness events; a\n  // person who stops typing must drift to idle even when nothing arrives.\n  const [now, setNow] = useState(() => Date.now());\n  useEffect(() => {\n    if (!enabled) return;\n    setNow(Date.now());\n    const timer = setInterval(() => {\n      setNow(Date.now());\n    }, tickMs);\n    return () => {\n      clearInterval(timer);\n    };\n  }, [enabled, tickMs]);\n\n  const rosterHumans = handle?.humans ?? NO_HUMANS;\n  const humans = useMemo(\n    () =>\n      rosterHumans.map((human) => ({\n        ...human,\n        state: derivePresenceState({\n          lastIntentAt: human.lastIntentAt,\n          hidden: human.hidden,\n          manualAway: human.manualAway,\n          now,\n        }),\n      })),\n    [rosterHumans, now]\n  );\n\n  const refreshNow = useCallback(() => handleRef.current?.refreshNow() ?? Promise.resolve(), []);\n\n  return {\n    status: handle ? handle.status : enabled ? 'connecting' : 'closed',\n    error: handle?.error ?? null,\n    accessType: handle?.accessType ?? null,\n    humans,\n    agents: handle?.agents ?? NO_AGENTS,\n    refreshNow,\n  };\n}\n\nexport type WorkspacePresenceResolver = (\n  request: WorkspacePresenceResolveRequest,\n  signal?: AbortSignal\n) => Promise<WorkspacePresenceResolveResponse>;\n\n/**\n * A stable resolver bound to the provider's auth and the given workspace.\n * Rejects when called without a workspace; no caching — callers own that.\n */\nexport function useWorkspacePresenceResolver(\n  workspaceId: string | null\n): WorkspacePresenceResolver {\n  const config = useAthenaConfig();\n  const { backendUrl, apiKey, token } = config;\n  return useCallback<WorkspacePresenceResolver>(\n    (request, signal) => {\n      if (workspaceId === null) {\n        return Promise.reject(\n          new Error('[AthenaSDK] useWorkspacePresenceResolver: no workspace selected')\n        );\n      }\n      return resolveWorkspacePresence({\n        auth: { backendUrl, apiKey, token },\n        workspaceId,\n        request,\n        signal,\n      });\n    },\n    [workspaceId, backendUrl, apiKey, token]\n  );\n}\n"],"names":[],"mappings":";;;;;AAoCO,MAAM,2BAA2B;AAyBxC,MAAM,iBAAiB;AACvB,MAAM,YAA6B,CAAA;AACnC,MAAM,YAA6B,CAAA;AAE5B,SAAS,qBACd,aACA,SAC4B;AAC5B,QAAM,SAAS,gBAAA;AACf,QAAM,WAAU,mCAAS,aAAY,SAAS,gBAAgB;AAC9D,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAGhB,IAAI;AACd,QAAM,YAAY,OAAuC,IAAI;AAE7D,YAAU,MAAM;AACd,QAAI,CAAC,WAAW,gBAAgB,MAAM;AACpC,eAAS,IAAI;AACb;AAAA,IACF;AACA,UAAM,OAAO,yBAAyB;AAAA,MACpC;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,MAAA;AAAA,IAChB,CACD;AACD,cAAU,UAAU;AACpB,aAAS,EAAE,aAAa,QAAQ,KAAA,CAAM;AACtC,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAGF,GAAG,CAAC,SAAS,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC;AAOzE,QAAM,SACJ,WAAW,UAAU,QAAQ,MAAM,gBAAgB,cAAc,MAAM,SAAS;AAElF,QAAM,YAAY,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEM;AAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACtE;AAAA,IACA,MAAM;AAAA,EAAA;AAMR,QAAM,CAAC,KAAK,MAAM,IAAI,SAAS,MAAM,KAAK,KAAK;AAC/C,YAAU,MAAM;AACd,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,KAAK;AACjB,UAAM,QAAQ,YAAY,MAAM;AAC9B,aAAO,KAAK,KAAK;AAAA,IACnB,GAAG,MAAM;AACT,WAAO,MAAM;AACX,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,SAAS,MAAM,CAAC;AAEpB,QAAM,gBAAe,iCAAQ,WAAU;AACvC,QAAM,SAAS;AAAA,IACb,MACE,aAAa,IAAI,CAAC,WAAW;AAAA,MAC3B,GAAG;AAAA,MACH,OAAO,oBAAoB;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,YAAY,MAAM;AAAA,QAClB;AAAA,MAAA,CACD;AAAA,IAAA,EACD;AAAA,IACJ,CAAC,cAAc,GAAG;AAAA,EAAA;AAGpB,QAAM,aAAa,YAAY,MAAA;;AAAM,4BAAU,YAAV,mBAAmB,iBAAgB,QAAQ,QAAA;AAAA,KAAW,EAAE;AAE7F,SAAO;AAAA,IACL,QAAQ,SAAS,OAAO,SAAS,UAAU,eAAe;AAAA,IAC1D,QAAO,iCAAQ,UAAS;AAAA,IACxB,aAAY,iCAAQ,eAAc;AAAA,IAClC;AAAA,IACA,SAAQ,iCAAQ,WAAU;AAAA,IAC1B;AAAA,EAAA;AAEJ;AAWO,SAAS,6BACd,aAC2B;AAC3B,QAAM,SAAS,gBAAA;AACf,QAAM,EAAE,YAAY,QAAQ,MAAA,IAAU;AACtC,SAAO;AAAA,IACL,CAAC,SAAS,WAAW;AACnB,UAAI,gBAAgB,MAAM;AACxB,eAAO,QAAQ;AAAA,UACb,IAAI,MAAM,iEAAiE;AAAA,QAAA;AAAA,MAE/E;AACA,aAAO,yBAAyB;AAAA,QAC9B,MAAM,EAAE,YAAY,QAAQ,MAAA;AAAA,QAC5B;AAAA,QACA;AAAA,QACA;AAAA,MAAA,CACD;AAAA,IACH;AAAA,IACA,CAAC,aAAa,YAAY,QAAQ,KAAK;AAAA,EAAA;AAE3C;"}
+{"version":3,"file":"presence-react.js","sources":["../../src/collab/presence-react.ts"],"sourcesContent":["/**\n * React bindings for the workspace presence feed.\n *\n * `useWorkspacePresence(workspaceId)` opens (and owns) a\n * `connectWorkspacePresence` handle, resolving auth from the surrounding\n * `AthenaProvider` (per-viewer bearer when present, API key otherwise), and\n * re-renders on status/roster changes via `useSyncExternalStore`. Each person\n * carries a `state` on the intent ladder, recomputed against a clock that\n * ticks every `tickMs` so `active` decays to `idle` and `away` between\n * awareness events.\n *\n * `useWorkspacePresenceResolver(workspaceId)` returns the batch id→title\n * resolver bound to the same auth. It is deliberately thin: callers own\n * caching (TanStack Query is the expected home for it).\n */\n\nimport { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaCredentialIdentityEpoch } from '../auth/AthenaCredentialSourceContext';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type WorkspacePresenceHandle,\n  type WorkspacePresenceStatus,\n  connectWorkspacePresence,\n} from './presence-client';\nimport {\n  type WorkspacePresenceResolveRequest,\n  type WorkspacePresenceResolveResponse,\n  resolveWorkspacePresence,\n} from './presence-mint';\nimport {\n  type PresenceAgent,\n  type PresenceHuman,\n  type PresenceState,\n  derivePresenceState,\n} from './presence-slots';\n\n/** Default cadence for re-deriving each person's intent state. */\nexport const PRESENCE_DEFAULT_TICK_MS = 10_000;\n\nexport interface PresenceHumanWithState extends PresenceHuman {\n  /** Where the person sits on the intent ladder as of the last tick. */\n  state: PresenceState;\n}\n\nexport interface UseWorkspacePresenceOptions {\n  /** `false` closes the feed without unmounting the caller. Default `true`. */\n  enabled?: boolean;\n  /** How often `state` is re-derived from `lastIntentAt`. Default 10 s. */\n  tickMs?: number;\n}\n\nexport interface UseWorkspacePresenceResult {\n  /** `'closed'` while disabled or without a workspace; `'connecting'` until the first mint resolves. */\n  status: WorkspacePresenceStatus;\n  error: Error | null;\n  accessType: 'r' | 'rw' | null;\n  humans: PresenceHumanWithState[];\n  agents: PresenceAgent[];\n  /** Force an early token refresh; resolves immediately when no feed is open. */\n  refreshNow: () => Promise<void>;\n}\n\nconst EMPTY_SNAPSHOT = 'init||0';\nconst NO_HUMANS: PresenceHuman[] = [];\nconst NO_AGENTS: PresenceAgent[] = [];\n\nexport function useWorkspacePresence(\n  workspaceId: string | null,\n  options?: UseWorkspacePresenceOptions\n): UseWorkspacePresenceResult {\n  const config = useAthenaConfig();\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  const enabled = options?.enabled !== false && workspaceId !== null;\n  const tickMs = options?.tickMs ?? PRESENCE_DEFAULT_TICK_MS;\n  const [entry, setEntry] = useState<{\n    workspaceId: string;\n    handle: WorkspacePresenceHandle;\n  } | null>(null);\n  const handleRef = useRef<WorkspacePresenceHandle | null>(null);\n\n  useEffect(() => {\n    if (!enabled || workspaceId === null) {\n      setEntry(null);\n      return;\n    }\n    const next = connectWorkspacePresence({\n      workspaceId,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n        getToken: config.getToken,\n      },\n    });\n    handleRef.current = next;\n    setEntry({ workspaceId, handle: next });\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or the signed-in identity changes (the\n    // credential source's identity epoch). A renewed token for the same\n    // identity reaches the next re-mint through `getToken`, so a renewal\n    // does not tear the live connection down.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [enabled, workspaceId, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);\n\n  // React renders with the new arguments before the effect above runs, so a\n  // handle opened for a previous workspace, or before the feed was disabled,\n  // still sits in state for that one render. Expose it only while it is the\n  // handle this render asked for; otherwise the closed / connecting empty\n  // result wins, and a disabled feed never leaks a roster.\n  const handle =\n    enabled && entry !== null && entry.workspaceId === workspaceId ? entry.handle : null;\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  // The ladder decays with wall-clock time, not with awareness events; a\n  // person who stops typing must drift to idle even when nothing arrives.\n  const [now, setNow] = useState(() => Date.now());\n  useEffect(() => {\n    if (!enabled) return;\n    setNow(Date.now());\n    const timer = setInterval(() => {\n      setNow(Date.now());\n    }, tickMs);\n    return () => {\n      clearInterval(timer);\n    };\n  }, [enabled, tickMs]);\n\n  const rosterHumans = handle?.humans ?? NO_HUMANS;\n  const humans = useMemo(\n    () =>\n      rosterHumans.map((human) => ({\n        ...human,\n        state: derivePresenceState({\n          lastIntentAt: human.lastIntentAt,\n          hidden: human.hidden,\n          manualAway: human.manualAway,\n          now,\n        }),\n      })),\n    [rosterHumans, now]\n  );\n\n  const refreshNow = useCallback(() => handleRef.current?.refreshNow() ?? Promise.resolve(), []);\n\n  return {\n    status: handle ? handle.status : enabled ? 'connecting' : 'closed',\n    error: handle?.error ?? null,\n    accessType: handle?.accessType ?? null,\n    humans,\n    agents: handle?.agents ?? NO_AGENTS,\n    refreshNow,\n  };\n}\n\nexport type WorkspacePresenceResolver = (\n  request: WorkspacePresenceResolveRequest,\n  signal?: AbortSignal\n) => Promise<WorkspacePresenceResolveResponse>;\n\n/**\n * A stable resolver bound to the provider's auth and the given workspace.\n * Credentials are read on every call (the provider serves the current token\n * through getters), and `getToken` renews a refused one once. Rejects when\n * called without a workspace; no caching — callers own that.\n */\nexport function useWorkspacePresenceResolver(\n  workspaceId: string | null\n): WorkspacePresenceResolver {\n  const config = useAthenaConfig();\n  return useCallback<WorkspacePresenceResolver>(\n    (request, signal) => {\n      if (workspaceId === null) {\n        return Promise.reject(\n          new Error('[AthenaSDK] useWorkspacePresenceResolver: no workspace selected')\n        );\n      }\n      return resolveWorkspacePresence({\n        auth: {\n          backendUrl: config.backendUrl,\n          apiKey: config.apiKey,\n          token: config.token,\n          getToken: config.getToken,\n        },\n        workspaceId,\n        request,\n        signal,\n      });\n    },\n    [workspaceId, config]\n  );\n}\n"],"names":[],"mappings":";;;;;;AAqCO,MAAM,2BAA2B;AAyBxC,MAAM,iBAAiB;AACvB,MAAM,YAA6B,CAAA;AACnC,MAAM,YAA6B,CAAA;AAE5B,SAAS,qBACd,aACA,SAC4B;AAC5B,QAAM,SAAS,gBAAA;AACf,QAAM,gBAAgB,iCAAA;AACtB,QAAM,WAAU,mCAAS,aAAY,SAAS,gBAAgB;AAC9D,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAGhB,IAAI;AACd,QAAM,YAAY,OAAuC,IAAI;AAE7D,YAAU,MAAM;AACd,QAAI,CAAC,WAAW,gBAAgB,MAAM;AACpC,eAAS,IAAI;AACb;AAAA,IACF;AACA,UAAM,OAAO,yBAAyB;AAAA,MACpC;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,QACd,UAAU,OAAO;AAAA,MAAA;AAAA,IACnB,CACD;AACD,cAAU,UAAU;AACpB,aAAS,EAAE,aAAa,QAAQ,KAAA,CAAM;AACtC,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAMF,GAAG,CAAC,SAAS,aAAa,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,aAAa,CAAC;AAO3F,QAAM,SACJ,WAAW,UAAU,QAAQ,MAAM,gBAAgB,cAAc,MAAM,SAAS;AAElF,QAAM,YAAY,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEM;AAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACtE;AAAA,IACA,MAAM;AAAA,EAAA;AAMR,QAAM,CAAC,KAAK,MAAM,IAAI,SAAS,MAAM,KAAK,KAAK;AAC/C,YAAU,MAAM;AACd,QAAI,CAAC,QAAS;AACd,WAAO,KAAK,KAAK;AACjB,UAAM,QAAQ,YAAY,MAAM;AAC9B,aAAO,KAAK,KAAK;AAAA,IACnB,GAAG,MAAM;AACT,WAAO,MAAM;AACX,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,SAAS,MAAM,CAAC;AAEpB,QAAM,gBAAe,iCAAQ,WAAU;AACvC,QAAM,SAAS;AAAA,IACb,MACE,aAAa,IAAI,CAAC,WAAW;AAAA,MAC3B,GAAG;AAAA,MACH,OAAO,oBAAoB;AAAA,QACzB,cAAc,MAAM;AAAA,QACpB,QAAQ,MAAM;AAAA,QACd,YAAY,MAAM;AAAA,QAClB;AAAA,MAAA,CACD;AAAA,IAAA,EACD;AAAA,IACJ,CAAC,cAAc,GAAG;AAAA,EAAA;AAGpB,QAAM,aAAa,YAAY,MAAA;;AAAM,4BAAU,YAAV,mBAAmB,iBAAgB,QAAQ,QAAA;AAAA,KAAW,EAAE;AAE7F,SAAO;AAAA,IACL,QAAQ,SAAS,OAAO,SAAS,UAAU,eAAe;AAAA,IAC1D,QAAO,iCAAQ,UAAS;AAAA,IACxB,aAAY,iCAAQ,eAAc;AAAA,IAClC;AAAA,IACA,SAAQ,iCAAQ,WAAU;AAAA,IAC1B;AAAA,EAAA;AAEJ;AAaO,SAAS,6BACd,aAC2B;AAC3B,QAAM,SAAS,gBAAA;AACf,SAAO;AAAA,IACL,CAAC,SAAS,WAAW;AACnB,UAAI,gBAAgB,MAAM;AACxB,eAAO,QAAQ;AAAA,UACb,IAAI,MAAM,iEAAiE;AAAA,QAAA;AAAA,MAE/E;AACA,aAAO,yBAAyB;AAAA,QAC9B,MAAM;AAAA,UACJ,YAAY,OAAO;AAAA,UACnB,QAAQ,OAAO;AAAA,UACf,OAAO,OAAO;AAAA,UACd,UAAU,OAAO;AAAA,QAAA;AAAA,QAEnB;AAAA,QACA;AAAA,QACA;AAAA,MAAA,CACD;AAAA,IACH;AAAA,IACA,CAAC,aAAa,MAAM;AAAA,EAAA;AAExB;"}

package/dist/collab/react.cjs

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const react = require("react");
+const AthenaCredentialSourceContext = require("../auth/AthenaCredentialSourceContext.cjs");
 const AthenaContext = require("../provider/AthenaContext.cjs");
 const client = require("./client.cjs");
 function useGenericDoc(assetId, options) {
   const config = AthenaContext.useAthenaConfig();
+  const identityEpoch = AthenaCredentialSourceContext.useAthenaCredentialIdentityEpoch();
   const access = (options == null ? void 0 : options.access) ?? "view";
   const [handle, setHandle] = react.useState(null);
   const handleRef = react.useRef(null);
@@ -15,7 +17,8 @@ function useGenericDoc(assetId, options) {
       auth: {
         backendUrl: config.backendUrl,
         apiKey: config.apiKey,
-        token: config.token
+        token: config.token,
+        getToken: config.getToken
       }
     });
     handleRef.current = next;
@@ -24,7 +27,7 @@ function useGenericDoc(assetId, options) {
       handleRef.current = null;
       next.destroy();
     };
-  }, [assetId, access, config.backendUrl, config.apiKey, config.token]);
+  }, [assetId, access, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);
   const subscribe = react.useMemo(() => {
     return (onStoreChange) => {
       if (!handle) return () => {

package/dist/collab/react.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"react.cjs","sources":["../../src/collab/react.ts"],"sourcesContent":["/**\n * React bindings for Generic Doc live collaboration.\n *\n * `useGenericDoc(assetId)` opens (and owns) a `connectGenericDoc` handle,\n * resolving auth from the surrounding `AthenaProvider` (per-viewer bearer when\n * present, API key otherwise) and re-rendering on status/presence changes via\n * `useSyncExternalStore`.\n */\n\nimport { useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type GenericDocHandle,\n  type GenericDocStatus,\n  type PresenceEntry,\n  connectGenericDoc,\n} from './client';\nimport type * as Y from '@y/y';\n\nexport interface UseGenericDocResult {\n  /** Null until the handle is created (first render effect). */\n  doc: Y.Doc | null;\n  status: GenericDocStatus;\n  /**\n   * Whether the initial server sync completed for the current connection —\n   * `status === 'connected'` fires before the server state arrives, so gate\n   * \"is this doc really empty?\" UI on this.\n   */\n  synced: boolean;\n  accessType: 'r' | 'rw' | null;\n  error: Error | null;\n  presence: PresenceEntry[];\n  setPresence: (state: Record<string, unknown> | null) => void;\n}\n\nexport function useGenericDoc(\n  assetId: string,\n  options?: { access?: 'view' | 'edit' }\n): UseGenericDocResult {\n  const config = useAthenaConfig();\n  const access = options?.access ?? 'view';\n  const [handle, setHandle] = useState<GenericDocHandle | null>(null);\n  const handleRef = useRef<GenericDocHandle | null>(null);\n\n  useEffect(() => {\n    const next = connectGenericDoc({\n      assetId,\n      access,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n      },\n    });\n    handleRef.current = next;\n    setHandle(next);\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or credentials change; the handle re-mints on\n    // its own schedule otherwise.\n  }, [assetId, access, config.backendUrl, config.apiKey, config.token]);\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.synced}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  return {\n    doc: handle?.doc ?? null,\n    status: handle?.status ?? 'connecting',\n    synced: handle?.synced ?? false,\n    accessType: handle?.accessType ?? null,\n    error: handle?.error ?? null,\n    presence: handle?.getPresence() ?? [],\n    setPresence: (state) => handleRef.current?.setPresence(state),\n  };\n}\n\nconst EMPTY_SNAPSHOT = 'init|false||0';\n"],"names":["useAthenaConfig","useState","useRef","useEffect","connectGenericDoc","useMemo","useSyncExternalStore"],"mappings":";;;;;AAmCO,SAAS,cACd,SACA,SACqB;AACrB,QAAM,SAASA,cAAAA,gBAAA;AACf,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,QAAQ,SAAS,IAAIC,MAAAA,SAAkC,IAAI;AAClE,QAAM,YAAYC,MAAAA,OAAgC,IAAI;AAEtDC,QAAAA,UAAU,MAAM;AACd,UAAM,OAAOC,OAAAA,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,MAAA;AAAA,IAChB,CACD;AACD,cAAU,UAAU;AACpB,cAAU,IAAI;AACd,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAGF,GAAG,CAAC,SAAS,QAAQ,OAAO,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC;AAEpE,QAAM,YAAYC,MAAAA,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEMC,QAAAA;AAAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACvF;AAAA,IACA,MAAM;AAAA,EAAA;AAIR,SAAO;AAAA,IACL,MAAK,iCAAQ,QAAO;AAAA,IACpB,SAAQ,iCAAQ,WAAU;AAAA,IAC1B,SAAQ,iCAAQ,WAAU;AAAA,IAC1B,aAAY,iCAAQ,eAAc;AAAA,IAClC,QAAO,iCAAQ,UAAS;AAAA,IACxB,WAAU,iCAAQ,kBAAiB,CAAA;AAAA,IACnC,aAAa,CAAC,UAAA;;AAAU,6BAAU,YAAV,mBAAmB,YAAY;AAAA;AAAA,EAAK;AAEhE;AAEA,MAAM,iBAAiB;;"}
+{"version":3,"file":"react.cjs","sources":["../../src/collab/react.ts"],"sourcesContent":["/**\n * React bindings for Generic Doc live collaboration.\n *\n * `useGenericDoc(assetId)` opens (and owns) a `connectGenericDoc` handle,\n * resolving auth from the surrounding `AthenaProvider` (per-viewer bearer when\n * present, API key otherwise) and re-rendering on status/presence changes via\n * `useSyncExternalStore`.\n */\n\nimport { useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaCredentialIdentityEpoch } from '../auth/AthenaCredentialSourceContext';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type GenericDocHandle,\n  type GenericDocStatus,\n  type PresenceEntry,\n  connectGenericDoc,\n} from './client';\nimport type * as Y from '@y/y';\n\nexport interface UseGenericDocResult {\n  /** Null until the handle is created (first render effect). */\n  doc: Y.Doc | null;\n  status: GenericDocStatus;\n  /**\n   * Whether the initial server sync completed for the current connection —\n   * `status === 'connected'` fires before the server state arrives, so gate\n   * \"is this doc really empty?\" UI on this.\n   */\n  synced: boolean;\n  accessType: 'r' | 'rw' | null;\n  error: Error | null;\n  presence: PresenceEntry[];\n  setPresence: (state: Record<string, unknown> | null) => void;\n}\n\nexport function useGenericDoc(\n  assetId: string,\n  options?: { access?: 'view' | 'edit' }\n): UseGenericDocResult {\n  const config = useAthenaConfig();\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  const access = options?.access ?? 'view';\n  const [handle, setHandle] = useState<GenericDocHandle | null>(null);\n  const handleRef = useRef<GenericDocHandle | null>(null);\n\n  useEffect(() => {\n    const next = connectGenericDoc({\n      assetId,\n      access,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n        getToken: config.getToken,\n      },\n    });\n    handleRef.current = next;\n    setHandle(next);\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or the signed-in identity changes (the\n    // credential source's identity epoch). A renewed token for the same\n    // identity reaches the next re-mint through `getToken`, so a renewal\n    // does not tear the live connection down.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [assetId, access, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.synced}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  return {\n    doc: handle?.doc ?? null,\n    status: handle?.status ?? 'connecting',\n    synced: handle?.synced ?? false,\n    accessType: handle?.accessType ?? null,\n    error: handle?.error ?? null,\n    presence: handle?.getPresence() ?? [],\n    setPresence: (state) => handleRef.current?.setPresence(state),\n  };\n}\n\nconst EMPTY_SNAPSHOT = 'init|false||0';\n"],"names":["useAthenaConfig","useAthenaCredentialIdentityEpoch","useState","useRef","useEffect","connectGenericDoc","useMemo","useSyncExternalStore"],"mappings":";;;;;;AAoCO,SAAS,cACd,SACA,SACqB;AACrB,QAAM,SAASA,cAAAA,gBAAA;AACf,QAAM,gBAAgBC,8BAAAA,iCAAA;AACtB,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,QAAQ,SAAS,IAAIC,MAAAA,SAAkC,IAAI;AAClE,QAAM,YAAYC,MAAAA,OAAgC,IAAI;AAEtDC,QAAAA,UAAU,MAAM;AACd,UAAM,OAAOC,OAAAA,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,QACd,UAAU,OAAO;AAAA,MAAA;AAAA,IACnB,CACD;AACD,cAAU,UAAU;AACpB,cAAU,IAAI;AACd,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAMF,GAAG,CAAC,SAAS,QAAQ,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,aAAa,CAAC;AAEtF,QAAM,YAAYC,MAAAA,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEMC,QAAAA;AAAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACvF;AAAA,IACA,MAAM;AAAA,EAAA;AAIR,SAAO;AAAA,IACL,MAAK,iCAAQ,QAAO;AAAA,IACpB,SAAQ,iCAAQ,WAAU;AAAA,IAC1B,SAAQ,iCAAQ,WAAU;AAAA,IAC1B,aAAY,iCAAQ,eAAc;AAAA,IAClC,QAAO,iCAAQ,UAAS;AAAA,IACxB,WAAU,iCAAQ,kBAAiB,CAAA;AAAA,IACnC,aAAa,CAAC,UAAA;;AAAU,6BAAU,YAAV,mBAAmB,YAAY;AAAA;AAAA,EAAK;AAEhE;AAEA,MAAM,iBAAiB;;"}

package/dist/collab/react.js

@@ -1,8 +1,10 @@
 import { useState, useRef, useEffect, useMemo, useSyncExternalStore } from "react";
+import { useAthenaCredentialIdentityEpoch } from "../auth/AthenaCredentialSourceContext.js";
 import { useAthenaConfig } from "../provider/AthenaContext.js";
 import { connectGenericDoc } from "./client.js";
 function useGenericDoc(assetId, options) {
   const config = useAthenaConfig();
+  const identityEpoch = useAthenaCredentialIdentityEpoch();
   const access = (options == null ? void 0 : options.access) ?? "view";
   const [handle, setHandle] = useState(null);
   const handleRef = useRef(null);
@@ -13,7 +15,8 @@ function useGenericDoc(assetId, options) {
       auth: {
         backendUrl: config.backendUrl,
         apiKey: config.apiKey,
-        token: config.token
+        token: config.token,
+        getToken: config.getToken
       }
     });
     handleRef.current = next;
@@ -22,7 +25,7 @@ function useGenericDoc(assetId, options) {
       handleRef.current = null;
       next.destroy();
     };
-  }, [assetId, access, config.backendUrl, config.apiKey, config.token]);
+  }, [assetId, access, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);
   const subscribe = useMemo(() => {
     return (onStoreChange) => {
       if (!handle) return () => {

package/dist/collab/react.js.map

@@ -1 +1 @@
-{"version":3,"file":"react.js","sources":["../../src/collab/react.ts"],"sourcesContent":["/**\n * React bindings for Generic Doc live collaboration.\n *\n * `useGenericDoc(assetId)` opens (and owns) a `connectGenericDoc` handle,\n * resolving auth from the surrounding `AthenaProvider` (per-viewer bearer when\n * present, API key otherwise) and re-rendering on status/presence changes via\n * `useSyncExternalStore`.\n */\n\nimport { useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type GenericDocHandle,\n  type GenericDocStatus,\n  type PresenceEntry,\n  connectGenericDoc,\n} from './client';\nimport type * as Y from '@y/y';\n\nexport interface UseGenericDocResult {\n  /** Null until the handle is created (first render effect). */\n  doc: Y.Doc | null;\n  status: GenericDocStatus;\n  /**\n   * Whether the initial server sync completed for the current connection —\n   * `status === 'connected'` fires before the server state arrives, so gate\n   * \"is this doc really empty?\" UI on this.\n   */\n  synced: boolean;\n  accessType: 'r' | 'rw' | null;\n  error: Error | null;\n  presence: PresenceEntry[];\n  setPresence: (state: Record<string, unknown> | null) => void;\n}\n\nexport function useGenericDoc(\n  assetId: string,\n  options?: { access?: 'view' | 'edit' }\n): UseGenericDocResult {\n  const config = useAthenaConfig();\n  const access = options?.access ?? 'view';\n  const [handle, setHandle] = useState<GenericDocHandle | null>(null);\n  const handleRef = useRef<GenericDocHandle | null>(null);\n\n  useEffect(() => {\n    const next = connectGenericDoc({\n      assetId,\n      access,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n      },\n    });\n    handleRef.current = next;\n    setHandle(next);\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or credentials change; the handle re-mints on\n    // its own schedule otherwise.\n  }, [assetId, access, config.backendUrl, config.apiKey, config.token]);\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.synced}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  return {\n    doc: handle?.doc ?? null,\n    status: handle?.status ?? 'connecting',\n    synced: handle?.synced ?? false,\n    accessType: handle?.accessType ?? null,\n    error: handle?.error ?? null,\n    presence: handle?.getPresence() ?? [],\n    setPresence: (state) => handleRef.current?.setPresence(state),\n  };\n}\n\nconst EMPTY_SNAPSHOT = 'init|false||0';\n"],"names":[],"mappings":";;;AAmCO,SAAS,cACd,SACA,SACqB;AACrB,QAAM,SAAS,gBAAA;AACf,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAkC,IAAI;AAClE,QAAM,YAAY,OAAgC,IAAI;AAEtD,YAAU,MAAM;AACd,UAAM,OAAO,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,MAAA;AAAA,IAChB,CACD;AACD,cAAU,UAAU;AACpB,cAAU,IAAI;AACd,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAGF,GAAG,CAAC,SAAS,QAAQ,OAAO,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC;AAEpE,QAAM,YAAY,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEM;AAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACvF;AAAA,IACA,MAAM;AAAA,EAAA;AAIR,SAAO;AAAA,IACL,MAAK,iCAAQ,QAAO;AAAA,IACpB,SAAQ,iCAAQ,WAAU;AAAA,IAC1B,SAAQ,iCAAQ,WAAU;AAAA,IAC1B,aAAY,iCAAQ,eAAc;AAAA,IAClC,QAAO,iCAAQ,UAAS;AAAA,IACxB,WAAU,iCAAQ,kBAAiB,CAAA;AAAA,IACnC,aAAa,CAAC,UAAA;;AAAU,6BAAU,YAAV,mBAAmB,YAAY;AAAA;AAAA,EAAK;AAEhE;AAEA,MAAM,iBAAiB;"}
+{"version":3,"file":"react.js","sources":["../../src/collab/react.ts"],"sourcesContent":["/**\n * React bindings for Generic Doc live collaboration.\n *\n * `useGenericDoc(assetId)` opens (and owns) a `connectGenericDoc` handle,\n * resolving auth from the surrounding `AthenaProvider` (per-viewer bearer when\n * present, API key otherwise) and re-rendering on status/presence changes via\n * `useSyncExternalStore`.\n */\n\nimport { useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';\nimport { useAthenaCredentialIdentityEpoch } from '../auth/AthenaCredentialSourceContext';\nimport { useAthenaConfig } from '../provider/AthenaContext';\nimport {\n  type GenericDocHandle,\n  type GenericDocStatus,\n  type PresenceEntry,\n  connectGenericDoc,\n} from './client';\nimport type * as Y from '@y/y';\n\nexport interface UseGenericDocResult {\n  /** Null until the handle is created (first render effect). */\n  doc: Y.Doc | null;\n  status: GenericDocStatus;\n  /**\n   * Whether the initial server sync completed for the current connection —\n   * `status === 'connected'` fires before the server state arrives, so gate\n   * \"is this doc really empty?\" UI on this.\n   */\n  synced: boolean;\n  accessType: 'r' | 'rw' | null;\n  error: Error | null;\n  presence: PresenceEntry[];\n  setPresence: (state: Record<string, unknown> | null) => void;\n}\n\nexport function useGenericDoc(\n  assetId: string,\n  options?: { access?: 'view' | 'edit' }\n): UseGenericDocResult {\n  const config = useAthenaConfig();\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  const access = options?.access ?? 'view';\n  const [handle, setHandle] = useState<GenericDocHandle | null>(null);\n  const handleRef = useRef<GenericDocHandle | null>(null);\n\n  useEffect(() => {\n    const next = connectGenericDoc({\n      assetId,\n      access,\n      auth: {\n        backendUrl: config.backendUrl,\n        apiKey: config.apiKey,\n        token: config.token,\n        getToken: config.getToken,\n      },\n    });\n    handleRef.current = next;\n    setHandle(next);\n    return () => {\n      handleRef.current = null;\n      next.destroy();\n    };\n    // Recreate when the target or the signed-in identity changes (the\n    // credential source's identity epoch). A renewed token for the same\n    // identity reaches the next re-mint through `getToken`, so a renewal\n    // does not tear the live connection down.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [assetId, access, config.backendUrl, config.apiKey, config.getToken, identityEpoch]);\n\n  const subscribe = useMemo(() => {\n    return (onStoreChange: () => void) => {\n      if (!handle) return () => {};\n      return handle.onChange(onStoreChange);\n    };\n  }, [handle]);\n\n  const snapshot = useSyncExternalStore(\n    subscribe,\n    () => {\n      if (!handle) return EMPTY_SNAPSHOT;\n      return `${handle.status}|${handle.synced}|${handle.accessType ?? ''}|${handle.version}`;\n    },\n    () => EMPTY_SNAPSHOT\n  );\n  void snapshot;\n\n  return {\n    doc: handle?.doc ?? null,\n    status: handle?.status ?? 'connecting',\n    synced: handle?.synced ?? false,\n    accessType: handle?.accessType ?? null,\n    error: handle?.error ?? null,\n    presence: handle?.getPresence() ?? [],\n    setPresence: (state) => handleRef.current?.setPresence(state),\n  };\n}\n\nconst EMPTY_SNAPSHOT = 'init|false||0';\n"],"names":[],"mappings":";;;;AAoCO,SAAS,cACd,SACA,SACqB;AACrB,QAAM,SAAS,gBAAA;AACf,QAAM,gBAAgB,iCAAA;AACtB,QAAM,UAAS,mCAAS,WAAU;AAClC,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAkC,IAAI;AAClE,QAAM,YAAY,OAAgC,IAAI;AAEtD,YAAU,MAAM;AACd,UAAM,OAAO,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,MAAM;AAAA,QACJ,YAAY,OAAO;AAAA,QACnB,QAAQ,OAAO;AAAA,QACf,OAAO,OAAO;AAAA,QACd,UAAU,OAAO;AAAA,MAAA;AAAA,IACnB,CACD;AACD,cAAU,UAAU;AACpB,cAAU,IAAI;AACd,WAAO,MAAM;AACX,gBAAU,UAAU;AACpB,WAAK,QAAA;AAAA,IACP;AAAA,EAMF,GAAG,CAAC,SAAS,QAAQ,OAAO,YAAY,OAAO,QAAQ,OAAO,UAAU,aAAa,CAAC;AAEtF,QAAM,YAAY,QAAQ,MAAM;AAC9B,WAAO,CAAC,kBAA8B;AACpC,UAAI,CAAC,OAAQ,QAAO,MAAM;AAAA,MAAC;AAC3B,aAAO,OAAO,SAAS,aAAa;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEM;AAAA,IACf;AAAA,IACA,MAAM;AACJ,UAAI,CAAC,OAAQ,QAAO;AACpB,aAAO,GAAG,OAAO,MAAM,IAAI,OAAO,MAAM,IAAI,OAAO,cAAc,EAAE,IAAI,OAAO,OAAO;AAAA,IACvF;AAAA,IACA,MAAM;AAAA,EAAA;AAIR,SAAO;AAAA,IACL,MAAK,iCAAQ,QAAO;AAAA,IACpB,SAAQ,iCAAQ,WAAU;AAAA,IAC1B,SAAQ,iCAAQ,WAAU;AAAA,IAC1B,aAAY,iCAAQ,eAAc;AAAA,IAClC,QAAO,iCAAQ,UAAS;AAAA,IACxB,WAAU,iCAAQ,kBAAiB,CAAA;AAAA,IACnC,aAAa,CAAC,UAAA;;AAAU,6BAAU,YAAV,mBAAmB,YAAY;AAAA;AAAA,EAAK;AAEhE;AAEA,MAAM,iBAAiB;"}

package/dist/dictation/use-athena-dictation-engine.cjs

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const react = require("react");
 const AthenaContext = require("../provider/AthenaContext.cjs");
-const statewireAuthHeaders = require("../runtime/statewire-auth-headers.cjs");
+const credentialRenewal = require("../runtime/credential-renewal.cjs");
 const dictationEngine = require("./dictation-engine.cjs");
 const recordedDictationEngine = require("./recorded-dictation-engine.cjs");
 function transcriptionUploadUrl(backendUrl) {
@@ -28,17 +28,18 @@ function transcriptionUploadErrorMessage(status) {
 function createAthenaUploadTranscriber(getConfig) {
   return async (clip, { lang, signal }) => {
     const config = getConfig();
-    const headers = await statewireAuthHeaders.resolveStatewireAuthHeaders(config, { staleAuth: false });
-    const form = new FormData();
     const extension = clip.type.includes("mp4") ? "mp4" : clip.type.includes("ogg") ? "ogg" : "webm";
-    form.append("file", clip, `dictation.${extension}`);
-    if (lang) form.append("language", lang);
-    const response = await fetch(transcriptionUploadUrl(config.backendUrl), {
-      method: "POST",
-      headers,
-      body: form,
-      credentials: "include",
-      signal
+    const response = await credentialRenewal.sendWithCredentialRenewal(config, (headers) => {
+      const form = new FormData();
+      form.append("file", clip, `dictation.${extension}`);
+      if (lang) form.append("language", lang);
+      return fetch(transcriptionUploadUrl(config.backendUrl), {
+        method: "POST",
+        headers,
+        body: form,
+        credentials: "include",
+        signal
+      });
     });
     if (!response.ok) throw new Error(transcriptionUploadErrorMessage(response.status));
     const payload = await response.json();

package/dist/dictation/use-athena-dictation-engine.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-athena-dictation-engine.cjs","sources":["../../src/dictation/use-athena-dictation-engine.ts"],"sourcesContent":["import { useMemo, useRef } from 'react';\nimport { type AthenaConfig, useAthenaConfig } from '../provider/AthenaContext';\nimport { resolveStatewireAuthHeaders } from '../runtime/statewire-auth-headers';\nimport { createWebSpeechDictationEngine, type DictationEngine } from './dictation-engine';\nimport { createRecordedDictationEngine, type DictationTranscriber } from './recorded-dictation-engine';\n\ninterface UploadTranscriptionResponse {\n  transcript: string;\n}\n\n/** Agora's REST base from the configured backend URL (which may point at a nested endpoint). */\nexport function transcriptionUploadUrl(backendUrl: string): string {\n  return `${backendUrl.replace(/\\/api\\/assistant-ui\\/?$/, '').replace(/\\/$/, '')}/api/transcription/upload`;\n}\n\n/**\n * One line for the composer per way `/transcription/upload` refuses a clip.\n * The copy lives here, apart from the fetch, so it can be pinned by a test.\n */\nexport function transcriptionUploadErrorMessage(status: number): string {\n  switch (status) {\n    case 401:\n    case 403:\n      return 'Dictation is not available for this sign-in. Reload and try again.';\n    case 413:\n      return 'That recording is too long to transcribe.';\n    case 422:\n      return 'The dictation language was rejected. Use a BCP-47 tag such as en-US.';\n    case 429:\n      return 'Too many dictations in a row. Wait a moment and try again.';\n    case 503:\n      return 'Dictation is not set up on this server.';\n    default:\n      return `Transcription failed (${status}).`;\n  }\n}\n\n/**\n * Post a finished clip to agora's `/transcription/upload` route, which runs\n * it through Deepgram and returns the text. Credentials are read at call\n * time so a rotated token is picked up. The session language (host `lang`\n * or the document's) is forwarded so non-English speech is recognised as\n * such; the request is dropped when the engine aborts.\n */\nexport function createAthenaUploadTranscriber(\n  getConfig: () => Pick<AthenaConfig, 'backendUrl' | 'apiKey' | 'token' | 'getToken'>,\n): DictationTranscriber {\n  return async (clip, { lang, signal }) => {\n    const config = getConfig();\n    const headers = await resolveStatewireAuthHeaders(config, { staleAuth: false });\n    const form = new FormData();\n    const extension = clip.type.includes('mp4') ? 'mp4' : clip.type.includes('ogg') ? 'ogg' : 'webm';\n    form.append('file', clip, `dictation.${extension}`);\n    if (lang) form.append('language', lang);\n    const response = await fetch(transcriptionUploadUrl(config.backendUrl), {\n      method: 'POST',\n      headers,\n      body: form,\n      credentials: 'include',\n      signal,\n    });\n    if (!response.ok) throw new Error(transcriptionUploadErrorMessage(response.status));\n    const payload = (await response.json()) as UploadTranscriptionResponse;\n    return typeof payload.transcript === 'string' ? payload.transcript : '';\n  };\n}\n\n/**\n * The composer's default speech engine: record with `MediaRecorder`, then\n * transcribe the clip through agora (Deepgram). Falls back to the browser's\n * Web Speech API only where `MediaRecorder` is missing. A host-provided\n * `engine` always wins.\n */\nexport function useAthenaDictationEngine(override?: DictationEngine): DictationEngine {\n  const config = useAthenaConfig();\n  const configRef = useRef(config);\n  configRef.current = config;\n  return useMemo(() => {\n    if (override) return override;\n    const recorded = createRecordedDictationEngine({\n      transcribe: createAthenaUploadTranscriber(() => configRef.current),\n    });\n    return recorded.isSupported() ? recorded : createWebSpeechDictationEngine();\n  }, [override]);\n}\n"],"names":["resolveStatewireAuthHeaders","useAthenaConfig","useRef","useMemo","createRecordedDictationEngine","createWebSpeechDictationEngine"],"mappings":";;;;;;;AAWO,SAAS,uBAAuB,YAA4B;AACjE,SAAO,GAAG,WAAW,QAAQ,2BAA2B,EAAE,EAAE,QAAQ,OAAO,EAAE,CAAC;AAChF;AAMO,SAAS,gCAAgC,QAAwB;AACtE,UAAQ,QAAA;AAAA,IACN,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,yBAAyB,MAAM;AAAA,EAAA;AAE5C;AASO,SAAS,8BACd,WACsB;AACtB,SAAO,OAAO,MAAM,EAAE,MAAM,aAAa;AACvC,UAAM,SAAS,UAAA;AACf,UAAM,UAAU,MAAMA,qBAAAA,4BAA4B,QAAQ,EAAE,WAAW,OAAO;AAC9E,UAAM,OAAO,IAAI,SAAA;AACjB,UAAM,YAAY,KAAK,KAAK,SAAS,KAAK,IAAI,QAAQ,KAAK,KAAK,SAAS,KAAK,IAAI,QAAQ;AAC1F,SAAK,OAAO,QAAQ,MAAM,aAAa,SAAS,EAAE;AAClD,QAAI,KAAM,MAAK,OAAO,YAAY,IAAI;AACtC,UAAM,WAAW,MAAM,MAAM,uBAAuB,OAAO,UAAU,GAAG;AAAA,MACtE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM;AAAA,MACN,aAAa;AAAA,MACb;AAAA,IAAA,CACD;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,gCAAgC,SAAS,MAAM,CAAC;AAClF,UAAM,UAAW,MAAM,SAAS,KAAA;AAChC,WAAO,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAAA,EACvE;AACF;AAQO,SAAS,yBAAyB,UAA6C;AACpF,QAAM,SAASC,cAAAA,gBAAA;AACf,QAAM,YAAYC,MAAAA,OAAO,MAAM;AAC/B,YAAU,UAAU;AACpB,SAAOC,MAAAA,QAAQ,MAAM;AACnB,QAAI,SAAU,QAAO;AACrB,UAAM,WAAWC,wBAAAA,8BAA8B;AAAA,MAC7C,YAAY,8BAA8B,MAAM,UAAU,OAAO;AAAA,IAAA,CAClE;AACD,WAAO,SAAS,gBAAgB,WAAWC,gBAAAA,+BAAA;AAAA,EAC7C,GAAG,CAAC,QAAQ,CAAC;AACf;;;;;"}
+{"version":3,"file":"use-athena-dictation-engine.cjs","sources":["../../src/dictation/use-athena-dictation-engine.ts"],"sourcesContent":["import { useMemo, useRef } from 'react';\nimport { type AthenaConfig, useAthenaConfig } from '../provider/AthenaContext';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport { createWebSpeechDictationEngine, type DictationEngine } from './dictation-engine';\nimport { createRecordedDictationEngine, type DictationTranscriber } from './recorded-dictation-engine';\n\ninterface UploadTranscriptionResponse {\n  transcript: string;\n}\n\n/** Agora's REST base from the configured backend URL (which may point at a nested endpoint). */\nexport function transcriptionUploadUrl(backendUrl: string): string {\n  return `${backendUrl.replace(/\\/api\\/assistant-ui\\/?$/, '').replace(/\\/$/, '')}/api/transcription/upload`;\n}\n\n/**\n * One line for the composer per way `/transcription/upload` refuses a clip.\n * The copy lives here, apart from the fetch, so it can be pinned by a test.\n */\nexport function transcriptionUploadErrorMessage(status: number): string {\n  switch (status) {\n    case 401:\n    case 403:\n      return 'Dictation is not available for this sign-in. Reload and try again.';\n    case 413:\n      return 'That recording is too long to transcribe.';\n    case 422:\n      return 'The dictation language was rejected. Use a BCP-47 tag such as en-US.';\n    case 429:\n      return 'Too many dictations in a row. Wait a moment and try again.';\n    case 503:\n      return 'Dictation is not set up on this server.';\n    default:\n      return `Transcription failed (${status}).`;\n  }\n}\n\n/**\n * Post a finished clip to agora's `/transcription/upload` route, which runs\n * it through Deepgram and returns the text. Credentials are read at call\n * time so a rotated token is picked up, and a `401` gets one forced renewal\n * (`getToken({ force: true })`) and a resend before it fails. The session\n * language (host `lang` or the document's) is forwarded so non-English speech\n * is recognised as such; the request is dropped when the engine aborts.\n */\nexport function createAthenaUploadTranscriber(\n  getConfig: () => Pick<AthenaConfig, 'backendUrl' | 'apiKey' | 'token' | 'getToken'>,\n): DictationTranscriber {\n  return async (clip, { lang, signal }) => {\n    const config = getConfig();\n    const extension = clip.type.includes('mp4') ? 'mp4' : clip.type.includes('ogg') ? 'ogg' : 'webm';\n    const response = await sendWithCredentialRenewal(config, (headers) => {\n      // A request body is single-use: every attempt builds its own form.\n      const form = new FormData();\n      form.append('file', clip, `dictation.${extension}`);\n      if (lang) form.append('language', lang);\n      return fetch(transcriptionUploadUrl(config.backendUrl), {\n        method: 'POST',\n        headers,\n        body: form,\n        credentials: 'include',\n        signal,\n      });\n    });\n    if (!response.ok) throw new Error(transcriptionUploadErrorMessage(response.status));\n    const payload = (await response.json()) as UploadTranscriptionResponse;\n    return typeof payload.transcript === 'string' ? payload.transcript : '';\n  };\n}\n\n/**\n * The composer's default speech engine: record with `MediaRecorder`, then\n * transcribe the clip through agora (Deepgram). Falls back to the browser's\n * Web Speech API only where `MediaRecorder` is missing. A host-provided\n * `engine` always wins.\n */\nexport function useAthenaDictationEngine(override?: DictationEngine): DictationEngine {\n  const config = useAthenaConfig();\n  const configRef = useRef(config);\n  configRef.current = config;\n  return useMemo(() => {\n    if (override) return override;\n    const recorded = createRecordedDictationEngine({\n      transcribe: createAthenaUploadTranscriber(() => configRef.current),\n    });\n    return recorded.isSupported() ? recorded : createWebSpeechDictationEngine();\n  }, [override]);\n}\n"],"names":["sendWithCredentialRenewal","useAthenaConfig","useRef","useMemo","createRecordedDictationEngine","createWebSpeechDictationEngine"],"mappings":";;;;;;;AAWO,SAAS,uBAAuB,YAA4B;AACjE,SAAO,GAAG,WAAW,QAAQ,2BAA2B,EAAE,EAAE,QAAQ,OAAO,EAAE,CAAC;AAChF;AAMO,SAAS,gCAAgC,QAAwB;AACtE,UAAQ,QAAA;AAAA,IACN,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,yBAAyB,MAAM;AAAA,EAAA;AAE5C;AAUO,SAAS,8BACd,WACsB;AACtB,SAAO,OAAO,MAAM,EAAE,MAAM,aAAa;AACvC,UAAM,SAAS,UAAA;AACf,UAAM,YAAY,KAAK,KAAK,SAAS,KAAK,IAAI,QAAQ,KAAK,KAAK,SAAS,KAAK,IAAI,QAAQ;AAC1F,UAAM,WAAW,MAAMA,kBAAAA,0BAA0B,QAAQ,CAAC,YAAY;AAEpE,YAAM,OAAO,IAAI,SAAA;AACjB,WAAK,OAAO,QAAQ,MAAM,aAAa,SAAS,EAAE;AAClD,UAAI,KAAM,MAAK,OAAO,YAAY,IAAI;AACtC,aAAO,MAAM,uBAAuB,OAAO,UAAU,GAAG;AAAA,QACtD,QAAQ;AAAA,QACR;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb;AAAA,MAAA,CACD;AAAA,IACH,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,gCAAgC,SAAS,MAAM,CAAC;AAClF,UAAM,UAAW,MAAM,SAAS,KAAA;AAChC,WAAO,OAAO,QAAQ,eAAe,WAAW,QAAQ,aAAa;AAAA,EACvE;AACF;AAQO,SAAS,yBAAyB,UAA6C;AACpF,QAAM,SAASC,cAAAA,gBAAA;AACf,QAAM,YAAYC,MAAAA,OAAO,MAAM;AAC/B,YAAU,UAAU;AACpB,SAAOC,MAAAA,QAAQ,MAAM;AACnB,QAAI,SAAU,QAAO;AACrB,UAAM,WAAWC,wBAAAA,8BAA8B;AAAA,MAC7C,YAAY,8BAA8B,MAAM,UAAU,OAAO;AAAA,IAAA,CAClE;AACD,WAAO,SAAS,gBAAgB,WAAWC,gBAAAA,+BAAA;AAAA,EAC7C,GAAG,CAAC,QAAQ,CAAC;AACf;;;;;"}