@athenaintel/react 0.42.2 → 0.48.0

package/dist/assets/use-asset-embed.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-asset-embed.js","sources":["../../src/assets/use-asset-embed.ts"],"sourcesContent":["import { QueryClient, QueryClientContext, useQuery } from '@tanstack/react-query';\nimport { useContext, useRef } from 'react';\nimport { deriveAthenaAppUrl } from '../lib/athena-urls';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport type { AthenaAssetCitationReference } from './asset-embed-messages';\n\nexport interface UseAssetEmbedOptions {\n  readOnly?: boolean;\n  expiresInSeconds?: number;\n  /** Native Olympus surface rendered by the iframe. Defaults to `full`. */\n  displayMode?: 'minimal' | 'full';\n  /**\n   * Offer Quick Edit (⌘J, an AI rewrite of the selection) in a minimal embed, where the viewer\n   * does not sign in: spreadsheets and Word documents, on an editable link (`readOnly: false`)\n   * only. Its runs are billed to the asset's workspace under the link's creator, and each link has\n   * its own hourly cap. The full mode's editors offer it to the signed-in person already. Defaults\n   * to `false`.\n   */\n  allowQuickEdit?: boolean;\n}\n\nexport const DEFAULT_ASSET_EMBED_READ_ONLY = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT = false;\nexport const DEFAULT_ASSET_EMBED_DISPLAY_MODE = 'full' as const;\n\nexport interface UseAssetEmbedResult {\n  embedUrl: string | null;\n  isLoading: boolean;\n  error: string | null;\n}\n\nexport function buildAssetEmbedRequestBody({\n  assetId,\n  readOnly,\n  expiresInSeconds,\n  displayMode,\n  allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n}: {\n  assetId: string;\n  readOnly: boolean;\n  expiresInSeconds: number;\n  displayMode: 'minimal' | 'full';\n  allowQuickEdit?: boolean;\n}) {\n  return {\n    asset_id: assetId,\n    read_only: readOnly,\n    expires_in_seconds: expiresInSeconds,\n    display_mode: displayMode,\n    // Sent only when asked: an agora that predates it is never handed an unknown field.\n    ...(allowQuickEdit && { allow_quick_edit: true }),\n  };\n}\n\n/**\n * The embed links' query client when the host provides none: one for the page, so every embed of\n * one asset, mode and identity shares one minted link until it expires.\n */\nconst embedQueryClient = new QueryClient();\n\nconst ATHENA_APP_HOSTNAMES = new Set(['app.athenaintel.com', 'staging-app.athenaintel.com']);\nconst ATHENA_PREVIEW_HOSTNAME_SUFFIX = '.previews.athenaintel.com';\nconst ATHENA_WORKSPACE_HOSTNAME_PATTERN = /^.+--(\\d+)\\.(?:app\\.athenaintel\\.com|staging-app\\.athenaintel\\.com)$/;\nconst OLYMPUS_WORKSPACE_PORT = '8082';\n\nconst getUrl = (value?: string | null): URL | null => {\n  if (!value) {\n    return null;\n  }\n\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n};\n\nconst getCurrentOrigin = (): string | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n\n  return window.location.origin;\n};\n\nconst getOrigin = (value?: string | null): string | null => getUrl(value)?.origin ?? null;\n\nconst getAthenaWorkspacePort = (url: URL): string | null => {\n  const match = url.hostname.toLowerCase().match(ATHENA_WORKSPACE_HOSTNAME_PATTERN);\n  return match?.[1] ?? null;\n};\n\nconst isEmbedCapableAthenaHost = (url: URL): boolean => {\n  const hostname = url.hostname.toLowerCase();\n\n  if (ATHENA_APP_HOSTNAMES.has(hostname) || hostname.endsWith(ATHENA_PREVIEW_HOSTNAME_SUFFIX)) {\n    return true;\n  }\n\n  return getAthenaWorkspacePort(url) === OLYMPUS_WORKSPACE_PORT;\n};\n\nconst shouldPreferDerivedEmbedAppUrl = ({\n  appUrl,\n  derivedAppUrl,\n  currentOrigin,\n}: {\n  appUrl: string;\n  derivedAppUrl: string | null;\n  currentOrigin?: string | null;\n}): boolean => {\n  if (!derivedAppUrl) {\n    return false;\n  }\n\n  const resolvedAppUrl = getUrl(appUrl);\n  if (!resolvedAppUrl) {\n    return true;\n  }\n\n  const workspacePort = getAthenaWorkspacePort(resolvedAppUrl);\n  if (workspacePort && workspacePort !== OLYMPUS_WORKSPACE_PORT) {\n    return true;\n  }\n\n  if (isEmbedCapableAthenaHost(resolvedAppUrl)) {\n    return false;\n  }\n\n  const resolvedCurrentOrigin = getOrigin(currentOrigin ?? getCurrentOrigin());\n  return !!resolvedCurrentOrigin && resolvedAppUrl.origin === resolvedCurrentOrigin;\n};\n\nconst resolveEmbedAppUrl = ({\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string | null => {\n  const derivedAppUrl = deriveAthenaAppUrl({ backendUrl });\n\n  if (!appUrl) {\n    return derivedAppUrl;\n  }\n\n  if (shouldPreferDerivedEmbedAppUrl({ appUrl, derivedAppUrl, currentOrigin })) {\n    return derivedAppUrl;\n  }\n\n  return appUrl;\n};\n\nexport function resolveAssetEmbedUrl({\n  embedUrl,\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  embedUrl: string;\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string {\n  try {\n    const resolvedEmbedUrl = new URL(embedUrl);\n    if (!resolvedEmbedUrl.pathname.startsWith('/embed/')) {\n      return embedUrl;\n    }\n\n    const embedAppUrl = resolveEmbedAppUrl({\n      appUrl,\n      backendUrl,\n      currentOrigin,\n    });\n    if (!embedAppUrl) {\n      return embedUrl;\n    }\n\n    const resolvedAppUrl = new URL(embedAppUrl);\n    resolvedEmbedUrl.protocol = resolvedAppUrl.protocol;\n    resolvedEmbedUrl.host = resolvedAppUrl.host;\n    return resolvedEmbedUrl.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nfunction setFiniteNumberParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    params.set(key, String(value));\n  }\n}\n\nfunction setNonEmptyStringParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'string' && value.length > 0) {\n    params.set(key, value);\n  }\n}\n\n/** The SDK's own embed parameter: it marks the bridge, never a place, so no anchor writes it. */\nconst SDK_BRIDGE_PARAM = 'athena_sdk_bridge';\n\n/**\n * The pairs of an anchor given as its raw query — the string an Athena link, citation or search\n * result carries (`anchor=slide&slide_index=3&slide_id=…`, `anchor=time&time=0:42`), alone or\n * after the `?` of an asset ref (`asset_x?anchor=…`) — read as URL parameters, or `null` when the\n * string holds none, or a parameter with no name. The SDK never interprets the anchor: the embed\n * page parses it with the references grammar, so every kind of place travels as written.\n */\nfunction rawAnchorQueryPairs(query: string): Array<[string, string]> | null {\n  const queryIndex = query.indexOf('?');\n  const search = queryIndex === -1 ? query : query.slice(queryIndex + 1);\n  const pairs = [...new URLSearchParams(search)].filter(([key]) => key !== SDK_BRIDGE_PARAM);\n  if (pairs.length === 0 || pairs.some(([key]) => key.length === 0)) return null;\n  return pairs;\n}\n\nfunction appendRawAnchorQuery({ params, query }: { params: URLSearchParams; query: string }): void {\n  const pairs = rawAnchorQueryPairs(query);\n  if (!pairs) return;\n  // Verbatim: a key the URL already has is replaced, and a repeated key keeps every value.\n  for (const [key] of pairs) params.delete(key);\n  for (const [key, value] of pairs) params.append(key, value);\n}\n\nfunction appendTypedAnchorParams({\n  params,\n  anchor,\n}: {\n  params: URLSearchParams;\n  anchor: object & { type: string };\n}): void {\n  switch (anchor.type) {\n    case 'page':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      break;\n    case 'page_range':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'start_page',\n        value: 'startPage' in anchor ? anchor.startPage : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'end_page',\n        value: 'endPage' in anchor ? anchor.endPage : undefined,\n      });\n      break;\n    case 'page_rect':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'x',\n        value: 'x' in anchor ? anchor.x : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'y',\n        value: 'y' in anchor ? anchor.y : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'width',\n        value: 'width' in anchor ? anchor.width : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'height',\n        value: 'height' in anchor ? anchor.height : undefined,\n      });\n      if (\n        'unit' in anchor &&\n        (anchor.unit === 'percent' || anchor.unit === 'point')\n      ) {\n        params.set('unit', anchor.unit);\n      }\n      break;\n    case 'page_text':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      if ('text' in anchor && typeof anchor.text === 'string') {\n        params.set('text', anchor.text);\n      }\n      // Optional context that disambiguates a repeated phrase, and the hash of\n      // the cited unit's normalized text; the embed parses both with the shared\n      // `@athenaintel/references` parser.\n      setNonEmptyStringParam({ params, key: 'prefix', value: 'prefix' in anchor ? anchor.prefix : undefined });\n      setNonEmptyStringParam({ params, key: 'suffix', value: 'suffix' in anchor ? anchor.suffix : undefined });\n      setNonEmptyStringParam({ params, key: 'hash', value: 'hash' in anchor ? anchor.hash : undefined });\n      break;\n    // Sheet anchors ride the same query contract the embed page parses with\n    // the shared `@athenaintel/references` parser.\n    case 'sheet_cell':\n    case 'sheet_range':\n    case 'sheet_tab':\n    case 'sheet_table':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'sheet_id',\n        value: 'sheetId' in anchor ? anchor.sheetId : undefined,\n      });\n      if ('cell' in anchor && typeof anchor.cell === 'string') {\n        params.set('cell', anchor.cell);\n      }\n      if ('range' in anchor && typeof anchor.range === 'string') {\n        params.set('range', anchor.range);\n      }\n      if ('tableName' in anchor && typeof anchor.tableName === 'string') {\n        params.set('table_name', anchor.tableName);\n      }\n      if ('fallbackRange' in anchor && typeof anchor.fallbackRange === 'string') {\n        params.set('fallback_range', anchor.fallbackRange);\n      }\n      break;\n  }\n}\n\n/**\n * Writes a citation's place into an embed URL: its anchor and its excerpt (the passage the embed\n * finds by its words — alone, when the citation names no anchor). The anchor is either its raw\n * query string, forwarded as written whatever kind of place it names, or one of the typed page and\n * sheet anchors. Athena on the web's Spaces links read the same grammar, so a host that opens a\n * cited place there writes it the same way.\n */\nexport function appendCitationReferenceParams({\n  params,\n  reference,\n}: {\n  params: URLSearchParams;\n  reference?: AthenaAssetCitationReference;\n}): void {\n  const anchor = reference?.anchor;\n  if (typeof anchor === 'string') {\n    appendRawAnchorQuery({ params, query: anchor });\n  } else if (anchor && typeof anchor === 'object' && 'type' in anchor && typeof anchor.type === 'string') {\n    appendTypedAnchorParams({ params, anchor: { ...anchor, type: anchor.type } });\n  }\n\n  const excerpt = reference?.meta?.excerpt;\n  if (typeof excerpt === 'string' && excerpt) {\n    params.set('excerpt', excerpt);\n  }\n}\n\nexport function buildSdkAssetEmbedUrl(embedUrl: string, reference?: AthenaAssetCitationReference): string {\n  try {\n    const url = new URL(embedUrl);\n    url.searchParams.set('athena_sdk_bridge', '1');\n    appendCitationReferenceParams({ params: url.searchParams, reference });\n    return url.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nconst getJwtPayload = (token: string): Record<string, unknown> | null => {\n  try {\n    const payloadSegment = token.split('.')[1];\n    if (!payloadSegment || typeof atob !== 'function') return null;\n    const normalized = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');\n    const payload: unknown = JSON.parse(\n      atob(normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=')),\n    );\n    return payload && typeof payload === 'object' ? (payload as Record<string, unknown>) : null;\n  } catch {\n    return null;\n  }\n};\n\nexport function getAssetEmbedAuthContext({ token, apiKey }: { token?: string | null; apiKey?: string }): string {\n  if (!token) return apiKey ? `api-key:${apiKey}` : 'anonymous';\n\n  const payload = getJwtPayload(token);\n  const userId = payload?.user_id ?? payload?.sub;\n  if (typeof userId !== 'string' || !userId) return `opaque-token:${token}`;\n\n  return `jwt:${JSON.stringify({\n    issuer: payload?.iss ?? null,\n    userId,\n    activeOrgId: payload?.active_org_id ?? payload?.org_id ?? null,\n    workspaceId: payload?.workspace_id ?? null,\n    orgMemberships: payload?.org_id_to_org_member_info ?? null,\n  })}`;\n}\n\n/**\n * Hook to generate an embed URL for rendering an asset in an iframe.\n * Calls the Athena embed token endpoint through TanStack Query (the host's\n * QueryClient when there is one, else the page's embed client), keyed on the\n * asset, the mode and the identity.\n *\n * Note: The auth token is read via a ref and is intentionally NOT part\n * of the query key. PropelAuth and similar providers refresh the token value\n * periodically (e.g. on window focus), but the underlying session is the\n * same — minting again on every token rotation would force the iframe to\n * reload unnecessarily. The link is minted again only when the identity\n * (user or tenant), the asset or the mode changes.\n */\nexport function useAssetEmbed(\n  assetId: string | null,\n  options: UseAssetEmbedOptions & {\n    backendUrl: string;\n    appUrl?: string;\n    apiKey?: string;\n    token?: string | null;\n    /**\n     * Live token resolver (the provider's `config.getToken`) that renews the\n     * held `token`: read before the embed-token request, and asked for a\n     * renewed token (`force: true`) when the backend refuses it. Ignored when\n     * no token is held, so the request always authenticates as the identity\n     * the embed cache is keyed on.\n     */\n    getToken?: AthenaStatewireTokenGetter;\n  } = {\n    backendUrl: '',\n  },\n): UseAssetEmbedResult {\n  const {\n    readOnly = DEFAULT_ASSET_EMBED_READ_ONLY,\n    expiresInSeconds = 60 * 60 * 24 * 30,\n    displayMode = DEFAULT_ASSET_EMBED_DISPLAY_MODE,\n    allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n    backendUrl,\n    appUrl,\n    apiKey,\n    token,\n    getToken,\n  } = options;\n  // Keep the latest token in a ref so the query can read it without being\n  // keyed on it: PropelAuth and similar providers rotate the token value.\n  const tokenRef = useRef(token);\n  tokenRef.current = token;\n  const getTokenRef = useRef(getToken);\n  getTokenRef.current = getToken;\n\n  // Stable across normal JWT rotations, but changes when the user or tenant\n  // changes so a signed URL can never be reused across auth boundaries.\n  const authContext = getAssetEmbedAuthContext({ token, apiKey });\n  const enabled = Boolean(assetId && backendUrl);\n\n  const query = useQuery(\n    {\n      queryKey: [\n        'athena-sdk',\n        'asset-embed',\n        assetId,\n        readOnly,\n        displayMode,\n        allowQuickEdit,\n        // The identity, never the credential: an opaque token or a key is part of `authContext`.\n        keyPartFingerprint(authContext),\n        backendUrl,\n        appUrl ?? '',\n      ],\n      queryFn: async ({ signal }): Promise<{ url: string; expiresAt: number }> => {\n        // Derive the Athena API base from backendUrl before calling the embed endpoint.\n        const apiBaseUrl = backendUrl.replace(/\\/api\\/assistant-ui\\/?$/, '');\n        const heldToken = tokenRef.current;\n        const res = await sendWithCredentialRenewal(\n          { apiKey, token: heldToken, getToken: heldToken ? getTokenRef.current : undefined },\n          (headers) =>\n            fetch(`${apiBaseUrl}/api/embed/generate-token`, {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json', ...headers },\n              body: JSON.stringify(\n                buildAssetEmbedRequestBody({\n                  assetId: assetId ?? '',\n                  readOnly,\n                  expiresInSeconds,\n                  displayMode,\n                  allowQuickEdit,\n                }),\n              ),\n              signal,\n            }),\n        );\n        if (!res.ok) {\n          const text = await res.text().catch(() => '');\n          throw new Error(`Failed to generate embed token (${res.status}): ${text}`);\n        }\n        const data: { embed_url: string; expires_at: number } = await res.json();\n        return {\n          url: resolveAssetEmbedUrl({ embedUrl: data.embed_url, appUrl, backendUrl }),\n          expiresAt: data.expires_at,\n        };\n      },\n      enabled,\n      // A minted link is good until it expires; a new one would reload the frame, so it is never\n      // minted again while the embed shows (no refetch on focus or reconnect) and never retried.\n      staleTime: (cached) =>\n        cached.state.data ? Math.max(0, cached.state.data.expiresAt * 1000 - Date.now()) : 0,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n      retry: false,\n    },\n    useContext(QueryClientContext) ?? embedQueryClient,\n  );\n\n  return {\n    embedUrl: enabled ? (query.data?.url ?? null) : null,\n    isLoading: enabled && query.isLoading,\n    error: enabled && query.error ? query.error.message : null,\n  };\n}\n"],"names":[],"mappings":";;;;;AAuBO,MAAM,gCAAgC;AACtC,MAAM,uCAAuC;AAC7C,MAAM,mCAAmC;AAQzC,SAAS,2BAA2B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAiB;AACnB,GAMG;AACD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW;AAAA,IACX,oBAAoB;AAAA,IACpB,cAAc;AAAA;AAAA,IAEd,GAAI,kBAAkB,EAAE,kBAAkB,KAAA;AAAA,EAAK;AAEnD;AAMA,MAAM,mBAAmB,IAAI,YAAA;AAE7B,MAAM,uBAAuB,oBAAI,IAAI,CAAC,uBAAuB,6BAA6B,CAAC;AAC3F,MAAM,iCAAiC;AACvC,MAAM,oCAAoC;AAC1C,MAAM,yBAAyB;AAE/B,MAAM,SAAS,CAAC,UAAsC;AACpD,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,mBAAmB,MAAqB;AAC5C,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,SAAS;AACzB;AAEA,MAAM,YAAY,CAAC,UAAA;;AAAyC,uBAAO,KAAK,MAAZ,mBAAe,WAAU;AAAA;AAErF,MAAM,yBAAyB,CAAC,QAA4B;AAC1D,QAAM,QAAQ,IAAI,SAAS,YAAA,EAAc,MAAM,iCAAiC;AAChF,UAAO,+BAAQ,OAAM;AACvB;AAEA,MAAM,2BAA2B,CAAC,QAAsB;AACtD,QAAM,WAAW,IAAI,SAAS,YAAA;AAE9B,MAAI,qBAAqB,IAAI,QAAQ,KAAK,SAAS,SAAS,8BAA8B,GAAG;AAC3F,WAAO;AAAA,EACT;AAEA,SAAO,uBAAuB,GAAG,MAAM;AACzC;AAEA,MAAM,iCAAiC,CAAC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,MAIe;AACb,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,OAAO,MAAM;AACpC,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,uBAAuB,cAAc;AAC3D,MAAI,iBAAiB,kBAAkB,wBAAwB;AAC7D,WAAO;AAAA,EACT;AAEA,MAAI,yBAAyB,cAAc,GAAG;AAC5C,WAAO;AAAA,EACT;AAEA,QAAM,wBAAwB,UAAU,iBAAiB,iBAAA,CAAkB;AAC3E,SAAO,CAAC,CAAC,yBAAyB,eAAe,WAAW;AAC9D;AAEA,MAAM,qBAAqB,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF,MAIqB;AACnB,QAAM,gBAAgB,mBAAmB,EAAE,YAAY;AAEvD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,MAAI,+BAA+B,EAAE,QAAQ,eAAe,cAAA,CAAe,GAAG;AAC5E,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKW;AACT,MAAI;AACF,UAAM,mBAAmB,IAAI,IAAI,QAAQ;AACzC,QAAI,CAAC,iBAAiB,SAAS,WAAW,SAAS,GAAG;AACpD,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,mBAAmB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AACD,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,IAAI,IAAI,WAAW;AAC1C,qBAAiB,WAAW,eAAe;AAC3C,qBAAiB,OAAO,eAAe;AACvC,WAAO,iBAAiB,SAAA;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,EAAE,QAAQ,KAAK,SAAyE;AACpH,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACvD,WAAO,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AACF;AAEA,SAAS,uBAAuB,EAAE,QAAQ,KAAK,SAAyE;AACtH,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,IAAI,KAAK,KAAK;AAAA,EACvB;AACF;AAGA,MAAM,mBAAmB;AASzB,SAAS,oBAAoB,OAA+C;AAC1E,QAAM,aAAa,MAAM,QAAQ,GAAG;AACpC,QAAM,SAAS,eAAe,KAAK,QAAQ,MAAM,MAAM,aAAa,CAAC;AACrE,QAAM,QAAQ,CAAC,GAAG,IAAI,gBAAgB,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,gBAAgB;AACzF,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAG,QAAO;AAC1E,SAAO;AACT;AAEA,SAAS,qBAAqB,EAAE,QAAQ,SAA2D;AACjG,QAAM,QAAQ,oBAAoB,KAAK;AACvC,MAAI,CAAC,MAAO;AAEZ,aAAW,CAAC,GAAG,KAAK,MAAO,QAAO,OAAO,GAAG;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,MAAO,QAAO,OAAO,KAAK,KAAK;AAC5D;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AACF,GAGS;AACP,UAAQ,OAAO,MAAA;AAAA,IACb,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,eAAe,SAAS,OAAO,YAAY;AAAA,MAAA,CACnD;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,WAAW,SAAS,OAAO,QAAQ;AAAA,MAAA,CAC3C;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,YAAY,SAAS,OAAO,SAAS;AAAA,MAAA,CAC7C;AACD,UACE,UAAU,WACT,OAAO,SAAS,aAAa,OAAO,SAAS,UAC9C;AACA,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AAIA,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,QAAQ,OAAO,UAAU,SAAS,OAAO,OAAO,OAAA,CAAW;AACjG;AAAA;AAAA;AAAA,IAGF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA,UAAI,WAAW,UAAU,OAAO,OAAO,UAAU,UAAU;AACzD,eAAO,IAAI,SAAS,OAAO,KAAK;AAAA,MAClC;AACA,UAAI,eAAe,UAAU,OAAO,OAAO,cAAc,UAAU;AACjE,eAAO,IAAI,cAAc,OAAO,SAAS;AAAA,MAC3C;AACA,UAAI,mBAAmB,UAAU,OAAO,OAAO,kBAAkB,UAAU;AACzE,eAAO,IAAI,kBAAkB,OAAO,aAAa;AAAA,MACnD;AACA;AAAA,EAAA;AAEN;AASO,SAAS,8BAA8B;AAAA,EAC5C;AAAA,EACA;AACF,GAGS;;AACP,QAAM,SAAS,uCAAW;AAC1B,MAAI,OAAO,WAAW,UAAU;AAC9B,yBAAqB,EAAE,QAAQ,OAAO,OAAA,CAAQ;AAAA,EAChD,WAAW,UAAU,OAAO,WAAW,YAAY,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACtG,4BAAwB,EAAE,QAAQ,QAAQ,EAAE,GAAG,QAAQ,MAAM,OAAO,KAAA,GAAQ;AAAA,EAC9E;AAEA,QAAM,WAAU,4CAAW,SAAX,mBAAiB;AACjC,MAAI,OAAO,YAAY,YAAY,SAAS;AAC1C,WAAO,IAAI,WAAW,OAAO;AAAA,EAC/B;AACF;AAEO,SAAS,sBAAsB,UAAkB,WAAkD;AACxG,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,QAAI,aAAa,IAAI,qBAAqB,GAAG;AAC7C,kCAA8B,EAAE,QAAQ,IAAI,cAAc,WAAW;AACrE,WAAO,IAAI,SAAA;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,gBAAgB,CAAC,UAAkD;AACvE,MAAI;AACF,UAAM,iBAAiB,MAAM,MAAM,GAAG,EAAE,CAAC;AACzC,QAAI,CAAC,kBAAkB,OAAO,SAAS,WAAY,QAAO;AAC1D,UAAM,aAAa,eAAe,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACtE,UAAM,UAAmB,KAAK;AAAA,MAC5B,KAAK,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,GAAG,CAAC;AAAA,IAAA;AAEtF,WAAO,WAAW,OAAO,YAAY,WAAY,UAAsC;AAAA,EACzF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yBAAyB,EAAE,OAAO,UAA8D;AAC9G,MAAI,CAAC,MAAO,QAAO,SAAS,WAAW,MAAM,KAAK;AAElD,QAAM,UAAU,cAAc,KAAK;AACnC,QAAM,UAAS,mCAAS,aAAW,mCAAS;AAC5C,MAAI,OAAO,WAAW,YAAY,CAAC,OAAQ,QAAO,gBAAgB,KAAK;AAEvE,SAAO,OAAO,KAAK,UAAU;AAAA,IAC3B,SAAQ,mCAAS,QAAO;AAAA,IACxB;AAAA,IACA,cAAa,mCAAS,mBAAiB,mCAAS,WAAU;AAAA,IAC1D,cAAa,mCAAS,iBAAgB;AAAA,IACtC,iBAAgB,mCAAS,8BAA6B;AAAA,EAAA,CACvD,CAAC;AACJ;AAeO,SAAS,cACd,SACA,UAaI;AAAA,EACF,YAAY;AACd,GACqB;;AACrB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,mBAAmB,KAAK,KAAK,KAAK;AAAA,IAClC,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,IACE;AAGJ,QAAM,WAAW,OAAO,KAAK;AAC7B,WAAS,UAAU;AACnB,QAAM,cAAc,OAAO,QAAQ;AACnC,cAAY,UAAU;AAItB,QAAM,cAAc,yBAAyB,EAAE,OAAO,QAAQ;AAC9D,QAAM,UAAU,QAAQ,WAAW,UAAU;AAE7C,QAAM,QAAQ;AAAA,IACZ;AAAA,MACE,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEA,mBAAmB,WAAW;AAAA,QAC9B;AAAA,QACA,UAAU;AAAA,MAAA;AAAA,MAEZ,SAAS,OAAO,EAAE,aAA0D;AAE1E,cAAM,aAAa,WAAW,QAAQ,2BAA2B,EAAE;AACnE,cAAM,YAAY,SAAS;AAC3B,cAAM,MAAM,MAAM;AAAA,UAChB,EAAE,QAAQ,OAAO,WAAW,UAAU,YAAY,YAAY,UAAU,OAAA;AAAA,UACxE,CAAC,YACC,MAAM,GAAG,UAAU,6BAA6B;AAAA,YAC9C,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,QAAA;AAAA,YAClD,MAAM,KAAK;AAAA,cACT,2BAA2B;AAAA,gBACzB,SAAS,WAAW;AAAA,gBACpB;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cAAA,CACD;AAAA,YAAA;AAAA,YAEH;AAAA,UAAA,CACD;AAAA,QAAA;AAEL,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,EAAE;AAC5C,gBAAM,IAAI,MAAM,mCAAmC,IAAI,MAAM,MAAM,IAAI,EAAE;AAAA,QAC3E;AACA,cAAM,OAAkD,MAAM,IAAI,KAAA;AAClE,eAAO;AAAA,UACL,KAAK,qBAAqB,EAAE,UAAU,KAAK,WAAW,QAAQ,YAAY;AAAA,UAC1E,WAAW,KAAK;AAAA,QAAA;AAAA,MAEpB;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,WAAW,CAAC,WACV,OAAO,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,YAAY,MAAO,KAAK,IAAA,CAAK,IAAI;AAAA,MACrF,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IAAA;AAAA,IAET,WAAW,kBAAkB,KAAK;AAAA,EAAA;AAGpC,SAAO;AAAA,IACL,UAAU,YAAW,WAAM,SAAN,mBAAY,QAAO,OAAQ;AAAA,IAChD,WAAW,WAAW,MAAM;AAAA,IAC5B,OAAO,WAAW,MAAM,QAAQ,MAAM,MAAM,UAAU;AAAA,EAAA;AAE1D;"}
+{"version":3,"file":"use-asset-embed.js","sources":["../../src/assets/use-asset-embed.ts"],"sourcesContent":["import { QueryClient, QueryClientContext, useQuery } from '@tanstack/react-query';\nimport { useContext, useRef } from 'react';\nimport { deriveAthenaAppUrl } from '../lib/athena-urls';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { sendWithCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport type { AthenaAssetCitationReference } from './asset-embed-messages';\n\nexport interface UseAssetEmbedOptions {\n  readOnly?: boolean;\n  expiresInSeconds?: number;\n  /** Native Olympus surface rendered by the iframe. Defaults to `full`. */\n  displayMode?: 'minimal' | 'full';\n  /**\n   * Offer Quick Edit (⌘J, an AI rewrite of the selection) in a minimal embed, where the viewer\n   * does not sign in: spreadsheets and Word documents, on an editable link (`readOnly: false`)\n   * only. Its runs are billed to the asset's workspace under the link's creator, and each link has\n   * its own hourly cap. The full mode's editors offer it to the signed-in person already. Defaults\n   * to `false`.\n   */\n  allowQuickEdit?: boolean;\n  /**\n   * Show the asset's comment threads, read-only, to everyone holding the link, a viewer who is not\n   * signed in included. Without it, a minimal embed shows them only to a signed-in viewer who has\n   * their own access to the asset (the bearer this component hands the iframe, or an Athena\n   * session). No embed ever writes a comment. Defaults to `false`.\n   */\n  allowComments?: boolean;\n}\n\nexport const DEFAULT_ASSET_EMBED_READ_ONLY = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT = false;\nexport const DEFAULT_ASSET_EMBED_ALLOW_COMMENTS = false;\nexport const DEFAULT_ASSET_EMBED_DISPLAY_MODE = 'full' as const;\n\nexport interface UseAssetEmbedResult {\n  embedUrl: string | null;\n  isLoading: boolean;\n  error: string | null;\n}\n\nexport function buildAssetEmbedRequestBody({\n  assetId,\n  readOnly,\n  expiresInSeconds,\n  displayMode,\n  allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n  allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n}: {\n  assetId: string;\n  readOnly: boolean;\n  expiresInSeconds: number;\n  displayMode: 'minimal' | 'full';\n  allowQuickEdit?: boolean;\n  allowComments?: boolean;\n}) {\n  return {\n    asset_id: assetId,\n    read_only: readOnly,\n    expires_in_seconds: expiresInSeconds,\n    display_mode: displayMode,\n    // Sent only when asked: an agora that predates it is never handed an unknown field.\n    ...(allowQuickEdit && { allow_quick_edit: true }),\n    ...(allowComments && { allow_comments: true }),\n  };\n}\n\n/**\n * The embed links' query client when the host provides none: one for the page, so every embed of\n * one asset, mode and identity shares one minted link until it expires.\n */\nconst embedQueryClient = new QueryClient();\n\nconst ATHENA_APP_HOSTNAMES = new Set(['app.athenaintel.com', 'staging-app.athenaintel.com']);\nconst ATHENA_PREVIEW_HOSTNAME_SUFFIX = '.previews.athenaintel.com';\nconst ATHENA_WORKSPACE_HOSTNAME_PATTERN = /^.+--(\\d+)\\.(?:app\\.athenaintel\\.com|staging-app\\.athenaintel\\.com)$/;\nconst OLYMPUS_WORKSPACE_PORT = '8082';\n\nconst getUrl = (value?: string | null): URL | null => {\n  if (!value) {\n    return null;\n  }\n\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n};\n\nconst getCurrentOrigin = (): string | null => {\n  if (typeof window === 'undefined') {\n    return null;\n  }\n\n  return window.location.origin;\n};\n\nconst getOrigin = (value?: string | null): string | null => getUrl(value)?.origin ?? null;\n\nconst getAthenaWorkspacePort = (url: URL): string | null => {\n  const match = url.hostname.toLowerCase().match(ATHENA_WORKSPACE_HOSTNAME_PATTERN);\n  return match?.[1] ?? null;\n};\n\nconst isEmbedCapableAthenaHost = (url: URL): boolean => {\n  const hostname = url.hostname.toLowerCase();\n\n  if (ATHENA_APP_HOSTNAMES.has(hostname) || hostname.endsWith(ATHENA_PREVIEW_HOSTNAME_SUFFIX)) {\n    return true;\n  }\n\n  return getAthenaWorkspacePort(url) === OLYMPUS_WORKSPACE_PORT;\n};\n\nconst shouldPreferDerivedEmbedAppUrl = ({\n  appUrl,\n  derivedAppUrl,\n  currentOrigin,\n}: {\n  appUrl: string;\n  derivedAppUrl: string | null;\n  currentOrigin?: string | null;\n}): boolean => {\n  if (!derivedAppUrl) {\n    return false;\n  }\n\n  const resolvedAppUrl = getUrl(appUrl);\n  if (!resolvedAppUrl) {\n    return true;\n  }\n\n  const workspacePort = getAthenaWorkspacePort(resolvedAppUrl);\n  if (workspacePort && workspacePort !== OLYMPUS_WORKSPACE_PORT) {\n    return true;\n  }\n\n  if (isEmbedCapableAthenaHost(resolvedAppUrl)) {\n    return false;\n  }\n\n  const resolvedCurrentOrigin = getOrigin(currentOrigin ?? getCurrentOrigin());\n  return !!resolvedCurrentOrigin && resolvedAppUrl.origin === resolvedCurrentOrigin;\n};\n\nconst resolveEmbedAppUrl = ({\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string | null => {\n  const derivedAppUrl = deriveAthenaAppUrl({ backendUrl });\n\n  if (!appUrl) {\n    return derivedAppUrl;\n  }\n\n  if (shouldPreferDerivedEmbedAppUrl({ appUrl, derivedAppUrl, currentOrigin })) {\n    return derivedAppUrl;\n  }\n\n  return appUrl;\n};\n\nexport function resolveAssetEmbedUrl({\n  embedUrl,\n  appUrl,\n  backendUrl,\n  currentOrigin,\n}: {\n  embedUrl: string;\n  appUrl?: string;\n  backendUrl?: string | null;\n  currentOrigin?: string | null;\n}): string {\n  try {\n    const resolvedEmbedUrl = new URL(embedUrl);\n    if (!resolvedEmbedUrl.pathname.startsWith('/embed/')) {\n      return embedUrl;\n    }\n\n    const embedAppUrl = resolveEmbedAppUrl({\n      appUrl,\n      backendUrl,\n      currentOrigin,\n    });\n    if (!embedAppUrl) {\n      return embedUrl;\n    }\n\n    const resolvedAppUrl = new URL(embedAppUrl);\n    resolvedEmbedUrl.protocol = resolvedAppUrl.protocol;\n    resolvedEmbedUrl.host = resolvedAppUrl.host;\n    return resolvedEmbedUrl.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nfunction setFiniteNumberParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'number' && Number.isFinite(value)) {\n    params.set(key, String(value));\n  }\n}\n\nfunction setNonEmptyStringParam({ params, key, value }: { params: URLSearchParams; key: string; value: unknown }): void {\n  if (typeof value === 'string' && value.length > 0) {\n    params.set(key, value);\n  }\n}\n\n/** The SDK's own embed parameter: it marks the bridge, never a place, so no anchor writes it. */\nconst SDK_BRIDGE_PARAM = 'athena_sdk_bridge';\n\n/**\n * The pairs of an anchor given as its raw query — the string an Athena link, citation or search\n * result carries (`anchor=slide&slide_index=3&slide_id=…`, `anchor=time&time=0:42`), alone or\n * after the `?` of an asset ref (`asset_x?anchor=…`) — read as URL parameters, or `null` when the\n * string holds none, or a parameter with no name. The SDK never interprets the anchor: the embed\n * page parses it with the references grammar, so every kind of place travels as written.\n */\nfunction rawAnchorQueryPairs(query: string): Array<[string, string]> | null {\n  const queryIndex = query.indexOf('?');\n  const search = queryIndex === -1 ? query : query.slice(queryIndex + 1);\n  const pairs = [...new URLSearchParams(search)].filter(([key]) => key !== SDK_BRIDGE_PARAM);\n  if (pairs.length === 0 || pairs.some(([key]) => key.length === 0)) return null;\n  return pairs;\n}\n\nfunction appendRawAnchorQuery({ params, query }: { params: URLSearchParams; query: string }): void {\n  const pairs = rawAnchorQueryPairs(query);\n  if (!pairs) return;\n  // Verbatim: a key the URL already has is replaced, and a repeated key keeps every value.\n  for (const [key] of pairs) params.delete(key);\n  for (const [key, value] of pairs) params.append(key, value);\n}\n\nfunction appendTypedAnchorParams({\n  params,\n  anchor,\n}: {\n  params: URLSearchParams;\n  anchor: object & { type: string };\n}): void {\n  switch (anchor.type) {\n    case 'page':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      break;\n    case 'page_range':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'start_page',\n        value: 'startPage' in anchor ? anchor.startPage : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'end_page',\n        value: 'endPage' in anchor ? anchor.endPage : undefined,\n      });\n      break;\n    case 'page_rect':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'x',\n        value: 'x' in anchor ? anchor.x : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'y',\n        value: 'y' in anchor ? anchor.y : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'width',\n        value: 'width' in anchor ? anchor.width : undefined,\n      });\n      setFiniteNumberParam({\n        params,\n        key: 'height',\n        value: 'height' in anchor ? anchor.height : undefined,\n      });\n      if (\n        'unit' in anchor &&\n        (anchor.unit === 'percent' || anchor.unit === 'point')\n      ) {\n        params.set('unit', anchor.unit);\n      }\n      break;\n    case 'page_text':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'page',\n        value: 'page' in anchor ? anchor.page : undefined,\n      });\n      if ('text' in anchor && typeof anchor.text === 'string') {\n        params.set('text', anchor.text);\n      }\n      // Optional context that disambiguates a repeated phrase, and the hash of\n      // the cited unit's normalized text; the embed parses both with the shared\n      // `@athenaintel/references` parser.\n      setNonEmptyStringParam({ params, key: 'prefix', value: 'prefix' in anchor ? anchor.prefix : undefined });\n      setNonEmptyStringParam({ params, key: 'suffix', value: 'suffix' in anchor ? anchor.suffix : undefined });\n      setNonEmptyStringParam({ params, key: 'hash', value: 'hash' in anchor ? anchor.hash : undefined });\n      break;\n    // Sheet anchors ride the same query contract the embed page parses with\n    // the shared `@athenaintel/references` parser.\n    case 'sheet_cell':\n    case 'sheet_range':\n    case 'sheet_tab':\n    case 'sheet_table':\n      params.set('anchor', anchor.type);\n      setFiniteNumberParam({\n        params,\n        key: 'sheet_id',\n        value: 'sheetId' in anchor ? anchor.sheetId : undefined,\n      });\n      if ('cell' in anchor && typeof anchor.cell === 'string') {\n        params.set('cell', anchor.cell);\n      }\n      if ('range' in anchor && typeof anchor.range === 'string') {\n        params.set('range', anchor.range);\n      }\n      if ('tableName' in anchor && typeof anchor.tableName === 'string') {\n        params.set('table_name', anchor.tableName);\n      }\n      if ('fallbackRange' in anchor && typeof anchor.fallbackRange === 'string') {\n        params.set('fallback_range', anchor.fallbackRange);\n      }\n      break;\n  }\n}\n\n/**\n * Writes a citation's place into an embed URL: its anchor and its excerpt (the passage the embed\n * finds by its words — alone, when the citation names no anchor). The anchor is either its raw\n * query string, forwarded as written whatever kind of place it names, or one of the typed page and\n * sheet anchors. Athena on the web's Spaces links read the same grammar, so a host that opens a\n * cited place there writes it the same way.\n */\nexport function appendCitationReferenceParams({\n  params,\n  reference,\n}: {\n  params: URLSearchParams;\n  reference?: AthenaAssetCitationReference;\n}): void {\n  const anchor = reference?.anchor;\n  if (typeof anchor === 'string') {\n    appendRawAnchorQuery({ params, query: anchor });\n  } else if (anchor && typeof anchor === 'object' && 'type' in anchor && typeof anchor.type === 'string') {\n    appendTypedAnchorParams({ params, anchor: { ...anchor, type: anchor.type } });\n  }\n\n  const excerpt = reference?.meta?.excerpt;\n  if (typeof excerpt === 'string' && excerpt) {\n    params.set('excerpt', excerpt);\n  }\n}\n\nexport function buildSdkAssetEmbedUrl(embedUrl: string, reference?: AthenaAssetCitationReference): string {\n  try {\n    const url = new URL(embedUrl);\n    url.searchParams.set('athena_sdk_bridge', '1');\n    appendCitationReferenceParams({ params: url.searchParams, reference });\n    return url.toString();\n  } catch {\n    return embedUrl;\n  }\n}\n\nconst getJwtPayload = (token: string): Record<string, unknown> | null => {\n  try {\n    const payloadSegment = token.split('.')[1];\n    if (!payloadSegment || typeof atob !== 'function') return null;\n    const normalized = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');\n    const payload: unknown = JSON.parse(\n      atob(normalized.padEnd(normalized.length + ((4 - (normalized.length % 4)) % 4), '=')),\n    );\n    return payload && typeof payload === 'object' ? (payload as Record<string, unknown>) : null;\n  } catch {\n    return null;\n  }\n};\n\nexport function getAssetEmbedAuthContext({ token, apiKey }: { token?: string | null; apiKey?: string }): string {\n  if (!token) return apiKey ? `api-key:${apiKey}` : 'anonymous';\n\n  const payload = getJwtPayload(token);\n  const userId = payload?.user_id ?? payload?.sub;\n  if (typeof userId !== 'string' || !userId) return `opaque-token:${token}`;\n\n  return `jwt:${JSON.stringify({\n    issuer: payload?.iss ?? null,\n    userId,\n    activeOrgId: payload?.active_org_id ?? payload?.org_id ?? null,\n    workspaceId: payload?.workspace_id ?? null,\n    orgMemberships: payload?.org_id_to_org_member_info ?? null,\n  })}`;\n}\n\n/**\n * Hook to generate an embed URL for rendering an asset in an iframe.\n * Calls the Athena embed token endpoint through TanStack Query (the host's\n * QueryClient when there is one, else the page's embed client), keyed on the\n * asset, the mode and the identity.\n *\n * Note: The auth token is read via a ref and is intentionally NOT part\n * of the query key. PropelAuth and similar providers refresh the token value\n * periodically (e.g. on window focus), but the underlying session is the\n * same — minting again on every token rotation would force the iframe to\n * reload unnecessarily. The link is minted again only when the identity\n * (user or tenant), the asset or the mode changes.\n */\nexport function useAssetEmbed(\n  assetId: string | null,\n  options: UseAssetEmbedOptions & {\n    backendUrl: string;\n    appUrl?: string;\n    apiKey?: string;\n    token?: string | null;\n    /**\n     * Live token resolver (the provider's `config.getToken`) that renews the\n     * held `token`: read before the embed-token request, and asked for a\n     * renewed token (`force: true`) when the backend refuses it. Ignored when\n     * no token is held, so the request always authenticates as the identity\n     * the embed cache is keyed on.\n     */\n    getToken?: AthenaStatewireTokenGetter;\n  } = {\n    backendUrl: '',\n  },\n): UseAssetEmbedResult {\n  const {\n    readOnly = DEFAULT_ASSET_EMBED_READ_ONLY,\n    expiresInSeconds = 60 * 60 * 24 * 30,\n    displayMode = DEFAULT_ASSET_EMBED_DISPLAY_MODE,\n    allowQuickEdit = DEFAULT_ASSET_EMBED_ALLOW_QUICK_EDIT,\n    allowComments = DEFAULT_ASSET_EMBED_ALLOW_COMMENTS,\n    backendUrl,\n    appUrl,\n    apiKey,\n    token,\n    getToken,\n  } = options;\n  // Keep the latest token in a ref so the query can read it without being\n  // keyed on it: PropelAuth and similar providers rotate the token value.\n  const tokenRef = useRef(token);\n  tokenRef.current = token;\n  const getTokenRef = useRef(getToken);\n  getTokenRef.current = getToken;\n\n  // Stable across normal JWT rotations, but changes when the user or tenant\n  // changes so a signed URL can never be reused across auth boundaries.\n  const authContext = getAssetEmbedAuthContext({ token, apiKey });\n  const enabled = Boolean(assetId && backendUrl);\n\n  const query = useQuery(\n    {\n      queryKey: [\n        'athena-sdk',\n        'asset-embed',\n        assetId,\n        readOnly,\n        displayMode,\n        allowQuickEdit,\n        allowComments,\n        // The identity, never the credential: an opaque token or a key is part of `authContext`.\n        keyPartFingerprint(authContext),\n        backendUrl,\n        appUrl ?? '',\n      ],\n      queryFn: async ({ signal }): Promise<{ url: string; expiresAt: number }> => {\n        // Derive the Athena API base from backendUrl before calling the embed endpoint.\n        const apiBaseUrl = backendUrl.replace(/\\/api\\/assistant-ui\\/?$/, '');\n        const heldToken = tokenRef.current;\n        const res = await sendWithCredentialRenewal(\n          { apiKey, token: heldToken, getToken: heldToken ? getTokenRef.current : undefined },\n          (headers) =>\n            fetch(`${apiBaseUrl}/api/embed/generate-token`, {\n              method: 'POST',\n              headers: { 'Content-Type': 'application/json', ...headers },\n              body: JSON.stringify(\n                buildAssetEmbedRequestBody({\n                  assetId: assetId ?? '',\n                  readOnly,\n                  expiresInSeconds,\n                  displayMode,\n                  allowQuickEdit,\n                  allowComments,\n                }),\n              ),\n              signal,\n            }),\n        );\n        if (!res.ok) {\n          const text = await res.text().catch(() => '');\n          throw new Error(`Failed to generate embed token (${res.status}): ${text}`);\n        }\n        const data: { embed_url: string; expires_at: number } = await res.json();\n        return {\n          url: resolveAssetEmbedUrl({ embedUrl: data.embed_url, appUrl, backendUrl }),\n          expiresAt: data.expires_at,\n        };\n      },\n      enabled,\n      // A minted link is good until it expires; a new one would reload the frame, so it is never\n      // minted again while the embed shows (no refetch on focus or reconnect) and never retried.\n      staleTime: (cached) =>\n        cached.state.data ? Math.max(0, cached.state.data.expiresAt * 1000 - Date.now()) : 0,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n      retry: false,\n    },\n    useContext(QueryClientContext) ?? embedQueryClient,\n  );\n\n  return {\n    embedUrl: enabled ? (query.data?.url ?? null) : null,\n    isLoading: enabled && query.isLoading,\n    error: enabled && query.error ? query.error.message : null,\n  };\n}\n"],"names":[],"mappings":";;;;;AA8BO,MAAM,gCAAgC;AACtC,MAAM,uCAAuC;AAC7C,MAAM,qCAAqC;AAC3C,MAAM,mCAAmC;AAQzC,SAAS,2BAA2B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAiB;AAAA,EACjB,gBAAgB;AAClB,GAOG;AACD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW;AAAA,IACX,oBAAoB;AAAA,IACpB,cAAc;AAAA;AAAA,IAEd,GAAI,kBAAkB,EAAE,kBAAkB,KAAA;AAAA,IAC1C,GAAI,iBAAiB,EAAE,gBAAgB,KAAA;AAAA,EAAK;AAEhD;AAMA,MAAM,mBAAmB,IAAI,YAAA;AAE7B,MAAM,uBAAuB,oBAAI,IAAI,CAAC,uBAAuB,6BAA6B,CAAC;AAC3F,MAAM,iCAAiC;AACvC,MAAM,oCAAoC;AAC1C,MAAM,yBAAyB;AAE/B,MAAM,SAAS,CAAC,UAAsC;AACpD,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,KAAK;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,mBAAmB,MAAqB;AAC5C,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,SAAS;AACzB;AAEA,MAAM,YAAY,CAAC,UAAA;;AAAyC,uBAAO,KAAK,MAAZ,mBAAe,WAAU;AAAA;AAErF,MAAM,yBAAyB,CAAC,QAA4B;AAC1D,QAAM,QAAQ,IAAI,SAAS,YAAA,EAAc,MAAM,iCAAiC;AAChF,UAAO,+BAAQ,OAAM;AACvB;AAEA,MAAM,2BAA2B,CAAC,QAAsB;AACtD,QAAM,WAAW,IAAI,SAAS,YAAA;AAE9B,MAAI,qBAAqB,IAAI,QAAQ,KAAK,SAAS,SAAS,8BAA8B,GAAG;AAC3F,WAAO;AAAA,EACT;AAEA,SAAO,uBAAuB,GAAG,MAAM;AACzC;AAEA,MAAM,iCAAiC,CAAC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,MAIe;AACb,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,OAAO,MAAM;AACpC,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,QAAM,gBAAgB,uBAAuB,cAAc;AAC3D,MAAI,iBAAiB,kBAAkB,wBAAwB;AAC7D,WAAO;AAAA,EACT;AAEA,MAAI,yBAAyB,cAAc,GAAG;AAC5C,WAAO;AAAA,EACT;AAEA,QAAM,wBAAwB,UAAU,iBAAiB,iBAAA,CAAkB;AAC3E,SAAO,CAAC,CAAC,yBAAyB,eAAe,WAAW;AAC9D;AAEA,MAAM,qBAAqB,CAAC;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AACF,MAIqB;AACnB,QAAM,gBAAgB,mBAAmB,EAAE,YAAY;AAEvD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,MAAI,+BAA+B,EAAE,QAAQ,eAAe,cAAA,CAAe,GAAG;AAC5E,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKW;AACT,MAAI;AACF,UAAM,mBAAmB,IAAI,IAAI,QAAQ;AACzC,QAAI,CAAC,iBAAiB,SAAS,WAAW,SAAS,GAAG;AACpD,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,mBAAmB;AAAA,MACrC;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACD;AACD,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,IAAI,IAAI,WAAW;AAC1C,qBAAiB,WAAW,eAAe;AAC3C,qBAAiB,OAAO,eAAe;AACvC,WAAO,iBAAiB,SAAA;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,EAAE,QAAQ,KAAK,SAAyE;AACpH,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACvD,WAAO,IAAI,KAAK,OAAO,KAAK,CAAC;AAAA,EAC/B;AACF;AAEA,SAAS,uBAAuB,EAAE,QAAQ,KAAK,SAAyE;AACtH,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,WAAO,IAAI,KAAK,KAAK;AAAA,EACvB;AACF;AAGA,MAAM,mBAAmB;AASzB,SAAS,oBAAoB,OAA+C;AAC1E,QAAM,aAAa,MAAM,QAAQ,GAAG;AACpC,QAAM,SAAS,eAAe,KAAK,QAAQ,MAAM,MAAM,aAAa,CAAC;AACrE,QAAM,QAAQ,CAAC,GAAG,IAAI,gBAAgB,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,gBAAgB;AACzF,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG,MAAM,IAAI,WAAW,CAAC,EAAG,QAAO;AAC1E,SAAO;AACT;AAEA,SAAS,qBAAqB,EAAE,QAAQ,SAA2D;AACjG,QAAM,QAAQ,oBAAoB,KAAK;AACvC,MAAI,CAAC,MAAO;AAEZ,aAAW,CAAC,GAAG,KAAK,MAAO,QAAO,OAAO,GAAG;AAC5C,aAAW,CAAC,KAAK,KAAK,KAAK,MAAO,QAAO,OAAO,KAAK,KAAK;AAC5D;AAEA,SAAS,wBAAwB;AAAA,EAC/B;AAAA,EACA;AACF,GAGS;AACP,UAAQ,OAAO,MAAA;AAAA,IACb,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,eAAe,SAAS,OAAO,YAAY;AAAA,MAAA,CACnD;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,OAAO,SAAS,OAAO,IAAI;AAAA,MAAA,CACnC;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,WAAW,SAAS,OAAO,QAAQ;AAAA,MAAA,CAC3C;AACD,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,YAAY,SAAS,OAAO,SAAS;AAAA,MAAA,CAC7C;AACD,UACE,UAAU,WACT,OAAO,SAAS,aAAa,OAAO,SAAS,UAC9C;AACA,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA;AAAA,IACF,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACzC;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AAIA,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,UAAU,OAAO,YAAY,SAAS,OAAO,SAAS,OAAA,CAAW;AACvG,6BAAuB,EAAE,QAAQ,KAAK,QAAQ,OAAO,UAAU,SAAS,OAAO,OAAO,OAAA,CAAW;AACjG;AAAA;AAAA;AAAA,IAGF,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,IAAI,UAAU,OAAO,IAAI;AAChC,2BAAqB;AAAA,QACnB;AAAA,QACA,KAAK;AAAA,QACL,OAAO,aAAa,SAAS,OAAO,UAAU;AAAA,MAAA,CAC/C;AACD,UAAI,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACvD,eAAO,IAAI,QAAQ,OAAO,IAAI;AAAA,MAChC;AACA,UAAI,WAAW,UAAU,OAAO,OAAO,UAAU,UAAU;AACzD,eAAO,IAAI,SAAS,OAAO,KAAK;AAAA,MAClC;AACA,UAAI,eAAe,UAAU,OAAO,OAAO,cAAc,UAAU;AACjE,eAAO,IAAI,cAAc,OAAO,SAAS;AAAA,MAC3C;AACA,UAAI,mBAAmB,UAAU,OAAO,OAAO,kBAAkB,UAAU;AACzE,eAAO,IAAI,kBAAkB,OAAO,aAAa;AAAA,MACnD;AACA;AAAA,EAAA;AAEN;AASO,SAAS,8BAA8B;AAAA,EAC5C;AAAA,EACA;AACF,GAGS;;AACP,QAAM,SAAS,uCAAW;AAC1B,MAAI,OAAO,WAAW,UAAU;AAC9B,yBAAqB,EAAE,QAAQ,OAAO,OAAA,CAAQ;AAAA,EAChD,WAAW,UAAU,OAAO,WAAW,YAAY,UAAU,UAAU,OAAO,OAAO,SAAS,UAAU;AACtG,4BAAwB,EAAE,QAAQ,QAAQ,EAAE,GAAG,QAAQ,MAAM,OAAO,KAAA,GAAQ;AAAA,EAC9E;AAEA,QAAM,WAAU,4CAAW,SAAX,mBAAiB;AACjC,MAAI,OAAO,YAAY,YAAY,SAAS;AAC1C,WAAO,IAAI,WAAW,OAAO;AAAA,EAC/B;AACF;AAEO,SAAS,sBAAsB,UAAkB,WAAkD;AACxG,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,QAAQ;AAC5B,QAAI,aAAa,IAAI,qBAAqB,GAAG;AAC7C,kCAA8B,EAAE,QAAQ,IAAI,cAAc,WAAW;AACrE,WAAO,IAAI,SAAA;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,gBAAgB,CAAC,UAAkD;AACvE,MAAI;AACF,UAAM,iBAAiB,MAAM,MAAM,GAAG,EAAE,CAAC;AACzC,QAAI,CAAC,kBAAkB,OAAO,SAAS,WAAY,QAAO;AAC1D,UAAM,aAAa,eAAe,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACtE,UAAM,UAAmB,KAAK;AAAA,MAC5B,KAAK,WAAW,OAAO,WAAW,UAAW,IAAK,WAAW,SAAS,KAAM,GAAI,GAAG,CAAC;AAAA,IAAA;AAEtF,WAAO,WAAW,OAAO,YAAY,WAAY,UAAsC;AAAA,EACzF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yBAAyB,EAAE,OAAO,UAA8D;AAC9G,MAAI,CAAC,MAAO,QAAO,SAAS,WAAW,MAAM,KAAK;AAElD,QAAM,UAAU,cAAc,KAAK;AACnC,QAAM,UAAS,mCAAS,aAAW,mCAAS;AAC5C,MAAI,OAAO,WAAW,YAAY,CAAC,OAAQ,QAAO,gBAAgB,KAAK;AAEvE,SAAO,OAAO,KAAK,UAAU;AAAA,IAC3B,SAAQ,mCAAS,QAAO;AAAA,IACxB;AAAA,IACA,cAAa,mCAAS,mBAAiB,mCAAS,WAAU;AAAA,IAC1D,cAAa,mCAAS,iBAAgB;AAAA,IACtC,iBAAgB,mCAAS,8BAA6B;AAAA,EAAA,CACvD,CAAC;AACJ;AAeO,SAAS,cACd,SACA,UAaI;AAAA,EACF,YAAY;AACd,GACqB;;AACrB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,mBAAmB,KAAK,KAAK,KAAK;AAAA,IAClC,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,IACE;AAGJ,QAAM,WAAW,OAAO,KAAK;AAC7B,WAAS,UAAU;AACnB,QAAM,cAAc,OAAO,QAAQ;AACnC,cAAY,UAAU;AAItB,QAAM,cAAc,yBAAyB,EAAE,OAAO,QAAQ;AAC9D,QAAM,UAAU,QAAQ,WAAW,UAAU;AAE7C,QAAM,QAAQ;AAAA,IACZ;AAAA,MACE,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEA,mBAAmB,WAAW;AAAA,QAC9B;AAAA,QACA,UAAU;AAAA,MAAA;AAAA,MAEZ,SAAS,OAAO,EAAE,aAA0D;AAE1E,cAAM,aAAa,WAAW,QAAQ,2BAA2B,EAAE;AACnE,cAAM,YAAY,SAAS;AAC3B,cAAM,MAAM,MAAM;AAAA,UAChB,EAAE,QAAQ,OAAO,WAAW,UAAU,YAAY,YAAY,UAAU,OAAA;AAAA,UACxE,CAAC,YACC,MAAM,GAAG,UAAU,6BAA6B;AAAA,YAC9C,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,QAAA;AAAA,YAClD,MAAM,KAAK;AAAA,cACT,2BAA2B;AAAA,gBACzB,SAAS,WAAW;AAAA,gBACpB;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,gBACA;AAAA,cAAA,CACD;AAAA,YAAA;AAAA,YAEH;AAAA,UAAA,CACD;AAAA,QAAA;AAEL,YAAI,CAAC,IAAI,IAAI;AACX,gBAAM,OAAO,MAAM,IAAI,OAAO,MAAM,MAAM,EAAE;AAC5C,gBAAM,IAAI,MAAM,mCAAmC,IAAI,MAAM,MAAM,IAAI,EAAE;AAAA,QAC3E;AACA,cAAM,OAAkD,MAAM,IAAI,KAAA;AAClE,eAAO;AAAA,UACL,KAAK,qBAAqB,EAAE,UAAU,KAAK,WAAW,QAAQ,YAAY;AAAA,UAC1E,WAAW,KAAK;AAAA,QAAA;AAAA,MAEpB;AAAA,MACA;AAAA;AAAA;AAAA,MAGA,WAAW,CAAC,WACV,OAAO,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,YAAY,MAAO,KAAK,IAAA,CAAK,IAAI;AAAA,MACrF,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,MACpB,OAAO;AAAA,IAAA;AAAA,IAET,WAAW,kBAAkB,KAAK;AAAA,EAAA;AAGpC,SAAO;AAAA,IACL,UAAU,YAAW,WAAM,SAAN,mBAAY,QAAO,OAAQ;AAAA,IAChD,WAAW,WAAW,MAAM;AAAA,IAC5B,OAAO,WAAW,MAAM,QAAQ,MAAM,MAAM,UAAU;AAAA,EAAA;AAE1D;"}

package/dist/auth/AthenaAuthContext.cjs

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const react = require("react");
-const AthenaAuthContext = react.createContext(null);
+const require$$0 = require("react");
+const AthenaAuthContext = require$$0.createContext(null);
 function useAthenaAuth() {
-  const ctx = react.useContext(AthenaAuthContext);
+  const ctx = require$$0.useContext(AthenaAuthContext);
   if (!ctx) {
     throw new Error(
       "[AthenaSDK] useAthenaAuth must be used within an <AthenaAuthProvider>"

package/dist/auth/AthenaAuthContext.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AthenaAuthContext.cjs","sources":["../../src/auth/AthenaAuthContext.ts"],"sourcesContent":["import { createContext, useContext } from 'react';\nimport type { AthenaAuthState } from './types';\n\n/**\n * Internal context used by `AthenaAuthProvider` to share auth state.\n * Consumed by `useAthenaAuth()` and automatically by `AthenaProvider`.\n */\nexport const AthenaAuthContext = createContext<AthenaAuthState | null>(null);\n\n/**\n * Read the current Athena auth state.\n *\n * Must be used inside an `<AthenaAuthProvider>`.\n *\n * @example\n * ```tsx\n * function UserMenu() {\n *   const { user, isLoggedIn, logout } = useAthenaAuth();\n *   if (!isLoggedIn) return null;\n *   return (\n *     <div>\n *       <span>{user?.email}</span>\n *       <button onClick={() => logout()}>Log out</button>\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useAthenaAuth(): AthenaAuthState {\n  const ctx = useContext(AthenaAuthContext);\n  if (!ctx) {\n    throw new Error(\n      '[AthenaSDK] useAthenaAuth must be used within an <AthenaAuthProvider>',\n    );\n  }\n  return ctx;\n}\n"],"names":["createContext","useContext"],"mappings":";;;AAOO,MAAM,oBAAoBA,MAAAA,cAAsC,IAAI;AAqBpE,SAAS,gBAAiC;AAC/C,QAAM,MAAMC,MAAAA,WAAW,iBAAiB;AACxC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAEJ;AACA,SAAO;AACT;;;"}
+{"version":3,"file":"AthenaAuthContext.cjs","sources":["../../src/auth/AthenaAuthContext.ts"],"sourcesContent":["import { createContext, useContext } from 'react';\nimport type { AthenaAuthState } from './types';\n\n/**\n * Internal context used by `AthenaAuthProvider` to share auth state.\n * Consumed by `useAthenaAuth()` and automatically by `AthenaProvider`.\n */\nexport const AthenaAuthContext = createContext<AthenaAuthState | null>(null);\n\n/**\n * Read the current Athena auth state.\n *\n * Must be used inside an `<AthenaAuthProvider>`.\n *\n * @example\n * ```tsx\n * function UserMenu() {\n *   const { user, isLoggedIn, logout } = useAthenaAuth();\n *   if (!isLoggedIn) return null;\n *   return (\n *     <div>\n *       <span>{user?.email}</span>\n *       <button onClick={() => logout()}>Log out</button>\n *     </div>\n *   );\n * }\n * ```\n */\nexport function useAthenaAuth(): AthenaAuthState {\n  const ctx = useContext(AthenaAuthContext);\n  if (!ctx) {\n    throw new Error(\n      '[AthenaSDK] useAthenaAuth must be used within an <AthenaAuthProvider>',\n    );\n  }\n  return ctx;\n}\n"],"names":["createContext","useContext"],"mappings":";;;AAOO,MAAM,oBAAoBA,WAAAA,cAAsC,IAAI;AAqBpE,SAAS,gBAAiC;AAC/C,QAAM,MAAMC,WAAAA,WAAW,iBAAiB;AACxC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAAA,EAEJ;AACA,SAAO;AACT;;;"}

package/dist/auth/AthenaAuthProvider.cjs

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const jsxRuntime = require("react/jsx-runtime");
 const react = require("@propelauth/react");
-const react$1 = require("react");
+const require$$0 = require("react");
 const AthenaAuthContext = require("./AthenaAuthContext.cjs");
 function propelAuthTokenGetter(read) {
   return async ({ force = false } = {}) => {
@@ -49,10 +49,10 @@ function patchHistoryForLocationTracking() {
   historyPatched = true;
 }
 function useCurrentHref() {
-  const [href, setHref] = react$1.useState(
+  const [href, setHref] = require$$0.useState(
     typeof window !== "undefined" ? window.location.href : "/"
   );
-  react$1.useEffect(() => {
+  require$$0.useEffect(() => {
     if (typeof window === "undefined") {
       return;
     }
@@ -78,13 +78,13 @@ function AthenaAuthBridge({
 }) {
   const authInfo = react.useAuthInfo();
   const logoutFn = react.useLogoutFunction();
-  const logoutFnRef = react$1.useRef(logoutFn);
+  const logoutFnRef = require$$0.useRef(logoutFn);
   logoutFnRef.current = logoutFn;
-  const prevAuthStateRef = react$1.useRef(null);
-  const authInfoRef = react$1.useRef(authInfo);
+  const prevAuthStateRef = require$$0.useRef(null);
+  const authInfoRef = require$$0.useRef(authInfo);
   authInfoRef.current = authInfo;
-  const [getToken] = react$1.useState(() => propelAuthTokenGetter(() => authInfoRef.current));
-  const authState = react$1.useMemo(() => {
+  const [getToken] = require$$0.useState(() => propelAuthTokenGetter(() => authInfoRef.current));
+  const authState = require$$0.useMemo(() => {
     var _a, _b;
     if (authInfo.loading) {
       prevAuthStateRef.current = null;

package/dist/auth/AthenaAuthProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AthenaAuthProvider.cjs","sources":["../../src/auth/AthenaAuthProvider.tsx"],"sourcesContent":["import {\n  RequiredAuthProvider,\n  RedirectToLogin,\n  useAuthInfo,\n  useLogoutFunction,\n} from '@propelauth/react';\nimport type { ReactNode } from 'react';\nimport { useEffect, useMemo, useRef, useState } from 'react';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { AthenaAuthContext } from './AthenaAuthContext';\nimport type { AthenaAuthState, AthenaOrg, AthenaUser } from './types';\n\n/** The part of a PropelAuth `useAuthInfo()` snapshot the token getter reads. */\nexport interface PropelAuthTokenSnapshot {\n  loading: boolean;\n  isLoggedIn: boolean | undefined;\n  accessToken: string | null | undefined;\n  /** Absent on `@propelauth/react` releases that predate it. */\n  refreshAuthInfo?: () => Promise<void>;\n  /** Absent on `@propelauth/react` releases that predate it. */\n  tokens?: { getAccessToken?: () => Promise<string | undefined> };\n}\n\n/**\n * The PropelAuth side of the SDK's credential source. `force` (the previous\n * token was refused) makes PropelAuth mint a new token first; either way the\n * token comes from PropelAuth's own `getAccessToken`, which renews one that is\n * about to expire. A failed renewal keeps the held token, so the caller's\n * attempt is refused by the host rather than failing in the client.\n */\nexport function propelAuthTokenGetter(\n  read: () => PropelAuthTokenSnapshot,\n): AthenaStatewireTokenGetter {\n  return async ({ force = false } = {}) => {\n    const info = read();\n    if (info.loading || !info.isLoggedIn) return null;\n    if (force) {\n      try {\n        await info.refreshAuthInfo?.();\n      } catch {\n        // Keep the held token; the host decides.\n      }\n    }\n    const latest = read();\n    let fresh: string | undefined;\n    try {\n      fresh = await latest.tokens?.getAccessToken?.();\n    } catch {\n      fresh = undefined;\n    }\n    return fresh ?? (latest.isLoggedIn ? (latest.accessToken ?? null) : null);\n  };\n}\n\n// ─── Props ────────────────────────────────────────────────────────────\n\nexport interface AthenaAuthProviderProps {\n  children: ReactNode;\n\n  /**\n   * Your PropelAuth auth URL (e.g. `https://auth.yourdomain.com`).\n   * Found in the PropelAuth dashboard under Frontend Integration.\n   */\n  authUrl: string;\n\n  /**\n   * Where to redirect after a successful login.\n   * Defaults to the current page URL.\n   */\n  postLoginRedirectUrl?: string;\n\n  /**\n   * Custom element displayed while the auth state is loading.\n   * Defaults to `null` (renders nothing).\n   */\n  displayWhileLoading?: ReactNode;\n}\n\nconst ATHENA_LOCATION_CHANGE_EVENT = 'athena:location-change';\nlet historyPatched = false;\n\nfunction patchHistoryForLocationTracking(): void {\n  if (historyPatched || typeof window === 'undefined') {\n    return;\n  }\n\n  const notifyLocationChange = () => {\n    window.dispatchEvent(new Event(ATHENA_LOCATION_CHANGE_EVENT));\n  };\n\n  const originalPushState = window.history.pushState;\n  window.history.pushState = function pushState(...args) {\n    const result = originalPushState.apply(this, args);\n    notifyLocationChange();\n    return result;\n  };\n\n  const originalReplaceState = window.history.replaceState;\n  window.history.replaceState = function replaceState(...args) {\n    const result = originalReplaceState.apply(this, args);\n    notifyLocationChange();\n    return result;\n  };\n\n  historyPatched = true;\n}\n\nfunction useCurrentHref(): string {\n  const [href, setHref] = useState(\n    typeof window !== 'undefined' ? window.location.href : '/',\n  );\n\n  useEffect(() => {\n    if (typeof window === 'undefined') {\n      return;\n    }\n\n    patchHistoryForLocationTracking();\n\n    const updateHref = () => {\n      setHref(window.location.href);\n    };\n\n    updateHref();\n    window.addEventListener('popstate', updateHref);\n    window.addEventListener('hashchange', updateHref);\n    window.addEventListener(ATHENA_LOCATION_CHANGE_EVENT, updateHref);\n\n    return () => {\n      window.removeEventListener('popstate', updateHref);\n      window.removeEventListener('hashchange', updateHref);\n      window.removeEventListener(ATHENA_LOCATION_CHANGE_EVENT, updateHref);\n    };\n  }, []);\n\n  return href;\n}\n\n// ─── Internal Bridge ──────────────────────────────────────────────────\n\n/**\n * Reads PropelAuth state via hooks and maps it into the SDK's\n * `AthenaAuthState`, which is placed on `AthenaAuthContext`.\n */\nfunction AthenaAuthBridge({\n  children,\n  displayWhileLoading,\n}: {\n  children: ReactNode;\n  displayWhileLoading?: ReactNode;\n}) {\n  const authInfo = useAuthInfo();\n  const logoutFn = useLogoutFunction();\n  const logoutFnRef = useRef(logoutFn);\n  logoutFnRef.current = logoutFn;\n  const prevAuthStateRef = useRef<AthenaAuthState | null>(null);\n  const authInfoRef = useRef<PropelAuthTokenSnapshot>(authInfo);\n  authInfoRef.current = authInfo;\n  // One getter for the provider's lifetime: it reads the latest PropelAuth\n  // snapshot, so its identity never changes and never re-renders consumers.\n  const [getToken] = useState(() => propelAuthTokenGetter(() => authInfoRef.current));\n\n  const authState: AthenaAuthState = useMemo(() => {\n    if (authInfo.loading) {\n      prevAuthStateRef.current = null;\n      return {\n        isLoggedIn: false,\n        isLoading: true,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout: async () => {},\n        getToken,\n      };\n    }\n\n    if (!authInfo.isLoggedIn) {\n      prevAuthStateRef.current = null;\n      return {\n        isLoggedIn: false,\n        isLoading: false,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout: async (redirect = true) => logoutFnRef.current(redirect),\n        getToken,\n      };\n    }\n\n    // Referential stability: if the token and user identity haven't changed,\n    // return the previous state object to prevent cascading context re-renders\n    // from PropelAuth's focus-triggered token checks.\n    const prev = prevAuthStateRef.current;\n    if (\n      prev?.isLoggedIn &&\n      !prev.isLoading &&\n      prev.accessToken === authInfo.accessToken &&\n      prev.user?.userId === authInfo.user.userId\n    ) {\n      return prev;\n    }\n\n    const user: AthenaUser = {\n      userId: authInfo.user.userId,\n      email: authInfo.user.email,\n      firstName: authInfo.user.firstName ?? undefined,\n      lastName: authInfo.user.lastName ?? undefined,\n      username: authInfo.user.username ?? undefined,\n      pictureUrl: authInfo.user.pictureUrl ?? undefined,\n      properties: authInfo.user.properties,\n    };\n\n    const orgs: AthenaOrg[] =\n      authInfo.orgHelper?.getOrgs().map((org) => ({\n        orgId: org.orgId,\n        orgName: org.orgName,\n        urlSafeOrgName: org.urlSafeOrgName,\n      })) ?? [];\n\n    const newState: AthenaAuthState = {\n      isLoggedIn: true,\n      isLoading: false,\n      user,\n      accessToken: authInfo.accessToken,\n      orgs,\n      logout: async (redirect = true) => logoutFnRef.current(redirect),\n      getToken,\n    };\n    prevAuthStateRef.current = newState;\n    return newState;\n    // logoutFn intentionally excluded — captured via logoutFnRef for\n    // referential stability while always calling the latest function.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [authInfo, getToken]);\n\n  if (authState.isLoading) {\n    return <>{displayWhileLoading ?? null}</>;\n  }\n\n  return (\n    <AthenaAuthContext.Provider value={authState}>\n      {children}\n    </AthenaAuthContext.Provider>\n  );\n}\n\n// ─── Public Provider ──────────────────────────────────────────────────\n\n/**\n * Wraps your app with Athena authentication powered by PropelAuth.\n *\n * Place this **above** `<AthenaProvider>` in the component tree.\n * When present, `AthenaProvider` will automatically use the access token\n * from this provider — no need to pass `token` or `apiKey` manually.\n *\n * @example\n * ```tsx\n * import { AthenaAuthProvider } from '@athenaintel/react/auth';\n * import { AthenaProvider, AthenaChat } from '@athenaintel/react';\n *\n * function App() {\n *   return (\n *     <AthenaAuthProvider authUrl=\"https://auth.yourdomain.com\">\n *       <AthenaProvider>\n *         <AthenaChat />\n *       </AthenaProvider>\n *     </AthenaAuthProvider>\n *   );\n * }\n * ```\n */\nexport function AthenaAuthProvider({\n  children,\n  authUrl,\n  postLoginRedirectUrl,\n  displayWhileLoading,\n}: AthenaAuthProviderProps) {\n  const currentHref = useCurrentHref();\n  const redirectUrl = postLoginRedirectUrl ?? currentHref;\n\n  return (\n    <RequiredAuthProvider\n      authUrl={authUrl}\n      displayWhileLoading={\n        displayWhileLoading ? <>{displayWhileLoading}</> : undefined\n      }\n      displayIfLoggedOut={<RedirectToLogin postLoginRedirectUrl={redirectUrl} />}\n    >\n      <AthenaAuthBridge displayWhileLoading={displayWhileLoading}>\n        {children}\n      </AthenaAuthBridge>\n    </RequiredAuthProvider>\n  );\n}\n"],"names":["useState","useEffect","useAuthInfo","useLogoutFunction","useRef","useMemo","jsx","Fragment","AthenaAuthContext","RequiredAuthProvider","RedirectToLogin"],"mappings":";;;;;;AA8BO,SAAS,sBACd,MAC4B;AAC5B,SAAO,OAAO,EAAE,QAAQ,MAAA,IAAU,CAAA,MAAO;;AACvC,UAAM,OAAO,KAAA;AACb,QAAI,KAAK,WAAW,CAAC,KAAK,WAAY,QAAO;AAC7C,QAAI,OAAO;AACT,UAAI;AACF,gBAAM,UAAK,oBAAL;AAAA,MACR,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAAS,KAAA;AACf,QAAI;AACJ,QAAI;AACF,cAAQ,QAAM,kBAAO,WAAP,mBAAe,mBAAf;AAAA,IAChB,QAAQ;AACN,cAAQ;AAAA,IACV;AACA,WAAO,UAAU,OAAO,aAAc,OAAO,eAAe,OAAQ;AAAA,EACtE;AACF;AA0BA,MAAM,+BAA+B;AACrC,IAAI,iBAAiB;AAErB,SAAS,kCAAwC;AAC/C,MAAI,kBAAkB,OAAO,WAAW,aAAa;AACnD;AAAA,EACF;AAEA,QAAM,uBAAuB,MAAM;AACjC,WAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC;AAAA,EAC9D;AAEA,QAAM,oBAAoB,OAAO,QAAQ;AACzC,SAAO,QAAQ,YAAY,SAAS,aAAa,MAAM;AACrD,UAAM,SAAS,kBAAkB,MAAM,MAAM,IAAI;AACjD,yBAAA;AACA,WAAO;AAAA,EACT;AAEA,QAAM,uBAAuB,OAAO,QAAQ;AAC5C,SAAO,QAAQ,eAAe,SAAS,gBAAgB,MAAM;AAC3D,UAAM,SAAS,qBAAqB,MAAM,MAAM,IAAI;AACpD,yBAAA;AACA,WAAO;AAAA,EACT;AAEA,mBAAiB;AACnB;AAEA,SAAS,iBAAyB;AAChC,QAAM,CAAC,MAAM,OAAO,IAAIA,QAAAA;AAAAA,IACtB,OAAO,WAAW,cAAc,OAAO,SAAS,OAAO;AAAA,EAAA;AAGzDC,UAAAA,UAAU,MAAM;AACd,QAAI,OAAO,WAAW,aAAa;AACjC;AAAA,IACF;AAEA,oCAAA;AAEA,UAAM,aAAa,MAAM;AACvB,cAAQ,OAAO,SAAS,IAAI;AAAA,IAC9B;AAEA,eAAA;AACA,WAAO,iBAAiB,YAAY,UAAU;AAC9C,WAAO,iBAAiB,cAAc,UAAU;AAChD,WAAO,iBAAiB,8BAA8B,UAAU;AAEhE,WAAO,MAAM;AACX,aAAO,oBAAoB,YAAY,UAAU;AACjD,aAAO,oBAAoB,cAAc,UAAU;AACnD,aAAO,oBAAoB,8BAA8B,UAAU;AAAA,IACrE;AAAA,EACF,GAAG,CAAA,CAAE;AAEL,SAAO;AACT;AAQA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AACF,GAGG;AACD,QAAM,WAAWC,MAAAA,YAAA;AACjB,QAAM,WAAWC,MAAAA,kBAAA;AACjB,QAAM,cAAcC,QAAAA,OAAO,QAAQ;AACnC,cAAY,UAAU;AACtB,QAAM,mBAAmBA,QAAAA,OAA+B,IAAI;AAC5D,QAAM,cAAcA,QAAAA,OAAgC,QAAQ;AAC5D,cAAY,UAAU;AAGtB,QAAM,CAAC,QAAQ,IAAIJ,QAAAA,SAAS,MAAM,sBAAsB,MAAM,YAAY,OAAO,CAAC;AAElF,QAAM,YAA6BK,QAAAA,QAAQ,MAAM;;AAC/C,QAAI,SAAS,SAAS;AACpB,uBAAiB,UAAU;AAC3B,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN,QAAQ,YAAY;AAAA,QAAC;AAAA,QACrB;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,SAAS,YAAY;AACxB,uBAAiB,UAAU;AAC3B,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN,QAAQ,OAAO,WAAW,SAAS,YAAY,QAAQ,QAAQ;AAAA,QAC/D;AAAA,MAAA;AAAA,IAEJ;AAKA,UAAM,OAAO,iBAAiB;AAC9B,SACE,6BAAM,eACN,CAAC,KAAK,aACN,KAAK,gBAAgB,SAAS,iBAC9B,UAAK,SAAL,mBAAW,YAAW,SAAS,KAAK,QACpC;AACA,aAAO;AAAA,IACT;AAEA,UAAM,OAAmB;AAAA,MACvB,QAAQ,SAAS,KAAK;AAAA,MACtB,OAAO,SAAS,KAAK;AAAA,MACrB,WAAW,SAAS,KAAK,aAAa;AAAA,MACtC,UAAU,SAAS,KAAK,YAAY;AAAA,MACpC,UAAU,SAAS,KAAK,YAAY;AAAA,MACpC,YAAY,SAAS,KAAK,cAAc;AAAA,MACxC,YAAY,SAAS,KAAK;AAAA,IAAA;AAG5B,UAAM,SACJ,cAAS,cAAT,mBAAoB,UAAU,IAAI,CAAC,SAAS;AAAA,MAC1C,OAAO,IAAI;AAAA,MACX,SAAS,IAAI;AAAA,MACb,gBAAgB,IAAI;AAAA,IAAA,QACf,CAAA;AAET,UAAM,WAA4B;AAAA,MAChC,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA,aAAa,SAAS;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,WAAW,SAAS,YAAY,QAAQ,QAAQ;AAAA,MAC/D;AAAA,IAAA;AAEF,qBAAiB,UAAU;AAC3B,WAAO;AAAA,EAIT,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,MAAI,UAAU,WAAW;AACvB,WAAOC,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,iCAAuB,KAAA,CAAK;AAAA,EACxC;AAEA,wCACGC,kBAAAA,kBAAkB,UAAlB,EAA2B,OAAO,WAChC,UACH;AAEJ;AA2BO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAA4B;AAC1B,QAAM,cAAc,eAAA;AACpB,QAAM,cAAc,wBAAwB;AAE5C,SACEF,2BAAAA;AAAAA,IAACG,MAAAA;AAAAA,IAAA;AAAA,MACC;AAAA,MACA,qBACE,sBAAsBH,+BAAAC,WAAAA,UAAA,EAAG,UAAA,oBAAA,CAAoB,IAAM;AAAA,MAErD,oBAAoBD,2BAAAA,IAACI,MAAAA,iBAAA,EAAgB,sBAAsB,YAAA,CAAa;AAAA,MAExE,UAAAJ,2BAAAA,IAAC,kBAAA,EAAiB,qBACf,SAAA,CACH;AAAA,IAAA;AAAA,EAAA;AAGN;;;"}
+{"version":3,"file":"AthenaAuthProvider.cjs","sources":["../../src/auth/AthenaAuthProvider.tsx"],"sourcesContent":["import {\n  RequiredAuthProvider,\n  RedirectToLogin,\n  useAuthInfo,\n  useLogoutFunction,\n} from '@propelauth/react';\nimport type { ReactNode } from 'react';\nimport { useEffect, useMemo, useRef, useState } from 'react';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { AthenaAuthContext } from './AthenaAuthContext';\nimport type { AthenaAuthState, AthenaOrg, AthenaUser } from './types';\n\n/** The part of a PropelAuth `useAuthInfo()` snapshot the token getter reads. */\nexport interface PropelAuthTokenSnapshot {\n  loading: boolean;\n  isLoggedIn: boolean | undefined;\n  accessToken: string | null | undefined;\n  /** Absent on `@propelauth/react` releases that predate it. */\n  refreshAuthInfo?: () => Promise<void>;\n  /** Absent on `@propelauth/react` releases that predate it. */\n  tokens?: { getAccessToken?: () => Promise<string | undefined> };\n}\n\n/**\n * The PropelAuth side of the SDK's credential source. `force` (the previous\n * token was refused) makes PropelAuth mint a new token first; either way the\n * token comes from PropelAuth's own `getAccessToken`, which renews one that is\n * about to expire. A failed renewal keeps the held token, so the caller's\n * attempt is refused by the host rather than failing in the client.\n */\nexport function propelAuthTokenGetter(\n  read: () => PropelAuthTokenSnapshot,\n): AthenaStatewireTokenGetter {\n  return async ({ force = false } = {}) => {\n    const info = read();\n    if (info.loading || !info.isLoggedIn) return null;\n    if (force) {\n      try {\n        await info.refreshAuthInfo?.();\n      } catch {\n        // Keep the held token; the host decides.\n      }\n    }\n    const latest = read();\n    let fresh: string | undefined;\n    try {\n      fresh = await latest.tokens?.getAccessToken?.();\n    } catch {\n      fresh = undefined;\n    }\n    return fresh ?? (latest.isLoggedIn ? (latest.accessToken ?? null) : null);\n  };\n}\n\n// ─── Props ────────────────────────────────────────────────────────────\n\nexport interface AthenaAuthProviderProps {\n  children: ReactNode;\n\n  /**\n   * Your PropelAuth auth URL (e.g. `https://auth.yourdomain.com`).\n   * Found in the PropelAuth dashboard under Frontend Integration.\n   */\n  authUrl: string;\n\n  /**\n   * Where to redirect after a successful login.\n   * Defaults to the current page URL.\n   */\n  postLoginRedirectUrl?: string;\n\n  /**\n   * Custom element displayed while the auth state is loading.\n   * Defaults to `null` (renders nothing).\n   */\n  displayWhileLoading?: ReactNode;\n}\n\nconst ATHENA_LOCATION_CHANGE_EVENT = 'athena:location-change';\nlet historyPatched = false;\n\nfunction patchHistoryForLocationTracking(): void {\n  if (historyPatched || typeof window === 'undefined') {\n    return;\n  }\n\n  const notifyLocationChange = () => {\n    window.dispatchEvent(new Event(ATHENA_LOCATION_CHANGE_EVENT));\n  };\n\n  const originalPushState = window.history.pushState;\n  window.history.pushState = function pushState(...args) {\n    const result = originalPushState.apply(this, args);\n    notifyLocationChange();\n    return result;\n  };\n\n  const originalReplaceState = window.history.replaceState;\n  window.history.replaceState = function replaceState(...args) {\n    const result = originalReplaceState.apply(this, args);\n    notifyLocationChange();\n    return result;\n  };\n\n  historyPatched = true;\n}\n\nfunction useCurrentHref(): string {\n  const [href, setHref] = useState(\n    typeof window !== 'undefined' ? window.location.href : '/',\n  );\n\n  useEffect(() => {\n    if (typeof window === 'undefined') {\n      return;\n    }\n\n    patchHistoryForLocationTracking();\n\n    const updateHref = () => {\n      setHref(window.location.href);\n    };\n\n    updateHref();\n    window.addEventListener('popstate', updateHref);\n    window.addEventListener('hashchange', updateHref);\n    window.addEventListener(ATHENA_LOCATION_CHANGE_EVENT, updateHref);\n\n    return () => {\n      window.removeEventListener('popstate', updateHref);\n      window.removeEventListener('hashchange', updateHref);\n      window.removeEventListener(ATHENA_LOCATION_CHANGE_EVENT, updateHref);\n    };\n  }, []);\n\n  return href;\n}\n\n// ─── Internal Bridge ──────────────────────────────────────────────────\n\n/**\n * Reads PropelAuth state via hooks and maps it into the SDK's\n * `AthenaAuthState`, which is placed on `AthenaAuthContext`.\n */\nfunction AthenaAuthBridge({\n  children,\n  displayWhileLoading,\n}: {\n  children: ReactNode;\n  displayWhileLoading?: ReactNode;\n}) {\n  const authInfo = useAuthInfo();\n  const logoutFn = useLogoutFunction();\n  const logoutFnRef = useRef(logoutFn);\n  logoutFnRef.current = logoutFn;\n  const prevAuthStateRef = useRef<AthenaAuthState | null>(null);\n  const authInfoRef = useRef<PropelAuthTokenSnapshot>(authInfo);\n  authInfoRef.current = authInfo;\n  // One getter for the provider's lifetime: it reads the latest PropelAuth\n  // snapshot, so its identity never changes and never re-renders consumers.\n  const [getToken] = useState(() => propelAuthTokenGetter(() => authInfoRef.current));\n\n  const authState: AthenaAuthState = useMemo(() => {\n    if (authInfo.loading) {\n      prevAuthStateRef.current = null;\n      return {\n        isLoggedIn: false,\n        isLoading: true,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout: async () => {},\n        getToken,\n      };\n    }\n\n    if (!authInfo.isLoggedIn) {\n      prevAuthStateRef.current = null;\n      return {\n        isLoggedIn: false,\n        isLoading: false,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout: async (redirect = true) => logoutFnRef.current(redirect),\n        getToken,\n      };\n    }\n\n    // Referential stability: if the token and user identity haven't changed,\n    // return the previous state object to prevent cascading context re-renders\n    // from PropelAuth's focus-triggered token checks.\n    const prev = prevAuthStateRef.current;\n    if (\n      prev?.isLoggedIn &&\n      !prev.isLoading &&\n      prev.accessToken === authInfo.accessToken &&\n      prev.user?.userId === authInfo.user.userId\n    ) {\n      return prev;\n    }\n\n    const user: AthenaUser = {\n      userId: authInfo.user.userId,\n      email: authInfo.user.email,\n      firstName: authInfo.user.firstName ?? undefined,\n      lastName: authInfo.user.lastName ?? undefined,\n      username: authInfo.user.username ?? undefined,\n      pictureUrl: authInfo.user.pictureUrl ?? undefined,\n      properties: authInfo.user.properties,\n    };\n\n    const orgs: AthenaOrg[] =\n      authInfo.orgHelper?.getOrgs().map((org) => ({\n        orgId: org.orgId,\n        orgName: org.orgName,\n        urlSafeOrgName: org.urlSafeOrgName,\n      })) ?? [];\n\n    const newState: AthenaAuthState = {\n      isLoggedIn: true,\n      isLoading: false,\n      user,\n      accessToken: authInfo.accessToken,\n      orgs,\n      logout: async (redirect = true) => logoutFnRef.current(redirect),\n      getToken,\n    };\n    prevAuthStateRef.current = newState;\n    return newState;\n    // logoutFn intentionally excluded — captured via logoutFnRef for\n    // referential stability while always calling the latest function.\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [authInfo, getToken]);\n\n  if (authState.isLoading) {\n    return <>{displayWhileLoading ?? null}</>;\n  }\n\n  return (\n    <AthenaAuthContext.Provider value={authState}>\n      {children}\n    </AthenaAuthContext.Provider>\n  );\n}\n\n// ─── Public Provider ──────────────────────────────────────────────────\n\n/**\n * Wraps your app with Athena authentication powered by PropelAuth.\n *\n * Place this **above** `<AthenaProvider>` in the component tree.\n * When present, `AthenaProvider` will automatically use the access token\n * from this provider — no need to pass `token` or `apiKey` manually.\n *\n * @example\n * ```tsx\n * import { AthenaAuthProvider } from '@athenaintel/react/auth';\n * import { AthenaProvider, AthenaChat } from '@athenaintel/react';\n *\n * function App() {\n *   return (\n *     <AthenaAuthProvider authUrl=\"https://auth.yourdomain.com\">\n *       <AthenaProvider>\n *         <AthenaChat />\n *       </AthenaProvider>\n *     </AthenaAuthProvider>\n *   );\n * }\n * ```\n */\nexport function AthenaAuthProvider({\n  children,\n  authUrl,\n  postLoginRedirectUrl,\n  displayWhileLoading,\n}: AthenaAuthProviderProps) {\n  const currentHref = useCurrentHref();\n  const redirectUrl = postLoginRedirectUrl ?? currentHref;\n\n  return (\n    <RequiredAuthProvider\n      authUrl={authUrl}\n      displayWhileLoading={\n        displayWhileLoading ? <>{displayWhileLoading}</> : undefined\n      }\n      displayIfLoggedOut={<RedirectToLogin postLoginRedirectUrl={redirectUrl} />}\n    >\n      <AthenaAuthBridge displayWhileLoading={displayWhileLoading}>\n        {children}\n      </AthenaAuthBridge>\n    </RequiredAuthProvider>\n  );\n}\n"],"names":["useState","useEffect","useAuthInfo","useLogoutFunction","useRef","useMemo","jsx","Fragment","AthenaAuthContext","RequiredAuthProvider","RedirectToLogin"],"mappings":";;;;;;AA8BO,SAAS,sBACd,MAC4B;AAC5B,SAAO,OAAO,EAAE,QAAQ,MAAA,IAAU,CAAA,MAAO;;AACvC,UAAM,OAAO,KAAA;AACb,QAAI,KAAK,WAAW,CAAC,KAAK,WAAY,QAAO;AAC7C,QAAI,OAAO;AACT,UAAI;AACF,gBAAM,UAAK,oBAAL;AAAA,MACR,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM,SAAS,KAAA;AACf,QAAI;AACJ,QAAI;AACF,cAAQ,QAAM,kBAAO,WAAP,mBAAe,mBAAf;AAAA,IAChB,QAAQ;AACN,cAAQ;AAAA,IACV;AACA,WAAO,UAAU,OAAO,aAAc,OAAO,eAAe,OAAQ;AAAA,EACtE;AACF;AA0BA,MAAM,+BAA+B;AACrC,IAAI,iBAAiB;AAErB,SAAS,kCAAwC;AAC/C,MAAI,kBAAkB,OAAO,WAAW,aAAa;AACnD;AAAA,EACF;AAEA,QAAM,uBAAuB,MAAM;AACjC,WAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC;AAAA,EAC9D;AAEA,QAAM,oBAAoB,OAAO,QAAQ;AACzC,SAAO,QAAQ,YAAY,SAAS,aAAa,MAAM;AACrD,UAAM,SAAS,kBAAkB,MAAM,MAAM,IAAI;AACjD,yBAAA;AACA,WAAO;AAAA,EACT;AAEA,QAAM,uBAAuB,OAAO,QAAQ;AAC5C,SAAO,QAAQ,eAAe,SAAS,gBAAgB,MAAM;AAC3D,UAAM,SAAS,qBAAqB,MAAM,MAAM,IAAI;AACpD,yBAAA;AACA,WAAO;AAAA,EACT;AAEA,mBAAiB;AACnB;AAEA,SAAS,iBAAyB;AAChC,QAAM,CAAC,MAAM,OAAO,IAAIA,WAAAA;AAAAA,IACtB,OAAO,WAAW,cAAc,OAAO,SAAS,OAAO;AAAA,EAAA;AAGzDC,aAAAA,UAAU,MAAM;AACd,QAAI,OAAO,WAAW,aAAa;AACjC;AAAA,IACF;AAEA,oCAAA;AAEA,UAAM,aAAa,MAAM;AACvB,cAAQ,OAAO,SAAS,IAAI;AAAA,IAC9B;AAEA,eAAA;AACA,WAAO,iBAAiB,YAAY,UAAU;AAC9C,WAAO,iBAAiB,cAAc,UAAU;AAChD,WAAO,iBAAiB,8BAA8B,UAAU;AAEhE,WAAO,MAAM;AACX,aAAO,oBAAoB,YAAY,UAAU;AACjD,aAAO,oBAAoB,cAAc,UAAU;AACnD,aAAO,oBAAoB,8BAA8B,UAAU;AAAA,IACrE;AAAA,EACF,GAAG,CAAA,CAAE;AAEL,SAAO;AACT;AAQA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AACF,GAGG;AACD,QAAM,WAAWC,MAAAA,YAAA;AACjB,QAAM,WAAWC,MAAAA,kBAAA;AACjB,QAAM,cAAcC,WAAAA,OAAO,QAAQ;AACnC,cAAY,UAAU;AACtB,QAAM,mBAAmBA,WAAAA,OAA+B,IAAI;AAC5D,QAAM,cAAcA,WAAAA,OAAgC,QAAQ;AAC5D,cAAY,UAAU;AAGtB,QAAM,CAAC,QAAQ,IAAIJ,WAAAA,SAAS,MAAM,sBAAsB,MAAM,YAAY,OAAO,CAAC;AAElF,QAAM,YAA6BK,WAAAA,QAAQ,MAAM;;AAC/C,QAAI,SAAS,SAAS;AACpB,uBAAiB,UAAU;AAC3B,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN,QAAQ,YAAY;AAAA,QAAC;AAAA,QACrB;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,SAAS,YAAY;AACxB,uBAAiB,UAAU;AAC3B,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN,QAAQ,OAAO,WAAW,SAAS,YAAY,QAAQ,QAAQ;AAAA,QAC/D;AAAA,MAAA;AAAA,IAEJ;AAKA,UAAM,OAAO,iBAAiB;AAC9B,SACE,6BAAM,eACN,CAAC,KAAK,aACN,KAAK,gBAAgB,SAAS,iBAC9B,UAAK,SAAL,mBAAW,YAAW,SAAS,KAAK,QACpC;AACA,aAAO;AAAA,IACT;AAEA,UAAM,OAAmB;AAAA,MACvB,QAAQ,SAAS,KAAK;AAAA,MACtB,OAAO,SAAS,KAAK;AAAA,MACrB,WAAW,SAAS,KAAK,aAAa;AAAA,MACtC,UAAU,SAAS,KAAK,YAAY;AAAA,MACpC,UAAU,SAAS,KAAK,YAAY;AAAA,MACpC,YAAY,SAAS,KAAK,cAAc;AAAA,MACxC,YAAY,SAAS,KAAK;AAAA,IAAA;AAG5B,UAAM,SACJ,cAAS,cAAT,mBAAoB,UAAU,IAAI,CAAC,SAAS;AAAA,MAC1C,OAAO,IAAI;AAAA,MACX,SAAS,IAAI;AAAA,MACb,gBAAgB,IAAI;AAAA,IAAA,QACf,CAAA;AAET,UAAM,WAA4B;AAAA,MAChC,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA,aAAa,SAAS;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,WAAW,SAAS,YAAY,QAAQ,QAAQ;AAAA,MAC/D;AAAA,IAAA;AAEF,qBAAiB,UAAU;AAC3B,WAAO;AAAA,EAIT,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,MAAI,UAAU,WAAW;AACvB,WAAOC,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,iCAAuB,KAAA,CAAK;AAAA,EACxC;AAEA,wCACGC,kBAAAA,kBAAkB,UAAlB,EAA2B,OAAO,WAChC,UACH;AAEJ;AA2BO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAA4B;AAC1B,QAAM,cAAc,eAAA;AACpB,QAAM,cAAc,wBAAwB;AAE5C,SACEF,2BAAAA;AAAAA,IAACG,MAAAA;AAAAA,IAAA;AAAA,MACC;AAAA,MACA,qBACE,sBAAsBH,+BAAAC,WAAAA,UAAA,EAAG,UAAA,oBAAA,CAAoB,IAAM;AAAA,MAErD,oBAAoBD,2BAAAA,IAACI,MAAAA,iBAAA,EAAgB,sBAAsB,YAAA,CAAa;AAAA,MAExE,UAAAJ,2BAAAA,IAAC,kBAAA,EAAiB,qBACf,SAAA,CACH;AAAA,IAAA;AAAA,EAAA;AAGN;;;"}

package/dist/auth/AthenaCredentialSourceContext.cjs

@@ -1,19 +1,19 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const react = require("react");
-const AthenaCredentialSourceContext = react.createContext(null);
+const require$$0 = require("react");
+const AthenaCredentialSourceContext = require$$0.createContext(null);
 function useAthenaCredentialSource() {
-  return react.useContext(AthenaCredentialSourceContext);
+  return require$$0.useContext(AthenaCredentialSourceContext);
 }
 function useAthenaCredentialIdentityEpoch() {
   const credentials = useAthenaCredentialSource();
-  const subscribe = react.useCallback(
+  const subscribe = require$$0.useCallback(
     (onChange) => credentials ? credentials.subscribe(onChange) : () => {
     },
     [credentials]
   );
   const read = () => (credentials == null ? void 0 : credentials.identityEpoch()) ?? 0;
-  return react.useSyncExternalStore(subscribe, read, read);
+  return require$$0.useSyncExternalStore(subscribe, read, read);
 }
 exports.AthenaCredentialSourceContext = AthenaCredentialSourceContext;
 exports.useAthenaCredentialIdentityEpoch = useAthenaCredentialIdentityEpoch;

package/dist/auth/AthenaCredentialSourceContext.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AthenaCredentialSourceContext.cjs","sources":["../../src/auth/AthenaCredentialSourceContext.ts"],"sourcesContent":["import { createContext, useCallback, useContext, useSyncExternalStore } from 'react';\nimport type { AthenaCredentialSource } from './credential-source';\n\n/**\n * The provider's credential source (see `createAthenaCredentialSource`), for\n * the SDK's own connections that must restart when a new token arrives.\n * Internal: hosts read tokens through `useAthenaConfig().getToken`.\n */\nexport const AthenaCredentialSourceContext = createContext<AthenaCredentialSource | null>(null);\n\nexport function useAthenaCredentialSource(): AthenaCredentialSource | null {\n  return useContext(AthenaCredentialSourceContext);\n}\n\n/**\n * The credential source's identity epoch (see `identityEpoch`): a number that\n * changes when someone else signs in, not when a token is renewed. `0`\n * outside a provider.\n */\nexport function useAthenaCredentialIdentityEpoch(): number {\n  const credentials = useAthenaCredentialSource();\n  const subscribe = useCallback(\n    (onChange: () => void) => (credentials ? credentials.subscribe(onChange) : () => {}),\n    [credentials],\n  );\n  const read = () => credentials?.identityEpoch() ?? 0;\n  return useSyncExternalStore(subscribe, read, read);\n}\n"],"names":["createContext","useContext","useCallback","useSyncExternalStore"],"mappings":";;;AAQO,MAAM,gCAAgCA,MAAAA,cAA6C,IAAI;AAEvF,SAAS,4BAA2D;AACzE,SAAOC,MAAAA,WAAW,6BAA6B;AACjD;AAOO,SAAS,mCAA2C;AACzD,QAAM,cAAc,0BAAA;AACpB,QAAM,YAAYC,MAAAA;AAAAA,IAChB,CAAC,aAA0B,cAAc,YAAY,UAAU,QAAQ,IAAI,MAAM;AAAA,IAAC;AAAA,IAClF,CAAC,WAAW;AAAA,EAAA;AAEd,QAAM,OAAO,OAAM,2CAAa,oBAAmB;AACnD,SAAOC,2BAAqB,WAAW,MAAM,IAAI;AACnD;;;;"}
+{"version":3,"file":"AthenaCredentialSourceContext.cjs","sources":["../../src/auth/AthenaCredentialSourceContext.ts"],"sourcesContent":["import { createContext, useCallback, useContext, useSyncExternalStore } from 'react';\nimport type { AthenaCredentialSource } from './credential-source';\n\n/**\n * The provider's credential source (see `createAthenaCredentialSource`), for\n * the SDK's own connections that must restart when a new token arrives.\n * Internal: hosts read tokens through `useAthenaConfig().getToken`.\n */\nexport const AthenaCredentialSourceContext = createContext<AthenaCredentialSource | null>(null);\n\nexport function useAthenaCredentialSource(): AthenaCredentialSource | null {\n  return useContext(AthenaCredentialSourceContext);\n}\n\n/**\n * The credential source's identity epoch (see `identityEpoch`): a number that\n * changes when someone else signs in, not when a token is renewed. `0`\n * outside a provider.\n */\nexport function useAthenaCredentialIdentityEpoch(): number {\n  const credentials = useAthenaCredentialSource();\n  const subscribe = useCallback(\n    (onChange: () => void) => (credentials ? credentials.subscribe(onChange) : () => {}),\n    [credentials],\n  );\n  const read = () => credentials?.identityEpoch() ?? 0;\n  return useSyncExternalStore(subscribe, read, read);\n}\n"],"names":["createContext","useContext","useCallback","useSyncExternalStore"],"mappings":";;;AAQO,MAAM,gCAAgCA,WAAAA,cAA6C,IAAI;AAEvF,SAAS,4BAA2D;AACzE,SAAOC,WAAAA,WAAW,6BAA6B;AACjD;AAOO,SAAS,mCAA2C;AACzD,QAAM,cAAc,0BAAA;AACpB,QAAM,YAAYC,WAAAA;AAAAA,IAChB,CAAC,aAA0B,cAAc,YAAY,UAAU,QAAQ,IAAI,MAAM;AAAA,IAAC;AAAA,IAClF,CAAC,WAAW;AAAA,EAAA;AAEd,QAAM,OAAO,OAAM,2CAAa,oBAAmB;AACnD,SAAOC,gCAAqB,WAAW,MAAM,IAAI;AACnD;;;;"}

package/dist/auth/AthenaSSOProvider.cjs

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const jsxRuntime = require("react/jsx-runtime");
 const reactQuery = require("@tanstack/react-query");
-const react = require("react");
+const require$$0 = require("react");
 const athenaDiagnostics = require("../diagnostics/athena-diagnostics.cjs");
 const errors = require("../diagnostics/errors.cjs");
 const auth = require("../runtime/auth.cjs");
@@ -179,12 +179,12 @@ function AthenaSSOProvider({
   revalidateOnWindowFocus = false,
   retryPolicy = SSO_USERINFO_RETRY_POLICY
 }) {
-  const [queryClient] = react.useState(() => new reactQuery.QueryClient());
-  const retryPolicyRef = react.useRef(retryPolicy);
+  const [queryClient] = require$$0.useState(() => new reactQuery.QueryClient());
+  const retryPolicyRef = require$$0.useRef(retryPolicy);
   retryPolicyRef.current = retryPolicy;
-  const onErrorRef = react.useRef(onError);
+  const onErrorRef = require$$0.useRef(onError);
   onErrorRef.current = onError;
-  const ssoUrls = react.useMemo(
+  const ssoUrls = require$$0.useMemo(
     () => ({
       userInfo: resolveSSOUrl({
         baseUrl: ssoBaseUrl,
@@ -204,8 +204,8 @@ function AthenaSSOProvider({
     }),
     [ssoBaseUrl, ssoUserInfoUrl, ssoLoginUrl, ssoLogoutUrl]
   );
-  const queryKey = react.useMemo(() => ["athena-sdk", "sso-session", ssoUrls.userInfo], [ssoUrls.userInfo]);
-  const queryFn = react.useCallback(
+  const queryKey = require$$0.useMemo(() => ["athena-sdk", "sso-session", ssoUrls.userInfo], [ssoUrls.userInfo]);
+  const queryFn = require$$0.useCallback(
     async ({ signal }) => {
       var _a;
       try {
@@ -244,7 +244,7 @@ function AthenaSSOProvider({
   const loading = query.isPending;
   const reason = session ? null : (answer == null ? void 0 : answer.kind) === "no_session" ? answer.reason : query.isError ? "request_failed" : null;
   const signedOut = (answer == null ? void 0 : answer.kind) === "no_session" && answer.signedOut === true;
-  react.useEffect(() => {
+  require$$0.useEffect(() => {
     if (!revalidateOnWindowFocus || typeof window === "undefined") {
       return;
     }
@@ -263,15 +263,15 @@ function AthenaSSOProvider({
       document.removeEventListener("visibilitychange", handleVisibilityChange);
     };
   }, [revalidateOnWindowFocus, queryClient, queryKey]);
-  react.useEffect(() => {
+  require$$0.useEffect(() => {
     if (!loading && reason === "unauthenticated" && !signedOut && !displayOnError && typeof window !== "undefined") {
       window.location.assign(ssoUrls.login);
     }
   }, [loading, reason, signedOut, displayOnError, ssoUrls.login]);
-  const retry = react.useCallback(() => {
+  const retry = require$$0.useCallback(() => {
     void queryClient.resetQueries({ queryKey });
   }, [queryClient, queryKey]);
-  const logout = react.useCallback(async (redirectOnLogout = true) => {
+  const logout = require$$0.useCallback(async (redirectOnLogout = true) => {
     await queryClient.cancelQueries({ queryKey });
     try {
       await fetch(ssoUrls.logout, {
@@ -290,9 +290,9 @@ function AthenaSSOProvider({
       window.location.assign(ssoUrls.login);
     }
   }, [queryClient, queryKey, ssoUrls.login, ssoUrls.logout]);
-  const sessionRef = react.useRef(session);
+  const sessionRef = require$$0.useRef(session);
   sessionRef.current = session;
-  const getToken = react.useCallback(
+  const getToken = require$$0.useCallback(
     async ({ force = false } = {}) => {
       var _a;
       if (force) {
@@ -312,7 +312,7 @@ function AthenaSSOProvider({
     },
     [queryClient, queryKey, queryFn]
   );
-  const authState = react.useMemo(() => {
+  const authState = require$$0.useMemo(() => {
     if (loading) {
       return {
         isLoggedIn: false,

package/dist/auth/AthenaSSOProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AthenaSSOProvider.cjs","sources":["../../src/auth/AthenaSSOProvider.tsx"],"sourcesContent":["import { QueryClient, useQuery } from '@tanstack/react-query';\nimport type { ReactNode } from 'react';\nimport { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { athenaDiagnostics } from '../diagnostics/athena-diagnostics';\nimport { AthenaSdkError } from '../diagnostics/errors';\nimport {\n  DEFAULT_MINT_RETRY_POLICY,\n  getMintRetryDelay,\n  isRetryableMintStatus,\n  type MintRetryPolicy,\n} from '../runtime/auth';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { AthenaAuthContext } from './AthenaAuthContext';\nimport type {\n  AthenaAuthState,\n  AthenaOrg,\n  AthenaSSOUserInfo,\n  AthenaUser,\n} from './types';\n\n// ─── Props ────────────────────────────────────────────────────────────\n\nexport interface AthenaSSOProviderProps {\n  children: ReactNode;\n\n  /**\n   * Base URL used to resolve the Athena SSO endpoints.\n   *\n   * When omitted, the provider defaults to same-origin relative paths:\n   * `/api/sso/userinfo`, `/api/sso/initiate`, and `/api/sso/logout`.\n   *\n   * Use this when your frontend and backend live on different origins\n   * (for example `https://app.example.com` + `https://api.example.com`).\n   */\n  ssoBaseUrl?: string;\n\n  /**\n   * Optional override for the SSO user-info endpoint that returns the\n   * authenticated user's data and access token.\n   *\n   * The endpoint must return JSON matching `AthenaSSOUserInfo`:\n   * ```json\n   * {\n   *   \"user\": { \"user_id\": \"…\", \"email\": \"…\", … },\n   *   \"orgMemberInfos\": [{ \"orgId\": \"…\", \"orgName\": \"…\", \"urlSafeOrgName\": \"…\" }],\n   *   \"accessToken\": \"…\"\n   * }\n   * ```\n   *\n   * The request is sent with `credentials: 'include'` so that\n   * session cookies are forwarded automatically.\n   */\n  ssoUserInfoUrl?: string;\n\n  /**\n   * Optional override for the URL to redirect the user to when no valid\n   * SSO session exists.\n   * This is typically the SSO initiation endpoint on your backend\n   * (e.g. `https://api.yourdomain.com/api/sso/initiate`).\n   */\n  ssoLoginUrl?: string;\n\n  /**\n   * Optional override for the backend SSO logout endpoint.\n   * Defaults to `/api/sso/logout` (or `${ssoBaseUrl}/api/sso/logout`).\n   */\n  ssoLogoutUrl?: string;\n\n  /**\n   * Custom element displayed while the SSO session is being verified.\n   * Defaults to `null` (renders nothing).\n   */\n  displayWhileLoading?: ReactNode;\n\n  /**\n   * Shown when there is no session to sign the app in with: an element, or a\n   * function that receives why (`reason`) and a `retry`, so the app can offer\n   * sign-in only to a person who is signed out and a retry when the endpoint\n   * could not answer (see `AthenaSSOFailure`).\n   * If not provided, the user is automatically redirected to `ssoLoginUrl`\n   * when the endpoint answers that there is no session.\n   */\n  displayOnError?: ReactNode | ((failure: AthenaSSOFailure) => ReactNode);\n\n  /**\n   * Called with the typed error (`auth_sso_failed`) when a session read gives\n   * up. A nested `AthenaProvider`'s `onError` is not mounted while the first\n   * read runs, so observe sign-in failures here.\n   */\n  onError?: (error: AthenaSdkError) => void;\n\n  /**\n   * Re-validate the SSO session when the window regains focus.\n   * Disabled by default. When enabled, token expiry and user switching\n   * are picked up without requiring a full page reload.\n   */\n  revalidateOnWindowFocus?: boolean;\n\n  /** @internal Overrides how a session read retries; used by tests. */\n  retryPolicy?: MintRetryPolicy;\n}\n\n/**\n * Why the provider has no session.\n *\n * - `unauthenticated`: the endpoint answered 401 or 403, or the person signed\n *   out. Offer sign-in.\n * - `request_failed`: the endpoint did not answer usably. A network error, a\n *   timeout, or a 5xx / 408 / 429 on every attempt of one read, or another\n *   status. The person may well be signed in. Offer `retry`.\n * - `invalid_response`: it answered without a usable session.\n */\nexport type AthenaSSOFailureReason = 'unauthenticated' | 'invalid_response' | 'request_failed';\n\n/** What `displayOnError` receives when it is a function. */\nexport interface AthenaSSOFailure {\n  reason: AthenaSSOFailureReason;\n  /** Read the session again. `displayWhileLoading` shows meanwhile. */\n  retry: () => void;\n}\n\n// ─── Helpers ──────────────────────────────────────────────────────────\n\n/**\n * How one session read retries: the parent bridge's mint policy (Marathon's\n * `/api/sso/userinfo` and `/_athena/auth` mint the same credential), with a\n * longer wait per request, since every request mints and a slow answer is\n * still an answer.\n */\nconst SSO_USERINFO_RETRY_POLICY: MintRetryPolicy = {\n  ...DEFAULT_MINT_RETRY_POLICY,\n  timeoutMs: 10_000,\n};\n\n/** One userinfo request, classified. */\ntype UserInfoAttempt =\n  | { kind: 'session'; data: AthenaSSOUserInfo }\n  | { kind: 'unauthenticated' }\n  | { kind: 'invalid_response' }\n  /** A status it does not retry, or a 2xx whose body is not JSON. */\n  | { kind: 'failed'; status: number }\n  | {\n      kind: 'transient';\n      status: number | null;\n      reason: 'status' | 'network' | 'timeout';\n      cause?: unknown;\n    };\n\nconst abortError = () => new DOMException('The session read was cancelled.', 'AbortError');\n\n/** One userinfo request. Throws an `AbortError` when `signal` cancels the read. */\nasync function readUserInfoOnce({\n  url,\n  signal,\n  timeoutMs,\n}: {\n  url: string;\n  signal: AbortSignal;\n  timeoutMs: number;\n}): Promise<UserInfoAttempt> {\n  if (signal.aborted) throw abortError();\n  const request = new AbortController();\n  const cancel = () => request.abort();\n  signal.addEventListener('abort', cancel, { once: true });\n  let timedOut = false;\n  const timer = setTimeout(() => {\n    timedOut = true;\n    request.abort();\n  }, timeoutMs);\n\n  try {\n    const response = await fetch(url, { credentials: 'include', signal: request.signal });\n    if (response.status === 401 || response.status === 403) return { kind: 'unauthenticated' };\n    if (!response.ok) {\n      return isRetryableMintStatus(response.status)\n        ? { kind: 'transient', status: response.status, reason: 'status' }\n        : { kind: 'failed', status: response.status };\n    }\n\n    let data: unknown;\n    try {\n      data = await response.json();\n    } catch (error) {\n      if (signal.aborted) throw abortError();\n      return timedOut\n        ? { kind: 'transient', status: null, reason: 'timeout', cause: error }\n        : { kind: 'failed', status: response.status };\n    }\n    return isValidSSOUserInfo(data) ? { kind: 'session', data } : { kind: 'invalid_response' };\n  } catch (error) {\n    if (signal.aborted) throw abortError();\n    return { kind: 'transient', status: null, reason: timedOut ? 'timeout' : 'network', cause: error };\n  } finally {\n    clearTimeout(timer);\n    signal.removeEventListener('abort', cancel);\n  }\n}\n\n/**\n * What a read concluded, as the query holds it. A read that could not answer\n * throws instead (`request_failed`), so an earlier answer stays.\n */\ntype SessionAnswer =\n  | { kind: 'session'; data: AthenaSSOUserInfo }\n  | {\n      kind: 'no_session';\n      reason: Exclude<AthenaSSOFailureReason, 'request_failed'>;\n      /** The person signed out here (`logout`), rather than the endpoint answering no session. */\n      signedOut?: true;\n    };\n\n/**\n * One session read: one bounded cycle of userinfo requests. A transient\n * failure is retried with `policy`'s capped, jittered backoff; a read that\n * gives up throws the typed error it reports. Throws an `AbortError` when\n * `signal` cancels the read.\n */\nasync function readSession({\n  url,\n  signal,\n  policy,\n}: {\n  url: string;\n  signal: AbortSignal;\n  policy: MintRetryPolicy;\n}): Promise<SessionAnswer> {\n  const maxAttempts = Math.max(1, Math.floor(policy.maxAttempts));\n  for (let attempts = 1; ; attempts += 1) {\n    const attempt = await readUserInfoOnce({ url, signal, timeoutMs: policy.timeoutMs });\n\n    if (attempt.kind === 'session') return { kind: 'session', data: attempt.data };\n    if (attempt.kind === 'unauthenticated') return { kind: 'no_session', reason: 'unauthenticated' };\n    if (attempt.kind === 'invalid_response') {\n      console.error(\n        '[AthenaSDK] Invalid SSO userinfo response: expected \"user.user_id\", \"user.email\", \"orgMemberInfos\", and \"accessToken\"',\n      );\n      return { kind: 'no_session', reason: 'invalid_response' };\n    }\n\n    if (attempt.kind === 'transient' && attempts < maxAttempts) {\n      const delayMs = getMintRetryDelay({ retry: attempts, policy });\n      athenaDiagnostics.emit('auth.sso.userinfo.retry', {\n        level: 'warn',\n        data: {\n          status: attempt.status,\n          reason: attempt.reason,\n          attempt: attempts,\n          max_attempts: maxAttempts,\n          delay_ms: delayMs,\n        },\n      });\n      await waitBeforeRetry({ delayMs, signal });\n      continue;\n    }\n\n    throw sessionReadError({ url, attempt, attempts });\n  }\n}\n\n/** The backoff between two requests of one read; cancelling the read ends it at once. */\nfunction waitBeforeRetry({ delayMs, signal }: { delayMs: number; signal: AbortSignal }): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal.aborted) {\n      reject(abortError());\n      return;\n    }\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(abortError());\n    };\n    const timer = setTimeout(() => {\n      signal.removeEventListener('abort', onAbort);\n      resolve();\n    }, delayMs);\n    signal.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/** The typed error a read reports when it gives up without an answer about the session. */\nfunction sessionReadError({\n  url,\n  attempt,\n  attempts,\n}: {\n  url: string;\n  attempt: Extract<UserInfoAttempt, { kind: 'failed' | 'transient' }>;\n  attempts: number;\n}): AthenaSdkError {\n  if (attempt.kind === 'failed') {\n    const unreadable = attempt.status >= 200 && attempt.status < 300;\n    return new AthenaSdkError({\n      code: 'auth_sso_failed',\n      message: unreadable\n        ? `The SSO session read (${url}) answered HTTP ${attempt.status} without a JSON body.`\n        : `The SSO session read (${url}) answered HTTP ${attempt.status}.`,\n      hint: 'Check that ssoBaseUrl / ssoUserInfoUrl point at the SSO userinfo endpoint.',\n      status: attempt.status,\n      context: { attempts, reason: unreadable ? 'invalid_body' : 'status' },\n    });\n  }\n  const answer =\n    attempt.status !== null\n      ? `HTTP ${attempt.status}`\n      : attempt.reason === 'timeout'\n        ? 'a timeout'\n        : 'a network error';\n  return new AthenaSdkError({\n    code: 'auth_sso_failed',\n    message: `The SSO session read (${url}) failed ${attempts} time${attempts === 1 ? '' : 's'} (last: ${answer}).`,\n    hint: 'The sign-in service did not answer; the person may still be signed in. Offer a retry (displayOnError receives retry).',\n    ...(attempt.status !== null && { status: attempt.status }),\n    ...(attempt.cause !== undefined && { cause: attempt.cause }),\n    context: { attempts, reason: attempt.reason },\n  });\n}\n\nconst DEFAULT_SSO_PATHS = {\n  userInfo: '/api/sso/userinfo',\n  login: '/api/sso/initiate',\n  logout: '/api/sso/logout',\n} as const;\n\nconst trimTrailingSlash = (value: string): string => value.replace(/\\/+$/, '');\n\nfunction resolveSSOUrl({\n  baseUrl,\n  overrideUrl,\n  defaultPath,\n}: {\n  baseUrl?: string;\n  overrideUrl?: string;\n  defaultPath: string;\n}): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  if (!baseUrl) {\n    return defaultPath;\n  }\n\n  return `${trimTrailingSlash(baseUrl)}${defaultPath}`;\n}\n\nfunction isValidSSOUserInfo(data: unknown): data is AthenaSSOUserInfo {\n  if (!data || typeof data !== 'object') {\n    return false;\n  }\n\n  const candidate = data as {\n    accessToken?: unknown;\n    orgMemberInfos?: unknown;\n    user?: {\n      user_id?: unknown;\n      email?: unknown;\n    };\n  };\n\n  return (\n    typeof candidate.accessToken === 'string' &&\n    Array.isArray(candidate.orgMemberInfos) &&\n    !!candidate.user &&\n    typeof candidate.user.user_id === 'string' &&\n    typeof candidate.user.email === 'string'\n  );\n}\n\n/** Map the backend SSO response to the SDK's user/org types. */\nfunction mapSSOResponse(data: AthenaSSOUserInfo): {\n  user: AthenaUser;\n  orgs: AthenaOrg[];\n  accessToken: string;\n} {\n  const user: AthenaUser = {\n    userId: data.user.user_id,\n    email: data.user.email,\n    firstName: data.user.first_name || undefined,\n    lastName: data.user.last_name || undefined,\n    username: data.user.username || undefined,\n    pictureUrl: data.user.picture_url || undefined,\n    properties: data.user.properties,\n  };\n\n  const orgs: AthenaOrg[] = data.orgMemberInfos.map((org) => ({\n    orgId: org.orgId,\n    orgName: org.orgName,\n    urlSafeOrgName: org.urlSafeOrgName,\n  }));\n\n  return { user, orgs, accessToken: data.accessToken };\n}\n\n// ─── Provider ─────────────────────────────────────────────────────────\n\n/**\n * Wraps your app with Athena authentication powered by an external SSO\n * identity provider (e.g. Microsoft Entra / Azure AD, Okta, etc.).\n *\n * The SSO login flow is handled entirely by your backend. This provider\n * verifies the session by fetching `ssoUserInfoUrl` and exposes the\n * same `AthenaAuthState` context that `AthenaAuthProvider` (PropelAuth)\n * provides, so downstream components like `<AthenaProvider>` and\n * `useAthenaAuth()` work identically.\n *\n * Place this **above** `<AthenaProvider>` in the component tree.\n *\n * @example\n * ```tsx\n * import { AthenaSSOProvider } from '@athenaintel/react/auth';\n * import { AthenaProvider, AthenaChat } from '@athenaintel/react';\n *\n * function App() {\n *   return (\n *     <AthenaSSOProvider\n *       ssoUserInfoUrl=\"https://api.yourdomain.com/api/sso/userinfo\"\n *       ssoLoginUrl=\"https://api.yourdomain.com/api/sso/initiate\"\n *     >\n *       <AthenaProvider>\n *         <AthenaChat />\n *       </AthenaProvider>\n *     </AthenaSSOProvider>\n *   );\n * }\n * ```\n */\nexport function AthenaSSOProvider({\n  children,\n  ssoBaseUrl,\n  ssoUserInfoUrl,\n  ssoLoginUrl,\n  ssoLogoutUrl,\n  displayWhileLoading,\n  displayOnError,\n  onError,\n  revalidateOnWindowFocus = false,\n  retryPolicy = SSO_USERINFO_RETRY_POLICY,\n}: AthenaSSOProviderProps) {\n  // The provider's own client, never a host's: the session holds an access\n  // token, and a host may persist its query cache.\n  const [queryClient] = useState(() => new QueryClient());\n  const retryPolicyRef = useRef(retryPolicy);\n  retryPolicyRef.current = retryPolicy;\n  const onErrorRef = useRef(onError);\n  onErrorRef.current = onError;\n\n  const ssoUrls = useMemo(\n    () => ({\n      userInfo: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoUserInfoUrl,\n        defaultPath: DEFAULT_SSO_PATHS.userInfo,\n      }),\n      login: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoLoginUrl,\n        defaultPath: DEFAULT_SSO_PATHS.login,\n      }),\n      logout: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoLogoutUrl,\n        defaultPath: DEFAULT_SSO_PATHS.logout,\n      }),\n    }),\n    [ssoBaseUrl, ssoUserInfoUrl, ssoLoginUrl, ssoLogoutUrl],\n  );\n\n  const queryKey = useMemo(() => ['athena-sdk', 'sso-session', ssoUrls.userInfo], [ssoUrls.userInfo]);\n\n  // One read is one bounded cycle (`readSession`). A read that gives up\n  // throws, so the query keeps the session an earlier read answered: a failed\n  // background revalidation or renewal does not sign the person out.\n  const queryFn = useCallback(\n    async ({ signal }: { signal: AbortSignal }): Promise<SessionAnswer> => {\n      try {\n        return await readSession({ url: ssoUrls.userInfo, signal, policy: retryPolicyRef.current });\n      } catch (readError) {\n        if (readError instanceof AthenaSdkError) {\n          athenaDiagnostics.emit('auth.sso.userinfo.error', { error: readError });\n          try {\n            onErrorRef.current?.(readError);\n          } catch (callbackError) {\n            console.error('[AthenaSDK] AthenaSSOProvider onError threw', callbackError);\n          }\n        }\n        throw readError;\n      }\n    },\n    [ssoUrls.userInfo],\n  );\n\n  const query = useQuery(\n    {\n      queryKey,\n      queryFn,\n      // `readSession` retries a transient failure itself, with the bridge's\n      // policy; the query never retries on top of it, and reads while the\n      // browser reports itself offline too, so that policy decides.\n      retry: false,\n      networkMode: 'always',\n      staleTime: Number.POSITIVE_INFINITY,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n    },\n    queryClient,\n  );\n\n  const answer = query.data;\n  const session = answer?.kind === 'session' ? answer.data : null;\n  const loading = query.isPending;\n  const reason: AthenaSSOFailureReason | null = session\n    ? null\n    : answer?.kind === 'no_session'\n      ? answer.reason\n      : query.isError\n        ? 'request_failed'\n        : null;\n  const signedOut = answer?.kind === 'no_session' && answer.signedOut === true;\n\n  useEffect(() => {\n    if (!revalidateOnWindowFocus || typeof window === 'undefined') {\n      return;\n    }\n\n    // A revalidation joins a read already in flight (a renewal, the first\n    // read) instead of cancelling it.\n    const revalidate = () => {\n      void queryClient.refetchQueries({ queryKey }, { cancelRefetch: false });\n    };\n    const handleVisibilityChange = () => {\n      if (document.visibilityState === 'visible') {\n        revalidate();\n      }\n    };\n\n    window.addEventListener('focus', revalidate);\n    document.addEventListener('visibilitychange', handleVisibilityChange);\n\n    return () => {\n      window.removeEventListener('focus', revalidate);\n      document.removeEventListener('visibilitychange', handleVisibilityChange);\n    };\n  }, [revalidateOnWindowFocus, queryClient, queryKey]);\n\n  // Redirect to SSO login when the endpoint answered no session and no error\n  // UI was provided. Signing out redirects by itself, when asked to.\n  useEffect(() => {\n    if (\n      !loading &&\n      reason === 'unauthenticated' &&\n      !signedOut &&\n      !displayOnError &&\n      typeof window !== 'undefined'\n    ) {\n      window.location.assign(ssoUrls.login);\n    }\n  }, [loading, reason, signedOut, displayOnError, ssoUrls.login]);\n\n  const retry = useCallback(() => {\n    void queryClient.resetQueries({ queryKey });\n  }, [queryClient, queryKey]);\n\n  const logout = useCallback(async (redirectOnLogout = true) => {\n    await queryClient.cancelQueries({ queryKey });\n\n    try {\n      await fetch(ssoUrls.logout, {\n        method: 'POST',\n        credentials: 'include',\n      });\n    } catch (logoutError) {\n      console.error('[AthenaSDK] Failed to invalidate SSO session during logout', logoutError);\n    }\n\n    queryClient.setQueryData<SessionAnswer>(queryKey, {\n      kind: 'no_session',\n      reason: 'unauthenticated',\n      signedOut: true,\n    });\n\n    if (redirectOnLogout && typeof window !== 'undefined') {\n      window.location.assign(ssoUrls.login);\n    }\n  }, [queryClient, queryKey, ssoUrls.login, ssoUrls.logout]);\n\n  // The SSO side of the SDK's credential source: `force` (the previous token\n  // was refused) reads the session again for a new token, joining a read\n  // already in flight; otherwise, or when that read has no session to hand\n  // back, the held one is served.\n  const sessionRef = useRef(session);\n  sessionRef.current = session;\n  const getToken = useCallback<AthenaStatewireTokenGetter>(\n    async ({ force = false } = {}) => {\n      if (force) {\n        try {\n          const renewed = await queryClient.fetchQuery({\n            queryKey,\n            queryFn,\n            staleTime: 0,\n            retry: false,\n            networkMode: 'always',\n          });\n          if (renewed.kind === 'session') return renewed.data.accessToken;\n        } catch {\n          // The read gave up (already reported) or was cancelled.\n        }\n      }\n      return sessionRef.current?.accessToken ?? null;\n    },\n    [queryClient, queryKey, queryFn],\n  );\n\n  const authState: AthenaAuthState = useMemo(() => {\n    if (loading) {\n      return {\n        isLoggedIn: false,\n        isLoading: true,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout: async () => {},\n        getToken,\n      };\n    }\n\n    if (!session) {\n      return {\n        isLoggedIn: false,\n        isLoading: false,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout,\n        getToken,\n      };\n    }\n\n    const { user, orgs, accessToken } = mapSSOResponse(session);\n\n    return {\n      isLoggedIn: true,\n      isLoading: false,\n      user,\n      accessToken,\n      orgs,\n      logout,\n      getToken,\n    };\n  }, [loading, session, logout, getToken]);\n\n  if (authState.isLoading) {\n    return <>{displayWhileLoading ?? null}</>;\n  }\n\n  if (!authState.isLoggedIn) {\n    if (typeof displayOnError === 'function') {\n      return <>{displayOnError({ reason: reason ?? 'unauthenticated', retry })}</>;\n    }\n    return displayOnError ? <>{displayOnError}</> : null;\n  }\n\n  return (\n    <AthenaAuthContext.Provider value={authState}>\n      {children}\n    </AthenaAuthContext.Provider>\n  );\n}\n"],"names":["DEFAULT_MINT_RETRY_POLICY","isRetryableMintStatus","getMintRetryDelay","athenaDiagnostics","AthenaSdkError","useState","QueryClient","useRef","useMemo","useCallback","useQuery","useEffect","jsx","Fragment","AthenaAuthContext"],"mappings":";;;;;;;;;AAiIA,MAAM,4BAA6C;AAAA,EACjD,GAAGA,KAAAA;AAAAA,EACH,WAAW;AACb;AAgBA,MAAM,aAAa,MAAM,IAAI,aAAa,mCAAmC,YAAY;AAGzF,eAAe,iBAAiB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACF,GAI6B;AAC3B,MAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,QAAM,UAAU,IAAI,gBAAA;AACpB,QAAM,SAAS,MAAM,QAAQ,MAAA;AAC7B,SAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,MAAM;AACvD,MAAI,WAAW;AACf,QAAM,QAAQ,WAAW,MAAM;AAC7B,eAAW;AACX,YAAQ,MAAA;AAAA,EACV,GAAG,SAAS;AAEZ,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,KAAK,EAAE,aAAa,WAAW,QAAQ,QAAQ,QAAQ;AACpF,QAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,kBAAA;AACvE,QAAI,CAAC,SAAS,IAAI;AAChB,aAAOC,KAAAA,sBAAsB,SAAS,MAAM,IACxC,EAAE,MAAM,aAAa,QAAQ,SAAS,QAAQ,QAAQ,aACtD,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAA;AAAA,IACzC;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,SAAS,KAAA;AAAA,IACxB,SAAS,OAAO;AACd,UAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,aAAO,WACH,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,WAAW,OAAO,MAAA,IAC7D,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAA;AAAA,IACzC;AACA,WAAO,mBAAmB,IAAI,IAAI,EAAE,MAAM,WAAW,KAAA,IAAS,EAAE,MAAM,mBAAA;AAAA,EACxE,SAAS,OAAO;AACd,QAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,WAAO,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,WAAW,YAAY,WAAW,OAAO,MAAA;AAAA,EAC7F,UAAA;AACE,iBAAa,KAAK;AAClB,WAAO,oBAAoB,SAAS,MAAM;AAAA,EAC5C;AACF;AAqBA,eAAe,YAAY;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AACF,GAI2B;AACzB,QAAM,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,WAAW,CAAC;AAC9D,WAAS,WAAW,KAAK,YAAY,GAAG;AACtC,UAAM,UAAU,MAAM,iBAAiB,EAAE,KAAK,QAAQ,WAAW,OAAO,WAAW;AAEnF,QAAI,QAAQ,SAAS,UAAW,QAAO,EAAE,MAAM,WAAW,MAAM,QAAQ,KAAA;AACxE,QAAI,QAAQ,SAAS,kBAAmB,QAAO,EAAE,MAAM,cAAc,QAAQ,kBAAA;AAC7E,QAAI,QAAQ,SAAS,oBAAoB;AACvC,cAAQ;AAAA,QACN;AAAA,MAAA;AAEF,aAAO,EAAE,MAAM,cAAc,QAAQ,mBAAA;AAAA,IACvC;AAEA,QAAI,QAAQ,SAAS,eAAe,WAAW,aAAa;AAC1D,YAAM,UAAUC,KAAAA,kBAAkB,EAAE,OAAO,UAAU,QAAQ;AAC7DC,wBAAAA,kBAAkB,KAAK,2BAA2B;AAAA,QAChD,OAAO;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ,QAAQ;AAAA,UAChB,QAAQ,QAAQ;AAAA,UAChB,SAAS;AAAA,UACT,cAAc;AAAA,UACd,UAAU;AAAA,QAAA;AAAA,MACZ,CACD;AACD,YAAM,gBAAgB,EAAE,SAAS,QAAQ;AACzC;AAAA,IACF;AAEA,UAAM,iBAAiB,EAAE,KAAK,SAAS,UAAU;AAAA,EACnD;AACF;AAGA,SAAS,gBAAgB,EAAE,SAAS,UAAmE;AACrG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO,SAAS;AAClB,aAAO,YAAY;AACnB;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AACpB,mBAAa,KAAK;AAClB,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,aAAO,oBAAoB,SAAS,OAAO;AAC3C,cAAA;AAAA,IACF,GAAG,OAAO;AACV,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM;AAAA,EAC1D,CAAC;AACH;AAGA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AACF,GAImB;AACjB,MAAI,QAAQ,SAAS,UAAU;AAC7B,UAAM,aAAa,QAAQ,UAAU,OAAO,QAAQ,SAAS;AAC7D,WAAO,IAAIC,OAAAA,eAAe;AAAA,MACxB,MAAM;AAAA,MACN,SAAS,aACL,yBAAyB,GAAG,mBAAmB,QAAQ,MAAM,0BAC7D,yBAAyB,GAAG,mBAAmB,QAAQ,MAAM;AAAA,MACjE,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,MAChB,SAAS,EAAE,UAAU,QAAQ,aAAa,iBAAiB,SAAA;AAAA,IAAS,CACrE;AAAA,EACH;AACA,QAAM,SACJ,QAAQ,WAAW,OACf,QAAQ,QAAQ,MAAM,KACtB,QAAQ,WAAW,YACjB,cACA;AACR,SAAO,IAAIA,OAAAA,eAAe;AAAA,IACxB,MAAM;AAAA,IACN,SAAS,yBAAyB,GAAG,YAAY,QAAQ,QAAQ,aAAa,IAAI,KAAK,GAAG,WAAW,MAAM;AAAA,IAC3G,MAAM;AAAA,IACN,GAAI,QAAQ,WAAW,QAAQ,EAAE,QAAQ,QAAQ,OAAA;AAAA,IACjD,GAAI,QAAQ,UAAU,UAAa,EAAE,OAAO,QAAQ,MAAA;AAAA,IACpD,SAAS,EAAE,UAAU,QAAQ,QAAQ,OAAA;AAAA,EAAO,CAC7C;AACH;AAEA,MAAM,oBAAoB;AAAA,EACxB,UAAU;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AAEA,MAAM,oBAAoB,CAAC,UAA0B,MAAM,QAAQ,QAAQ,EAAE;AAE7E,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,SAAO,GAAG,kBAAkB,OAAO,CAAC,GAAG,WAAW;AACpD;AAEA,SAAS,mBAAmB,MAA0C;AACpE,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO;AAAA,EACT;AAEA,QAAM,YAAY;AASlB,SACE,OAAO,UAAU,gBAAgB,YACjC,MAAM,QAAQ,UAAU,cAAc,KACtC,CAAC,CAAC,UAAU,QACZ,OAAO,UAAU,KAAK,YAAY,YAClC,OAAO,UAAU,KAAK,UAAU;AAEpC;AAGA,SAAS,eAAe,MAItB;AACA,QAAM,OAAmB;AAAA,IACvB,QAAQ,KAAK,KAAK;AAAA,IAClB,OAAO,KAAK,KAAK;AAAA,IACjB,WAAW,KAAK,KAAK,cAAc;AAAA,IACnC,UAAU,KAAK,KAAK,aAAa;AAAA,IACjC,UAAU,KAAK,KAAK,YAAY;AAAA,IAChC,YAAY,KAAK,KAAK,eAAe;AAAA,IACrC,YAAY,KAAK,KAAK;AAAA,EAAA;AAGxB,QAAM,OAAoB,KAAK,eAAe,IAAI,CAAC,SAAS;AAAA,IAC1D,OAAO,IAAI;AAAA,IACX,SAAS,IAAI;AAAA,IACb,gBAAgB,IAAI;AAAA,EAAA,EACpB;AAEF,SAAO,EAAE,MAAM,MAAM,aAAa,KAAK,YAAA;AACzC;AAmCO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAC1B,cAAc;AAChB,GAA2B;AAGzB,QAAM,CAAC,WAAW,IAAIC,MAAAA,SAAS,MAAM,IAAIC,WAAAA,aAAa;AACtD,QAAM,iBAAiBC,MAAAA,OAAO,WAAW;AACzC,iBAAe,UAAU;AACzB,QAAM,aAAaA,MAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AAErB,QAAM,UAAUC,MAAAA;AAAAA,IACd,OAAO;AAAA,MACL,UAAU,cAAc;AAAA,QACtB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,MACD,OAAO,cAAc;AAAA,QACnB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,MACD,QAAQ,cAAc;AAAA,QACpB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,IAAA;AAAA,IAEH,CAAC,YAAY,gBAAgB,aAAa,YAAY;AAAA,EAAA;AAGxD,QAAM,WAAWA,MAAAA,QAAQ,MAAM,CAAC,cAAc,eAAe,QAAQ,QAAQ,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAKlG,QAAM,UAAUC,MAAAA;AAAAA,IACd,OAAO,EAAE,OAAA,MAA8D;;AACrE,UAAI;AACF,eAAO,MAAM,YAAY,EAAE,KAAK,QAAQ,UAAU,QAAQ,QAAQ,eAAe,SAAS;AAAA,MAC5F,SAAS,WAAW;AAClB,YAAI,qBAAqBL,OAAAA,gBAAgB;AACvCD,4BAAAA,kBAAkB,KAAK,2BAA2B,EAAE,OAAO,WAAW;AACtE,cAAI;AACF,6BAAW,YAAX,oCAAqB;AAAA,UACvB,SAAS,eAAe;AACtB,oBAAQ,MAAM,+CAA+C,aAAa;AAAA,UAC5E;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EAAA;AAGnB,QAAM,QAAQO,WAAAA;AAAAA,IACZ;AAAA,MACE;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA,OAAO;AAAA,MACP,aAAa;AAAA,MACb,WAAW,OAAO;AAAA,MAClB,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,IAAA;AAAA,IAEtB;AAAA,EAAA;AAGF,QAAM,SAAS,MAAM;AACrB,QAAM,WAAU,iCAAQ,UAAS,YAAY,OAAO,OAAO;AAC3D,QAAM,UAAU,MAAM;AACtB,QAAM,SAAwC,UAC1C,QACA,iCAAQ,UAAS,eACf,OAAO,SACP,MAAM,UACJ,mBACA;AACR,QAAM,aAAY,iCAAQ,UAAS,gBAAgB,OAAO,cAAc;AAExEC,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,2BAA2B,OAAO,WAAW,aAAa;AAC7D;AAAA,IACF;AAIA,UAAM,aAAa,MAAM;AACvB,WAAK,YAAY,eAAe,EAAE,SAAA,GAAY,EAAE,eAAe,OAAO;AAAA,IACxE;AACA,UAAM,yBAAyB,MAAM;AACnC,UAAI,SAAS,oBAAoB,WAAW;AAC1C,mBAAA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,iBAAiB,SAAS,UAAU;AAC3C,aAAS,iBAAiB,oBAAoB,sBAAsB;AAEpE,WAAO,MAAM;AACX,aAAO,oBAAoB,SAAS,UAAU;AAC9C,eAAS,oBAAoB,oBAAoB,sBAAsB;AAAA,IACzE;AAAA,EACF,GAAG,CAAC,yBAAyB,aAAa,QAAQ,CAAC;AAInDA,QAAAA,UAAU,MAAM;AACd,QACE,CAAC,WACD,WAAW,qBACX,CAAC,aACD,CAAC,kBACD,OAAO,WAAW,aAClB;AACA,aAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,SAAS,QAAQ,WAAW,gBAAgB,QAAQ,KAAK,CAAC;AAE9D,QAAM,QAAQF,MAAAA,YAAY,MAAM;AAC9B,SAAK,YAAY,aAAa,EAAE,UAAU;AAAA,EAC5C,GAAG,CAAC,aAAa,QAAQ,CAAC;AAE1B,QAAM,SAASA,MAAAA,YAAY,OAAO,mBAAmB,SAAS;AAC5D,UAAM,YAAY,cAAc,EAAE,UAAU;AAE5C,QAAI;AACF,YAAM,MAAM,QAAQ,QAAQ;AAAA,QAC1B,QAAQ;AAAA,QACR,aAAa;AAAA,MAAA,CACd;AAAA,IACH,SAAS,aAAa;AACpB,cAAQ,MAAM,8DAA8D,WAAW;AAAA,IACzF;AAEA,gBAAY,aAA4B,UAAU;AAAA,MAChD,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,WAAW;AAAA,IAAA,CACZ;AAED,QAAI,oBAAoB,OAAO,WAAW,aAAa;AACrD,aAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,aAAa,UAAU,QAAQ,OAAO,QAAQ,MAAM,CAAC;AAMzD,QAAM,aAAaF,MAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AACrB,QAAM,WAAWE,MAAAA;AAAAA,IACf,OAAO,EAAE,QAAQ,MAAA,IAAU,OAAO;;AAChC,UAAI,OAAO;AACT,YAAI;AACF,gBAAM,UAAU,MAAM,YAAY,WAAW;AAAA,YAC3C;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,OAAO;AAAA,YACP,aAAa;AAAA,UAAA,CACd;AACD,cAAI,QAAQ,SAAS,UAAW,QAAO,QAAQ,KAAK;AAAA,QACtD,QAAQ;AAAA,QAER;AAAA,MACF;AACA,eAAO,gBAAW,YAAX,mBAAoB,gBAAe;AAAA,IAC5C;AAAA,IACA,CAAC,aAAa,UAAU,OAAO;AAAA,EAAA;AAGjC,QAAM,YAA6BD,MAAAA,QAAQ,MAAM;AAC/C,QAAI,SAAS;AACX,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN,QAAQ,YAAY;AAAA,QAAC;AAAA,QACrB;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,EAAE,MAAM,MAAM,YAAA,IAAgB,eAAe,OAAO;AAE1D,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ,GAAG,CAAC,SAAS,SAAS,QAAQ,QAAQ,CAAC;AAEvC,MAAI,UAAU,WAAW;AACvB,WAAOI,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,iCAAuB,KAAA,CAAK;AAAA,EACxC;AAEA,MAAI,CAAC,UAAU,YAAY;AACzB,QAAI,OAAO,mBAAmB,YAAY;AACxC,aAAOD,+BAAAC,WAAAA,UAAA,EAAG,yBAAe,EAAE,QAAQ,UAAU,mBAAmB,MAAA,CAAO,EAAA,CAAE;AAAA,IAC3E;AACA,WAAO,iBAAiBD,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,UAAA,eAAA,CAAe,IAAM;AAAA,EAClD;AAEA,wCACGC,kBAAAA,kBAAkB,UAAlB,EAA2B,OAAO,WAChC,UACH;AAEJ;;"}
+{"version":3,"file":"AthenaSSOProvider.cjs","sources":["../../src/auth/AthenaSSOProvider.tsx"],"sourcesContent":["import { QueryClient, useQuery } from '@tanstack/react-query';\nimport type { ReactNode } from 'react';\nimport { useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { athenaDiagnostics } from '../diagnostics/athena-diagnostics';\nimport { AthenaSdkError } from '../diagnostics/errors';\nimport {\n  DEFAULT_MINT_RETRY_POLICY,\n  getMintRetryDelay,\n  isRetryableMintStatus,\n  type MintRetryPolicy,\n} from '../runtime/auth';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { AthenaAuthContext } from './AthenaAuthContext';\nimport type {\n  AthenaAuthState,\n  AthenaOrg,\n  AthenaSSOUserInfo,\n  AthenaUser,\n} from './types';\n\n// ─── Props ────────────────────────────────────────────────────────────\n\nexport interface AthenaSSOProviderProps {\n  children: ReactNode;\n\n  /**\n   * Base URL used to resolve the Athena SSO endpoints.\n   *\n   * When omitted, the provider defaults to same-origin relative paths:\n   * `/api/sso/userinfo`, `/api/sso/initiate`, and `/api/sso/logout`.\n   *\n   * Use this when your frontend and backend live on different origins\n   * (for example `https://app.example.com` + `https://api.example.com`).\n   */\n  ssoBaseUrl?: string;\n\n  /**\n   * Optional override for the SSO user-info endpoint that returns the\n   * authenticated user's data and access token.\n   *\n   * The endpoint must return JSON matching `AthenaSSOUserInfo`:\n   * ```json\n   * {\n   *   \"user\": { \"user_id\": \"…\", \"email\": \"…\", … },\n   *   \"orgMemberInfos\": [{ \"orgId\": \"…\", \"orgName\": \"…\", \"urlSafeOrgName\": \"…\" }],\n   *   \"accessToken\": \"…\"\n   * }\n   * ```\n   *\n   * The request is sent with `credentials: 'include'` so that\n   * session cookies are forwarded automatically.\n   */\n  ssoUserInfoUrl?: string;\n\n  /**\n   * Optional override for the URL to redirect the user to when no valid\n   * SSO session exists.\n   * This is typically the SSO initiation endpoint on your backend\n   * (e.g. `https://api.yourdomain.com/api/sso/initiate`).\n   */\n  ssoLoginUrl?: string;\n\n  /**\n   * Optional override for the backend SSO logout endpoint.\n   * Defaults to `/api/sso/logout` (or `${ssoBaseUrl}/api/sso/logout`).\n   */\n  ssoLogoutUrl?: string;\n\n  /**\n   * Custom element displayed while the SSO session is being verified.\n   * Defaults to `null` (renders nothing).\n   */\n  displayWhileLoading?: ReactNode;\n\n  /**\n   * Shown when there is no session to sign the app in with: an element, or a\n   * function that receives why (`reason`) and a `retry`, so the app can offer\n   * sign-in only to a person who is signed out and a retry when the endpoint\n   * could not answer (see `AthenaSSOFailure`).\n   * If not provided, the user is automatically redirected to `ssoLoginUrl`\n   * when the endpoint answers that there is no session.\n   */\n  displayOnError?: ReactNode | ((failure: AthenaSSOFailure) => ReactNode);\n\n  /**\n   * Called with the typed error (`auth_sso_failed`) when a session read gives\n   * up. A nested `AthenaProvider`'s `onError` is not mounted while the first\n   * read runs, so observe sign-in failures here.\n   */\n  onError?: (error: AthenaSdkError) => void;\n\n  /**\n   * Re-validate the SSO session when the window regains focus.\n   * Disabled by default. When enabled, token expiry and user switching\n   * are picked up without requiring a full page reload.\n   */\n  revalidateOnWindowFocus?: boolean;\n\n  /** @internal Overrides how a session read retries; used by tests. */\n  retryPolicy?: MintRetryPolicy;\n}\n\n/**\n * Why the provider has no session.\n *\n * - `unauthenticated`: the endpoint answered 401 or 403, or the person signed\n *   out. Offer sign-in.\n * - `request_failed`: the endpoint did not answer usably. A network error, a\n *   timeout, or a 5xx / 408 / 429 on every attempt of one read, or another\n *   status. The person may well be signed in. Offer `retry`.\n * - `invalid_response`: it answered without a usable session.\n */\nexport type AthenaSSOFailureReason = 'unauthenticated' | 'invalid_response' | 'request_failed';\n\n/** What `displayOnError` receives when it is a function. */\nexport interface AthenaSSOFailure {\n  reason: AthenaSSOFailureReason;\n  /** Read the session again. `displayWhileLoading` shows meanwhile. */\n  retry: () => void;\n}\n\n// ─── Helpers ──────────────────────────────────────────────────────────\n\n/**\n * How one session read retries: the parent bridge's mint policy (Marathon's\n * `/api/sso/userinfo` and `/_athena/auth` mint the same credential), with a\n * longer wait per request, since every request mints and a slow answer is\n * still an answer.\n */\nconst SSO_USERINFO_RETRY_POLICY: MintRetryPolicy = {\n  ...DEFAULT_MINT_RETRY_POLICY,\n  timeoutMs: 10_000,\n};\n\n/** One userinfo request, classified. */\ntype UserInfoAttempt =\n  | { kind: 'session'; data: AthenaSSOUserInfo }\n  | { kind: 'unauthenticated' }\n  | { kind: 'invalid_response' }\n  /** A status it does not retry, or a 2xx whose body is not JSON. */\n  | { kind: 'failed'; status: number }\n  | {\n      kind: 'transient';\n      status: number | null;\n      reason: 'status' | 'network' | 'timeout';\n      cause?: unknown;\n    };\n\nconst abortError = () => new DOMException('The session read was cancelled.', 'AbortError');\n\n/** One userinfo request. Throws an `AbortError` when `signal` cancels the read. */\nasync function readUserInfoOnce({\n  url,\n  signal,\n  timeoutMs,\n}: {\n  url: string;\n  signal: AbortSignal;\n  timeoutMs: number;\n}): Promise<UserInfoAttempt> {\n  if (signal.aborted) throw abortError();\n  const request = new AbortController();\n  const cancel = () => request.abort();\n  signal.addEventListener('abort', cancel, { once: true });\n  let timedOut = false;\n  const timer = setTimeout(() => {\n    timedOut = true;\n    request.abort();\n  }, timeoutMs);\n\n  try {\n    const response = await fetch(url, { credentials: 'include', signal: request.signal });\n    if (response.status === 401 || response.status === 403) return { kind: 'unauthenticated' };\n    if (!response.ok) {\n      return isRetryableMintStatus(response.status)\n        ? { kind: 'transient', status: response.status, reason: 'status' }\n        : { kind: 'failed', status: response.status };\n    }\n\n    let data: unknown;\n    try {\n      data = await response.json();\n    } catch (error) {\n      if (signal.aborted) throw abortError();\n      return timedOut\n        ? { kind: 'transient', status: null, reason: 'timeout', cause: error }\n        : { kind: 'failed', status: response.status };\n    }\n    return isValidSSOUserInfo(data) ? { kind: 'session', data } : { kind: 'invalid_response' };\n  } catch (error) {\n    if (signal.aborted) throw abortError();\n    return { kind: 'transient', status: null, reason: timedOut ? 'timeout' : 'network', cause: error };\n  } finally {\n    clearTimeout(timer);\n    signal.removeEventListener('abort', cancel);\n  }\n}\n\n/**\n * What a read concluded, as the query holds it. A read that could not answer\n * throws instead (`request_failed`), so an earlier answer stays.\n */\ntype SessionAnswer =\n  | { kind: 'session'; data: AthenaSSOUserInfo }\n  | {\n      kind: 'no_session';\n      reason: Exclude<AthenaSSOFailureReason, 'request_failed'>;\n      /** The person signed out here (`logout`), rather than the endpoint answering no session. */\n      signedOut?: true;\n    };\n\n/**\n * One session read: one bounded cycle of userinfo requests. A transient\n * failure is retried with `policy`'s capped, jittered backoff; a read that\n * gives up throws the typed error it reports. Throws an `AbortError` when\n * `signal` cancels the read.\n */\nasync function readSession({\n  url,\n  signal,\n  policy,\n}: {\n  url: string;\n  signal: AbortSignal;\n  policy: MintRetryPolicy;\n}): Promise<SessionAnswer> {\n  const maxAttempts = Math.max(1, Math.floor(policy.maxAttempts));\n  for (let attempts = 1; ; attempts += 1) {\n    const attempt = await readUserInfoOnce({ url, signal, timeoutMs: policy.timeoutMs });\n\n    if (attempt.kind === 'session') return { kind: 'session', data: attempt.data };\n    if (attempt.kind === 'unauthenticated') return { kind: 'no_session', reason: 'unauthenticated' };\n    if (attempt.kind === 'invalid_response') {\n      console.error(\n        '[AthenaSDK] Invalid SSO userinfo response: expected \"user.user_id\", \"user.email\", \"orgMemberInfos\", and \"accessToken\"',\n      );\n      return { kind: 'no_session', reason: 'invalid_response' };\n    }\n\n    if (attempt.kind === 'transient' && attempts < maxAttempts) {\n      const delayMs = getMintRetryDelay({ retry: attempts, policy });\n      athenaDiagnostics.emit('auth.sso.userinfo.retry', {\n        level: 'warn',\n        data: {\n          status: attempt.status,\n          reason: attempt.reason,\n          attempt: attempts,\n          max_attempts: maxAttempts,\n          delay_ms: delayMs,\n        },\n      });\n      await waitBeforeRetry({ delayMs, signal });\n      continue;\n    }\n\n    throw sessionReadError({ url, attempt, attempts });\n  }\n}\n\n/** The backoff between two requests of one read; cancelling the read ends it at once. */\nfunction waitBeforeRetry({ delayMs, signal }: { delayMs: number; signal: AbortSignal }): Promise<void> {\n  return new Promise((resolve, reject) => {\n    if (signal.aborted) {\n      reject(abortError());\n      return;\n    }\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(abortError());\n    };\n    const timer = setTimeout(() => {\n      signal.removeEventListener('abort', onAbort);\n      resolve();\n    }, delayMs);\n    signal.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/** The typed error a read reports when it gives up without an answer about the session. */\nfunction sessionReadError({\n  url,\n  attempt,\n  attempts,\n}: {\n  url: string;\n  attempt: Extract<UserInfoAttempt, { kind: 'failed' | 'transient' }>;\n  attempts: number;\n}): AthenaSdkError {\n  if (attempt.kind === 'failed') {\n    const unreadable = attempt.status >= 200 && attempt.status < 300;\n    return new AthenaSdkError({\n      code: 'auth_sso_failed',\n      message: unreadable\n        ? `The SSO session read (${url}) answered HTTP ${attempt.status} without a JSON body.`\n        : `The SSO session read (${url}) answered HTTP ${attempt.status}.`,\n      hint: 'Check that ssoBaseUrl / ssoUserInfoUrl point at the SSO userinfo endpoint.',\n      status: attempt.status,\n      context: { attempts, reason: unreadable ? 'invalid_body' : 'status' },\n    });\n  }\n  const answer =\n    attempt.status !== null\n      ? `HTTP ${attempt.status}`\n      : attempt.reason === 'timeout'\n        ? 'a timeout'\n        : 'a network error';\n  return new AthenaSdkError({\n    code: 'auth_sso_failed',\n    message: `The SSO session read (${url}) failed ${attempts} time${attempts === 1 ? '' : 's'} (last: ${answer}).`,\n    hint: 'The sign-in service did not answer; the person may still be signed in. Offer a retry (displayOnError receives retry).',\n    ...(attempt.status !== null && { status: attempt.status }),\n    ...(attempt.cause !== undefined && { cause: attempt.cause }),\n    context: { attempts, reason: attempt.reason },\n  });\n}\n\nconst DEFAULT_SSO_PATHS = {\n  userInfo: '/api/sso/userinfo',\n  login: '/api/sso/initiate',\n  logout: '/api/sso/logout',\n} as const;\n\nconst trimTrailingSlash = (value: string): string => value.replace(/\\/+$/, '');\n\nfunction resolveSSOUrl({\n  baseUrl,\n  overrideUrl,\n  defaultPath,\n}: {\n  baseUrl?: string;\n  overrideUrl?: string;\n  defaultPath: string;\n}): string {\n  if (overrideUrl) {\n    return overrideUrl;\n  }\n\n  if (!baseUrl) {\n    return defaultPath;\n  }\n\n  return `${trimTrailingSlash(baseUrl)}${defaultPath}`;\n}\n\nfunction isValidSSOUserInfo(data: unknown): data is AthenaSSOUserInfo {\n  if (!data || typeof data !== 'object') {\n    return false;\n  }\n\n  const candidate = data as {\n    accessToken?: unknown;\n    orgMemberInfos?: unknown;\n    user?: {\n      user_id?: unknown;\n      email?: unknown;\n    };\n  };\n\n  return (\n    typeof candidate.accessToken === 'string' &&\n    Array.isArray(candidate.orgMemberInfos) &&\n    !!candidate.user &&\n    typeof candidate.user.user_id === 'string' &&\n    typeof candidate.user.email === 'string'\n  );\n}\n\n/** Map the backend SSO response to the SDK's user/org types. */\nfunction mapSSOResponse(data: AthenaSSOUserInfo): {\n  user: AthenaUser;\n  orgs: AthenaOrg[];\n  accessToken: string;\n} {\n  const user: AthenaUser = {\n    userId: data.user.user_id,\n    email: data.user.email,\n    firstName: data.user.first_name || undefined,\n    lastName: data.user.last_name || undefined,\n    username: data.user.username || undefined,\n    pictureUrl: data.user.picture_url || undefined,\n    properties: data.user.properties,\n  };\n\n  const orgs: AthenaOrg[] = data.orgMemberInfos.map((org) => ({\n    orgId: org.orgId,\n    orgName: org.orgName,\n    urlSafeOrgName: org.urlSafeOrgName,\n  }));\n\n  return { user, orgs, accessToken: data.accessToken };\n}\n\n// ─── Provider ─────────────────────────────────────────────────────────\n\n/**\n * Wraps your app with Athena authentication powered by an external SSO\n * identity provider (e.g. Microsoft Entra / Azure AD, Okta, etc.).\n *\n * The SSO login flow is handled entirely by your backend. This provider\n * verifies the session by fetching `ssoUserInfoUrl` and exposes the\n * same `AthenaAuthState` context that `AthenaAuthProvider` (PropelAuth)\n * provides, so downstream components like `<AthenaProvider>` and\n * `useAthenaAuth()` work identically.\n *\n * Place this **above** `<AthenaProvider>` in the component tree.\n *\n * @example\n * ```tsx\n * import { AthenaSSOProvider } from '@athenaintel/react/auth';\n * import { AthenaProvider, AthenaChat } from '@athenaintel/react';\n *\n * function App() {\n *   return (\n *     <AthenaSSOProvider\n *       ssoUserInfoUrl=\"https://api.yourdomain.com/api/sso/userinfo\"\n *       ssoLoginUrl=\"https://api.yourdomain.com/api/sso/initiate\"\n *     >\n *       <AthenaProvider>\n *         <AthenaChat />\n *       </AthenaProvider>\n *     </AthenaSSOProvider>\n *   );\n * }\n * ```\n */\nexport function AthenaSSOProvider({\n  children,\n  ssoBaseUrl,\n  ssoUserInfoUrl,\n  ssoLoginUrl,\n  ssoLogoutUrl,\n  displayWhileLoading,\n  displayOnError,\n  onError,\n  revalidateOnWindowFocus = false,\n  retryPolicy = SSO_USERINFO_RETRY_POLICY,\n}: AthenaSSOProviderProps) {\n  // The provider's own client, never a host's: the session holds an access\n  // token, and a host may persist its query cache.\n  const [queryClient] = useState(() => new QueryClient());\n  const retryPolicyRef = useRef(retryPolicy);\n  retryPolicyRef.current = retryPolicy;\n  const onErrorRef = useRef(onError);\n  onErrorRef.current = onError;\n\n  const ssoUrls = useMemo(\n    () => ({\n      userInfo: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoUserInfoUrl,\n        defaultPath: DEFAULT_SSO_PATHS.userInfo,\n      }),\n      login: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoLoginUrl,\n        defaultPath: DEFAULT_SSO_PATHS.login,\n      }),\n      logout: resolveSSOUrl({\n        baseUrl: ssoBaseUrl,\n        overrideUrl: ssoLogoutUrl,\n        defaultPath: DEFAULT_SSO_PATHS.logout,\n      }),\n    }),\n    [ssoBaseUrl, ssoUserInfoUrl, ssoLoginUrl, ssoLogoutUrl],\n  );\n\n  const queryKey = useMemo(() => ['athena-sdk', 'sso-session', ssoUrls.userInfo], [ssoUrls.userInfo]);\n\n  // One read is one bounded cycle (`readSession`). A read that gives up\n  // throws, so the query keeps the session an earlier read answered: a failed\n  // background revalidation or renewal does not sign the person out.\n  const queryFn = useCallback(\n    async ({ signal }: { signal: AbortSignal }): Promise<SessionAnswer> => {\n      try {\n        return await readSession({ url: ssoUrls.userInfo, signal, policy: retryPolicyRef.current });\n      } catch (readError) {\n        if (readError instanceof AthenaSdkError) {\n          athenaDiagnostics.emit('auth.sso.userinfo.error', { error: readError });\n          try {\n            onErrorRef.current?.(readError);\n          } catch (callbackError) {\n            console.error('[AthenaSDK] AthenaSSOProvider onError threw', callbackError);\n          }\n        }\n        throw readError;\n      }\n    },\n    [ssoUrls.userInfo],\n  );\n\n  const query = useQuery(\n    {\n      queryKey,\n      queryFn,\n      // `readSession` retries a transient failure itself, with the bridge's\n      // policy; the query never retries on top of it, and reads while the\n      // browser reports itself offline too, so that policy decides.\n      retry: false,\n      networkMode: 'always',\n      staleTime: Number.POSITIVE_INFINITY,\n      refetchOnWindowFocus: false,\n      refetchOnReconnect: false,\n    },\n    queryClient,\n  );\n\n  const answer = query.data;\n  const session = answer?.kind === 'session' ? answer.data : null;\n  const loading = query.isPending;\n  const reason: AthenaSSOFailureReason | null = session\n    ? null\n    : answer?.kind === 'no_session'\n      ? answer.reason\n      : query.isError\n        ? 'request_failed'\n        : null;\n  const signedOut = answer?.kind === 'no_session' && answer.signedOut === true;\n\n  useEffect(() => {\n    if (!revalidateOnWindowFocus || typeof window === 'undefined') {\n      return;\n    }\n\n    // A revalidation joins a read already in flight (a renewal, the first\n    // read) instead of cancelling it.\n    const revalidate = () => {\n      void queryClient.refetchQueries({ queryKey }, { cancelRefetch: false });\n    };\n    const handleVisibilityChange = () => {\n      if (document.visibilityState === 'visible') {\n        revalidate();\n      }\n    };\n\n    window.addEventListener('focus', revalidate);\n    document.addEventListener('visibilitychange', handleVisibilityChange);\n\n    return () => {\n      window.removeEventListener('focus', revalidate);\n      document.removeEventListener('visibilitychange', handleVisibilityChange);\n    };\n  }, [revalidateOnWindowFocus, queryClient, queryKey]);\n\n  // Redirect to SSO login when the endpoint answered no session and no error\n  // UI was provided. Signing out redirects by itself, when asked to.\n  useEffect(() => {\n    if (\n      !loading &&\n      reason === 'unauthenticated' &&\n      !signedOut &&\n      !displayOnError &&\n      typeof window !== 'undefined'\n    ) {\n      window.location.assign(ssoUrls.login);\n    }\n  }, [loading, reason, signedOut, displayOnError, ssoUrls.login]);\n\n  const retry = useCallback(() => {\n    void queryClient.resetQueries({ queryKey });\n  }, [queryClient, queryKey]);\n\n  const logout = useCallback(async (redirectOnLogout = true) => {\n    await queryClient.cancelQueries({ queryKey });\n\n    try {\n      await fetch(ssoUrls.logout, {\n        method: 'POST',\n        credentials: 'include',\n      });\n    } catch (logoutError) {\n      console.error('[AthenaSDK] Failed to invalidate SSO session during logout', logoutError);\n    }\n\n    queryClient.setQueryData<SessionAnswer>(queryKey, {\n      kind: 'no_session',\n      reason: 'unauthenticated',\n      signedOut: true,\n    });\n\n    if (redirectOnLogout && typeof window !== 'undefined') {\n      window.location.assign(ssoUrls.login);\n    }\n  }, [queryClient, queryKey, ssoUrls.login, ssoUrls.logout]);\n\n  // The SSO side of the SDK's credential source: `force` (the previous token\n  // was refused) reads the session again for a new token, joining a read\n  // already in flight; otherwise, or when that read has no session to hand\n  // back, the held one is served.\n  const sessionRef = useRef(session);\n  sessionRef.current = session;\n  const getToken = useCallback<AthenaStatewireTokenGetter>(\n    async ({ force = false } = {}) => {\n      if (force) {\n        try {\n          const renewed = await queryClient.fetchQuery({\n            queryKey,\n            queryFn,\n            staleTime: 0,\n            retry: false,\n            networkMode: 'always',\n          });\n          if (renewed.kind === 'session') return renewed.data.accessToken;\n        } catch {\n          // The read gave up (already reported) or was cancelled.\n        }\n      }\n      return sessionRef.current?.accessToken ?? null;\n    },\n    [queryClient, queryKey, queryFn],\n  );\n\n  const authState: AthenaAuthState = useMemo(() => {\n    if (loading) {\n      return {\n        isLoggedIn: false,\n        isLoading: true,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout: async () => {},\n        getToken,\n      };\n    }\n\n    if (!session) {\n      return {\n        isLoggedIn: false,\n        isLoading: false,\n        user: null,\n        accessToken: null,\n        orgs: [],\n        logout,\n        getToken,\n      };\n    }\n\n    const { user, orgs, accessToken } = mapSSOResponse(session);\n\n    return {\n      isLoggedIn: true,\n      isLoading: false,\n      user,\n      accessToken,\n      orgs,\n      logout,\n      getToken,\n    };\n  }, [loading, session, logout, getToken]);\n\n  if (authState.isLoading) {\n    return <>{displayWhileLoading ?? null}</>;\n  }\n\n  if (!authState.isLoggedIn) {\n    if (typeof displayOnError === 'function') {\n      return <>{displayOnError({ reason: reason ?? 'unauthenticated', retry })}</>;\n    }\n    return displayOnError ? <>{displayOnError}</> : null;\n  }\n\n  return (\n    <AthenaAuthContext.Provider value={authState}>\n      {children}\n    </AthenaAuthContext.Provider>\n  );\n}\n"],"names":["DEFAULT_MINT_RETRY_POLICY","isRetryableMintStatus","getMintRetryDelay","athenaDiagnostics","AthenaSdkError","useState","QueryClient","useRef","useMemo","useCallback","useQuery","useEffect","jsx","Fragment","AthenaAuthContext"],"mappings":";;;;;;;;;AAiIA,MAAM,4BAA6C;AAAA,EACjD,GAAGA,KAAAA;AAAAA,EACH,WAAW;AACb;AAgBA,MAAM,aAAa,MAAM,IAAI,aAAa,mCAAmC,YAAY;AAGzF,eAAe,iBAAiB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACF,GAI6B;AAC3B,MAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,QAAM,UAAU,IAAI,gBAAA;AACpB,QAAM,SAAS,MAAM,QAAQ,MAAA;AAC7B,SAAO,iBAAiB,SAAS,QAAQ,EAAE,MAAM,MAAM;AACvD,MAAI,WAAW;AACf,QAAM,QAAQ,WAAW,MAAM;AAC7B,eAAW;AACX,YAAQ,MAAA;AAAA,EACV,GAAG,SAAS;AAEZ,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,KAAK,EAAE,aAAa,WAAW,QAAQ,QAAQ,QAAQ;AACpF,QAAI,SAAS,WAAW,OAAO,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,kBAAA;AACvE,QAAI,CAAC,SAAS,IAAI;AAChB,aAAOC,KAAAA,sBAAsB,SAAS,MAAM,IACxC,EAAE,MAAM,aAAa,QAAQ,SAAS,QAAQ,QAAQ,aACtD,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAA;AAAA,IACzC;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,SAAS,KAAA;AAAA,IACxB,SAAS,OAAO;AACd,UAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,aAAO,WACH,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,WAAW,OAAO,MAAA,IAC7D,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAA;AAAA,IACzC;AACA,WAAO,mBAAmB,IAAI,IAAI,EAAE,MAAM,WAAW,KAAA,IAAS,EAAE,MAAM,mBAAA;AAAA,EACxE,SAAS,OAAO;AACd,QAAI,OAAO,QAAS,OAAM,WAAA;AAC1B,WAAO,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,WAAW,YAAY,WAAW,OAAO,MAAA;AAAA,EAC7F,UAAA;AACE,iBAAa,KAAK;AAClB,WAAO,oBAAoB,SAAS,MAAM;AAAA,EAC5C;AACF;AAqBA,eAAe,YAAY;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AACF,GAI2B;AACzB,QAAM,cAAc,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,WAAW,CAAC;AAC9D,WAAS,WAAW,KAAK,YAAY,GAAG;AACtC,UAAM,UAAU,MAAM,iBAAiB,EAAE,KAAK,QAAQ,WAAW,OAAO,WAAW;AAEnF,QAAI,QAAQ,SAAS,UAAW,QAAO,EAAE,MAAM,WAAW,MAAM,QAAQ,KAAA;AACxE,QAAI,QAAQ,SAAS,kBAAmB,QAAO,EAAE,MAAM,cAAc,QAAQ,kBAAA;AAC7E,QAAI,QAAQ,SAAS,oBAAoB;AACvC,cAAQ;AAAA,QACN;AAAA,MAAA;AAEF,aAAO,EAAE,MAAM,cAAc,QAAQ,mBAAA;AAAA,IACvC;AAEA,QAAI,QAAQ,SAAS,eAAe,WAAW,aAAa;AAC1D,YAAM,UAAUC,KAAAA,kBAAkB,EAAE,OAAO,UAAU,QAAQ;AAC7DC,wBAAAA,kBAAkB,KAAK,2BAA2B;AAAA,QAChD,OAAO;AAAA,QACP,MAAM;AAAA,UACJ,QAAQ,QAAQ;AAAA,UAChB,QAAQ,QAAQ;AAAA,UAChB,SAAS;AAAA,UACT,cAAc;AAAA,UACd,UAAU;AAAA,QAAA;AAAA,MACZ,CACD;AACD,YAAM,gBAAgB,EAAE,SAAS,QAAQ;AACzC;AAAA,IACF;AAEA,UAAM,iBAAiB,EAAE,KAAK,SAAS,UAAU;AAAA,EACnD;AACF;AAGA,SAAS,gBAAgB,EAAE,SAAS,UAAmE;AACrG,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO,SAAS;AAClB,aAAO,YAAY;AACnB;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AACpB,mBAAa,KAAK;AAClB,aAAO,YAAY;AAAA,IACrB;AACA,UAAM,QAAQ,WAAW,MAAM;AAC7B,aAAO,oBAAoB,SAAS,OAAO;AAC3C,cAAA;AAAA,IACF,GAAG,OAAO;AACV,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,MAAM;AAAA,EAC1D,CAAC;AACH;AAGA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AACF,GAImB;AACjB,MAAI,QAAQ,SAAS,UAAU;AAC7B,UAAM,aAAa,QAAQ,UAAU,OAAO,QAAQ,SAAS;AAC7D,WAAO,IAAIC,OAAAA,eAAe;AAAA,MACxB,MAAM;AAAA,MACN,SAAS,aACL,yBAAyB,GAAG,mBAAmB,QAAQ,MAAM,0BAC7D,yBAAyB,GAAG,mBAAmB,QAAQ,MAAM;AAAA,MACjE,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,MAChB,SAAS,EAAE,UAAU,QAAQ,aAAa,iBAAiB,SAAA;AAAA,IAAS,CACrE;AAAA,EACH;AACA,QAAM,SACJ,QAAQ,WAAW,OACf,QAAQ,QAAQ,MAAM,KACtB,QAAQ,WAAW,YACjB,cACA;AACR,SAAO,IAAIA,OAAAA,eAAe;AAAA,IACxB,MAAM;AAAA,IACN,SAAS,yBAAyB,GAAG,YAAY,QAAQ,QAAQ,aAAa,IAAI,KAAK,GAAG,WAAW,MAAM;AAAA,IAC3G,MAAM;AAAA,IACN,GAAI,QAAQ,WAAW,QAAQ,EAAE,QAAQ,QAAQ,OAAA;AAAA,IACjD,GAAI,QAAQ,UAAU,UAAa,EAAE,OAAO,QAAQ,MAAA;AAAA,IACpD,SAAS,EAAE,UAAU,QAAQ,QAAQ,OAAA;AAAA,EAAO,CAC7C;AACH;AAEA,MAAM,oBAAoB;AAAA,EACxB,UAAU;AAAA,EACV,OAAO;AAAA,EACP,QAAQ;AACV;AAEA,MAAM,oBAAoB,CAAC,UAA0B,MAAM,QAAQ,QAAQ,EAAE;AAE7E,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AACF,GAIW;AACT,MAAI,aAAa;AACf,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,SAAO,GAAG,kBAAkB,OAAO,CAAC,GAAG,WAAW;AACpD;AAEA,SAAS,mBAAmB,MAA0C;AACpE,MAAI,CAAC,QAAQ,OAAO,SAAS,UAAU;AACrC,WAAO;AAAA,EACT;AAEA,QAAM,YAAY;AASlB,SACE,OAAO,UAAU,gBAAgB,YACjC,MAAM,QAAQ,UAAU,cAAc,KACtC,CAAC,CAAC,UAAU,QACZ,OAAO,UAAU,KAAK,YAAY,YAClC,OAAO,UAAU,KAAK,UAAU;AAEpC;AAGA,SAAS,eAAe,MAItB;AACA,QAAM,OAAmB;AAAA,IACvB,QAAQ,KAAK,KAAK;AAAA,IAClB,OAAO,KAAK,KAAK;AAAA,IACjB,WAAW,KAAK,KAAK,cAAc;AAAA,IACnC,UAAU,KAAK,KAAK,aAAa;AAAA,IACjC,UAAU,KAAK,KAAK,YAAY;AAAA,IAChC,YAAY,KAAK,KAAK,eAAe;AAAA,IACrC,YAAY,KAAK,KAAK;AAAA,EAAA;AAGxB,QAAM,OAAoB,KAAK,eAAe,IAAI,CAAC,SAAS;AAAA,IAC1D,OAAO,IAAI;AAAA,IACX,SAAS,IAAI;AAAA,IACb,gBAAgB,IAAI;AAAA,EAAA,EACpB;AAEF,SAAO,EAAE,MAAM,MAAM,aAAa,KAAK,YAAA;AACzC;AAmCO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAC1B,cAAc;AAChB,GAA2B;AAGzB,QAAM,CAAC,WAAW,IAAIC,WAAAA,SAAS,MAAM,IAAIC,WAAAA,aAAa;AACtD,QAAM,iBAAiBC,WAAAA,OAAO,WAAW;AACzC,iBAAe,UAAU;AACzB,QAAM,aAAaA,WAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AAErB,QAAM,UAAUC,WAAAA;AAAAA,IACd,OAAO;AAAA,MACL,UAAU,cAAc;AAAA,QACtB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,MACD,OAAO,cAAc;AAAA,QACnB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,MACD,QAAQ,cAAc;AAAA,QACpB,SAAS;AAAA,QACT,aAAa;AAAA,QACb,aAAa,kBAAkB;AAAA,MAAA,CAChC;AAAA,IAAA;AAAA,IAEH,CAAC,YAAY,gBAAgB,aAAa,YAAY;AAAA,EAAA;AAGxD,QAAM,WAAWA,WAAAA,QAAQ,MAAM,CAAC,cAAc,eAAe,QAAQ,QAAQ,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAKlG,QAAM,UAAUC,WAAAA;AAAAA,IACd,OAAO,EAAE,OAAA,MAA8D;;AACrE,UAAI;AACF,eAAO,MAAM,YAAY,EAAE,KAAK,QAAQ,UAAU,QAAQ,QAAQ,eAAe,SAAS;AAAA,MAC5F,SAAS,WAAW;AAClB,YAAI,qBAAqBL,OAAAA,gBAAgB;AACvCD,4BAAAA,kBAAkB,KAAK,2BAA2B,EAAE,OAAO,WAAW;AACtE,cAAI;AACF,6BAAW,YAAX,oCAAqB;AAAA,UACvB,SAAS,eAAe;AACtB,oBAAQ,MAAM,+CAA+C,aAAa;AAAA,UAC5E;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EAAA;AAGnB,QAAM,QAAQO,WAAAA;AAAAA,IACZ;AAAA,MACE;AAAA,MACA;AAAA;AAAA;AAAA;AAAA,MAIA,OAAO;AAAA,MACP,aAAa;AAAA,MACb,WAAW,OAAO;AAAA,MAClB,sBAAsB;AAAA,MACtB,oBAAoB;AAAA,IAAA;AAAA,IAEtB;AAAA,EAAA;AAGF,QAAM,SAAS,MAAM;AACrB,QAAM,WAAU,iCAAQ,UAAS,YAAY,OAAO,OAAO;AAC3D,QAAM,UAAU,MAAM;AACtB,QAAM,SAAwC,UAC1C,QACA,iCAAQ,UAAS,eACf,OAAO,SACP,MAAM,UACJ,mBACA;AACR,QAAM,aAAY,iCAAQ,UAAS,gBAAgB,OAAO,cAAc;AAExEC,aAAAA,UAAU,MAAM;AACd,QAAI,CAAC,2BAA2B,OAAO,WAAW,aAAa;AAC7D;AAAA,IACF;AAIA,UAAM,aAAa,MAAM;AACvB,WAAK,YAAY,eAAe,EAAE,SAAA,GAAY,EAAE,eAAe,OAAO;AAAA,IACxE;AACA,UAAM,yBAAyB,MAAM;AACnC,UAAI,SAAS,oBAAoB,WAAW;AAC1C,mBAAA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,iBAAiB,SAAS,UAAU;AAC3C,aAAS,iBAAiB,oBAAoB,sBAAsB;AAEpE,WAAO,MAAM;AACX,aAAO,oBAAoB,SAAS,UAAU;AAC9C,eAAS,oBAAoB,oBAAoB,sBAAsB;AAAA,IACzE;AAAA,EACF,GAAG,CAAC,yBAAyB,aAAa,QAAQ,CAAC;AAInDA,aAAAA,UAAU,MAAM;AACd,QACE,CAAC,WACD,WAAW,qBACX,CAAC,aACD,CAAC,kBACD,OAAO,WAAW,aAClB;AACA,aAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,SAAS,QAAQ,WAAW,gBAAgB,QAAQ,KAAK,CAAC;AAE9D,QAAM,QAAQF,WAAAA,YAAY,MAAM;AAC9B,SAAK,YAAY,aAAa,EAAE,UAAU;AAAA,EAC5C,GAAG,CAAC,aAAa,QAAQ,CAAC;AAE1B,QAAM,SAASA,WAAAA,YAAY,OAAO,mBAAmB,SAAS;AAC5D,UAAM,YAAY,cAAc,EAAE,UAAU;AAE5C,QAAI;AACF,YAAM,MAAM,QAAQ,QAAQ;AAAA,QAC1B,QAAQ;AAAA,QACR,aAAa;AAAA,MAAA,CACd;AAAA,IACH,SAAS,aAAa;AACpB,cAAQ,MAAM,8DAA8D,WAAW;AAAA,IACzF;AAEA,gBAAY,aAA4B,UAAU;AAAA,MAChD,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,WAAW;AAAA,IAAA,CACZ;AAED,QAAI,oBAAoB,OAAO,WAAW,aAAa;AACrD,aAAO,SAAS,OAAO,QAAQ,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,aAAa,UAAU,QAAQ,OAAO,QAAQ,MAAM,CAAC;AAMzD,QAAM,aAAaF,WAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AACrB,QAAM,WAAWE,WAAAA;AAAAA,IACf,OAAO,EAAE,QAAQ,MAAA,IAAU,OAAO;;AAChC,UAAI,OAAO;AACT,YAAI;AACF,gBAAM,UAAU,MAAM,YAAY,WAAW;AAAA,YAC3C;AAAA,YACA;AAAA,YACA,WAAW;AAAA,YACX,OAAO;AAAA,YACP,aAAa;AAAA,UAAA,CACd;AACD,cAAI,QAAQ,SAAS,UAAW,QAAO,QAAQ,KAAK;AAAA,QACtD,QAAQ;AAAA,QAER;AAAA,MACF;AACA,eAAO,gBAAW,YAAX,mBAAoB,gBAAe;AAAA,IAC5C;AAAA,IACA,CAAC,aAAa,UAAU,OAAO;AAAA,EAAA;AAGjC,QAAM,YAA6BD,WAAAA,QAAQ,MAAM;AAC/C,QAAI,SAAS;AACX,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN,QAAQ,YAAY;AAAA,QAAC;AAAA,QACrB;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,MAAM;AAAA,QACN,aAAa;AAAA,QACb,MAAM,CAAA;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,EAAE,MAAM,MAAM,YAAA,IAAgB,eAAe,OAAO;AAE1D,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEJ,GAAG,CAAC,SAAS,SAAS,QAAQ,QAAQ,CAAC;AAEvC,MAAI,UAAU,WAAW;AACvB,WAAOI,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,iCAAuB,KAAA,CAAK;AAAA,EACxC;AAEA,MAAI,CAAC,UAAU,YAAY;AACzB,QAAI,OAAO,mBAAmB,YAAY;AACxC,aAAOD,+BAAAC,WAAAA,UAAA,EAAG,yBAAe,EAAE,QAAQ,UAAU,mBAAmB,MAAA,CAAO,EAAA,CAAE;AAAA,IAC3E;AACA,WAAO,iBAAiBD,2BAAAA,IAAAC,WAAAA,UAAA,EAAG,UAAA,eAAA,CAAe,IAAM;AAAA,EAClD;AAEA,wCACGC,kBAAAA,kBAAkB,UAAlB,EAA2B,OAAO,WAChC,UACH;AAEJ;;"}

package/dist/auth/credential-source.cjs

@@ -1,29 +1,41 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const TOKEN_EXPIRY_SKEW_MS = 3e4;
-function jwtExpiresAtMs(token) {
+function jwtClaims(token) {
   const payload = token.split(".")[1];
   if (!payload) return null;
   try {
     const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
     const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
-    const exp = JSON.parse(atob(padded)).exp;
-    return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : null;
+    const claims = JSON.parse(atob(padded));
+    return typeof claims === "object" && claims !== null && !Array.isArray(claims) ? claims : null;
   } catch {
     return null;
   }
 }
+function jwtExpiresAtMs(token) {
+  var _a;
+  const exp = (_a = jwtClaims(token)) == null ? void 0 : _a.exp;
+  return typeof exp === "number" && Number.isFinite(exp) ? exp * 1e3 : null;
+}
 function jwtSubject(token) {
-  const payload = token.split(".")[1];
-  if (!payload) return null;
-  try {
-    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
-    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
-    const sub = JSON.parse(atob(padded)).sub;
-    return typeof sub === "string" && sub.length > 0 ? sub : null;
-  } catch {
-    return null;
-  }
+  var _a;
+  const sub = (_a = jwtClaims(token)) == null ? void 0 : _a.sub;
+  return typeof sub === "string" && sub.length > 0 ? sub : null;
+}
+function jwtScope(token) {
+  const claims = jwtClaims(token);
+  if (claims === null) return null;
+  const orgMember = claims.org_member_info;
+  const scope = [
+    ["workspace_id", claims.workspace_id],
+    ["org_id", claims.org_id],
+    [
+      "org_member_info.org_id",
+      typeof orgMember === "object" && orgMember !== null ? orgMember.org_id : void 0
+    ]
+  ].filter((entry) => typeof entry[1] === "string" && entry[1].length > 0).map(([claim, value]) => `${claim}=${value}`);
+  return scope.length > 0 ? scope.join("\0") : null;
 }
 function isTokenExpiring(token, now = Date.now()) {
   const expiresAt = jwtExpiresAtMs(token);
@@ -116,5 +128,6 @@ exports.TOKEN_EXPIRY_SKEW_MS = TOKEN_EXPIRY_SKEW_MS;
 exports.createAthenaCredentialSource = createAthenaCredentialSource;
 exports.isTokenExpiring = isTokenExpiring;
 exports.jwtExpiresAtMs = jwtExpiresAtMs;
+exports.jwtScope = jwtScope;
 exports.jwtSubject = jwtSubject;
 //# sourceMappingURL=credential-source.cjs.map