@athenaintel/react 0.53.0 → 0.54.0

package/dist/auth/account-identity.d.ts

@@ -0,0 +1,57 @@
+import { type QueryClient, type UseQueryResult } from '@tanstack/react-query';
+import { type CredentialResolver } from '../runtime/credential-renewal';
+import type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';
+import { type AccountIdentity } from '../threads/api';
+/**
+ * The credential an identity read is sent with, as its key names it: never
+ * the secret itself.
+ */
+export interface AccountIdentityCredential {
+    /** Agora's API base the read goes to. */
+    backendUrl: string;
+    /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */
+    principal: string | undefined;
+    apiKey: string | undefined;
+    /** The token the host holds now. A renewal for the same person and scope keeps the key. */
+    heldToken: string | null | undefined;
+    /** The provider's token getter (`config.getToken`), by identity. */
+    tokenGetter: AthenaStatewireTokenGetter | undefined;
+}
+/** What one read presents, resolved when it is sent; `force` renews a refused token. */
+export interface AccountIdentityAuth {
+    apiKey?: string;
+    token?: string | null;
+}
+/**
+ * The one key a credential's identity is read under, whoever reads it: the
+ * backend, the signed-in person, the API key's fingerprint, the provider's
+ * token getter, who the held token acts as and which workspace it is scoped
+ * to, and the provider's credential identity epoch
+ * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed
+ * out a token that acts as someone else.
+ */
+export declare function accountIdentityQueryKey(credential: AccountIdentityCredential, identityEpoch: number): readonly unknown[];
+/**
+ * The credential's agora identity (`GET /api/v0/me`): one read per credential,
+ * through the query cache, shared by every reader of it. `AthenaChat` (its
+ * mentions workspace and the viewer behind its answer labels) and the session
+ * list (the conversation index it attaches to) read it here under one key
+ * (`accountIdentityQueryKey`), so a page with both sends one request. Never a
+ * process-wide map: the key names the credential and never the secret. A
+ * renewal for the same person and scope keeps the answer; an API-key switch, a
+ * held token scoped to another workspace, or a getter now signing in someone
+ * else, reads `/me` again under a new key, never a cached answer for the
+ * previous credential. The epoch follows the person, not the scope: a getter
+ * that alone hands out the same person's token for another workspace is read
+ * again once the answer goes stale.
+ *
+ * `resolveAuth` presents the credential the key names, so whichever reader
+ * sends the request, the answer is the same. `enabled` is the reader's own.
+ * `queryClient` defaults to the one in context.
+ */
+export declare function useAccountIdentityQuery({ credential, resolveAuth, enabled, queryClient, }: {
+    credential: AccountIdentityCredential;
+    resolveAuth: CredentialResolver<AccountIdentityAuth>;
+    enabled: boolean;
+    queryClient?: QueryClient;
+}): UseQueryResult<AccountIdentity>;

package/dist/auth/account-identity.js

@@ -0,0 +1,69 @@
+import { useQuery } from "@tanstack/react-query";
+import { keyPartFingerprint } from "../lib/use-athena-rest-query.js";
+import { withCredentialRenewal } from "../runtime/credential-renewal.js";
+import { fetchAccountIdentity } from "../threads/api.js";
+import { useAthenaCredentialIdentityEpoch } from "./AthenaCredentialSourceContext.js";
+import { jwtSubject, jwtScope } from "./credential-source.js";
+const tokenGetterIds = /* @__PURE__ */ new WeakMap();
+let lastTokenGetterId = 0;
+function tokenGetterId(getToken) {
+  if (getToken === void 0) return "";
+  let id = tokenGetterIds.get(getToken);
+  if (id === void 0) {
+    lastTokenGetterId += 1;
+    id = lastTokenGetterId;
+    tokenGetterIds.set(getToken, id);
+  }
+  return `getter:${id}`;
+}
+function heldTokenIdentity(token) {
+  if (!token) return "";
+  const subject = jwtSubject(token);
+  if (subject === null) return `token:${keyPartFingerprint(token)}`;
+  const scope = jwtScope(token);
+  return scope === null ? `sub:${keyPartFingerprint(subject)}` : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;
+}
+function accountIdentityQueryKey(credential, identityEpoch) {
+  return [
+    "athena-sdk",
+    "account",
+    credential.backendUrl,
+    credential.principal ?? "",
+    credential.apiKey ? keyPartFingerprint(credential.apiKey) : "",
+    tokenGetterId(credential.tokenGetter),
+    heldTokenIdentity(credential.heldToken),
+    identityEpoch
+  ];
+}
+const NO_RETRY_STATUSES = /* @__PURE__ */ new Set([401, 403, 404, 405, 409]);
+function retryTransient(failureCount, error) {
+  const status = Reflect.get(error, "status");
+  if (typeof status === "number" && NO_RETRY_STATUSES.has(status)) return false;
+  return failureCount < 2;
+}
+function useAccountIdentityQuery({
+  credential,
+  resolveAuth,
+  enabled,
+  queryClient
+}) {
+  const identityEpoch = useAthenaCredentialIdentityEpoch();
+  return useQuery(
+    {
+      queryKey: accountIdentityQueryKey(credential, identityEpoch),
+      queryFn: ({ signal }) => withCredentialRenewal(
+        resolveAuth,
+        (auth) => fetchAccountIdentity(credential.backendUrl, auth, { signal })
+      ),
+      enabled,
+      retry: retryTransient,
+      staleTime: 6e4
+    },
+    queryClient
+  );
+}
+export {
+  accountIdentityQueryKey,
+  useAccountIdentityQuery
+};
+//# sourceMappingURL=account-identity.js.map

package/dist/auth/account-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-identity.js","sources":["../../src/auth/account-identity.ts"],"sourcesContent":["import { type QueryClient, type UseQueryResult, useQuery } from '@tanstack/react-query';\nimport { keyPartFingerprint } from '../lib/use-athena-rest-query';\nimport { type CredentialResolver, withCredentialRenewal } from '../runtime/credential-renewal';\nimport type { AthenaStatewireTokenGetter } from '../runtime/statewire-auth-headers';\nimport { type AccountIdentity, fetchAccountIdentity } from '../threads/api';\nimport { useAthenaCredentialIdentityEpoch } from './AthenaCredentialSourceContext';\nimport { jwtScope, jwtSubject } from './credential-source';\n\n/**\n * The credential an identity read is sent with, as its key names it: never\n * the secret itself.\n */\nexport interface AccountIdentityCredential {\n  /** Agora's API base the read goes to. */\n  backendUrl: string;\n  /** The signed-in person (`AthenaAuthContext`'s user id), when one is. */\n  principal: string | undefined;\n  apiKey: string | undefined;\n  /** The token the host holds now. A renewal for the same person and scope keeps the key. */\n  heldToken: string | null | undefined;\n  /** The provider's token getter (`config.getToken`), by identity. */\n  tokenGetter: AthenaStatewireTokenGetter | undefined;\n}\n\n/** What one read presents, resolved when it is sent; `force` renews a refused token. */\nexport interface AccountIdentityAuth {\n  apiKey?: string;\n  token?: string | null;\n}\n\n/** One id per token getter, so the key can name a getter without holding it. */\nconst tokenGetterIds = new WeakMap<AthenaStatewireTokenGetter, number>();\nlet lastTokenGetterId = 0;\n\nfunction tokenGetterId(getToken: AthenaStatewireTokenGetter | undefined): string {\n  if (getToken === undefined) return '';\n  let id = tokenGetterIds.get(getToken);\n  if (id === undefined) {\n    lastTokenGetterId += 1;\n    id = lastTokenGetterId;\n    tokenGetterIds.set(getToken, id);\n  }\n  return `getter:${id}`;\n}\n\n/**\n * Who a held token acts as, and where, without the token: its JWT subject and\n * the claims scoping it to a workspace or org (`jwtScope`), or the token\n * itself when it is opaque, fingerprinted. A renewal for the same person and\n * scope keeps it, so a rotation is not a new identity; the same person's token\n * scoped to another workspace is.\n */\nfunction heldTokenIdentity(token: string | null | undefined): string {\n  if (!token) return '';\n  const subject = jwtSubject(token);\n  if (subject === null) return `token:${keyPartFingerprint(token)}`;\n  const scope = jwtScope(token);\n  return scope === null\n    ? `sub:${keyPartFingerprint(subject)}`\n    : `sub:${keyPartFingerprint(subject)}|scope:${keyPartFingerprint(scope)}`;\n}\n\n/**\n * The one key a credential's identity is read under, whoever reads it: the\n * backend, the signed-in person, the API key's fingerprint, the provider's\n * token getter, who the held token acts as and which workspace it is scoped\n * to, and the provider's credential identity epoch\n * (`useAthenaCredentialIdentityEpoch`), which moves once the getter has handed\n * out a token that acts as someone else.\n */\nexport function accountIdentityQueryKey(\n  credential: AccountIdentityCredential,\n  identityEpoch: number,\n): readonly unknown[] {\n  return [\n    'athena-sdk',\n    'account',\n    credential.backendUrl,\n    credential.principal ?? '',\n    credential.apiKey ? keyPartFingerprint(credential.apiKey) : '',\n    tokenGetterId(credential.tokenGetter),\n    heldTokenIdentity(credential.heldToken),\n    identityEpoch,\n  ];\n}\n\n/** A refusal, or a route an older agora lacks, answers the same way again. */\nconst NO_RETRY_STATUSES: ReadonlySet<number> = new Set([401, 403, 404, 405, 409]);\n\n/** Retry a transient failure twice; never a refused credential. */\nfunction retryTransient(failureCount: number, error: Error): boolean {\n  const status: unknown = Reflect.get(error, 'status');\n  if (typeof status === 'number' && NO_RETRY_STATUSES.has(status)) return false;\n  return failureCount < 2;\n}\n\n/**\n * The credential's agora identity (`GET /api/v0/me`): one read per credential,\n * through the query cache, shared by every reader of it. `AthenaChat` (its\n * mentions workspace and the viewer behind its answer labels) and the session\n * list (the conversation index it attaches to) read it here under one key\n * (`accountIdentityQueryKey`), so a page with both sends one request. Never a\n * process-wide map: the key names the credential and never the secret. A\n * renewal for the same person and scope keeps the answer; an API-key switch, a\n * held token scoped to another workspace, or a getter now signing in someone\n * else, reads `/me` again under a new key, never a cached answer for the\n * previous credential. The epoch follows the person, not the scope: a getter\n * that alone hands out the same person's token for another workspace is read\n * again once the answer goes stale.\n *\n * `resolveAuth` presents the credential the key names, so whichever reader\n * sends the request, the answer is the same. `enabled` is the reader's own.\n * `queryClient` defaults to the one in context.\n */\nexport function useAccountIdentityQuery({\n  credential,\n  resolveAuth,\n  enabled,\n  queryClient,\n}: {\n  credential: AccountIdentityCredential;\n  resolveAuth: CredentialResolver<AccountIdentityAuth>;\n  enabled: boolean;\n  queryClient?: QueryClient;\n}): UseQueryResult<AccountIdentity> {\n  const identityEpoch = useAthenaCredentialIdentityEpoch();\n  return useQuery(\n    {\n      queryKey: accountIdentityQueryKey(credential, identityEpoch),\n      queryFn: ({ signal }) =>\n        withCredentialRenewal(resolveAuth, (auth) =>\n          fetchAccountIdentity(credential.backendUrl, auth, { signal }),\n        ),\n      enabled,\n      retry: retryTransient,\n      staleTime: 60_000,\n    },\n    queryClient,\n  );\n}\n"],"names":[],"mappings":";;;;;;AA+BA,MAAM,qCAAqB,QAAA;AAC3B,IAAI,oBAAoB;AAExB,SAAS,cAAc,UAA0D;AAC/E,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,KAAK,eAAe,IAAI,QAAQ;AACpC,MAAI,OAAO,QAAW;AACpB,yBAAqB;AACrB,SAAK;AACL,mBAAe,IAAI,UAAU,EAAE;AAAA,EACjC;AACA,SAAO,UAAU,EAAE;AACrB;AASA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,KAAM,QAAO,SAAS,mBAAmB,KAAK,CAAC;AAC/D,QAAM,QAAQ,SAAS,KAAK;AAC5B,SAAO,UAAU,OACb,OAAO,mBAAmB,OAAO,CAAC,KAClC,OAAO,mBAAmB,OAAO,CAAC,UAAU,mBAAmB,KAAK,CAAC;AAC3E;AAUO,SAAS,wBACd,YACA,eACoB;AACpB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,WAAW,aAAa;AAAA,IACxB,WAAW,SAAS,mBAAmB,WAAW,MAAM,IAAI;AAAA,IAC5D,cAAc,WAAW,WAAW;AAAA,IACpC,kBAAkB,WAAW,SAAS;AAAA,IACtC;AAAA,EAAA;AAEJ;AAGA,MAAM,wCAA6C,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AAGhF,SAAS,eAAe,cAAsB,OAAuB;AACnE,QAAM,SAAkB,QAAQ,IAAI,OAAO,QAAQ;AACnD,MAAI,OAAO,WAAW,YAAY,kBAAkB,IAAI,MAAM,EAAG,QAAO;AACxE,SAAO,eAAe;AACxB;AAoBO,SAAS,wBAAwB;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKoC;AAClC,QAAM,gBAAgB,iCAAA;AACtB,SAAO;AAAA,IACL;AAAA,MACE,UAAU,wBAAwB,YAAY,aAAa;AAAA,MAC3D,SAAS,CAAC,EAAE,OAAA,MACV;AAAA,QAAsB;AAAA,QAAa,CAAC,SAClC,qBAAqB,WAAW,YAAY,MAAM,EAAE,QAAQ;AAAA,MAAA;AAAA,MAEhE;AAAA,MACA,OAAO;AAAA,MACP,WAAW;AAAA,IAAA;AAAA,IAEb;AAAA,EAAA;AAEJ;"}

package/dist/chat/AthenaChat.cjs

@@ -1253,7 +1253,7 @@ const AthenaUserMessage = ({
       children: [
         /* @__PURE__ */ jsxRuntime.jsx(MessageDaySeparator, {}),
         /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "flex min-w-0 max-w-[75%] flex-col items-end gap-1", children: [
-          /* @__PURE__ */ jsxRuntime.jsx("div", { className: "aui-user-message-content wrap-break-word rounded-2xl bg-muted/70 px-4 py-2.5 text-foreground", children: /* @__PURE__ */ jsxRuntime.jsx(messageImages.MessageImageGallery, { children: /* @__PURE__ */ jsxRuntime.jsx(react.MessagePrimitive.Parts, { components: partComponents }) }) }),
+          /* @__PURE__ */ jsxRuntime.jsx("div", { className: "aui-user-message-content wrap-break-word min-w-0 max-w-full rounded-2xl bg-muted/70 px-4 py-2.5 text-foreground", children: /* @__PURE__ */ jsxRuntime.jsx(messageImages.MessageImageGallery, { children: /* @__PURE__ */ jsxRuntime.jsx(react.MessagePrimitive.Parts, { components: partComponents }) }) }),
           /* @__PURE__ */ jsxRuntime.jsxs("div", { className: "aui-user-message-footer -mr-1 flex items-center gap-1", children: [
             /* @__PURE__ */ jsxRuntime.jsx(MessageTimestamp, { className: "mr-1 group-hover/aui-user-message:opacity-100" }),
             /* @__PURE__ */ jsxRuntime.jsx(messageComponents.BranchPicker, {}),